diff options
Diffstat (limited to 'kevlar/2026-08-31/sponge/ip-sessions/session_search_20260831T113642_412bf26b.ndjson')
| -rw-r--r-- | kevlar/2026-08-31/sponge/ip-sessions/session_search_20260831T113642_412bf26b.ndjson | 100 |
1 files changed, 100 insertions, 0 deletions
diff --git a/kevlar/2026-08-31/sponge/ip-sessions/session_search_20260831T113642_412bf26b.ndjson b/kevlar/2026-08-31/sponge/ip-sessions/session_search_20260831T113642_412bf26b.ndjson new file mode 100644 index 0000000..e0db603 --- /dev/null +++ b/kevlar/2026-08-31/sponge/ip-sessions/session_search_20260831T113642_412bf26b.ndjson @@ -0,0 +1,100 @@ +{"@timestamp":1788176013243,"_id":"260831-U0YGeVTNYg9ECof_mSgynVjt","_index":"arkime_sessions3-260831","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["netcup GmbH"],"isp.dstCnt":1,"isp.src":["Pfcloud UG"],"isp.srcCnt":1,"org.dst":["Netcup KVM"],"org.dstCnt":1,"org.src":["Intelligence Hosting LLC"],"org.srcCnt":1,"usertype.dst":["business"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS197540 netcup GmbH","number":197540,"organization":{"name":"netcup GmbH"}},"bytes":0,"geo":{"country_iso_code":"DE"},"ip":"159.195.21.150","mac":["8a:41:d3:b8:0d:d3"],"mac-cnt":1,"packets":0,"port":25565},"dstRIR":"ARIN","ethertype":2048,"fileId":[82449],"firstPacket":1788175456838,"ipProtocol":6,"lastPacket":1788175456838,"length":0,"network":{"bytes":56,"community_id":"1:K1eKO0mfdJz4H9oell2FXbkapKg=","packets":1},"node":"spark-afae","packetPos":[-82449,171223],"packetRange":{"gte":1788175456838,"lte":1788175456838},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51396 Pfcloud UG (haftungsbeschrankt)","number":51396,"organization":{"name":"Pfcloud UG (haftungsbeschrankt)"}},"bytes":56,"geo":{"country_iso_code":"NL"},"ip":"204.76.203.7","mac":["bc:0f:fe:38:0b:a3"],"mac-cnt":1,"packets":1,"port":38756},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"ARIN","srcTTL":[248],"srcTTLCnt":1,"tags":["sensor:netcup-ts","netcup-ts","honeypot"],"tagsCnt":3,"tcp":{"ja4t":["65535_00_00_00"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":3801039780},"totDataBytes":0} +{"@timestamp":1788175716280,"_id":"260831-tD8KTUMJguJCDbrcwxiAEtrx","_index":"arkime_sessions3-260831","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Pfcloud UG"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Intelligence Hosting LLC"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":0,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":0,"port":25565},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[82447],"firstPacket":1788174723786,"ipProtocol":6,"lastPacket":1788174723786,"length":0,"network":{"bytes":60,"community_id":"1:2s/FTWbhM9ZuMvy0YR39w15+T1o=","packets":1},"node":"spark-afae","packetPos":[-82447,312313],"packetRange":{"gte":1788174723786,"lte":1788174723786},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51396 Pfcloud UG (haftungsbeschrankt)","number":51396,"organization":{"name":"Pfcloud UG (haftungsbeschrankt)"}},"bytes":60,"geo":{"country_iso_code":"NL"},"ip":"204.76.203.7","mac":["fc:bd:67:9d:2b:2b"],"mac-cnt":1,"packets":1,"port":48594},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcRIR":"ARIN","srcTTL":[244],"srcTTLCnt":1,"tags":["sensor:contabo-sponge-01-ts","honeypot","contabo-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["65535_00_00_00"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":2292216167},"totDataBytes":0} +{"@timestamp":1788174195736,"_id":"260831-t83gB6y2lRFE8LWSIy-YzjPa","_index":"arkime_sessions3-260831","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo GmbH"],"isp.dstCnt":1,"isp.src":["Pfcloud UG"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Intelligence Hosting LLC"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS51167 Contabo GmbH","number":51167,"organization":{"name":"Contabo GmbH"}},"bytes":0,"geo":{"country_iso_code":"FR"},"ip":"109.123.246.142","mac":["00:50:56:63:46:a6"],"mac-cnt":1,"packets":0,"port":26312},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[82438],"firstPacket":1788173699463,"ipProtocol":6,"lastPacket":1788173699463,"length":0,"network":{"bytes":60,"community_id":"1:ptBAoz4goaP6fn2yUQUIOZtB3Po=","packets":1},"node":"spark-afae","packetPos":[-82438,7045857],"packetRange":{"gte":1788173699463,"lte":1788173699463},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51396 Pfcloud UG (haftungsbeschrankt)","number":51396,"organization":{"name":"Pfcloud UG (haftungsbeschrankt)"}},"bytes":60,"geo":{"country_iso_code":"NL"},"ip":"204.76.203.7","mac":["c0:69:11:cd:1f:19"],"mac-cnt":1,"packets":1,"port":44956},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcRIR":"ARIN","srcTTL":[244],"srcTTLCnt":1,"tags":["proxy","sensor:contabo-sponge-02-ts","contabo-sponge-02-ts"],"tagsCnt":3,"tcp":{"ja4t":["65535_00_00_00"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":3555019893},"totDataBytes":0} +{"@timestamp":1788173895701,"_id":"260831-MkZ9pZjZK8VCHbX3_E8SvPm3","_index":"arkime_sessions3-260831","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Hetzner Online GmbH"],"isp.dstCnt":1,"isp.src":["Pfcloud UG"],"isp.srcCnt":1,"org.dst":["HETZNER-DC"],"org.dstCnt":1,"org.src":["Intelligence Hosting LLC"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS24940 Hetzner Online GmbH","number":24940,"organization":{"name":"Hetzner Online GmbH"}},"bytes":0,"geo":{"country_iso_code":"FI"},"ip":"89.167.72.144","mac":["92:00:07:4c:82:70"],"mac-cnt":1,"packets":0,"port":26312},"dstRIR":"RIPE","ethertype":2048,"fileId":[82434],"firstPacket":1788173141762,"ipProtocol":6,"lastPacket":1788173141762,"length":0,"network":{"bytes":54,"community_id":"1:Aga4NvKaIX11W37vehv+w5uKmo8=","packets":1},"node":"spark-afae","packetPos":[-82434,173372],"packetRange":{"gte":1788173141762,"lte":1788173141762},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51396 Pfcloud UG (haftungsbeschrankt)","number":51396,"organization":{"name":"Pfcloud UG (haftungsbeschrankt)"}},"bytes":54,"geo":{"country_iso_code":"NL"},"ip":"204.76.203.7","mac":["d2:74:7f:6e:37:e3"],"mac-cnt":1,"packets":1,"port":48440},"spoofable":["true"],"spoofableCnt":1,"srcRIR":"ARIN","srcTTL":[245],"srcTTLCnt":1,"tags":["sponge-01-ts","sensor:sponge-01-ts","honeypot"],"tagsCnt":3,"tcp":{"ja4t":["65535_00_00_00"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":2579894765},"totDataBytes":0} +{"@timestamp":1788173594044,"_id":"260831-aT_gTIWe9ApCFqRAfJrcxe1y","_index":"arkime_sessions3-260831","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["netcup GmbH"],"isp.dstCnt":1,"isp.src":["Pfcloud UG"],"isp.srcCnt":1,"org.dst":["Netcup KVM"],"org.dstCnt":1,"org.src":["Intelligence Hosting LLC"],"org.srcCnt":1,"usertype.dst":["business"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS197540 netcup GmbH","number":197540,"organization":{"name":"netcup GmbH"}},"bytes":0,"geo":{"country_iso_code":"DE"},"ip":"159.195.21.150","mac":["8a:41:d3:b8:0d:d3"],"mac-cnt":1,"packets":0,"port":26312},"dstRIR":"ARIN","ethertype":2048,"fileId":[82433],"firstPacket":1788173088664,"ipProtocol":6,"lastPacket":1788173088664,"length":0,"network":{"bytes":56,"community_id":"1:9qCh6hPNFLLzM6P6vCUvQnJiauM=","packets":1},"node":"spark-afae","packetPos":[-82433,321486],"packetRange":{"gte":1788173088664,"lte":1788173088664},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51396 Pfcloud UG (haftungsbeschrankt)","number":51396,"organization":{"name":"Pfcloud UG (haftungsbeschrankt)"}},"bytes":56,"geo":{"country_iso_code":"NL"},"ip":"204.76.203.7","mac":["bc:0f:fe:38:0b:a3"],"mac-cnt":1,"packets":1,"port":45337},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"ARIN","srcTTL":[248],"srcTTLCnt":1,"tags":["sensor:netcup-ts","netcup-ts","honeypot"],"tagsCnt":3,"tcp":{"ja4t":["65535_00_00_00"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":870090501},"totDataBytes":0} +{"@timestamp":1788173292912,"_id":"260831-Xj9c45ckoGtBkZzjcQI_DXsk","_index":"arkime_sessions3-260831","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Kaopu Cloud HK Limited"],"isp.dstCnt":1,"isp.src":["Pfcloud UG"],"isp.srcCnt":1,"org.dst":["LightNode-BH"],"org.dstCnt":1,"org.src":["Intelligence Hosting LLC"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":0,"geo":{"country_iso_code":"BH"},"ip":"38.54.2.209","mac":["52:54:8f:9d:76:48"],"mac-cnt":1,"packets":0,"port":26312},"dstRIR":"ARIN","ethertype":2048,"fileId":[82431],"firstPacket":1788172631586,"ipProtocol":6,"lastPacket":1788172631586,"length":0,"network":{"bytes":54,"community_id":"1:i3r5vYvBOR4hL7NkUUVimsWQWyM=","packets":1},"node":"spark-afae","packetPos":[-82431,168111],"packetRange":{"gte":1788172631586,"lte":1788172631586},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51396 Pfcloud UG (haftungsbeschrankt)","number":51396,"organization":{"name":"Pfcloud UG (haftungsbeschrankt)"}},"bytes":54,"geo":{"country_iso_code":"NL"},"ip":"204.76.203.7","mac":["98:44:ce:60:15:19"],"mac-cnt":1,"packets":1,"port":36096},"spoofable":["true"],"spoofableCnt":1,"srcDscp":[18],"srcDscpCnt":1,"srcOui":["Huawei Technologies Co.,Ltd"],"srcOuiCnt":1,"srcRIR":"ARIN","srcTTL":[240],"srcTTLCnt":1,"tags":["bahrain-sponge-01-ts","honeypot","sensor:bahrain-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["65535_00_00_00"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":3844232795},"totDataBytes":0} +{"@timestamp":1788172995850,"_id":"260831-ls0zWfU3fVpBuoQhm6PbxU0U","_index":"arkime_sessions3-260831","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["Pfcloud UG"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["Intelligence Hosting LLC"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":0,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":0,"port":26312},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstRIR":"ARIN","ethertype":2048,"fileId":[82430],"firstPacket":1788172136296,"ipProtocol":6,"lastPacket":1788172136296,"length":0,"network":{"bytes":58,"community_id":"1:86YmlKbh2Ifd7hclPkSmKy7stUA=","packets":1},"node":"spark-afae","packetPos":[-82430,217681332],"packetRange":{"gte":1788172136296,"lte":1788172136296},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51396 Pfcloud UG (haftungsbeschrankt)","number":51396,"organization":{"name":"Pfcloud UG (haftungsbeschrankt)"}},"bytes":58,"geo":{"country_iso_code":"NL"},"ip":"204.76.203.7","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":1,"port":39513},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"ARIN","srcTTL":[240],"srcTTLCnt":1,"tags":["sensor:frantech-ts","honeypot","frantech-ts"],"tagsCnt":3,"tcp":{"ja4t":["65535_2_536_00"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":164081633},"totDataBytes":0} +{"@timestamp":1788172384134,"_id":"260831-Pj9_iWxrIPFGKrDQnIlJonaC","_index":"arkime_sessions3-260831","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Pfcloud UG"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Intelligence Hosting LLC"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":0,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":0,"port":26312},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[82425],"firstPacket":1788171477878,"ipProtocol":6,"lastPacket":1788171477878,"length":0,"network":{"bytes":60,"community_id":"1:xwCH3uQhvvcHnmjY5J1BoFFI9vk=","packets":1},"node":"spark-afae","packetPos":[-82425,754614],"packetRange":{"gte":1788171477878,"lte":1788171477878},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51396 Pfcloud UG (haftungsbeschrankt)","number":51396,"organization":{"name":"Pfcloud UG (haftungsbeschrankt)"}},"bytes":60,"geo":{"country_iso_code":"NL"},"ip":"204.76.203.7","mac":["fc:bd:67:9d:2b:2b"],"mac-cnt":1,"packets":1,"port":45191},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcRIR":"ARIN","srcTTL":[244],"srcTTLCnt":1,"tags":["contabo-sponge-01-ts","sensor:contabo-sponge-01-ts","honeypot"],"tagsCnt":3,"tcp":{"ja4t":["65535_00_00_00"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":3807853290},"totDataBytes":0} +{"@timestamp":1788171180976,"_id":"260831-ET-AushPQadGKLA7_Q03wfLa","_index":"arkime_sessions3-260831","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["Pfcloud UG"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["Intelligence Hosting LLC"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":0,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":0,"port":27202},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstRIR":"ARIN","ethertype":2048,"fileId":[82417],"firstPacket":1788170646784,"ipProtocol":6,"lastPacket":1788170646784,"length":0,"network":{"bytes":58,"community_id":"1:xMMrbPohMuZGAXcfGSbeuY92Oj8=","packets":1},"node":"spark-afae","packetPos":[-82417,171858841],"packetRange":{"gte":1788170646784,"lte":1788170646784},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51396 Pfcloud UG (haftungsbeschrankt)","number":51396,"organization":{"name":"Pfcloud UG (haftungsbeschrankt)"}},"bytes":58,"geo":{"country_iso_code":"NL"},"ip":"204.76.203.7","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":1,"port":41926},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"ARIN","srcTTL":[241],"srcTTLCnt":1,"tags":["sensor:frantech-ts","frantech-ts","honeypot"],"tagsCnt":3,"tcp":{"ja4t":["65535_2_536_00"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":2364798792},"totDataBytes":0} +{"@timestamp":1788170877036,"_id":"260831-Bj_9N3_KnsNFhINFVIrI6wGd","_index":"arkime_sessions3-260831","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["netcup