diff options
Diffstat (limited to 'kevlar/2026-08-31/sponge/ip-sessions/session_search_20260831T113639_29b53eaa.ndjson')
| -rw-r--r-- | kevlar/2026-08-31/sponge/ip-sessions/session_search_20260831T113639_29b53eaa.ndjson | 53 |
1 files changed, 53 insertions, 0 deletions
diff --git a/kevlar/2026-08-31/sponge/ip-sessions/session_search_20260831T113639_29b53eaa.ndjson b/kevlar/2026-08-31/sponge/ip-sessions/session_search_20260831T113639_29b53eaa.ndjson new file mode 100644 index 0000000..801ba6c --- /dev/null +++ b/kevlar/2026-08-31/sponge/ip-sessions/session_search_20260831T113639_29b53eaa.ndjson @@ -0,0 +1,53 @@ +{"@timestamp":1787991936200,"_id":"260829-N7vgw7p2CSVAZo3Eac-9AVUP","_index":"arkime_sessions3-260829","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Hetzner Online GmbH"],"isp.dstCnt":1,"isp.src":["Aeza International LTD"],"isp.srcCnt":1,"org.dst":["HETZNER-DC"],"org.dstCnt":1,"org.src":["Aeza International LTD"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS24940 Hetzner Online GmbH","number":24940,"organization":{"name":"Hetzner Online GmbH"}},"bytes":0,"geo":{"country_iso_code":"FI"},"ip":"89.167.72.144","mac":["92:00:07:4c:82:70"],"mac-cnt":1,"packets":0,"port":8080},"dstRIR":"RIPE","ethertype":2048,"fileId":[81221],"firstPacket":1787991651170,"ipProtocol":6,"lastPacket":1787991652186,"length":1016,"network":{"bytes":148,"community_id":"1:eL4ZHV77N4HFQc9mFEV3MHTbUrI=","packets":2},"node":"spark-afae","packetPos":[-81221,179108,172],"packetRange":{"gte":1787991651170,"lte":1787991652186},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS210644 Aeza Group LLC","number":210644,"organization":{"name":"Aeza Group LLC"}},"bytes":148,"geo":{"country_iso_code":"AT"},"ip":"147.45.71.214","mac":["d2:74:7f:6e:37:e3"],"mac-cnt":1,"packets":2,"port":35120},"spoofable":["true"],"spoofableCnt":1,"srcRIR":"ARIN","srcTTL":[54],"srcTTLCnt":1,"tags":["sensor:sponge-01-ts","honeypot","sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["42340_2-4-8-1-3_1320_13"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":2053509478},"totDataBytes":0} +{"@timestamp":1787990732940,"_id":"260829-JyZPRBEzvntIvqGZ5he1oAVW","_index":"arkime_sessions3-260829","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["netcup GmbH"],"isp.dstCnt":1,"isp.src":["Aeza International LTD"],"isp.srcCnt":1,"org.dst":["Netcup KVM"],"org.dstCnt":1,"org.src":["Aeza International LTD"],"org.srcCnt":1,"usertype.dst":["business"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS197540 netcup GmbH","number":197540,"organization":{"name":"netcup GmbH"}},"bytes":0,"geo":{"country_iso_code":"DE"},"ip":"159.195.21.150","mac":["8a:41:d3:b8:0d:d3"],"mac-cnt":1,"packets":0,"port":8080},"dstRIR":"ARIN","ethertype":2048,"fileId":[81214],"firstPacket":1787990351245,"ipProtocol":6,"lastPacket":1787990352272,"length":1027,"network":{"bytes":148,"community_id":"1:GGalzCq2CCJidVQDewuE/nlZWLg=","packets":2},"node":"spark-afae","packetPos":[-81214,524172,90],"packetRange":{"gte":1787990351245,"lte":1787990352272},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS210644 Aeza Group LLC","number":210644,"organization":{"name":"Aeza Group LLC"}},"bytes":148,"geo":{"country_iso_code":"AT"},"ip":"147.45.71.214","mac":["bc:0f:fe:3d:a3:a7"],"mac-cnt":1,"packets":2,"port":36370},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"ARIN","srcTTL":[52],"srcTTLCnt":1,"tags":["sensor:netcup-ts","honeypot","netcup-ts"],"tagsCnt":3,"tcp":{"ja4t":["42340_2-4-8-1-3_1320_13"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":4001417055},"totDataBytes":0} +{"@timestamp":1787991333465,"_id":"260829-PSaP-yxzqhlH8pIUi5668ScD","_index":"arkime_sessions3-260829","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Kaopu Cloud HK Limited"],"isp.dstCnt":1,"isp.src":["Aeza International LTD"],"isp.srcCnt":1,"org.dst":["LightNode-BH"],"org.dstCnt":1,"org.src":["Aeza International LTD"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":0,"geo":{"country_iso_code":"BH"},"ip":"38.54.2.209","mac":["52:54:8f:9d:76:48"],"mac-cnt":1,"packets":0,"port":8080},"dstRIR":"ARIN","ethertype":2048,"fileId":[81218],"firstPacket":1787990348840,"ipProtocol":6,"lastPacket":1787990349842,"length":1002,"network":{"bytes":148,"community_id":"1:kVHDHgOVwUb4k0RfLwjESx8q5Iw=","packets":2},"node":"spark-afae","packetPos":[-81218,114070,90],"packetRange":{"gte":1787990348840,"lte":1787990349842},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS210644 Aeza Group LLC","number":210644,"organization":{"name":"Aeza Group LLC"}},"bytes":148,"geo":{"country_iso_code":"AT"},"ip":"147.45.71.214","mac":["98:44:ce:60:15:19"],"mac-cnt":1,"packets":2,"port":38912},"spoofable":["true"],"spoofableCnt":1,"srcDscp":[8],"srcDscpCnt":1,"srcOui":["Huawei Technologies Co.,Ltd"],"srcOuiCnt":1,"srcRIR":"ARIN","srcTTL":[54],"srcTTLCnt":1,"tags":["sensor:bahrain-sponge-01-ts","bahrain-sponge-01-ts","honeypot"],"tagsCnt":3,"tcp":{"ja4t":["42340_2-4-8-1-3_1320_13"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":2067320260},"totDataBytes":0} +{"@timestamp":1787989232002,"_id":"260829-8iU7Srj9pjhO977qYKN1i74I","_index":"arkime_sessions3-260829","client":{"bytes":135},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["Aeza International LTD"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["Aeza International LTD"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":429,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":5,"port":8090},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstPayload8":"485454502f312e31","dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[81204],"firstPacket":1787988675072,"http":{"bodyMagic":["text/plain"],"bodyMagicCnt":1,"responseHeader":["content-type","connection"],"responseHeaderCnt":2,"responseHeaderField":["content-type","connection"],"responseHeaderValue":["text/plain; charset=utf-8","close"],"responseHeaderValueCnt":2,"serverVersion":["1.1"],"serverVersionCnt":1,"statuscode":[400],"statuscodeCnt":1},"initRTT":74,"ipProtocol":6,"lastPacket":1787988675404,"length":332,"network":{"bytes":902,"community_id":"1:uxawoEdIi9OVrKDoJgGgM+GHw5k=","packets":10},"node":"spark-afae","packetPos":[-81204,6282457,90,160,82,210,82,185,82,278,89],"packetRange":{"gte":1787988675072,"lte":1787988675404},"protocol":["tcp","tls","http"],"protocolCnt":3,"segmentCnt":1,"server":{"bytes":103},"source":{"as":{"full":"AS210644 Aeza Group LLC","number":210644,"organization":{"name":"Aeza Group LLC"}},"bytes":473,"geo":{"country_iso_code":"AT"},"ip":"147.45.71.214","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":5,"port":39668},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcPayload8":"160301007b010000","srcRIR":"ARIN","srcTTL":[51],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["873895570045471"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["ac32bdeb-b49d-4079-9e6b-8fbca5e0addf"],"signatureCnt":1,"signatureId":[1031336],"signatureIdCnt":1},"tag":{"block":["false"],"blockCnt":1,"category":["protocol"],"categoryCnt":1,"description":["ip addresses with this tag have been observed attempting to opportunistically crawl the internet and establish tls/ssl connections."],"intention":["unknown"],"intentionCnt":1,"name":["tls/ssl crawler"],"nameCnt":1},"tags":["honeypot","frantech-ts","sensor:frantech-ts"],"tagsCnt":3,"tcp":{"ja4l":"74037_51_tcp","ja4ls":"31_64_136","ja4t":["42340_2-4-8-1-3_1320_13"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":3,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":1,"psh":3,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":371097084},"tls":{"ja3":["cba7f34191ef2379c1325641f6c6c4f4"],"ja3Cnt":1,"ja3string":["771,49199-49195-49169-49159-49171-49161-49172-49162-5-47-53-49170-10,5-10-11-13-65281,23-24-25,0"],"ja3stringCnt":1,"ja4":["t12i130500_2d7513195f68_e51b7354d87f"],"ja4Cnt":1,"ja4_r":["t12i130500_0005,000a,002f,0035,c007,c009,c00a,c011,c012,c013,c014,c02b,c02f_0005,000a,000b,000d,ff01_0401,0403,0201,0203,0401,0501,0601"],"ja4_rCnt":1},"totDataBytes":238} +{"@timestamp":1787989231405,"_id":"260829-8iWGhDIZrlxK6b9XePYZmxyh","_index":"arkime_sessions3-260829","client":{"bytes":252},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["Aeza International LTD"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["Aeza International LTD"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":625,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":5,"port":8090},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstPayload8":"485454502f312e31","dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[81204],"firstPacket":1787988674763,"http":{"bodyMagic":["text/html"],"bodyMagicCnt":1,"clientVersion":["1.1"],"clientVersionCnt":1,"host":["209.141.62.110:8090","209.141.62.110"],"hostCnt":2,"ja4h":["ge11nn050000_57c5e92682a8_000000000000_000000000000"],"ja4hCnt":1,"ja4h_r":["ge11nn050000_Host,User-Agent,Accept-Charset,Accept-Encoding,Connection__"],"ja4h_rCnt":1,"md5":["0f87454a3ea15f0db55ae928dbcd82fc"],"md5Cnt":1,"method":["GET"],"method-GET":1,"methodCnt":1,"path":["/favicon.ico"],"pathCnt":1,"requestHeader":["host","user-agent","accept-charset","accept-encoding","connection"],"requestHeaderCnt":5,"requestHeaderField":["accept-charset","accept-encoding","connection"],"requestHeaderValue":["utf-8","gzip","close"],"requestHeaderValueCnt":3,"response-server":["Apache/2.4.41 (Ubuntu)"],"response-serverCnt":1,"response-x-powered-by":["PHP/7.4.3"],"response-x-powered-byCnt":1,"responseHeader":["content-type","content-length","server","x-powered-by","connection","date"],"responseHeaderCnt":6,"responseHeaderField":["connection","content-type","date","content-length"],"responseHeaderValue":["close","text/plain; charset=utf-8","sat, 29 aug 2026 07:31:14 gmt","94"],"responseHeaderValueCnt":4,"serverVersion":["1.1"],"serverVersionCnt":1,"sha256":["1ca624415b2889dbeb3f969890b848b7bc5eaf96ca5e8fdd7461f943b45d10cb"],"sha256Cnt":1,"statuscode":[200],"statuscodeCnt":1,"uri":["209.141.62.110:8090/favicon.ico"],"uriCnt":1,"useragent":["Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.5 Safari/605.2.22"],"useragentCnt":1},"initRTT":74,"ipProtocol":6,"lastPacket":1787988675072,"length":309,"network":{"bytes":1215,"community_id":"1:Zt3Sxso44M5VUUvuKEss42Nl7/4=","packets":10},"node":"spark-afae","packetPos":[-81204,6280512,90,0,82,334,82,369,652,82,0],"packetRange":{"gte":1787988674763,"lte":1787988675072},"protocol":["tcp","http"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":287},"source":{"as":{"full":"AS210644 Aeza Group LLC","number":210644,"organization":{"name":"Aeza Group LLC"}},"bytes":590,"geo":{"country_iso_code":"AT"},"ip":"147.45.71.214","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":5,"port":39666},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcPayload8":"474554202f666176","srcRIR":"ARIN","srcTTL":[51],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["746957014419118"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["869feaa1-dc77-4037-aee2-247b7a39cf7d","ce8622a8-6d2f-4fe3-ab81-0cc86e19363e","ee583a2e-d308-4c53-b8e2-a1cd45cd1bb7","f63d9281-086b-4182-9002-663ffb13d931"],"signatureCnt":4,"signatureId":[2000166,2000009,1031486,2000008],"signatureIdCnt":4},"tag":{"block":["false","true"],"blockCnt":2,"category":["recon","attack","protocol"],"categoryCnt":3,"cves":[""],"cvesCnt":1,"description":["generic favicon request detection. requests for /favicon.ico are commonly issued by web crawlers and browsers during normal browsing, but can also indicate automated scanning activity.","ip addresses with this tag have been seen crawling http(s) servers around the internet.","generic web crawler traffic detected. the simple pattern of get requests without specific exploitation indicators suggests automated crawling activity, possibly for search indexing or vulnerability scanning.","cloud credential scanning probe detected. requests for sensitive configuration files and credentials indicate automated scanning for exposed secrets and api keys."],"intention":["suspicious","unknown"],"intentionCnt":2,"name":["favicon crawler","web crawler","root path scanner"],"nameCnt":3},"tags":["honeypot","frantech-ts","sensor:frantech-ts"],"tagsCnt":3,"tcp":{"ja4ls":"52_64_tcp","ja4t":["42340_2-4-8-1-3_1320_13"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":4,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":2,"psh":2,"rst":0,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":1302908324},"totDataBytes":539} +{"@timestamp":1787989232002,"_id":"260829-8iWRE2jdvJRMOLk5YVC7Bdse","_index":"arkime_sessions3-260829","client":{"bytes":135},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["Aeza International LTD"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["Aeza International LTD"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":429,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":5,"port":8090},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstPayload8":"485454502f312e31","dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[81204],"firstPacket":1787988674319,"http":{"bodyMagic":["text/plain"],"bodyMagicCnt":1,"responseHeader":["content-type","connection"],"responseHeaderCnt":2,"responseHeaderField":["content-type","connection"],"responseHeaderValue":["text/plain; charset=utf-8","close"],"responseHeaderValueCnt":2,"serverVersion":["1.1"],"serverVersionCnt":1,"statuscode":[400],"statuscodeCnt":1},"initRTT":73,"ipProtocol":6,"lastPacket":1787988674669,"length":350,"network":{"bytes":968,"community_id":"1:htAHriicJaClpAZni31hChsAJ2U=","packets":11},"node":"spark-afae","packetPos":[-81204,6279098,90,360,82,210,82,185,82,0,0,89],"packetRange":{"gte":1787988674319,"lte":1787988674669},"protocol":["tcp","tls","http"],"protocolCnt":3,"segmentCnt":1,"server":{"bytes":103},"source":{"as":{"full":"AS210644 Aeza Group LLC","number":210644,"organization":{"name":"Aeza Group LLC"}},"bytes":539,"geo":{"country_iso_code":"AT"},"ip":"147.45.71.214","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":6,"port":39652},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcPayload8":"160301007b010000","srcRIR":"ARIN","srcTTL":[51],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["807980301493381"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["ac32bdeb-b49d-4079-9e6b-8fbca5e0addf"],"signatureCnt":1,"signatureId":[1031336],"signatureIdCnt":1},"tag":{"block":["false"],"blockCnt":1,"category":["protocol"],"categoryCnt":1,"description":["ip addresses with this tag have been observed attempting to opportunistically crawl the internet and establish tls/ssl connections."],"intention":["unknown"],"intentionCnt":1,"name":["tls/ssl crawler"],"nameCnt":1},"tags":["honeypot","frantech-ts","sensor:frantech-ts"],"tagsCnt":3,"tcp":{"ja4l":"73584_51_tcp","ja4ls":"25_64_61","ja4t":["42340_2-4-8-1-3_1320_13"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":4,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":1,"psh":3,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":2461629858},"tls":{"ja3":["cba7f34191ef2379c1325641f6c6c4f4"],"ja3Cnt":1,"ja3string":["771,49199-49195-49169-49159-49171-49161-49172-49162-5-47-53-49170-10,5-10-11-13-65281,23-24-25,0"],"ja3stringCnt":1,"ja4":["t12i130500_2d7513195f68_e51b7354d87f"],"ja4Cnt":1,"ja4_r":["t12i130500_0005,000a,002f,0035,c007,c009,c00a,c011,c012,c013,c014,c02b,c02f_0005,000a,000b,000d,ff01_0401,0403,0201,0203,0401,0501,0601"],"ja4_rCnt":1},"totDataBytes":238} +{"@timestamp":1787989231405,"_id":"260829-8iUMBJkeH1tMt79ppkR65LUG","_index":"arkime_sessions3-260829","client":{"bytes":241},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["Aeza International LTD"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["Aeza International LTD"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":625,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":5,"port":8090},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstPayload8":"485454502f312e31","dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[81204],"firstPacket":1787988674009,"http":{"bodyMagic":["text/html"],"bodyMagicCnt":1,"clientVersion":["1.1"],"clientVersionCnt":1,"host":["209.141.62.110:8090","209.141.62.110"],"hostCnt":2,"ja4h":["ge11nn050000_57c5e92682a8_000000000000_000000000000"],"ja4hCnt":1,"ja4h_r":["ge11nn050000_Host,User-Agent,Accept-Charset,Accept-Encoding,Connection__"],"ja4h_rCnt":1,"md5":["0f87454a3ea15f0db55ae928dbcd82fc"],"md5Cnt":1,"method":["GET"],"method-GET":1,"methodCnt":1,"path":["/"],"pathCnt":1,"requestHeader":["host","user-agent","accept-charset","accept-encoding","connection"],"requestHeaderCnt":5,"requestHeaderField":["accept-charset","accept-encoding","connection"],"requestHeaderValue":["utf-8","gzip","close"],"requestHeaderValueCnt":3,"response-server":["Apache/2.4.41 (Ubuntu)"],"response-serverCnt":1,"response-x-powered-by":["PHP/7.4.3"],"response-x-powered-byCnt":1,"responseHeader":["content-type","content-length","server","x-powered-by","connection","date"],"responseHeaderCnt":6,"responseHeaderField":["connection","content-type","date","content-length"],"responseHeaderValue":["close","text/plain; charset=utf-8","sat, 29 aug 2026 07:31:14 gmt","94"],"responseHeaderValueCnt":4,"serverVersion":["1.1"],"serverVersionCnt":1,"sha256":["1ca624415b2889dbeb3f969890b848b7bc5eaf96ca5e8fdd7461f943b45d10cb"],"sha256Cnt":1,"statuscode":[200],"statuscodeCnt":1,"uri":["209.141.62.110:8090/"],"uriCnt":1,"useragent":["Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.5 Safari/605.2.22"],"useragentCnt":1},"initRTT":73,"ipProtocol":6,"lastPacket":1787988674317,"length":308,"network":{"bytes":1204,"community_id":"1:xHF483LzNV4C2HWHwKUc89PDlik=","packets":10},"node":"spark-afae","packetPos":[-81204,6277575,90,249,82,323,82,369,82,0,0],"packetRange":{"gte":1787988674009,"lte":1787988674317},"protocol":["tcp","http"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":287},"source":{"as":{"full":"AS210644 Aeza Group LLC","number":210644,"organization":{"name":"Aeza Group LLC"}},"bytes":579,"geo":{"country_iso_code":"AT"},"ip":"147.45.71.214","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":5,"port":39648},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcPayload8":"474554202f204854","srcRIR":"ARIN","srcTTL":[51],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["601795474186862"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["869feaa1-dc77-4037-aee2-247b7a39cf7d","ce8622a8-6d2f-4fe3-ab81-0cc86e19363e","ee583a2e-d308-4c53-b8e2-a1cd45cd1bb7"],"signatureCnt":3,"signatureId":[2000166,1031486,2000008],"signatureIdCnt":3},"tag":{"block":["false","true"],"blockCnt":2,"category":["recon","attack","protocol"],"categoryCnt":3,"cves":[""],"cvesCnt":1,"description":["ip addresses with this tag have been seen crawling http(s) servers around the internet.","generic web crawler traffic detected. the simple pattern of get requests without specific exploitation indicators suggests automated crawling activity, possibly for search indexing or vulnerability scanning.","cloud credential scanning probe detected. requests for sensitive configuration files and credentials indicate automated scanning for exposed secrets and api keys."],"intention":["suspicious","unknown"],"intentionCnt":2,"name":["web crawler","root path scanner"],"nameCnt":2},"tags":["honeypot","frantech-ts","sensor:frantech-ts"],"tagsCnt":3,"tcp":{"ja4ls":"28_64_tcp","ja4t":["42340_2-4-8-1-3_1320_13"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":4,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":2,"psh":2,"rst":0,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":37769695},"totDataBytes":528} +{"@timestamp":1787989232002,"_id":"260829-8iX_KKREQIJDy7u4046l507c","_index":"arkime_sessions3-260829","client":{"bytes":135},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["Aeza International LTD"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["Aeza International LTD"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":429,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":5,"port":8090},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstPayload8":"485454502f312e31","dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[81204],"firstPacket":1787988673689,"http":{"bodyMagic":["text/plain"],"bodyMagicCnt":1,"responseHeader":["content-type","connection"],"responseHeaderCnt":2,"responseHeaderField":["content-type","connection"],"responseHeaderValue":["text/plain; charset=utf-8","close"],"responseHeaderValueCnt":2,"serverVersion":["1.1"],"serverVersionCnt":1,"statuscode":[400],"statuscodeCnt":1},"initRTT":74,"ipProtocol":6,"lastPacket":1787988674009,"length":320,"network":{"bytes":902,"community_id":"1:70uOdbeDOG8Fdk+1kXqdkEjHIUc=","packets":10},"node":"spark-afae","packetPos":[-81204,6276402,90,0,82,210,82,185,352,262,89],"packetRange":{"gte":1787988673689,"lte":1787988674009},"protocol":["tcp","tls","http"],"protocolCnt":3,"segmentCnt":1,"server":{"bytes":103},"source":{"as":{"full":"AS210644 Aeza Group LLC","number":210644,"organization":{"name":"Aeza Group LLC"}},"bytes":473,"geo":{"country_iso_code":"AT"},"ip":"147.45.71.214","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":5,"port":39646},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcPayload8":"160301007b010000","srcRIR":"ARIN","srcTTL":[51],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["426365615991645"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["ac32bdeb-b49d-4079-9e6b-8fbca5e0addf"],"signatureCnt":1,"signatureId":[1031336],"signatureIdCnt":1},"tag":{"block":["false"],"blockCnt":1,"category":["protocol"],"categoryCnt":1,"description":["ip addresses with this tag have been observed attempting to opportunistically crawl the internet and establish tls/ssl connections."],"intention":["unknown"],"intentionCnt":1,"name":["tls/ssl crawler"],"nameCnt":1},"tags":["honeypot","frantech-ts","sensor:frantech-ts"],"tagsCnt":3,"tcp":{"ja4l":"74415_51_tcp","ja4ls":"45_64_86","ja4t":["42340_2-4-8-1-3_1320_13"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":3,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":1,"psh":3,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":2484838809},"tls":{"ja3":["cba7f34191ef2379c1325641f6c6c4f4"],"ja3Cnt":1,"ja3string":["771,49199-49195-49169-49159-49171-49161-49172-49162-5-47-53-49170-10,5-10-11-13-65281,23-24-25,0"],"ja3stringCnt":1,"ja4":["t12i130500_2d7513195f68_e51b7354d87f"],"ja4Cnt":1,"ja4_r":["t12i130500_0005,000a,002f,0035,c007,c009,c00a,c011,c012,c013,c014,c02b,c02f_0005,000a,000b,000d,ff01_0401,0403,0201,0203,0401,0501,0601"],"ja4_rCnt":1},"totDataBytes":238} +{"@timestamp":1787989231403,"_id":"260829-8iVhAQC8pDZDrbMbKut2M2FB","_index":"arkime_sessions3-260829","client":{"bytes":211},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["Aeza International LTD"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["Aeza International LTD"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":625,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":5,"port":8090},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstPayload8":"485454502f312e31","dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[81204],"firstPacket":1787988626241,"http":{"bodyMagic":["text/html"],"bodyMagicCnt":1,"clientVersion":["1.1"],"clientVersionCnt":1,"host":["209.141.62.110:8090","209.141.62.110"],"hostCnt":2,"ja4h":["ge11nn040000_e1d2031bdfea_000000000000_000000000000"],"ja4hCnt":1,"ja4h_r":["ge11nn040000_Host,User-Agent,Accept,Accept-Encoding__"],"ja4h_rCnt":1,"md5":["0f87454a3ea15f0db55ae928dbcd82fc"],"md5Cnt":1,"method":["GET"],"method-GET":1,"methodCnt":1,"path":["/"],"pathCnt":1,"requestHeader":["host","accept","user-agent","accept-encoding"],"requestHeaderCnt":4,"requestHeaderField":["accept","accept-encoding"],"requestHeaderValue":["*/*","gzip"],"requestHeaderValueCnt":2,"response-server":["Apache/2.4.41 (Ubuntu)"],"response-serverCnt":1,"response-x-powered-by":["PHP/7.4.3"],"response-x-powered-byCnt":1,"responseHeader":["content-type","content-length","server","x-powered-by","connection","date"],"responseHeaderCnt":6,"responseHeaderField":["connection","content-type","date","content-length"],"responseHeaderValue":["close","text/plain; charset=utf-8","sat, 29 aug 2026 07:30:26 gmt","94"],"responseHeaderValueCnt":4,"serverVersion":["1.1"],"serverVersionCnt":1,"sha256":["1ca624415b2889dbeb3f969890b848b7bc5eaf96ca5e8fdd7461f943b45d10cb"],"sha256Cnt":1,"statuscode":[200],"statuscodeCnt":1,"uri":["209.141.62.110:8090/"],"uriCnt":1,"useragent":["Mozilla/5.0 (Macintosh; Intel Mac OS X 15_7_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.0 Safari/605.1.15"],"useragentCnt":1},"initRTT":71,"ipProtocol":6,"lastPacket":1787988626527,"length":286,"network":{"bytes":1240,"community_id":"1:nCfEpictZ2fhOZY+buZGsWc6qdg=","packets":11},"node":"spark-afae","packetPos":[-81204,6162398,90,410,82,293,82,369,172,82,0,0],"packetRange":{"gte":1787988626241,"lte":1787988626527},"protocol":["tcp","http"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":287},"source":{"as":{"full":"AS210644 Aeza Group LLC","number":210644,"organization":{"name":"Aeza Group LLC"}},"bytes":615,"geo":{"country_iso_code":"AT"},"ip":"147.45.71.214","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":6,"port":49334},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcPayload8":"474554202f204854","srcRIR":"ARIN","srcTTL":[51],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["757261300706659"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["869feaa1-dc77-4037-aee2-247b7a39cf7d","ce8622a8-6d2f-4fe3-ab81-0cc86e19363e","ee583a2e-d308-4c53-b8e2-a1cd45cd1bb7"],"signatureCnt":3,"signatureId":[2000166,1031486,2000008],"signatureIdCnt":3},"tag":{"block":["false","true"],"blockCnt":2,"category":["recon","attack","protocol"],"categoryCnt":3,"cves":[""],"cvesCnt":1,"description":["ip addresses with this tag have been seen crawling http(s) servers around the internet.","generic web crawler traffic detected. the simple pattern of get requests without specific exploitation indicators suggests automated crawling activity, possibly for search indexing or vulnerability scanning.","cloud credential scanning probe detected. requests for sensitive configuration files and credentials indicate automated scanning for exposed secrets and api keys."],"intention":["suspicious","unknown"],"intentionCnt":2,"name":["web crawler","root path scanner"],"nameCnt":2},"tags":["honeypot","frantech-ts","sensor:frantech-ts"],"tagsCnt":3,"tcp":{"ja4ls":"45_64_tcp","ja4t":["42340_2-4-8-1-3_1320_13"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":5,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":2,"psh":2,"rst":0,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":2928161800},"totDataBytes":498} +{"@timestamp":1787982872397,"_id":"260829-9SR0arAIZFBBVZV2_O7esHrf","_index":"arkime_sessions3-260829","client":{"bytes":135},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["Aeza International LTD"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["Aeza International LTD"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":429,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":5,"port":3000},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstPayload8":"485454502f312e31","dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[81154],"firstPacket":1787982250385,"http":{"bodyMagic":["text/plain"],"bodyMagicCnt":1,"responseHeader":["content-type","connection"],"responseHeaderCnt":2,"responseHeaderField":["content-type","connection"],"responseHeaderValue":["text/plain; charset=utf-8","close"],"responseHeaderValueCnt":2,"serverVersion":["1.1"],"serverVersionCnt":1,"statuscode":[400],"statuscodeCnt":1},"initRTT":70,"ipProtocol":6,"lastPacket":1787982250855,"length":470,"network":{"bytes":968,"community_id":"1:jieErXBJP8GVwDk7RvSzQufK12s=","packets":11},"node":"spark-afae","packetPos":[-81154,2217961,90,712,402,210,82,185,1744,292,82,89],"packetRange":{"gte":1787982250385,"lte":1787982250855},"protocol":["tls","http","tcp"],"protocolCnt":3,"segmentCnt":1,"server":{"bytes":103},"source":{"as":{"full":"AS210644 Aeza Group LLC","number":210644,"organization":{"name":"Aeza Group LLC"}},"bytes":539,"geo":{"country_iso_code":"AT"},"ip":"147.45.71.214","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":6,"port":60300},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcPayload8":"160301007b010000","srcRIR":"ARIN","srcTTL":[51],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["811069510869961"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["ac32bdeb-b49d-4079-9e6b-8fbca5e0addf"],"signatureCnt":1,"signatureId":[1031336],"signatureIdCnt":1},"tag":{"block":["false"],"blockCnt":1,"category":["protocol"],"categoryCnt":1,"description":["ip addresses with this tag have been observed attempting to opportunistically crawl the internet and establish tls/ssl connections."],"intention":["unknown"],"intentionCnt":1,"name":["tls/ssl crawler"],"nameCnt":1},"tags":["sensor:frantech-ts","honeypot","frantech-ts"],"tagsCnt":3,"tcp":{"ja4l":"70791_51_tcp","ja4ls":"40_64_135","ja4t":["42340_2-4-8-1-3_1320_13"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":4,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":1,"psh":3,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":3059006402},"tls":{"ja3":["cba7f34191ef2379c1325641f6c6c4f4"],"ja3Cnt":1,"ja3string":["771,49199-49195-49169-49159-49171-49161-49172-49162-5-47-53-49170-10,5-10-11-13-65281,23-24-25,0"],"ja3stringCnt":1,"ja4":["t12i130500_2d7513195f68_e51b7354d87f"],"ja4Cnt":1,"ja4_r":["t12i130500_0005,000a,002f,0035,c007,c009,c00a,c011,c012,c013,c014,c02b,c02f_0005,000a,000b,000d,ff01_0401,0403,0201,0203,0401,0501,0601"],"ja4_rCnt":1},"totDataBytes":238} +{"@timestamp":1787982872337,"_id":"260829-9SSKfQx4eXNERafqSZR9ptWS","_index":"arkime_sessions3-260829","client":{"bytes":239},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["Aeza International LTD"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["Aeza International LTD"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":625,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":5,"port":3000},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstPayload8":"485454502f312e31","dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[81154],"firstPacket":1787982249668,"http":{"bodyMagic":["text/html"],"bodyMagicCnt":1,"clientVersion":["1.1"],"clientVersionCnt":1,"host":["209.141.62.110:3000","209.141.62.110"],"hostCnt":2,"ja4h":["ge11nn050000_57c5e92682a8_000000000000_000000000000"],"ja4hCnt":1,"ja4h_r":["ge11nn050000_Host,User-Agent,Accept-Charset,Accept-Encoding,Connection__"],"ja4h_rCnt":1,"md5":["0f87454a3ea15f0db55ae928dbcd82fc"],"md5Cnt":1,"method":["GET"],"method-GET":1,"methodCnt":1,"path":["/favicon.ico"],"pathCnt":1,"requestHeader":["user-agent","accept-encoding","host","accept-charset","connection"],"requestHeaderCnt":5,"requestHeaderField":["accept-charset","accept-encoding","connection"],"requestHeaderValue":["utf-8","gzip","close"],"requestHeaderValueCnt":3,"response-server":["Apache/2.4.41 (Ubuntu)"],"response-serverCnt":1,"response-x-powered-by":["PHP/7.4.3"],"response-x-powered-byCnt":1,"responseHeader":["x-powered-by","content-type","content-length","server","date","connection"],"responseHeaderCnt":6,"responseHeaderField":["connection","content-type","date","content-length"],"responseHeaderValue":["close","text/plain; charset=utf-8","sat, 29 aug 2026 05:44:10 gmt","94"],"responseHeaderValueCnt":4,"serverVersion":["1.1"],"serverVersionCnt":1,"sha256":["1ca624415b2889dbeb3f969890b848b7bc5eaf96ca5e8fdd7461f943b45d10cb"],"sha256Cnt":1,"statuscode":[200],"statuscodeCnt":1,"uri":["209.141.62.110:3000/favicon.ico"],"uriCnt":1,"useragent":["Mozilla/5.0 (CentOS; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36"],"useragentCnt":1},"initRTT":71,"ipProtocol":6,"lastPacket":1787982250299,"length":631,"network":{"bytes":1268,"community_id":"1:xjEbXBdsE108KaWVL1BgoVQex1c=","packets":11},"node":"spark-afae","packetPos":[-81154,2215053,90,442,460,321,82,369,242,82,336,82],"packetRange":{"gte":1787982249668,"lte":1787982250299},"protocol":["http","tcp"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":287},"source":{"as":{"full":"AS210644 Aeza Group LLC","number":210644,"organization":{"name":"Aeza Group LLC"}},"bytes":643,"geo":{"country_iso_code":"AT"},"ip":"147.45.71.214","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":6,"port":60294},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcPayload8":"474554202f666176","srcRIR":"ARIN","srcTTL":[51],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["335914626835621"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["ce8622a8-6d2f-4fe3-ab81-0cc86e19363e","ee583a2e-d308-4c53-b8e2-a1cd45cd1bb7","f63d9281-086b-4182-9002-663ffb13d931","869feaa1-dc77-4037-aee2-247b7a39cf7d"],"signatureCnt":4,"signatureId":[2000166,2000009,1031486,2000008],"signatureIdCnt":4},"tag":{"block":["false","true"],"blockCnt":2,"category":["attack","recon","protocol"],"categoryCnt":3,"cves":[""],"cvesCnt":1,"description":["ip