add: bph report iocs

1 files changed, 100 insertions, 0 deletions

diff --git a/kevlar/2026-08-31/sponge/ip-sessions/session_search_20260831T113641_4a246a7f.ndjson b/kevlar/2026-08-31/sponge/ip-sessions/session_search_20260831T113641_4a246a7f.ndjson
new file mode 100644
index 0000000..5ae0c98
--- /dev/null
+++ b/kevlar/2026-08-31/sponge/ip-sessions/session_search_20260831T113641_4a246a7f.ndjson
@@ -0,0 +1,100 @@
+{"@timestamp":1788151895083,"_id":"260831-b8sos4_6_XJMjo9le_g3pm3q","_index":"arkime_sessions3-260831","client":{"bytes":261},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo GmbH"],"isp.dstCnt":1,"isp.src":["FlokiNET Ltd"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["FlokiNET Ltd"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS51167 Contabo GmbH","number":51167,"organization":{"name":"Contabo GmbH"}},"bytes":345,"geo":{"country_iso_code":"FR"},"ip":"109.123.246.142","mac":["00:50:56:63:46:a6"],"mac-cnt":1,"packets":5,"port":443},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstPayload8":"15030300020250","dstRIR":"RIPE","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[82288],"firstPacket":1788150641138,"initRTT":517,"ipProtocol":6,"lastPacket":1788150642298,"length":1160,"network":{"bytes":1010,"community_id":"1:/8pF2jwPkFPZBe1/ZMhuqU+QIB4=","packets":11},"node":"spark-afae","packetPos":[-82288,90774,90,180,82,343,82,89,82,0,0,0],"packetRange":{"gte":1788150641138,"lte":1788150642298},"protocol":["tcp","tls"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":7},"source":{"as":{"full":"AS200651 FlokiNET ehf","number":200651,"organization":{"name":"FlokiNET ehf"}},"bytes":665,"geo":{"country_iso_code":"RO"},"ip":"185.100.87.136","mac":["c0:69:11:cd:1f:19","00:c0:1d:c0:ff:ee"],"mac-cnt":2,"packets":6,"port":59462},"srcOui":["Arista Networks","Grand Junction Networks, Inc."],"srcOuiCnt":2,"srcPayload8":"1603010100010000","srcRIR":"RIPE","srcTTL":[49],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["311926472371616"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["ac32bdeb-b49d-4079-9e6b-8fbca5e0addf"],"signatureCnt":1,"signatureId":[1031336],"signatureIdCnt":1},"tag":{"block":["false"],"blockCnt":1,"category":["protocol"],"categoryCnt":1,"description":["ip addresses with this tag have been observed attempting to opportunistically crawl the internet and establish tls/ssl connections."],"intention":["unknown"],"intentionCnt":1,"name":["tls/ssl crawler"],"nameCnt":1},"tags":["contabo-sponge-02-ts","sensor:contabo-sponge-02-ts","proxy"],"tagsCnt":3,"tcp":{"ja4ls":"70_64_451","ja4t":["64240_2-4-8-1-3_1460_7"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":5,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":2,"psh":2,"rst":0,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":669497660},"tls":{"ja3":["7c1e207beb00684bbbe144f1b0abe1d5"],"ja3Cnt":1,"ja3string":["771,52392-52393-49199-49200-49195-49196-49171-49161-49172-49162-156-157-47-53-49170-10-4867-4865-4866,5-10-11-13-65281-16-18-43-51,29-23-24-25,0"],"ja3stringCnt":1,"ja4":["t13i1909h2_9dc949149365_97f8aa674fd9"],"ja4Cnt":1,"ja4_r":["t13i1909h2_000a,002f,0035,009c,009d,1301,1302,1303,c009,c00a,c012,c013,c014,c02b,c02c,c02f,c030,cca8,cca9_0005,000a,000b,000d,0012,002b,0033,ff01_0804,0403,0807,0805,0806,0401,0501,0601,0503,0603,0201,0203"],"ja4_rCnt":1,"srcSessionId":["5d8f6e3e84ecb3102756cc8e260f76ba5268fc5df692da9e548a2e3c0ec46765"]},"totDataBytes":268}
+{"@timestamp":1788147983883,"_id":"260831-8juBStNpGqdDiK1XQCOzdUNp","_index":"arkime_sessions3-260831","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Kaopu Cloud HK Limited"],"isp.dstCnt":1,"isp.src":["FlokiNET Ltd"],"isp.srcCnt":1,"org.dst":["LightNode-BH"],"org.dstCnt":1,"org.src":["FlokiNET Ltd"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":0,"geo":{"country_iso_code":"BH"},"ip":"38.54.2.209","mac":["52:54:8f:9d:76:48"],"mac-cnt":1,"packets":0,"port":443},"dstRIR":"ARIN","ethertype":2048,"fileId":[82263],"firstPacket":1788147741756,"ipProtocol":6,"lastPacket":1788147741756,"length":0,"network":{"bytes":66,"community_id":"1:r0RGyh+rNI0g5vZSkAY7j6uxPDA=","packets":1},"node":"spark-afae","packetPos":[-82263,513221],"packetRange":{"gte":1788147741756,"lte":1788147741756},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS200651 FlokiNET ehf","number":200651,"organization":{"name":"FlokiNET ehf"}},"bytes":66,"geo":{"country_iso_code":"RO"},"ip":"185.100.87.136","mac":["98:44:ce:60:15:19"],"mac-cnt":1,"packets":1,"port":55362},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Huawei Technologies Co.,Ltd"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[52],"srcTTLCnt":1,"tags":["bahrain-sponge-01-ts","sensor:bahrain-sponge-01-ts","honeypot"],"tagsCnt":3,"tcp":{"ja4t":["65535_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":3438602577},"totDataBytes":0}
+{"@timestamp":1788147976304,"_id":"260831-GMvU6zBkWOpJaaC0LrlLYIwH","_index":"arkime_sessions3-260831","client":{"bytes":261},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["FlokiNET Ltd"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["FlokiNET Ltd"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":345,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":5,"port":443},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstPayload8":"15030300020250","dstRIR":"RIPE","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[82264],"firstPacket":1788146893336,"initRTT":589,"ipProtocol":6,"lastPacket":1788146894852,"length":1516,"network":{"bytes":1084,"community_id":"1:S7cYxStXzLMVEZWmLXqg3+wNs9o=","packets":12},"node":"spark-afae","packetPos":[-82264,289955,90,2554,1772,82,343,82,89,82,0,0,0],"packetRange":{"gte":1788146893336,"lte":1788146894852},"protocol":["tls","tcp"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":7},"source":{"as":{"full":"AS200651 FlokiNET ehf","number":200651,"organization":{"name":"FlokiNET ehf"}},"bytes":739,"geo":{"country_iso_code":"RO"},"ip":"185.100.87.136","mac":["fc:bd:67:9d:2b:2b","00:c0:1d:c0:ff:ee"],"mac-cnt":2,"packets":7,"port":48942},"srcOui":["Arista Networks","Grand Junction Networks, Inc."],"srcOuiCnt":2,"srcPayload8":"1603010100010000","srcRIR":"RIPE","srcTTL":[55],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["1443912164571305"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["ac32bdeb-b49d-4079-9e6b-8fbca5e0addf"],"signatureCnt":1,"signatureId":[1031336],"signatureIdCnt":1},"tag":{"block":["false"],"blockCnt":1,"category":["protocol"],"categoryCnt":1,"description":["ip addresses with this tag have been observed attempting to opportunistically crawl the internet and establish tls/ssl connections."],"intention":["unknown"],"intentionCnt":1,"name":["tls/ssl crawler"],"nameCnt":1},"tags":["contabo-sponge-01-ts","sensor:contabo-sponge-01-ts","honeypot"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-4-8-1-3_1460_7"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":5,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":2,"psh":2,"rst":0,"srcZero":0,"syn":2,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":2999751579},"tls":{"ja3":["7c1e207beb00684bbbe144f1b0abe1d5"],"ja3Cnt":1,"ja3string":["771,52392-52393-49199-49200-49195-49196-49171-49161-49172-49162-156-157-47-53-49170-10-4867-4865-4866,5-10-11-13-65281-16-18-43-51,29-23-24-25,0"],"ja3stringCnt":1,"ja4":["t13i1909h2_9dc949149365_97f8aa674fd9"],"ja4Cnt":1,"ja4_r":["t13i1909h2_000a,002f,0035,009c,009d,1301,1302,1303,c009,c00a,c012,c013,c014,c02b,c02c,c02f,c030,cca8,cca9_0005,000a,000b,000d,0012,002b,0033,ff01_0804,0403,0807,0805,0806,0401,0501,0601,0503,0603,0201,0203"],"ja4_rCnt":1,"srcSessionId":["116fdd23cdc2eabe26270380a5ca59a24f9fc8aac1decdff8c569c0970418f83"]},"totDataBytes":268}
+{"@timestamp":1788145253446,"_id":"260831-wMqgNi8v_5dAvYtvcBQ64bbK","_index":"arkime_sessions3-260831","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Hetzner Online GmbH"],"isp.dstCnt":1,"isp.src":["FlokiNET Ltd"],"isp.srcCnt":1,"org.dst":["HETZNER-DC"],"org.dstCnt":1,"org.src":["FlokiNET Ltd"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS24940 Hetzner Online GmbH","number":24940,"organization":{"name":"Hetzner Online GmbH"}},"bytes":0,"geo":{"country_iso_code":"FI"},"ip":"89.167.72.144","mac":["92:00:07:4c:82:70"],"mac-cnt":1,"packets":0,"port":443},"dstRIR":"RIPE","ethertype":2048,"fileId":[82243],"firstPacket":1788144557944,"ipProtocol":6,"lastPacket":1788144557944,"length":0,"network":{"bytes":66,"community_id":"1:WstRldGNl/Tses71qOYJq/i5Msc=","packets":1},"node":"spark-afae","packetPos":[-82243,221487],"packetRange":{"gte":1788144557944,"lte":1788144557944},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS200651 FlokiNET ehf","number":200651,"organization":{"name":"FlokiNET ehf"}},"bytes":66,"geo":{"country_iso_code":"RO"},"ip":"185.100.87.136","mac":["d2:74:7f:6e:37:e3"],"mac-cnt":1,"packets":1,"port":57465},"spoofable":["true"],"spoofableCnt":1,"srcRIR":"RIPE","srcTTL":[56],"srcTTLCnt":1,"tags":["sensor:sponge-01-ts","sponge-01-ts","honeypot"],"tagsCnt":3,"tcp":{"ja4t":["65535_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":645996698},"totDataBytes":0}
+{"@timestamp":1788143740278,"_id":"260831-n8odzpCyrqxDYIE5KuKGUsmn","_index":"arkime_sessions3-260831","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo GmbH"],"isp.dstCnt":1,"isp.src":["FlokiNET Ltd"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["FlokiNET Ltd"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS51167 Contabo GmbH","number":51167,"organization":{"name":"Contabo GmbH"}},"bytes":66,"geo":{"country_iso_code":"FR"},"ip":"109.123.246.142","mac":["00:50:56:63:46:a6"],"mac-cnt":1,"packets":1,"port":443},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[82233],"firstPacket":1788143085566,"ipProtocol":6,"lastPacket":1788143086653,"length":1087,"network":{"bytes":192,"community_id":"1:EfS2EPHz57ioflRkIRbQeONlP9w=","packets":3},"node":"spark-afae","packetPos":[-82233,173103,82,164],"packetRange":{"gte":1788143085566,"lte":1788143086653},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS200651 FlokiNET ehf","number":200651,"organization":{"name":"FlokiNET ehf"}},"bytes":126,"geo":{"country_iso_code":"RO"},"ip":"185.100.87.136","mac":["c0:69:11:cd:1f:19","00:c0:1d:c0:ff:ee"],"mac-cnt":2,"packets":2,"port":34967},"srcOui":["Grand Junction Networks, Inc.","Arista Networks"],"srcOuiCnt":2,"srcRIR":"RIPE","srcTTL":[49],"srcTTLCnt":1,"tags":["proxy","sensor:contabo-sponge-02-ts","contabo-sponge-02-ts"],"tagsCnt":3,"tcp":{"ja4t":["65535_2-1-3-1-1-4_1460_8"],"ja4tCnt":1,"ja4ts":["64240_2-1-1-4-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":672423617},"totDataBytes":0}
+{"@timestamp":1788142532846,"_id":"260831-LDtVIBO8Jr1Bmo8tRUqqfmhE","_index":"arkime_sessions3-260831","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["FlokiNET Ltd"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["FlokiNET Ltd"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":66,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":1,"port":443},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[82226],"firstPacket":1788141346664,"ipProtocol":6,"lastPacket":1788141347842,"length":1178,"network":{"bytes":192,"community_id":"1:X05Jfot6WybiZGSlXeYgetYpniM=","packets":3},"node":"spark-afae","packetPos":[-82226,133709,82,1798],"packetRange":{"gte":1788141346664,"lte":1788141347842},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS200651 FlokiNET ehf","number":200651,"organization":{"name":"FlokiNET ehf"}},"bytes":126,"geo":{"country_iso_code":"RO"},"ip":"185.100.87.136","mac":["fc:bd:67:9d:2b:2b","00:c0:1d:c0:ff:ee"],"mac-cnt":2,"packets":2,"port":33464},"srcOui":["Arista Networks","Grand Junction Networks, Inc."],"srcOuiCnt":2,"srcRIR":"RIPE","srcTTL":[56],"srcTTLCnt":1,"tags":["sensor:contabo-sponge-01-ts","honeypot","contabo-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["65535_2-1-3-1-1-4_1460_8"],"ja4tCnt":1,"ja4ts":["64240_2-1-1-4-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":1698696913},"totDataBytes":0}
+{"@timestamp":1788140393682,"_id":"260831-Usp8AoYm2ZdHqaPNhcCdp8rI","_index":"arkime_sessions3-260831","client":{"bytes":261},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["FlokiNET Ltd"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["FlokiNET Ltd"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":441,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":5,"port":443},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstPayload8":"485454502f312e31","dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[82212],"firstPacket":1788139583711,"http":{"bodyMagic":["text/plain"],"bodyMagicCnt":1,"md5":["6196dba52703776af2e6593f772ed7ce"],"md5Cnt":1,"responseHeader":["content-type","connection"],"responseHeaderCnt":2,"responseHeaderField":["content-type","connection"],"responseHeaderValue":["text/plain; charset=utf-8","close"],"responseHeaderValueCnt":2,"serverVersion":["1.1"],"serverVersionCnt":1,"sha256":["19b843cc92cb12aa314bb3c3913b2feeb852e85969bf06cb9d096931bfda34ba"],"sha256Cnt":1,"statuscode":[400],"statuscodeCnt":1},"initRTT":607,"ipProtocol":6,"lastPacket":1788139585206,"length":1495,"network":{"bytes":1180,"community_id":"1:iUpkP9W5aHLyOWKLKP18rExpW7c=","packets":12},"node":"spark-afae","packetPos":[-82212,3740410,90,860,320,82,343,82,185,82,0,0,0],"packetRange":{"gte":1788139583711,"lte":1788139585206},"protocol":["tcp","tls","http"],"protocolCnt":3,"segmentCnt":1,"server":{"bytes":103},"source":{"as":{"full":"AS200651 FlokiNET ehf","number":200651,"organization":{"name":"FlokiNET ehf"}},"bytes":739,"geo":{"country_iso_code":"RO"},"ip":"185.100.87.136","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":7,"port":50320},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcPayload8":"1603010100010000","srcRIR":"RIPE","srcTTL":[53],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["2211464182965309"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["ac32bdeb-b49d-4079-9e6b-8fbca5e0addf"],"signatureCnt":1,"signatureId":[1031336],"signatureIdCnt":1},"tag":{"block":["false"],"blockCnt":1,"category":["protocol"],"categoryCnt":1,"description":["ip addresses with this tag have been observed attempting to opportunistically crawl the internet and establish tls/ssl connections."],"intention":["unknown"],"intentionCnt":1,"name":["tls/ssl crawler"],"nameCnt":1},"tags":["honeypot","frantech-ts","sensor:frantech-ts"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-4-8-1-3_1400_7"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":5,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":2,"psh":2,"rst":0,"srcZero":0,"syn":2,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":3120997093},"tls":{"ja3":["7c1e207beb00684bbbe144f1b0abe1d5"],"ja3Cnt":1,"ja3string":["771,52392-52393-49199-49200-49195-49196-49171-49161-49172-49162-156-157-47-53-49170-10-4867-4865-4866,5-10-11-13-65281-16-18-43-51,29-23-24-25,0"],"ja3stringCnt":1,"ja4":["t13i1909h2_9dc949149365_97f8aa674fd9"],"ja4Cnt":1,"ja4_r":["t13i1909h2_000a,002f,0035,009c,009d,1301,1302,1303,c009,c00a,c012,c013,c014,c02b,c02c,c02f,c030,cca8,cca9_0005,000a,000b,000d,0012,002b,0033,ff01_0804,0403,0807,0805,0806,0401,0501,0601,0503,0603,0201,0203"],"ja4_rCnt":1,"srcSessionId":["72da08838773043261ad10b1b9ef56a58a81a174dc7d4f3e6019feda8d545d90"]},"totDataBytes":364}
+{"@timestamp":1788138586359,"_id":"260831-qDrPUkEGsN5C4pu3PHdifEV_","_index":"arkime_sessions3-260831","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["FlokiNET Ltd"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["FlokiNET Ltd"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":66,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":1,"port":443},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[82200],"firstPacket":1788137940617,"ipProtocol":6,"lastPacket":1788137941790,"length":1173,"network":{"bytes":186,"community_id":"1:lT8//AtXQuciWqv23BUfR+/3tsY=","packets":3},"node":"spark-afae","packetPos":[-82200,2311967,82,584],"packetRange":{"gte":1788137940617,"lte":1788137941790},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS200651 FlokiNET ehf","number":200651,"organization":{"name":"FlokiNET ehf"}},"bytes":120,"geo":{"country_iso_code":"RO"},"ip":"185.100.87.136","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":2,"port":37392},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[53],"srcTTLCnt":1,"tags":["honeypot","sensor:frantech-ts","frantech-ts"],"tagsCnt":3,"tcp":{"ja4t":["65535_2-1-3-1-1-4_1400_8"],"ja4tCnt":1,"ja4ts":["64240_2-1-1-4-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":2216535769},"totDataBytes":0}
+{"@timestamp":1788137386515,"_id":"260831-j0RdJyVQQ9NI7pD-QNYEnlOo","_index":"arkime_sessions3-260831","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["netcup GmbH"],"isp.dstCnt":1,"isp.src":["FlokiNET Ltd"],"isp.srcCnt":1,"org.dst":["Netcup KVM"],"org.dstCnt":1,"org.src":["FlokiNET Ltd"],"org.srcCnt":1,"usertype.dst":["business"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS197540 netcup GmbH","number":197540,"organization":{"name":"netcup GmbH"}},"bytes":0,"geo":{"country_iso_code":"DE"},"ip":"159.195.21.150","mac":["8a:41:d3:b8:0d:d3"],"mac-cnt":1,"packets":0,"port":443},"dstRIR":"ARIN","ethertype":2048,"fileId":[82192],"firstPacket":1788137014257,"ipProtocol":6,"lastPacket":1788137014257,"length":0,"network":{"bytes":66,"community_id":"1:6JXV7nO2M8+Xr+nbGq9jCmhtSIw=","packets":1},"node":"spark-afae","packetPos":[-82192,415772],"packetRange":{"gte":1788137014257,"lte":1788137014257},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS200651 FlokiNET ehf","number":200651,"organization":{"name":"FlokiNET ehf"}},"bytes":66,"geo":{"country_iso_code":"RO"},"ip":"185.100.87.136","mac":["bc:0f:fe:3d:a3:a7"],"mac-cnt":1,"packets":1,"port":46854},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[53],"srcTTLCnt":1,"tags":["sensor:netcup-ts","honeypot","netcup-ts"],"tagsCnt":3,"tcp":{"ja4t":["65535_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":1824310592},"totDataBytes":0}
+{"@timestamp":1787932705566,"_id":"260828-LjxoBwhXIYpBBa00Umu--72T","_index":"arkime_sessions3-260828","client":{"bytes":261},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["FlokiNET Ltd"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["FlokiNET Ltd"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":441,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":5,"port":443},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstPayload8":"485454502f312e31","dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[80820],"firstPacket":1787931973293,"http":{"bodyMagic":["text/plain"],"bodyMagicCnt":1,"md5":["6196dba52703776af2e6593f772ed7ce"],"md5Cnt":1,"responseHeader":["connection","content-type"],"responseHeaderCnt":2,"responseHeaderField":["content-type","connection"],"responseHeaderValue":["text/plain; charset=utf-8","close"],"responseHeaderValueCnt":2,"serverVersion":["1.1"],"serverVersionCnt":1,"sha256":["19b843cc92cb12aa314bb3c3913b2feeb852e85969bf06cb9d096931bfda34ba"],"sha256Cnt":1,"statuscode":[400],"statuscodeCnt":1},"initRTT":599,"ipProtocol":6,"lastPacket":1787931974771,"length":1478,"network":{"bytes":1192,"community_id":"1:XjgJKmaQcyj1xcPNijj+MO1byg8=","packets":12},"node":"spark-afae","packetPos":[-80820,5574804,90,13691,3737,82,343,82,185,4680,94,418,82],"packetRange":{"gte":1787931973293,"lte":1787931974771},"protocol":["http","tls","tcp"],"protocolCnt":3,"segmentCnt":1,"server":{"bytes":103},"source":{"as":{"full":"AS200651 FlokiNET ehf","number":200651,"organization":{"name":"FlokiNET ehf"}},"bytes":751,"geo":{"country_iso_code":"RO"},"ip":"185.100.87.136","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":7,"port":53378},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcPayload8":"1603010100010000","srcRIR":"RIPE","srcTTL":[53],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["1541417280453656"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["ac32bdeb-b49d-4079-9e6b-8fbca5e0addf"],"signatureCnt":1,"signatureId":[1031336],"signatureIdCnt":1},"tag":{"block":["false"],"blockCnt":1,"category":["protocol"],"categoryCnt":1,"description":["ip addresses with this tag have been observed attempting to opportunistically crawl the internet and establish tls/ssl connections."],"intention":["unknown"],"intentionCnt":1,"name":["tls/ssl crawler"],"nameCnt":1},"tags":["sensor:frantech-ts","honeypot","frantech-ts"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-4-8-1-3_1400_7"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":5,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":2,"psh":2,"rst":0,"srcZero":0,"syn":2,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":3878915599},"tls":{"ja3":["7c1e207beb00684bbbe144f1b0abe1d5"],"ja3Cnt":1,"ja3string":["771,52392-52393-49199-49200-49195-49196-49171-49161-49172-49162-156-157-47-53-49170-10-4867-4865-4866,5-10-11-13-65281-16-18-43-51,29-23-24-25,0"],"ja3stringCnt":1,"ja4":["t13i1909h2_9dc949149365_97f8aa674fd9"],"ja4Cnt":1,"ja4_r":["t13i1909h2_000a,002f,0035,009c,009d,1301,1302,1303,c009,c00a,c012,c013,c014,c02b,c02c,c02f,c030,cca8,cca9_0005,000a,000b,000d,0012,002b,0033,ff01_0804,0403,0807,0805,0806,0401,0501,0601,0503,0603,0201,0203"],"ja4_rCnt":1,"srcSessionId":["fd8bd6da22de1932d574a7f59752bc8fbe5090533f8b1faf31e8eb24693bc13f"]},"totDataBytes":364}
+{"@timestamp":1787928466724,"_id":"260828-ebTw46KTDMxKmqhFb39CaBmA","_index":"arkime_sessions3-260828","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo GmbH"],"isp.dstCnt":1,"isp.src":["FlokiNET Ltd"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["FlokiNET Ltd"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS51167 Contabo GmbH","number":51167,"organization":{"name":"Contabo GmbH"}},"bytes":0,"geo":{"country_iso_code":"FR"},"ip":"109.123.246.142","mac":["00:50:56:63:46:a6"],"mac-cnt":1,"packets":0,"port":443},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[80790],"firstPacket":1787927815005,"ipProtocol":6,"lastPacket":1787927815005,"length":0,"network":{"bytes":66,"community_id":"1:MBWf9lyNxx5pOf7DPvj475cedEI=","packets":1},"node":"spark-afae","packetPos":[-80790,1441017],"packetRange":{"gte":1787927815005,"lte":1787927815005},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS200651 FlokiNET ehf","number":200651,"organization":{"name":"FlokiNET ehf"}},"bytes":66,"geo":{"country_iso_code":"RO"},"ip":"185.100.87.136","mac":["c0:69:11:cd:1f:19"],"mac-cnt":1,"packets":1,"port":46158},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[49],"srcTTLCnt":1,"tags":["proxy","sensor:contabo-sponge-02-ts","contabo-sponge-02-ts"],"tagsCnt":3,"tcp":{"ja4t":["65535_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":85030270},"totDataBytes":0}
+{"@timestamp":1787926033629,"_id":"260828-9Bzylnv8AkNIJqDxfoRaXhZ6","_index":"arkime_sessions3-260828","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["FlokiNET Ltd"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["FlokiNET Ltd"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":66,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":1,"port":443},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[80763],"firstPacket":1787925657873,"ipProtocol":6,"lastPacket":1787925659100,"length":1227,"network":{"bytes":186,"community_id":"1:78ahmVAFioDCNMVhKEHZpmuLRoE=","packets":3},"node":"spark-afae","packetPos":[-80763,3652799,82,16489],"packetRange":{"gte":1787925657873,"lte":1787925659100},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS200651 FlokiNET ehf","number":200651,"organization":{"name":"FlokiNET ehf"}},"bytes":120,"geo":{"country_iso_code":"RO"},"ip":"185.100.87.136","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":2,"port":46668},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[52],"srcTTLCnt":1,"tags":["honeypot","frantech-ts","sensor:frantech-ts"],"tagsCnt":3,"tcp":{"ja4t":["65535_2-1-3-1-1-4_1400_8"],"ja4tCnt":1,"ja4ts":["64240_2-1-1-4-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":3068274095},"totDataBytes":0}
+{"@timestamp":1787926033920,"_id":"260828-IbQR78oQM1hNtrd-Ee7glrt7","_index":"arkime_sessions3-260828","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Hetzner Online GmbH"],"isp.dstCnt":1,"isp.src":["FlokiNET Ltd"],"isp.srcCnt":1,"org.dst":["HETZNER-DC"],"org.dstCnt":1,"org.src":["FlokiNET Ltd"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS24940 Hetzner Online GmbH","number":24940,"organization":{"name":"Hetzner Online GmbH"}},"bytes":0,"geo":{"country_iso_code":"FI"},"ip":"89.167.72.144","mac":["92:00:07:4c:82:70"],"mac-cnt":1,"packets":0,"port":443},"dstRIR":"RIPE","ethertype":2048,"fileId":[80762],"firstPacket":1787925567945,"ipProtocol":6,"lastPacket":1787925567945,"length":0,"network":{"bytes":66,"community_id":"1:tcN43CdySNJ3w7+i20tfhzxBacY=","packets":1},"node":"spark-afae","packetPos":[-80762,480296],"packetRange":{"gte":1787925567945,"lte":1787925567945},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS200651 FlokiNET ehf","number":200651,"organization":{"name":"FlokiNET ehf"}},"bytes":66,"geo":{"country_iso_code":"RO"},"ip":"185.100.87.136","mac":["d2:74:7f:6e:37:e3"],"mac-cnt":1,"packets":1,"port":59742},"spoofable":["true"],"spoofableCnt":1,"srcRIR":"RIPE","srcTTL":[56],"srcTTLCnt":1,"tags":["sensor:sponge-01-ts","honeypot","sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["65535_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":1136315664},"totDataBytes":0}