GmbH"],"isp.dstCnt":1,"isp.src":["Pfcloud UG"],"isp.srcCnt":1,"org.dst":["Netcup KVM"],"org.dstCnt":1,"org.src":["Intelligence Hosting LLC"],"org.srcCnt":1,"usertype.dst":["business"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS197540 netcup GmbH","number":197540,"organization":{"name":"netcup GmbH"}},"bytes":0,"geo":{"country_iso_code":"DE"},"ip":"159.195.21.150","mac":["8a:41:d3:b8:0d:d3"],"mac-cnt":1,"packets":0,"port":27202},"dstRIR":"ARIN","ethertype":2048,"fileId":[82415],"firstPacket":1788170369824,"ipProtocol":6,"lastPacket":1788170369824,"length":0,"network":{"bytes":56,"community_id":"1:0Bg/mcxKSl+PfBqpF2R0GUWQNQE=","packets":1},"node":"spark-afae","packetPos":[-82415,1163553],"packetRange":{"gte":1788170369824,"lte":1788170369824},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51396 Pfcloud UG (haftungsbeschrankt)","number":51396,"organization":{"name":"Pfcloud UG (haftungsbeschrankt)"}},"bytes":56,"geo":{"country_iso_code":"NL"},"ip":"204.76.203.7","mac":["bc:0f:fe:38:0b:a3"],"mac-cnt":1,"packets":1,"port":45839},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"ARIN","srcTTL":[248],"srcTTLCnt":1,"tags":["sensor:netcup-ts","netcup-ts","honeypot"],"tagsCnt":3,"tcp":{"ja4t":["65535_00_00_00"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":3233530105},"totDataBytes":0} +{"@timestamp":1788170577652,"_id":"260831-EUYjw1U5LS5GiYlcgMcz6K2w","_index":"arkime_sessions3-260831","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo GmbH"],"isp.dstCnt":1,"isp.src":["Pfcloud UG"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Intelligence Hosting LLC"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS51167 Contabo GmbH","number":51167,"organization":{"name":"Contabo GmbH"}},"bytes":0,"geo":{"country_iso_code":"FR"},"ip":"109.123.246.142","mac":["00:50:56:63:46:a6"],"mac-cnt":1,"packets":0,"port":27202},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[82413],"firstPacket":1788169974816,"ipProtocol":6,"lastPacket":1788169974816,"length":0,"network":{"bytes":60,"community_id":"1:9J6HJM+PaaV4oM4V40oCfs0i+Po=","packets":1},"node":"spark-afae","packetPos":[-82413,2731520],"packetRange":{"gte":1788169974816,"lte":1788169974816},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51396 Pfcloud UG (haftungsbeschrankt)","number":51396,"organization":{"name":"Pfcloud UG (haftungsbeschrankt)"}},"bytes":60,"geo":{"country_iso_code":"NL"},"ip":"204.76.203.7","mac":["c0:69:11:cd:1f:19"],"mac-cnt":1,"packets":1,"port":37388},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcRIR":"ARIN","srcTTL":[243],"srcTTLCnt":1,"tags":["contabo-sponge-02-ts","proxy","sensor:contabo-sponge-02-ts"],"tagsCnt":3,"tcp":{"ja4t":["65535_00_00_00"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":1546808543},"totDataBytes":0} +{"@timestamp":1788170576706,"_id":"260831-U83I7JSWuEBFrJqyimfgB3jt","_index":"arkime_sessions3-260831","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Pfcloud UG"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Intelligence Hosting LLC"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":0,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":0,"port":27202},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[82414],"firstPacket":1788169505171,"ipProtocol":6,"lastPacket":1788169505171,"length":0,"network":{"bytes":60,"community_id":"1:ZC8sv3ZxoTaSFjsxkKZ9idA8NM0=","packets":1},"node":"spark-afae","packetPos":[-82414,417228],"packetRange":{"gte":1788169505171,"lte":1788169505171},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51396 Pfcloud UG (haftungsbeschrankt)","number":51396,"organization":{"name":"Pfcloud UG (haftungsbeschrankt)"}},"bytes":60,"geo":{"country_iso_code":"NL"},"ip":"204.76.203.7","mac":["fc:bd:67:9d:2b:2b"],"mac-cnt":1,"packets":1,"port":59593},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcRIR":"ARIN","srcTTL":[245],"srcTTLCnt":1,"tags":["honeypot","sensor:contabo-sponge-01-ts","contabo-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["65535_00_00_00"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":3514063929},"totDataBytes":0} +{"@timestamp":1788169676732,"_id":"260831-2j4z35Eo_N9AyqXGzxFeE0uN","_index":"arkime_sessions3-260831","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Kaopu Cloud HK Limited"],"isp.dstCnt":1,"isp.src":["Pfcloud UG"],"isp.srcCnt":1,"org.dst":["LightNode-BH"],"org.dstCnt":1,"org.src":["Intelligence Hosting LLC"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":0,"geo":{"country_iso_code":"BH"},"ip":"38.54.2.209","mac":["52:54:8f:9d:76:48"],"mac-cnt":1,"packets":0,"port":27202},"dstRIR":"ARIN","ethertype":2048,"fileId":[82408],"firstPacket":1788169095728,"ipProtocol":6,"lastPacket":1788169095728,"length":0,"network":{"bytes":54,"community_id":"1:BHvl/9lHu3a5/N4aRsmUxEiPagQ=","packets":1},"node":"spark-afae","packetPos":[-82408,128686],"packetRange":{"gte":1788169095728,"lte":1788169095728},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51396 Pfcloud UG (haftungsbeschrankt)","number":51396,"organization":{"name":"Pfcloud UG (haftungsbeschrankt)"}},"bytes":54,"geo":{"country_iso_code":"NL"},"ip":"204.76.203.7","mac":["98:44:ce:60:15:19"],"mac-cnt":1,"packets":1,"port":40762},"spoofable":["true"],"spoofableCnt":1,"srcDscp":[18],"srcDscpCnt":1,"srcOui":["Huawei Technologies Co.,Ltd"],"srcOuiCnt":1,"srcRIR":"ARIN","srcTTL":[240],"srcTTLCnt":1,"tags":["honeypot","sensor:bahrain-sponge-01-ts","bahrain-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["65535_00_00_00"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":927917281},"totDataBytes":0} +{"@timestamp":1788169377269,"_id":"260831-BUYqOCLNl0RP_ZY7QGJgsLEp","_index":"arkime_sessions3-260831","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Hetzner Online GmbH"],"isp.dstCnt":1,"isp.src":["Pfcloud UG"],"isp.srcCnt":1,"org.dst":["HETZNER-DC"],"org.dstCnt":1,"org.src":["Intelligence Hosting LLC"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS24940 Hetzner Online GmbH","number":24940,"organization":{"name":"Hetzner Online GmbH"}},"bytes":0,"geo":{"country_iso_code":"FI"},"ip":"89.167.72.144","mac":["92:00:07:4c:82:70"],"mac-cnt":1,"packets":0,"port":27202},"dstRIR":"RIPE","ethertype":2048,"fileId":[82404],"firstPacket":1788168909574,"ipProtocol":6,"lastPacket":1788168909574,"length":0,"network":{"bytes":54,"community_id":"1:9dwf4tFSTUYC0o+ezs30KjqjSDs=","packets":1},"node":"spark-afae","packetPos":[-82404,301186],"packetRange":{"gte":1788168909574,"lte":1788168909574},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51396 Pfcloud UG (haftungsbeschrankt)","number":51396,"organization":{"name":"Pfcloud UG (haftungsbeschrankt)"}},"bytes":54,"geo":{"country_iso_code":"NL"},"ip":"204.76.203.7","mac":["d2:74:7f:6e:37:e3"],"mac-cnt":1,"packets":1,"port":45884},"spoofable":["true"],"spoofableCnt":1,"srcRIR":"ARIN","srcTTL":[244],"srcTTLCnt":1,"tags":["honeypot","sponge-01-ts","sensor:sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["65535_00_00_00"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":180168500},"totDataBytes":0} +{"@timestamp":1788168169443,"_id":"260831-rj4cgF2r3WFD160TXYTyN85a","_index":"arkime_sessions3-260831","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Kaopu Cloud HK Limited"],"isp.dstCnt":1,"isp.src":["Pfcloud UG"],"isp.srcCnt":1,"org.dst":["LightNode-BH"],"org.dstCnt":1,"org.src":["Intelligence Hosting LLC"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":0,"geo":{"country_iso_code":"BH"},"ip":"38.54.2.209","mac":["52:54:8f:9d:76:48"],"mac-cnt":1,"packets":0,"port":27391},"dstRIR":"ARIN","ethertype":2048,"fileId":[82397],"firstPacket":1788166955989,"ipProtocol":6,"lastPacket":1788166955989,"length":0,"network":{"bytes":54,"community_id":"1:Zu4GNJQarsRbNcp9eproLilrLWg=","packets":1},"node":"spark-afae","packetPos":[-82397,37416],"packetRange":{"gte":1788166955989,"lte":1788166955989},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51396 Pfcloud UG (haftungsbeschrankt)","number":51396,"organization":{"name":"Pfcloud UG (haftungsbeschrankt)"}},"bytes":54,"geo":{"country_iso_code":"NL"},"ip":"204.76.203.7","mac":["98:44:ce:60:15:19"],"mac-cnt":1,"packets":1,"port":57407},"spoofable":["true"],"spoofableCnt":1,"srcDscp":[18],"srcDscpCnt":1,"srcOui":["Huawei Technologies Co.,Ltd"],"srcOuiCnt":1,"srcRIR":"ARIN","srcTTL":[241],"srcTTLCnt":1,"tags":["honeypot","bahrain-sponge-01-ts","sensor:bahrain-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["65535_00_00_00"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":186435688},"totDataBytes":0} +{"@timestamp":1788167868115,"_id":"260831-oz4Qh38QxnFGmJJIYT_Mbljp","_index":"arkime_sessions3-260831","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo GmbH"],"isp.dstCnt":1,"isp.src":["Pfcloud UG"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Intelligence Hosting LLC"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS51167 Contabo GmbH","number":51167,"organization":{"name":"Contabo GmbH"}},"bytes":0,"geo":{"country_iso_code":"FR"},"ip":"109.123.246.142","mac":["00:50:56:63:46:a6"],"mac-cnt":1,"packets":0,"port":27391},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[82396],"firstPacket":1788166727760,"ipProtocol":6,"lastPacket":1788166727760,"length":0,"network":{"bytes":60,"community_id":"1:IT6nXnOCvS+Ny2fDj6WrB41HHjU=","packets":1},"node":"spark-afae","packetPos":[-82396,71286],"packetRange":{"gte":1788166727760,"lte":1788166727760},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51396 Pfcloud UG (haftungsbeschrankt)","number":51396,"organization":{"name":"Pfcloud UG (haftungsbeschrankt)"}},"bytes":60,"geo":{"country_iso_code":"NL"},"ip":"204.76.203.7","mac":["c0:69:11:cd:1f:19"],"mac-cnt":1,"packets":1,"port":59996},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcRIR":"ARIN","srcTTL":[244],"srcTTLCnt":1,"tags":["proxy","sensor:contabo-sponge-02-ts","contabo-sponge-02-ts"],"tagsCnt":3,"tcp":{"ja4t":["65535_00_00_00"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":2596432280},"totDataBytes":0} +{"@timestamp":1788167268554,"_id":"260831-Bs3_yR31eOhG8JZ7gKhyAK7q","_index":"arkime_sessions3-260831","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["netcup GmbH"],"isp.dstCnt":1,"isp.src":["Pfcloud UG"],"isp.srcCnt":1,"org.dst":["Netcup KVM"],"org.dstCnt":1,"org.src":["Intelligence Hosting LLC"],"org.srcCnt":1,"usertype.dst":["business"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS197540 netcup GmbH","number":197540,"organization":{"name":"netcup GmbH"}},"bytes":0,"geo":{"country_iso_code":"DE"},"ip":"159.195.21.150","mac":["8a:41:d3:b8:0d:d3"],"mac-cnt":1,"packets":0,"port":27391},"dstRIR":"ARIN","ethertype":2048,"fileId":[82390],"firstPacket":1788166386297,"ipProtocol":6,"lastPacket":1788166386297,"length":0,"network":{"bytes":56,"community_id":"1:WcBuHJ6gJQj4OIoSDmq8g2M6gsk=","packets":1},"node":"spark-afae","packetPos":[-82390,112841],"packetRange":{"gte":1788166386297,"lte":1788166386297},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51396 Pfcloud UG (haftungsbeschrankt)","number":51396,"organization":{"name":"Pfcloud UG (haftungsbeschrankt)"}},"bytes":56,"geo":{"country_iso_code":"NL"},"ip":"204.76.203.7","mac":["bc:0f:fe:38:0b:a3"],"mac-cnt":1,"packets":1,"port":49302},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"ARIN","srcTTL":[248],"srcTTLCnt":1,"tags":["netcup-ts","sensor:netcup-ts","honeypot"],"tagsCnt":3,"tcp":{"ja4t":["65535_00_00_00"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":451799016},"totDataBytes":0} +{"@timestamp":1788166368883,"_id":"260831-bD6XT76qm1ZPkKwMtPDfEu2A","_index":"arkime_sessions3-260831","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["Pfcloud UG"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["Intelligence Hosting LLC"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":0,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":0,"port":27391},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstRIR":"ARIN","ethertype":2048,"fileId":[82386],"firstPacket":1788165706610,"ipProtocol":6,"lastPacket":1788165706610,"length":0,"network":{"bytes":58,"community_id":"1:EaUZYzQ5XP/tS1dln4j94kh2f3E=","packets":1},"node":"spark-afae","packetPos":[-82386,88514679],"packetRange":{"gte":1788165706610,"lte":1788165706610},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51396 Pfcloud UG (haftungsbeschrankt)","number":51396,"organization":{"name":"Pfcloud UG (haftungsbeschrankt)"}},"bytes":58,"geo":{"country_iso_code":"NL"},"ip":"204.76.203.7","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":1,"port":45487},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"ARIN","srcTTL":[242],"srcTTLCnt":1,"tags":["honeypot","sensor:frantech-ts","frantech-ts"],"tagsCnt":3,"tcp":{"ja4t":["65535_2_536_00"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":3038448671},"totDataBytes":0} +{"@timestamp":1788164866506,"_id":"260831-usyiyY9MZTRE_Kq6TsHsutNA","_index":"arkime_sessions3-260831","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Hetzner