addresses with this tag have been seen crawling http(s) servers around the internet.","cloud credential scanning probe detected. requests for sensitive configuration files and credentials indicate automated scanning for exposed secrets and api keys.","generic favicon request detection. requests for /favicon.ico are commonly issued by web crawlers and browsers during normal browsing, but can also indicate automated scanning activity.","generic web crawler traffic detected. the simple pattern of get requests without specific exploitation indicators suggests automated crawling activity, possibly for search indexing or vulnerability scanning."],"intention":["unknown","suspicious"],"intentionCnt":2,"name":["favicon crawler","web crawler","root path scanner"],"nameCnt":3},"tags":["sensor:frantech-ts","honeypot","frantech-ts"],"tagsCnt":3,"tcp":{"ja4ls":"27_64_tcp","ja4t":["42340_2-4-8-1-3_1320_13"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":5,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":2,"psh":2,"rst":0,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":519290863},"totDataBytes":526} +{"@timestamp":1787982872397,"_id":"260829-9SQTe90O9HFFm66XpmNaOkz8","_index":"arkime_sessions3-260829","client":{"bytes":135},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["Aeza International LTD"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["Aeza International LTD"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":429,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":5,"port":3000},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstPayload8":"485454502f312e31","dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[81154],"firstPacket":1787982249048,"http":{"bodyMagic":["text/plain"],"bodyMagicCnt":1,"responseHeader":["content-type","connection"],"responseHeaderCnt":2,"responseHeaderField":["content-type","connection"],"responseHeaderValue":["text/plain; charset=utf-8","close"],"responseHeaderValueCnt":2,"serverVersion":["1.1"],"serverVersionCnt":1,"statuscode":[400],"statuscodeCnt":1},"initRTT":71,"ipProtocol":6,"lastPacket":1787982249667,"length":619,"network":{"bytes":968,"community_id":"1:NLqrWBN3Yw4J5U/v7M8mYGl8fDg=","packets":11},"node":"spark-afae","packetPos":[-81154,2212869,90,0,872,210,82,185,262,152,82,89],"packetRange":{"gte":1787982249048,"lte":1787982249667},"protocol":["tls","http","tcp"],"protocolCnt":3,"segmentCnt":1,"server":{"bytes":103},"source":{"as":{"full":"AS210644 Aeza Group LLC","number":210644,"organization":{"name":"Aeza Group LLC"}},"bytes":539,"geo":{"country_iso_code":"AT"},"ip":"147.45.71.214","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":6,"port":60282},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcPayload8":"160301007b010000","srcRIR":"ARIN","srcTTL":[51],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["490828286713626"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["ac32bdeb-b49d-4079-9e6b-8fbca5e0addf"],"signatureCnt":1,"signatureId":[1031336],"signatureIdCnt":1},"tag":{"block":["false"],"blockCnt":1,"category":["protocol"],"categoryCnt":1,"description":["ip addresses with this tag have been observed attempting to opportunistically crawl the internet and establish tls/ssl connections."],"intention":["unknown"],"intentionCnt":1,"name":["tls/ssl crawler"],"nameCnt":1},"tags":["sensor:frantech-ts","honeypot","frantech-ts"],"tagsCnt":3,"tcp":{"ja4l":"71109_51_tcp","ja4ls":"44_64_108","ja4t":["42340_2-4-8-1-3_1320_13"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":4,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":1,"psh":3,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":4206213335},"tls":{"ja3":["cba7f34191ef2379c1325641f6c6c4f4"],"ja3Cnt":1,"ja3string":["771,49199-49195-49169-49159-49171-49161-49172-49162-5-47-53-49170-10,5-10-11-13-65281,23-24-25,0"],"ja3stringCnt":1,"ja4":["t12i130500_2d7513195f68_e51b7354d87f"],"ja4Cnt":1,"ja4_r":["t12i130500_0005,000a,002f,0035,c007,c009,c00a,c011,c012,c013,c014,c02b,c02f_0005,000a,000b,000d,ff01_0401,0403,0201,0203,0401,0501,0601"],"ja4_rCnt":1},"totDataBytes":238} +{"@timestamp":1787982872319,"_id":"260829-9SRsdUpEgeROv68Sju7Kc_L2","_index":"arkime_sessions3-260829","client":{"bytes":228},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["Aeza International LTD"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["Aeza International LTD"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":625,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":5,"port":3000},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstPayload8":"485454502f312e31","dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[81154],"firstPacket":1787982248396,"http":{"bodyMagic":["text/html"],"bodyMagicCnt":1,"clientVersion":["1.1"],"clientVersionCnt":1,"host":["209.141.62.110:3000","209.141.62.110"],"hostCnt":2,"ja4h":["ge11nn050000_57c5e92682a8_000000000000_000000000000"],"ja4hCnt":1,"ja4h_r":["ge11nn050000_Host,User-Agent,Accept-Charset,Accept-Encoding,Connection__"],"ja4h_rCnt":1,"md5":["0f87454a3ea15f0db55ae928dbcd82fc"],"md5Cnt":1,"method":["GET"],"method-GET":1,"methodCnt":1,"path":["/"],"pathCnt":1,"requestHeader":["user-agent","accept-encoding","host","accept-charset","connection"],"requestHeaderCnt":5,"requestHeaderField":["accept-charset","accept-encoding","connection"],"requestHeaderValue":["utf-8","gzip","close"],"requestHeaderValueCnt":3,"response-server":["Apache/2.4.41 (Ubuntu)"],"response-serverCnt":1,"response-x-powered-by":["PHP/7.4.3"],"response-x-powered-byCnt":1,"responseHeader":["x-powered-by","content-type","content-length","server","date","connection"],"responseHeaderCnt":6,"responseHeaderField":["connection","content-type","date","content-length"],"responseHeaderValue":["close","text/plain; charset=utf-8","sat, 29 aug 2026 05:44:08 gmt","94"],"responseHeaderValueCnt":4,"serverVersion":["1.1"],"serverVersionCnt":1,"sha256":["1ca624415b2889dbeb3f969890b848b7bc5eaf96ca5e8fdd7461f943b45d10cb"],"sha256Cnt":1,"statuscode":[200],"statuscodeCnt":1,"uri":["209.141.62.110:3000/"],"uriCnt":1,"useragent":["Mozilla/5.0 (CentOS; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36"],"useragentCnt":1},"initRTT":70,"ipProtocol":6,"lastPacket":1787982248972,"length":576,"network":{"bytes":1257,"community_id":"1:phJMcBwdabHDf7N+vCJFGJA2VLo=","packets":11},"node":"spark-afae","packetPos":[-81154,2209554,90,610,172,310,82,369,1016,172,240,82],"packetRange":{"gte":1787982248396,"lte":1787982248972},"protocol":["http","tcp"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":287},"source":{"as":{"full":"AS210644 Aeza Group LLC","number":210644,"organization":{"name":"Aeza Group LLC"}},"bytes":632,"geo":{"country_iso_code":"AT"},"ip":"147.45.71.214","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":6,"port":49738},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcPayload8":"474554202f204854","srcRIR":"ARIN","srcTTL":[51],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["12429962218702"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["ce8622a8-6d2f-4fe3-ab81-0cc86e19363e","ee583a2e-d308-4c53-b8e2-a1cd45cd1bb7","869feaa1-dc77-4037-aee2-247b7a39cf7d"],"signatureCnt":3,"signatureId":[2000166,1031486,2000008],"signatureIdCnt":3},"tag":{"block":["false","true"],"blockCnt":2,"category":["attack","recon","protocol"],"categoryCnt":3,"cves":[""],"cvesCnt":1,"description":["ip addresses with this tag have been seen crawling http(s) servers around the internet.","cloud credential scanning probe detected. requests for sensitive configuration files and credentials indicate automated scanning for exposed secrets and api keys.","generic web crawler traffic detected. the simple pattern of get requests without specific exploitation indicators suggests automated crawling activity, possibly for search indexing or vulnerability scanning."],"intention":["unknown","suspicious"],"intentionCnt":2,"name":["web crawler","root path scanner"],"nameCnt":2},"tags":["sensor:frantech-ts","honeypot","frantech-ts"],"tagsCnt":3,"tcp":{"ja4ls":"44_64_tcp","ja4t":["42340_2-4-8-1-3_1320_13"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":5,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":2,"psh":2,"rst":0,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":909814970},"totDataBytes":515} +{"@timestamp":1787982872991,"_id":"260829-9SRn8gEZGfxGhZAEgX8CmNhb","_index":"arkime_sessions3-260829","client":{"bytes":135},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["Aeza International LTD"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["Aeza International LTD"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":429,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":5,"port":3000},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstPayload8":"485454502f312e31","dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[81154],"firstPacket":1787982247782,"http":{"bodyMagic":["text/plain"],"bodyMagicCnt":1,"responseHeader":["content-type","connection"],"responseHeaderCnt":2,"responseHeaderField":["content-type","connection"],"responseHeaderValue":["text/plain; charset=utf-8","close"],"responseHeaderValueCnt":2,"serverVersion":["1.1"],"serverVersionCnt":1,"statuscode":[400],"statuscodeCnt":1},"initRTT":70,"ipProtocol":6,"lastPacket":1787982248266,"length":484,"network":{"bytes":968,"community_id":"1:US8DKec5ekaa0LFcjWKqGv4nn4Q=","packets":11},"node":"spark-afae","packetPos":[-81154,2206072,90,918,352,210,82,185,622,82,0,89],"packetRange":{"gte":1787982247782,"lte":1787982248266},"protocol":["tls","http","tcp"],"protocolCnt":3,"segmentCnt":1,"server":{"bytes":103},"source":{"as":{"full":"AS210644 Aeza Group LLC","number":210644,"organization":{"name":"Aeza Group LLC"}},"bytes":539,"geo":{"country_iso_code":"AT"},"ip":"147.45.71.214","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":6,"port":49734},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcPayload8":"160301007b010000","srcRIR":"ARIN","srcTTL":[51],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["2234941089644812"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["ac32bdeb-b49d-4079-9e6b-8fbca5e0addf"],"signatureCnt":1,"signatureId":[1031336],"signatureIdCnt":1},"tag":{"block":["false"],"blockCnt":1,"category":["protocol"],"categoryCnt":1,"description":["ip addresses with this tag have been observed attempting to opportunistically crawl the internet and establish tls/ssl connections."],"intention":["unknown"],"intentionCnt":1,"name":["tls/ssl crawler"],"nameCnt":1},"tags":["sensor:frantech-ts","honeypot","frantech-ts"],"tagsCnt":3,"tcp":{"ja4l":"70758_51_tcp","ja4ls":"45_64_117","ja4t":["42340_2-4-8-1-3_1320_13"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":4,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":1,"psh":3,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":97261827},"tls":{"ja3":["cba7f34191ef2379c1325641f6c6c4f4"],"ja3Cnt":1,"ja3string":["771,49199-49195-49169-49159-49171-49161-49172-49162-5-47-53-49170-10,5-10-11-13-65281,23-24-25,0"],"ja3stringCnt":1,"ja4":["t12i130500_2d7513195f68_e51b7354d87f"],"ja4Cnt":1,"ja4_r":["t12i130500_0005,000a,002f,0035,c007,c009,c00a,c011,c012,c013,c014,c02b,c02f_0005,000a,000b,000d,ff01_0401,0403,0201,0203,0401,0501,0601"],"ja4_rCnt":1},"totDataBytes":238} +{"@timestamp":1787982872317,"_id":"260829-9SQmeo0nCFFN07nC6NCZp3vy","_index":"arkime_sessions3-260829","client":{"bytes":211},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["Aeza International LTD"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["Aeza International LTD"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":625,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":5,"port":3000},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstPayload8":"485454502f312e31","dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[81154],"firstPacket":1787982160277,"http":{"bodyMagic":["text/html"],"bodyMagicCnt":1,"clientVersion":["1.1"],"clientVersionCnt":1,"host":["209.141.62.110:3000","209.141.62.110"],"hostCnt":2,"ja4h":["ge11nn040000_e1d2031bdfea_000000000000_000000000000"],"ja4hCnt":1,"ja4h_r":["ge11nn040000_Host,User-Agent,Accept,Accept-Encoding__"],"ja4h_rCnt":1,"md5":["0f87454a3ea15f0db55ae928dbcd82fc"],"md5Cnt":1,"method":["GET"],"method-GET":1,"methodCnt":1,"path":["/"],"pathCnt":1,"requestHeader":["user-agent","accept-encoding","host","accept"],"requestHeaderCnt":4,"requestHeaderField":["accept","accept-encoding"],"requestHeaderValue":["*/*","gzip"],"requestHeaderValueCnt":2,"response-server":["Apache/2.4.41 (Ubuntu)"],"response-serverCnt":1,"response-x-powered-by":["PHP/7.4.3"],"response-x-powered-byCnt":1,"responseHeader":["x-powered-by","content-type","content-length","server","date","connection"],"responseHeaderCnt":6,"responseHeaderField":["connection","content-type","date","content-length"],"responseHeaderValue":["close","text/plain; charset=utf-8","sat, 29 aug 2026 05:42:40 gmt","94"],"responseHeaderValueCnt":4,"serverVersion":["1.1"],"serverVersionCnt":1,"sha256":["1ca624415b2889dbeb3f969890b848b7bc5eaf96ca5e8fdd7461f943b45d10cb"],"sha256Cnt":1,"statuscode":[200],"statuscodeCnt":1,"uri":["209.141.62.110:3000/"],"uriCnt":1,"useragent":["Mozilla/5.0 (Macintosh; Intel Mac OS X 15_7_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.0 Safari/605.1.15"],"useragentCnt":1},"initRTT":70,"ipProtocol":6,"lastPacket":1787982160562,"length":285,"network":{"bytes":1174,"community_id":"1:NxyOgXM0U7i8ZqDbbscexhe/f2s=","packets":10},"node":"spark-afae","packetPos":[-81154,1987912,90,434,82,293,82,369,572,82,0],"packetRange":{"gte":1787982160277,"lte":1787982160562},"protocol":["http","tcp"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":287},"source":{"as":{"full":"AS210644 Aeza Group LLC","number":210644,"organization":{"name":"Aeza Group LLC"}},"bytes":549,"geo":{"country_iso_code":"AT"},"ip":"147.45.71.214","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":5,"port":41740},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcPayload8":"474554202f204854","srcRIR":"ARIN","srcTTL":[51],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["66972320729093"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["ce8622a8-6d2f-4fe3-ab81-0cc86e19363e","ee583a2e-d308-4c53-b8e2-a1cd45cd1bb7","869feaa1-dc77-4037-aee2-247b7a39cf7d"],"signatureCnt":3,"signatureId":[2000166,1031486,2000008],"signatureIdCnt":3},"tag":{"block":["false","true"],"blockCnt":2,"category":["attack","recon","protocol"],"categoryCnt":3,"cves":[""],"cvesCnt":1,"description":["ip addresses with this tag have been seen crawling http(s) servers around the internet.","cloud credential scanning probe detected. requests for sensitive configuration files and credentials indicate automated scanning for exposed secrets and api keys.","generic web crawler traffic detected. the simple pattern of get requests without specific exploitation indicators suggests automated crawling activity, possibly for search indexing or vulnerability scanning."],"intention":["unknown","suspicious"],"intentionCnt":2,"name":["web crawler","root path scanner"],"nameCnt":2},"tags":["sensor:frantech-ts","honeypot","frantech-ts"],"tagsCnt":3,"tcp":{"ja4ls":"43_64_tcp","ja4t":["42340_2-4-8-1-3_1320_13"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":4,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":2,"psh":2,"rst":0,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":1913934558},"totDataBytes":498} +{"@timestamp":1787981067587,"_id":"260829-4Lnb130YY9BJUpJUeLXTTN_3","_index":"arkime_sessions3-260829","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Hetzner Online GmbH"],"isp.dstCnt":1,"isp.src":["Aeza International LTD"],"isp.srcCnt":1,"org.dst":["HETZNER-DC"],"org.dstCnt":1,"org.src":["Aeza International LTD"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS24940 Hetzner Online GmbH","number":24940,"organization":{"name":"Hetzner Online