+{"@timestamp":1787927609778,"_id":"260828-4Tui9Oom8yxGAKkyV_HYT-od","_index":"arkime_sessions3-260828","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["netcup GmbH"],"isp.dstCnt":1,"isp.src":["FlokiNET Ltd"],"isp.srcCnt":1,"org.dst":["Netcup KVM"],"org.dstCnt":1,"org.src":["FlokiNET Ltd"],"org.srcCnt":1,"usertype.dst":["business"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS197540 netcup GmbH","number":197540,"organization":{"name":"netcup GmbH"}},"bytes":0,"geo":{"country_iso_code":"DE"},"ip":"159.195.21.150","mac":["8a:41:d3:b8:0d:d3"],"mac-cnt":1,"packets":0,"port":443},"dstRIR":"ARIN","ethertype":2048,"fileId":[80781],"firstPacket":1787922391017,"ipProtocol":6,"lastPacket":1787922391017,"length":0,"network":{"bytes":66,"community_id":"1:++nXVRJLE1LovamCNcL3lVuwGWY=","packets":1},"node":"spark-afae","packetPos":[-80781,1350518634],"packetRange":{"gte":1787922391017,"lte":1787922391017},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS200651 FlokiNET ehf","number":200651,"organization":{"name":"FlokiNET ehf"}},"bytes":66,"geo":{"country_iso_code":"RO"},"ip":"185.100.87.136","mac":["bc:0f:fe:3d:a3:a7"],"mac-cnt":1,"packets":1,"port":37179},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[53],"srcTTLCnt":1,"tags":["sensor:netcup-ts","netcup-ts","honeypot"],"tagsCnt":3,"tcp":{"ja4t":["65535_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":3906101889},"totDataBytes":0}
+{"@timestamp":1787920296924,"_id":"260828-JBxxZpaJUgRLF4v9yvNca1Mu","_index":"arkime_sessions3-260828","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Kaopu Cloud HK Limited"],"isp.dstCnt":1,"isp.src":["FlokiNET Ltd"],"isp.srcCnt":1,"org.dst":["LightNode-BH"],"org.dstCnt":1,"org.src":["FlokiNET Ltd"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":0,"geo":{"country_iso_code":"BH"},"ip":"38.54.2.209","mac":["52:54:8f:9d:76:48"],"mac-cnt":1,"packets":0,"port":443},"dstRIR":"ARIN","ethertype":2048,"fileId":[80727],"firstPacket":1787919343199,"ipProtocol":6,"lastPacket":1787919343199,"length":0,"network":{"bytes":66,"community_id":"1:YZVrI3J3fu0kNTHAiXdHvCLibTw=","packets":1},"node":"spark-afae","packetPos":[-80727,510024],"packetRange":{"gte":1787919343199,"lte":1787919343199},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS200651 FlokiNET ehf","number":200651,"organization":{"name":"FlokiNET ehf"}},"bytes":66,"geo":{"country_iso_code":"RO"},"ip":"185.100.87.136","mac":["98:44:ce:60:15:19"],"mac-cnt":1,"packets":1,"port":54462},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Huawei Technologies Co.,Ltd"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[52],"srcTTLCnt":1,"tags":["honeypot","bahrain-sponge-01-ts","sensor:bahrain-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["65535_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":843146114},"totDataBytes":0}
+{"@timestamp":1787920296653,"_id":"260828-s7PDi8Gr0vlOEpnzfHF9GwIr","_index":"arkime_sessions3-260828","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["FlokiNET Ltd"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["FlokiNET Ltd"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":0,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":0,"port":443},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[80726],"firstPacket":1787919154493,"ipProtocol":6,"lastPacket":1787919154493,"length":0,"network":{"bytes":66,"community_id":"1:okc/hQIMZRKfQ21H9d2676u5QAU=","packets":1},"node":"spark-afae","packetPos":[-80726,489660],"packetRange":{"gte":1787919154493,"lte":1787919154493},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS200651 FlokiNET ehf","number":200651,"organization":{"name":"FlokiNET ehf"}},"bytes":66,"geo":{"country_iso_code":"RO"},"ip":"185.100.87.136","mac":["fc:bd:67:9d:2b:2b"],"mac-cnt":1,"packets":1,"port":60420},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[55],"srcTTLCnt":1,"tags":["contabo-sponge-01-ts","honeypot","sensor:contabo-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["65535_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":4119850335},"totDataBytes":0}
+{"@timestamp":1787696078629,"_id":"260825-OaGLMUoFZd5AubrWZr0lyyxy","_index":"arkime_sessions3-260825","client":{"bytes":1046},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo GmbH"],"isp.dstCnt":1,"isp.src":["FlokiNET Ltd"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["FlokiNET Ltd"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS51167 Contabo GmbH","number":51167,"organization":{"name":"Contabo GmbH"}},"bytes":1440,"geo":{"country_iso_code":"FR"},"ip":"109.123.246.142","mac":["00:50:56:63:46:a6"],"mac-cnt":1,"packets":10,"port":22},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstPayload8":"5353482d312e3939","dstRIR":"RIPE","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[79448],"firstPacket":1787695597495,"initRTT":15,"ipProtocol":6,"lastPacket":1787695597744,"length":249,"network":{"bytes":3088,"community_id":"1:1YQK630+aS5olPbDHRwUIT9Lcq8=","packets":19},"node":"spark-afae","packetPos":[-79448,948569,90,0,82,104,82,102,370,82,946,82,226,82,530,98,0,82,0,0],"packetRange":{"gte":1787695597495,"lte":1787695597744},"protocol":["tcp","ssh"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":772},"source":{"as":{"full":"AS200651 FlokiNET ehf","number":200651,"organization":{"name":"FlokiNET ehf"}},"bytes":1648,"geo":{"country_iso_code":"RO"},"ip":"185.100.87.136","mac":["c0:69:11:cd:1f:19","00:c0:1d:c0:ff:ee"],"mac-cnt":2,"packets":9,"port":41202},"srcOui":["Arista Networks","Grand Junction Networks, Inc."],"srcOuiCnt":2,"srcPayload8":"5353482d322e302d","srcRIR":"RIPE","srcTTL":[49],"srcTTLCnt":1,"ssh":{"hassh":["e54ef3ec27fe1fea7ab64d3fa05359fd"],"hasshCnt":1,"hasshServer":["e24f4545013804fcb86089ffc93a0539"],"hasshServerCnt":1,"ja4ssh":["c16s16_c4s4_c3s4"],"ja4sshCnt":1,"version":["ssh-2.0-openssh_10.1","ssh-1.99-cisco-1.25"],"versionCnt":2},"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["1565936703231496"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["537cee16-c4a9-45cd-baf1-75963ab7bdd2","GPL ATTACK SSH Connection Attempt"],"signatureCnt":2,"signatureId":[1080086,1000010],"signatureIdCnt":2},"tag":{"block":["true"],"blockCnt":1,"category":["activity"],"categoryCnt":1,"description":["ip addresses with this tag have been observed attempting to negotiate an ssh session."],"intention":["suspicious"],"intentionCnt":1,"name":["ssh connection attempt"],"nameCnt":1},"tags":["sensor:contabo-sponge-02-ts","proxy","contabo-sponge-02-ts"],"tagsCnt":3,"tcp":{"ja4l":"15749_49_15616","ja4ls":"186_64_36168","ja4t":["64240_2-4-8-1-3_1460_7"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":7,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":2,"psh":8,"rst":0,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":421439747},"totDataBytes":1818}
+{"@timestamp":1787677323195,"_id":"260825-C_1RLXUyipRPx45cpb-d-Pae","_index":"arkime_sessions3-260825","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo GmbH"],"isp.dstCnt":1,"isp.src":["FlokiNET Ltd"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["FlokiNET Ltd"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS51167 Contabo GmbH","number":51167,"organization":{"name":"Contabo GmbH"}},"bytes":66,"geo":{"country_iso_code":"FR"},"ip":"109.123.246.142","mac":["00:50:56:63:46:a6"],"mac-cnt":1,"packets":1,"port":22},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[79344],"firstPacket":1787676981065,"ipProtocol":6,"lastPacket":1787676981100,"length":35,"network":{"bytes":192,"community_id":"1:aJHm3UA7W0Q1ztigOK682r0wVek=","packets":3},"node":"spark-afae","packetPos":[-79344,994931,82,0],"packetRange":{"gte":1787676981065,"lte":1787676981100},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS200651 FlokiNET ehf","number":200651,"organization":{"name":"FlokiNET ehf"}},"bytes":126,"geo":{"country_iso_code":"RO"},"ip":"185.100.87.136","mac":["c0:69:11:cd:1f:19","00:c0:1d:c0:ff:ee"],"mac-cnt":2,"packets":2,"port":53802},"srcOui":["Arista Networks","Grand Junction Networks, Inc."],"srcOuiCnt":2,"srcRIR":"RIPE","srcTTL":[49],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["1407704947676888"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["GPL ATTACK SSH Connection Attempt"],"signatureCnt":1,"signatureId":[1000010],"signatureIdCnt":1},"tags":["proxy","sensor:contabo-sponge-02-ts","contabo-sponge-02-ts"],"tagsCnt":3,"tcp":{"ja4t":["65535_2-1-3-1-1-4_1460_8"],"ja4tCnt":1,"ja4ts":["64240_2-1-1-4-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":4107802518},"totDataBytes":0}
+{"@timestamp":1787675214885,"_id":"260825-yfysvTQ2XI5Lz4UnAM7eEvgx","_index":"arkime_sessions3-260825","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Kaopu Cloud HK Limited"],"isp.dstCnt":1,"isp.src":["FlokiNET Ltd"],"isp.srcCnt":1,"org.dst":["LightNode-BH"],"org.dstCnt":1,"org.src":["FlokiNET Ltd"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":74,"geo":{"country_iso_code":"BH"},"ip":"38.54.2.209","mac":["52:54:8f:9d:76:48"],"mac-cnt":1,"packets":1,"port":22},"dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[79333],"firstPacket":1787674706967,"ipProtocol":6,"lastPacket":1787674714059,"length":7092,"network":{"bytes":370,"community_id":"1:m0AGzx10e/qkD6BPsgMOohYc8WE=","packets":5},"node":"spark-afae","packetPos":[-79333,3430013,90,983,2779,2092],"packetRange":{"gte":1787674706967,"lte":1787674714059},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS200651 FlokiNET ehf","number":200651,"organization":{"name":"FlokiNET ehf"}},"bytes":296,"geo":{"country_iso_code":"RO"},"ip":"185.100.87.136","mac":["98:44:ce:60:15:19"],"mac-cnt":1,"packets":4,"port":39992},"srcOui":["Huawei Technologies Co.,Ltd"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[51],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["778178320338725"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["GPL ATTACK SSH Connection Attempt"],"signatureCnt":1,"signatureId":[1000010],"signatureIdCnt":1},"tags":["honeypot","bahrain-sponge-01-ts","sensor:bahrain-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-4-8-1-3_1460_7"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":4,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":3779311209},"totDataBytes":0}
+{"@timestamp":1787674915836,"_id":"260825-gp9ppIRphh9FWZpA3YeFw3gu","_index":"arkime_sessions3-260825","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["FlokiNET Ltd"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["FlokiNET Ltd"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":66,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":1,"port":22},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[79331],"firstPacket":1787674195889,"ipProtocol":6,"lastPacket":1787674195889,"length":0,"network":{"bytes":132,"community_id":"1:LXa6hGgP/DV4+wbrSZdqk5lVDWE=","packets":2},"node":"spark-afae","packetPos":[-79331,977508,82],"packetRange":{"gte":1787674195889,"lte":1787674195889},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS200651 FlokiNET ehf","number":200651,"organization":{"name":"FlokiNET ehf"}},"bytes":66,"geo":{"country_iso_code":"RO"},"ip":"185.100.87.136","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":1,"port":53684},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[53],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["1007192092678105"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["GPL ATTACK SSH Connection Attempt"],"signatureCnt":1,"signatureId":[1000010],"signatureIdCnt":1},"tags":["frantech-ts","honeypot","sensor:frantech-ts"],"tagsCnt":3,"tcp":{"ja4t":["65535_2-1-3-1-1-4_1400_8"],"ja4tCnt":1,"ja4ts":["64240_2-1-1-4-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":2718085108},"totDataBytes":0}
+{"@timestamp":1787673111262,"_id":"260825-Vp-bg_K2pLNPJ4oX0ObmlcTt","_index":"arkime_sessions3-260825","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["netcup GmbH"],"isp.dstCnt":1,"isp.src":["FlokiNET Ltd"],"isp.srcCnt":1,"org.dst":["Netcup KVM"],"org.dstCnt":1,"org.src":["FlokiNET Ltd"],"org.srcCnt":1,"usertype.dst":["business"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS197540 netcup GmbH","number":197540,"organization":{"name":"netcup GmbH"}},"bytes":74,"geo":{"country_iso_code":"DE"},"ip":"159.195.21.150","mac":["8a:41:d3:b8:0d:d3"],"mac-cnt":1,"packets":1,"port":22},"dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[79320],"firstPacket":1787671987786,"ipProtocol":6,"lastPacket":1787671994901,"length":7115,"network":{"bytes":370,"community_id":"1:JwyCkQPYEPRFlzIkhH3mj6KmjHY=","packets":5},"node":"spark-afae","packetPos":[-79320,5703487,90,1732,2144,3832],"packetRange":{"gte":1787671987786,"lte":1787671994901},"protocol":["tcp"],"protocolCnt":1,"rootId":"260825-Vp-bg_K2pLNPJ4oX0ObmlcTt","segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS200651 FlokiNET ehf","number":200651,"organization":{"name":"FlokiNET ehf"}},"bytes":296,"geo":{"country_iso_code":"RO"},"ip":"185.100.87.136","mac":["bc:0f:fe:3d:a3:a7","00:00:5e:00:01:96"],"mac-cnt":2,"packets":4,"port":46918},"srcOui":["ICANN, IANA Department","Juniper Networks"],"srcOuiCnt":2,"srcRIR":"RIPE","srcTTL":[53],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["846235979792841"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["GPL ATTACK SSH Connection Attempt"],"signatureCnt":1,"signatureId":[1000010],"signatureIdCnt":1},"tags":["honeypot","sensor:netcup-ts","netcup-ts"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-4-8-1-3_1460_7"],"ja4tCnt":1,"ja4ts":["43440_2-4-8-1-3_1460_11"],"ja4tsCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":4,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":3800702334},"totDataBytes":0}
+{"@timestamp":1787672211441,"_id":"260825-W_xnHMJGGodNGqbUIcQJGwUf","_index":"arkime_sessions3-260825","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["FlokiNET Ltd"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["FlokiNET Ltd"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":66,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":1,"port":22},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[79316],"firstPacket":1787671517658,"ipProtocol":6,"lastPacket":1787671517658,"length":0,"network":{"bytes":132,"community_id":"1:CfMj85SspCJY0ZSxoAVZMUsRyGM=","packets":2},"node":"spark-afae","packetPos":[-79316,1519613,82],"packetRange":{"gte":1787671517658,"lte":1787671517658},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS200651 FlokiNET ehf","number":200651,"organization":{"name":"FlokiNET ehf"}},"bytes":66,"geo":{"country_iso_code":"RO"},"ip":"185.100.87.136","mac":["fc:bd:67:9d:2b:2b","00:c0:1d:c0:ff:ee"],"mac-cnt":2,"packets":1,"port":42788},"srcOui":["Arista Networks","Grand Junction Networks, Inc."],"srcOuiCnt":2,"srcRIR":"RIPE","srcTTL":[55],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["1422430686929253"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["GPL ATTACK SSH Connection Attempt"],"signatureCnt":1,"signatureId":[1000010],"signatureIdCnt":1},"tags":["sensor:contabo-sponge-01-ts","contabo-sponge-01-ts","honeypot"],"tagsCnt":3,"tcp":{"ja4t":["65535_2-1-3-1-1-4_1460_8"],"ja4tCnt":1,"ja4ts":["64240_2-1-1-4-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":3122990401},"totDataBytes":0}
+{"@timestamp":1787671002118,"_id":"260825-L_wsU-Zk8jxAJYaQC0no8kVn","_index":"arkime_sessions3-260825","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Kaopu Cloud HK Limited"],"isp.dstCnt":1,"isp.src":["FlokiNET Ltd"],"isp.srcCnt":1,"org.dst":["LightNode-BH"],"org.dstCnt":1,"org.src":["FlokiNET Ltd"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":66,"geo":{"country_iso_code":"BH"},"ip":"38.54.2.209","mac":["52:54:8f:9d:76:48"],"mac-cnt":1,"packets":1,"port":22},"dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[79310],"firstPacket":1787669811788,"ipProtocol":6,"lastPacket":1787669812908,"length":1120,"network":{"bytes":186,"community_id":"1:8NEncjtqmEcJv0e6zSFz2swKiJg=","packets":3},"node":"spark-afae","packetPos":[-79310,312785,82,1908],"packetRange":{"gte":1787669811788,"lte":1787669812908},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS200651 FlokiNET ehf","number":200651,"organization":{"name":"FlokiNET ehf"}},"bytes":120,"geo":{"country_iso_code":"RO"},"ip":"185.100.87.136","mac":["98:44:ce:60:15:19"],"mac-cnt":1,"packets":2,"port":33232},"srcOui":["Huawei Technologies Co.,Ltd"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[51],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["853099268669534"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["GPL ATTACK SSH Connection Attempt"],"signatureCnt":1,"signatureId":[1000010],"signatureIdCnt":1},"tags":["honeypot","bahrain-sponge-01-ts","sensor:bahrain-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["65535_2-1-3-1-1-4_1460_8"],"ja4tCnt":1,"ja4ts":["64240_2-1-1-4-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":3072372477},"totDataBytes":0}
+{"@timestamp":1787669483647,"_id":"260825-CZ-pI-vAQeRAxoCRrAYqykg0","_index":"arkime_sessions3-260825","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["netcup GmbH"],"isp.dstCnt":1,"isp.src":["FlokiNET Ltd"],"isp.srcCnt":1,"org.dst":["Netcup KVM"],"org.dstCnt":1,"org.src":["FlokiNET Ltd"],"org.srcCnt":1,"usertype.dst":["business"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS197540 netcup GmbH","number":197540,"organization":{"name":"netcup GmbH"}},"bytes":66,"geo":{"country_iso_code":"DE"},"ip":"159.195.21.150","mac":["8a:41:d3:b8:0d:d3"],"mac-cnt":1,"packets":1,"port":22},"dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[79300],"firstPacket":1787668814565,"ipProtocol":6,"lastPacket":1787668815626,"length":1061,"network":{"bytes":188,"community_id":"1:7sKsVqykPA/Vp8FW/p0bQzKZseQ=","packets":3},"node":"spark-afae","packetPos":[-79300,2673103,82,672],"packetRange":{"gte":1787668814565,"lte":1787668815626},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS200651 FlokiNET ehf","number":200651,"organization":{"name":"FlokiNET ehf"}},"bytes":122,"geo":{"country_iso_code":"RO"},"ip":"185.100.87.136","mac":["00:00:5e:00:01:96","bc:0f:fe:3d:a3:a7"],"mac-cnt":2,"packets":2,"port":58431},"srcOui":["ICANN, IANA Department","Juniper Networks"],"srcOuiCnt":2,"srcRIR":"RIPE","srcTTL":[53],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["1865678559926482"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["GPL ATTACK SSH Connection Attempt"],"signatureCnt":1,"signatureId":[1000010],"signatureIdCnt":1},"tags":["netcup-ts","honeypot","sensor:netcup-ts"],"tagsCnt":3,"tcp":{"ja4t":["65535_2-1-3-1-1-4_1460_8"],"ja4tCnt":1,"ja4ts":["42340_2-1-1-4-1-3_1460_11"],"ja4tsCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":3184888463},"totDataBytes":0}
+{"@timestamp":1787657089993,"_id":"260825-Wvpnx4-_HehF77NR8p5n5s2q","_index":"arkime_sessions3-260825","client":{"bytes":215},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["FlokiNET Ltd"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["FlokiNET Ltd"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":625,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":5,"port":8443},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstPayload8":"485454502f312e31","dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[79232],"firstPacket":1787655967394,"http":{"bodyMagic":["application/json","text/html"],"bodyMagicCnt":2,"clientVersion":["1.1"],"clientVersionCnt":1,"host":["209.141.62.110","209.141.62.110:8443"],"hostCnt":2,"ja4h":["po11nn050000_928c23def140_000000000000_000000000000"],"ja4hCnt":1,"ja4h_r":["po11nn050000_Host,User-Agent,Content-Length,Cache-Control,Content-Type__"],"ja4h_rCnt":1,"md5":["7defa9fa40b1688dbb6420272b7aed25","0f87454a3ea15f0db55ae928dbcd82fc"],"md5Cnt":2,"method":["POST"],"method-POST":1,"methodCnt":1,"path":["/api/checkin"],"pathCnt":1,"request-cache-control":["no-cache"],"request-cache-controlCnt":1,"requestBody":["{\"hostname\":\"WIN-DESKTOP\"}"],"requestHeader":["cache-control","content-type","user-agent","content-length","host"],"requestHeaderCnt":5,"requestHeaderField":["content-length","content-type"],"requestHeaderValue":["26","application/json"],"requestHeaderValueCnt":2,"response-server":["Apache/2.4.41 (Ubuntu)"],"response-serverCnt":1,"response-x-powered-by":["PHP/7.4.3"],"response-x-powered-byCnt":1,"responseHeader":["server","connection","content-type","x-powered-by","date","content-length"],"responseHeaderCnt":6,"responseHeaderField":["connection","content-type","date","content-length"],"responseHeaderValue":["close","text/plain; charset=utf-8","tue, 25 aug 2026 11:06:09 gmt","94"],"responseHeaderValueCnt":4,"serverVersion":["1.1"],"serverVersionCnt":1,"sha256":["1ca624415b2889dbeb3f969890b848b7bc5eaf96ca5e8fdd7461f943b45d10cb","f95e5c5b12e743a1aa81c56d21d0886d82cec995621db3d71070a63f3d1c19bf"],"sha256Cnt":2,"statuscode":[200],"statuscodeCnt":1,"uri":["209.141.62.110:8443/api/checkin"],"uriCnt":1,"useragent":["Mozilla/5.0 (Windows NT 10.0; Win64; x64)"],"useragentCnt":1},"initRTT":1115,"ipProtocol":6,"lastPacket":1787655969789,"length":2395,"network":{"bytes":1252,"community_id":"1:qMcEl09YqoMbj4cByv8j4vCRj9A=","packets":11},"node":"spark-afae","packetPos":[-79232,238632,90,446,884,82,297,82,369,82,0,0],"packetRange":{"gte":1787655967394,"lte":1787655969789},"protocol":["tcp","http"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":287},"source":{"as":{"full":"AS200651 FlokiNET ehf","number":200651,"organization":{"name":"FlokiNET ehf"}},"bytes":627,"geo":{"country_iso_code":"RO"},"ip":"185.100.87.136","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":6,"port":55424},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcPayload8":"504f5354202f6170","srcRIR":"RIPE","srcTTL":[52],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["1973814252816668"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["869feaa1-dc77-4037-aee2-247b7a39cf7d","f00e21c3-4bf0-42eb-947f-491086bc0093"],"signatureCnt":2,"signatureId":[1031486,1083150],"signatureIdCnt":2},"tag":{"block":["false","true"],"blockCnt":2,"category":["protocol","activity"],"categoryCnt":2,"description":["ip addresses with this tag have been seen crawling http(s) servers around the internet.","ip addresses with this tag have been observed attempting to send linux commands commonly seen in exploits and proofs of concept (such as whoami, nohup, netcat, etc.)."],"intention":["unknown","suspicious"],"intentionCnt":2,"name":["web crawler","generic suspicious linux command in request"],"nameCnt":2},"tags":["honeypot","frantech-ts","sensor:frantech-ts"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-4-8-1-3_1400_7"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":4,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":2,"psh":2,"rst":0,"srcZero":0,"syn":2,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":1653504548},"totDataBytes":502}
+{"@timestamp":1787657089992,"_id":"260825-Wvqo54YLiMpH4ZRTZCy378BB","_index":"arkime_sessions3-260825","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["FlokiNET Ltd"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["FlokiNET Ltd"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":66,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":1,"port":8443},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[79232],"firstPacket":1787655966201,"ipProtocol":6,"lastPacket":1787655967384,"length":1183,"network":{"bytes":186,"community_id":"1:ULbRXanUY+yZxWb9g1oZjFe/kSA=","packets":3},"node":"spark-afae","packetPos":[-79232,237236,82,1244],"packetRange":{"gte":1787655966201,"lte":1787655967384},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS200651 FlokiNET ehf","number":200651,"organization":{"name":"FlokiNET ehf"}},"bytes":120,"geo":{"country_iso_code":"RO"},"ip":"185.100.87.136","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":2,"port":55350},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[53],"srcTTLCnt":1,"tags":["honeypot","frantech-ts","sensor:frantech-ts"],"tagsCnt":3,"tcp":{"ja4t":["65535_2-1-3-1-1-4_1400_8"],"ja4tCnt":1,"ja4ts":["64240_2-1-1-4-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":986111929},"totDataBytes":0}
+{"@timestamp":1787655580434,"_id":"260825-4Z2JzXnStttDMKX7OcJ3aVqD","_index":"arkime_sessions3-260825","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo GmbH"],"isp.dstCnt":1,"isp.src":["FlokiNET Ltd"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["FlokiNET Ltd"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS51167 Contabo GmbH","number":51167,"organization":{"name":"Contabo GmbH"}},"bytes":0,"geo":{"country_iso_code":"FR"},"ip":"109.123.246.142","mac":["00:50:56:63:46:a6"],"mac-cnt":1,"packets":0,"port":8443},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[79223],"firstPacket":1787655108643,"ipProtocol":6,"lastPacket":1787655108643,"length":0,"network":{"bytes":66,"community_id":"1:ZD6mqkIKN6Dtt9QMHBZ1pnwu4qE=","packets":1},"node":"spark-afae","packetPos":[-79223,1035056],"packetRange":{"gte":1787655108643,"lte":1787655108643},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS200651 FlokiNET ehf","number":200651,"organization":{"name":"FlokiNET ehf"}},"bytes":66,"geo":{"country_iso_code":"RO"},"ip":"185.100.87.136","mac":["c0:69:11:cd:1f:19"],"mac-cnt":1,"packets":1,"port":57690},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[49],"srcTTLCnt":1,"tags":["proxy","contabo-sponge-02-ts","sensor:contabo-sponge-02-ts"],"tagsCnt":3,"tcp":{"ja4t":["65535_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":707054047},"totDataBytes":0}