Online GmbH"],"isp.dstCnt":1,"isp.src":["Pfcloud UG"],"isp.srcCnt":1,"org.dst":["HETZNER-DC"],"org.dstCnt":1,"org.src":["Intelligence Hosting LLC"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS24940 Hetzner Online GmbH","number":24940,"organization":{"name":"Hetzner Online GmbH"}},"bytes":0,"geo":{"country_iso_code":"FI"},"ip":"89.167.72.144","mac":["92:00:07:4c:82:70"],"mac-cnt":1,"packets":0,"port":27391},"dstRIR":"RIPE","ethertype":2048,"fileId":[82374],"firstPacket":1788164423100,"ipProtocol":6,"lastPacket":1788164423100,"length":0,"network":{"bytes":54,"community_id":"1:PwRB9K75Q4LjPN+jvIjhktZtBqY=","packets":1},"node":"spark-afae","packetPos":[-82374,190210],"packetRange":{"gte":1788164423100,"lte":1788164423100},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51396 Pfcloud UG (haftungsbeschrankt)","number":51396,"organization":{"name":"Pfcloud UG (haftungsbeschrankt)"}},"bytes":54,"geo":{"country_iso_code":"NL"},"ip":"204.76.203.7","mac":["d2:74:7f:6e:37:e3"],"mac-cnt":1,"packets":1,"port":60698},"spoofable":["true"],"spoofableCnt":1,"srcRIR":"ARIN","srcTTL":[245],"srcTTLCnt":1,"tags":["sponge-01-ts","honeypot","sensor:sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["65535_00_00_00"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":1453692158},"totDataBytes":0} +{"@timestamp":1788165167059,"_id":"260831-xcxe8_mUcDRA-b4kOXmWEmBc","_index":"arkime_sessions3-260831","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Pfcloud UG"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Intelligence Hosting LLC"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":0,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":0,"port":27391},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[82378],"firstPacket":1788164376529,"ipProtocol":6,"lastPacket":1788164376529,"length":0,"network":{"bytes":60,"community_id":"1:/ptVIc75xFEMMTvIBJK7FvspEto=","packets":1},"node":"spark-afae","packetPos":[-82378,1144340],"packetRange":{"gte":1788164376529,"lte":1788164376529},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51396 Pfcloud UG (haftungsbeschrankt)","number":51396,"organization":{"name":"Pfcloud UG (haftungsbeschrankt)"}},"bytes":60,"geo":{"country_iso_code":"NL"},"ip":"204.76.203.7","mac":["fc:bd:67:9d:2b:2b"],"mac-cnt":1,"packets":1,"port":57987},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcRIR":"ARIN","srcTTL":[244],"srcTTLCnt":1,"tags":["honeypot","sensor:contabo-sponge-01-ts","contabo-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["65535_00_00_00"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":246221713},"totDataBytes":0} +{"@timestamp":1788164565266,"_id":"260831-LD4g2b7XLHBOuIKz-69lZL_n","_index":"arkime_sessions3-260831","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Kaopu Cloud HK Limited"],"isp.dstCnt":1,"isp.src":["Pfcloud UG"],"isp.srcCnt":1,"org.dst":["LightNode-BH"],"org.dstCnt":1,"org.src":["Intelligence Hosting LLC"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":0,"geo":{"country_iso_code":"BH"},"ip":"38.54.2.209","mac":["52:54:8f:9d:76:48"],"mac-cnt":1,"packets":0,"port":27866},"dstRIR":"ARIN","ethertype":2048,"fileId":[82373],"firstPacket":1788163810736,"ipProtocol":6,"lastPacket":1788163810736,"length":0,"network":{"bytes":54,"community_id":"1:F/gVjJe3B98pxBuSzs+xJovbK+g=","packets":1},"node":"spark-afae","packetPos":[-82373,152659],"packetRange":{"gte":1788163810736,"lte":1788163810736},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51396 Pfcloud UG (haftungsbeschrankt)","number":51396,"organization":{"name":"Pfcloud UG (haftungsbeschrankt)"}},"bytes":54,"geo":{"country_iso_code":"NL"},"ip":"204.76.203.7","mac":["98:44:ce:60:15:19"],"mac-cnt":1,"packets":1,"port":49242},"spoofable":["true"],"spoofableCnt":1,"srcDscp":[18],"srcDscpCnt":1,"srcOui":["Huawei Technologies Co.,Ltd"],"srcOuiCnt":1,"srcRIR":"ARIN","srcTTL":[240],"srcTTLCnt":1,"tags":["sensor:bahrain-sponge-01-ts","bahrain-sponge-01-ts","honeypot"],"tagsCnt":3,"tcp":{"ja4t":["65535_00_00_00"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":834825411},"totDataBytes":0} +{"@timestamp":1788164564732,"_id":"260831-r8yi-03aTcVK6Z8w-HYDoj1E","_index":"arkime_sessions3-260831","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo GmbH"],"isp.dstCnt":1,"isp.src":["Pfcloud UG"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Intelligence Hosting LLC"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS51167 Contabo GmbH","number":51167,"organization":{"name":"Contabo GmbH"}},"bytes":0,"geo":{"country_iso_code":"FR"},"ip":"109.123.246.142","mac":["00:50:56:63:46:a6"],"mac-cnt":1,"packets":0,"port":27866},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[82371],"firstPacket":1788163741124,"ipProtocol":6,"lastPacket":1788163741124,"length":0,"network":{"bytes":60,"community_id":"1:Qhzd0wDYw2LIOcfmbYe368E+Fy4=","packets":1},"node":"spark-afae","packetPos":[-82371,657754],"packetRange":{"gte":1788163741124,"lte":1788163741124},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51396 Pfcloud UG (haftungsbeschrankt)","number":51396,"organization":{"name":"Pfcloud UG (haftungsbeschrankt)"}},"bytes":60,"geo":{"country_iso_code":"NL"},"ip":"204.76.203.7","mac":["c0:69:11:cd:1f:19"],"mac-cnt":1,"packets":1,"port":55883},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcRIR":"ARIN","srcTTL":[244],"srcTTLCnt":1,"tags":["sensor:contabo-sponge-02-ts","contabo-sponge-02-ts","proxy"],"tagsCnt":3,"tcp":{"ja4t":["65535_00_00_00"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":585156629},"totDataBytes":0} +{"@timestamp":1788163664236,"_id":"260831-w0UoaFkXT6FHBJUz4UcAoL2Y","_index":"arkime_sessions3-260831","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["netcup GmbH"],"isp.dstCnt":1,"isp.src":["Pfcloud UG"],"isp.srcCnt":1,"org.dst":["Netcup KVM"],"org.dstCnt":1,"org.src":["Intelligence Hosting LLC"],"org.srcCnt":1,"usertype.dst":["business"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS197540 netcup GmbH","number":197540,"organization":{"name":"netcup GmbH"}},"bytes":0,"geo":{"country_iso_code":"DE"},"ip":"159.195.21.150","mac":["8a:41:d3:b8:0d:d3"],"mac-cnt":1,"packets":0,"port":27866},"dstRIR":"ARIN","ethertype":2048,"fileId":[82366],"firstPacket":1788163009871,"ipProtocol":6,"lastPacket":1788163009871,"length":0,"network":{"bytes":56,"community_id":"1:kh9znHAO2BYaS58FDCxaMSaiYcs=","packets":1},"node":"spark-afae","packetPos":[-82366,288795],"packetRange":{"gte":1788163009871,"lte":1788163009871},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51396 Pfcloud UG (haftungsbeschrankt)","number":51396,"organization":{"name":"Pfcloud UG (haftungsbeschrankt)"}},"bytes":56,"geo":{"country_iso_code":"NL"},"ip":"204.76.203.7","mac":["bc:0f:fe:38:0b:a3"],"mac-cnt":1,"packets":1,"port":34087},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"ARIN","srcTTL":[248],"srcTTLCnt":1,"tags":["netcup-ts","honeypot","sensor:netcup-ts"],"tagsCnt":3,"tcp":{"ja4t":["65535_00_00_00"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":84688865},"totDataBytes":0} +{"@timestamp":1788162762634,"_id":"260831-9j0UO9ebeV5NGZDy8K-S_jEl","_index":"arkime_sessions3-260831","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["Pfcloud UG"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["Intelligence Hosting LLC"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":0,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":0,"port":27866},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstRIR":"ARIN","ethertype":2048,"fileId":[82362],"firstPacket":1788161789816,"ipProtocol":6,"lastPacket":1788161789816,"length":0,"network":{"bytes":58,"community_id":"1:wAOI0/brZlBzBpSBbRPM5d/Oo8A=","packets":1},"node":"spark-afae","packetPos":[-82362,143257],"packetRange":{"gte":1788161789816,"lte":1788161789816},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51396 Pfcloud UG (haftungsbeschrankt)","number":51396,"organization":{"name":"Pfcloud UG (haftungsbeschrankt)"}},"bytes":58,"geo":{"country_iso_code":"NL"},"ip":"204.76.203.7","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":1,"port":36998},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"ARIN","srcTTL":[241],"srcTTLCnt":1,"tags":["honeypot","sensor:frantech-ts","frantech-ts"],"tagsCnt":3,"tcp":{"ja4t":["65535_2_536_00"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":4156764267},"totDataBytes":0} +{"@timestamp":1788162159659,"_id":"260831-bcwvBHxsvX9LE5-CD0tiFV4W","_index":"arkime_sessions3-260831","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Hetzner Online GmbH"],"isp.dstCnt":1,"isp.src":["Pfcloud UG"],"isp.srcCnt":1,"org.dst":["HETZNER-DC"],"org.dstCnt":1,"org.src":["Intelligence Hosting LLC"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS24940 Hetzner Online GmbH","number":24940,"organization":{"name":"Hetzner Online GmbH"}},"bytes":0,"geo":{"country_iso_code":"FI"},"ip":"89.167.72.144","mac":["92:00:07:4c:82:70"],"mac-cnt":1,"packets":0,"port":27866},"dstRIR":"RIPE","ethertype":2048,"fileId":[82356],"firstPacket":1788161605202,"ipProtocol":6,"lastPacket":1788161605202,"length":0,"network":{"bytes":54,"community_id":"1:cBL6rQkolGJtENKqWCmeZXwzSDU=","packets":1},"node":"spark-afae","packetPos":[-82356,241950],"packetRange":{"gte":1788161605202,"lte":1788161605202},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51396 Pfcloud UG (haftungsbeschrankt)","number":51396,"organization":{"name":"Pfcloud UG (haftungsbeschrankt)"}},"bytes":54,"geo":{"country_iso_code":"NL"},"ip":"204.76.203.7","mac":["d2:74:7f:6e:37:e3"],"mac-cnt":1,"packets":1,"port":40273},"spoofable":["true"],"spoofableCnt":1,"srcRIR":"ARIN","srcTTL":[244],"srcTTLCnt":1,"tags":["honeypot","sponge-01-ts","sensor:sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["65535_00_00_00"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":3621212588},"totDataBytes":0} +{"@timestamp":1788162458010,"_id":"260831-eMzcwE7CuERPC5JBvmPf90Cp","_index":"arkime_sessions3-260831","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Pfcloud UG"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Intelligence Hosting LLC"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":0,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":0,"port":27866},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[82360],"firstPacket":1788161199150,"ipProtocol":6,"lastPacket":1788161199150,"length":0,"network":{"bytes":60,"community_id":"1:SVwBPK20EKT1rqdfQyh+CU6YYbM=","packets":1},"node":"spark-afae","packetPos":[-82360,171757],"packetRange":{"gte":1788161199150,"lte":1788161199150},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51396 Pfcloud UG (haftungsbeschrankt)","number":51396,"organization":{"name":"Pfcloud UG (haftungsbeschrankt)"}},"bytes":60,"geo":{"country_iso_code":"NL"},"ip":"204.76.203.7","mac":["fc:bd:67:9d:2b:2b"],"mac-cnt":1,"packets":1,"port":40535},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcRIR":"ARIN","srcTTL":[245],"srcTTLCnt":1,"tags":["sensor:contabo-sponge-01-ts","honeypot","contabo-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["65535_00_00_00"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":332935837},"totDataBytes":0} +{"@timestamp":1788162157974,"_id":"260831-4D2-6vIhFApJAYYV-QxOD9CO","_index":"arkime_sessions3-260831","client":{"bytes":3},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["Pfcloud UG"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["Intelligence Hosting LLC"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":639,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":8,"port":28015},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstPayload8":"485454502f312e31","dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[82357],"firstPacket":1788160960343,"http":{"bodyMagic":["text/plain"],"bodyMagicCnt":1,"responseHeader":["content-type","connection"],"responseHeaderCnt":2,"responseHeaderField":["content-type","connection"],"responseHeaderValue":["text/plain; charset=utf-8","close"],"responseHeaderValueCnt":2,"serverVersion":["1.1"],"serverVersionCnt":1,"statuscode":[400],"statuscodeCnt":1},"initRTT":65,"ipProtocol":6,"lastPacket":1788161002949,"length":42606,"network":{"bytes":1232,"community_id":"1:U3fw5/G6XgBVrlF88oNETfTpJuM=","packets":17},"node":"spark-afae","packetPos":[-82357,641726,90,160,82,85,34509,82,0,152,38247,82,152,82,49096,82,185,222],"packetRange":{"gte":1788160960343,"lte":1788161002949},"protocol":["http","tcp"],"protocolCnt":2,"rootId":"260831-4D2-6vIhFApJAYYV-QxOD9CO","segmentCnt":1,"server":{"bytes":103},"source":{"as":{"full":"AS51396 Pfcloud UG (haftungsbeschrankt)","number":51396,"organization":{"name":"Pfcloud UG (haftungsbeschrankt)"}},"bytes":593,"geo":{"country_iso_code":"NL"},"ip":"204.76.203.7","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":9,"port":41424},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcPayload8":"050100","srcRIR":"ARIN","srcTTL":[49],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":["","Attempted Information