GmbH"}},"bytes":0,"geo":{"country_iso_code":"FI"},"ip":"89.167.72.144","mac":["92:00:07:4c:82:70"],"mac-cnt":1,"packets":0,"port":3000},"dstRIR":"RIPE","ethertype":2048,"fileId":[81141],"firstPacket":1787980511624,"ipProtocol":6,"lastPacket":1787980512629,"length":1005,"network":{"bytes":148,"community_id":"1:dq81+I36DuIv06HqeSBJsvbEsIU=","packets":2},"node":"spark-afae","packetPos":[-81141,1068016,384],"packetRange":{"gte":1787980511624,"lte":1787980512629},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS210644 Aeza Group LLC","number":210644,"organization":{"name":"Aeza Group LLC"}},"bytes":148,"geo":{"country_iso_code":"AT"},"ip":"147.45.71.214","mac":["d2:74:7f:6e:37:e3"],"mac-cnt":1,"packets":2,"port":46216},"spoofable":["true"],"spoofableCnt":1,"srcRIR":"ARIN","srcTTL":[54],"srcTTLCnt":1,"tags":["sponge-01-ts","honeypot","sensor:sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["42340_2-4-8-1-3_1320_13"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":1413806104},"totDataBytes":0} +{"@timestamp":1787981067587,"_id":"260829-4LkwHJ7YFAVIbY8G_Xa3P1vm","_index":"arkime_sessions3-260829","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Hetzner Online GmbH"],"isp.dstCnt":1,"isp.src":["Aeza International LTD"],"isp.srcCnt":1,"org.dst":["HETZNER-DC"],"org.dstCnt":1,"org.src":["Aeza International LTD"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS24940 Hetzner Online GmbH","number":24940,"organization":{"name":"Hetzner Online GmbH"}},"bytes":0,"geo":{"country_iso_code":"FI"},"ip":"89.167.72.144","mac":["92:00:07:4c:82:70"],"mac-cnt":1,"packets":0,"port":3000},"dstRIR":"RIPE","ethertype":2048,"fileId":[81141],"firstPacket":1787980509623,"ipProtocol":6,"lastPacket":1787980510648,"length":1025,"network":{"bytes":148,"community_id":"1:kn9CMIoAZUZG60OFgsnSpGVWAjs=","packets":2},"node":"spark-afae","packetPos":[-81141,1065642,1814],"packetRange":{"gte":1787980509623,"lte":1787980510648},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS210644 Aeza Group LLC","number":210644,"organization":{"name":"Aeza Group LLC"}},"bytes":148,"geo":{"country_iso_code":"AT"},"ip":"147.45.71.214","mac":["d2:74:7f:6e:37:e3"],"mac-cnt":1,"packets":2,"port":46200},"spoofable":["true"],"spoofableCnt":1,"srcRIR":"ARIN","srcTTL":[54],"srcTTLCnt":1,"tags":["sponge-01-ts","honeypot","sensor:sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["42340_2-4-8-1-3_1320_13"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":1935626081},"totDataBytes":0} +{"@timestamp":1787979565462,"_id":"260829-qrmF7eSRPHlD46E8nsILVruK","_index":"arkime_sessions3-260829","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Aeza International LTD"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Aeza International LTD"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":0,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":0,"port":8080},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[81131],"firstPacket":1787979241033,"ipProtocol":6,"lastPacket":1787979242037,"length":1004,"network":{"bytes":148,"community_id":"1:2zl1aTzDtuEgFScLLAoWR6fKS2Q=","packets":2},"node":"spark-afae","packetPos":[-81131,1230132,1682],"packetRange":{"gte":1787979241033,"lte":1787979242037},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS210644 Aeza Group LLC","number":210644,"organization":{"name":"Aeza Group LLC"}},"bytes":148,"geo":{"country_iso_code":"AT"},"ip":"147.45.71.214","mac":["fc:bd:67:9d:2b:2b"],"mac-cnt":1,"packets":2,"port":41610},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcRIR":"ARIN","srcTTL":[55],"srcTTLCnt":1,"tags":["sensor:contabo-sponge-01-ts","honeypot","contabo-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["42340_2-4-8-1-3_1320_13"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":2089066181},"totDataBytes":0} +{"@timestamp":1787979565462,"_id":"260829-qrn6pCTV4_FGdKRUcC1L78Dy","_index":"arkime_sessions3-260829","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Aeza International LTD"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Aeza International LTD"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":0,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":0,"port":8080},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[81131],"firstPacket":1787979239033,"ipProtocol":6,"lastPacket":1787979240053,"length":1020,"network":{"bytes":148,"community_id":"1:VfxB6ddklOV8D2Q0YPDi1teh/4U=","packets":2},"node":"spark-afae","packetPos":[-81131,1228284,962],"packetRange":{"gte":1787979239033,"lte":1787979240053},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS210644 Aeza Group LLC","number":210644,"organization":{"name":"Aeza Group LLC"}},"bytes":148,"geo":{"country_iso_code":"AT"},"ip":"147.45.71.214","mac":["fc:bd:67:9d:2b:2b"],"mac-cnt":1,"packets":2,"port":41604},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcRIR":"ARIN","srcTTL":[55],"srcTTLCnt":1,"tags":["sensor:contabo-sponge-01-ts","honeypot","contabo-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["42340_2-4-8-1-3_1320_13"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":252850851},"totDataBytes":0} +{"@timestamp":1787979263595,"_id":"260829-cSTXOXZMYr9NZaglnUx3-VC9","_index":"arkime_sessions3-260829","client":{"bytes":135},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["Aeza International LTD"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["Aeza International LTD"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":429,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":5,"port":8282},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstPayload8":"485454502f312e31","dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[81130],"firstPacket":1787978336859,"http":{"bodyMagic":["text/plain"],"bodyMagicCnt":1,"responseHeader":["connection","content-type"],"responseHeaderCnt":2,"responseHeaderField":["content-type","connection"],"responseHeaderValue":["text/plain; charset=utf-8","close"],"responseHeaderValueCnt":2,"serverVersion":["1.1"],"serverVersionCnt":1,"statuscode":[400],"statuscodeCnt":1},"initRTT":71,"ipProtocol":6,"lastPacket":1787978337152,"length":293,"network":{"bytes":902,"community_id":"1:kiCxLaX9V90cvC8maASZKoCunFo=","packets":10},"node":"spark-afae","packetPos":[-81130,8272224,90,6546,82,210,82,185,1536,246,89],"packetRange":{"gte":1787978336859,"lte":1787978337152},"protocol":["tls","http","tcp"],"protocolCnt":3,"rootId":"260829-cSTXOXZMYr9NZaglnUx3-VC9","segmentCnt":1,"server":{"bytes":103},"source":{"as":{"full":"AS210644 Aeza Group LLC","number":210644,"organization":{"name":"Aeza Group LLC"}},"bytes":473,"geo":{"country_iso_code":"AT"},"ip":"147.45.71.214","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":5,"port":39138},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcPayload8":"160301007b010000","srcRIR":"ARIN","srcTTL":[51],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["32088612477998"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["ac32bdeb-b49d-4079-9e6b-8fbca5e0addf"],"signatureCnt":1,"signatureId":[1031336],"signatureIdCnt":1},"tag":{"block":["false"],"blockCnt":1,"category":["protocol"],"categoryCnt":1,"description":["ip addresses with this tag have been observed attempting to opportunistically crawl the internet and establish tls/ssl connections."],"intention":["unknown"],"intentionCnt":1,"name":["tls/ssl crawler"],"nameCnt":1},"tags":["frantech-ts","sensor:frantech-ts","honeypot"],"tagsCnt":3,"tcp":{"ja4l":"71172_51_tcp","ja4ls":"25_64_127","ja4t":["42340_2-4-8-1-3_1320_13"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":3,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":1,"psh":3,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":136089276},"tls":{"ja3":["cba7f34191ef2379c1325641f6c6c4f4"],"ja3Cnt":1,"ja3string":["771,49199-49195-49169-49159-49171-49161-49172-49162-5-47-53-49170-10,5-10-11-13-65281,23-24-25,0"],"ja3stringCnt":1,"ja4":["t12i130500_2d7513195f68_e51b7354d87f"],"ja4Cnt":1,"ja4_r":["t12i130500_0005,000a,002f,0035,c007,c009,c00a,c011,c012,c013,c014,c02b,c02f_0005,000a,000b,000d,ff01_0401,0403,0201,0203,0401,0501,0601"],"ja4_rCnt":1},"totDataBytes":238} +{"@timestamp":1787979263580,"_id":"260829-cSS3bb26z3pB65XnWlNXx_SS","_index":"arkime_sessions3-260829","client":{"bytes":239},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["Aeza International LTD"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["Aeza International LTD"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":625,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":5,"port":8282},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstPayload8":"485454502f312e31","dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[81130],"firstPacket":1787978336545,"http":{"bodyMagic":["text/html"],"bodyMagicCnt":1,"clientVersion":["1.1"],"clientVersionCnt":1,"host":["209.141.62.110:8282","209.141.62.110"],"hostCnt":2,"ja4h":["ge11nn050000_57c5e92682a8_000000000000_000000000000"],"ja4hCnt":1,"ja4h_r":["ge11nn050000_Host,User-Agent,Accept-Charset,Accept-Encoding,Connection__"],"ja4h_rCnt":1,"md5":["0f87454a3ea15f0db55ae928dbcd82fc"],"md5Cnt":1,"method":["GET"],"method-GET":1,"methodCnt":1,"path":["/favicon.ico"],"pathCnt":1,"requestHeader":["accept-encoding","connection","accept-charset","user-agent","host"],"requestHeaderCnt":5,"requestHeaderField":["accept-charset","accept-encoding","connection"],"requestHeaderValue":["utf-8","gzip","close"],"requestHeaderValueCnt":3,"response-server":["Apache/2.4.41 (Ubuntu)"],"response-serverCnt":1,"response-x-powered-by":["PHP/7.4.3"],"response-x-powered-byCnt":1,"responseHeader":["content-length","connection","content-type","date","server","x-powered-by"],"responseHeaderCnt":6,"responseHeaderField":["connection","content-type","date","content-length"],"responseHeaderValue":["close","text/plain; charset=utf-8","sat, 29 aug 2026 04:38:56 gmt","94"],"responseHeaderValueCnt":4,"serverVersion":["1.1"],"serverVersionCnt":1,"sha256":["1ca624415b2889dbeb3f969890b848b7bc5eaf96ca5e8fdd7461f943b45d10cb"],"sha256Cnt":1,"statuscode":[200],"statuscodeCnt":1,"uri":["209.141.62.110:8282/favicon.ico"],"uriCnt":1,"useragent":["Mozilla/5.0 (CentOS; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36"],"useragentCnt":1},"initRTT":72,"ipProtocol":6,"lastPacket":1787978336860,"length":315,"network":{"bytes":1202,"community_id":"1:p+QuUE3w5BGyy2ds/1LbZlGPpEw=","packets":10},"node":"spark-afae","packetPos":[-81130,8268610,90,600,152,321,82,369,1848,332,82],"packetRange":{"gte":1787978336545,"lte":1787978336860},"protocol":["http","tcp"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":287},"source":{"as":{"full":"AS210644 Aeza Group LLC","number":210644,"organization":{"name":"Aeza Group LLC"}},"bytes":577,"geo":{"country_iso_code":"AT"},"ip":"147.45.71.214","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":5,"port":39136},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcPayload8":"474554202f666176","srcRIR":"ARIN","srcTTL":[51],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["89710223611259"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["f63d9281-086b-4182-9002-663ffb13d931","869feaa1-dc77-4037-aee2-247b7a39cf7d","ee583a2e-d308-4c53-b8e2-a1cd45cd1bb7","ce8622a8-6d2f-4fe3-ab81-0cc86e19363e"],"signatureCnt":4,"signatureId":[2000166,2000009,1031486,2000008],"signatureIdCnt":4},"tag":{"block":["false","true"],"blockCnt":2,"category":["recon","attack","protocol"],"categoryCnt":3,"cves":[""],"cvesCnt":1,"description":["cloud credential scanning probe detected. requests for sensitive configuration files and credentials indicate automated scanning for exposed secrets and api keys.","generic favicon request detection. requests for /favicon.ico are commonly issued by web crawlers and browsers during normal browsing, but can also indicate automated scanning activity.","generic web crawler traffic detected. the simple pattern of get requests without specific exploitation indicators suggests automated crawling activity, possibly for search indexing or vulnerability scanning.","ip addresses with this tag have been seen crawling http(s) servers around the internet."],"intention":["unknown","suspicious"],"intentionCnt":2,"name":["root path scanner","web crawler","favicon crawler"],"nameCnt":3},"tags":["frantech-ts","sensor:frantech-ts","honeypot"],"tagsCnt":3,"tcp":{"ja4ls":"22_64_tcp","ja4t":["42340_2-4-8-1-3_1320_13"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":4,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":2,"psh":2,"rst":0,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":2848402240},"totDataBytes":526} +{"@timestamp":1787979263610,"_id":"260829-cSRLtJtqGP5CFLhUcuMX7YIn","_index":"arkime_sessions3-260829","client":{"bytes":135},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["Aeza International LTD"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["Aeza International LTD"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":429,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":5,"port":8282},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstPayload8":"485454502f312e31","dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[81130],"firstPacket":1787978336258,"http":{"bodyMagic":["text/plain"],"bodyMagicCnt":1,"responseHeader":["connection","content-type"],"responseHeaderCnt":2,"responseHeaderField":["content-type","connection"],"responseHeaderValue":["text/plain; charset=utf-8","close"],"responseHeaderValueCnt":2,"serverVersion":["1.1"],"serverVersionCnt":1,"statuscode":[400],"statuscodeCnt":1},"initRTT":71,"ipProtocol":6,"lastPacket":1787978336543,"length":285,"network":{"bytes":902,"community_id":"1:3ercAXinTJU2jFoq/lLhLcaDh1o=","packets":10},"node":"spark-afae","packetPos":[-81130,8266852,90,786,82,210,82,185,82,0,89],"packetRange":{"gte":1787978336258,"lte":1787978336543},"protocol":["tls","http","tcp"],"protocolCnt":3,"segmentCnt":1,"server":{"bytes":103},"source":{"as":{"full":"AS210644 Aeza Group LLC","number":210644,"organization":{"name":"Aeza Group LLC"}},"bytes":473,"geo":{"country_iso_code":"AT"},"ip":"147.45.71.214","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":5,"port":39130},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcPayload8":"160301007b010000","srcRIR":"ARIN","srcTTL":[51],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["264036190766110"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["ac32bdeb-b49d-4079-9e6b-8fbca5e0addf"],"signatureCnt":1,"signatureId":[1031336],"signatureIdCnt":1},"tag":{"block":["false"],"blockCnt":1,"category":["protocol"],"categoryCnt":1,"description":["ip addresses with this tag have been observed attempting to opportunistically crawl the internet and establish tls/ssl connections."],"intention":["unknown"],"intentionCnt":1,"name":["tls/ssl crawler"],"nameCnt":1},"tags":["frantech-ts","sensor:frantech-ts","honeypot"],"tagsCnt":3,"tcp":{"ja4l":"71260_51_tcp","ja4ls":"24_64_170","ja4t":["42340_2-4-8-1-3_1320_13"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":3,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":1,"psh":3,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":785169277},"tls":{"ja3":["cba7f34191ef2379c1325641f6c6c4f4"],"ja3Cnt":1,"ja3string":["771,49199-49195-49169-49159-49171-49161-49172-49162-5-47-53-49170-10,5-10-11-13-65281,23-24-25,0"],"ja3stringCnt":1,"ja4":["t12i130500_2d7513195f68_e51b7354d87f"],"ja4Cnt":1,"ja4_r":["t12i130500_0005,000a,002f,0035,c007,c009,c00a,c011,c012,c013,c014,c02b,c02f_0005,000a,000b,000d,ff01_0401,0403,0201,0203,0401,0501,0601"],"ja4_rCnt":1},"totDataBytes":238} +{"@timestamp":1787979263565,"_id":"260829-cST1sGDzoRtESYhfvobYC4yJ","_index":"arkime_sessions3-260829","client":{"bytes":228},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["Aeza International LTD"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["Aeza International LTD"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":625,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":5,"port":8282},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstPayload8":"485454502f312e31","dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[81130],"firstPacket":1787978335937,"http":{"bodyMagic":["text/html"],"bodyMagicCnt":1,"clientVersion":["1.1"],"clientVersionCnt":1,"host":["209.141.62.110:8282","209.141.62.110"],"hostCnt":2,"ja4h":["ge11nn050000_57c5e92682a8_000000000000_000000000000"],"ja4hCnt":1,"ja4h_r":["ge11nn050000_Host,User-Agent,Accept-Charset,Accept-Encoding,Connection__"],"ja4h_rCnt":1,"md5":["0f87454a3ea15f0db55ae928dbcd82fc"],"md5Cnt":1,"method":["GET"],"method-GET":1,"methodCnt":1,"path":["/"],"pathCnt":1,"requestHeader":["accept-encoding","connection","accept-charset","user-agent","host"],"requestHeaderCnt":5,"requestHeaderField":["accept-charset","accept-encoding","connection"],"requestHeaderValue":["utf-8","gzip","close"],"requestHeaderValueCnt":3,"response-server":["Apache/2.4.41 (Ubuntu)"],"response-serverCnt":1,"response-x-powered-by":["PHP/7.4.3"],"response-x-powered-byCnt":1,"responseHeader":["content-length","connection","content-type","date","server","x-powered-by"],"responseHeaderCnt":6,"responseHeaderField":["connection","content-type","date","content-length"],"responseHeaderValue":["close","text/plain; charset=utf-8","sat, 29 aug 2026 04:38:56 gmt","94"],"responseHeaderValueCnt":4,"serverVersion":["1.1"],"serverVersionCnt":1,"sha256":["1ca624415b2889dbeb3f969890b848b7bc5eaf96ca5e8fdd7461f943b45d10cb"],"sha256Cnt":1,"statuscode":[200],"statuscodeCnt":1,"uri":["209.141.62.110:8282/"],"uriCnt":1,"useragent":["Mozilla/5.0 (CentOS; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36"],"useragentCnt":1},"initRTT":72,"ipProtocol":6,"lastPacket":1787978336256,"length":319,"network":{"bytes":1191,"community_id":"1:HOgJU+xj1PprHMwLAXTy8hy57ZI=","packets":10},"node":"spark-afae","packetPos":[-81130,8260269,90,1794,940,310,82,369,2752,82,0],"packetRange":{"gte":1787978335937,"lte":1787978336256},"protocol":["http","tcp"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":287},"source":{"as":{"full":"AS210644 Aeza Group LLC","number":210644,"organization":{"name":"Aeza Group LLC"}},"bytes":566,"geo":{"country_iso_code":"AT"},"ip":"147.45.71.214","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":5,"port":39116},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcPayload8":"474554202f204854","srcRIR":"ARIN","srcTTL":[51],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["2057751460676937"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["869feaa1-dc77-4037-aee2-247b7a39cf7d","ee583a2e-d308-4c53-b8e2-a1cd45cd1bb7","ce8622a8-6d2f-4fe3-ab81-0cc86e19363e"],"signatureCnt":3,"signatureId":[2000166,1031486,2000008],"signatureIdCnt":3},"tag":{"block":["false","true"],"blockCnt":2,"category":["recon","attack","protocol"],"categoryCnt":3,"cves":[""],"cvesCnt":1,"description":["cloud credential scanning probe detected. requests for sensitive configuration files and credentials indicate automated scanning for exposed secrets and api keys.","generic web crawler traffic detected. the simple pattern of get requests without specific exploitation indicators suggests automated crawling activity, possibly for search indexing or vulnerability scanning.","ip addresses with this tag have been seen crawling http(s) servers around the internet."],"intention":["unknown","suspicious"],"intentionCnt":2,"name":["root path scanner","web crawler"],"nameCnt":2},"tags":["frantech-ts","sensor:frantech-ts","honeypot"],"tagsCnt":3,"tcp":{"ja4ls":"15_64_tcp","ja4t":["42340_2-4-8-1-3_1320_13"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":4,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":2,"psh":2,"rst":0,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":2095950953},"totDataBytes":515} +{"@timestamp":1787979263610,"_id":"260829-cSRzOPJrcGRPIKTib8CUGKWQ","_index":"arkime_sessions3-260829","client":{"bytes":135},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["Aeza International LTD"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["Aeza International LTD"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":429,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":5,"port":8282},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstPayload8":"485454502f312e31","dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[81130],"firstPacket":1787978335531,"http":{"bodyMagic":["text/plain"],"bodyMagicCnt":1,"responseHeader":["connection","content-type"],"responseHeaderCnt":2,"responseHeaderField":["content-type","connection"],"responseHeaderValue":["text/plain; charset=utf-8","close"],"responseHeaderValueCnt":2,"serverVersion":["1.1"],"serverVersionCnt":1,"statuscode":[400],"statuscodeCnt":1},"initRTT":71,"ipProtocol":6,"lastPacket":1787978335937,"length":406,"network":{"bytes":902,"community_id":"1:iB5F0Xx2/DQjkQtKo//OXu1tpG4=","packets":10},"node":"spark-afae","packetPos":[-81130,8241742,90,11231,4140,210,82,185,2348,82,89],"packetRange":{"gte":1787978335531,"lte":1787978335937},"protocol":["tls","http","tcp"],"protocolCnt":3,"segmentCnt":1,"server":{"bytes":103},"source":{"as":{"full":"AS210644 Aeza Group LLC","number":210644,"organization":{"name":"Aeza Group LLC"}},"bytes":473,"geo":{"country_iso_code":"AT"},"ip":"147.45.71.214","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":5,"port":39114},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcPayload8":"160301007b010000","srcRIR":"ARIN","srcTTL":[51],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["2001076178067247"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["ac32bdeb-b49d-4079-9e6b-8fbca5e0addf"],"signatureCnt":1,"signatureId":[1031336],"signatureIdCnt":1},"tag":{"block":["false"],"blockCnt":1,"category":["protocol"],"categoryCnt":1,"description":["ip addresses with this tag have been observed attempting to opportunistically crawl the internet and establish tls/ssl connections."],"intention":["unknown"],"intentionCnt":1,"name":["tls/ssl crawler"],"nameCnt":1},"tags":["frantech-ts","sensor:frantech-ts","honeypot"],"tagsCnt":3,"tcp":{"ja4l":"71247_51_tcp","ja4ls":"20_64_106","ja4t":["42340_2-4-8-1-3_1320_13"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":3,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":1,"psh":3,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":2194083733},"tls":{"ja3":["cba7f34191ef2379c1325641f6c6c4f4"],"ja3Cnt":1,"ja3string":["771,49199-49195-49169-49159-49171-49161-49172-49162-5-47-53-49170-10,5-10-11-13-65281,23-24-25,0"],"ja3stringCnt":1,"ja4":["t12i130500_2d7513195f68_e51b7354d87f"],"ja4Cnt":1,"ja4_r":["t12i130500_0005,000a,002f,0035,c007,c009,c00a,c011,c012,c013,c014,c02b,c02f_0005,000a,000b,000d,ff01_0401,0403,0201,0203,0401,0501,0601"],"ja4_rCnt":1},"totDataBytes":238} +{"@timestamp":1787979263565,"_id":"260829-cSSRVpmXazFNEbFiq9dCvWmv","_index":"arkime_sessions3-260829","client":{"bytes":211},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["Aeza International LTD"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["Aeza International LTD"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":625,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":5,"port":8282},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstPayload8":"485454502f312e31","dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[81130],"firstPacket":1787978267096,"http":{"bodyMagic":["text/html"],"bodyMagicCnt":1,"clientVersion":["1.1"],"clientVersionCnt":1,"host":["209.141.62.110:8282","209.141.62.110"],"hostCnt":2,"ja4h":["ge11nn040000_e1d2031bdfea_000000000000_000000000000"],"ja4hCnt":1,"ja4h_r":["ge11nn040000_Host,User-Agent,Accept,Accept-Encoding__"],"ja4h_rCnt":1,"md5":["0f87454a3ea15f0db55ae928dbcd82fc"],"md5Cnt":1,"method":["GET"],"method-GET":1,"methodCnt":1,"path":["/"],"pathCnt":1,"requestHeader":["accept-encoding","user-agent","host","accept"],"requestHeaderCnt":4,"requestHeaderField":["accept","accept-encoding"],"requestHeaderValue":["*/*","gzip"],"requestHeaderValueCnt":2,"response-server":["Apache/2.4.41 (Ubuntu)"],"response-serverCnt":1,"response-x-powered-by":["PHP/7.4.3"],"response-x-powered-byCnt":1,"responseHeader":["content-length","connection","content-type","date","server","x-powered-by"],"responseHeaderCnt":6,"responseHeaderField":["connection","content-type","date","content-length"],"responseHeaderValue":["close","text/plain; charset=utf-8","sat, 29 aug 2026 04:37:47 gmt","94"],"responseHeaderValueCnt":4,"serverVersion":["1.1"],"serverVersionCnt":1,"sha256":["1ca624415b2889dbeb3f969890b848b7bc5eaf96ca5e8fdd7461f943b45d10cb"],"sha256Cnt":1,"statuscode":[200],"statuscodeCnt":1,"uri":["209.141.62.110:8282/"],"uriCnt":1,"useragent":["Mozilla/5.0 (Macintosh; Intel Mac OS X 15_7_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.0 Safari/605.1.15"],"useragentCnt":1},"initRTT":70,"ipProtocol":6,"lastPacket":1787978267379,"length":283,"network":{"bytes":1174,"community_id":"1:umwYdyigufck9PteMGkwHYAxN9Q=","packets":10},"node":"spark-afae","packetPos":[-81130,6262678,90,172,82,293,82,369,82,0,0],"packetRange":{"gte":1787978267096,"lte":1787978267379},"protocol":["http","tcp"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":287},"source":{"as":{"full":"AS210644 Aeza Group LLC","number":210644,"organization":{"name":"Aeza Group LLC"}},"bytes":549,"geo":{"country_iso_code":"AT"},"ip":"147.45.71.214","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":5,"port":53906},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcPayload8":"474554202f204854","srcRIR":"ARIN","srcTTL":[51],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["976400909590354"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["869feaa1-dc77-4037-aee2-247b7a39cf7d","ee583a2e-d308-4c53-b8e2-a1cd45cd1bb7","ce8622a8-6d2f-4fe3-ab81-0cc86e19363e"],"signatureCnt":3,"signatureId":[2000166,1031486,2000008],"signatureIdCnt":3},"tag":{"block":["false","true"],"blockCnt":2,"category":["recon","attack","protocol"],"categoryCnt":3,"cves":[""],"cvesCnt":1,"description":["cloud credential scanning probe detected. requests for sensitive configuration files and credentials indicate automated scanning for exposed secrets and api keys.","generic web crawler traffic detected. the simple pattern of get requests without specific exploitation indicators suggests automated crawling activity, possibly for search indexing or vulnerability scanning.","ip addresses with this tag have been seen crawling http(s) servers around the internet."],"intention":["unknown","suspicious"],"intentionCnt":2,"name":["root path scanner","web crawler"],"nameCnt":2},"tags":["frantech-ts","sensor:frantech-ts","honeypot"],"tagsCnt":3,"tcp":{"ja4ls":"41_64_tcp","ja4t":["42340_2-4-8-1-3_1320_13"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":4,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":2,"psh":2,"rst":0,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":1758606928},"totDataBytes":498} +{"@timestamp":1787966894479,"_id":"260829-riL3cDy3_VVHhZYSw0P685qB","_index":"arkime_sessions3-260829","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Kaopu Cloud HK Limited"],"isp.dstCnt":1,"isp.src":["Aeza International LTD"],"isp.srcCnt":1,"org.dst":["LightNode-BH"],"org.dstCnt":1,"org.src":["Aeza International LTD"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":0,"geo":{"country_iso_code":"BH"},"ip":"38.54.2.209","mac":["52:54:8f:9d:76:48"],"mac-cnt":1,"packets":0,"port":8989},"dstRIR":"ARIN","ethertype":2048,"fileId":[81046],"firstPacket":1787965850894,"ipProtocol":6,"lastPacket":1787965851897,"length":1003,"network":{"bytes":148,"community_id":"1:H0XRM9TJDWUto9NvZ8EaQzn5aDY=","packets":2},"node":"spark-afae","packetPos":[-81046,20920,90],"packetRange":{"gte":1787965850894,"lte":1787965851897},"protocol":["tcp"],"protocolCnt":1,"rootId":"260829-riL3cDy3_VVHhZYSw0P685qB","segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS210644 Aeza Group LLC","number":210644,"organization":{"name":"Aeza Group LLC"}},"bytes":148,"geo":{"country_iso_code":"AT"},"ip":"147.45.71.214","mac":["98:44:ce:60:15:19"],"mac-cnt":1,"packets":2,"port":50520},"spoofable":["true"],"spoofableCnt":1,"srcDscp":[8],"srcDscpCnt":1,"srcOui":["Huawei Technologies Co.,Ltd"],"srcOuiCnt":1,"srcRIR":"ARIN","srcTTL":[54],"srcTTLCnt":1,"tags":["bahrain-sponge-01-ts","honeypot","sensor:bahrain-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["42340_2-4-8-1-3_1320_13"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":3225210541},"totDataBytes":0} +{"@timestamp":1787966894479,"_id":"260829-riKeCPlR7nlOQLpdXG9QMRnA","_index":"arkime_sessions3-260829","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Kaopu Cloud HK Limited"],"isp.dstCnt":1,"isp.src":["Aeza International LTD"],"isp.srcCnt":1,"org.dst":["LightNode-BH"],"org.dstCnt":1,"org.src":["Aeza International LTD"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":0,"geo":{"country_iso_code":"BH"},"ip":"38.54.2.209","mac":["52:54:8f:9d:76:48"],"mac-cnt":1,"packets":0,"port":8989},"dstRIR":"ARIN","ethertype":2048,"fileId":[81046],"firstPacket":1787965848916,"ipProtocol":6,"lastPacket":1787965849936,"length":1020,"network":{"bytes":148,"community_id":"1:Jjf+7vJoVNjqbLMeJ0wM7Nz5AYw=","packets":2},"node":"spark-afae","packetPos":[-81046,20740,90],"packetRange":{"gte":1787965848916,"lte":1787965849936},"protocol":["tcp"],"protocolCnt":1,"rootId":"260829-riKeCPlR7nlOQLpdXG9QMRnA","segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS210644 Aeza Group LLC","number":210644,"organization":{"name":"Aeza Group LLC"}},"bytes":148,"geo":{"country_iso_code":"AT"},"ip":"147.45.71.214","mac":["98:44:ce:60:15:19"],"mac-cnt":1,"packets":2,"port":50504},"spoofable":["true"],"spoofableCnt":1,"srcDscp":[8],"srcDscpCnt":1,"srcOui":["Huawei Technologies Co.,Ltd"],"srcOuiCnt":1,"srcRIR":"ARIN","srcTTL":[54],"srcTTLCnt":1,"tags":["bahrain-sponge-01-ts","honeypot","sensor:bahrain-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["42340_2-4-8-1-3_1320_13"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":1877473896},"totDataBytes":0} +{"@timestamp":1787966894586,"_id":"260829-QbjP1ZYevENBUK5fGA_0k2DH","_index":"arkime_sessions3-260829","client":{"bytes":135},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["Aeza International LTD"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["Aeza International LTD"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":429,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":5,"port":8085},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstPayload8":"485454502f312e31","dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[81047],"firstPacket":1787965699853,"http":{"bodyMagic":["text/plain"],"bodyMagicCnt":1,"responseHeader":["content-type","connection"],"responseHeaderCnt":2,"responseHeaderField":["content-type","connection"],"responseHeaderValue":["text/plain; charset=utf-8","close"],"responseHeaderValueCnt":2,"serverVersion":["1.1"],"serverVersionCnt":1,"statuscode":[400],"statuscodeCnt":1},"initRTT":71,"ipProtocol":6,"lastPacket":1787965700142,"length":289,"network":{"bytes":902,"community_id":"1:kovvRQfA8YucB1USaikfEDyAYZI=","packets":10},"node":"spark-afae","packetPos":[-81047,390445,90,1044,82,210,82,185,82,0,89],"packetRange":{"gte":1787965699853,"lte":1787965700142},"protocol":["http","tls","tcp"],"protocolCnt":3,"rootId":"260829-QbjP1ZYevENBUK5fGA_0k2DH","segmentCnt":1,"server":{"bytes":103},"source":{"as":{"full":"AS210644 Aeza Group LLC","number":210644,"organization":{"name":"Aeza Group LLC"}},"bytes":473,"geo":{"country_iso_code":"AT"},"ip":"147.45.71.214","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":5,"port":53714},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcPayload8":"160301007b010000","srcRIR":"ARIN","srcTTL":[51],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["851342421051377"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["ac32bdeb-b49d-4079-9e6b-8fbca5e0addf"],"signatureCnt":1,"signatureId":[1031336],"signatureIdCnt":1},"tag":{"block":["false"],"blockCnt":1,"category":["protocol"],"categoryCnt":1,"description":["ip addresses with this tag have been observed attempting to opportunistically crawl the internet and establish tls/ssl connections."],"intention":["unknown"],"intentionCnt":1,"name":["tls/ssl crawler"],"nameCnt":1},"tags":["honeypot","frantech-ts","sensor:frantech-ts"],"tagsCnt":3,"tcp":{"ja4l":"71649_51_tcp","ja4ls":"24_64_63","ja4t":["42340_2-4-8-1-3_1320_13"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":3,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":1,"psh":3,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":3302045940},"tls":{"ja3":["cba7f34191ef2379c1325641f6c6c4f4"],"ja3Cnt":1,"ja3string":["771,49199-49195-49169-49159-49171-49161-49172-49162-5-47-53-49170-10,5-10-11-13-65281,23-24-25,0"],"ja3stringCnt":1,"ja4":["t12i130500_2d7513195f68_e51b7354d87f"],"ja4Cnt":1,"ja4_r":["t12i130500_0005,000a,002f,0035,c007,c009,c00a,c011,c012,c013,c014,c02b,c02f_0005,000a,000b,000d,ff01_0401,0403,0201,0203,0401,0501,0601"],"ja4_rCnt":1},"totDataBytes":238} +{"@timestamp":1787966894557,"_id":"260829-QbibHO8PwjVCfrSQGvGaQMJn","_index":"arkime_sessions3-260829","client":{"bytes":254},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["Aeza