+{"@timestamp":1787654974653,"_id":"260825-Dfq5Qn_emjpO7aMnZ_yhmLPn","_index":"arkime_sessions3-260825","client":{"bytes":215},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["FlokiNET Ltd"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["FlokiNET Ltd"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":625,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":5,"port":8443},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstPayload8":"485454502f312e31","dstRIR":"RIPE","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[79221],"firstPacket":1787653904451,"http":{"bodyMagic":["application/json","text/html"],"bodyMagicCnt":2,"clientVersion":["1.1"],"clientVersionCnt":1,"host":["217.15.163.226","217.15.163.226:8443"],"hostCnt":2,"ja4h":["po11nn050000_928c23def140_000000000000_000000000000"],"ja4hCnt":1,"ja4h_r":["po11nn050000_Host,User-Agent,Content-Length,Cache-Control,Content-Type__"],"ja4h_rCnt":1,"md5":["0f87454a3ea15f0db55ae928dbcd82fc","7defa9fa40b1688dbb6420272b7aed25"],"md5Cnt":2,"method":["POST"],"method-POST":1,"methodCnt":1,"path":["/api/checkin"],"pathCnt":1,"request-cache-control":["no-cache"],"request-cache-controlCnt":1,"requestBody":["{\"hostname\":\"WIN-DESKTOP\"}"],"requestHeader":["content-type","user-agent","content-length","cache-control","host"],"requestHeaderCnt":5,"requestHeaderField":["content-length","content-type"],"requestHeaderValue":["26","application/json"],"requestHeaderValueCnt":2,"response-server":["Apache/2.4.41 (Ubuntu)"],"response-serverCnt":1,"response-x-powered-by":["PHP/7.4.3"],"response-x-powered-byCnt":1,"responseHeader":["content-type","server","x-powered-by","content-length","connection","date"],"responseHeaderCnt":6,"responseHeaderField":["connection","content-type","date","content-length"],"responseHeaderValue":["close","text/plain; charset=utf-8","tue, 25 aug 2026 10:31:45 gmt","94"],"responseHeaderValueCnt":4,"serverVersion":["1.1"],"serverVersionCnt":1,"sha256":["f95e5c5b12e743a1aa81c56d21d0886d82cec995621db3d71070a63f3d1c19bf","1ca624415b2889dbeb3f969890b848b7bc5eaf96ca5e8fdd7461f943b45d10cb"],"sha256Cnt":2,"statuscode":[200],"statuscodeCnt":1,"uri":["217.15.163.226:8443/api/checkin"],"uriCnt":1,"useragent":["Mozilla/5.0 (Windows NT 10.0; Win64; x64)"],"useragentCnt":1},"initRTT":610,"ipProtocol":6,"lastPacket":1787653905849,"length":1398,"network":{"bytes":1252,"community_id":"1:KrXzKo4RSRliTXYv91Ms2FQgOfE=","packets":11},"node":"spark-afae","packetPos":[-79221,2753,90,4000,416,82,297,82,369,434,82,0],"packetRange":{"gte":1787653904451,"lte":1787653905849},"protocol":["tcp","http"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":287},"source":{"as":{"full":"AS200651 FlokiNET ehf","number":200651,"organization":{"name":"FlokiNET ehf"}},"bytes":627,"geo":{"country_iso_code":"RO"},"ip":"185.100.87.136","mac":["fc:bd:67:9d:2b:2b","00:c0:1d:c0:ff:ee"],"mac-cnt":2,"packets":6,"port":45726},"srcOui":["Arista Networks","Grand Junction Networks, Inc."],"srcOuiCnt":2,"srcPayload8":"504f5354202f6170","srcRIR":"RIPE","srcTTL":[56],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["250698275706549"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["869feaa1-dc77-4037-aee2-247b7a39cf7d","f00e21c3-4bf0-42eb-947f-491086bc0093"],"signatureCnt":2,"signatureId":[1031486,1083150],"signatureIdCnt":2},"tag":{"block":["false","true"],"blockCnt":2,"category":["protocol","activity"],"categoryCnt":2,"description":["ip addresses with this tag have been observed attempting to send linux commands commonly seen in exploits and proofs of concept (such as whoami, nohup, netcat, etc.).","ip addresses with this tag have been seen crawling http(s) servers around the internet."],"intention":["suspicious","unknown"],"intentionCnt":2,"name":["web crawler","generic suspicious linux command in request"],"nameCnt":2},"tags":["contabo-sponge-01-ts","sensor:contabo-sponge-01-ts","honeypot"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-4-8-1-3_1460_7"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":4,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":2,"psh":2,"rst":0,"srcZero":0,"syn":2,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":4226106946},"totDataBytes":502}
+{"@timestamp":1787654974652,"_id":"260825-Dfpv6iyWZp5O8qi0Ed3No75H","_index":"arkime_sessions3-260825","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["FlokiNET Ltd"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["FlokiNET Ltd"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":66,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":1,"port":8443},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[79221],"firstPacket":1787653904224,"ipProtocol":6,"lastPacket":1787653904400,"length":176,"network":{"bytes":126,"community_id":"1:84Kmpwyq1t0Y3JvA9SDE79AjIII=","packets":2},"node":"spark-afae","packetPos":[-79221,2263,324],"packetRange":{"gte":1787653904224,"lte":1787653904400},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS200651 FlokiNET ehf","number":200651,"organization":{"name":"FlokiNET ehf"}},"bytes":60,"geo":{"country_iso_code":"RO"},"ip":"185.100.87.136","mac":["fc:bd:67:9d:2b:2b","00:c0:1d:c0:ff:ee"],"mac-cnt":2,"packets":1,"port":55239},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Arista Networks","Grand Junction Networks, Inc."],"srcOuiCnt":2,"srcRIR":"RIPE","srcTTL":[55],"srcTTLCnt":1,"tags":["contabo-sponge-01-ts","sensor:contabo-sponge-01-ts","honeypot"],"tagsCnt":3,"tcp":{"ja4ts":["64240_2-1-1-4-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":1,"srcZero":0,"syn":0,"syn-ack":1,"urg":0},"tcpseq":{"dst":2218113135},"totDataBytes":0}
+{"@timestamp":1787654075733,"_id":"260825-7Pl597OpLr9JNpRJ60a7-fBV","_index":"arkime_sessions3-260825","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["FlokiNET Ltd"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["FlokiNET Ltd"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":66,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":1,"port":8443},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[79216],"firstPacket":1787653901149,"ipProtocol":6,"lastPacket":1787653901149,"length":0,"network":{"bytes":132,"community_id":"1:84Kmpwyq1t0Y3JvA9SDE79AjIII=","packets":2},"node":"spark-afae","packetPos":[-79216,3621344,82],"packetRange":{"gte":1787653901149,"lte":1787653901149},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS200651 FlokiNET ehf","number":200651,"organization":{"name":"FlokiNET ehf"}},"bytes":66,"geo":{"country_iso_code":"RO"},"ip":"185.100.87.136","mac":["fc:bd:67:9d:2b:2b","00:c0:1d:c0:ff:ee"],"mac-cnt":2,"packets":1,"port":55239},"srcOui":["Arista Networks","Grand Junction Networks, Inc."],"srcOuiCnt":2,"srcRIR":"RIPE","srcTTL":[55],"srcTTLCnt":1,"tags":["contabo-sponge-01-ts","sensor:contabo-sponge-01-ts","honeypot"],"tagsCnt":3,"tcp":{"ja4t":["65535_2-1-3-1-1-4_1460_8"],"ja4tCnt":1,"ja4ts":["64240_2-1-1-4-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":2317390842},"totDataBytes":0}
+{"@timestamp":1787652271589,"_id":"260825-iZ3i7uoRtLBIObngSRYAxrOs","_index":"arkime_sessions3-260825","client":{"bytes":215},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["netcup GmbH"],"isp.dstCnt":1,"isp.src":["FlokiNET Ltd"],"isp.srcCnt":1,"org.dst":["Netcup KVM"],"org.dstCnt":1,"org.src":["FlokiNET Ltd"],"org.srcCnt":1,"usertype.dst":["business"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS197540 netcup GmbH","number":197540,"organization":{"name":"netcup GmbH"}},"bytes":384,"geo":{"country_iso_code":"DE"},"ip":"159.195.21.150","mac":["8a:41:d3:b8:0d:d3"],"mac-cnt":1,"packets":4,"port":8443},"dstPayload8":"485454502f312e31","dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[79205],"firstPacket":1787651164917,"http":{"bodyMagic":["application/json"],"bodyMagicCnt":1,"clientVersion":["1.1"],"clientVersionCnt":1,"host":["159.195.21.150:8443","159.195.21.150"],"hostCnt":2,"ja4h":["po11nn050000_928c23def140_000000000000_000000000000"],"ja4hCnt":1,"ja4h_r":["po11nn050000_Host,User-Agent,Content-Length,Cache-Control,Content-Type__"],"ja4h_rCnt":1,"md5":["7defa9fa40b1688dbb6420272b7aed25"],"md5Cnt":1,"method":["POST"],"method-POST":1,"methodCnt":1,"path":["/api/checkin"],"pathCnt":1,"request-cache-control":["no-cache"],"request-cache-controlCnt":1,"requestBody":["{\"hostname\":\"WIN-DESKTOP\"}"],"requestHeader":["host","content-type","content-length","cache-control","user-agent"],"requestHeaderCnt":5,"requestHeaderField":["content-length","content-type"],"requestHeaderValue":["26","application/json"],"requestHeaderValueCnt":2,"response-server":["SonicWall SMA 10.2.0.9-12sv"],"response-serverCnt":1,"responseHeader":["content-length","server","date"],"responseHeaderCnt":3,"responseHeaderField":["date","content-length"],"responseHeaderValue":["tue, 25 aug 2026 09:46:05 gmt","0"],"responseHeaderValueCnt":2,"serverVersion":["1.1"],"serverVersionCnt":1,"sha256":["f95e5c5b12e743a1aa81c56d21d0886d82cec995621db3d71070a63f3d1c19bf"],"sha256Cnt":1,"statuscode":[200],"statuscodeCnt":1,"uri":["159.195.21.150:8443/api/checkin"],"uriCnt":1,"useragent":["Mozilla/5.0 (Windows NT 10.0; Win64; x64)"],"useragentCnt":1},"initRTT":522,"ipProtocol":6,"lastPacket":1787651166025,"length":1108,"network":{"bytes":1003,"community_id":"1:8JuKPUzI1CbcY8av2qWyzx2RU74=","packets":10},"node":"spark-afae","packetPos":[-79205,154307,90,736,82,297,82,194,82,0,0],"packetRange":{"gte":1787651164917,"lte":1787651166025},"protocol":["tcp","http"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":112},"source":{"as":{"full":"AS200651 FlokiNET ehf","number":200651,"organization":{"name":"FlokiNET ehf"}},"bytes":619,"geo":{"country_iso_code":"RO"},"ip":"185.100.87.136","mac":["bc:0f:fe:3d:a3:a7","00:00:5e:00:01:96"],"mac-cnt":2,"packets":6,"port":53554},"srcOui":["Juniper Networks","ICANN, IANA Department"],"srcOuiCnt":2,"srcPayload8":"504f5354202f6170","srcRIR":"RIPE","srcTTL":[53],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["1127900911151644"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["869feaa1-dc77-4037-aee2-247b7a39cf7d","f00e21c3-4bf0-42eb-947f-491086bc0093"],"signatureCnt":2,"signatureId":[1031486,1083150],"signatureIdCnt":2},"tag":{"block":["false","true"],"blockCnt":2,"category":["activity","protocol"],"categoryCnt":2,"description":["ip addresses with this tag have been seen crawling http(s) servers around the internet.","ip addresses with this tag have been observed attempting to send linux commands commonly seen in exploits and proofs of concept (such as whoami, nohup, netcat, etc.)."],"intention":["suspicious","unknown"],"intentionCnt":2,"name":["web crawler","generic suspicious linux command in request"],"nameCnt":2},"tags":["sensor:netcup-ts","honeypot","netcup-ts"],"tagsCnt":3,"tcp":{"ja4ls":"42_64_tcp","ja4t":["64240_2-4-8-1-3_1460_7"],"ja4tCnt":1,"ja4ts":["43440_2-4-8-1-3_1460_11"],"ja4tsCnt":1},"tcpflags":{"ack":4,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":2,"psh":2,"rst":0,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":1617113931},"totDataBytes":327}
+{"@timestamp":1787652271589,"_id":"260825-iZ1UIlff3U1DpJCXr4pPgU6y","_index":"arkime_sessions3-260825","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["netcup GmbH"],"isp.dstCnt":1,"isp.src":["FlokiNET Ltd"],"isp.srcCnt":1,"org.dst":["Netcup KVM"],"org.dstCnt":1,"org.src":["FlokiNET Ltd"],"org.srcCnt":1,"usertype.dst":["business"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS197540 netcup GmbH","number":197540,"organization":{"name":"netcup GmbH"}},"bytes":66,"geo":{"country_iso_code":"DE"},"ip":"159.195.21.150","mac":["8a:41:d3:b8:0d:d3"],"mac-cnt":1,"packets":1,"port":8443},"dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[79205],"firstPacket":1787651163819,"ipProtocol":6,"lastPacket":1787651164874,"length":1055,"network":{"bytes":188,"community_id":"1:f0XidMZ4pfa6EI6sN0hPIIurCzI=","packets":3},"node":"spark-afae","packetPos":[-79205,152771,82,1204],"packetRange":{"gte":1787651163819,"lte":1787651164874},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS200651 FlokiNET ehf","number":200651,"organization":{"name":"FlokiNET ehf"}},"bytes":122,"geo":{"country_iso_code":"RO"},"ip":"185.100.87.136","mac":["bc:0f:fe:3d:a3:a7","00:00:5e:00:01:96"],"mac-cnt":2,"packets":2,"port":50411},"srcOui":["Juniper Networks","ICANN, IANA Department"],"srcOuiCnt":2,"srcRIR":"RIPE","srcTTL":[53],"srcTTLCnt":1,"tags":["sensor:netcup-ts","honeypot","netcup-ts"],"tagsCnt":3,"tcp":{"ja4t":["65535_2-1-3-1-1-4_1460_8"],"ja4tCnt":1,"ja4ts":["42340_2-1-1-4-1-3_1460_11"],"ja4tsCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":3804982830},"totDataBytes":0}
+{"@timestamp":1787648932644,"_id":"260825-PflS7Ya9GrNLAYf34-H3E-31","_index":"arkime_sessions3-260825","client":{"bytes":212},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Kaopu Cloud HK Limited"],"isp.dstCnt":1,"isp.src":["FlokiNET Ltd"],"isp.srcCnt":1,"org.dst":["LightNode-BH"],"org.dstCnt":1,"org.src":["FlokiNET Ltd"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":625,"geo":{"country_iso_code":"BH"},"ip":"38.54.2.209","mac":["52:54:8f:9d:76:48"],"mac-cnt":1,"packets":5,"port":8443},"dstPayload8":"485454502f312e31","dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[79185],"firstPacket":1787648581924,"http":{"bodyMagic":["text/html","application/json"],"bodyMagicCnt":2,"clientVersion":["1.1"],"clientVersionCnt":1,"host":["38.54.2.209:8443","38.54.2.209"],"hostCnt":2,"ja4h":["po11nn050000_928c23def140_000000000000_000000000000"],"ja4hCnt":1,"ja4h_r":["po11nn050000_Host,User-Agent,Content-Length,Cache-Control,Content-Type__"],"ja4h_rCnt":1,"md5":["7defa9fa40b1688dbb6420272b7aed25","0f87454a3ea15f0db55ae928dbcd82fc"],"md5Cnt":2,"method":["POST"],"method-POST":1,"methodCnt":1,"path":["/api/checkin"],"pathCnt":1,"request-cache-control":["no-cache"],"request-cache-controlCnt":1,"requestBody":["{\"hostname\":\"WIN-DESKTOP\"}"],"requestHeader":["content-type","content-length","user-agent","cache-control","host"],"requestHeaderCnt":5,"requestHeaderField":["content-length","content-type"],"requestHeaderValue":["26","application/json"],"requestHeaderValueCnt":2,"response-server":["Apache/2.4.41 (Ubuntu)"],"response-serverCnt":1,"response-x-powered-by":["PHP/7.4.3"],"response-x-powered-byCnt":1,"responseHeader":["content-type","server","content-length","x-powered-by","connection","date"],"responseHeaderCnt":6,"responseHeaderField":["connection","content-type","date","content-length"],"responseHeaderValue":["close","text/plain; charset=utf-8","tue, 25 aug 2026 09:03:03 gmt","94"],"responseHeaderValueCnt":4,"serverVersion":["1.1"],"serverVersionCnt":1,"sha256":["f95e5c5b12e743a1aa81c56d21d0886d82cec995621db3d71070a63f3d1c19bf","1ca624415b2889dbeb3f969890b848b7bc5eaf96ca5e8fdd7461f943b45d10cb"],"sha256Cnt":2,"statuscode":[200],"statuscodeCnt":1,"uri":["38.54.2.209:8443/api/checkin"],"uriCnt":1,"useragent":["Mozilla/5.0 (Windows NT 10.0; Win64; x64)"],"useragentCnt":1},"initRTT":564,"ipProtocol":6,"lastPacket":1787648583170,"length":1246,"network":{"bytes":1249,"community_id":"1:AAPagcaEkWSpEIcNwsQTHJTPMCc=","packets":11},"node":"spark-afae","packetPos":[-79185,1258356,90,1518,262,82,294,82,369,262,82,0],"packetRange":{"gte":1787648581924,"lte":1787648583170},"protocol":["tcp","http"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":287},"source":{"as":{"full":"AS200651 FlokiNET ehf","number":200651,"organization":{"name":"FlokiNET ehf"}},"bytes":624,"geo":{"country_iso_code":"RO"},"ip":"185.100.87.136","mac":["98:44:ce:60:15:19"],"mac-cnt":1,"packets":6,"port":52780},"srcOui":["Huawei Technologies Co.,Ltd"],"srcOuiCnt":1,"srcPayload8":"504f5354202f6170","srcRIR":"RIPE","srcTTL":[52],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["1438186099111504"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["869feaa1-dc77-4037-aee2-247b7a39cf7d","f00e21c3-4bf0-42eb-947f-491086bc0093"],"signatureCnt":2,"signatureId":[1031486,1083150],"signatureIdCnt":2},"tag":{"block":["false","true"],"blockCnt":2,"category":["activity","protocol"],"categoryCnt":2,"description":["ip addresses with this tag have been seen crawling http(s) servers around the internet.","ip addresses with this tag have been observed attempting to send linux commands commonly seen in exploits and proofs of concept (such as whoami, nohup, netcat, etc.)."],"intention":["suspicious","unknown"],"intentionCnt":2,"name":["web crawler","generic suspicious linux command in request"],"nameCnt":2},"tags":["bahrain-sponge-01-ts","honeypot","sensor:bahrain-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-4-8-1-3_1460_7"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":4,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":2,"psh":2,"rst":0,"srcZero":0,"syn":2,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":998693233},"totDataBytes":499}
+{"@timestamp":1787648932590,"_id":"260825-Pfnt89xsnAtN4Lk6wvqTBowg","_index":"arkime_sessions3-260825","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Kaopu Cloud HK Limited"],"isp.dstCnt":1,"isp.src":["FlokiNET Ltd"],"isp.srcCnt":1,"org.dst":["LightNode-BH"],"org.dstCnt":1,"org.src":["FlokiNET Ltd"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":66,"geo":{"country_iso_code":"BH"},"ip":"38.54.2.209","mac":["52:54:8f:9d:76:48"],"mac-cnt":1,"packets":1,"port":8443},"dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[79185],"firstPacket":1787648580759,"ipProtocol":6,"lastPacket":1787648581900,"length":1141,"network":{"bytes":186,"community_id":"1:Iuk2j2LQGB+8WOMCGDNO/F9LVlw=","packets":3},"node":"spark-afae","packetPos":[-79185,1253709,82,4495],"packetRange":{"gte":1787648580759,"lte":1787648581900},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS200651 FlokiNET ehf","number":200651,"organization":{"name":"FlokiNET ehf"}},"bytes":120,"geo":{"country_iso_code":"RO"},"ip":"185.100.87.136","mac":["98:44:ce:60:15:19"],"mac-cnt":1,"packets":2,"port":39434},"srcOui":["Huawei Technologies Co.,Ltd"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[52],"srcTTLCnt":1,"tags":["bahrain-sponge-01-ts","honeypot","sensor:bahrain-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["65535_2-1-3-1-1-4_1460_8"],"ja4tCnt":1,"ja4ts":["64240_2-1-1-4-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":843891774},"totDataBytes":0}
+{"@timestamp":1787601549150,"_id":"260824-8_ITWyVj_7JLyY2eumAsL3Ks","_index":"arkime_sessions3-260824","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo GmbH"],"isp.dstCnt":1,"isp.src":["FlokiNET Ltd"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["FlokiNET Ltd"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS51167 Contabo GmbH","number":51167,"organization":{"name":"Contabo GmbH"}},"bytes":0,"geo":{"country_iso_code":"FR"},"ip":"109.123.246.142","mac":["00:50:56:63:46:a6"],"mac-cnt":1,"packets":0,"port":2222},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[78923],"firstPacket":1787600976915,"ipProtocol":6,"lastPacket":1787600976915,"length":0,"network":{"bytes":66,"community_id":"1:mjuIGJO2TZ41pCmY7obUFWHPxjs=","packets":1},"node":"spark-afae","packetPos":[-78923,445441],"packetRange":{"gte":1787600976915,"lte":1787600976915},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS200651 FlokiNET ehf","number":200651,"organization":{"name":"FlokiNET ehf"}},"bytes":66,"geo":{"country_iso_code":"RO"},"ip":"185.100.87.136","mac":["c0:69:11:cd:1f:19"],"mac-cnt":1,"packets":1,"port":33685},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[49],"srcTTLCnt":1,"tags":["sensor:contabo-sponge-02-ts","proxy","contabo-sponge-02-ts"],"tagsCnt":3,"tcp":{"ja4t":["65535_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":1808621043},"totDataBytes":0}
+{"@timestamp":1787595532994,"_id":"260824-3JhxSPusil1JcrsweK91cMZr","_index":"arkime_sessions3-260824","client":{"bytes":952},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["netcup GmbH"],"isp.dstCnt":1,"isp.src":["FlokiNET Ltd"],"isp.srcCnt":1,"org.dst":["Netcup KVM"],"org.dstCnt":1,"org.src":["FlokiNET Ltd"],"org.srcCnt":1,"usertype.dst":["business"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS197540 netcup GmbH","number":197540,"organization":{"name":"netcup GmbH"}},"bytes":1572,"geo":{"country_iso_code":"DE"},"ip":"159.195.21.150","mac":["8a:41:d3:b8:0d:d3"],"mac-cnt":1,"packets":9,"port":2222},"dstPayload8":"5353482d322e302d","dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[78889],"firstPacket":1787595237087,"initRTT":517,"ipProtocol":6,"lastPacket":1787595238450,"length":1363,"network":{"bytes":3200,"community_id":"1:wBZv3rx47s98sY1TSNvcL4TBu6M=","packets":19},"node":"spark-afae","packetPos":[-78889,4021067,90,2648,764,82,106,2925,296,82,802,946,82,130,82,274,278,98,82,164],"packetRange":{"gte":1787595237087,"lte":1787595238450},"protocol":["ssh","tcp"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":970},"source":{"as":{"full":"AS200651 FlokiNET ehf","number":200651,"organization":{"name":"FlokiNET ehf"}},"bytes":1628,"geo":{"country_iso_code":"RO"},"ip":"185.100.87.136","mac":["bc:0f:fe:3d:a3:a7","00:00:5e:00:01:96"],"mac-cnt":2,"packets":10,"port":51608},"srcOui":["ICANN, IANA Department","Juniper Networks"],"srcOuiCnt":2,"srcPayload8":"5353482d322e302d","srcRIR":"RIPE","srcTTL":[53],"srcTTLCnt":1,"ssh":{"hassh":["e54ef3ec27fe1fea7ab64d3fa05359fd"],"hasshCnt":1,"hasshServer":["41a85c886a9e9b845f0e69d68994492a"],"hasshServerCnt":1,"ja4ssh":["c16s16_c4s4_c3s3"],"ja4sshCnt":1,"version":["ssh-2.0-openssh_9.6p1 ubuntu-3ubuntu13.5","ssh-2.0-openssh_10.2p1"],"versionCnt":2},"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["1501560102561150"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["537cee16-c4a9-45cd-baf1-75963ab7bdd2","b1859b91-92d5-48d2-b43d-bbfd09db964d"],"signatureCnt":2,"signatureId":[1080086,1031283],"signatureIdCnt":2},"tag":{"block":["true"],"blockCnt":1,"category":["activity"],"categoryCnt":1,"description":["ip addresses with this tag have been observed crawling the internet for ssh servers running on ports other than 22/tcp.","ip addresses with this tag have been observed attempting to negotiate an ssh session."],"intention":["suspicious"],"intentionCnt":1,"name":["ssh alternative port crawler","ssh connection attempt"],"nameCnt":2},"tags":["honeypot","netcup-ts","sensor:netcup-ts"],"tagsCnt":3,"tcp":{"ja4l":"517770_53_15742","ja4t":["64240_2-4-8-1-3_1460_7"],"ja4tCnt":1,"ja4ts":["43440_2-4-8-1-3_1460_11"],"ja4tsCnt":1},"tcpflags":{"ack":6,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":2,"psh":8,"rst":0,"srcZero":0,"syn":2,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":1930145605},"totDataBytes":1922}
+{"@timestamp":1787595532965,"_id":"260824-3JhHdXkRRdVDIpKGYPHCDzEY","_index":"arkime_sessions3-260824","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["netcup GmbH"],"isp.dstCnt":1,"isp.src":["FlokiNET Ltd"],"isp.srcCnt":1,"org.dst":["Netcup KVM"],"org.dstCnt":1,"org.src":["FlokiNET Ltd"],"org.srcCnt":1,"usertype.dst":["business"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS197540 netcup GmbH","number":197540,"organization":{"name":"netcup GmbH"}},"bytes":66,"geo":{"country_iso_code":"DE"},"ip":"159.195.21.150","mac":["8a:41:d3:b8:0d:d3"],"mac-cnt":1,"packets":1,"port":2222},"dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[78889],"firstPacket":1787595235949,"ipProtocol":6,"lastPacket":1787595237002,"length":1053,"network":{"bytes":188,"community_id":"1:Av/gcha36ZmwdMvAaWrTXqEKwoY=","packets":3},"node":"spark-afae","packetPos":[-78889,4017659,82,3164],"packetRange":{"gte":1787595235949,"lte":1787595237002},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS200651 FlokiNET ehf","number":200651,"organization":{"name":"FlokiNET ehf"}},"bytes":122,"geo":{"country_iso_code":"RO"},"ip":"185.100.87.136","mac":["bc:0f:fe:3d:a3:a7","00:00:5e:00:01:96"],"mac-cnt":2,"packets":2,"port":43624},"srcOui":["ICANN, IANA Department","Juniper Networks"],"srcOuiCnt":2,"srcRIR":"RIPE","srcTTL":[53],"srcTTLCnt":1,"tags":["honeypot","netcup-ts","sensor:netcup-ts"],"tagsCnt":3,"tcp":{"ja4t":["65535_2-1-3-1-1-4_1460_8"],"ja4tCnt":1,"ja4ts":["42340_2-1-1-4-1-3_1460_11"],"ja4tsCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":3975408297},"totDataBytes":0}
+{"@timestamp":1787595833040,"_id":"260824-NvJVJzxbvsNAELyYXDmreZkk","_index":"arkime_sessions3-260824","client":{"bytes":952},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["FlokiNET Ltd"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["FlokiNET Ltd"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":1572,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":9,"port":2222},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstPayload8":"5353482d322e302d","dstRIR":"RIPE","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[78891],"firstPacket":1787594536933,"initRTT":599,"ipProtocol":6,"lastPacket":1787594538843,"length":1910,"network":{"bytes":3200,"community_id":"1:lCiOeVpAWHktteIxk6FlopYyyo8=","packets":19},"node":"spark-afae","packetPos":[-78891,316720,90,2262,1418,82,106,1665,206,82,802,946,172,130,82,274,506,98,82,164],"packetRange":{"gte":1787594536933,"lte":1787594538843},"protocol":["ssh","tcp"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":970},"source":{"as":{"full":"AS200651 FlokiNET ehf","number":200651,"organization":{"name":"FlokiNET ehf"}},"bytes":1628,"geo":{"country_iso_code":"RO"},"ip":"185.100.87.136","mac":["fc:bd:67:9d:2b:2b","00:c0:1d:c0:ff:ee"],"mac-cnt":2,"packets":10,"port":40412},"srcOui":["Grand Junction Networks, Inc.","Arista Networks"],"srcOuiCnt":2,"srcPayload8":"5353482d322e302d","srcRIR":"RIPE","srcTTL":[55],"srcTTLCnt":1,"ssh":{"hassh":["e54ef3ec27fe1fea7ab64d3fa05359fd"],"hasshCnt":1,"hasshServer":["41a85c886a9e9b845f0e69d68994492a"],"hasshServerCnt":1,"ja4ssh":["c16s16_c4s4_c3s3"],"ja4sshCnt":1,"version":["ssh-2.0-openssh_9.6p1 ubuntu-3ubuntu13.5","ssh-2.0-openssh_10.2p1"],"versionCnt":2},"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["67425741031979"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["537cee16-c4a9-45cd-baf1-75963ab7bdd2","b1859b91-92d5-48d2-b43d-bbfd09db964d"],"signatureCnt":2,"signatureId":[1080086,1031283],"signatureIdCnt":2},"tag":{"block":["true"],"blockCnt":1,"category":["activity"],"categoryCnt":1,"description":["ip addresses with this tag have been observed attempting to negotiate an ssh session.","ip addresses with this tag have been observed crawling the internet for ssh servers running on ports other than 22/tcp."],"intention":["suspicious"],"intentionCnt":1,"name":["ssh alternative port crawler","ssh connection attempt"],"nameCnt":2},"tags":["honeypot","contabo-sponge-01-ts","sensor:contabo-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4l":"598637_55_87399","ja4t":["64240_2-4-8-1-3_1460_7"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":6,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":2,"psh":8,"rst":0,"srcZero":0,"syn":2,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":491842575},"totDataBytes":1922}