Leak"],"categoryCnt":2,"flowId":["65970072085693"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[2,3],"severityCnt":2,"signature":["553b5765-6241-4e9a-9982-0ca113796134","5a66c944-faed-4791-9d94-b44b7bd48352"],"signatureCnt":2,"signatureId":[1031235,2000181],"signatureIdCnt":2},"tags":["honeypot","sensor:frantech-ts","frantech-ts"],"tagsCnt":3,"tcp":{"ja4ls":"41_64_21172091","ja4t":["64240_2-4-8-1-3_1400_7"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":10,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":2,"psh":2,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":2420588357},"totDataBytes":106} +{"@timestamp":1788161236341,"_id":"260831-yj2qvKFi40RFUJ6u0SFtPUc8","_index":"arkime_sessions3-260831","client":{"bytes":125},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["Pfcloud UG"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["Intelligence Hosting LLC"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":625,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":5,"port":28015},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstPayload8":"485454502f312e31","dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[82351],"firstPacket":1788160821896,"http":{"bodyMagic":["text/html"],"bodyMagicCnt":1,"clientVersion":["1.1"],"clientVersionCnt":1,"host":["azenv.net"],"hostCnt":1,"ja4h":["ge11nn040000_8391bea91fb6_000000000000_000000000000"],"ja4hCnt":1,"ja4h_r":["ge11nn040000_Host,User-Agent,Accept-Encoding,Connection__"],"ja4h_rCnt":1,"md5":["0f87454a3ea15f0db55ae928dbcd82fc"],"md5Cnt":1,"method":["GET"],"method-GET":1,"methodCnt":1,"path":["http://azenv.net/"],"pathCnt":1,"requestHeader":["user-agent","accept-encoding","connection","host"],"requestHeaderCnt":4,"requestHeaderField":["accept-encoding","connection"],"requestHeaderValue":["gzip","close"],"requestHeaderValueCnt":2,"response-server":["Apache/2.4.41 (Ubuntu)"],"response-serverCnt":1,"response-x-powered-by":["PHP/7.4.3"],"response-x-powered-byCnt":1,"responseHeader":["content-length","x-powered-by","date","connection","content-type","server"],"responseHeaderCnt":6,"responseHeaderField":["connection","content-type","date","content-length"],"responseHeaderValue":["close","text/plain; charset=utf-8","mon, 31 aug 2026 07:20:22 gmt","94"],"responseHeaderValueCnt":4,"serverVersion":["1.1"],"serverVersionCnt":1,"sha256":["1ca624415b2889dbeb3f969890b848b7bc5eaf96ca5e8fdd7461f943b45d10cb"],"sha256Cnt":1,"statuscode":[200],"statuscodeCnt":1,"uri":["http://azenv.net/"],"uriCnt":1,"useragent":["Go-http-client/1.1"],"useragentCnt":1},"initRTT":65,"ipProtocol":6,"lastPacket":1788160822286,"length":390,"network":{"bytes":1208,"community_id":"1:z1SpC0UDIJ8PVBYhuQWpSZe3PQ4=","packets":12},"node":"spark-afae","packetPos":[-82351,39532737,90,402,82,207,82,369,1014,82,0,0,520],"packetRange":{"gte":1788160821896,"lte":1788160822286},"protocol":["http","tcp"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":287},"source":{"as":{"full":"AS51396 Pfcloud UG (haftungsbeschrankt)","number":51396,"organization":{"name":"Pfcloud UG (haftungsbeschrankt)"}},"bytes":583,"geo":{"country_iso_code":"NL"},"ip":"204.76.203.7","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":7,"port":38116},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcPayload8":"4745542068747470","srcRIR":"ARIN","srcTTL":[50],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["1599239500691698"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["ce8622a8-6d2f-4fe3-ab81-0cc86e19363e","3d144850-efcc-436a-9008-c5d28ac581ae","869feaa1-dc77-4037-aee2-247b7a39cf7d","23e6932c-e2bd-48cf-80b8-aa98ae9276c4","ee583a2e-d308-4c53-b8e2-a1cd45cd1bb7"],"signatureCnt":5,"signatureId":[2000166,1070034,1030619,1031486,2000008],"signatureIdCnt":5},"tag":{"block":["true","false"],"blockCnt":2,"category":["protocol","activity","attack","recon","tool"],"categoryCnt":5,"cves":[""],"cvesCnt":1,"description":["ip addresses with this tag have been seen crawling http(s) servers around the internet.","generic web crawler traffic detected. the simple pattern of get requests without specific exploitation indicators suggests automated crawling activity, possibly for search indexing or vulnerability scanning.","ip addresses with this tag have been observed crawling the internet for unauthenticated web proxies and testing if they are functional.","ip addresses with this tag have been observed scanning the internet using the golang http client.","cloud credential scanning probe detected. requests for sensitive configuration files and credentials indicate automated scanning for exposed secrets and api keys."],"intention":["unknown","suspicious","malicious"],"intentionCnt":3,"name":["root path scanner","open proxy scanner","go http client","web crawler"],"nameCnt":4},"tags":["frantech-ts","sensor:frantech-ts","honeypot"],"tagsCnt":3,"tcp":{"ja4ls":"42_64_tcp","ja4t":["64240_2-4-8-1-3_1400_7"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":4,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":2,"psh":2,"rst":2,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":913703813},"totDataBytes":412} +{"@timestamp":1788160622526,"_id":"260831-tD0Iyg5tsS1IqrC6rq3bgTmc","_index":"arkime_sessions3-260831","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Kaopu Cloud HK Limited"],"isp.dstCnt":1,"isp.src":["Pfcloud UG"],"isp.srcCnt":1,"org.dst":["LightNode-BH"],"org.dstCnt":1,"org.src":["Intelligence Hosting LLC"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":0,"geo":{"country_iso_code":"BH"},"ip":"38.54.2.209","mac":["52:54:8f:9d:76:48"],"mac-cnt":1,"packets":0,"port":28015},"dstRIR":"ARIN","ethertype":2048,"fileId":[82348],"firstPacket":1788159914622,"ipProtocol":6,"lastPacket":1788159914622,"length":0,"network":{"bytes":54,"community_id":"1:t/94xYFngDg172dS+qYZuNEzrMY=","packets":1},"node":"spark-afae","packetPos":[-82348,326256],"packetRange":{"gte":1788159914622,"lte":1788159914622},"protocol":["tcp"],"protocolCnt":1,"rootId":"260831-tD0Iyg5tsS1IqrC6rq3bgTmc","segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51396 Pfcloud UG (haftungsbeschrankt)","number":51396,"organization":{"name":"Pfcloud UG (haftungsbeschrankt)"}},"bytes":54,"geo":{"country_iso_code":"NL"},"ip":"204.76.203.7","mac":["98:44:ce:60:15:19"],"mac-cnt":1,"packets":1,"port":48842},"spoofable":["true"],"spoofableCnt":1,"srcDscp":[18],"srcDscpCnt":1,"srcOui":["Huawei Technologies Co.,Ltd"],"srcOuiCnt":1,"srcRIR":"ARIN","srcTTL":[240],"srcTTLCnt":1,"tags":["bahrain-sponge-01-ts","honeypot","sensor:bahrain-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["65535_00_00_00"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":1094539491},"totDataBytes":0} +{"@timestamp":1788160320732,"_id":"260831-qT1tSdLTMrhGJ5pjYP6A_XId","_index":"arkime_sessions3-260831","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["Pfcloud UG"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["Intelligence Hosting LLC"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":58,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":1,"port":28015},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[82345],"firstPacket":1788159812625,"ipProtocol":6,"lastPacket":1788159812757,"length":132,"network":{"bytes":170,"community_id":"1:reARVY05wSYil94Q4GfsVMBml5w=","packets":3},"node":"spark-afae","packetPos":[-82345,37860552,74,544],"packetRange":{"gte":1788159812625,"lte":1788159812757},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51396 Pfcloud UG (haftungsbeschrankt)","number":51396,"organization":{"name":"Pfcloud UG (haftungsbeschrankt)"}},"bytes":112,"geo":{"country_iso_code":"NL"},"ip":"204.76.203.7","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":2,"port":46143},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"ARIN","srcTTL":[50,241],"srcTTLCnt":2,"tags":["sensor:frantech-ts","frantech-ts","honeypot"],"tagsCnt":3,"tcp":{"ja4t":["65535_2_536_00"],"ja4tCnt":1,"ja4ts":["64240_2_1460_00"],"ja4tsCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":1181953047},"totDataBytes":0} +{"@timestamp":1788160019308,"_id":"260831-NsxvQAN6pLJCZrqJuVvW-Mla","_index":"arkime_sessions3-260831","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["netcup GmbH"],"isp.dstCnt":1,"isp.src":["Pfcloud UG"],"isp.srcCnt":1,"org.dst":["Netcup KVM"],"org.dstCnt":1,"org.src":["Intelligence Hosting LLC"],"org.srcCnt":1,"usertype.dst":["business"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS197540 netcup GmbH","number":197540,"organization":{"name":"netcup GmbH"}},"bytes":0,"geo":{"country_iso_code":"DE"},"ip":"159.195.21.150","mac":["8a:41:d3:b8:0d:d3"],"mac-cnt":1,"packets":0,"port":28015},"dstRIR":"ARIN","ethertype":2048,"fileId":[82342],"firstPacket":1788158942663,"ipProtocol":6,"lastPacket":1788158942663,"length":0,"network":{"bytes":56,"community_id":"1:WiJLWwhTDHlxnLyJtc2EeYw3ge4=","packets":1},"node":"spark-afae","packetPos":[-82342,247587],"packetRange":{"gte":1788158942663,"lte":1788158942663},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51396 Pfcloud UG (haftungsbeschrankt)","number":51396,"organization":{"name":"Pfcloud UG (haftungsbeschrankt)"}},"bytes":56,"geo":{"country_iso_code":"NL"},"ip":"204.76.203.7","mac":["bc:0f:fe:38:0b:a3"],"mac-cnt":1,"packets":1,"port":36460},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"ARIN","srcTTL":[248],"srcTTLCnt":1,"tags":["sensor:netcup-ts","honeypot","netcup-ts"],"tagsCnt":3,"tcp":{"ja4t":["65535_00_00_00"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":2396114459},"totDataBytes":0} +{"@timestamp":1788159419967,"_id":"260831-iD1byUANLWFMpIJ8KBKx7FyZ","_index":"arkime_sessions3-260831","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Hetzner Online GmbH"],"isp.dstCnt":1,"isp.src":["Pfcloud UG"],"isp.srcCnt":1,"org.dst":["HETZNER-DC"],"org.dstCnt":1,"org.src":["Intelligence Hosting LLC"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS24940 Hetzner Online GmbH","number":24940,"organization":{"name":"Hetzner Online GmbH"}},"bytes":0,"geo":{"country_iso_code":"FI"},"ip":"89.167.72.144","mac":["92:00:07:4c:82:70"],"mac-cnt":1,"packets":0,"port":28015},"dstRIR":"RIPE","ethertype":2048,"fileId":[82339],"firstPacket":1788158624621,"ipProtocol":6,"lastPacket":1788158624621,"length":0,"network":{"bytes":54,"community_id":"1:POCOqOtk6P4trg6THxEQ2uUkyks=","packets":1},"node":"spark-afae","packetPos":[-82339,472175],"packetRange":{"gte":1788158624621,"lte":1788158624621},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51396 Pfcloud UG (haftungsbeschrankt)","number":51396,"organization":{"name":"Pfcloud UG (haftungsbeschrankt)"}},"bytes":54,"geo":{"country_iso_code":"NL"},"ip":"204.76.203.7","mac":["d2:74:7f:6e:37:e3"],"mac-cnt":1,"packets":1,"port":37556},"spoofable":["true"],"spoofableCnt":1,"srcRIR":"ARIN","srcTTL":[244],"srcTTLCnt":1,"tags":["sensor:sponge-01-ts","honeypot","sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["65535_00_00_00"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":1944178273},"totDataBytes":0} +{"@timestamp":1788158814684,"_id":"260831-cj16RYBZhZNP-5fLPSHd45ON","_index":"arkime_sessions3-260831","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo GmbH"],"isp.dstCnt":1,"isp.src":["Pfcloud UG"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Intelligence Hosting LLC"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS51167 Contabo GmbH","number":51167,"organization":{"name":"Contabo GmbH"}},"bytes":0,"geo":{"country_iso_code":"FR"},"ip":"109.123.246.142","mac":["00:50:56:63:46:a6"],"mac-cnt":1,"packets":0,"port":28015},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[82335],"firstPacket":1788158388584,"ipProtocol":6,"lastPacket":1788158388584,"length":0,"network":{"bytes":60,"community_id":"1:epXaZhpZTbif2w1Y2cTUGQm/dpw=","packets":1},"node":"spark-afae","packetPos":[-82335,2358569],"packetRange":{"gte":1788158388584,"lte":1788158388584},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51396 Pfcloud UG (haftungsbeschrankt)","number":51396,"organization":{"name":"Pfcloud UG (haftungsbeschrankt)"}},"bytes":60,"geo":{"country_iso_code":"NL"},"ip":"204.76.203.7","mac":["c0:69:11:cd:1f:19"],"mac-cnt":1,"packets":1,"port":48562},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcRIR":"ARIN","srcTTL":[243],"srcTTLCnt":1,"tags":["proxy","sensor:contabo-sponge-02-ts","contabo-sponge-02-ts"],"tagsCnt":3,"tcp":{"ja4t":["65535_00_00_00"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":4078511119},"totDataBytes":0} +{"@timestamp":1788158515452,"_id":"260831-Zz2-hi3DiTRMALC8dPuGYGwR","_index":"arkime_sessions3-260831","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Pfcloud UG"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Intelligence Hosting LLC"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":0,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":0,"port":28015},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[82333],"firstPacket":1788157760619,"ipProtocol":6,"lastPacket":1788157760619,"length":0,"network":{"bytes":60,"community_id":"1:k2tPeFGA2c3ReLm9GQ7q0zp7r6I=","packets":1},"node":"spark-afae","packetPos":[-82333,385941],"packetRange":{"gte":1788157760619,"lte":1788157760619},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51396 Pfcloud UG (haftungsbeschrankt)","number":51396,"organization":{"name":"Pfcloud