International LTD"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["Aeza International LTD"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":625,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":5,"port":8085},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstPayload8":"485454502f312e31","dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[81047],"firstPacket":1787965699559,"http":{"bodyMagic":["text/html"],"bodyMagicCnt":1,"clientVersion":["1.1"],"clientVersionCnt":1,"host":["209.141.62.110","209.141.62.110:8085"],"hostCnt":2,"ja4h":["ge11nn050000_57c5e92682a8_000000000000_000000000000"],"ja4hCnt":1,"ja4h_r":["ge11nn050000_Host,User-Agent,Accept-Charset,Accept-Encoding,Connection__"],"ja4h_rCnt":1,"md5":["0f87454a3ea15f0db55ae928dbcd82fc"],"md5Cnt":1,"method":["GET"],"method-GET":1,"methodCnt":1,"path":["/favicon.ico"],"pathCnt":1,"requestHeader":["accept-encoding","host","connection","accept-charset","user-agent"],"requestHeaderCnt":5,"requestHeaderField":["accept-charset","accept-encoding","connection"],"requestHeaderValue":["utf-8","gzip","close"],"requestHeaderValueCnt":3,"response-server":["Apache/2.4.41 (Ubuntu)"],"response-serverCnt":1,"response-x-powered-by":["PHP/7.4.3"],"response-x-powered-byCnt":1,"responseHeader":["content-type","date","x-powered-by","connection","content-length","server"],"responseHeaderCnt":6,"responseHeaderField":["connection","content-type","date","content-length"],"responseHeaderValue":["close","text/plain; charset=utf-8","sat, 29 aug 2026 01:08:19 gmt","94"],"responseHeaderValueCnt":4,"serverVersion":["1.1"],"serverVersionCnt":1,"sha256":["1ca624415b2889dbeb3f969890b848b7bc5eaf96ca5e8fdd7461f943b45d10cb"],"sha256Cnt":1,"statuscode":[200],"statuscodeCnt":1,"uri":["209.141.62.110:8085/favicon.ico"],"uriCnt":1,"useragent":["Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Safari/605.7.24"],"useragentCnt":1},"initRTT":70,"ipProtocol":6,"lastPacket":1787965699852,"length":293,"network":{"bytes":1217,"community_id":"1:kbWvO5pfB6I8/oR+arC5XLmYMPk=","packets":10},"node":"spark-afae","packetPos":[-81047,386986,90,1236,82,336,82,369,1018,82,0],"packetRange":{"gte":1787965699559,"lte":1787965699852},"protocol":["http","tcp"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":287},"source":{"as":{"full":"AS210644 Aeza Group LLC","number":210644,"organization":{"name":"Aeza Group LLC"}},"bytes":592,"geo":{"country_iso_code":"AT"},"ip":"147.45.71.214","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":5,"port":53708},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcPayload8":"474554202f666176","srcRIR":"ARIN","srcTTL":[51],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["995815163088959"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["f63d9281-086b-4182-9002-663ffb13d931","869feaa1-dc77-4037-aee2-247b7a39cf7d","ee583a2e-d308-4c53-b8e2-a1cd45cd1bb7","ce8622a8-6d2f-4fe3-ab81-0cc86e19363e"],"signatureCnt":4,"signatureId":[2000166,2000009,1031486,2000008],"signatureIdCnt":4},"tag":{"block":["true","false"],"blockCnt":2,"category":["attack","protocol","recon"],"categoryCnt":3,"cves":[""],"cvesCnt":1,"description":["generic web crawler traffic detected. the simple pattern of get requests without specific exploitation indicators suggests automated crawling activity, possibly for search indexing or vulnerability scanning.","cloud credential scanning probe detected. requests for sensitive configuration files and credentials indicate automated scanning for exposed secrets and api keys.","generic favicon request detection. requests for /favicon.ico are commonly issued by web crawlers and browsers during normal browsing, but can also indicate automated scanning activity.","ip addresses with this tag have been seen crawling http(s) servers around the internet."],"intention":["suspicious","unknown"],"intentionCnt":2,"name":["root path scanner","favicon crawler","web crawler"],"nameCnt":3},"tags":["honeypot","frantech-ts","sensor:frantech-ts"],"tagsCnt":3,"tcp":{"ja4ls":"24_64_tcp","ja4t":["42340_2-4-8-1-3_1320_13"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":4,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":2,"psh":2,"rst":0,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":4176389842},"totDataBytes":541} +{"@timestamp":1787966894608,"_id":"260829-QbhfgMdYWbJOgIngeTyVzbAb","_index":"arkime_sessions3-260829","client":{"bytes":135},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["Aeza International LTD"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["Aeza International LTD"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":429,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":5,"port":8085},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstPayload8":"485454502f312e31","dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[81047],"firstPacket":1787965699266,"http":{"bodyMagic":["text/plain"],"bodyMagicCnt":1,"responseHeader":["content-type","connection"],"responseHeaderCnt":2,"responseHeaderField":["content-type","connection"],"responseHeaderValue":["text/plain; charset=utf-8","close"],"responseHeaderValueCnt":2,"serverVersion":["1.1"],"serverVersionCnt":1,"statuscode":[400],"statuscodeCnt":1},"initRTT":71,"ipProtocol":6,"lastPacket":1787965699557,"length":291,"network":{"bytes":902,"community_id":"1:h9U5qPsj3fzajrsd48I2Lnctxdo=","packets":10},"node":"spark-afae","packetPos":[-81047,385714,90,300,82,210,82,185,82,0,89],"packetRange":{"gte":1787965699266,"lte":1787965699557},"protocol":["http","tls","tcp"],"protocolCnt":3,"segmentCnt":1,"server":{"bytes":103},"source":{"as":{"full":"AS210644 Aeza Group LLC","number":210644,"organization":{"name":"Aeza Group LLC"}},"bytes":473,"geo":{"country_iso_code":"AT"},"ip":"147.45.71.214","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":5,"port":53694},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcPayload8":"160301007b010000","srcRIR":"ARIN","srcTTL":[51],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["861940700523628"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["ac32bdeb-b49d-4079-9e6b-8fbca5e0addf"],"signatureCnt":1,"signatureId":[1031336],"signatureIdCnt":1},"tag":{"block":["false"],"blockCnt":1,"category":["protocol"],"categoryCnt":1,"description":["ip addresses with this tag have been observed attempting to opportunistically crawl the internet and establish tls/ssl connections."],"intention":["unknown"],"intentionCnt":1,"name":["tls/ssl crawler"],"nameCnt":1},"tags":["honeypot","frantech-ts","sensor:frantech-ts"],"tagsCnt":3,"tcp":{"ja4l":"71149_51_tcp","ja4ls":"22_64_87","ja4t":["42340_2-4-8-1-3_1320_13"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":3,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":1,"psh":3,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":3993212616},"tls":{"ja3":["cba7f34191ef2379c1325641f6c6c4f4"],"ja3Cnt":1,"ja3string":["771,49199-49195-49169-49159-49171-49161-49172-49162-5-47-53-49170-10,5-10-11-13-65281,23-24-25,0"],"ja3stringCnt":1,"ja4":["t12i130500_2d7513195f68_e51b7354d87f"],"ja4Cnt":1,"ja4_r":["t12i130500_0005,000a,002f,0035,c007,c009,c00a,c011,c012,c013,c014,c02b,c02f_0005,000a,000b,000d,ff01_0401,0403,0201,0203,0401,0501,0601"],"ja4_rCnt":1},"totDataBytes":238} +{"@timestamp":1787966894551,"_id":"260829-Qbi41rBdfCpIo4_i3zekgvvq","_index":"arkime_sessions3-260829","client":{"bytes":243},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["Aeza International LTD"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["Aeza International LTD"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":625,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":5,"port":8085},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstPayload8":"485454502f312e31","dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[81047],"firstPacket":1787965698940,"http":{"bodyMagic":["text/html"],"bodyMagicCnt":1,"clientVersion":["1.1"],"clientVersionCnt":1,"host":["209.141.62.110","209.141.62.110:8085"],"hostCnt":2,"ja4h":["ge11nn050000_57c5e92682a8_000000000000_000000000000"],"ja4hCnt":1,"ja4h_r":["ge11nn050000_Host,User-Agent,Accept-Charset,Accept-Encoding,Connection__"],"ja4h_rCnt":1,"md5":["0f87454a3ea15f0db55ae928dbcd82fc"],"md5Cnt":1,"method":["GET"],"method-GET":1,"methodCnt":1,"path":["/"],"pathCnt":1,"requestHeader":["accept-encoding","host","connection","accept-charset","user-agent"],"requestHeaderCnt":5,"requestHeaderField":["accept-charset","accept-encoding","connection"],"requestHeaderValue":["utf-8","gzip","close"],"requestHeaderValueCnt":3,"response-server":["Apache/2.4.41 (Ubuntu)"],"response-serverCnt":1,"response-x-powered-by":["PHP/7.4.3"],"response-x-powered-byCnt":1,"responseHeader":["content-type","date","x-powered-by","connection","content-length","server"],"responseHeaderCnt":6,"responseHeaderField":["connection","content-type","date","content-length"],"responseHeaderValue":["close","text/plain; charset=utf-8","sat, 29 aug 2026 01:08:19 gmt","94"],"responseHeaderValueCnt":4,"serverVersion":["1.1"],"serverVersionCnt":1,"sha256":["1ca624415b2889dbeb3f969890b848b7bc5eaf96ca5e8fdd7461f943b45d10cb"],"sha256Cnt":1,"statuscode":[200],"statuscodeCnt":1,"uri":["209.141.62.110:8085/"],"uriCnt":1,"useragent":["Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Safari/605.7.24"],"useragentCnt":1},"initRTT":71,"ipProtocol":6,"lastPacket":1787965699266,"length":326,"network":{"bytes":1206,"community_id":"1:Hlpx+/Vc3GYaoWkeoRhKtLBoRUk=","packets":10},"node":"spark-afae","packetPos":[-81047,377832,90,2122,164,325,82,369,2722,1844,82],"packetRange":{"gte":1787965698940,"lte":1787965699266},"protocol":["http","tcp"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":287},"source":{"as":{"full":"AS210644 Aeza Group LLC","number":210644,"organization":{"name":"Aeza Group LLC"}},"bytes":581,"geo":{"country_iso_code":"AT"},"ip":"147.45.71.214","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":5,"port":53684},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcPayload8":"474554202f204854","srcRIR":"ARIN","srcTTL":[51],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["659922695354663"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["869feaa1-dc77-4037-aee2-247b7a39cf7d","ee583a2e-d308-4c53-b8e2-a1cd45cd1bb7","ce8622a8-6d2f-4fe3-ab81-0cc86e19363e"],"signatureCnt":3,"signatureId":[2000166,1031486,2000008],"signatureIdCnt":3},"tag":{"block":["true","false"],"blockCnt":2,"category":["attack","protocol","recon"],"categoryCnt":3,"cves":[""],"cvesCnt":1,"description":["generic web crawler traffic detected. the simple pattern of get requests without specific exploitation indicators suggests automated crawling activity, possibly for search indexing or vulnerability scanning.","cloud credential scanning probe detected. requests for sensitive configuration files and credentials indicate automated scanning for exposed secrets and api keys.","ip addresses with this tag have been seen crawling http(s) servers around the internet."],"intention":["suspicious","unknown"],"intentionCnt":2,"name":["root path scanner","web crawler"],"nameCnt":2},"tags":["honeypot","frantech-ts","sensor:frantech-ts"],"tagsCnt":3,"tcp":{"ja4ls":"13_64_tcp","ja4t":["42340_2-4-8-1-3_1320_13"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":4,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":2,"psh":2,"rst":0,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":234219942},"totDataBytes":530} +{"@timestamp":1787966894608,"_id":"260829-QbiWNs4W8eNJEY69Q8gf0eXp","_index":"arkime_sessions3-260829","client":{"bytes":135},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["Aeza International LTD"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["Aeza International LTD"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":429,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":5,"port":8085},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstPayload8":"485454502f312e31","dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[81047],"firstPacket":1787965698614,"http":{"bodyMagic":["text/plain"],"bodyMagicCnt":1,"responseHeader":["content-type","connection"],"responseHeaderCnt":2,"responseHeaderField":["content-type","connection"],"responseHeaderValue":["text/plain; charset=utf-8","close"],"responseHeaderValueCnt":2,"serverVersion":["1.1"],"serverVersionCnt":1,"statuscode":[400],"statuscodeCnt":1},"initRTT":71,"ipProtocol":6,"lastPacket":1787965698939,"length":325,"network":{"bytes":902,"community_id":"1:EVerslJWtuc+1rZsgviG/fFN/nk=","packets":10},"node":"spark-afae","packetPos":[-81047,371924,90,3048,152,210,82,185,1002,980,89],"packetRange":{"gte":1787965698614,"lte":1787965698939},"protocol":["http","tls","tcp"],"protocolCnt":3,"segmentCnt":1,"server":{"bytes":103},"source":{"as":{"full":"AS210644 Aeza Group LLC","number":210644,"organization":{"name":"Aeza Group LLC"}},"bytes":473,"geo":{"country_iso_code":"AT"},"ip":"147.45.71.214","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":5,"port":53680},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcPayload8":"160301007b010000","srcRIR":"ARIN","srcTTL":[51],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["667303906405465"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["ac32bdeb-b49d-4079-9e6b-8fbca5e0addf"],"signatureCnt":1,"signatureId":[1031336],"signatureIdCnt":1},"tag":{"block":["false"],"blockCnt":1,"category":["protocol"],"categoryCnt":1,"description":["ip addresses with this tag have been observed attempting to opportunistically crawl the internet and establish tls/ssl connections."],"intention":["unknown"],"intentionCnt":1,"name":["tls/ssl crawler"],"nameCnt":1},"tags":["honeypot","frantech-ts","sensor:frantech-ts"],"tagsCnt":3,"tcp":{"ja4l":"71658_51_tcp","ja4ls":"19_64_106","ja4t":["42340_2-4-8-1-3_1320_13"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":3,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":1,"psh":3,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":3802924506},"tls":{"ja3":["cba7f34191ef2379c1325641f6c6c4f4"],"ja3Cnt":1,"ja3string":["771,49199-49195-49169-49159-49171-49161-49172-49162-5-47-53-49170-10,5-10-11-13-65281,23-24-25,0"],"ja3stringCnt":1,"ja4":["t12i130500_2d7513195f68_e51b7354d87f"],"ja4Cnt":1,"ja4_r":["t12i130500_0005,000a,002f,0035,c007,c009,c00a,c011,c012,c013,c014,c02b,c02f_0005,000a,000b,000d,ff01_0401,0403,0201,0203,0401,0501,0601"],"ja4_rCnt":1},"totDataBytes":238} +{"@timestamp":1787966894550,"_id":"260829-QbiV7v4mMA5PCpiewFSyNMIF","_index":"arkime_sessions3-260829","client":{"bytes":211},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["Aeza International LTD"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["Aeza International LTD"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":625,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":5,"port":8085},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstPayload8":"485454502f312e31","dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[81047],"firstPacket":1787965656581,"http":{"bodyMagic":["text/html"],"bodyMagicCnt":1,"clientVersion":["1.1"],"clientVersionCnt":1,"host":["209.141.62.110","209.141.62.110:8085"],"hostCnt":2,"ja4h":["ge11nn040000_e1d2031bdfea_000000000000_000000000000"],"ja4hCnt":1,"ja4h_r":["ge11nn040000_Host,User-Agent,Accept,Accept-Encoding__"],"ja4h_rCnt":1,"md5":["0f87454a3ea15f0db55ae928dbcd82fc"],"md5Cnt":1,"method":["GET"],"method-GET":1,"methodCnt":1,"path":["/"],"pathCnt":1,"requestHeader":["accept-encoding","host","user-agent","accept"],"requestHeaderCnt":4,"requestHeaderField":["accept","accept-encoding"],"requestHeaderValue":["*/*","gzip"],"requestHeaderValueCnt":2,"response-server":["Apache/2.4.41 (Ubuntu)"],"response-serverCnt":1,"response-x-powered-by":["PHP/7.4.3"],"response-x-powered-byCnt":1,"responseHeader":["content-type","date","x-powered-by","connection","content-length","server"],"responseHeaderCnt":6,"responseHeaderField":["connection","content-type","date","content-length"],"responseHeaderValue":["close","text/plain; charset=utf-8","sat, 