+{"@timestamp":1787595833040,"_id":"260824-NvLF1fabgXxJb4EDvEqIxawJ","_index":"arkime_sessions3-260824","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["FlokiNET Ltd"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["FlokiNET Ltd"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":66,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":1,"port":2222},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[78891],"firstPacket":1787594535735,"ipProtocol":6,"lastPacket":1787594536910,"length":1175,"network":{"bytes":192,"community_id":"1:7+qrkEfJeMXtxN1xQUOkKdSO3HE=","packets":3},"node":"spark-afae","packetPos":[-78891,310692,82,5870],"packetRange":{"gte":1787594535735,"lte":1787594536910},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS200651 FlokiNET ehf","number":200651,"organization":{"name":"FlokiNET ehf"}},"bytes":126,"geo":{"country_iso_code":"RO"},"ip":"185.100.87.136","mac":["fc:bd:67:9d:2b:2b","00:c0:1d:c0:ff:ee"],"mac-cnt":2,"packets":2,"port":60298},"srcOui":["Grand Junction Networks, Inc.","Arista Networks"],"srcOuiCnt":2,"srcRIR":"RIPE","srcTTL":[55],"srcTTLCnt":1,"tags":["honeypot","contabo-sponge-01-ts","sensor:contabo-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["65535_2-1-3-1-1-4_1460_8"],"ja4tCnt":1,"ja4ts":["64240_2-1-1-4-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":2340123840},"totDataBytes":0}
+{"@timestamp":1787594933256,"_id":"260824-0ZiSW7oXgNlEcLAbPy9Xn4AA","_index":"arkime_sessions3-260824","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["FlokiNET Ltd"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["FlokiNET Ltd"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":66,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":1,"port":2222},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[78886],"firstPacket":1787594447960,"ipProtocol":6,"lastPacket":1787594447960,"length":0,"network":{"bytes":132,"community_id":"1:wnyOwbqyEnmnrJojTtO7nEXeUV0=","packets":2},"node":"spark-afae","packetPos":[-78886,6727312,82],"packetRange":{"gte":1787594447960,"lte":1787594447960},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS200651 FlokiNET ehf","number":200651,"organization":{"name":"FlokiNET ehf"}},"bytes":66,"geo":{"country_iso_code":"RO"},"ip":"185.100.87.136","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":1,"port":52900},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[52],"srcTTLCnt":1,"tags":["frantech-ts","honeypot","sensor:frantech-ts"],"tagsCnt":3,"tcp":{"ja4t":["65535_2-1-3-1-1-4_1400_8"],"ja4tCnt":1,"ja4ts":["64240_2-1-1-4-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":2086775818},"totDataBytes":0}
+{"@timestamp":1787584972718,"_id":"260824-zvDgn2cLAkdP148xysBnOrhn","_index":"arkime_sessions3-260824","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["FlokiNET Ltd"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["FlokiNET Ltd"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":74,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":1,"port":443},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[78831],"firstPacket":1787584079567,"ipProtocol":6,"lastPacket":1787584082661,"length":3094,"network":{"bytes":296,"community_id":"1:K30lE/P6p7sAcHktouxYQIRctfo=","packets":4},"node":"spark-afae","packetPos":[-78831,1500815,90,5042,6539],"packetRange":{"gte":1787584079567,"lte":1787584082661},"protocol":["tcp"],"protocolCnt":1,"rootId":"260824-zvDgn2cLAkdP148xysBnOrhn","segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS200651 FlokiNET ehf","number":200651,"organization":{"name":"FlokiNET ehf"}},"bytes":222,"geo":{"country_iso_code":"RO"},"ip":"185.100.87.136","mac":["fc:bd:67:9d:2b:2b","00:c0:1d:c0:ff:ee"],"mac-cnt":2,"packets":3,"port":53472},"srcOui":["Arista Networks","Grand Junction Networks, Inc."],"srcOuiCnt":2,"srcRIR":"RIPE","srcTTL":[55],"srcTTLCnt":1,"tags":["sensor:contabo-sponge-01-ts","honeypot","contabo-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-4-8-1-3_1460_7"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":3,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":3613994254},"totDataBytes":0}
+{"@timestamp":1787584972718,"_id":"260824-zvCXnfYm6fJF0aWgRuAfAtQ2","_index":"arkime_sessions3-260824","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["FlokiNET Ltd"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["FlokiNET Ltd"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":74,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":1,"port":443},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[78831],"firstPacket":1787584074567,"ipProtocol":6,"lastPacket":1787584077668,"length":3101,"network":{"bytes":296,"community_id":"1:+d/m0Wv+Aiq5ZO3MeMO+by6nEDY=","packets":4},"node":"spark-afae","packetPos":[-78831,1482765,90,6474,3918],"packetRange":{"gte":1787584074567,"lte":1787584077668},"protocol":["tcp"],"protocolCnt":1,"rootId":"260824-zvCXnfYm6fJF0aWgRuAfAtQ2","segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS200651 FlokiNET ehf","number":200651,"organization":{"name":"FlokiNET ehf"}},"bytes":222,"geo":{"country_iso_code":"RO"},"ip":"185.100.87.136","mac":["fc:bd:67:9d:2b:2b","00:c0:1d:c0:ff:ee"],"mac-cnt":2,"packets":3,"port":53458},"srcOui":["Arista Networks","Grand Junction Networks, Inc."],"srcOuiCnt":2,"srcRIR":"RIPE","srcTTL":[55],"srcTTLCnt":1,"tags":["sensor:contabo-sponge-01-ts","honeypot","contabo-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-4-8-1-3_1460_7"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":3,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":2884413915},"totDataBytes":0}
+{"@timestamp":1787582557952,"_id":"260824-gfCoKsBqXkNP1qN6Vl-pOYWE","_index":"arkime_sessions3-260824","client":{"bytes":743},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo GmbH"],"isp.dstCnt":1,"isp.src":["FlokiNET Ltd"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["FlokiNET Ltd"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS51167 Contabo GmbH","number":51167,"organization":{"name":"Contabo GmbH"}},"bytes":206,"geo":{"country_iso_code":"FR"},"ip":"109.123.246.142","mac":["00:50:56:63:46:a6"],"mac-cnt":1,"packets":3,"port":443},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[78818],"firstPacket":1787582227016,"http":{"bodyMagic":["application/octet-stream"],"bodyMagicCnt":1,"clientVersion":["1.1"],"clientVersionCnt":1,"host":["109.123.246.142","109.123.246.142:443"],"hostCnt":2,"ja4h":["po11nn060000_f70d2564bd2a_000000000000_000000000000"],"ja4hCnt":1,"ja4h_r":["po11nn060000_Host,User-Agent,Content-Length,Accept-Encoding,Content-Type,Secret__"],"ja4h_rCnt":1,"key":["os","commit","arch"],"keyCnt":3,"md5":["7b9b6ff541e18bccaa9f5b44d2d1cd9b"],"md5Cnt":1,"method":["POST"],"method-POST":1,"methodCnt":1,"path":["/api/client/update"],"pathCnt":1,"requestBody":[""],"requestHeader":["user-agent","accept-encoding","host","content-type","content-length","secret"],"requestHeaderCnt":6,"requestHeaderField":["content-length","accept-encoding","content-type","secret"],"requestHeaderValue":["384","gzip","application/octet-stream","3de172c65c5204dbce4c985d6616ca6fbbf337be4ddd40746307af802fa510a2"],"requestHeaderValueCnt":4,"sha256":["d475150d580c13632457dd7b3ccc53cf2aaa612e50629ba31d15b0a825bd1c36"],"sha256Cnt":1,"uri":["109.123.246.142:443/api/client/update?arch=amd64\u0026commit=08059e95dacafe0bf6e5782f8e2c8ec9cd8c5a17\u0026os=windows"],"uriCnt":1,"useragent":["SPARK COMMIT: 08059e95dacafe0bf6e5782f8e2c8ec9cd8c5a17"],"useragentCnt":1,"value":["windows","amd64","08059e95dacafe0bf6e5782f8e2c8ec9cd8c5a17"],"valueCnt":3},"initRTT":538,"ipProtocol":6,"lastPacket":1787582228201,"length":1185,"network":{"bytes":1229,"community_id":"1:uVUi5q0QdWVBQmVkerDBe/l2IuQ=","packets":7},"node":"spark-afae","packetPos":[-78818,882998,90,500,180,82,825,246],"packetRange":{"gte":1787582227016,"lte":1787582228201},"protocol":["http","tcp"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS200651 FlokiNET ehf","number":200651,"organization":{"name":"FlokiNET ehf"}},"bytes":1023,"geo":{"country_iso_code":"RO"},"ip":"185.100.87.136","mac":["c0:69:11:cd:1f:19","00:c0:1d:c0:ff:ee"],"mac-cnt":2,"packets":4,"port":56926},"srcOui":["Arista Networks","Grand Junction Networks, Inc."],"srcOuiCnt":2,"srcPayload8":"504f5354202f6170","srcRIR":"RIPE","srcTTL":[49],"srcTTLCnt":1,"tags":["contabo-sponge-02-ts","proxy","sensor:contabo-sponge-02-ts"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-4-8-1-3_1460_7"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":2,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":1,"rst":1,"srcZero":0,"syn":2,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":3686187698},"totDataBytes":743}
+{"@timestamp":1787582557952,"_id":"260824-gfAbRSNTJ55GnYdB7VkW0IUD","_index":"arkime_sessions3-260824","cert":[{"curve":"prime256v1","hash":"09:70:ea:39:86:69:5a:f1:83:45:93:40:ee:12:e7:1c:53:c7:21:a5","issuerCN":["asa temporary self signed certificate"],"ja4x":"7022c563de38_7022c563de38_000000000000","ja4x_r":"550403_550403_","notAfter":2092893639000,"notBefore":1777533639000,"publicAlgorithm":"id-ecPublicKey","remainingDays":3533,"remainingSeconds":305311414,"serial":"c802f369","subjectCN":["asa temporary self signed certificate"],"validDays":3650,"validSeconds":315360000}],"certCnt":1,"client":{"bytes":599},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo GmbH"],"isp.dstCnt":1,"isp.src":["FlokiNET Ltd"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["FlokiNET Ltd"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS51167 Contabo GmbH","number":51167,"organization":{"name":"Contabo GmbH"}},"bytes":2598,"geo":{"country_iso_code":"FR"},"ip":"109.123.246.142","mac":["00:50:56:63:46:a6"],"mac-cnt":1,"packets":8,"port":443},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstPayload8":"1603030059020000","dstRIR":"RIPE","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[78818],"firstPacket":1787582225716,"initRTT":516,"ipProtocol":6,"lastPacket":1787582227049,"length":1333,"network":{"bytes":3873,"community_id":"1:1hM2w+iwtbRt6tZS3EEqWOpXI7w=","packets":18},"node":"spark-afae","packetPos":[-78818,878544,90,457,180,82,343,82,692,82,208,82,133,294,1097,468,82,262,82],"packetRange":{"gte":1787582225716,"lte":1787582227049},"protocol":["tls","tcp"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":2062},"source":{"as":{"full":"AS200651 FlokiNET ehf","number":200651,"organization":{"name":"FlokiNET ehf"}},"bytes":1275,"geo":{"country_iso_code":"RO"},"ip":"185.100.87.136","mac":["c0:69:11:cd:1f:19","00:c0:1d:c0:ff:ee"],"mac-cnt":2,"packets":10,"port":56912},"srcOui":["Arista Networks","Grand Junction Networks, Inc."],"srcOuiCnt":2,"srcPayload8":"1603010100010000","srcRIR":"RIPE","srcTTL":[49],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["542047982741268"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["ac32bdeb-b49d-4079-9e6b-8fbca5e0addf"],"signatureCnt":1,"signatureId":[1031336],"signatureIdCnt":1},"tag":{"block":["false"],"blockCnt":1,"category":["protocol"],"categoryCnt":1,"description":["ip addresses with this tag have been observed attempting to opportunistically crawl the internet and establish tls/ssl connections."],"intention":["unknown"],"intentionCnt":1,"name":["tls/ssl crawler"],"nameCnt":1},"tags":["contabo-sponge-02-ts","proxy","cert:self-signed","sensor:contabo-sponge-02-ts"],"tagsCnt":4,"tcp":{"ja4l":"516564_49_23932","ja4t":["64240_2-4-8-1-3_1460_7"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":6,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":2,"psh":7,"rst":0,"srcZero":0,"syn":2,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":2723882605},"tls":{"cipher":["TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384"],"cipherCnt":1,"dstSessionId":["7b44f07292e1c3bb838645415c2fae69c9678a886eb3ecefd7a232257c0c8b9f"],"ja3":["7c1e207beb00684bbbe144f1b0abe1d5"],"ja3Cnt":1,"ja3s":["e58f0b3c1e9eefb8ee4f92aeceee5858"],"ja3sCnt":1,"ja3sstring":["771,49196,65281-11"],"ja3sstringCnt":1,"ja3string":["771,52392-52393-49199-49200-49195-49196-49171-49161-49172-49162-156-157-47-53-49170-10-4867-4865-4866,5-10-11-13-65281-16-18-43-51,29-23-24-25,0"],"ja3stringCnt":1,"ja4":["t13i1909h2_9dc949149365_97f8aa674fd9"],"ja4Cnt":1,"ja4_r":["t13i1909h2_000a,002f,0035,009c,009d,1301,1302,1303,c009,c00a,c012,c013,c014,c02b,c02c,c02f,c030,cca8,cca9_0005,000a,000b,000d,0012,002b,0033,ff01_0804,0403,0807,0805,0806,0401,0501,0601,0503,0603,0201,0203"],"ja4_rCnt":1,"ja4s":["t120200_c02c_344b4dce5a52"],"ja4sCnt":1,"ja4s_r":["t120200_c02c_ff01,000b"],"ja4s_rCnt":1,"srcSessionId":["d23f5dd80722a36bd7b468a3c211de10c7a7d1a940fd2519fe08caa4eba33945"],"version":["TLSv1.2"],"versionCnt":1},"totDataBytes":2661}
+{"@timestamp":1787572321169,"_id":"260824-Q--WG83eM2dF5YT4XDO57RwQ","_index":"arkime_sessions3-260824","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["FlokiNET Ltd"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["FlokiNET Ltd"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":66,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":1,"port":443},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[78762],"firstPacket":1787571566606,"ipProtocol":6,"lastPacket":1787571567820,"length":1214,"network":{"bytes":192,"community_id":"1:g27gIaBCwBQj25axLWWA9SZwRrY=","packets":3},"node":"spark-afae","packetPos":[-78762,2141934,82,3788],"packetRange":{"gte":1787571566606,"lte":1787571567820},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS200651 FlokiNET ehf","number":200651,"organization":{"name":"FlokiNET ehf"}},"bytes":126,"geo":{"country_iso_code":"RO"},"ip":"185.100.87.136","mac":["fc:bd:67:9d:2b:2b","00:c0:1d:c0:ff:ee"],"mac-cnt":2,"packets":2,"port":40380},"srcOui":["Arista Networks","Grand Junction Networks, Inc."],"srcOuiCnt":2,"srcRIR":"RIPE","srcTTL":[55],"srcTTLCnt":1,"tags":["contabo-sponge-01-ts","sensor:contabo-sponge-01-ts","honeypot"],"tagsCnt":3,"tcp":{"ja4t":["65535_2-1-3-1-1-4_1460_8"],"ja4tCnt":1,"ja4ts":["64240_2-1-1-4-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":3242376466},"totDataBytes":0}
+{"@timestamp":1787572012162,"_id":"260824-2Zbsz6f3-oJIbZXCQXLLUn-1","_index":"arkime_sessions3-260824","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo GmbH"],"isp.dstCnt":1,"isp.src":["FlokiNET Ltd"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["FlokiNET Ltd"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS51167 Contabo GmbH","number":51167,"organization":{"name":"Contabo GmbH"}},"bytes":66,"geo":{"country_iso_code":"FR"},"ip":"109.123.246.142","mac":["00:50:56:63:46:a6"],"mac-cnt":1,"packets":1,"port":443},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[78758],"firstPacket":1787570824981,"ipProtocol":6,"lastPacket":1787570828093,"length":3112,"network":{"bytes":192,"community_id":"1:6UXKWbT65zmAfPkGjXn0SbEzIA0=","packets":3},"node":"spark-afae","packetPos":[-78758,344277,82,3203],"packetRange":{"gte":1787570824981,"lte":1787570828093},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS200651 FlokiNET ehf","number":200651,"organization":{"name":"FlokiNET ehf"}},"bytes":126,"geo":{"country_iso_code":"RO"},"ip":"185.100.87.136","mac":["c0:69:11:cd:1f:19","00:c0:1d:c0:ff:ee"],"mac-cnt":2,"packets":2,"port":53894},"srcOui":["Arista Networks","Grand Junction Networks, Inc."],"srcOuiCnt":2,"srcRIR":"RIPE","srcTTL":[49],"srcTTLCnt":1,"tags":["contabo-sponge-02-ts","sensor:contabo-sponge-02-ts","proxy"],"tagsCnt":3,"tcp":{"ja4t":["65535_2-1-3-1-1-4_1460_8"],"ja4tCnt":1,"ja4ts":["64240_2-1-1-4-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":1903896232},"totDataBytes":0}
+{"@timestamp":1787570802851,"_id":"260824-w5Z0fXIB2WtOYrDP6GnfOQIu","_index":"arkime_sessions3-260824","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["FlokiNET Ltd"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["FlokiNET Ltd"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":66,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":1,"port":443},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[78753],"firstPacket":1787570250250,"ipProtocol":6,"lastPacket":1787570250250,"length":0,"network":{"bytes":132,"community_id":"1:b2GLHaF4Uht48EcOXF4KS9j550k=","packets":2},"node":"spark-afae","packetPos":[-78753,2614640,82],"packetRange":{"gte":1787570250250,"lte":1787570250250},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS200651 FlokiNET ehf","number":200651,"organization":{"name":"FlokiNET ehf"}},"bytes":66,"geo":{"country_iso_code":"RO"},"ip":"185.100.87.136","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":1,"port":58730},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[52],"srcTTLCnt":1,"tags":["sensor:frantech-ts","frantech-ts","honeypot"],"tagsCnt":3,"tcp":{"ja4t":["65535_2-1-3-1-1-4_1400_8"],"ja4tCnt":1,"ja4ts":["64240_2-1-1-4-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":3452192720},"totDataBytes":0}
+{"@timestamp":1787565663731,"_id":"260824-Z-4d-bsiRDZMXITAPQMX6_bi","_index":"arkime_sessions3-260824","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Kaopu Cloud HK Limited"],"isp.dstCnt":1,"isp.src":["FlokiNET Ltd"],"isp.srcCnt":1,"org.dst":["LightNode-BH"],"org.dstCnt":1,"org.src":["FlokiNET Ltd"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":66,"geo":{"country_iso_code":"BH"},"ip":"38.54.2.209","mac":["52:54:8f:9d:76:48"],"mac-cnt":1,"packets":1,"port":443},"dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[78725],"firstPacket":1787564906001,"ipProtocol":6,"lastPacket":1787564906001,"length":0,"network":{"bytes":132,"community_id":"1:U0C5rhqQxhmlrFKb441HIr3iuTY=","packets":2},"node":"spark-afae","packetPos":[-78725,3562752,82],"packetRange":{"gte":1787564906001,"lte":1787564906001},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS200651 FlokiNET ehf","number":200651,"organization":{"name":"FlokiNET ehf"}},"bytes":66,"geo":{"country_iso_code":"RO"},"ip":"185.100.87.136","mac":["98:44:ce:60:15:19"],"mac-cnt":1,"packets":1,"port":38342},"srcOui":["Huawei Technologies Co.,Ltd"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[52],"srcTTLCnt":1,"tags":["honeypot","sensor:bahrain-sponge-01-ts","bahrain-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["65535_2-1-3-1-1-4_1460_8"],"ja4tCnt":1,"ja4ts":["64240_2-1-1-4-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":3366229933},"totDataBytes":0}
+{"@timestamp":1787564152808,"_id":"260824-7zHLXxZz44RJ8apZHv7pMk1y","_index":"arkime_sessions3-260824","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["netcup GmbH"],"isp.dstCnt":1,"isp.src":["FlokiNET Ltd"],"isp.srcCnt":1,"org.dst":["Netcup KVM"],"org.dstCnt":1,"org.src":["FlokiNET Ltd"],"org.srcCnt":1,"usertype.dst":["business"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS197540 netcup GmbH","number":197540,"organization":{"name":"netcup GmbH"}},"bytes":66,"geo":{"country_iso_code":"DE"},"ip":"159.195.21.150","mac":["8a:41:d3:b8:0d:d3"],"mac-cnt":1,"packets":1,"port":443},"dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[78715],"firstPacket":1787562978248,"ipProtocol":6,"lastPacket":1787562978248,"length":0,"network":{"bytes":132,"community_id":"1:qfi2cephLFfpf6XSDFeRRbeYXHQ=","packets":2},"node":"spark-afae","packetPos":[-78715,555465,82],"packetRange":{"gte":1787562978248,"lte":1787562978248},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS200651 FlokiNET ehf","number":200651,"organization":{"name":"FlokiNET ehf"}},"bytes":66,"geo":{"country_iso_code":"RO"},"ip":"185.100.87.136","mac":["bc:0f:fe:3d:a3:a7","00:00:5e:00:01:96"],"mac-cnt":2,"packets":1,"port":51302},"srcOui":["ICANN, IANA Department","Juniper Networks"],"srcOuiCnt":2,"srcRIR":"RIPE","srcTTL":[53],"srcTTLCnt":1,"tags":["honeypot","sensor:netcup-ts","netcup-ts"],"tagsCnt":3,"tcp":{"ja4t":["65535_2-1-3-1-1-4_1460_8"],"ja4tCnt":1,"ja4ts":["42340_2-1-1-4-1-3_1460_11"],"ja4tsCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":3253473039},"totDataBytes":0}
+{"@timestamp":1787555351979,"_id":"260824-hZUsN_losp9O_qky2cTn1_Ip","_index":"arkime_sessions3-260824","client":{"bytes":52},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["netcup GmbH"],"isp.dstCnt":1,"isp.src":["FlokiNET Ltd"],"isp.srcCnt":1,"org.dst":["Netcup KVM"],"org.dstCnt":1,"org.src":["FlokiNET Ltd"],"org.srcCnt":1,"usertype.dst":["business"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS197540 netcup GmbH","number":197540,"organization":{"name":"netcup GmbH"}},"bytes":0,"geo":{"country_iso_code":"DE"},"ip":"159.195.21.150","mac":["8a:41:d3:b8:0d:d3"],"mac-cnt":1,"packets":0,"port":443},"dstRIR":"ARIN","ethertype":2048,"fileId":[78667],"firstPacket":1787554313284,"ipProtocol":17,"lastPacket":1787554313284,"length":0,"network":{"bytes":94,"community_id":"1:DOLo1ipOS55A++96wB3zZ4VB2yM=","packets":1},"node":"spark-afae","packetPos":[-78667,4835560],"packetRange":{"gte":1787554313284,"lte":1787554313284},"protocol":["udp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS200651 FlokiNET ehf","number":200651,"organization":{"name":"FlokiNET ehf"}},"bytes":94,"geo":{"country_iso_code":"RO"},"ip":"185.100.87.136","mac":["bc:0f:fe:3d:a3:a7"],"mac-cnt":1,"packets":1,"port":55266},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcPayload8":"08ef002600000000","srcRIR":"RIPE","srcTTL":[53],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["379633829626034"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["f30d8a4b-8331-4517-8035-34b2a818e4fe"],"signatureCnt":1,"signatureId":[1071783],"signatureIdCnt":1},"tag":{"block":["false"],"blockCnt":1,"category":["protocol"],"categoryCnt":1,"description":["ip addresses with this tag have been observed sending quic traffic."],"intention":["unknown"],"intentionCnt":1,"name":["quic protocol"],"nameCnt":1},"tags":["sensor:netcup-ts","netcup-ts","honeypot"],"tagsCnt":3,"totDataBytes":52}
+{"@timestamp":1787554149835,"_id":"260824-6Oxo-6rO2hdDZbTVIfPcmkU6","_index":"arkime_sessions3-260824","client":{"bytes":52},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Kaopu Cloud HK Limited"],"isp.dstCnt":1,"isp.src":["FlokiNET Ltd"],"isp.srcCnt":1,"org.dst":["LightNode-BH"],"org.dstCnt":1,"org.src":["FlokiNET Ltd"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":0,"geo":{"country_iso_code":"BH"},"ip":"38.54.2.209","mac":["52:54:8f:9d:76:48"],"mac-cnt":1,"packets":0,"port":443},"dstRIR":"ARIN","ethertype":2048,"fileId":[78661],"firstPacket":1787552731747,"ipProtocol":17,"lastPacket":1787552731747,"length":0,"network":{"bytes":94,"community_id":"1:67oLdK72MDbmv+/bllrx++kdmEU=","packets":1},"node":"spark-afae","packetPos":[-78661,429420],"packetRange":{"gte":1787552731747,"lte":1787552731747},"protocol":["udp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS200651 FlokiNET ehf","number":200651,"organization":{"name":"FlokiNET ehf"}},"bytes":94,"geo":{"country_iso_code":"RO"},"ip":"185.100.87.136","mac":["98:44:ce:60:15:19"],"mac-cnt":1,"packets":1,"port":43211},"srcOui":["Huawei Technologies Co.,Ltd"],"srcOuiCnt":1,"srcPayload8":"08ef002600000000","srcRIR":"RIPE","srcTTL":[52],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["959525489704739"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["f30d8a4b-8331-4517-8035-34b2a818e4fe"],"signatureCnt":1,"signatureId":[1071783],"signatureIdCnt":1},"tag":{"block":["false"],"blockCnt":1,"category":["protocol"],"categoryCnt":1,"description":["ip addresses with this tag have been observed sending quic traffic."],"intention":["unknown"],"intentionCnt":1,"name":["quic protocol"],"nameCnt":1},"tags":["bahrain-sponge-01-ts","honeypot","sensor:bahrain-sponge-01-ts"],"tagsCnt":3,"totDataBytes":52}
+{"@timestamp":1787547789176,"_id":"260824-AJWClDJVzCdIAqAHHpbTIQDc","_index":"arkime_sessions3-260824","client":{"bytes":52},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo GmbH"],"isp.dstCnt":1,"isp.src":["FlokiNET Ltd"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["FlokiNET Ltd"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS51167 Contabo GmbH","number":51167,"organization":{"name":"Contabo GmbH"}},"bytes":0,"geo":{"country_iso_code":"FR"},"ip":"109.123.246.142","mac":["00:50:56:63:46:a6"],"mac-cnt":1,"packets":0,"port":443},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[78624],"firstPacket":1787546523231,"ipProtocol":17,"lastPacket":1787546523231,"length":0,"network":{"bytes":94,"community_id":"1:4fw0CFB8eUO8cLrcG2vC2Ufc0nk=","packets":1},"node":"spark-afae","packetPos":[-78624,4984],"packetRange":{"gte":1787546523231,"lte":1787546523231},"protocol":["udp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS200651 FlokiNET ehf","number":200651,"organization":{"name":"FlokiNET ehf"}},"bytes":94,"geo":{"country_iso_code":"RO"},"ip":"185.100.87.136","mac":["c0:69:11:cd:1f:19"],"mac-cnt":1,"packets":1,"port":60820},"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcPayload8":"08ef002600000000","srcRIR":"RIPE","srcTTL":[49],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["993005445591417"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["f30d8a4b-8331-4517-8035-34b2a818e4fe"],"signatureCnt":1,"signatureId":[1071783],"signatureIdCnt":1},"tag":{"block":["false"],"blockCnt":1,"category":["protocol"],"categoryCnt":1,"description":["ip addresses with this tag have been observed sending quic traffic."],"intention":["unknown"],"intentionCnt":1,"name":["quic protocol"],"nameCnt":1},"tags":["contabo-sponge-02-ts","sensor:contabo-sponge-02-ts","proxy"],"tagsCnt":3,"totDataBytes":52}