UG (haftungsbeschrankt)"}},"bytes":60,"geo":{"country_iso_code":"NL"},"ip":"204.76.203.7","mac":["fc:bd:67:9d:2b:2b"],"mac-cnt":1,"packets":1,"port":58872},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcRIR":"ARIN","srcTTL":[244],"srcTTLCnt":1,"tags":["sensor:contabo-sponge-01-ts","honeypot","contabo-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["65535_00_00_00"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":1885830942},"totDataBytes":0} +{"@timestamp":1788157604274,"_id":"260831-_svXXFgMrvNAO4-IW8UPh9iM","_index":"arkime_sessions3-260831","client":{"bytes":3},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["Pfcloud UG"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["Intelligence Hosting LLC"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":1064,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":16,"port":28017},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[82328],"firstPacket":1788156753987,"initRTT":66,"ipProtocol":6,"lastPacket":1788156876586,"length":122599,"network":{"bytes":2329,"community_id":"1:cpVmdRlBNMRt4+gzPwOeyEftsFA=","packets":35},"node":"spark-afae","packetPos":[-82328,19212267,90,160,82,85,25970,500,234,82,19621,222,316,82,19314,432,332,82,61539,1360,1799,82,16299,362,82,0,15029,222,82,0,27367,1350,164,82,21254,82],"packetRange":{"gte":1788156753987,"lte":1788156876586},"protocol":["tcp"],"protocolCnt":1,"rootId":"260831-_svXXFgMrvNAO4-IW8UPh9iM","segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51396 Pfcloud UG (haftungsbeschrankt)","number":51396,"organization":{"name":"Pfcloud UG (haftungsbeschrankt)"}},"bytes":1265,"geo":{"country_iso_code":"NL"},"ip":"204.76.203.7","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":19,"port":34700},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcPayload8":"050100","srcRIR":"ARIN","srcTTL":[50],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":["Attempted Information Leak",""],"categoryCnt":2,"flowId":["302656256062005"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[2,3],"severityCnt":2,"signature":["553b5765-6241-4e9a-9982-0ca113796134","5a66c944-faed-4791-9d94-b44b7bd48352"],"signatureCnt":2,"signatureId":[1031235,2000181],"signatureIdCnt":2},"tag":{"block":["false","true"],"blockCnt":2,"category":["recon","activity"],"categoryCnt":2,"cves":[""],"cvesCnt":1,"description":["ip addresses with this tag have been observed attempting to discover socks5 proxies that do not require authentication.","socks proxy protocol negotiation"],"intention":["suspicious"],"intentionCnt":1,"name":["socks proxy protocol negotiation","socks5 proxy scanner"],"nameCnt":2},"tags":["honeypot","sensor:frantech-ts","frantech-ts"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-4-8-1-3_1400_7"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":30,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":1,"psh":1,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":2091935025},"totDataBytes":3} +{"@timestamp":1788157604260,"_id":"260831-_sueR_V46XxCfIiYaX82uD0C","_index":"arkime_sessions3-260831","client":{"bytes":125},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["Pfcloud UG"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["Intelligence Hosting LLC"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":625,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":5,"port":28017},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstPayload8":"485454502f312e31","dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[82328],"firstPacket":1788156618619,"http":{"bodyMagic":["text/html"],"bodyMagicCnt":1,"clientVersion":["1.1"],"clientVersionCnt":1,"host":["azenv.net"],"hostCnt":1,"ja4h":["ge11nn040000_8391bea91fb6_000000000000_000000000000"],"ja4hCnt":1,"ja4h_r":["ge11nn040000_Host,User-Agent,Accept-Encoding,Connection__"],"ja4h_rCnt":1,"md5":["0f87454a3ea15f0db55ae928dbcd82fc"],"md5Cnt":1,"method":["GET"],"method-GET":1,"methodCnt":1,"path":["http://azenv.net/"],"pathCnt":1,"requestHeader":["accept-encoding","connection","user-agent","host"],"requestHeaderCnt":4,"requestHeaderField":["accept-encoding","connection"],"requestHeaderValue":["gzip","close"],"requestHeaderValueCnt":2,"response-server":["Apache/2.4.41 (Ubuntu)"],"response-serverCnt":1,"response-x-powered-by":["PHP/7.4.3"],"response-x-powered-byCnt":1,"responseHeader":["server","connection","content-type","date","x-powered-by","content-length"],"responseHeaderCnt":6,"responseHeaderField":["connection","content-type","date","content-length"],"responseHeaderValue":["close","text/plain; charset=utf-8","mon, 31 aug 2026 06:10:18 gmt","94"],"responseHeaderValueCnt":4,"serverVersion":["1.1"],"serverVersionCnt":1,"sha256":["1ca624415b2889dbeb3f969890b848b7bc5eaf96ca5e8fdd7461f943b45d10cb"],"sha256Cnt":1,"statuscode":[200],"statuscodeCnt":1,"uri":["http://azenv.net/"],"uriCnt":1,"useragent":["Go-http-client/1.1"],"useragentCnt":1},"initRTT":64,"ipProtocol":6,"lastPacket":1788156618876,"length":257,"network":{"bytes":1088,"community_id":"1:W1MyX6bhAsiAidvgV52u8DFga1c=","packets":10},"node":"spark-afae","packetPos":[-82328,18623350,90,3247,82,207,82,369,82,0,0],"packetRange":{"gte":1788156618619,"lte":1788156618876},"protocol":["http","tcp"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":287},"source":{"as":{"full":"AS51396 Pfcloud UG (haftungsbeschrankt)","number":51396,"organization":{"name":"Pfcloud UG (haftungsbeschrankt)"}},"bytes":463,"geo":{"country_iso_code":"NL"},"ip":"204.76.203.7","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":5,"port":38856},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcPayload8":"4745542068747470","srcRIR":"ARIN","srcTTL":[50],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["690282550530438"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["ce8622a8-6d2f-4fe3-ab81-0cc86e19363e","3d144850-efcc-436a-9008-c5d28ac581ae","869feaa1-dc77-4037-aee2-247b7a39cf7d","23e6932c-e2bd-48cf-80b8-aa98ae9276c4","ee583a2e-d308-4c53-b8e2-a1cd45cd1bb7"],"signatureCnt":5,"signatureId":[2000166,1070034,1030619,1031486,2000008],"signatureIdCnt":5},"tag":{"block":["false","true"],"blockCnt":2,"category":["protocol","tool","recon","activity","attack"],"categoryCnt":5,"cves":[""],"cvesCnt":1,"description":["generic web crawler traffic detected. the simple pattern of get requests without specific exploitation indicators suggests automated crawling activity, possibly for search indexing or vulnerability scanning.","ip addresses with this tag have been observed crawling the internet for unauthenticated web proxies and testing if they are functional.","ip addresses with this tag have been observed scanning the internet using the golang http client.","cloud credential scanning probe detected. requests for sensitive configuration files and credentials indicate automated scanning for exposed secrets and api keys.","ip addresses with this tag have been seen crawling http(s) servers around the internet."],"intention":["unknown","suspicious","malicious"],"intentionCnt":3,"name":["root path scanner","web crawler","open proxy scanner","go http client"],"nameCnt":4},"tags":["honeypot","sensor:frantech-ts","frantech-ts"],"tagsCnt":3,"tcp":{"ja4ls":"42_64_tcp","ja4t":["64240_2-4-8-1-3_1400_7"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":4,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":2,"psh":2,"rst":0,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":2487249366},"totDataBytes":412} +{"@timestamp":1788157305970,"_id":"260831-Rj1NfZJKdtRAHp6rBy4wM895","_index":"arkime_sessions3-260831","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["netcup GmbH"],"isp.dstCnt":1,"isp.src":["Pfcloud UG"],"isp.srcCnt":1,"org.dst":["Netcup KVM"],"org.dstCnt":1,"org.src":["Intelligence Hosting LLC"],"org.srcCnt":1,"usertype.dst":["business"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS197540 netcup GmbH","number":197540,"organization":{"name":"netcup GmbH"}},"bytes":0,"geo":{"country_iso_code":"DE"},"ip":"159.195.21.150","mac":["8a:41:d3:b8:0d:d3"],"mac-cnt":1,"packets":0,"port":28017},"dstRIR":"ARIN","ethertype":2048,"fileId":[82325],"firstPacket":1788156195863,"ipProtocol":6,"lastPacket":1788156195863,"length":0,"network":{"bytes":56,"community_id":"1:blLGs8ikJ4kMnziz3Vo4pWSxhig=","packets":1},"node":"spark-afae","packetPos":[-82325,77319],"packetRange":{"gte":1788156195863,"lte":1788156195863},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51396 Pfcloud UG (haftungsbeschrankt)","number":51396,"organization":{"name":"Pfcloud UG (haftungsbeschrankt)"}},"bytes":56,"geo":{"country_iso_code":"NL"},"ip":"204.76.203.7","mac":["bc:0f:fe:38:0b:a3"],"mac-cnt":1,"packets":1,"port":60300},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"ARIN","srcTTL":[248],"srcTTLCnt":1,"tags":["sensor:netcup-ts","honeypot","netcup-ts"],"tagsCnt":3,"tcp":{"ja4t":["65535_00_00_00"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":2836442277},"totDataBytes":0} +{"@timestamp":1788156403472,"_id":"260831-JT2aMXZx9lRH1KmG2oAg_9g-","_index":"arkime_sessions3-260831","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Kaopu Cloud HK Limited"],"isp.dstCnt":1,"isp.src":["Pfcloud UG"],"isp.srcCnt":1,"org.dst":["LightNode-BH"],"org.dstCnt":1,"org.src":["Intelligence Hosting LLC"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":0,"geo":{"country_iso_code":"BH"},"ip":"38.54.2.209","mac":["52:54:8f:9d:76:48"],"mac-cnt":1,"packets":0,"port":28017},"dstRIR":"ARIN","ethertype":2048,"fileId":[82318],"firstPacket":1788155333816,"ipProtocol":6,"lastPacket":1788155333816,"length":0,"network":{"bytes":54,"community_id":"1:dsRN+M1c8Y/0iZhm3m4Ay1Wiwd4=","packets":1},"node":"spark-afae","packetPos":[-82318,89098],"packetRange":{"gte":1788155333816,"lte":1788155333816},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51396 Pfcloud UG (haftungsbeschrankt)","number":51396,"organization":{"name":"Pfcloud UG (haftungsbeschrankt)"}},"bytes":54,"geo":{"country_iso_code":"NL"},"ip":"204.76.203.7","mac":["98:44:ce:60:15:19"],"mac-cnt":1,"packets":1,"port":53928},"spoofable":["true"],"spoofableCnt":1,"srcDscp":[18],"srcDscpCnt":1,"srcOui":["Huawei Technologies Co.,Ltd"],"srcOuiCnt":1,"srcRIR":"ARIN","srcTTL":[241],"srcTTLCnt":1,"tags":["bahrain-sponge-01-ts","sensor:bahrain-sponge-01-ts","honeypot"],"tagsCnt":3,"tcp":{"ja4t":["65535_00_00_00"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":3958585134},"totDataBytes":0} +{"@timestamp":1788155804434,"_id":"260831-Dj25Ws3qOrJCKKvnkvX8jOw_","_index":"arkime_sessions3-260831","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Hetzner Online GmbH"],"isp.dstCnt":1,"isp.src":["Pfcloud UG"],"isp.srcCnt":1,"org.dst":["HETZNER-DC"],"org.dstCnt":1,"org.src":["Intelligence Hosting LLC"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS24940 Hetzner Online GmbH","number":24940,"organization":{"name":"Hetzner Online GmbH"}},"bytes":0,"geo":{"country_iso_code":"FI"},"ip":"89.167.72.144","mac":["92:00:07:4c:82:70"],"mac-cnt":1,"packets":0,"port":28017},"dstRIR":"RIPE","ethertype":2048,"fileId":[82315],"firstPacket":1788155067610,"ipProtocol":6,"lastPacket":1788155067610,"length":0,"network":{"bytes":54,"community_id":"1:Nd07AzIenaZOsB0E/XVRBsIgk4M=","packets":1},"node":"spark-afae","packetPos":[-82315,47087],"packetRange":{"gte":1788155067610,"lte":1788155067610},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51396 Pfcloud UG (haftungsbeschrankt)","number":51396,"organization":{"name":"Pfcloud UG (haftungsbeschrankt)"}},"bytes":54,"geo":{"country_iso_code":"NL"},"ip":"204.76.203.7","mac":["d2:74:7f:6e:37:e3"],"mac-cnt":1,"packets":1,"port":49926},"spoofable":["true"],"spoofableCnt":1,"srcRIR":"ARIN","srcTTL":[245],"srcTTLCnt":1,"tags":["honeypot","sensor:sponge-01-ts","sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["65535_00_00_00"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":316079462},"totDataBytes":0} +{"@timestamp":1788156104253,"_id":"260831-Gj0KM6dboupPrZTBsVo6-Z-k","_index":"arkime_sessions3-260831","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Pfcloud UG"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Intelligence Hosting LLC"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":0,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":0,"port":28017},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[82317],"firstPacket":1788155008308,"ipProtocol":6,"lastPacket":1788155008308,"length":0,"network":{"bytes":60,"community_id":"1:xnIFp9qqyPBK8RtylDWIZLXj89Y=","packets":1},"node":"spark-afae","packetPos":[-82317,304083],"packetRange":{"gte":1788155008308,"lte":1788155008308},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51396 Pfcloud UG (haftungsbeschrankt)","number":51396,"organization":{"name":"Pfcloud UG (haftungsbeschrankt)"}},"bytes":60,"geo":{"country_iso_code":"NL"},"ip":"204.76.203.7","mac":["fc:bd:67:9d:2b:2b"],"mac-cnt":1,"packets":1,"port":57806},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcRIR":"ARIN","srcTTL":[245],"srcTTLCnt":1,"tags":["honeypot","sensor:contabo-sponge-01-ts","contabo-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["65535_00_00_00"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":4280062025},"totDataBytes":0} +{"@timestamp":1788155205108,"_id":"260831-vMu-pL5TUb5AToACpZc_fz3L","_index":"arkime_sessions3-260831","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo GmbH"],"isp.dstCnt":1,"isp.src":["Pfcloud UG"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Intelligence Hosting LLC"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS51167 Contabo GmbH","number":51167,"organization":{"name":"Contabo GmbH"}},"bytes":0,"geo":{"country_iso_code":"FR"},"ip":"109.123.246.142","mac":["00:50:56:63:46:a6"],"mac-cnt":1,"packets":0,"port":28017},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[82309],"firstPacket":1788154890057,"ipProtocol":6,"lastPacket":1788154890057,"length":0,"network":{"bytes":60,"community_id":"1:4FzACNXR5zKSPzhly7itfeJYWQQ=","packets":1},"node":"spark-afae","packetPos":[-82309,947127],"packetRange":{"gte":1788154890057,"lte":1788154890057},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51396 Pfcloud UG (haftungsbeschrankt)","number":51396,"organization":{"name":"Pfcloud UG (haftungsbeschrankt)"}},"bytes":60,"geo":{"country_iso_code":"NL"},"ip":"204.76.203.7","mac":["c0:69:11:cd:1f:19"],"mac-cnt":1,"packets":1,"port":48157},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcRIR":"ARIN","srcTTL":[243],"srcTTLCnt":1,"tags":["proxy","contabo-sponge-02-ts","sensor:contabo-sponge-02-ts"],"tagsCnt":3,"tcp":{"ja4t":["65535_00_00_00"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":3518917786},"totDataBytes":0} +{"@timestamp":1788154899774,"_id":"260831-7jyvldIS-7VAF7M644IBaH1h","_index":"arkime_sessions3-260831","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["Pfcloud UG"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["Intelligence Hosting LLC"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":58,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":1,"port":28017},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[82308],"firstPacket":1788153761366,"ipProtocol":6,"lastPacket":1788153761508,"length":142,"network":{"bytes":170,"community_id":"1:OIN4BzKnsfvFWPpiTUetm6+XkAQ=","packets":3},"node":"spark-afae","packetPos":[-82308,331611,74,2105],"packetRange":{"gte":1788153761366,"lte":1788153761508},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51396 Pfcloud UG (haftungsbeschrankt)","number":51396,"organization":{"name":"Pfcloud UG (haftungsbeschrankt)"}},"bytes":112,"geo":{"country_iso_code":"NL"},"ip":"204.76.203.7","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":2,"port":40253},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"ARIN","srcTTL":[51,242],"srcTTLCnt":2,"tags":["sensor:frantech-ts","honeypot","frantech-ts"],"tagsCnt":3,"tcp":{"ja4t":["65535_2_536_00"],"ja4tCnt":1,"ja4ts":["64240_2_1460_00"],"ja4tsCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":3283011293},"totDataBytes":0} +{"@timestamp":1788153999147,"_id":"260831-zTxhOGiC-p5FN4dqxGvtE4Jw","_index":"arkime_sessions3-260831","client":{"bytes":3},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["Pfcloud UG"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["Intelligence Hosting LLC"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":1328,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":20,"port":28080},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[82303],"firstPacket":1788152945202,"initRTT":64,"ipProtocol":6,"lastPacket":1788153084499,"length":139297,"network":{"bytes":2857,"community_id":"1:/YtsECNoke0nsi4pXc3MnToQsyg=","packets":43},"node":"spark-afae","packetPos":[-82303,8793555,90,1098,82,85,123867,502,1468,82,96890,82,755,82,38896,222,0,82,26813,246,222,82,29821,564,552,82,54123,328,1598,82,25158,222,471,82,26041,82,394,82,60381,222,0,82,646,82],"packetRange":{"gte":1788152945202,"lte":1788153084499},"protocol":["tcp"],"protocolCnt":1,"rootId":"260831-zTxhOGiC-p5FN4dqxGvtE4Jw","segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51396 Pfcloud UG (haftungsbeschrankt)","number":51396,"organization":{"name":"Pfcloud UG (haftungsbeschrankt)"}},"bytes":1529,"geo":{"country_iso_code":"NL"},"ip":"204.76.203.7","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":23,"port":53318},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcPayload8":"050100","srcRIR":"ARIN","srcTTL":[49],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":["","Attempted Information Leak"],"categoryCnt":2,"flowId":["308113840161104"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[2,3],"severityCnt":2,"signature":["553b5765-6241-4e9a-9982-0ca113796134","5a66c944-faed-4791-9d94-b44b7bd48352"],"signatureCnt":2,"signatureId":[1031235,2000181],"signatureIdCnt":2},"tags":["honeypot","sensor:frantech-ts","frantech-ts"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-4-8-1-3_1400_7"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":38,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":1,"psh":1,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":928563089},"totDataBytes":3} +{"@timestamp":1788153999117,"_id":"260831-zTwkHAsqx1dGsp5uz79uGGSj","_index":"arkime_sessions3-260831","client":{"bytes":125},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["Pfcloud UG"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["Intelligence Hosting LLC"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":625,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":5,"port":28080},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstPayload8":"485454502f312e31","dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[82303],"firstPacket":1788152809960,"http":{"bodyMagic":["text/html"],"bodyMagicCnt":1,"clientVersion":["1.1"],"clientVersionCnt":1,"host":["azenv.net"],"hostCnt":1,"ja4h":["ge11nn040000_8391bea91fb6_000000000000_000000000000"],"ja4hCnt":1,"ja4h_r":["ge11nn040000_Host,User-Agent,Accept-Encoding,Connection__"],"ja4h_rCnt":1,"md5":["0f87454a3ea15f0db55ae928dbcd82fc"],"md5Cnt":1,"method":["GET"],"method-GET":1,"methodCnt":1,"path":["http://azenv.net/"],"pathCnt":1,"requestHeader":["user-agent","host","accept-encoding","connection"],"requestHeaderCnt":4,"requestHeaderField":["accept-encoding","connection"],"requestHeaderValue":["gzip","close"],"requestHeaderValueCnt":2,"response-server":["Apache/2.4.41 (Ubuntu)"],"response-serverCnt":1,"response-x-powered-by":["PHP/7.4.3"],"response-x-powered-byCnt":1,"responseHeader":["server","date","content-type","content-length","connection","x-powered-by"],"responseHeaderCnt":6,"responseHeaderField":["connection","content-type","date","content-length"],"responseHeaderValue":["close","text/plain; charset=utf-8","mon, 31 aug 2026 05:06:50 gmt","94"],"responseHeaderValueCnt":4,"serverVersion":["1.1"],"serverVersionCnt":1,"sha256":["1ca624415b2889dbeb3f969890b848b7bc5eaf96ca5e8fdd7461f943b45d10cb"],"sha256Cnt":1,"statuscode":[200],"statuscodeCnt":1,"uri":["http://azenv.net/"],"uriCnt":1,"useragent":["Go-http-client/1.1"],"useragentCnt":1},"initRTT":65,"ipProtocol":6,"lastPacket":1788152810220,"length":260,"network":{"bytes":1088,"community_id":"1:7CP9qA9ANxp0lcF2OuhjaI3x7tk=","packets":10},"node":"spark-afae","packetPos":[-82303,117154,90,0,82,207,82,369,82,0,0],"packetRange":{"gte":1788152809960,"lte":1788152810220},"protocol":["http","tcp"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":287},"source":{"as":{"full":"AS51396 Pfcloud UG (haftungsbeschrankt)","number":51396,"organization":{"name":"Pfcloud UG (haftungsbeschrankt)"}},"bytes":463,"geo":{"country_iso_code":"NL"},"ip":"204.76.203.7","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":5,"port":34658},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcPayload8":"4745542068747470","srcRIR":"ARIN","srcTTL":[50],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["467245330024162"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["869feaa1-dc77-4037-aee2-247b7a39cf7d","3d144850-efcc-436a-9008-c5d28ac581ae","23e6932c-e2bd-48cf-80b8-aa98ae9276c4","ee583a2e-d308-4c53-b8e2-a1cd45cd1bb7","ce8622a8-6d2f-4fe3-ab81-0cc86e19363e"],"signatureCnt":5,"signatureId":[2000166,1070034,1030619,1031486,2000008],"signatureIdCnt":5},"tag":{"block":["false","true"],"blockCnt":2,"category":["attack","recon","protocol","tool","activity"],"categoryCnt":5,"cves":[""],"cvesCnt":1,"description":["ip addresses with this tag have been seen crawling http(s) servers around the internet.","cloud credential scanning probe detected. requests for sensitive configuration files and credentials indicate automated scanning for exposed secrets and api keys.","generic web crawler traffic detected. the simple pattern of get requests without specific exploitation indicators suggests automated crawling activity, possibly for search indexing or vulnerability scanning.","ip addresses with this tag have been observed crawling the internet for unauthenticated web proxies and testing if they are functional.","ip addresses with this tag have been observed scanning the internet using the golang http client."],"intention":["suspicious","malicious","unknown"],"intentionCnt":3,"name":["go http client","web crawler","open proxy scanner","root path scanner"],"nameCnt":4},"tags":["honeypot","sensor:frantech-ts","frantech-ts"],"tagsCnt":3,"tcp":{"ja4ls":"48_64_tcp","ja4t":["64240_2-4-8-1-3_1400_7"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":4,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":2,"psh":2,"rst":0,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":2297734709},"totDataBytes":412} +{"@timestamp":1788153397489,"_id":"260831-tzyawe7AS5lP44eGUfrC9VXe","_index":"arkime_sessions3-260831","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Pfcloud UG"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Intelligence Hosting LLC"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":0,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":0,"port":28080},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[82298],"firstPacket":1788152724456,"ipProtocol":6,"lastPacket":1788152724456,"length":0,"network":{"bytes":60,"community_id":"1:lS75XMRMx5IqGiNLB37LzAqfKw4=","packets":1},"node":"spark-afae","packetPos":[-82298,819003],"packetRange":{"gte":1788152724456,"lte":1788152724456},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51396 Pfcloud UG (haftungsbeschrankt)","number":51396,"organization":{"name":"Pfcloud UG (haftungsbeschrankt)"}},"bytes":60,"geo":{"country_iso_code":"NL"},"ip":"204.76.203.7","mac":["fc:bd:67:9d:2b:2b"],"mac-cnt":1,"packets":1,"port":33330},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcRIR":"ARIN","srcTTL":[244],"srcTTLCnt":1,"tags":["contabo-sponge-01-ts","sensor:contabo-sponge-01-ts","honeypot"],"tagsCnt":3,"tcp":{"ja4t":["65535_00_00_00"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":853389461},"totDataBytes":0} +{"@timestamp":1788153097282,"_id":"260831-kMtkKoEGN7hCOp7XSEc4bCk6","_index":"arkime_sessions3-260831","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Hetzner Online GmbH"],"isp.dstCnt":1,"isp.src":["Pfcloud UG"],"isp.srcCnt":1,"org.dst":["HETZNER-DC"],"org.dstCnt":1,"org.src":["Intelligence Hosting LLC"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS24940 Hetzner Online GmbH","number":24940,"organization":{"name":"Hetzner Online GmbH"}},"bytes":0,"geo":{"country_iso_code":"FI"},"ip":"89.167.72.144","mac":["92:00:07:4c:82:70"],"mac-cnt":1,"packets":0,"port":28080},"dstRIR":"RIPE","ethertype":2048,"fileId":[82296],"firstPacket":1788152418370,"ipProtocol":6,"lastPacket":1788152418370,"length":0,"network":{"bytes":54,"community_id":"1:prCSpfDJW59smPLKwU3rJDA9j5U=","packets":1},"node":"spark-afae","packetPos":[-82296,45854],"packetRange":{"gte":1788152418370,"lte":1788152418370},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51396 Pfcloud UG (haftungsbeschrankt)","number":51396,"organization":{"name":"Pfcloud UG (haftungsbeschrankt)"}},"bytes":54,"geo":{"country_iso_code":"NL"},"ip":"204.76.203.7","mac":["d2:74:7f:6e:37:e3"],"mac-cnt":1,"packets":1,"port":51401},"spoofable":["true"],"spoofableCnt":1,"srcRIR":"ARIN","srcTTL":[245],"srcTTLCnt":1,"tags":["sponge-01-ts","honeypot","sensor:sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["65535_00_00_00"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":1822439004},"totDataBytes":0} +{"@timestamp":1788152797506,"_id":"260831-oTz7c9pF7m9ApoMZvCxFpyMC","_index":"arkime_sessions3-260831","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo GmbH"],"isp.dstCnt":1,"isp.src":["Pfcloud UG"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Intelligence Hosting LLC"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS51167 Contabo GmbH","number":51167,"organization":{"name":"Contabo GmbH"}},"bytes":0,"geo":{"country_iso_code":"FR"},"ip":"109.123.246.142","mac":["00:50:56:63:46:a6"],"mac-cnt":1,"packets":0,"port":28080},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[82294],"firstPacket":1788151465725,"ipProtocol":6,"lastPacket":1788151465725,"length":0,"network":{"bytes":60,"community_id":"1:59700E9qutjBVMWDrkR/miIv1bg=","packets":1},"node":"spark-afae","packetPos":[-82294,15818],"packetRange":{"gte":1788151465725,"lte":1788151465725},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51396 Pfcloud UG (haftungsbeschrankt)","number":51396,"organization":{"name":"Pfcloud UG (haftungsbeschrankt)"}},"bytes":60,"geo":{"country_iso_code":"NL"},"ip":"204.76.203.7","mac":["c0:69:11:cd:1f:19"],"mac-cnt":1,"packets":1,"port":33210},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcRIR":"ARIN","srcTTL":[243],"srcTTLCnt":1,"tags":["proxy","sensor:contabo-sponge-02-ts","contabo-sponge-02-ts"],"tagsCnt":3,"tcp":{"ja4t":["65535_00_00_00"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":2387440218},"totDataBytes":0} +{"@timestamp":1788151894732,"_id":"260831-gDwf7sRcRQBNnKcrs2Ob038j","_index":"arkime_sessions3-260831","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Kaopu Cloud HK Limited"],"isp.dstCnt":1,"isp.src":["Pfcloud UG"],"isp.srcCnt":1,"org.dst":["LightNode-BH"],"org.dstCnt":1,"org.src":["Intelligence Hosting LLC"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":0,"geo":{"country_iso_code":"BH"},"ip":"38.54.2.209","mac":["52:54:8f:9d:76:48"],"mac-cnt":1,"packets":0,"port":28080},"dstRIR":"ARIN","ethertype":2048,"fileId":[82289],"firstPacket":1788151174815,"ipProtocol":6,"lastPacket":1788151174815,"length":0,"network":{"bytes":54,"community_id":"1:Rh4dpCzAQfqH1zlIDBSeN/V2PQw=","packets":1},"node":"spark-afae","packetPos":[-82289,158764],"packetRange":{"gte":1788151174815,"lte":1788151174815},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51396 Pfcloud UG (haftungsbeschrankt)","number":51396,"organization":{"name":"Pfcloud UG (haftungsbeschrankt)"}},"bytes":54,"geo":{"country_iso_code":"NL"},"ip":"204.76.203.7","mac":["98:44:ce:60:15:19"],"mac-cnt":1,"packets":1,"port":39113},"spoofable":["true"],"spoofableCnt":1,"srcDscp":[18],"srcDscpCnt":1,"srcOui":["Huawei Technologies Co.,Ltd"],"srcOuiCnt":1,"srcRIR":"ARIN","srcTTL":[240],"srcTTLCnt":1,"tags":["honeypot","bahrain-sponge-01-ts","sensor:bahrain-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["65535_00_00_00"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":1823935315},"totDataBytes":0} +{"@timestamp":1788150384299,"_id":"260831-STwkcTWFkstDjLb2bntHkaGF","_index":"arkime_sessions3-260831","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["Pfcloud UG"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["Intelligence Hosting LLC"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":58,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":1,"port":28080},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[82278],"firstPacket":1788149844724,"ipProtocol":6,"lastPacket":1788149844854,"length":130,"network":{"bytes":170,"community_id":"1:lh0uqsfPJRDgfHD/Q8yCROG5tzU=","packets":3},"node":"spark-afae","packetPos":[-82278,5186663,74,0],"packetRange":{"gte":1788149844724,"lte":1788149844854},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51396 Pfcloud UG (haftungsbeschrankt)","number":51396,"organization":{"name":"Pfcloud UG (haftungsbeschrankt)"}},"bytes":112,"geo":{"country_iso_code":"NL"},"ip":"204.76.203.7","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":2,"port":37745},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"ARIN","srcTTL":[49,240],"srcTTLCnt":2,"tags":["honeypot","frantech-ts","sensor:frantech-ts"],"tagsCnt":3,"tcp":{"ja4t":["65535_2_536_00"],"ja4tCnt":1,"ja4ts":["64240_2_1460_00"],"ja4tsCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":2306315447},"totDataBytes":0} +{"@timestamp":1788150388869,"_id":"260831-Q8sOfN8uvAdBAqOxeqWuxjhP","_index":"arkime_sessions3-260831","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["netcup GmbH"],"isp.dstCnt":1,"isp.src":["Pfcloud UG"],"isp.srcCnt":1,"org.dst":["Netcup KVM"],"org.dstCnt":1,"org.src":["Intelligence Hosting LLC"],"org.srcCnt":1,"usertype.dst":["business"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS197540 netcup GmbH","number":197540,"organization":{"name":"netcup GmbH"}},"bytes":0,"geo":{"country_iso_code":"DE"},"ip":"159.195.21.150","mac":["8a:41:d3:b8:0d:d3"],"mac-cnt":1,"packets":0,"port":28080},"dstRIR":"ARIN","ethertype":2048,"fileId":[82277],"firstPacket":1788149668008,"ipProtocol":6,"lastPacket":1788149668008,"length":0,"network":{"bytes":56,"community_id":"1:vO5aS/SzhcFKrBe3a6CIJ4ReQkI=","packets":1},"node":"spark-afae","packetPos":[-82277,2100788],"packetRange":{"gte":1788149668008,"lte":1788149668008},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51396 Pfcloud UG (haftungsbeschrankt)","number":51396,"organization":{"name":"Pfcloud UG (haftungsbeschrankt)"}},"bytes":56,"geo":{"country_iso_code":"NL"},"ip":"204.76.203.7","mac":["bc:0f:fe:38:0b:a3"],"mac-cnt":1,"packets":1,"port":38641},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"ARIN","srcTTL":[248],"srcTTLCnt":1,"tags":["netcup-ts","sensor:netcup-ts","honeypot"],"tagsCnt":3,"tcp":{"ja4t":["65535_00_00_00"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":2929491905},"totDataBytes":0} +{"@timestamp":1788148884280,"_id":"260831-HkWiNPsXqj9PnYcRKuNxNnCP","_index":"arkime_sessions3-260831","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo GmbH"],"isp.dstCnt":1,"isp.src":["Pfcloud UG"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Intelligence Hosting LLC"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS51167 Contabo GmbH","number":51167,"organization":{"name":"Contabo GmbH"}},"bytes":0,"geo":{"country_iso_code":"FR"},"ip":"109.123.246.142","mac":["00:50:56:63:46:a6"],"mac-cnt":1,"packets":0,"port":28081},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[82267],"firstPacket":1788148325826,"ipProtocol":6,"lastPacket":1788148325826,"length":0,"network":{"bytes":60,"community_id":"1:mwYPoJjYFuHyRODvng5gvp8GTvE=","packets":1},"node":"spark-afae","packetPos":[-82267,917359],"packetRange":{"gte":1788148325826,"lte":1788148325826},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51396 Pfcloud UG (haftungsbeschrankt)","number":51396,"organization":{"name":"Pfcloud UG (haftungsbeschrankt)"}},"bytes":60,"geo":{"country_iso_code":"NL"},"ip":"204.76.203.7","mac":["c0:69:11:cd:1f:19"],"mac-cnt":1,"packets":1,"port":44225},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcRIR":"ARIN","srcTTL":[244],"srcTTLCnt":1,"tags":["sensor:contabo-sponge-02-ts","contabo-sponge-02-ts","proxy"],"tagsCnt":3,"tcp":{"ja4t":["65535_00_00_00"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":2644219308},"totDataBytes":0} +{"@timestamp":1788148883894,"_id":"260831-NArZm4l_BSpBfoSxb024BLsj","_index":"arkime_sessions3-260831","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["Pfcloud UG"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["Intelligence Hosting LLC"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":0,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":0,"port":28081},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstRIR":"ARIN","ethertype":2048,"fileId":[82270],"firstPacket":1788148171366,"ipProtocol":6,"lastPacket":1788148171366,"length":0,"network":{"bytes":58,"community_id":"1:E82dzCknwDVTkx84Sfrmk99Nyas=","packets":1},"node":"spark-afae","packetPos":[-82270,2486455],"packetRange":{"gte":1788148171366,"lte":1788148171366},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51396 Pfcloud UG (haftungsbeschrankt)","number":51396,"organization":{"name":"Pfcloud UG (haftungsbeschrankt)"}},"bytes":58,"geo":{"country_iso_code":"NL"},"ip":"204.76.203.7","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":1,"port":48840},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"ARIN","srcTTL":[241],"srcTTLCnt":1,"tags":["frantech-ts","sensor:frantech-ts","honeypot"],"tagsCnt":3,"tcp":{"ja4t":["65535_2_536_00"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":3587117729},"totDataBytes":0} +{"@timestamp":1788148276257,"_id":"260831-_DvL80UGvDNFvJlt-IljaGNO","_index":"arkime_sessions3-260831","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["netcup GmbH"],"isp.dstCnt":1,"isp.src":["Pfcloud UG"],"isp.srcCnt":1,"org.dst":["Netcup KVM"],"org.dstCnt":1,"org.src":["Intelligence Hosting LLC"],"org.srcCnt":1,"usertype.dst":["business"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS197540 netcup GmbH","number":197540,"organization":{"name":"netcup GmbH"}},"bytes":0,"geo":{"country_iso_code":"DE"},"ip":"159.195.21.150","mac":["8a:41:d3:b8:0d:d3"],"mac-cnt":1,"packets":0,"port":28081},"dstRIR":"ARIN","ethertype":2048,"fileId":[82265],"firstPacket":1788147606642,"ipProtocol":6,"lastPacket":1788147606642,"length":0,"network":{"bytes":56,"community_id":"1:dbRSX2QqNsNP8rVPZFCe9EHwW98=","packets":1},"node":"spark-afae","packetPos":[-82265,1035301],"packetRange":{"gte":1788147606642,"lte":1788147606642},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51396 Pfcloud UG (haftungsbeschrankt)","number":51396,"organization":{"name":"Pfcloud UG (haftungsbeschrankt)"}},"bytes":56,"geo":{"country_iso_code":"NL"},"ip":"204.76.203.7","mac":["bc:0f:fe:38:0b:a3"],"mac-cnt":1,"packets":1,"port":48125},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"ARIN","srcTTL":[248],"srcTTLCnt":1,"tags":["sensor:netcup-ts","honeypot","netcup-ts"],"tagsCnt":3,"tcp":{"ja4t":["65535_00_00_00"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":3811087836},"totDataBytes":0} +{"@timestamp":1788148883937,"_id":"260831-I8sgWvskEvlO7oJiFu-t9c5r","_index":"arkime_sessions3-260831","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Pfcloud UG"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Intelligence Hosting LLC"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":0,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":0,"port":28081},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[82269],"firstPacket":1788147577359,"ipProtocol":6,"lastPacket":1788147577359,"length":0,"network":{"bytes":60,"community_id":"1:B0yrxm8bDXu6ToGSSt1iInp/Vz4=","packets":1},"node":"spark-afae","packetPos":[-82269,13856],"packetRange":{"gte":1788147577359,"lte":1788147577359},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51396 Pfcloud UG (haftungsbeschrankt)","number":51396,"organization":{"name":"Pfcloud UG (haftungsbeschrankt)"}},"bytes":60,"geo":{"country_iso_code":"NL"},"ip":"204.76.203.7","mac":["fc:bd:67:9d:2b:2b"],"mac-cnt":1,"packets":1,"port":36954},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcRIR":"ARIN","srcTTL":[244],"srcTTLCnt":1,"tags":["sensor:contabo-sponge-01-ts","honeypot","contabo-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["65535_00_00_00"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":2670894509},"totDataBytes":0} +{"@timestamp":1788147676391,"_id":"260831-Dcs5zKPV2XRG97YLmKK_7Uce","_index":"arkime_sessions3-260831","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Hetzner Online GmbH"],"isp.dstCnt":1,"isp.src":["Pfcloud UG"],"isp.srcCnt":1,"org.dst":["HETZNER-DC"],"org.dstCnt":1,"org.src":["Intelligence Hosting LLC"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS24940 Hetzner Online GmbH","number":24940,"organization":{"name":"Hetzner Online GmbH"}},"bytes":0,"geo":{"country_iso_code":"FI"},"ip":"89.167.72.144","mac":["92:00:07:4c:82:70"],"mac-cnt":1,"packets":0,"port":28081},"dstRIR":"RIPE","ethertype":2048,"fileId":[82260],"firstPacket":1788147460044,"ipProtocol":6,"lastPacket":1788147460044,"length":0,"network":{"bytes":54,"community_id":"1:8OzU4mEUJetGAdBY5Rr/O9PiV3k=","packets":1},"node":"spark-afae","packetPos":[-82260,117011],"packetRange":{"gte":1788147460044,"lte":1788147460044},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51396 Pfcloud UG (haftungsbeschrankt)","number":51396,"organization":{"name":"Pfcloud UG (haftungsbeschrankt)"}},"bytes":54,"geo":{"country_iso_code":"NL"},"ip":"204.76.203.7","mac":["d2:74:7f:6e:37:e3"],"mac-cnt":1,"packets":1,"port":54038},"spoofable":["true"],"spoofableCnt":1,"srcRIR":"ARIN","srcTTL":[244],"srcTTLCnt":1,"tags":["honeypot","sensor:sponge-01-ts","sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["65535_00_00_00"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":2401517767},"totDataBytes":0} +{"@timestamp":1788147083529,"_id":"260831-0TsJp3sQkDhDpbcOlWVTa-YT","_index":"arkime_sessions3-260831","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Kaopu Cloud HK Limited"],"isp.dstCnt":1,"isp.src":["Pfcloud UG"],"isp.srcCnt":1,"org.dst":["LightNode-BH"],"org.dstCnt":1,"org.src":["Intelligence Hosting LLC"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":0,"geo":{"country_iso_code":"BH"},"ip":"38.54.2.209","mac":["52:54:8f:9d:76:48"],"mac-cnt":1,"packets":0,"port":28081},"dstRIR":"ARIN","ethertype":2048,"fileId":[82257],"firstPacket":1788146846245,"ipProtocol":6,"lastPacket":1788146846245,"length":0,"network":{"bytes":54,"community_id":"1:MSgLJCXG1I2ewz18NJ9m65JI5Bg=","packets":1},"node":"spark-afae","packetPos":[-82257,560596],"packetRange":{"gte":1788146846245,"lte":1788146846245},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51396 Pfcloud UG (haftungsbeschrankt)","number":51396,"organization":{"name":"Pfcloud UG (haftungsbeschrankt)"}},"bytes":54,"geo":{"country_iso_code":"NL"},"ip":"204.76.203.7","mac":["98:44:ce:60:15:19"],"mac-cnt":1,"packets":1,"port":35781},"spoofable":["true"],"spoofableCnt":1,"srcDscp":[18],"srcDscpCnt":1,"srcOui":["Huawei Technologies