29 aug 2026 01:07:36 gmt","94"],"responseHeaderValueCnt":4,"serverVersion":["1.1"],"serverVersionCnt":1,"sha256":["1ca624415b2889dbeb3f969890b848b7bc5eaf96ca5e8fdd7461f943b45d10cb"],"sha256Cnt":1,"statuscode":[200],"statuscodeCnt":1,"uri":["209.141.62.110:8085/"],"uriCnt":1,"useragent":["Mozilla/5.0 (Macintosh; Intel Mac OS X 15_7_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.0 Safari/605.1.15"],"useragentCnt":1},"initRTT":71,"ipProtocol":6,"lastPacket":1787965656866,"length":285,"network":{"bytes":1174,"community_id":"1:D0qdPSnv/60hRCQcm63VWRRIiWg=","packets":10},"node":"spark-afae","packetPos":[-81047,235232,90,158,82,293,82,369,82,0,0],"packetRange":{"gte":1787965656581,"lte":1787965656866},"protocol":["http","tcp"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":287},"source":{"as":{"full":"AS210644 Aeza Group LLC","number":210644,"organization":{"name":"Aeza Group LLC"}},"bytes":549,"geo":{"country_iso_code":"AT"},"ip":"147.45.71.214","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":5,"port":35332},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcPayload8":"474554202f204854","srcRIR":"ARIN","srcTTL":[51],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["243706120450829"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["869feaa1-dc77-4037-aee2-247b7a39cf7d","ee583a2e-d308-4c53-b8e2-a1cd45cd1bb7","ce8622a8-6d2f-4fe3-ab81-0cc86e19363e"],"signatureCnt":3,"signatureId":[2000166,1031486,2000008],"signatureIdCnt":3},"tag":{"block":["true","false"],"blockCnt":2,"category":["attack","protocol","recon"],"categoryCnt":3,"cves":[""],"cvesCnt":1,"description":["generic web crawler traffic detected. the simple pattern of get requests without specific exploitation indicators suggests automated crawling activity, possibly for search indexing or vulnerability scanning.","cloud credential scanning probe detected. requests for sensitive configuration files and credentials indicate automated scanning for exposed secrets and api keys.","ip addresses with this tag have been seen crawling http(s) servers around the internet."],"intention":["suspicious","unknown"],"intentionCnt":2,"name":["root path scanner","web crawler"],"nameCnt":2},"tags":["honeypot","frantech-ts","sensor:frantech-ts"],"tagsCnt":3,"tcp":{"ja4ls":"49_64_tcp","ja4t":["42340_2-4-8-1-3_1320_13"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":4,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":2,"psh":2,"rst":0,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":1226285677},"totDataBytes":498} +{"@timestamp":1787963872674,"_id":"260829-jgnbzS8yv7ZK865VgrRIv6p8","_index":"arkime_sessions3-260829","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Hetzner Online GmbH"],"isp.dstCnt":1,"isp.src":["Aeza International LTD"],"isp.srcCnt":1,"org.dst":["HETZNER-DC"],"org.dstCnt":1,"org.src":["Aeza International LTD"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS24940 Hetzner Online GmbH","number":24940,"organization":{"name":"Hetzner Online GmbH"}},"bytes":0,"geo":{"country_iso_code":"FI"},"ip":"89.167.72.144","mac":["92:00:07:4c:82:70"],"mac-cnt":1,"packets":0,"port":8999},"dstRIR":"RIPE","ethertype":2048,"fileId":[81025],"firstPacket":1787963083997,"ipProtocol":6,"lastPacket":1787963085020,"length":1023,"network":{"bytes":148,"community_id":"1:zMrmpyxmpDCeXMGmXHhR8ieCzAM=","packets":2},"node":"spark-afae","packetPos":[-81025,156751,90],"packetRange":{"gte":1787963083997,"lte":1787963085020},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS210644 Aeza Group LLC","number":210644,"organization":{"name":"Aeza Group LLC"}},"bytes":148,"geo":{"country_iso_code":"AT"},"ip":"147.45.71.214","mac":["d2:74:7f:6e:37:e3"],"mac-cnt":1,"packets":2,"port":56798},"spoofable":["true"],"spoofableCnt":1,"srcRIR":"ARIN","srcTTL":[54],"srcTTLCnt":1,"tags":["sponge-01-ts","honeypot","sensor:sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["42340_2-4-8-1-3_1320_13"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":2014963968},"totDataBytes":0} +{"@timestamp":1787963872674,"_id":"260829-jgnYGDL30ulI-YlPa4xqgYJZ","_index":"arkime_sessions3-260829","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Hetzner Online GmbH"],"isp.dstCnt":1,"isp.src":["Aeza International LTD"],"isp.srcCnt":1,"org.dst":["HETZNER-DC"],"org.dstCnt":1,"org.src":["Aeza International LTD"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS24940 Hetzner Online GmbH","number":24940,"organization":{"name":"Hetzner Online GmbH"}},"bytes":0,"geo":{"country_iso_code":"FI"},"ip":"89.167.72.144","mac":["92:00:07:4c:82:70"],"mac-cnt":1,"packets":0,"port":8999},"dstRIR":"RIPE","ethertype":2048,"fileId":[81025],"firstPacket":1787963081996,"ipProtocol":6,"lastPacket":1787963083004,"length":1008,"network":{"bytes":148,"community_id":"1:B6O1kw/1xZjvGFNgs4D2nW8WTGw=","packets":2},"node":"spark-afae","packetPos":[-81025,156497,164],"packetRange":{"gte":1787963081996,"lte":1787963083004},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS210644 Aeza Group LLC","number":210644,"organization":{"name":"Aeza Group LLC"}},"bytes":148,"geo":{"country_iso_code":"AT"},"ip":"147.45.71.214","mac":["d2:74:7f:6e:37:e3"],"mac-cnt":1,"packets":2,"port":56788},"spoofable":["true"],"spoofableCnt":1,"srcRIR":"ARIN","srcTTL":[54],"srcTTLCnt":1,"tags":["sponge-01-ts","honeypot","sensor:sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["42340_2-4-8-1-3_1320_13"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":312170498},"totDataBytes":0} +{"@timestamp":1787960243637,"_id":"260828-m7c1NVLy_jxBIbyGJK9KiEwM","_index":"arkime_sessions3-260828","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Hetzner Online GmbH"],"isp.dstCnt":1,"isp.src":["Aeza International LTD"],"isp.srcCnt":1,"org.dst":["HETZNER-DC"],"org.dstCnt":1,"org.src":["Aeza International LTD"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS24940 Hetzner Online GmbH","number":24940,"organization":{"name":"Hetzner Online GmbH"}},"bytes":0,"geo":{"country_iso_code":"FI"},"ip":"89.167.72.144","mac":["92:00:07:4c:82:70"],"mac-cnt":1,"packets":0,"port":8090},"dstRIR":"RIPE","ethertype":2048,"fileId":[81002],"firstPacket":1787959291351,"ipProtocol":6,"lastPacket":1787959292379,"length":1028,"network":{"bytes":148,"community_id":"1:bg9TsW31ap9Q/H8UmtHnax4ZMEY=","packets":2},"node":"spark-afae","packetPos":[-81002,107968,90],"packetRange":{"gte":1787959291351,"lte":1787959292379},"protocol":["tcp"],"protocolCnt":1,"rootId":"260828-m7c1NVLy_jxBIbyGJK9KiEwM","segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS210644 Aeza Group LLC","number":210644,"organization":{"name":"Aeza Group LLC"}},"bytes":148,"geo":{"country_iso_code":"AT"},"ip":"147.45.71.214","mac":["d2:74:7f:6e:37:e3"],"mac-cnt":1,"packets":2,"port":35284},"spoofable":["true"],"spoofableCnt":1,"srcRIR":"ARIN","srcTTL":[54],"srcTTLCnt":1,"tags":["sensor:sponge-01-ts","sponge-01-ts","honeypot"],"tagsCnt":3,"tcp":{"ja4t":["42340_2-4-8-1-3_1320_13"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":1677705326},"totDataBytes":0} +{"@timestamp":1787960243637,"_id":"260828-m7ebyUyA7dFNf4RMaGFxZ2y2","_index":"arkime_sessions3-260828","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Hetzner Online GmbH"],"isp.dstCnt":1,"isp.src":["Aeza International LTD"],"isp.srcCnt":1,"org.dst":["HETZNER-DC"],"org.dstCnt":1,"org.src":["Aeza International LTD"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS24940 Hetzner Online GmbH","number":24940,"organization":{"name":"Hetzner Online GmbH"}},"bytes":0,"geo":{"country_iso_code":"FI"},"ip":"89.167.72.144","mac":["92:00:07:4c:82:70"],"mac-cnt":1,"packets":0,"port":8090},"dstRIR":"RIPE","ethertype":2048,"fileId":[81002],"firstPacket":1787959289351,"ipProtocol":6,"lastPacket":1787959290363,"length":1012,"network":{"bytes":148,"community_id":"1:7GjogiBPbXLsc14Rp3PTEoY3jlY=","packets":2},"node":"spark-afae","packetPos":[-81002,107788,90],"packetRange":{"gte":1787959289351,"lte":1787959290363},"protocol":["tcp"],"protocolCnt":1,"rootId":"260828-m7ebyUyA7dFNf4RMaGFxZ2y2","segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS210644 Aeza Group LLC","number":210644,"organization":{"name":"Aeza Group LLC"}},"bytes":148,"geo":{"country_iso_code":"AT"},"ip":"147.45.71.214","mac":["d2:74:7f:6e:37:e3"],"mac-cnt":1,"packets":2,"port":35276},"spoofable":["true"],"spoofableCnt":1,"srcRIR":"ARIN","srcTTL":[54],"srcTTLCnt":1,"tags":["sensor:sponge-01-ts","sponge-01-ts","honeypot"],"tagsCnt":3,"tcp":{"ja4t":["42340_2-4-8-1-3_1320_13"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":2250061751},"totDataBytes":0} +{"@timestamp":1787954795399,"_id":"260828-DyGql_S6gsFNM5J2Z5u1DgOC","_index":"arkime_sessions3-260828","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["netcup GmbH"],"isp.dstCnt":1,"isp.src":["Aeza International LTD"],"isp.srcCnt":1,"org.dst":["Netcup KVM"],"org.dstCnt":1,"org.src":["Aeza International LTD"],"org.srcCnt":1,"usertype.dst":["business"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS197540 netcup GmbH","number":197540,"organization":{"name":"netcup GmbH"}},"bytes":0,"geo":{"country_iso_code":"DE"},"ip":"159.195.21.150","mac":["8a:41:d3:b8:0d:d3"],"mac-cnt":1,"packets":0,"port":8085},"dstRIR":"ARIN","ethertype":2048,"fileId":[80966],"firstPacket":1787953739088,"ipProtocol":6,"lastPacket":1787953740113,"length":1025,"network":{"bytes":148,"community_id":"1:IApMBbj77BVmjxxWQKCACsjEteI=","packets":2},"node":"spark-afae","packetPos":[-80966,61790,551633],"packetRange":{"gte":1787953739088,"lte":1787953740113},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS210644 Aeza Group LLC","number":210644,"organization":{"name":"Aeza Group LLC"}},"bytes":148,"geo":{"country_iso_code":"AT"},"ip":"147.45.71.214","mac":["bc:0f:fe:38:0b:a3"],"mac-cnt":1,"packets":2,"port":49486},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"ARIN","srcTTL":[53],"srcTTLCnt":1,"tags":["sensor:netcup-ts","netcup-ts","honeypot"],"tagsCnt":3,"tcp":{"ja4t":["42340_2-4-8-1-3_1320_13"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":1720701256},"totDataBytes":0} +{"@timestamp":1787954795399,"_id":"260828-DyGMHmi4aEhFWr_sLvdyj4zO","_index":"arkime_sessions3-260828","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["netcup GmbH"],"isp.dstCnt":1,"isp.src":["Aeza International LTD"],"isp.srcCnt":1,"org.dst":["Netcup KVM"],"org.dstCnt":1,"org.src":["Aeza International LTD"],"org.srcCnt":1,"usertype.dst":["business"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS197540 netcup GmbH","number":197540,"organization":{"name":"netcup GmbH"}},"bytes":0,"geo":{"country_iso_code":"DE"},"ip":"159.195.21.150","mac":["8a:41:d3:b8:0d:d3"],"mac-cnt":1,"packets":0,"port":8085},"dstRIR":"ARIN","ethertype":2048,"fileId":[80966],"firstPacket":1787953737090,"ipProtocol":6,"lastPacket":1787953738100,"length":1010,"network":{"bytes":148,"community_id":"1:FOO5MVZ3hdnbECPW/e0yDoj6WuE=","packets":2},"node":"spark-afae","packetPos":[-80966,45064,13644],"packetRange":{"gte":1787953737090,"lte":1787953738100},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS210644 Aeza Group LLC","number":210644,"organization":{"name":"Aeza Group LLC"}},"bytes":148,"geo":{"country_iso_code":"AT"},"ip":"147.45.71.214","mac":["bc:0f:fe:3d:a3:a7"],"mac-cnt":1,"packets":2,"port":34222},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"ARIN","srcTTL":[53],"srcTTLCnt":1,"tags":["sensor:netcup-ts","netcup-ts","honeypot"],"tagsCnt":3,"tcp":{"ja4t":["42340_2-4-8-1-3_1320_13"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":2301782099},"totDataBytes":0} +{"@timestamp":1787949946101,"_id":"260828-bCA2opEpYMtMTaxC7v76ly10","_index":"arkime_sessions3-260828","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Kaopu Cloud HK Limited"],"isp.dstCnt":1,"isp.src":["Aeza International LTD"],"isp.srcCnt":1,"org.dst":["LightNode-BH"],"org.dstCnt":1,"org.src":["Aeza International LTD"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":0,"geo":{"country_iso_code":"BH"},"ip":"38.54.2.209","mac":["52:54:8f:9d:76:48"],"mac-cnt":1,"packets":0,"port":6363},"dstRIR":"ARIN","ethertype":2048,"fileId":[80935],"firstPacket":1787949166513,"ipProtocol":6,"lastPacket":1787949167545,"length":1032,"network":{"bytes":148,"community_id":"1:iIZ+SrFhlpiX6cfAuJa7zjHr7tI=","packets":2},"node":"spark-afae","packetPos":[-80935,283930,532],"packetRange":{"gte":1787949166513,"lte":1787949167545},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS210644 Aeza Group LLC","number":210644,"organization":{"name":"Aeza Group LLC"}},"bytes":148,"geo":{"country_iso_code":"AT"},"ip":"147.45.71.214","mac":["98:44:ce:60:15:19"],"mac-cnt":1,"packets":2,"port":37246},"spoofable":["true"],"spoofableCnt":1,"srcDscp":[8],"srcDscpCnt":1,"srcOui":["Huawei Technologies Co.,Ltd"],"srcOuiCnt":1,"srcRIR":"ARIN","srcTTL":[54],"srcTTLCnt":1,"tags":["honeypot","bahrain-sponge-01-ts","sensor:bahrain-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["42340_2-4-8-1-3_1320_13"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":3234508539},"totDataBytes":0} +{"@timestamp":1787949946101,"_id":"260828-bCAAXGmaOl1FtIIwwkFjrSs_","_index":"arkime_sessions3-260828","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Kaopu Cloud HK Limited"],"isp.dstCnt":1,"isp.src":["Aeza International LTD"],"isp.srcCnt":1,"org.dst":["LightNode-BH"],"org.dstCnt":1,"org.src":["Aeza International LTD"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":0,"geo":{"country_iso_code":"BH"},"ip":"38.54.2.209","mac":["52:54:8f:9d:76:48"],"mac-cnt":1,"packets":0,"port":6363},"dstRIR":"ARIN","ethertype":2048,"fileId":[80935],"firstPacket":1787949164510,"ipProtocol":6,"lastPacket":1787949165522,"length":1012,"network":{"bytes":148,"community_id":"1:1ad7kkimJ3JlNN22OOueGEG1pIg=","packets":2},"node":"spark-afae","packetPos":[-80935,283090,516],"packetRange":{"gte":1787949164510,"lte":1787949165522},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS210644 Aeza Group LLC","number":210644,"organization":{"name":"Aeza Group LLC"}},"bytes":148,"geo":{"country_iso_code":"AT"},"ip":"147.45.71.214","mac":["98:44:ce:60:15:19"],"mac-cnt":1,"packets":2,"port":37236},"spoofable":["true"],"spoofableCnt":1,"srcDscp":[8],"srcDscpCnt":1,"srcOui":["Huawei Technologies Co.,Ltd"],"srcOuiCnt":1,"srcRIR":"ARIN","srcTTL":[54],"srcTTLCnt":1,"tags":["honeypot","bahrain-sponge-01-ts","sensor:bahrain-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["42340_2-4-8-1-3_1320_13"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":529347749},"totDataBytes":0} +{"@timestamp":1787948442930,"_id":"260828-NSBVjoocT9pAV5ClIo1lw62P","_index":"arkime_sessions3-260828","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["netcup GmbH"],"isp.dstCnt":1,"isp.src":["Aeza International LTD"],"isp.srcCnt":1,"org.dst":["Netcup KVM"],"org.dstCnt":1,"org.src":["Aeza International LTD"],"org.srcCnt":1,"usertype.dst":["business"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS197540 netcup GmbH","number":197540,"organization":{"name":"netcup GmbH"}},"bytes":0,"geo":{"country_iso_code":"DE"},"ip":"159.195.21.150","mac":["8a:41:d3:b8:0d:d3"],"mac-cnt":1,"packets":0,"port":8086},"dstRIR":"ARIN","ethertype":2048,"fileId":[80924],"firstPacket":1787947724664,"ipProtocol":6,"lastPacket":1787947725683,"length":1019,"network":{"bytes":148,"community_id":"1:OpTFkaN8aqCo79OGhDbicCA1PV8=","packets":2},"node":"spark-afae","packetPos":[-80924,1519462,90],"packetRange":{"gte":1787947724664,"lte":1787947725683},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS210644 Aeza Group LLC","number":210644,"organization":{"name":"Aeza Group LLC"}},"bytes":148,"geo":{"country_iso_code":"AT"},"ip":"147.45.71.214","mac":["bc:0f:fe:3d:a3:a7"],"mac-cnt":1,"packets":2,"port":45816},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"ARIN","srcTTL":[53],"srcTTLCnt":1,"tags":["honeypot","netcup-ts","sensor:netcup-ts"],"tagsCnt":3,"tcp":{"ja4t":["42340_2-4-8-1-3_1320_13"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":200817858},"totDataBytes":0} +{"@timestamp":1787948442930,"_id":"260828-NSDoAIHlJVRHtJnFywUyomme","_index":"arkime_sessions3-260828","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["netcup GmbH"],"isp.dstCnt":1,"isp.src":["Aeza International LTD"],"isp.srcCnt":1,"org.dst":["Netcup