+{"@timestamp":1787540572385,"_id":"260824-PjGzJYA1pCpPupsjQ5HpZiIX","_index":"arkime_sessions3-260824","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["netcup GmbH"],"isp.dstCnt":1,"isp.src":["FlokiNET Ltd"],"isp.srcCnt":1,"org.dst":["Netcup KVM"],"org.dstCnt":1,"org.src":["FlokiNET Ltd"],"org.srcCnt":1,"usertype.dst":["business"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS197540 netcup GmbH","number":197540,"organization":{"name":"netcup GmbH"}},"bytes":66,"geo":{"country_iso_code":"DE"},"ip":"159.195.21.150","mac":["8a:41:d3:b8:0d:d3"],"mac-cnt":1,"packets":1,"port":443},"dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[78585],"firstPacket":1787540324159,"ipProtocol":6,"lastPacket":1787540325194,"length":1035,"network":{"bytes":188,"community_id":"1:VWKKpnG45wVvZzeZTmrHU5G9Fkg=","packets":3},"node":"spark-afae","packetPos":[-78585,4670986,82,2532],"packetRange":{"gte":1787540324159,"lte":1787540325194},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS200651 FlokiNET ehf","number":200651,"organization":{"name":"FlokiNET ehf"}},"bytes":122,"geo":{"country_iso_code":"RO"},"ip":"185.100.87.136","mac":["bc:0f:fe:3d:a3:a7","00:00:5e:00:01:96"],"mac-cnt":2,"packets":2,"port":42068},"srcOui":["Juniper Networks","ICANN, IANA Department"],"srcOuiCnt":2,"srcRIR":"RIPE","srcTTL":[53],"srcTTLCnt":1,"tags":["sensor:netcup-ts","netcup-ts","honeypot"],"tagsCnt":3,"tcp":{"ja4t":["65535_2-1-3-1-1-4_1460_8"],"ja4tCnt":1,"ja4ts":["42340_2-1-1-4-1-3_1460_11"],"ja4tsCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":792133220},"totDataBytes":0}
+{"@timestamp":1787540572492,"_id":"260824-MeuMCmcQLF1EeKxZXaqVLABW","_index":"arkime_sessions3-260824","client":{"bytes":52},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["FlokiNET Ltd"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["FlokiNET Ltd"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":0,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":0,"port":443},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[78586],"firstPacket":1787539937612,"ipProtocol":17,"lastPacket":1787539937612,"length":0,"network":{"bytes":94,"community_id":"1:dD1V1mIX+64NLnlVBgBZ6z56LA0=","packets":1},"node":"spark-afae","packetPos":[-78586,29003843],"packetRange":{"gte":1787539937612,"lte":1787539937612},"protocol":["udp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS200651 FlokiNET ehf","number":200651,"organization":{"name":"FlokiNET ehf"}},"bytes":94,"geo":{"country_iso_code":"RO"},"ip":"185.100.87.136","mac":["fc:bd:67:9d:2b:2b"],"mac-cnt":1,"packets":1,"port":55851},"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcPayload8":"08ef002600000000","srcRIR":"RIPE","srcTTL":[55],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["378720375845194"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["f30d8a4b-8331-4517-8035-34b2a818e4fe"],"signatureCnt":1,"signatureId":[1071783],"signatureIdCnt":1},"tag":{"block":["false"],"blockCnt":1,"category":["protocol"],"categoryCnt":1,"description":["ip addresses with this tag have been observed sending quic traffic."],"intention":["unknown"],"intentionCnt":1,"name":["quic protocol"],"nameCnt":1},"tags":["sensor:contabo-sponge-01-ts","contabo-sponge-01-ts","honeypot"],"tagsCnt":3,"totDataBytes":52}
+{"@timestamp":1787540252035,"_id":"260824-Juv7TugryQVJe6XGq1BWrpRl","_index":"arkime_sessions3-260824","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Kaopu Cloud HK Limited"],"isp.dstCnt":1,"isp.src":["FlokiNET Ltd"],"isp.srcCnt":1,"org.dst":["LightNode-BH"],"org.dstCnt":1,"org.src":["FlokiNET Ltd"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":66,"geo":{"country_iso_code":"BH"},"ip":"38.54.2.209","mac":["52:54:8f:9d:76:48"],"mac-cnt":1,"packets":1,"port":443},"dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[78583],"firstPacket":1787539721366,"ipProtocol":6,"lastPacket":1787539722510,"length":1144,"network":{"bytes":186,"community_id":"1:IlFOs/Aj3u0I4VIa8EqHz/PEwbU=","packets":3},"node":"spark-afae","packetPos":[-78583,1619664,82,2072],"packetRange":{"gte":1787539721366,"lte":1787539722510},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS200651 FlokiNET ehf","number":200651,"organization":{"name":"FlokiNET ehf"}},"bytes":120,"geo":{"country_iso_code":"RO"},"ip":"185.100.87.136","mac":["98:44:ce:60:15:19"],"mac-cnt":1,"packets":2,"port":48670},"srcOui":["Huawei Technologies Co.,Ltd"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[51],"srcTTLCnt":1,"tags":["bahrain-sponge-01-ts","sensor:bahrain-sponge-01-ts","honeypot"],"tagsCnt":3,"tcp":{"ja4t":["65535_2-1-3-1-1-4_1460_8"],"ja4tCnt":1,"ja4ts":["64240_2-1-1-4-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":1311290946},"totDataBytes":0}
+{"@timestamp":1787537835283,"_id":"260824-OpRj1q0zqKtM5IrIGj1GEHNp","_index":"arkime_sessions3-260824","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo GmbH"],"isp.dstCnt":1,"isp.src":["FlokiNET Ltd"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["FlokiNET Ltd"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS51167 Contabo GmbH","number":51167,"organization":{"name":"Contabo GmbH"}},"bytes":66,"geo":{"country_iso_code":"FR"},"ip":"109.123.246.142","mac":["00:50:56:63:46:a6"],"mac-cnt":1,"packets":1,"port":443},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[78568],"firstPacket":1787537350021,"ipProtocol":6,"lastPacket":1787537350052,"length":31,"network":{"bytes":192,"community_id":"1:jgyjUkMNVqLRW0reWrLM+aCE+EY=","packets":3},"node":"spark-afae","packetPos":[-78568,218071,82,0],"packetRange":{"gte":1787537350021,"lte":1787537350052},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS200651 FlokiNET ehf","number":200651,"organization":{"name":"FlokiNET ehf"}},"bytes":126,"geo":{"country_iso_code":"RO"},"ip":"185.100.87.136","mac":["c0:69:11:cd:1f:19","00:c0:1d:c0:ff:ee"],"mac-cnt":2,"packets":2,"port":50831},"srcOui":["Arista Networks","Grand Junction Networks, Inc."],"srcOuiCnt":2,"srcRIR":"RIPE","srcTTL":[49],"srcTTLCnt":1,"tags":["proxy","contabo-sponge-02-ts","sensor:contabo-sponge-02-ts"],"tagsCnt":3,"tcp":{"ja4t":["65535_2-1-3-1-1-4_1460_8"],"ja4tCnt":1,"ja4ts":["64240_2-1-1-4-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":2864800397},"totDataBytes":0}
+{"@timestamp":1787535425575,"_id":"260824-iuppUb6c6gNG-rQzLrWgnhI7","_index":"arkime_sessions3-260824","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["FlokiNET Ltd"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["FlokiNET Ltd"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":66,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":1,"port":443},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[78556],"firstPacket":1787534854123,"ipProtocol":6,"lastPacket":1787534857363,"length":3240,"network":{"bytes":192,"community_id":"1:y9yNBRczI/FwrDX1h3mIKARusaY=","packets":3},"node":"spark-afae","packetPos":[-78556,12252757,82,8328],"packetRange":{"gte":1787534854123,"lte":1787534857363},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS200651 FlokiNET ehf","number":200651,"organization":{"name":"FlokiNET ehf"}},"bytes":126,"geo":{"country_iso_code":"RO"},"ip":"185.100.87.136","mac":["fc:bd:67:9d:2b:2b","00:c0:1d:c0:ff:ee"],"mac-cnt":2,"packets":2,"port":59915},"srcOui":["Arista Networks","Grand Junction Networks, Inc."],"srcOuiCnt":2,"srcRIR":"RIPE","srcTTL":[56],"srcTTLCnt":1,"tags":["contabo-sponge-01-ts","honeypot","sensor:contabo-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["65535_2-1-3-1-1-4_1460_8"],"ja4tCnt":1,"ja4ts":["64240_2-1-1-4-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":1441215478},"totDataBytes":0}
+{"@timestamp":1787534825215,"_id":"260824-A5Tbu3LBCOFBD6UQgxCHBR91","_index":"arkime_sessions3-260824","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["FlokiNET Ltd"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["FlokiNET Ltd"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":66,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":1,"port":443},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[78552],"firstPacket":1787533652698,"ipProtocol":6,"lastPacket":1787533652698,"length":0,"network":{"bytes":132,"community_id":"1:Aou8xxuhI2jEuQcFKrqUdCZqEo0=","packets":2},"node":"spark-afae","packetPos":[-78552,646933,82],"packetRange":{"gte":1787533652698,"lte":1787533652698},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS200651 FlokiNET ehf","number":200651,"organization":{"name":"FlokiNET ehf"}},"bytes":66,"geo":{"country_iso_code":"RO"},"ip":"185.100.87.136","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":1,"port":41747},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[53],"srcTTLCnt":1,"tags":["sensor:frantech-ts","honeypot","frantech-ts"],"tagsCnt":3,"tcp":{"ja4t":["65535_2-1-3-1-1-4_1400_8"],"ja4tCnt":1,"ja4ts":["64240_2-1-1-4-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":4231691570},"totDataBytes":0}
+{"@timestamp":1787525783347,"_id":"260823-PZNknT6kW7lAmKqrIL9IPA7W","_index":"arkime_sessions3-260823","client":{"bytes":261},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["FlokiNET Ltd"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["FlokiNET Ltd"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":441,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":5,"port":443},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstPayload8":"485454502f312e31","dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[78503],"firstPacket":1787524457028,"http":{"bodyMagic":["text/plain"],"bodyMagicCnt":1,"md5":["6196dba52703776af2e6593f772ed7ce"],"md5Cnt":1,"responseHeader":["connection","content-type"],"responseHeaderCnt":2,"responseHeaderField":["content-type","connection"],"responseHeaderValue":["text/plain; charset=utf-8","close"],"responseHeaderValueCnt":2,"serverVersion":["1.1"],"serverVersionCnt":1,"sha256":["19b843cc92cb12aa314bb3c3913b2feeb852e85969bf06cb9d096931bfda34ba"],"sha256Cnt":1,"statuscode":[400],"statuscodeCnt":1},"initRTT":586,"ipProtocol":6,"lastPacket":1787524458433,"length":1405,"network":{"bytes":1180,"community_id":"1:FiSLSMiOWCySQh9UGlv1gQe9Csg=","packets":12},"node":"spark-afae","packetPos":[-78503,13555,90,4014,360,82,343,82,185,2332,164,200,82],"packetRange":{"gte":1787524457028,"lte":1787524458433},"protocol":["tcp","http","tls"],"protocolCnt":3,"segmentCnt":1,"server":{"bytes":103},"source":{"as":{"full":"AS200651 FlokiNET ehf","number":200651,"organization":{"name":"FlokiNET ehf"}},"bytes":739,"geo":{"country_iso_code":"RO"},"ip":"185.100.87.136","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":7,"port":49234},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcPayload8":"1603010100010000","srcRIR":"RIPE","srcTTL":[52],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["403596705154025"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["ac32bdeb-b49d-4079-9e6b-8fbca5e0addf"],"signatureCnt":1,"signatureId":[1031336],"signatureIdCnt":1},"tag":{"block":["false"],"blockCnt":1,"category":["protocol"],"categoryCnt":1,"description":["ip addresses with this tag have been observed attempting to opportunistically crawl the internet and establish tls/ssl connections."],"intention":["unknown"],"intentionCnt":1,"name":["tls/ssl crawler"],"nameCnt":1},"tags":["honeypot","frantech-ts","sensor:frantech-ts"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-4-8-1-3_1400_7"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":5,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":2,"psh":2,"rst":0,"srcZero":0,"syn":2,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":2502411850},"tls":{"ja3":["7c1e207beb00684bbbe144f1b0abe1d5"],"ja3Cnt":1,"ja3string":["771,52392-52393-49199-49200-49195-49196-49171-49161-49172-49162-156-157-47-53-49170-10-4867-4865-4866,5-10-11-13-65281-16-18-43-51,29-23-24-25,0"],"ja3stringCnt":1,"ja4":["t13i1909h2_9dc949149365_97f8aa674fd9"],"ja4Cnt":1,"ja4_r":["t13i1909h2_000a,002f,0035,009c,009d,1301,1302,1303,c009,c00a,c012,c013,c014,c02b,c02c,c02f,c030,cca8,cca9_0005,000a,000b,000d,0012,002b,0033,ff01_0804,0403,0807,0805,0806,0401,0501,0601,0503,0603,0201,0203"],"ja4_rCnt":1,"srcSessionId":["1ecea5d953a4cbdf6e688233bc484bce91b64b72a0b1ffa03770ec14b044a1e8"]},"totDataBytes":364}
+{"@timestamp":1787522451504,"_id":"260823-1uiltFKYh_lGH5aKRTLFBNHl","_index":"arkime_sessions3-260823","client":{"bytes":261},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Kaopu Cloud HK Limited"],"isp.dstCnt":1,"isp.src":["FlokiNET Ltd"],"isp.srcCnt":1,"org.dst":["LightNode-BH"],"org.dstCnt":1,"org.src":["FlokiNET Ltd"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":441,"geo":{"country_iso_code":"BH"},"ip":"38.54.2.209","mac":["52:54:8f:9d:76:48"],"mac-cnt":1,"packets":5,"port":443},"dstPayload8":"485454502f312e31","dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[78484],"firstPacket":1787521447632,"http":{"bodyMagic":["text/plain"],"bodyMagicCnt":1,"md5":["6196dba52703776af2e6593f772ed7ce"],"md5Cnt":1,"responseHeader":["connection","content-type"],"responseHeaderCnt":2,"responseHeaderField":["content-type","connection"],"responseHeaderValue":["text/plain; charset=utf-8","close"],"responseHeaderValueCnt":2,"serverVersion":["1.1"],"serverVersionCnt":1,"sha256":["19b843cc92cb12aa314bb3c3913b2feeb852e85969bf06cb9d096931bfda34ba"],"sha256Cnt":1,"statuscode":[400],"statuscodeCnt":1},"initRTT":1071,"ipProtocol":6,"lastPacket":1787521449984,"length":2352,"network":{"bytes":1180,"community_id":"1:hm9S1Qkv1kxBIQrNrjoNUTtYo6E=","packets":12},"node":"spark-afae","packetPos":[-78484,3546420,90,16803,13554,82,343,82,185,1984,82,164,82],"packetRange":{"gte":1787521447632,"lte":1787521449984},"protocol":["tls","tcp","http"],"protocolCnt":3,"segmentCnt":1,"server":{"bytes":103},"source":{"as":{"full":"AS200651 FlokiNET ehf","number":200651,"organization":{"name":"FlokiNET ehf"}},"bytes":739,"geo":{"country_iso_code":"RO"},"ip":"185.100.87.136","mac":["98:44:ce:60:15:19"],"mac-cnt":1,"packets":7,"port":45046},"srcOui":["Huawei Technologies Co.,Ltd"],"srcOuiCnt":1,"srcPayload8":"1603010100010000","srcRIR":"RIPE","srcTTL":[51],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["2151550337763443"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["ac32bdeb-b49d-4079-9e6b-8fbca5e0addf"],"signatureCnt":1,"signatureId":[1031336],"signatureIdCnt":1},"tag":{"block":["false"],"blockCnt":1,"category":["protocol"],"categoryCnt":1,"description":["ip addresses with this tag have been observed attempting to opportunistically crawl the internet and establish tls/ssl connections."],"intention":["unknown"],"intentionCnt":1,"name":["tls/ssl crawler"],"nameCnt":1},"tags":["bahrain-sponge-01-ts","honeypot","sensor:bahrain-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-4-8-1-3_1460_7"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":5,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":2,"psh":2,"rst":0,"srcZero":0,"syn":2,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":1566349163},"tls":{"ja3":["7c1e207beb00684bbbe144f1b0abe1d5"],"ja3Cnt":1,"ja3string":["771,52392-52393-49199-49200-49195-49196-49171-49161-49172-49162-156-157-47-53-49170-10-4867-4865-4866,5-10-11-13-65281-16-18-43-51,29-23-24-25,0"],"ja3stringCnt":1,"ja4":["t13i1909h2_9dc949149365_97f8aa674fd9"],"ja4Cnt":1,"ja4_r":["t13i1909h2_000a,002f,0035,009c,009d,1301,1302,1303,c009,c00a,c012,c013,c014,c02b,c02c,c02f,c030,cca8,cca9_0005,000a,000b,000d,0012,002b,0033,ff01_0804,0403,0807,0805,0806,0401,0501,0601,0503,0603,0201,0203"],"ja4_rCnt":1,"srcSessionId":["85c5abba8071e58e8c69b4050d3eb9a5a89c41b4e004c9c8de1f4dac55f0105b"]},"totDataBytes":364}
+{"@timestamp":1787520650297,"_id":"260823-uTDOBqM8NrJMK6oW1wJrj1mz","_index":"arkime_sessions3-260823","client":{"bytes":261},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["netcup GmbH"],"isp.dstCnt":1,"isp.src":["FlokiNET Ltd"],"isp.srcCnt":1,"org.dst":["Netcup KVM"],"org.dstCnt":1,"org.src":["FlokiNET Ltd"],"org.srcCnt":1,"usertype.dst":["business"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS197540 netcup GmbH","number":197540,"organization":{"name":"netcup GmbH"}},"bytes":441,"geo":{"country_iso_code":"DE"},"ip":"159.195.21.150","mac":["8a:41:d3:b8:0d:d3"],"mac-cnt":1,"packets":5,"port":443},"dstPayload8":"485454502f312e31","dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[78474],"firstPacket":1787520229835,"http":{"bodyMagic":["text/plain"],"bodyMagicCnt":1,"md5":["6196dba52703776af2e6593f772ed7ce"],"md5Cnt":1,"responseHeader":["content-type","connection"],"responseHeaderCnt":2,"responseHeaderField":["content-type","connection"],"responseHeaderValue":["text/plain; charset=utf-8","close"],"responseHeaderValueCnt":2,"serverVersion":["1.1"],"serverVersionCnt":1,"sha256":["19b843cc92cb12aa314bb3c3913b2feeb852e85969bf06cb9d096931bfda34ba"],"sha256Cnt":1,"statuscode":[400],"statuscodeCnt":1},"initRTT":527,"ipProtocol":6,"lastPacket":1787520231065,"length":1230,"network":{"bytes":1180,"community_id":"1:E4NnOq9IIqsN4hW7xxKBCljk+lY=","packets":12},"node":"spark-afae","packetPos":[-78474,3289030,90,11867,180,82,343,82,357,82,468,246,82],"packetRange":{"gte":1787520229835,"lte":1787520231065},"protocol":["http","tcp","tls"],"protocolCnt":3,"segmentCnt":1,"server":{"bytes":103},"source":{"as":{"full":"AS200651 FlokiNET ehf","number":200651,"organization":{"name":"FlokiNET ehf"}},"bytes":739,"geo":{"country_iso_code":"RO"},"ip":"185.100.87.136","mac":["bc:0f:fe:3d:a3:a7","00:00:5e:00:01:96"],"mac-cnt":2,"packets":7,"port":55990},"srcOui":["Juniper Networks","ICANN, IANA Department"],"srcOuiCnt":2,"srcPayload8":"1603010100010000","srcRIR":"RIPE","srcTTL":[53],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["1618301817732171"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["ac32bdeb-b49d-4079-9e6b-8fbca5e0addf"],"signatureCnt":1,"signatureId":[1031336],"signatureIdCnt":1},"tag":{"block":["false"],"blockCnt":1,"category":["protocol"],"categoryCnt":1,"description":["ip addresses with this tag have been observed attempting to opportunistically crawl the internet and establish tls/ssl connections."],"intention":["unknown"],"intentionCnt":1,"name":["tls/ssl crawler"],"nameCnt":1},"tags":["sensor:netcup-ts","netcup-ts","honeypot"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-4-8-1-3_1460_7"],"ja4tCnt":1,"ja4ts":["43440_2-4-8-1-3_1460_11"],"ja4tsCnt":1},"tcpflags":{"ack":5,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":2,"psh":2,"rst":0,"srcZero":0,"syn":2,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":2180145472},"tls":{"ja3":["7c1e207beb00684bbbe144f1b0abe1d5"],"ja3Cnt":1,"ja3string":["771,52392-52393-49199-49200-49195-49196-49171-49161-49172-49162-156-157-47-53-49170-10-4867-4865-4866,5-10-11-13-65281-16-18-43-51,29-23-24-25,0"],"ja3stringCnt":1,"ja4":["t13i1909h2_9dc949149365_97f8aa674fd9"],"ja4Cnt":1,"ja4_r":["t13i1909h2_000a,002f,0035,009c,009d,1301,1302,1303,c009,c00a,c012,c013,c014,c02b,c02c,c02f,c030,cca8,cca9_0005,000a,000b,000d,0012,002b,0033,ff01_0804,0403,0807,0805,0806,0401,0501,0601,0503,0603,0201,0203"],"ja4_rCnt":1,"srcSessionId":["9e2c016464ce9b84a13303cb92cae7642dba864074f9a10f9f3f3c2a1f23c8ec"]},"totDataBytes":364}
+{"@timestamp":1787519743590,"_id":"260823-uZLbGewjbZxJk7i4JMxmDKzL","_index":"arkime_sessions3-260823","cert":[{"curve":"prime256v1","hash":"09:70:ea:39:86:69:5a:f1:83:45:93:40:ee:12:e7:1c:53:c7:21:a5","issuerCN":["asa temporary self signed certificate"],"ja4x":"7022c563de38_7022c563de38_000000000000","ja4x_r":"550403_550403_","notAfter":2092893639000,"notBefore":1777533639000,"publicAlgorithm":"id-ecPublicKey","remainingDays":3534,"remainingSeconds":305374215,"serial":"c802f369","subjectCN":["asa temporary self signed certificate"],"validDays":3650,"validSeconds":315360000}],"certCnt":1,"client":{"bytes":661},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo GmbH"],"isp.dstCnt":1,"isp.src":["FlokiNET Ltd"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["FlokiNET Ltd"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS51167 Contabo GmbH","number":51167,"organization":{"name":"Contabo GmbH"}},"bytes":1382,"geo":{"country_iso_code":"FR"},"ip":"109.123.246.142","mac":["00:50:56:63:46:a6"],"mac-cnt":1,"packets":8,"port":443},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstPayload8":"1603030059020000","dstRIR":"RIPE","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[78468],"firstPacket":1787519424609,"initRTT":21,"ipProtocol":6,"lastPacket":1787519424918,"length":309,"network":{"bytes":2579,"community_id":"1:6QzR2kIfTDkZmDhyDdXTY5EEy04=","packets":16},"node":"spark-afae","packetPos":[-78468,93117,90,0,82,343,82,693,82,208,82,133,356,266,82,0,0],"packetRange":{"gte":1787519424609,"lte":1787519424918},"protocol":["tls","tcp"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":846},"source":{"as":{"full":"AS200651 FlokiNET ehf","number":200651,"organization":{"name":"FlokiNET ehf"}},"bytes":1197,"geo":{"country_iso_code":"RO"},"ip":"185.100.87.136","mac":["c0:69:11:cd:1f:19","00:c0:1d:c0:ff:ee"],"mac-cnt":2,"packets":8,"port":36482},"srcOui":["Arista Networks","Grand Junction Networks, Inc."],"srcOuiCnt":2,"srcPayload8":"1603010100010000","srcRIR":"RIPE","srcTTL":[49],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["82781552280416"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["ac32bdeb-b49d-4079-9e6b-8fbca5e0addf"],"signatureCnt":1,"signatureId":[1031336],"signatureIdCnt":1},"tag":{"block":["false"],"blockCnt":1,"category":["protocol"],"categoryCnt":1,"description":["ip addresses with this tag have been observed attempting to opportunistically crawl the internet and establish tls/ssl connections."],"intention":["unknown"],"intentionCnt":1,"name":["tls/ssl crawler"],"nameCnt":1},"tags":["contabo-sponge-02-ts","sensor:contabo-sponge-02-ts","proxy","cert:self-signed"],"tagsCnt":4,"tcp":{"ja4l":"20677_49_20941","ja4ls":"620_64_34416","ja4t":["64240_2-4-8-1-3_1460_7"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":6,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":2,"psh":6,"rst":0,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":3871778238},"tls":{"cipher":["TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384"],"cipherCnt":1,"dstSessionId":["754de26acd480e7c71e7cb064014faa41f1cd798331a8c9dcc8a2a678abcbee0"],"ja3":["7c1e207beb00684bbbe144f1b0abe1d5"],"ja3Cnt":1,"ja3s":["e58f0b3c1e9eefb8ee4f92aeceee5858"],"ja3sCnt":1,"ja3sstring":["771,49196,65281-11"],"ja3sstringCnt":1,"ja3string":["771,52392-52393-49199-49200-49195-49196-49171-49161-49172-49162-156-157-47-53-49170-10-4867-4865-4866,5-10-11-13-65281-16-18-43-51,29-23-24-25,0"],"ja3stringCnt":1,"ja4":["t13i1909h2_9dc949149365_97f8aa674fd9"],"ja4Cnt":1,"ja4_r":["t13i1909h2_000a,002f,0035,009c,009d,1301,1302,1303,c009,c00a,c012,c013,c014,c02b,c02c,c02f,c030,cca8,cca9_0005,000a,000b,000d,0012,002b,0033,ff01_0804,0403,0807,0805,0806,0401,0501,0601,0503,0603,0201,0203"],"ja4_rCnt":1,"ja4s":["t120200_c02c_344b4dce5a52"],"ja4sCnt":1,"ja4s_r":["t120200_c02c_ff01,000b"],"ja4s_rCnt":1,"srcSessionId":["c267cae1a2815c1ec843229e55ae9bef0f47306b2d2f0b292273b96b26633ea7"],"version":["TLSv1.2"],"versionCnt":1},"totDataBytes":1507}
+{"@timestamp":1787519441003,"_id":"260823-rpJdrXLME-pFx6T0SY97YlTc","_index":"arkime_sessions3-260823","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["FlokiNET Ltd"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["FlokiNET Ltd"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":66,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":1,"port":443},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[78466],"firstPacket":1787518226531,"ipProtocol":6,"lastPacket":1787518229784,"length":3253,"network":{"bytes":186,"community_id":"1:blgIs05Da5uuX4rEypXrciWyC7w=","packets":3},"node":"spark-afae","packetPos":[-78466,275746,82,12279],"packetRange":{"gte":1787518226531,"lte":1787518229784},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS200651 FlokiNET ehf","number":200651,"organization":{"name":"FlokiNET ehf"}},"bytes":120,"geo":{"country_iso_code":"RO"},"ip":"185.100.87.136","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":2,"port":43370},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[52],"srcTTLCnt":1,"tags":["honeypot","frantech-ts","sensor:frantech-ts"],"tagsCnt":3,"tcp":{"ja4t":["65535_2-1-3-1-1-4_1400_8"],"ja4tCnt":1,"ja4ts":["64240_2-1-1-4-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":22429966},"totDataBytes":0}
+{"@timestamp":1787517938796,"_id":"260823-R-hV5JOuJCJAJ7AETHrHzOjw","_index":"arkime_sessions3-260823","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Kaopu Cloud HK Limited"],"isp.dstCnt":1,"isp.src":["FlokiNET Ltd"],"isp.srcCnt":1,"org.dst":["LightNode-BH"],"org.dstCnt":1,"org.src":["FlokiNET Ltd"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":66,"geo":{"country_iso_code":"BH"},"ip":"38.54.2.209","mac":["52:54:8f:9d:76:48"],"mac-cnt":1,"packets":1,"port":443},"dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[78459],"firstPacket":1787516590902,"ipProtocol":6,"lastPacket":1787516594061,"length":3159,"network":{"bytes":186,"community_id":"1:lmPHVZIdxizAso+20SH4ieHmA8Q=","packets":3},"node":"spark-afae","packetPos":[-78459,39414,82,5933],"packetRange":{"gte":1787516590902,"lte":1787516594061},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS200651 FlokiNET ehf","number":200651,"organization":{"name":"FlokiNET ehf"}},"bytes":120,"geo":{"country_iso_code":"RO"},"ip":"185.100.87.136","mac":["98:44:ce:60:15:19"],"mac-cnt":1,"packets":2,"port":48216},"srcOui":["Huawei Technologies Co.,Ltd"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[52],"srcTTLCnt":1,"tags":["bahrain-sponge-01-ts","honeypot","sensor:bahrain-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["65535_2-1-3-1-1-4_1460_8"],"ja4tCnt":1,"ja4ts":["64240_2-1-1-4-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":1652704063},"totDataBytes":0}
+{"@timestamp":1787516437529,"_id":"260823-d5LTIzt5C_lCwo57TVwJ9pFl","_index":"arkime_sessions3-260823","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["netcup GmbH"],"isp.dstCnt":1,"isp.src":["FlokiNET Ltd"],"isp.srcCnt":1,"org.dst":["Netcup KVM"],"org.dstCnt":1,"org.src":["FlokiNET Ltd"],"org.srcCnt":1,"usertype.dst":["business"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS197540 netcup GmbH","number":197540,"organization":{"name":"netcup GmbH"}},"bytes":66,"geo":{"country_iso_code":"DE"},"ip":"159.195.21.150","mac":["8a:41:d3:b8:0d:d3"],"mac-cnt":1,"packets":1,"port":443},"dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[78450],"firstPacket":1787515931085,"ipProtocol":6,"lastPacket":1787515932138,"length":1053,"network":{"bytes":188,"community_id":"1:eZCAb0QsK/Okal8wKTbX7HXyB2k=","packets":3},"node":"spark-afae","packetPos":[-78450,4114750,82,3489],"packetRange":{"gte":1787515931085,"lte":1787515932138},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS200651 FlokiNET ehf","number":200651,"organization":{"name":"FlokiNET ehf"}},"bytes":122,"geo":{"country_iso_code":"RO"},"ip":"185.100.87.136","mac":["bc:0f:fe:3d:a3:a7","00:00:5e:00:01:96"],"mac-cnt":2,"packets":2,"port":41368},"srcOui":["ICANN, IANA Department","Juniper Networks"],"srcOuiCnt":2,"srcRIR":"RIPE","srcTTL":[53],"srcTTLCnt":1,"tags":["sensor:netcup-ts","netcup-ts","honeypot"],"tagsCnt":3,"tcp":{"ja4t":["65535_2-1-3-1-1-4_1460_8"],"ja4tCnt":1,"ja4ts":["42340_2-1-1-4-1-3_1460_11"],"ja4tsCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":3147991667},"totDataBytes":0}
+{"@timestamp":1787516437782,"_id":"260823-G-hgQ04SsDlEYq8OMs2L2E1T","_index":"arkime_sessions3-260823","client":{"bytes":261},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["FlokiNET Ltd"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["FlokiNET Ltd"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":441,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":5,"port":443},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstPayload8":"485454502f312e31","dstRIR":"RIPE","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[78451],"firstPacket":1787515571202,"http":{"bodyMagic":["text/plain"],"bodyMagicCnt":1,"md5":["6196dba52703776af2e6593f772ed7ce"],"md5Cnt":1,"responseHeader":["connection","content-type"],"responseHeaderCnt":2,"responseHeaderField":["content-type","connection"],"responseHeaderValue":["text/plain; charset=utf-8","close"],"responseHeaderValueCnt":2,"serverVersion":["1.1"],"serverVersionCnt":1,"sha256":["19b843cc92cb12aa314bb3c3913b2feeb852e85969bf06cb9d096931bfda34ba"],"sha256Cnt":1,"statuscode":[400],"statuscodeCnt":1},"initRTT":613,"ipProtocol":6,"lastPacket":1787515572681,"length":1479,"network":{"bytes":1180,"community_id":"1:jtxKR2NXqiNXOxeKn75K2DPh8jc=","packets":12},"node":"spark-afae","packetPos":[-78451,5771659,90,19060,2449,82,343,82,185,2564,216,82,0],"packetRange":{"gte":1787515571202,"lte":1787515572681},"protocol":["tls","tcp","http"],"protocolCnt":3,"segmentCnt":1,"server":{"bytes":103},"source":{"as":{"full":"AS200651 FlokiNET ehf","number":200651,"organization":{"name":"FlokiNET ehf"}},"bytes":739,"geo":{"country_iso_code":"RO"},"ip":"185.100.87.136","mac":["fc:bd:67:9d:2b:2b","00:c0:1d:c0:ff:ee"],"mac-cnt":2,"packets":7,"port":52228},"srcOui":["Arista Networks","Grand Junction Networks, Inc."],"srcOuiCnt":2,"srcPayload8":"1603010100010000","srcRIR":"RIPE","srcTTL":[56],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["869139772845556"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["ac32bdeb-b49d-4079-9e6b-8fbca5e0addf"],"signatureCnt":1,"signatureId":[1031336],"signatureIdCnt":1},"tag":{"block":["false"],"blockCnt":1,"category":["protocol"],"categoryCnt":1,"description":["ip addresses with this tag have been observed attempting to opportunistically crawl the internet and establish tls/ssl connections."],"intention":["unknown"],"intentionCnt":1,"name":["tls/ssl crawler"],"nameCnt":1},"tags":["sensor:contabo-sponge-01-ts","contabo-sponge-01-ts","honeypot"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-4-8-1-3_1460_7"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":5,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":2,"psh":2,"rst":0,"srcZero":0,"syn":2,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":1435215093},"tls":{"ja3":["7c1e207beb00684bbbe144f1b0abe1d5"],"ja3Cnt":1,"ja3string":["771,52392-52393-49199-49200-49195-49196-49171-49161-49172-49162-156-157-47-53-49170-10-4867-4865-4866,5-10-11-13-65281-16-18-43-51,29-23-24-25,0"],"ja3stringCnt":1,"ja4":["t13i1909h2_9dc949149365_97f8aa674fd9"],"ja4Cnt":1,"ja4_r":["t13i1909h2_000a,002f,0035,009c,009d,1301,1302,1303,c009,c00a,c012,c013,c014,c02b,c02c,c02f,c030,cca8,cca9_0005,000a,000b,000d,0012,002b,0033,ff01_0804,0403,0807,0805,0806,0401,0501,0601,0503,0603,0201,0203"],"ja4_rCnt":1,"srcSessionId":["b37cc194dff05aee07ca27f61d8668cc9917d3bccd81954e21dbba433985135e"]},"totDataBytes":364}
+{"@timestamp":1787516134237,"_id":"260823-bJJ8RBOiM6dOgaS2At7YKeQV","_index":"arkime_sessions3-260823","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo GmbH"],"isp.dstCnt":1,"isp.src":["FlokiNET Ltd"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["FlokiNET Ltd"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS51167 Contabo GmbH","number":51167,"organization":{"name":"Contabo GmbH"}},"bytes":66,"geo":{"country_iso_code":"FR"},"ip":"109.123.246.142","mac":["00:50:56:63:46:a6"],"mac-cnt":1,"packets":1,"port":443},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[78448],"firstPacket":1787515498615,"ipProtocol":6,"lastPacket":1787515499709,"length":1094,"network":{"bytes":192,"community_id":"1:5U1pMkNXiEHluw0RK+q21rYw6Es=","packets":3},"node":"spark-afae","packetPos":[-78448,108316,82,410],"packetRange":{"gte":1787515498615,"lte":1787515499709},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS200651 FlokiNET ehf","number":200651,"organization":{"name":"FlokiNET ehf"}},"bytes":126,"geo":{"country_iso_code":"RO"},"ip":"185.100.87.136","mac":["c0:69:11:cd:1f:19","00:c0:1d:c0:ff:ee"],"mac-cnt":2,"packets":2,"port":55463},"srcOui":["Arista Networks","Grand Junction Networks, Inc."],"srcOuiCnt":2,"srcRIR":"RIPE","srcTTL":[49],"srcTTLCnt":1,"tags":["contabo-sponge-02-ts","sensor:contabo-sponge-02-ts","proxy"],"tagsCnt":3,"tcp":{"ja4t":["65535_2-1-3-1-1-4_1460_8"],"ja4tCnt":1,"ja4ts":["64240_2-1-1-4-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":2798259832},"totDataBytes":0}
+{"@timestamp":1787513686657,"_id":"260823-uOfw0Fmtr7NIaLzBT4oxK6Mx","_index":"arkime_sessions3-260823","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["FlokiNET Ltd"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["FlokiNET Ltd"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":66,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":1,"port":443},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[78436],"firstPacket":1787513413587,"ipProtocol":6,"lastPacket":1787513414798,"length":1211,"network":{"bytes":192,"community_id":"1:MxQoED+dG9wA8UkrhFqz2pPUcoc=","packets":3},"node":"spark-afae","packetPos":[-78436,17810709,82,26088],"packetRange":{"gte":1787513413587,"lte":1787513414798},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS200651 FlokiNET ehf","number":200651,"organization":{"name":"FlokiNET ehf"}},"bytes":126,"geo":{"country_iso_code":"RO"},"ip":"185.100.87.136","mac":["00:c0:1d:c0:ff:ee","fc:bd:67:9d:2b:2b"],"mac-cnt":2,"packets":2,"port":60827},"srcOui":["Grand Junction Networks, Inc.","Arista Networks"],"srcOuiCnt":2,"srcRIR":"RIPE","srcTTL":[56],"srcTTLCnt":1,"tags":["sensor:contabo-sponge-01-ts","contabo-sponge-01-ts","honeypot"],"tagsCnt":3,"tcp":{"ja4t":["65535_2-1-3-1-1-4_1460_8"],"ja4tCnt":1,"ja4ts":["64240_2-1-1-4-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":4004336566},"totDataBytes":0}
+{"@timestamp":1787413782641,"_id":"260822-DtuwglYLkVhOeZ3kwmq67OIW","_index":"arkime_sessions3-260822","client":{"bytes":174},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["netcup GmbH"],"isp.dstCnt":1,"isp.src":["FlokiNET Ltd"],"isp.srcCnt":1,"org.dst":["Netcup KVM"],"org.dstCnt":1,"org.src":["FlokiNET Ltd"],"org.srcCnt":1,"usertype.dst":["business"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS197540 netcup GmbH","number":197540,"organization":{"name":"netcup GmbH"}},"bytes":384,"geo":{"country_iso_code":"DE"},"ip":"159.195.21.150","mac":["8a:41:d3:b8:0d:d3"],"mac-cnt":1,"packets":4,"port":444},"dstPayload8":"485454502f312e31","dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[77879],"firstPacket":1787412678665,"http":{"clientVersion":["1.1"],"clientVersionCnt":1,"host":["159.195.21.150:444","159.195.21.150"],"hostCnt":2,"ja4h":["ge11nn040000_e1d2031bdfea_000000000000_000000000000"],"ja4hCnt":1,"ja4h_r":["ge11nn040000_Host,User-Agent,Accept,Accept-Encoding__"],"ja4h_rCnt":1,"method":["GET"],"method-GET":1,"methodCnt":1,"path":["/"],"pathCnt":1,"requestHeader":["host","user-agent","accept-encoding","accept"],"requestHeaderCnt":4,"requestHeaderField":["accept","accept-encoding"],"requestHeaderValue":["*/*","gzip"],"requestHeaderValueCnt":2,"response-server":["SonicWall SMA 10.2.0.9-12sv"],"response-serverCnt":1,"responseHeader":["content-length","date","server"],"responseHeaderCnt":3,"responseHeaderField":["date","content-length"],"responseHeaderValue":["sat, 22 aug 2026 15:31:18 gmt","0"],"responseHeaderValueCnt":2,"serverVersion":["1.1"],"serverVersionCnt":1,"statuscode":[200],"statuscodeCnt":1,"uri":["159.195.21.150:444/"],"uriCnt":1,"useragent":["Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:144.0) Gecko/20100101 Firefox/144.0"],"useragentCnt":1},"initRTT":15,"ipProtocol":6,"lastPacket":1787412678809,"length":144,"network":{"bytes":962,"community_id":"1:cXksXWWqv96qzSSFPVrKC7eoGZ0=","packets":10},"node":"spark-afae","packetPos":[-77879,609216,90,0,82,256,288,449,82,0,1060],"packetRange":{"gte":1787412678665,"lte":1787412678809},"protocol":["tcp","http"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":112},"source":{"as":{"full":"AS200651 FlokiNET ehf","number":200651,"organization":{"name":"FlokiNET ehf"}},"bytes":578,"geo":{"country_iso_code":"RO"},"ip":"185.100.87.136","mac":["bc:0f:fe:3d:a3:a7","00:00:5e:00:01:96"],"mac-cnt":2,"packets":6,"port":50324},"srcOui":["ICANN, IANA Department","Juniper Networks"],"srcOuiCnt":2,"srcPayload8":"474554202f204854","srcRIR":"RIPE","srcTTL":[53],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["1730525701401659"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["869feaa1-dc77-4037-aee2-247b7a39cf7d","ee583a2e-d308-4c53-b8e2-a1cd45cd1bb7","ce8622a8-6d2f-4fe3-ab81-0cc86e19363e"],"signatureCnt":3,"signatureId":[2000166,1031486,2000008],"signatureIdCnt":3},"tag":{"block":["true","false"],"blockCnt":2,"category":["attack","protocol","recon"],"categoryCnt":3,"cves":[""],"cvesCnt":1,"description":["ip addresses with this tag have been seen crawling http(s) servers around the internet.","cloud credential scanning probe detected. requests for sensitive configuration files and credentials indicate automated scanning for exposed secrets and api keys.","generic web crawler traffic detected. the simple pattern of get requests without specific exploitation indicators suggests automated crawling activity, possibly for search indexing or vulnerability scanning."],"intention":["unknown","suspicious"],"intentionCnt":2,"name":["root path scanner","web crawler"],"nameCnt":2},"tags":["honeypot","sensor:netcup-ts","netcup-ts"],"tagsCnt":3,"tcp":{"ja4ls":"36_64_tcp","ja4t":["64240_2-4-8-1-3_1460_7"],"ja4tCnt":1,"ja4ts":["43440_2-4-8-1-3_1460_11"],"ja4tsCnt":1},"tcpflags":{"ack":4,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":2,"psh":2,"rst":0,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":2386129455},"totDataBytes":286}
+{"@timestamp":1787413782641,"_id":"260822-DtvpEWCixvlLA6EsFmD3-pXn","_index":"arkime_sessions3-260822","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["netcup GmbH"],"isp.dstCnt":1,"isp.src":["FlokiNET Ltd"],"isp.srcCnt":1,"org.dst":["Netcup KVM"],"org.dstCnt":1,"org.src":["FlokiNET Ltd"],"org.srcCnt":1,"usertype.dst":["business"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS197540 netcup GmbH","number":197540,"organization":{"name":"netcup GmbH"}},"bytes":66,"geo":{"country_iso_code":"DE"},"ip":"159.195.21.150","mac":["8a:41:d3:b8:0d:d3"],"mac-cnt":1,"packets":1,"port":444},"dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[77879],"firstPacket":1787412678601,"ipProtocol":6,"lastPacket":1787412678632,"length":31,"network":{"bytes":188,"community_id":"1:eFu3f0LcW40Qx6vUZWhEiKpcwTA=","packets":3},"node":"spark-afae","packetPos":[-77879,608816,82,246],"packetRange":{"gte":1787412678601,"lte":1787412678632},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS200651 FlokiNET ehf","number":200651,"organization":{"name":"FlokiNET ehf"}},"bytes":122,"geo":{"country_iso_code":"RO"},"ip":"185.100.87.136","mac":["bc:0f:fe:3d:a3:a7","00:00:5e:00:01:96"],"mac-cnt":2,"packets":2,"port":59076},"srcOui":["ICANN, IANA Department","Juniper Networks"],"srcOuiCnt":2,"srcRIR":"RIPE","srcTTL":[53],"srcTTLCnt":1,"tags":["honeypot","sensor:netcup-ts","netcup-ts"],"tagsCnt":3,"tcp":{"ja4t":["65535_2-1-3-1-1-4_1460_8"],"ja4tCnt":1,"ja4ts":["42340_2-1-1-4-1-3_1460_11"],"ja4tsCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":2558387445},"totDataBytes":0}
+{"@timestamp":1787411962847,"_id":"260822-19o7fyKihstGxJVgmZENXHbD","_index":"arkime_sessions3-260822","client":{"bytes":174},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["FlokiNET Ltd"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["FlokiNET Ltd"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":625,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":5,"port":444},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstPayload8":"485454502f312e31","dstRIR":"RIPE","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[77869],"firstPacket":1787411695522,"http":{"bodyMagic":["text/html"],"bodyMagicCnt":1,"clientVersion":["1.1"],"clientVersionCnt":1,"host":["217.15.163.226:444","217.15.163.226"],"hostCnt":2,"ja4h":["ge11nn040000_e1d2031bdfea_000000000000_000000000000"],"ja4hCnt":1,"ja4h_r":["ge11nn040000_Host,User-Agent,Accept,Accept-Encoding__"],"ja4h_rCnt":1,"md5":["0f87454a3ea15f0db55ae928dbcd82fc"],"md5Cnt":1,"method":["GET"],"method-GET":1,"methodCnt":1,"path":["/"],"pathCnt":1,"requestHeader":["accept","accept-encoding","host","user-agent"],"requestHeaderCnt":4,"requestHeaderField":["accept","accept-encoding"],"requestHeaderValue":["*/*","gzip"],"requestHeaderValueCnt":2,"response-server":["Apache/2.4.41 (Ubuntu)"],"response-serverCnt":1,"response-x-powered-by":["PHP/7.4.3"],"response-x-powered-byCnt":1,"responseHeader":["date","connection","content-type","server","content-length","x-powered-by"],"responseHeaderCnt":6,"responseHeaderField":["connection","content-type","date","content-length"],"responseHeaderValue":["close","text/plain; charset=utf-8","sat, 22 aug 2026 15:14:55 gmt","94"],"responseHeaderValueCnt":4,"serverVersion":["1.1"],"serverVersionCnt":1,"sha256":["1ca624415b2889dbeb3f969890b848b7bc5eaf96ca5e8fdd7461f943b45d10cb"],"sha256Cnt":1,"statuscode":[200],"statuscodeCnt":1,"uri":["217.15.163.226:444/"],"uriCnt":1,"useragent":["Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:144.0) Gecko/20100101 Firefox/144.0"],"useragentCnt":1},"initRTT":87,"ipProtocol":6,"lastPacket":1787411695873,"length":351,"network":{"bytes":1137,"community_id":"1:hL/pjg8l0bTVp1C8y7osuCN9tnM=","packets":10},"node":"spark-afae","packetPos":[-77869,3756016,90,180,82,256,82,369,338,82,0],"packetRange":{"gte":1787411695522,"lte":1787411695873},"protocol":["http","tcp"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":287},"source":{"as":{"full":"AS200651 FlokiNET ehf","number":200651,"organization":{"name":"FlokiNET ehf"}},"bytes":512,"geo":{"country_iso_code":"RO"},"ip":"185.100.87.136","mac":["fc:bd:67:9d:2b:2b","00:c0:1d:c0:ff:ee"],"mac-cnt":2,"packets":5,"port":48774},"srcOui":["Arista Networks","Grand Junction Networks, Inc."],"srcOuiCnt":2,"srcPayload8":"474554202f204854","srcRIR":"RIPE","srcTTL":[55],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["2246034578528399"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["869feaa1-dc77-4037-aee2-247b7a39cf7d","ee583a2e-d308-4c53-b8e2-a1cd45cd1bb7","ce8622a8-6d2f-4fe3-ab81-0cc86e19363e"],"signatureCnt":3,"signatureId":[2000166,1031486,2000008],"signatureIdCnt":3},"tag":{"block":["false","true"],"blockCnt":2,"category":["protocol","attack","recon"],"categoryCnt":3,"cves":[""],"cvesCnt":1,"description":["cloud credential scanning probe detected. requests for sensitive configuration files and credentials indicate automated scanning for exposed secrets and api keys.","ip addresses with this tag have been seen crawling http(s) servers around the internet.","generic web crawler traffic detected. the simple pattern of get requests without specific exploitation indicators suggests automated crawling activity, possibly for search indexing or vulnerability scanning."],"intention":["unknown","suspicious"],"intentionCnt":2,"name":["web crawler","root path scanner"],"nameCnt":2},"tags":["contabo-sponge-01-ts","sensor:contabo-sponge-01-ts","honeypot"],"tagsCnt":3,"tcp":{"ja4ls":"64_64_tcp","ja4t":["64240_2-4-8-1-3_1460_7"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":4,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":2,"psh":2,"rst":0,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":3038142346},"totDataBytes":461}
+{"@timestamp":1787411962847,"_id":"260822-19ohbc4Xrz5H3qYZ52pXa3Br","_index":"arkime_sessions3-260822","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["FlokiNET Ltd"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["FlokiNET Ltd"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":66,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":1,"port":444},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[77869],"firstPacket":1787411695276,"ipProtocol":6,"lastPacket":1787411695452,"length":176,"network":{"bytes":192,"community_id":"1:Xc604tgQQ4ofZ1woYq2ggEmJI38=","packets":3},"node":"spark-afae","packetPos":[-77869,3754094,82,172],"packetRange":{"gte":1787411695276,"lte":1787411695452},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS200651 FlokiNET ehf","number":200651,"organization":{"name":"FlokiNET ehf"}},"bytes":126,"geo":{"country_iso_code":"RO"},"ip":"185.100.87.136","mac":["fc:bd:67:9d:2b:2b","00:c0:1d:c0:ff:ee"],"mac-cnt":2,"packets":2,"port":52826},"srcOui":["Arista Networks","Grand Junction Networks, Inc."],"srcOuiCnt":2,"srcRIR":"RIPE","srcTTL":[55],"srcTTLCnt":1,"tags":["contabo-sponge-01-ts","sensor:contabo-sponge-01-ts","honeypot"],"tagsCnt":3,"tcp":{"ja4t":["65535_2-1-3-1-1-4_1460_8"],"ja4tCnt":1,"ja4ts":["64240_2-1-1-4-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":4233806052},"totDataBytes":0}
+{"@timestamp":1787411355732,"_id":"260822-wdo6PONiQ9lAJ6IYfYpTmkeD","_index":"arkime_sessions3-260822","client":{"bytes":174},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["FlokiNET Ltd"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["FlokiNET Ltd"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":625,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":5,"port":444},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstPayload8":"485454502f312e31","dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[77866],"firstPacket":1787411022842,"http":{"bodyMagic":["text/html"],"bodyMagicCnt":1,"clientVersion":["1.1"],"clientVersionCnt":1,"host":["209.141.62.110","209.141.62.110:444"],"hostCnt":2,"ja4h":["ge11nn040000_e1d2031bdfea_000000000000_000000000000"],"ja4hCnt":1,"ja4h_r":["ge11nn040000_Host,User-Agent,Accept,Accept-Encoding__"],"ja4h_rCnt":1,"md5":["0f87454a3ea15f0db55ae928dbcd82fc"],"md5Cnt":1,"method":["GET"],"method-GET":1,"methodCnt":1,"path":["/"],"pathCnt":1,"requestHeader":["user-agent","accept-encoding","accept","host"],"requestHeaderCnt":4,"requestHeaderField":["accept","accept-encoding"],"requestHeaderValue":["*/*","gzip"],"requestHeaderValueCnt":2,"response-server":["Apache/2.4.41 (Ubuntu)"],"response-serverCnt":1,"response-x-powered-by":["PHP/7.4.3"],"response-x-powered-byCnt":1,"responseHeader":["content-type","content-length","x-powered-by","date","connection","server"],"responseHeaderCnt":6,"responseHeaderField":["connection","content-type","date","content-length"],"responseHeaderValue":["close","text/plain; charset=utf-8","sat, 22 aug 2026 15:03:43 gmt","94"],"responseHeaderValueCnt":4,"serverVersion":["1.1"],"serverVersionCnt":1,"sha256":["1ca624415b2889dbeb3f969890b848b7bc5eaf96ca5e8fdd7461f943b45d10cb"],"sha256Cnt":1,"statuscode":[200],"statuscodeCnt":1,"uri":["209.141.62.110:444/"],"uriCnt":1,"useragent":["Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:144.0) Gecko/20100101 Firefox/144.0"],"useragentCnt":1},"initRTT":84,"ipProtocol":6,"lastPacket":1787411023180,"length":338,"network":{"bytes":1137,"community_id":"1:ucHFu2fjlmijd6xZ+7PhVrSTgnI=","packets":10},"node":"spark-afae","packetPos":[-77866,5353630,90,207,82,256,82,369,82,0,0],"packetRange":{"gte":1787411022842,"lte":1787411023180},"protocol":["tcp","http"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":287},"source":{"as":{"full":"AS200651 FlokiNET ehf","number":200651,"organization":{"name":"FlokiNET ehf"}},"bytes":512,"geo":{"country_iso_code":"RO"},"ip":"185.100.87.136","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":5,"port":44924},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcPayload8":"474554202f204854","srcRIR":"RIPE","srcTTL":[53],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["1928987515723688"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["ce8622a8-6d2f-4fe3-ab81-0cc86e19363e","ee583a2e-d308-4c53-b8e2-a1cd45cd1bb7","869feaa1-dc77-4037-aee2-247b7a39cf7d"],"signatureCnt":3,"signatureId":[2000166,1031486,2000008],"signatureIdCnt":3},"tag":{"block":["false","true"],"blockCnt":2,"category":["recon","attack","protocol"],"categoryCnt":3,"cves":[""],"cvesCnt":1,"description":["ip addresses with this tag have been seen crawling http(s) servers around the internet.","generic web crawler traffic detected. the simple pattern of get requests without specific exploitation indicators suggests automated crawling activity, possibly for search indexing or vulnerability scanning.","cloud credential scanning probe detected. requests for sensitive configuration files and credentials indicate automated scanning for exposed secrets and api keys."],"intention":["suspicious","unknown"],"intentionCnt":2,"name":["web crawler","root path scanner"],"nameCnt":2},"tags":["sensor:frantech-ts","honeypot","frantech-ts"],"tagsCnt":3,"tcp":{"ja4ls":"43_64_tcp","ja4t":["64240_2-4-8-1-3_1400_7"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":4,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":2,"psh":2,"rst":0,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":4015740977},"totDataBytes":461}
+{"@timestamp":1787411355732,"_id":"260822-wdo3tZsdc8VIL4BJzI9SaStc","_index":"arkime_sessions3-260822","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["FlokiNET Ltd"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["FlokiNET Ltd"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":66,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":1,"port":444},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[77866],"firstPacket":1787411022626,"ipProtocol":6,"lastPacket":1787411022795,"length":169,"network":{"bytes":186,"community_id":"1:JMALIMKMZDG11QAp4+HG4Gpiiuo=","packets":3},"node":"spark-afae","packetPos":[-77866,5352868,82,542],"packetRange":{"gte":1787411022626,"lte":1787411022795},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS200651 FlokiNET ehf","number":200651,"organization":{"name":"FlokiNET ehf"}},"bytes":120,"geo":{"country_iso_code":"RO"},"ip":"185.100.87.136","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":2,"port":35447},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[53],"srcTTLCnt":1,"tags":["sensor:frantech-ts","honeypot","frantech-ts"],"tagsCnt":3,"tcp":{"ja4t":["65535_2-1-3-1-1-4_1400_8"],"ja4tCnt":1,"ja4ts":["64240_2-1-1-4-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":358145103},"totDataBytes":0}