KVM"],"org.dstCnt":1,"org.src":["Aeza International LTD"],"org.srcCnt":1,"usertype.dst":["business"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS197540 netcup GmbH","number":197540,"organization":{"name":"netcup GmbH"}},"bytes":0,"geo":{"country_iso_code":"DE"},"ip":"159.195.21.150","mac":["8a:41:d3:b8:0d:d3"],"mac-cnt":1,"packets":0,"port":8086},"dstRIR":"ARIN","ethertype":2048,"fileId":[80924],"firstPacket":1787947722661,"ipProtocol":6,"lastPacket":1787947723692,"length":1031,"network":{"bytes":148,"community_id":"1:5JIkWvI5zP+buQUs9pF0Rc58Jqc=","packets":2},"node":"spark-afae","packetPos":[-80924,1519192,90],"packetRange":{"gte":1787947722661,"lte":1787947723692},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS210644 Aeza Group LLC","number":210644,"organization":{"name":"Aeza Group LLC"}},"bytes":148,"geo":{"country_iso_code":"AT"},"ip":"147.45.71.214","mac":["bc:0f:fe:38:0b:a3"],"mac-cnt":1,"packets":2,"port":45806},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"ARIN","srcTTL":[53],"srcTTLCnt":1,"tags":["honeypot","netcup-ts","sensor:netcup-ts"],"tagsCnt":3,"tcp":{"ja4t":["42340_2-4-8-1-3_1320_13"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":1553906581},"totDataBytes":0} +{"@timestamp":1787948441525,"_id":"260828-UrZLo-s2jqhMn6Glpi8aXQKt","_index":"arkime_sessions3-260828","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Hetzner Online GmbH"],"isp.dstCnt":1,"isp.src":["Aeza International LTD"],"isp.srcCnt":1,"org.dst":["HETZNER-DC"],"org.dstCnt":1,"org.src":["Aeza International LTD"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS24940 Hetzner Online GmbH","number":24940,"organization":{"name":"Hetzner Online GmbH"}},"bytes":0,"geo":{"country_iso_code":"FI"},"ip":"89.167.72.144","mac":["92:00:07:4c:82:70"],"mac-cnt":1,"packets":0,"port":8989},"dstRIR":"RIPE","ethertype":2048,"fileId":[80925],"firstPacket":1787947460763,"ipProtocol":6,"lastPacket":1787947461781,"length":1018,"network":{"bytes":148,"community_id":"1:tHJBDOpX1kBHjGAKOBA2wulRF84=","packets":2},"node":"spark-afae","packetPos":[-80925,276770,356],"packetRange":{"gte":1787947460763,"lte":1787947461781},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS210644 Aeza Group LLC","number":210644,"organization":{"name":"Aeza Group LLC"}},"bytes":148,"geo":{"country_iso_code":"AT"},"ip":"147.45.71.214","mac":["d2:74:7f:6e:37:e3"],"mac-cnt":1,"packets":2,"port":45966},"spoofable":["true"],"spoofableCnt":1,"srcRIR":"ARIN","srcTTL":[54],"srcTTLCnt":1,"tags":["sensor:sponge-01-ts","honeypot","sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["42340_2-4-8-1-3_1320_13"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":3284106598},"totDataBytes":0} +{"@timestamp":1787948441525,"_id":"260828-UrY17Q2_0UtO5bmmirRrom2r","_index":"arkime_sessions3-260828","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Hetzner Online GmbH"],"isp.dstCnt":1,"isp.src":["Aeza International LTD"],"isp.srcCnt":1,"org.dst":["HETZNER-DC"],"org.dstCnt":1,"org.src":["Aeza International LTD"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS24940 Hetzner Online GmbH","number":24940,"organization":{"name":"Hetzner Online GmbH"}},"bytes":0,"geo":{"country_iso_code":"FI"},"ip":"89.167.72.144","mac":["92:00:07:4c:82:70"],"mac-cnt":1,"packets":0,"port":8989},"dstRIR":"RIPE","ethertype":2048,"fileId":[80925],"firstPacket":1787947458763,"ipProtocol":6,"lastPacket":1787947459769,"length":1006,"network":{"bytes":148,"community_id":"1:2AlHKj7p7fZ9qo4UMglst2bxFbU=","packets":2},"node":"spark-afae","packetPos":[-80925,275904,686],"packetRange":{"gte":1787947458763,"lte":1787947459769},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS210644 Aeza Group LLC","number":210644,"organization":{"name":"Aeza Group LLC"}},"bytes":148,"geo":{"country_iso_code":"AT"},"ip":"147.45.71.214","mac":["d2:74:7f:6e:37:e3"],"mac-cnt":1,"packets":2,"port":45952},"spoofable":["true"],"spoofableCnt":1,"srcRIR":"ARIN","srcTTL":[54],"srcTTLCnt":1,"tags":["sensor:sponge-01-ts","honeypot","sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["42340_2-4-8-1-3_1320_13"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":834825272},"totDataBytes":0} +{"@timestamp":1787945129248,"_id":"260828-vB9iT-wRkcNHNbaOqjEC1Rdh","_index":"arkime_sessions3-260828","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Kaopu Cloud HK Limited"],"isp.dstCnt":1,"isp.src":["Aeza International LTD"],"isp.srcCnt":1,"org.dst":["LightNode-BH"],"org.dstCnt":1,"org.src":["Aeza International LTD"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":0,"geo":{"country_iso_code":"BH"},"ip":"38.54.2.209","mac":["52:54:8f:9d:76:48"],"mac-cnt":1,"packets":0,"port":8080},"dstRIR":"ARIN","ethertype":2048,"fileId":[80902],"firstPacket":1787944735848,"ipProtocol":6,"lastPacket":1787944736849,"length":1001,"network":{"bytes":148,"community_id":"1:bnL8R3wLacU1gWW6HlXHG7rvtK0=","packets":2},"node":"spark-afae","packetPos":[-80902,306941,508],"packetRange":{"gte":1787944735848,"lte":1787944736849},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS210644 Aeza Group LLC","number":210644,"organization":{"name":"Aeza Group LLC"}},"bytes":148,"geo":{"country_iso_code":"AT"},"ip":"147.45.71.214","mac":["98:44:ce:60:15:19"],"mac-cnt":1,"packets":2,"port":39866},"spoofable":["true"],"spoofableCnt":1,"srcDscp":[8],"srcDscpCnt":1,"srcOui":["Huawei Technologies Co.,Ltd"],"srcOuiCnt":1,"srcRIR":"ARIN","srcTTL":[54],"srcTTLCnt":1,"tags":["bahrain-sponge-01-ts","honeypot","sensor:bahrain-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["42340_2-4-8-1-3_1320_13"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":1471477435},"totDataBytes":0} +{"@timestamp":1787945129248,"_id":"260828-vB_Cc_BKwI5AhrVHb55VCeW1","_index":"arkime_sessions3-260828","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Kaopu Cloud HK Limited"],"isp.dstCnt":1,"isp.src":["Aeza International LTD"],"isp.srcCnt":1,"org.dst":["LightNode-BH"],"org.dstCnt":1,"org.src":["Aeza International LTD"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":0,"geo":{"country_iso_code":"BH"},"ip":"38.54.2.209","mac":["52:54:8f:9d:76:48"],"mac-cnt":1,"packets":0,"port":8080},"dstRIR":"ARIN","ethertype":2048,"fileId":[80902],"firstPacket":1787944733846,"ipProtocol":6,"lastPacket":1787944734866,"length":1020,"network":{"bytes":148,"community_id":"1:X0vCabPb+wGIY395W5urZWLtS4g=","packets":2},"node":"spark-afae","packetPos":[-80902,305913,172],"packetRange":{"gte":1787944733846,"lte":1787944734866},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS210644 Aeza Group LLC","number":210644,"organization":{"name":"Aeza Group LLC"}},"bytes":148,"geo":{"country_iso_code":"AT"},"ip":"147.45.71.214","mac":["98:44:ce:60:15:19"],"mac-cnt":1,"packets":2,"port":39852},"spoofable":["true"],"spoofableCnt":1,"srcDscp":[8],"srcDscpCnt":1,"srcOui":["Huawei Technologies Co.,Ltd"],"srcOuiCnt":1,"srcRIR":"ARIN","srcTTL":[54],"srcTTLCnt":1,"tags":["bahrain-sponge-01-ts","honeypot","sensor:bahrain-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["42340_2-4-8-1-3_1320_13"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":2112627},"totDataBytes":0} +{"@timestamp":1787930283302,"_id":"260828-DTy4RQeNAUtK34vgIV40wF-t","_index":"arkime_sessions3-260828","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["netcup GmbH"],"isp.dstCnt":1,"isp.src":["Aeza International LTD"],"isp.srcCnt":1,"org.dst":["Netcup KVM"],"org.dstCnt":1,"org.src":["Aeza International LTD"],"org.srcCnt":1,"usertype.dst":["business"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS197540 netcup GmbH","number":197540,"organization":{"name":"netcup GmbH"}},"bytes":0,"geo":{"country_iso_code":"DE"},"ip":"159.195.21.150","mac":["8a:41:d3:b8:0d:d3"],"mac-cnt":1,"packets":0,"port":8081},"dstRIR":"ARIN","ethertype":2048,"fileId":[80803],"firstPacket":1787929585890,"ipProtocol":6,"lastPacket":1787929586892,"length":1002,"network":{"bytes":148,"community_id":"1:1fMUUxQhoDQZ0aQJhZJ7UM2rZio=","packets":2},"node":"spark-afae","packetPos":[-80803,607185,90],"packetRange":{"gte":1787929585890,"lte":1787929586892},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS210644 Aeza Group LLC","number":210644,"organization":{"name":"Aeza Group LLC"}},"bytes":148,"geo":{"country_iso_code":"AT"},"ip":"147.45.71.214","mac":["bc:0f:fe:3d:a3:a7"],"mac-cnt":1,"packets":2,"port":37084},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"ARIN","srcTTL":[53],"srcTTLCnt":1,"tags":["sensor:netcup-ts","netcup-ts","honeypot"],"tagsCnt":3,"tcp":{"ja4t":["42340_2-4-8-1-3_1320_13"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":442352958},"totDataBytes":0} +{"@timestamp":1787930283302,"_id":"260828-DTx9uXB-AtNG-rccUeH-VIOI","_index":"arkime_sessions3-260828","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["netcup GmbH"],"isp.dstCnt":1,"isp.src":["Aeza International LTD"],"isp.srcCnt":1,"org.dst":["Netcup KVM"],"org.dstCnt":1,"org.src":["Aeza International LTD"],"org.srcCnt":1,"usertype.dst":["business"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS197540 netcup GmbH","number":197540,"organization":{"name":"netcup GmbH"}},"bytes":0,"geo":{"country_iso_code":"DE"},"ip":"159.195.21.150","mac":["8a:41:d3:b8:0d:d3"],"mac-cnt":1,"packets":0,"port":8081},"dstRIR":"ARIN","ethertype":2048,"fileId":[80803],"firstPacket":1787929583891,"ipProtocol":6,"lastPacket":1787929584915,"length":1024,"network":{"bytes":148,"community_id":"1:EeFG4OYZM7f/Bs+ojnU9JU+n8cI=","packets":2},"node":"spark-afae","packetPos":[-80803,607005,90],"packetRange":{"gte":1787929583891,"lte":1787929584915},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS210644 Aeza Group LLC","number":210644,"organization":{"name":"Aeza Group LLC"}},"bytes":148,"geo":{"country_iso_code":"AT"},"ip":"147.45.71.214","mac":["bc:0f:fe:3d:a3:a7"],"mac-cnt":1,"packets":2,"port":37080},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"ARIN","srcTTL":[53],"srcTTLCnt":1,"tags":["sensor:netcup-ts","netcup-ts","honeypot"],"tagsCnt":3,"tcp":{"ja4t":["42340_2-4-8-1-3_1320_13"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":3767350429},"totDataBytes":0} +{"@timestamp":1787920601771,"_id":"260828-vrMy0N8K4tZH_79MmgcM6qVm","_index":"arkime_sessions3-260828","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Hetzner Online GmbH"],"isp.dstCnt":1,"isp.src":["Aeza International LTD"],"isp.srcCnt":1,"org.dst":["HETZNER-DC"],"org.dstCnt":1,"org.src":["Aeza International LTD"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS24940 Hetzner Online GmbH","number":24940,"organization":{"name":"Hetzner Online GmbH"}},"bytes":0,"geo":{"country_iso_code":"FI"},"ip":"89.167.72.144","mac":["92:00:07:4c:82:70"],"mac-cnt":1,"packets":0,"port":8085},"dstRIR":"RIPE","ethertype":2048,"fileId":[80728],"firstPacket":1787919625061,"ipProtocol":6,"lastPacket":1787919626069,"length":1008,"network":{"bytes":148,"community_id":"1:mB6kobGqIe5ikPHGnkONs7HsL7Y=","packets":2},"node":"spark-afae","packetPos":[-80728,63510,270],"packetRange":{"gte":1787919625061,"lte":1787919626069},"protocol":["tcp"],"protocolCnt":1,"rootId":"260828-vrMy0N8K4tZH_79MmgcM6qVm","segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS210644 Aeza Group LLC","number":210644,"organization":{"name":"Aeza Group LLC"}},"bytes":148,"geo":{"country_iso_code":"AT"},"ip":"147.45.71.214","mac":["d2:74:7f:6e:37:e3"],"mac-cnt":1,"packets":2,"port":40096},"spoofable":["true"],"spoofableCnt":1,"srcRIR":"ARIN","srcTTL":[54],"srcTTLCnt":1,"tags":["sensor:sponge-01-ts","honeypot","sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["42340_2-4-8-1-3_1320_13"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":2876621414},"totDataBytes":0} +{"@timestamp":1787920601771,"_id":"260828-vrOd-rQA3JxEmrObdbWhGnOP","_index":"arkime_sessions3-260828","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Hetzner Online GmbH"],"isp.dstCnt":1,"isp.src":["Aeza International LTD"],"isp.srcCnt":1,"org.dst":["HETZNER-DC"],"org.dstCnt":1,"org.src":["Aeza International LTD"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS24940 Hetzner Online GmbH","number":24940,"organization":{"name":"Hetzner Online GmbH"}},"bytes":0,"geo":{"country_iso_code":"FI"},"ip":"89.167.72.144","mac":["92:00:07:4c:82:70"],"mac-cnt":1,"packets":0,"port":8085},"dstRIR":"RIPE","ethertype":2048,"fileId":[80728],"firstPacket":1787919623061,"ipProtocol":6,"lastPacket":1787919624088,"length":1027,"network":{"bytes":148,"community_id":"1:VTPJhpZ12a9gTuSSb2Lsj8V8vys=","packets":2},"node":"spark-afae","packetPos":[-80728,63170,180],"packetRange":{"gte":1787919623061,"lte":1787919624088},"protocol":["tcp"],"protocolCnt":1,"rootId":"260828-vrOd-rQA3JxEmrObdbWhGnOP","segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS210644 Aeza Group LLC","number":210644,"organization":{"name":"Aeza Group LLC"}},"bytes":148,"geo":{"country_iso_code":"AT"},"ip":"147.45.71.214","mac":["d2:74:7f:6e:37:e3"],"mac-cnt":1,"packets":2,"port":40082},"spoofable":["true"],"spoofableCnt":1,"srcRIR":"ARIN","srcTTL":[54],"srcTTLCnt":1,"tags":["sensor:sponge-01-ts","honeypot","sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["42340_2-4-8-1-3_1320_13"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":1565545882},"totDataBytes":0} +{"@timestamp":1787920296641,"_id":"260828-JByY6hH-BTFEf5MEyEEkoygO","_index":"arkime_sessions3-260828","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Kaopu Cloud HK Limited"],"isp.dstCnt":1,"isp.src":["Aeza International LTD"],"isp.srcCnt":1,"org.dst":["LightNode-BH"],"org.dstCnt":1,"org.src":["Aeza International LTD"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":0,"geo":{"country_iso_code":"BH"},"ip":"38.54.2.209","mac":["52:54:8f:9d:76:48"],"mac-cnt":1,"packets":0,"port":8081},"dstRIR":"ARIN","ethertype":2048,"fileId":[80727],"firstPacket":1787918913560,"ipProtocol":6,"lastPacket":1787918914564,"length":1004,"network":{"bytes":148,"community_id":"1:O6DsdFeEWAP1jDUi/7qoQpYJpaE=","packets":2},"node":"spark-afae","packetPos":[-80727,1371,348],"packetRange":{"gte":1787918913560,"lte":1787918914564},"protocol":["tcp"],"protocolCnt":1,"rootId":"260828-JByY6hH-BTFEf5MEyEEkoygO","segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS210644 Aeza Group LLC","number":210644,"organization":{"name":"Aeza Group LLC"}},"bytes":148,"geo":{"country_iso_code":"AT"},"ip":"147.45.71.214","mac":["98:44:ce:60:15:19"],"mac-cnt":1,"packets":2,"port":54862},"spoofable":["true"],"spoofableCnt":1,"srcDscp":[8],"srcDscpCnt":1,"srcOui":["Huawei Technologies Co.,Ltd"],"srcOuiCnt":1,"srcRIR":"ARIN","srcTTL":[54],"srcTTLCnt":1,"tags":["honeypot","bahrain-sponge-01-ts","sensor:bahrain-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["42340_2-4-8-1-3_1320_13"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":3612283096},"totDataBytes":0} +{"@timestamp":1787920296641,"_id":"260828-JBzkVxKU3YVD-LPEnWqB30zv","_index":"arkime_sessions3-260828","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Kaopu Cloud HK Limited"],"isp.dstCnt":1,"isp.src":["Aeza International LTD"],"isp.srcCnt":1,"org.dst":["LightNode-BH"],"org.dstCnt":1,"org.src":["Aeza International LTD"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":0,"geo":{"country_iso_code":"BH"},"ip":"38.54.2.209","mac":["52:54:8f:9d:76:48"],"mac-cnt":1,"packets":0,"port":8081},"dstRIR":"ARIN","ethertype":2048,"fileId":[80727],"firstPacket":1787918911559,"ipProtocol":6,"lastPacket":1787918912576,"length":1017,"network":{"bytes":148,"community_id":"1:W/AVvCAKv4aytveq7tYS1i97GzM=","packets":2},"node":"spark-afae","packetPos":[-80727,1109,172],"packetRange":{"gte":1787918911559,"lte":1787918912576},"protocol":["tcp"],"protocolCnt":1,"rootId":"260828-JBzkVxKU3YVD-LPEnWqB30zv","segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS210644 Aeza Group LLC","number":210644,"organization":{"name":"Aeza Group LLC"}},"bytes":148,"geo":{"country_iso_code":"AT"},"ip":"147.45.71.214","mac":["98:44:ce:60:15:19"],"mac-cnt":1,"packets":2,"port":54860},"spoofable":["true"],"spoofableCnt":1,"srcDscp":[8],"srcDscpCnt":1,"srcOui":["Huawei Technologies Co.,Ltd"],"srcOuiCnt":1,"srcRIR":"ARIN","srcTTL":[54],"srcTTLCnt":1,"tags":["honeypot","bahrain-sponge-01-ts","sensor:bahrain-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["42340_2-4-8-1-3_1320_13"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":2035744445},"totDataBytes":0} |