+{"@timestamp":1787410453242,"_id":"260822-oNp7TWiV281CF51K9Wm6dXsb","_index":"arkime_sessions3-260822","client":{"bytes":171},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Kaopu Cloud HK Limited"],"isp.dstCnt":1,"isp.src":["FlokiNET Ltd"],"isp.srcCnt":1,"org.dst":["LightNode-BH"],"org.dstCnt":1,"org.src":["FlokiNET Ltd"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":625,"geo":{"country_iso_code":"BH"},"ip":"38.54.2.209","mac":["52:54:8f:9d:76:48"],"mac-cnt":1,"packets":5,"port":444},"dstPayload8":"485454502f312e31","dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[77862],"firstPacket":1787409789905,"http":{"bodyMagic":["text/html"],"bodyMagicCnt":1,"clientVersion":["1.1"],"clientVersionCnt":1,"host":["38.54.2.209:444","38.54.2.209"],"hostCnt":2,"ja4h":["ge11nn040000_e1d2031bdfea_000000000000_000000000000"],"ja4hCnt":1,"ja4h_r":["ge11nn040000_Host,User-Agent,Accept,Accept-Encoding__"],"ja4h_rCnt":1,"md5":["0f87454a3ea15f0db55ae928dbcd82fc"],"md5Cnt":1,"method":["GET"],"method-GET":1,"methodCnt":1,"path":["/"],"pathCnt":1,"requestHeader":["accept","accept-encoding","host","user-agent"],"requestHeaderCnt":4,"requestHeaderField":["accept","accept-encoding"],"requestHeaderValue":["*/*","gzip"],"requestHeaderValueCnt":2,"response-server":["Apache/2.4.41 (Ubuntu)"],"response-serverCnt":1,"response-x-powered-by":["PHP/7.4.3"],"response-x-powered-byCnt":1,"responseHeader":["content-type","connection","date","x-powered-by","content-length","server"],"responseHeaderCnt":6,"responseHeaderField":["connection","content-type","date","content-length"],"responseHeaderValue":["close","text/plain; charset=utf-8","sat, 22 aug 2026 14:43:10 gmt","94"],"responseHeaderValueCnt":4,"serverVersion":["1.1"],"serverVersionCnt":1,"sha256":["1ca624415b2889dbeb3f969890b848b7bc5eaf96ca5e8fdd7461f943b45d10cb"],"sha256Cnt":1,"statuscode":[200],"statuscodeCnt":1,"uri":["38.54.2.209:444/"],"uriCnt":1,"useragent":["Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:144.0) Gecko/20100101 Firefox/144.0"],"useragentCnt":1},"initRTT":61,"ipProtocol":6,"lastPacket":1787409790148,"length":243,"network":{"bytes":1134,"community_id":"1:oeWSjJO2sgU9gOF15P7INXoPx7Y=","packets":10},"node":"spark-afae","packetPos":[-77862,1117488,90,160,82,253,82,369,234,82,0],"packetRange":{"gte":1787409789905,"lte":1787409790148},"protocol":["http","tcp"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":287},"source":{"as":{"full":"AS200651 FlokiNET ehf","number":200651,"organization":{"name":"FlokiNET ehf"}},"bytes":509,"geo":{"country_iso_code":"RO"},"ip":"185.100.87.136","mac":["98:44:ce:60:15:19"],"mac-cnt":1,"packets":5,"port":42186},"srcOui":["Huawei Technologies Co.,Ltd"],"srcOuiCnt":1,"srcPayload8":"474554202f204854","srcRIR":"RIPE","srcTTL":[51],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["1638464076028204"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["ce8622a8-6d2f-4fe3-ab81-0cc86e19363e","869feaa1-dc77-4037-aee2-247b7a39cf7d","ee583a2e-d308-4c53-b8e2-a1cd45cd1bb7"],"signatureCnt":3,"signatureId":[2000166,1031486,2000008],"signatureIdCnt":3},"tag":{"block":["false","true"],"blockCnt":2,"category":["protocol","recon","attack"],"categoryCnt":3,"cves":[""],"cvesCnt":1,"description":["generic web crawler traffic detected. the simple pattern of get requests without specific exploitation indicators suggests automated crawling activity, possibly for search indexing or vulnerability scanning.","cloud credential scanning probe detected. requests for sensitive configuration files and credentials indicate automated scanning for exposed secrets and api keys.","ip addresses with this tag have been seen crawling http(s) servers around the internet."],"intention":["unknown","suspicious"],"intentionCnt":2,"name":["web crawler","root path scanner"],"nameCnt":2},"tags":["honeypot","sensor:bahrain-sponge-01-ts","bahrain-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4ls":"55_64_tcp","ja4t":["64240_2-4-8-1-3_1460_7"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":4,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":2,"psh":2,"rst":0,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":1132809182},"totDataBytes":458}
+{"@timestamp":1787410453217,"_id":"260822-oNrh_JmTFKxFB6Qee74jILUJ","_index":"arkime_sessions3-260822","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Kaopu Cloud HK Limited"],"isp.dstCnt":1,"isp.src":["FlokiNET Ltd"],"isp.srcCnt":1,"org.dst":["LightNode-BH"],"org.dstCnt":1,"org.src":["FlokiNET Ltd"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":66,"geo":{"country_iso_code":"BH"},"ip":"38.54.2.209","mac":["52:54:8f:9d:76:48"],"mac-cnt":1,"packets":1,"port":444},"dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[77862],"firstPacket":1787409789691,"ipProtocol":6,"lastPacket":1787409789811,"length":120,"network":{"bytes":186,"community_id":"1:sXRWEdVCTSBMp+3qj07FZn5ijA0=","packets":3},"node":"spark-afae","packetPos":[-77862,1117184,82,152],"packetRange":{"gte":1787409789691,"lte":1787409789811},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS200651 FlokiNET ehf","number":200651,"organization":{"name":"FlokiNET ehf"}},"bytes":120,"geo":{"country_iso_code":"RO"},"ip":"185.100.87.136","mac":["98:44:ce:60:15:19"],"mac-cnt":1,"packets":2,"port":55809},"srcOui":["Huawei Technologies Co.,Ltd"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[52],"srcTTLCnt":1,"tags":["honeypot","sensor:bahrain-sponge-01-ts","bahrain-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["65535_2-1-3-1-1-4_1460_8"],"ja4tCnt":1,"ja4ts":["64240_2-1-1-4-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":511279777},"totDataBytes":0}
+{"@timestamp":1787408945075,"_id":"260822-adpykUxRSUZKAq0RFaZRD2TM","_index":"arkime_sessions3-260822","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo GmbH"],"isp.dstCnt":1,"isp.src":["FlokiNET Ltd"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["FlokiNET Ltd"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS51167 Contabo GmbH","number":51167,"organization":{"name":"Contabo GmbH"}},"bytes":0,"geo":{"country_iso_code":"FR"},"ip":"109.123.246.142","mac":["00:50:56:63:46:a6"],"mac-cnt":1,"packets":0,"port":444},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[77853],"firstPacket":1787407935304,"ipProtocol":6,"lastPacket":1787407935304,"length":0,"network":{"bytes":66,"community_id":"1:rZRjVzbqc1bE4RK7yu+Lootkkcs=","packets":1},"node":"spark-afae","packetPos":[-77853,7591],"packetRange":{"gte":1787407935304,"lte":1787407935304},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS200651 FlokiNET ehf","number":200651,"organization":{"name":"FlokiNET ehf"}},"bytes":66,"geo":{"country_iso_code":"RO"},"ip":"185.100.87.136","mac":["c0:69:11:cd:1f:19"],"mac-cnt":1,"packets":1,"port":48333},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[49],"srcTTLCnt":1,"tags":["contabo-sponge-02-ts","sensor:contabo-sponge-02-ts","proxy"],"tagsCnt":3,"tcp":{"ja4t":["65535_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":2274244197},"totDataBytes":0}
+{"@timestamp":1787282291741,"_id":"260821-rX8VP1oGUylBX7thi2ekOjwK","_index":"arkime_sessions3-260821","client":{"bytes":30},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["netcup GmbH"],"isp.dstCnt":1,"isp.src":["FlokiNET Ltd"],"isp.srcCnt":1,"org.dst":["Netcup KVM"],"org.dstCnt":1,"org.src":["FlokiNET Ltd"],"org.srcCnt":1,"usertype.dst":["business"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS197540 netcup GmbH","number":197540,"organization":{"name":"netcup GmbH"}},"bytes":0,"geo":{"country_iso_code":"DE"},"ip":"159.195.21.150","mac":["8a:41:d3:b8:0d:d3"],"mac-cnt":1,"packets":0,"port":53},"dns":[{"host":["version.bind"],"hostCnt":1,"opcode":"QUERY","qc":"CH","qt":"TXT","queryHost":"version.bind"}],"dnsCnt":1,"dstRIR":"ARIN","ethertype":2048,"fileId":[77149],"firstPacket":1787281486958,"ipProtocol":17,"lastPacket":1787281486958,"length":0,"network":{"bytes":72,"community_id":"1:rS+rUnaBdcn6viYerADFmMYTfqc=","packets":1},"node":"spark-afae","packetPos":[-77149,894788],"packetRange":{"gte":1787281486958,"lte":1787281486958},"protocol":["dns","udp"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS200651 FlokiNET ehf","number":200651,"organization":{"name":"FlokiNET ehf"}},"bytes":72,"geo":{"country_iso_code":"RO"},"ip":"185.100.87.136","mac":["bc:0f:fe:3d:a3:a7"],"mac-cnt":1,"packets":1,"port":33004},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcPayload8":"34ef010000010000","srcRIR":"RIPE","srcTTL":[53],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["1863383062483447"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["bfd5c1ca-a1b3-418c-8643-5e916ad156e4"],"signatureCnt":1,"signatureId":[1071781],"signatureIdCnt":1},"tag":{"block":["false"],"blockCnt":1,"category":["protocol"],"categoryCnt":1,"description":["ip addresses with this tag have been observed sending dns traffic."],"intention":["unknown"],"intentionCnt":1,"name":["dns protocol"],"nameCnt":1},"tags":["sensor:netcup-ts","netcup-ts","honeypot"],"tagsCnt":3,"totDataBytes":30}
+{"@timestamp":1787278676513,"_id":"260821-IcnZ6ZuxsJBES4VTNA0SwVSN","_index":"arkime_sessions3-260821","client":{"bytes":30},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["FlokiNET Ltd"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["FlokiNET Ltd"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":0,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":0,"port":53},"dns":[{"host":["version.bind"],"hostCnt":1,"opcode":"QUERY","qc":"CH","qt":"TXT","queryHost":"version.bind"}],"dnsCnt":1,"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[77130],"firstPacket":1787278287291,"ipProtocol":17,"lastPacket":1787278287291,"length":0,"network":{"bytes":72,"community_id":"1:LeWvFXAKYxjUt+Hy1PId1fEZVVk=","packets":1},"node":"spark-afae","packetPos":[-77130,2438946],"packetRange":{"gte":1787278287291,"lte":1787278287291},"protocol":["udp","dns"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS200651 FlokiNET ehf","number":200651,"organization":{"name":"FlokiNET ehf"}},"bytes":72,"geo":{"country_iso_code":"RO"},"ip":"185.100.87.136","mac":["fc:bd:67:9d:2b:2b"],"mac-cnt":1,"packets":1,"port":49281},"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcPayload8":"34ef010000010000","srcRIR":"RIPE","srcTTL":[55],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["2095101400722955"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["bfd5c1ca-a1b3-418c-8643-5e916ad156e4"],"signatureCnt":1,"signatureId":[1071781],"signatureIdCnt":1},"tag":{"block":["false"],"blockCnt":1,"category":["protocol"],"categoryCnt":1,"description":["ip addresses with this tag have been observed sending dns traffic."],"intention":["unknown"],"intentionCnt":1,"name":["dns protocol"],"nameCnt":1},"tags":["contabo-sponge-01-ts","honeypot","sensor:contabo-sponge-01-ts"],"tagsCnt":3,"totDataBytes":30}
+{"@timestamp":1787278976591,"_id":"260821-LMkYKnGzJEtGSIw2c5kT_pFe","_index":"arkime_sessions3-260821","client":{"bytes":30},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["FlokiNET Ltd"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["FlokiNET Ltd"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":0,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":0,"port":53},"dns":[{"host":["version.bind"],"hostCnt":1,"opcode":"QUERY","qc":"CH","qt":"TXT","queryHost":"version.bind"}],"dnsCnt":1,"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstRIR":"ARIN","ethertype":2048,"fileId":[77131],"firstPacket":1787278250285,"ipProtocol":17,"lastPacket":1787278250285,"length":0,"network":{"bytes":72,"community_id":"1:JzAMfn7ioIhQA7mMSH0/8FdhnWI=","packets":1},"node":"spark-afae","packetPos":[-77131,5518684],"packetRange":{"gte":1787278250285,"lte":1787278250285},"protocol":["dns","udp"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS200651 FlokiNET ehf","number":200651,"organization":{"name":"FlokiNET ehf"}},"bytes":72,"geo":{"country_iso_code":"RO"},"ip":"185.100.87.136","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":1,"port":57933},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcPayload8":"34ef010000010000","srcRIR":"RIPE","srcTTL":[52],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["662156494680445"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["bfd5c1ca-a1b3-418c-8643-5e916ad156e4"],"signatureCnt":1,"signatureId":[1071781],"signatureIdCnt":1},"tag":{"block":["false"],"blockCnt":1,"category":["protocol"],"categoryCnt":1,"description":["ip addresses with this tag have been observed sending dns traffic."],"intention":["unknown"],"intentionCnt":1,"name":["dns protocol"],"nameCnt":1},"tags":["honeypot","sensor:frantech-ts","frantech-ts"],"tagsCnt":3,"totDataBytes":30}
+{"@timestamp":1787278385899,"_id":"260821-YH-veAzdeANH4LMXR1Ui4hiO","_index":"arkime_sessions3-260821","client":{"bytes":30},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo GmbH"],"isp.dstCnt":1,"isp.src":["FlokiNET Ltd"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["FlokiNET Ltd"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS51167 Contabo GmbH","number":51167,"organization":{"name":"Contabo GmbH"}},"bytes":0,"geo":{"country_iso_code":"FR"},"ip":"109.123.246.142","mac":["00:50:56:63:46:a6"],"mac-cnt":1,"packets":0,"port":53},"dns":[{"host":["version.bind"],"hostCnt":1,"opcode":"QUERY","qc":"CH","qt":"TXT","queryHost":"version.bind"}],"dnsCnt":1,"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[77128],"firstPacket":1787277934755,"ipProtocol":17,"lastPacket":1787277934755,"length":0,"network":{"bytes":72,"community_id":"1:VOOaT5cW8GCZOc/oAZslxVRiIhw=","packets":1},"node":"spark-afae","packetPos":[-77128,19420043],"packetRange":{"gte":1787277934755,"lte":1787277934755},"protocol":["dns","udp"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS200651 FlokiNET ehf","number":200651,"organization":{"name":"FlokiNET ehf"}},"bytes":72,"geo":{"country_iso_code":"RO"},"ip":"185.100.87.136","mac":["c0:69:11:cd:1f:19"],"mac-cnt":1,"packets":1,"port":34160},"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcPayload8":"34ef010000010000","srcRIR":"RIPE","srcTTL":[49],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["1836329107529297"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["bfd5c1ca-a1b3-418c-8643-5e916ad156e4"],"signatureCnt":1,"signatureId":[1071781],"signatureIdCnt":1},"tag":{"block":["false"],"blockCnt":1,"category":["protocol"],"categoryCnt":1,"description":["ip addresses with this tag have been observed sending dns traffic."],"intention":["unknown"],"intentionCnt":1,"name":["dns protocol"],"nameCnt":1},"tags":["sensor:contabo-sponge-02-ts","contabo-sponge-02-ts","proxy"],"tagsCnt":3,"totDataBytes":30}
+{"@timestamp":1787276573924,"_id":"260821-1Mi-SYKM8E9EVaKoW1BDnxIj","_index":"arkime_sessions3-260821","client":{"bytes":30},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Kaopu Cloud HK Limited"],"isp.dstCnt":1,"isp.src":["FlokiNET Ltd"],"isp.srcCnt":1,"org.dst":["LightNode-BH"],"org.dstCnt":1,"org.src":["FlokiNET Ltd"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":0,"geo":{"country_iso_code":"BH"},"ip":"38.54.2.209","mac":["52:54:8f:9d:76:48"],"mac-cnt":1,"packets":0,"port":53},"dns":[{"host":["version.bind"],"hostCnt":1,"opcode":"QUERY","qc":"CH","qt":"TXT","queryHost":"version.bind"}],"dnsCnt":1,"dstRIR":"ARIN","ethertype":2048,"fileId":[77117],"firstPacket":1787275566698,"ipProtocol":17,"lastPacket":1787275566698,"length":0,"network":{"bytes":72,"community_id":"1:7ysETYXyRDZx3rFbIlMUt6Zyehg=","packets":1},"node":"spark-afae","packetPos":[-77117,851305],"packetRange":{"gte":1787275566698,"lte":1787275566698},"protocol":["udp","dns"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS200651 FlokiNET ehf","number":200651,"organization":{"name":"FlokiNET ehf"}},"bytes":72,"geo":{"country_iso_code":"RO"},"ip":"185.100.87.136","mac":["98:44:ce:60:15:19"],"mac-cnt":1,"packets":1,"port":37721},"srcOui":["Huawei Technologies Co.,Ltd"],"srcOuiCnt":1,"srcPayload8":"34ef010000010000","srcRIR":"RIPE","srcTTL":[52],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["1873085448933687"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["bfd5c1ca-a1b3-418c-8643-5e916ad156e4"],"signatureCnt":1,"signatureId":[1071781],"signatureIdCnt":1},"tag":{"block":["false"],"blockCnt":1,"category":["protocol"],"categoryCnt":1,"description":["ip addresses with this tag have been observed sending dns traffic."],"intention":["unknown"],"intentionCnt":1,"name":["dns protocol"],"nameCnt":1},"tags":["bahrain-sponge-01-ts","honeypot","sensor:bahrain-sponge-01-ts"],"tagsCnt":3,"totDataBytes":30}
+{"@timestamp":1787235184868,"_id":"260820-P8OnJDJJXi9HwZ4VrjeAB1ei","_index":"arkime_sessions3-260820","client":{"bytes":13},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Kaopu Cloud HK Limited"],"isp.dstCnt":1,"isp.src":["FlokiNET Ltd"],"isp.srcCnt":1,"org.dst":["LightNode-BH"],"org.dstCnt":1,"org.src":["FlokiNET Ltd"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":375,"geo":{"country_iso_code":"BH"},"ip":"38.54.2.209","mac":["52:54:8f:9d:76:48"],"mac-cnt":1,"packets":4,"port":443},"dstPayload8":"485454502f312e31","dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[76886],"firstPacket":1787234689247,"http":{"bodyMagic":["text/plain"],"bodyMagicCnt":1,"md5":["6196dba52703776af2e6593f772ed7ce"],"md5Cnt":1,"responseHeader":["connection","content-type"],"responseHeaderCnt":2,"responseHeaderField":["content-type","connection"],"responseHeaderValue":["text/plain; charset=utf-8","close"],"responseHeaderValueCnt":2,"serverVersion":["1.1"],"serverVersionCnt":1,"sha256":["19b843cc92cb12aa314bb3c3913b2feeb852e85969bf06cb9d096931bfda34ba"],"sha256Cnt":1,"statuscode":[400],"statuscodeCnt":1},"initRTT":60,"ipProtocol":6,"lastPacket":1787234699369,"length":10122,"network":{"bytes":714,"community_id":"1:vsgU/eXwN+hTyyBLDT68cgxudyU=","packets":9},"node":"spark-afae","packetPos":[-76886,1350181,90,357,82,95,2348,82,185,82],"packetRange":{"gte":1787234689247,"lte":1787234699369},"protocol":["tcp","http","tls"],"protocolCnt":3,"segmentCnt":1,"server":{"bytes":103},"source":{"as":{"full":"AS200651 FlokiNET ehf","number":200651,"organization":{"name":"FlokiNET ehf"}},"bytes":339,"geo":{"country_iso_code":"RO"},"ip":"185.100.87.136","mac":["98:44:ce:60:15:19"],"mac-cnt":1,"packets":5,"port":49380},"srcOui":["Huawei Technologies Co.,Ltd"],"srcOuiCnt":1,"srcPayload8":"1603000008010101","srcRIR":"RIPE","srcTTL":[51],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["499311212942682"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["ac32bdeb-b49d-4079-9e6b-8fbca5e0addf"],"signatureCnt":1,"signatureId":[1031336],"signatureIdCnt":1},"tag":{"block":["false"],"blockCnt":1,"category":["protocol"],"categoryCnt":1,"description":["ip addresses with this tag have been observed attempting to opportunistically crawl the internet and establish tls/ssl connections."],"intention":["unknown"],"intentionCnt":1,"name":["tls/ssl crawler"],"nameCnt":1},"tags":["bahrain-sponge-01-ts","honeypot","sensor:bahrain-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4ls":"49_64_4939768","ja4t":["64240_2-4-8-1-3_1460_7"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":2,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":2,"psh":2,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":3479985102},"tls":{"ja3":["65e083060901bd26e31a66556ae6396b"],"ja3Cnt":1,"ja3string":["257,,,"],"ja3stringCnt":1,"ja4":["t00i000000_000000000000_000000000000"],"ja4Cnt":1,"ja4_r":["t00i000000__"],"ja4_rCnt":1},"totDataBytes":116}
+{"@timestamp":1787235184868,"_id":"260820-P8N89ka3ZyNO7YjM1I7gaVfA","_index":"arkime_sessions3-260820","client":{"bytes":16},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Kaopu Cloud HK Limited"],"isp.dstCnt":1,"isp.src":["FlokiNET Ltd"],"isp.srcCnt":1,"org.dst":["LightNode-BH"],"org.dstCnt":1,"org.src":["FlokiNET Ltd"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":375,"geo":{"country_iso_code":"BH"},"ip":"38.54.2.209","mac":["52:54:8f:9d:76:48"],"mac-cnt":1,"packets":4,"port":443},"dstPayload8":"485454502f312e31","dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[76886],"firstPacket":1787234680246,"http":{"bodyMagic":["text/plain"],"bodyMagicCnt":1,"md5":["6196dba52703776af2e6593f772ed7ce"],"md5Cnt":1,"responseHeader":["connection","content-type"],"responseHeaderCnt":2,"responseHeaderField":["content-type","connection"],"responseHeaderValue":["text/plain; charset=utf-8","close"],"responseHeaderValueCnt":2,"serverVersion":["1.1"],"serverVersionCnt":1,"sha256":["19b843cc92cb12aa314bb3c3913b2feeb852e85969bf06cb9d096931bfda34ba"],"sha256Cnt":1,"statuscode":[400],"statuscodeCnt":1},"initRTT":60,"ipProtocol":6,"lastPacket":1787234689368,"length":9122,"network":{"bytes":717,"community_id":"1:zwPXy8sQSlIDWhOW+WGMfCgNjAk=","packets":9},"node":"spark-afae","packetPos":[-76886,1348709,90,0,82,98,1030,262,185,341],"packetRange":{"gte":1787234680246,"lte":1787234689368},"protocol":["tcp","http"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":103},"source":{"as":{"full":"AS200651 FlokiNET ehf","number":200651,"organization":{"name":"FlokiNET ehf"}},"bytes":342,"geo":{"country_iso_code":"RO"},"ip":"185.100.87.136","mac":["98:44:ce:60:15:19"],"mac-cnt":1,"packets":5,"port":47096},"srcOui":["Huawei Technologies Co.,Ltd"],"srcOuiCnt":1,"srcPayload8":"1020000042424242","srcRIR":"RIPE","srcTTL":[51],"srcTTLCnt":1,"tags":["bahrain-sponge-01-ts","honeypot","sensor:bahrain-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4ls":"43_64_4439963","ja4t":["64240_2-4-8-1-3_1460_7"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":2,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":2,"psh":2,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":1160713571},"totDataBytes":119}
+{"@timestamp":1787229473063,"_id":"260820-WXt1p9OJYIlDk79-NF33whS-","_index":"arkime_sessions3-260820","client":{"bytes":13},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["netcup GmbH"],"isp.dstCnt":1,"isp.src":["FlokiNET Ltd"],"isp.srcCnt":1,"org.dst":["Netcup KVM"],"org.dstCnt":1,"org.src":["FlokiNET Ltd"],"org.srcCnt":1,"usertype.dst":["business"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS197540 netcup GmbH","number":197540,"organization":{"name":"netcup GmbH"}},"bytes":375,"geo":{"country_iso_code":"DE"},"ip":"159.195.21.150","mac":["8a:41:d3:b8:0d:d3"],"mac-cnt":1,"packets":4,"port":443},"dstPayload8":"485454502f312e31","dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[76855],"firstPacket":1787228550688,"http":{"bodyMagic":["text/plain"],"bodyMagicCnt":1,"md5":["6196dba52703776af2e6593f772ed7ce"],"md5Cnt":1,"responseHeader":["content-type","connection"],"responseHeaderCnt":2,"responseHeaderField":["content-type","connection"],"responseHeaderValue":["text/plain; charset=utf-8","close"],"responseHeaderValueCnt":2,"serverVersion":["1.1"],"serverVersionCnt":1,"sha256":["19b843cc92cb12aa314bb3c3913b2feeb852e85969bf06cb9d096931bfda34ba"],"sha256Cnt":1,"statuscode":[400],"statuscodeCnt":1},"initRTT":15,"ipProtocol":6,"lastPacket":1787228560719,"length":10031,"network":{"bytes":716,"community_id":"1:m5RRUje544bSCNhfzXF8WNahz6M=","packets":9},"node":"spark-afae","packetPos":[-76855,3229378,90,357,226,95,22883,82,185,82],"packetRange":{"gte":1787228550688,"lte":1787228560719},"protocol":["tls","tcp","http"],"protocolCnt":3,"segmentCnt":1,"server":{"bytes":103},"source":{"as":{"full":"AS200651 FlokiNET ehf","number":200651,"organization":{"name":"FlokiNET ehf"}},"bytes":341,"geo":{"country_iso_code":"RO"},"ip":"185.100.87.136","mac":["bc:0f:fe:3d:a3:a7","00:00:5e:00:01:96"],"mac-cnt":2,"packets":5,"port":32882},"srcOui":["Juniper Networks","ICANN, IANA Department"],"srcOuiCnt":2,"srcPayload8":"1603000008010101","srcRIR":"RIPE","srcTTL":[53],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["1830589063226795"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["ac32bdeb-b49d-4079-9e6b-8fbca5e0addf"],"signatureCnt":1,"signatureId":[1031336],"signatureIdCnt":1},"tag":{"block":["false"],"blockCnt":1,"category":["protocol"],"categoryCnt":1,"description":["ip addresses with this tag have been observed attempting to opportunistically crawl the internet and establish tls/ssl connections."],"intention":["unknown"],"intentionCnt":1,"name":["tls/ssl crawler"],"nameCnt":1},"tags":["sensor:netcup-ts","netcup-ts","honeypot"],"tagsCnt":3,"tcp":{"ja4ls":"66_64_4984466","ja4t":["64240_2-4-8-1-3_1460_7"],"ja4tCnt":1,"ja4ts":["43440_2-4-8-1-3_1460_11"],"ja4tsCnt":1},"tcpflags":{"ack":2,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":2,"psh":2,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":2788429998},"tls":{"ja3":["65e083060901bd26e31a66556ae6396b"],"ja3Cnt":1,"ja3string":["257,,,"],"ja3stringCnt":1,"ja4":["t00i000000_000000000000_000000000000"],"ja4Cnt":1,"ja4_r":["t00i000000__"],"ja4_rCnt":1},"totDataBytes":116}
+{"@timestamp":1787229472732,"_id":"260820-WXvQ7Bl9g-BKfrJA_QaFlNX2","_index":"arkime_sessions3-260820","client":{"bytes":16},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["netcup GmbH"],"isp.dstCnt":1,"isp.src":["FlokiNET Ltd"],"isp.srcCnt":1,"org.dst":["Netcup KVM"],"org.dstCnt":1,"org.src":["FlokiNET Ltd"],"org.srcCnt":1,"usertype.dst":["business"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS197540 netcup GmbH","number":197540,"organization":{"name":"netcup GmbH"}},"bytes":375,"geo":{"country_iso_code":"DE"},"ip":"159.195.21.150","mac":["8a:41:d3:b8:0d:d3"],"mac-cnt":1,"packets":4,"port":443},"dstPayload8":"485454502f312e31","dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[76855],"firstPacket":1787228541688,"http":{"bodyMagic":["text/plain"],"bodyMagicCnt":1,"md5":["6196dba52703776af2e6593f772ed7ce"],"md5Cnt":1,"responseHeader":["content-type","connection"],"responseHeaderCnt":2,"responseHeaderField":["content-type","connection"],"responseHeaderValue":["text/plain; charset=utf-8","close"],"responseHeaderValueCnt":2,"serverVersion":["1.1"],"serverVersionCnt":1,"sha256":["19b843cc92cb12aa314bb3c3913b2feeb852e85969bf06cb9d096931bfda34ba"],"sha256Cnt":1,"statuscode":[400],"statuscodeCnt":1},"initRTT":15,"ipProtocol":6,"lastPacket":1787228550719,"length":9031,"network":{"bytes":719,"community_id":"1:jVmlSLv1TyRvS16BwTH47suDmQQ=","packets":9},"node":"spark-afae","packetPos":[-76855,3218517,90,0,82,98,10419,262,185,164],"packetRange":{"gte":1787228541688,"lte":1787228550719},"protocol":["tcp","http"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":103},"source":{"as":{"full":"AS200651 FlokiNET ehf","number":200651,"organization":{"name":"FlokiNET ehf"}},"bytes":344,"geo":{"country_iso_code":"RO"},"ip":"185.100.87.136","mac":["bc:0f:fe:3d:a3:a7","00:00:5e:00:01:96"],"mac-cnt":2,"packets":5,"port":32880},"srcOui":["Juniper Networks","ICANN, IANA Department"],"srcOuiCnt":2,"srcPayload8":"1020000042424242","srcRIR":"RIPE","srcTTL":[53],"srcTTLCnt":1,"tags":["sensor:netcup-ts","netcup-ts","honeypot"],"tagsCnt":3,"tcp":{"ja4ls":"51_64_4484639","ja4t":["64240_2-4-8-1-3_1460_7"],"ja4tCnt":1,"ja4ts":["43440_2-4-8-1-3_1460_11"],"ja4tsCnt":1},"tcpflags":{"ack":2,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":2,"psh":2,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":2867468320},"totDataBytes":119}
+{"@timestamp":1787224362608,"_id":"260820-4Ho6deXLPG1NIa0k5E4AQsQw","_index":"arkime_sessions3-260820","client":{"bytes":13},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["FlokiNET Ltd"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["FlokiNET Ltd"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":375,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":4,"port":443},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstPayload8":"485454502f312e31","dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[76825],"firstPacket":1787223314504,"http":{"bodyMagic":["text/plain"],"bodyMagicCnt":1,"responseHeader":["connection","content-type"],"responseHeaderCnt":2,"responseHeaderField":["content-type","connection"],"responseHeaderValue":["text/plain; charset=utf-8","close"],"responseHeaderValueCnt":2,"serverVersion":["1.1"],"serverVersionCnt":1,"statuscode":[400],"statuscodeCnt":1},"initRTT":84,"ipProtocol":6,"lastPacket":1787223324669,"length":10165,"network":{"bytes":714,"community_id":"1:Amn+jqdWrpgCfhpE45EezIjYwco=","packets":9},"node":"spark-afae","packetPos":[-76825,1280066,172,357,82,95,12323,82,185,254],"packetRange":{"gte":1787223314504,"lte":1787223324669},"protocol":["tls","http","tcp"],"protocolCnt":3,"rootId":"260820-4Ho6deXLPG1NIa0k5E4AQsQw","segmentCnt":1,"server":{"bytes":103},"source":{"as":{"full":"AS200651 FlokiNET ehf","number":200651,"organization":{"name":"FlokiNET ehf"}},"bytes":339,"geo":{"country_iso_code":"RO"},"ip":"185.100.87.136","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":5,"port":46316},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcPayload8":"1603000008010101","srcRIR":"RIPE","srcTTL":[52],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["758511907217017"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["ac32bdeb-b49d-4079-9e6b-8fbca5e0addf"],"signatureCnt":1,"signatureId":[1031336],"signatureIdCnt":1},"tag":{"block":["false"],"blockCnt":1,"category":["protocol"],"categoryCnt":1,"description":["ip addresses with this tag have been observed attempting to opportunistically crawl the internet and establish tls/ssl connections."],"intention":["unknown"],"intentionCnt":1,"name":["tls/ssl crawler"],"nameCnt":1},"tags":["sensor:frantech-ts","honeypot","frantech-ts"],"tagsCnt":3,"tcp":{"ja4ls":"101_64_4914686","ja4t":["64240_2-4-8-1-3_1400_7"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":2,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":2,"psh":2,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":1448835148},"tls":{"ja3":["65e083060901bd26e31a66556ae6396b"],"ja3Cnt":1,"ja3string":["257,,,"],"ja3stringCnt":1,"ja4":["t00i000000_000000000000_000000000000"],"ja4Cnt":1,"ja4_r":["t00i000000__"],"ja4_rCnt":1},"totDataBytes":116}
+{"@timestamp":1787224362620,"_id":"260820-4HpCODEYsX9Ex6xVaHEh4Qb7","_index":"arkime_sessions3-260820","client":{"bytes":16},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["FlokiNET Ltd"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["FlokiNET Ltd"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":375,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":4,"port":443},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstPayload8":"485454502f312e31","dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[76825],"firstPacket":1787223305501,"http":{"bodyMagic":["text/plain"],"bodyMagicCnt":1,"responseHeader":["connection","content-type"],"responseHeaderCnt":2,"responseHeaderField":["content-type","connection"],"responseHeaderValue":["text/plain; charset=utf-8","close"],"responseHeaderValueCnt":2,"serverVersion":["1.1"],"serverVersionCnt":1,"statuscode":[400],"statuscodeCnt":1},"initRTT":84,"ipProtocol":6,"lastPacket":1787223314674,"length":9173,"network":{"bytes":717,"community_id":"1:vueUa5dLFAb30HGdAALnHvon00A=","packets":9},"node":"spark-afae","packetPos":[-76825,1269606,90,160,82,98,10120,172,185,341],"packetRange":{"gte":1787223305501,"lte":1787223314674},"protocol":["http","tcp"],"protocolCnt":2,"rootId":"260820-4HpCODEYsX9Ex6xVaHEh4Qb7","segmentCnt":1,"server":{"bytes":103},"source":{"as":{"full":"AS200651 FlokiNET ehf","number":200651,"organization":{"name":"FlokiNET ehf"}},"bytes":342,"geo":{"country_iso_code":"RO"},"ip":"185.100.87.136","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":5,"port":49576},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcPayload8":"1020000042424242","srcRIR":"RIPE","srcTTL":[53],"srcTTLCnt":1,"tags":["sensor:frantech-ts","honeypot","frantech-ts"],"tagsCnt":3,"tcp":{"ja4ls":"43_64_4417939","ja4t":["64240_2-4-8-1-3_1400_7"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":2,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":2,"psh":2,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":3702674257},"totDataBytes":119}
+{"@timestamp":1787208433883,"_id":"260820-dHluWOUbrN9L0IKz_91Vvp1N","_index":"arkime_sessions3-260820","client":{"bytes":13},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo GmbH"],"isp.dstCnt":1,"isp.src":["FlokiNET Ltd"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["FlokiNET Ltd"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS51167 Contabo GmbH","number":51167,"organization":{"name":"Contabo GmbH"}},"bytes":272,"geo":{"country_iso_code":"FR"},"ip":"109.123.246.142","mac":["00:50:56:63:46:a6"],"mac-cnt":1,"packets":4,"port":443},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[76739],"firstPacket":1787207885164,"initRTT":15,"ipProtocol":6,"lastPacket":1787207885331,"length":167,"network":{"bytes":557,"community_id":"1:tg4z6gXSaz5bcefo1vgoKr+k3LY=","packets":8},"node":"spark-afae","packetPos":[-76739,70206357,90,1197,82,95,12771,328,82],"packetRange":{"gte":1787207885164,"lte":1787207885331},"protocol":["tcp","tls"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS200651 FlokiNET ehf","number":200651,"organization":{"name":"FlokiNET ehf"}},"bytes":285,"geo":{"country_iso_code":"RO"},"ip":"185.100.87.136","mac":["c0:69:11:cd:1f:19","00:c0:1d:c0:ff:ee"],"mac-cnt":2,"packets":4,"port":44000},"srcOui":["Arista Networks","Grand Junction Networks, Inc."],"srcOuiCnt":2,"srcPayload8":"1603000008010101","srcRIR":"RIPE","srcTTL":[49],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["1549605034496052"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["ac32bdeb-b49d-4079-9e6b-8fbca5e0addf"],"signatureCnt":1,"signatureId":[1031336],"signatureIdCnt":1},"tag":{"block":["false"],"blockCnt":1,"category":["protocol"],"categoryCnt":1,"description":["ip addresses with this tag have been observed attempting to opportunistically crawl the internet and establish tls/ssl connections."],"intention":["unknown"],"intentionCnt":1,"name":["tls/ssl crawler"],"nameCnt":1},"tags":["contabo-sponge-02-ts","proxy","sensor:contabo-sponge-02-ts"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-4-8-1-3_1460_7"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":3,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":2,"psh":1,"rst":0,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":3700629673},"tls":{"ja3":["65e083060901bd26e31a66556ae6396b"],"ja3Cnt":1,"ja3string":["257,,,"],"ja3stringCnt":1,"ja4":["t00i000000_000000000000_000000000000"],"ja4Cnt":1,"ja4_r":["t00i000000__"],"ja4_rCnt":1},"totDataBytes":13}
+{"@timestamp":1787208433883,"_id":"260820-dHkJbbm6UtVJsI1sN5P2RS5b","_index":"arkime_sessions3-260820","client":{"bytes":16},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo GmbH"],"isp.dstCnt":1,"isp.src":["FlokiNET Ltd"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["FlokiNET Ltd"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS51167 Contabo GmbH","number":51167,"organization":{"name":"Contabo GmbH"}},"bytes":206,"geo":{"country_iso_code":"FR"},"ip":"109.123.246.142","mac":["00:50:56:63:46:a6"],"mac-cnt":1,"packets":3,"port":443},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[76739],"firstPacket":1787207884992,"initRTT":17,"ipProtocol":6,"lastPacket":1787207885133,"length":141,"network":{"bytes":428,"community_id":"1:BC1yARCPP1xfuZGWDu2zm1d+OzU=","packets":6},"node":"spark-afae","packetPos":[-76739,70201429,90,776,82,98,3108],"packetRange":{"gte":1787207884992,"lte":1787207885133},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS200651 FlokiNET ehf","number":200651,"organization":{"name":"FlokiNET ehf"}},"bytes":222,"geo":{"country_iso_code":"RO"},"ip":"185.100.87.136","mac":["c0:69:11:cd:1f:19","00:c0:1d:c0:ff:ee"],"mac-cnt":2,"packets":3,"port":43986},"srcOui":["Arista Networks","Grand Junction Networks, Inc."],"srcOuiCnt":2,"srcPayload8":"1020000042424242","srcRIR":"RIPE","srcTTL":[49],"srcTTLCnt":1,"tags":["contabo-sponge-02-ts","proxy","sensor:contabo-sponge-02-ts"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-4-8-1-3_1460_7"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":2,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":1,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":3426482614},"totDataBytes":16}
+{"@timestamp":1787200872326,"_id":"260820-hr4zpoSeoCNJ5bKrLZFEdxO2","_index":"arkime_sessions3-260820","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Kaopu Cloud HK Limited"],"isp.dstCnt":1,"isp.src":["FlokiNET Ltd"],"isp.srcCnt":1,"org.dst":["LightNode-BH"],"org.dstCnt":1,"org.src":["FlokiNET Ltd"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":66,"geo":{"country_iso_code":"BH"},"ip":"38.54.2.209","mac":["52:54:8f:9d:76:48"],"mac-cnt":1,"packets":1,"port":443},"dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[76696],"firstPacket":1787199717787,"ipProtocol":6,"lastPacket":1787199717906,"length":119,"network":{"bytes":186,"community_id":"1:dyxTFvk1ACU1Aq+KugSi8nmw+OY=","packets":3},"node":"spark-afae","packetPos":[-76696,258836,82,0],"packetRange":{"gte":1787199717787,"lte":1787199717906},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS200651 FlokiNET ehf","number":200651,"organization":{"name":"FlokiNET ehf"}},"bytes":120,"geo":{"country_iso_code":"RO"},"ip":"185.100.87.136","mac":["98:44:ce:60:15:19"],"mac-cnt":1,"packets":2,"port":52446},"srcOui":["Huawei Technologies Co.,Ltd"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[52],"srcTTLCnt":1,"tags":["bahrain-sponge-01-ts","honeypot","sensor:bahrain-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["65535_2-1-3-1-1-4_1460_8"],"ja4tCnt":1,"ja4ts":["64240_2-1-1-4-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":770117761},"totDataBytes":0}
+{"@timestamp":1787198753843,"_id":"260820-rngmiGaAZo9Oy7Ma6-uKNL4P","_index":"arkime_sessions3-260820","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["netcup GmbH"],"isp.dstCnt":1,"isp.src":["FlokiNET Ltd"],"isp.srcCnt":1,"org.dst":["Netcup KVM"],"org.dstCnt":1,"org.src":["FlokiNET Ltd"],"org.srcCnt":1,"usertype.dst":["business"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS197540 netcup GmbH","number":197540,"organization":{"name":"netcup GmbH"}},"bytes":66,"geo":{"country_iso_code":"DE"},"ip":"159.195.21.150","mac":["8a:41:d3:b8:0d:d3"],"mac-cnt":1,"packets":1,"port":443},"dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[76684],"firstPacket":1787198179101,"ipProtocol":6,"lastPacket":1787198179132,"length":31,"network":{"bytes":188,"community_id":"1:wvHOdDwqIsJsLdd1Ev/gmVdSR2s=","packets":3},"node":"spark-afae","packetPos":[-76684,18268576,82,1070],"packetRange":{"gte":1787198179101,"lte":1787198179132},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS200651 FlokiNET ehf","number":200651,"organization":{"name":"FlokiNET ehf"}},"bytes":122,"geo":{"country_iso_code":"RO"},"ip":"185.100.87.136","mac":["00:00:5e:00:01:96","bc:0f:fe:3d:a3:a7"],"mac-cnt":2,"packets":2,"port":45427},"srcOui":["Juniper Networks","ICANN, IANA Department"],"srcOuiCnt":2,"srcRIR":"RIPE","srcTTL":[53],"srcTTLCnt":1,"tags":["netcup-ts","honeypot","sensor:netcup-ts"],"tagsCnt":3,"tcp":{"ja4t":["65535_2-1-3-1-1-4_1460_8"],"ja4tCnt":1,"ja4ts":["42340_2-1-1-4-1-3_1460_11"],"ja4tsCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":2024229875},"totDataBytes":0}
+{"@timestamp":1787197850933,"_id":"260820-mHjQ7WpKMoJCbZ6QswKD6li5","_index":"arkime_sessions3-260820","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["FlokiNET Ltd"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["FlokiNET Ltd"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":66,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":1,"port":443},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[76679],"firstPacket":1787196865955,"ipProtocol":6,"lastPacket":1787196866123,"length":168,"network":{"bytes":186,"community_id":"1:vyWZ+1w/4Lgb7w/tZPmtpkVMgxk=","packets":3},"node":"spark-afae","packetPos":[-76679,8940748,82,0],"packetRange":{"gte":1787196865955,"lte":1787196866123},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS200651 FlokiNET ehf","number":200651,"organization":{"name":"FlokiNET ehf"}},"bytes":120,"geo":{"country_iso_code":"RO"},"ip":"185.100.87.136","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":2,"port":52278},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[53],"srcTTLCnt":1,"tags":["sensor:frantech-ts","honeypot","frantech-ts"],"tagsCnt":3,"tcp":{"ja4t":["65535_2-1-3-1-1-4_1400_8"],"ja4tCnt":1,"ja4ts":["64240_2-1-1-4-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":317170716},"totDataBytes":0}
+{"@timestamp":1787196035455,"_id":"260820-4b0MLWlqdO5J9LxJr9TTZS6l","_index":"arkime_sessions3-260820","client":{"bytes":13},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["FlokiNET Ltd"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["FlokiNET Ltd"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":375,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":4,"port":443},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstPayload8":"485454502f312e31","dstRIR":"RIPE","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[76669],"firstPacket":1787195490437,"http":{"bodyMagic":["text/plain"],"bodyMagicCnt":1,"md5":["6196dba52703776af2e6593f772ed7ce"],"md5Cnt":1,"responseHeader":["content-type","connection"],"responseHeaderCnt":2,"responseHeaderField":["content-type","connection"],"responseHeaderValue":["text/plain; charset=utf-8","close"],"responseHeaderValueCnt":2,"serverVersion":["1.1"],"serverVersionCnt":1,"sha256":["19b843cc92cb12aa314bb3c3913b2feeb852e85969bf06cb9d096931bfda34ba"],"sha256Cnt":1,"statuscode":[400],"statuscodeCnt":1},"initRTT":92,"ipProtocol":6,"lastPacket":1787195500612,"length":10175,"network":{"bytes":720,"community_id":"1:zvEA6D08XCA68OC65Ip0Sj9wJ0o=","packets":9},"node":"spark-afae","packetPos":[-76669,3400860,172,717,82,95,29155,82,185,164],"packetRange":{"gte":1787195490437,"lte":1787195500612},"protocol":["tls","tcp","http"],"protocolCnt":3,"segmentCnt":1,"server":{"bytes":103},"source":{"as":{"full":"AS200651 FlokiNET ehf","number":200651,"organization":{"name":"FlokiNET ehf"}},"bytes":345,"geo":{"country_iso_code":"RO"},"ip":"185.100.87.136","mac":["fc:bd:67:9d:2b:2b","00:c0:1d:c0:ff:ee"],"mac-cnt":2,"packets":5,"port":58842},"srcOui":["Grand Junction Networks, Inc.","Arista Networks"],"srcOuiCnt":2,"srcPayload8":"1603000008010101","srcRIR":"RIPE","srcTTL":[55],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["754031476976321"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["ac32bdeb-b49d-4079-9e6b-8fbca5e0addf"],"signatureCnt":1,"signatureId":[1031336],"signatureIdCnt":1},"tag":{"block":["false"],"blockCnt":1,"category":["protocol"],"categoryCnt":1,"description":["ip addresses with this tag have been observed attempting to opportunistically crawl the internet and establish tls/ssl connections."],"intention":["unknown"],"intentionCnt":1,"name":["tls/ssl crawler"],"nameCnt":1},"tags":["honeypot","contabo-sponge-01-ts","sensor:contabo-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4ls":"73_64_4907451","ja4t":["64240_2-4-8-1-3_1460_7"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":2,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":2,"psh":2,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":3415927730},"tls":{"ja3":["65e083060901bd26e31a66556ae6396b"],"ja3Cnt":1,"ja3string":["257,,,"],"ja3stringCnt":1,"ja4":["t00i000000_000000000000_000000000000"],"ja4Cnt":1,"ja4_r":["t00i000000__"],"ja4_rCnt":1},"totDataBytes":116}
+{"@timestamp":1787196035455,"_id":"260820-4b2WWQbM_11JU4kYRO1Rsjkf","_index":"arkime_sessions3-260820","client":{"bytes":16},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["FlokiNET Ltd"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["FlokiNET Ltd"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":375,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":4,"port":443},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstPayload8":"485454502f312e31","dstRIR":"RIPE","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[76669],"firstPacket":1787195481436,"http":{"bodyMagic":["text/plain"],"bodyMagicCnt":1,"md5":["6196dba52703776af2e6593f772ed7ce"],"md5Cnt":1,"responseHeader":["content-type","connection"],"responseHeaderCnt":2,"responseHeaderField":["content-type","connection"],"responseHeaderValue":["text/plain; charset=utf-8","close"],"responseHeaderValueCnt":2,"serverVersion":["1.1"],"serverVersionCnt":1,"sha256":["19b843cc92cb12aa314bb3c3913b2feeb852e85969bf06cb9d096931bfda34ba"],"sha256Cnt":1,"statuscode":[400],"statuscodeCnt":1},"initRTT":87,"ipProtocol":6,"lastPacket":1787195490651,"length":9215,"network":{"bytes":723,"community_id":"1:glLSYxaGBdYSK+cQEkPMCGCeP3M=","packets":9},"node":"spark-afae","packetPos":[-76669,3365041,90,0,82,98,35549,172,185,881],"packetRange":{"gte":1787195481436,"lte":1787195490651},"protocol":["tcp","http"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":103},"source":{"as":{"full":"AS200651 FlokiNET ehf","number":200651,"organization":{"name":"FlokiNET ehf"}},"bytes":348,"geo":{"country_iso_code":"RO"},"ip":"185.100.87.136","mac":["fc:bd:67:9d:2b:2b","00:c0:1d:c0:ff:ee"],"mac-cnt":2,"packets":5,"port":46994},"srcOui":["Grand Junction Networks, Inc.","Arista Networks"],"srcOuiCnt":2,"srcPayload8":"1020000042424242","srcRIR":"RIPE","srcTTL":[56],"srcTTLCnt":1,"tags":["honeypot","contabo-sponge-01-ts","sensor:contabo-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4ls":"68_64_4421773","ja4t":["64240_2-4-8-1-3_1460_7"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":2,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":2,"psh":2,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":1587130527},"totDataBytes":119}
+{"@timestamp":1787193933093,"_id":"260820-lL3XuyTeu7JDf5vNlcRoXdE1","_index":"arkime_sessions3-260820","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo GmbH"],"isp.dstCnt":1,"isp.src":["FlokiNET Ltd"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["FlokiNET Ltd"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS51167 Contabo GmbH","number":51167,"organization":{"name":"Contabo GmbH"}},"bytes":66,"geo":{"country_iso_code":"FR"},"ip":"109.123.246.142","mac":["00:50:56:63:46:a6"],"mac-cnt":1,"packets":1,"port":443},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[76657],"firstPacket":1787192998057,"ipProtocol":6,"lastPacket":1787192998088,"length":31,"network":{"bytes":192,"community_id":"1:aRdppeL+uo36ElQETqoOljQ6lZc=","packets":3},"node":"spark-afae","packetPos":[-76657,3547768,82,0],"packetRange":{"gte":1787192998057,"lte":1787192998088},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS200651 FlokiNET ehf","number":200651,"organization":{"name":"FlokiNET ehf"}},"bytes":126,"geo":{"country_iso_code":"RO"},"ip":"185.100.87.136","mac":["c0:69:11:cd:1f:19","00:c0:1d:c0:ff:ee"],"mac-cnt":2,"packets":2,"port":35203},"srcOui":["Arista Networks","Grand Junction Networks, Inc."],"srcOuiCnt":2,"srcRIR":"RIPE","srcTTL":[49],"srcTTLCnt":1,"tags":["contabo-sponge-02-ts","proxy","sensor:contabo-sponge-02-ts"],"tagsCnt":3,"tcp":{"ja4t":["65535_2-1-3-1-1-4_1460_8"],"ja4tCnt":1,"ja4ts":["64240_2-1-1-4-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":400216613},"totDataBytes":0}
+{"@timestamp":1787190626876,"_id":"260820-G72icNFw1RtHoKRdVFhUZOQd","_index":"arkime_sessions3-260820","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["FlokiNET Ltd"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["FlokiNET Ltd"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":66,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":1,"port":443},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[76639],"firstPacket":1787189890941,"ipProtocol":6,"lastPacket":1787189891107,"length":166,"network":{"bytes":192,"community_id":"1:bEpUHtaprJnpBB6WmlqqOpgMVlI=","packets":3},"node":"spark-afae","packetPos":[-76639,1203845,82,442],"packetRange":{"gte":1787189890941,"lte":1787189891107},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS200651 FlokiNET ehf","number":200651,"organization":{"name":"FlokiNET ehf"}},"bytes":126,"geo":{"country_iso_code":"RO"},"ip":"185.100.87.136","mac":["fc:bd:67:9d:2b:2b","00:c0:1d:c0:ff:ee"],"mac-cnt":2,"packets":2,"port":45752},"srcOui":["Grand Junction Networks, Inc.","Arista Networks"],"srcOuiCnt":2,"srcRIR":"RIPE","srcTTL":[56],"srcTTLCnt":1,"tags":["sensor:contabo-sponge-01-ts","honeypot","contabo-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["65535_2-1-3-1-1-4_1460_8"],"ja4tCnt":1,"ja4ts":["64240_2-1-1-4-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":3613841877},"totDataBytes":0}
+{"@timestamp":1787138181763,"_id":"260819-ynMokQOBTfdEkINoz657vgO7","_index":"arkime_sessions3-260819","client":{"bytes":52},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["netcup GmbH"],"isp.dstCnt":1,"isp.src":["FlokiNET Ltd"],"isp.srcCnt":1,"org.dst":["Netcup KVM"],"org.dstCnt":1,"org.src":["FlokiNET Ltd"],"org.srcCnt":1,"usertype.dst":["business"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS197540 netcup GmbH","number":197540,"organization":{"name":"netcup GmbH"}},"bytes":0,"geo":{"country_iso_code":"DE"},"ip":"159.195.21.150","mac":["8a:41:d3:b8:0d:d3"],"mac-cnt":1,"packets":0,"port":8080},"dstRIR":"ARIN","ethertype":2048,"fileId":[76348],"firstPacket":1787137675911,"ipProtocol":17,"lastPacket":1787137675911,"length":0,"network":{"bytes":94,"community_id":"1:/kl5CkMJrhi5F8pPpv/uMGonez8=","packets":1},"node":"spark-afae","packetPos":[-76348,1032228],"packetRange":{"gte":1787137675911,"lte":1787137675911},"protocol":["udp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS200651 FlokiNET ehf","number":200651,"organization":{"name":"FlokiNET ehf"}},"bytes":94,"geo":{"country_iso_code":"RO"},"ip":"185.100.87.136","mac":["bc:0f:fe:3d:a3:a7"],"mac-cnt":1,"packets":1,"port":46687},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcPayload8":"08ef002600000000","srcRIR":"RIPE","srcTTL":[53],"srcTTLCnt":1,"tags":["netcup-ts","honeypot","sensor:netcup-ts"],"tagsCnt":3,"totDataBytes":52}
+{"@timestamp":1787138181719,"_id":"260819-ynMZxGQwMyJIqY10TIt_i8Jz","_index":"arkime_sessions3-260819","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["netcup GmbH"],"isp.dstCnt":1,"isp.src":["FlokiNET Ltd"],"isp.srcCnt":1,"org.dst":["Netcup KVM"],"org.dstCnt":1,"org.src":["FlokiNET Ltd"],"org.srcCnt":1,"usertype.dst":["business"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS197540 netcup GmbH","number":197540,"organization":{"name":"netcup GmbH"}},"bytes":66,"geo":{"country_iso_code":"DE"},"ip":"159.195.21.150","mac":["8a:41:d3:b8:0d:d3"],"mac-cnt":1,"packets":1,"port":8080},"dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[76348],"firstPacket":1787137674763,"ipProtocol":6,"lastPacket":1787137675818,"length":1055,"network":{"bytes":188,"community_id":"1:vd0/xSh7dx91WLHiy74y0xi/+rw=","packets":3},"node":"spark-afae","packetPos":[-76348,1031910,82,164],"packetRange":{"gte":1787137674763,"lte":1787137675818},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS200651 FlokiNET ehf","number":200651,"organization":{"name":"FlokiNET ehf"}},"bytes":122,"geo":{"country_iso_code":"RO"},"ip":"185.100.87.136","mac":["bc:0f:fe:3d:a3:a7","00:00:5e:00:01:96"],"mac-cnt":2,"packets":2,"port":51404},"srcOui":["Juniper Networks","ICANN, IANA Department"],"srcOuiCnt":2,"srcRIR":"RIPE","srcTTL":[53],"srcTTLCnt":1,"tags":["netcup-ts","honeypot","sensor:netcup-ts"],"tagsCnt":3,"tcp":{"ja4t":["65535_2-1-3-1-1-4_1460_8"],"ja4tCnt":1,"ja4ts":["42340_2-1-1-4-1-3_1460_11"],"ja4tsCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":2137311022},"totDataBytes":0}
+{"@timestamp":1787137572282,"_id":"260819-v3ODATQBU9FDGLBAIHQ00sFl","_index":"arkime_sessions3-260819","client":{"bytes":52},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["FlokiNET Ltd"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["FlokiNET Ltd"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":0,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":0,"port":8080},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstRIR":"ARIN","ethertype":2048,"fileId":[76345],"firstPacket":1787136728849,"ipProtocol":17,"lastPacket":1787136728849,"length":0,"network":{"bytes":94,"community_id":"1:sSwdWHSwH/nd4hzYxNGGEXq3jJ8=","packets":1},"node":"spark-afae","packetPos":[-76345,5887851],"packetRange":{"gte":1787136728849,"lte":1787136728849},"protocol":["udp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS200651 FlokiNET ehf","number":200651,"organization":{"name":"FlokiNET ehf"}},"bytes":94,"geo":{"country_iso_code":"RO"},"ip":"185.100.87.136","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":1,"port":58502},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcPayload8":"08ef002600000000","srcRIR":"RIPE","srcTTL":[53],"srcTTLCnt":1,"tags":["frantech-ts","sensor:frantech-ts","honeypot"],"tagsCnt":3,"totDataBytes":52}