Co.,Ltd"],"srcOuiCnt":1,"srcRIR":"ARIN","srcTTL":[241],"srcTTLCnt":1,"tags":["honeypot","sensor:bahrain-sponge-01-ts","bahrain-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["65535_00_00_00"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":1044021387},"totDataBytes":0} +{"@timestamp":1788147374914,"_id":"260831-AsunotNlsyNCAojI1Az-mJNn","_index":"arkime_sessions3-260831","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["netcup GmbH"],"isp.dstCnt":1,"isp.src":["Pfcloud UG"],"isp.srcCnt":1,"org.dst":["Netcup KVM"],"org.dstCnt":1,"org.src":["Intelligence Hosting LLC"],"org.srcCnt":1,"usertype.dst":["business"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS197540 netcup GmbH","number":197540,"organization":{"name":"netcup GmbH"}},"bytes":0,"geo":{"country_iso_code":"DE"},"ip":"159.195.21.150","mac":["8a:41:d3:b8:0d:d3"],"mac-cnt":1,"packets":0,"port":28737},"dstRIR":"ARIN","ethertype":2048,"fileId":[82258],"firstPacket":1788146230620,"ipProtocol":6,"lastPacket":1788146230620,"length":0,"network":{"bytes":56,"community_id":"1:CkjeLKr8x3GF1nYMSiLLUoJNEsk=","packets":1},"node":"spark-afae","packetPos":[-82258,36123],"packetRange":{"gte":1788146230620,"lte":1788146230620},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51396 Pfcloud UG (haftungsbeschrankt)","number":51396,"organization":{"name":"Pfcloud UG (haftungsbeschrankt)"}},"bytes":56,"geo":{"country_iso_code":"NL"},"ip":"204.76.203.7","mac":["bc:0f:fe:38:0b:a3"],"mac-cnt":1,"packets":1,"port":46344},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"ARIN","srcTTL":[248],"srcTTLCnt":1,"tags":["sensor:netcup-ts","honeypot","netcup-ts"],"tagsCnt":3,"tcp":{"ja4t":["65535_00_00_00"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":2074613938},"totDataBytes":0} +{"@timestamp":1788147074909,"_id":"260831-CEX_ANKS7ilPO5HokAv1udc6","_index":"arkime_sessions3-260831","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Hetzner Online GmbH"],"isp.dstCnt":1,"isp.src":["Pfcloud UG"],"isp.srcCnt":1,"org.dst":["HETZNER-DC"],"org.dstCnt":1,"org.src":["Intelligence Hosting LLC"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS24940 Hetzner Online GmbH","number":24940,"organization":{"name":"Hetzner Online GmbH"}},"bytes":0,"geo":{"country_iso_code":"FI"},"ip":"89.167.72.144","mac":["92:00:07:4c:82:70"],"mac-cnt":1,"packets":0,"port":28737},"dstRIR":"RIPE","ethertype":2048,"fileId":[82255],"firstPacket":1788145746196,"ipProtocol":6,"lastPacket":1788145746196,"length":0,"network":{"bytes":54,"community_id":"1:fgL2nSmHUtdJi/BfWQb9KJT8tQE=","packets":1},"node":"spark-afae","packetPos":[-82255,14642],"packetRange":{"gte":1788145746196,"lte":1788145746196},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51396 Pfcloud UG (haftungsbeschrankt)","number":51396,"organization":{"name":"Pfcloud UG (haftungsbeschrankt)"}},"bytes":54,"geo":{"country_iso_code":"NL"},"ip":"204.76.203.7","mac":["d2:74:7f:6e:37:e3"],"mac-cnt":1,"packets":1,"port":39967},"spoofable":["true"],"spoofableCnt":1,"srcRIR":"ARIN","srcTTL":[244],"srcTTLCnt":1,"tags":["honeypot","sponge-01-ts","sensor:sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["65535_00_00_00"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":1982015715},"totDataBytes":0} +{"@timestamp":1788146494854,"_id":"260831-uzvs6uAfekpNy7DK5-h80W9J","_index":"arkime_sessions3-260831","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Kaopu Cloud HK Limited"],"isp.dstCnt":1,"isp.src":["Pfcloud UG"],"isp.srcCnt":1,"org.dst":["LightNode-BH"],"org.dstCnt":1,"org.src":["Intelligence Hosting LLC"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":0,"geo":{"country_iso_code":"BH"},"ip":"38.54.2.209","mac":["52:54:8f:9d:76:48"],"mac-cnt":1,"packets":0,"port":28737},"dstRIR":"ARIN","ethertype":2048,"fileId":[82252],"firstPacket":1788145716945,"ipProtocol":6,"lastPacket":1788145716945,"length":0,"network":{"bytes":54,"community_id":"1:wrg3sI3SRFoviQNeC8spveR/WH8=","packets":1},"node":"spark-afae","packetPos":[-82252,884308],"packetRange":{"gte":1788145716945,"lte":1788145716945},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51396 Pfcloud UG (haftungsbeschrankt)","number":51396,"organization":{"name":"Pfcloud UG (haftungsbeschrankt)"}},"bytes":54,"geo":{"country_iso_code":"NL"},"ip":"204.76.203.7","mac":["98:44:ce:60:15:19"],"mac-cnt":1,"packets":1,"port":36430},"spoofable":["true"],"spoofableCnt":1,"srcDscp":[18],"srcDscpCnt":1,"srcOui":["Huawei Technologies Co.,Ltd"],"srcOuiCnt":1,"srcRIR":"ARIN","srcTTL":[240],"srcTTLCnt":1,"tags":["sensor:bahrain-sponge-01-ts","honeypot","bahrain-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["65535_00_00_00"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":3520137893},"totDataBytes":0} +{"@timestamp":1788146174260,"_id":"260831-sDtvkzMUcgVCEqrX1gnb-1_n","_index":"arkime_sessions3-260831","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Pfcloud UG"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Intelligence Hosting LLC"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":0,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":0,"port":28737},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[82250],"firstPacket":1788145222326,"ipProtocol":6,"lastPacket":1788145222326,"length":0,"network":{"bytes":60,"community_id":"1:4Uu49h5N8ckBmkBIWAhiutHG4mw=","packets":1},"node":"spark-afae","packetPos":[-82250,831221],"packetRange":{"gte":1788145222326,"lte":1788145222326},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51396 Pfcloud UG (haftungsbeschrankt)","number":51396,"organization":{"name":"Pfcloud UG (haftungsbeschrankt)"}},"bytes":60,"geo":{"country_iso_code":"NL"},"ip":"204.76.203.7","mac":["fc:bd:67:9d:2b:2b"],"mac-cnt":1,"packets":1,"port":51006},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcRIR":"ARIN","srcTTL":[245],"srcTTLCnt":1,"tags":["contabo-sponge-01-ts","honeypot","sensor:contabo-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["65535_00_00_00"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":633549532},"totDataBytes":0} +{"@timestamp":1788144952910,"_id":"260831-hDvRgsA5U_NF7ZNZjHIun7wL","_index":"arkime_sessions3-260831","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["Pfcloud UG"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["Intelligence Hosting LLC"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":0,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":0,"port":28737},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstRIR":"ARIN","ethertype":2048,"fileId":[82242],"firstPacket":1788144137339,"ipProtocol":6,"lastPacket":1788144137339,"length":0,"network":{"bytes":58,"community_id":"1:186GAncU/3vHGppCQQHejNgFoF8=","packets":1},"node":"spark-afae","packetPos":[-82242,1944185],"packetRange":{"gte":1788144137339,"lte":1788144137339},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51396 Pfcloud UG (haftungsbeschrankt)","number":51396,"organization":{"name":"Pfcloud UG (haftungsbeschrankt)"}},"bytes":58,"geo":{"country_iso_code":"NL"},"ip":"204.76.203.7","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":1,"port":41855},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"ARIN","srcTTL":[240],"srcTTLCnt":1,"tags":["frantech-ts","sensor:frantech-ts","honeypot"],"tagsCnt":3,"tcp":{"ja4t":["65535_2_536_00"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":1994800064},"totDataBytes":0} +{"@timestamp":1788144649090,"_id":"260831-tcopAwZ2Eb1HRr9NUNuMIAVJ","_index":"arkime_sessions3-260831","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo GmbH"],"isp.dstCnt":1,"isp.src":["Pfcloud UG"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Intelligence Hosting LLC"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS51167 Contabo GmbH","number":51167,"organization":{"name":"Contabo GmbH"}},"bytes":0,"geo":{"country_iso_code":"FR"},"ip":"109.123.246.142","mac":["00:50:56:63:46:a6"],"mac-cnt":1,"packets":0,"port":28737},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[82240],"firstPacket":1788143407617,"ipProtocol":6,"lastPacket":1788143407617,"length":0,"network":{"bytes":60,"community_id":"1:NNS8pRAu8ATPKTm0FaKX/whrB+E=","packets":1},"node":"spark-afae","packetPos":[-82240,40841],"packetRange":{"gte":1788143407617,"lte":1788143407617},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51396 Pfcloud UG (haftungsbeschrankt)","number":51396,"organization":{"name":"Pfcloud UG (haftungsbeschrankt)"}},"bytes":60,"geo":{"country_iso_code":"NL"},"ip":"204.76.203.7","mac":["c0:69:11:cd:1f:19"],"mac-cnt":1,"packets":1,"port":34948},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcRIR":"ARIN","srcTTL":[244],"srcTTLCnt":1,"tags":["sensor:contabo-sponge-02-ts","proxy","contabo-sponge-02-ts"],"tagsCnt":3,"tcp":{"ja4t":["65535_00_00_00"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":2733053383},"totDataBytes":0} +{"@timestamp":1788143141039,"_id":"260831-QjtCWYAeLaBCj6uyfg52qblO","_index":"arkime_sessions3-260831","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["Pfcloud UG"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["Intelligence Hosting LLC"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":0,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":0,"port":28888},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstRIR":"ARIN","ethertype":2048,"fileId":[82231],"firstPacket":1788142670917,"ipProtocol":6,"lastPacket":1788142670917,"length":0,"network":{"bytes":58,"community_id":"1:iyM6UTyYMdH+UTYck38wEKjLnhk=","packets":1},"node":"spark-afae","packetPos":[-82231,5164303],"packetRange":{"gte":1788142670917,"lte":1788142670917},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51396 Pfcloud UG (haftungsbeschrankt)","number":51396,"organization":{"name":"Pfcloud UG (haftungsbeschrankt)"}},"bytes":58,"geo":{"country_iso_code":"NL"},"ip":"204.76.203.7","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":1,"port":53908},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"ARIN","srcTTL":[242],"srcTTLCnt":1,"tags":["sensor:frantech-ts","honeypot","frantech-ts"],"tagsCnt":3,"tcp":{"ja4t":["65535_2_536_00"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":3354806349},"totDataBytes":0} +{"@timestamp":1788142533651,"_id":"260831-LDtfntzHvZhKppWC8VjqhVUn","_index":"arkime_sessions3-260831","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Pfcloud UG"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Intelligence Hosting LLC"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":0,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":0,"port":28888},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[82226],"firstPacket":1788142053701,"ipProtocol":6,"lastPacket":1788142053701,"length":0,"network":{"bytes":60,"community_id":"1:PmtImmjEFPLV3SFggwZFgSv+EPY=","packets":1},"node":"spark-afae","packetPos":[-82226,1314864],"packetRange":{"gte":1788142053701,"lte":1788142053701},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51396 Pfcloud UG (haftungsbeschrankt)","number":51396,"organization":{"name":"Pfcloud UG (haftungsbeschrankt)"}},"bytes":60,"geo":{"country_iso_code":"NL"},"ip":"204.76.203.7","mac":["fc:bd:67:9d:2b:2b"],"mac-cnt":1,"packets":1,"port":36469},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcRIR":"ARIN","srcTTL":[244],"srcTTLCnt":1,"tags":["sensor:contabo-sponge-01-ts","honeypot","contabo-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["65535_00_00_00"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":3132311412},"totDataBytes":0} +{"@timestamp":1788143140287,"_id":"260831-lMqU-6gz5ZlHT5Xcuy6t3mAE","_index":"arkime_sessions3-260831","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["netcup GmbH"],"isp.dstCnt":1,"isp.src":["Pfcloud UG"],"isp.srcCnt":1,"org.dst":["Netcup KVM"],"org.dstCnt":1,"org.src":["Intelligence Hosting LLC"],"org.srcCnt":1,"usertype.dst":["business"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS197540 netcup GmbH","number":197540,"organization":{"name":"netcup GmbH"}},"bytes":0,"geo":{"country_iso_code":"DE"},"ip":"159.195.21.150","mac":["8a:41:d3:b8:0d:d3"],"mac-cnt":1,"packets":0,"port":28888},"dstRIR":"ARIN","ethertype":2048,"fileId":[82229],"firstPacket":1788141859533,"ipProtocol":6,"lastPacket":1788141859533,"length":0,"network":{"bytes":56,"community_id":"1:ZV6Q+/8xGe4CeJmJG7oE5MusTos=","packets":1},"node":"spark-afae","packetPos":[-82229,54484],"packetRange":{"gte":1788141859533,"lte":1788141859533},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51396 Pfcloud UG (haftungsbeschrankt)","number":51396,"organization":{"name":"Pfcloud UG (haftungsbeschrankt)"}},"bytes":56,"geo":{"country_iso_code":"NL"},"ip":"204.76.203.7","mac":["bc:0f:fe:38:0b:a3"],"mac-cnt":1,"packets":1,"port":42629},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"ARIN","srcTTL":[248],"srcTTLCnt":1,"tags":["netcup-ts","sensor:netcup-ts","honeypot"],"tagsCnt":3,"tcp":{"ja4t":["65535_00_00_00"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":4024736387},"totDataBytes":0} +{"@timestamp":1788142856402,"_id":"260831-NzuqVaSzt-NLc6cyQkVIj2-I","_index":"arkime_sessions3-260831","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Kaopu Cloud HK Limited"],"isp.dstCnt":1,"isp.src":["Pfcloud UG"],"isp.srcCnt":1,"org.dst":["LightNode-BH"],"org.dstCnt":1,"org.src":["Intelligence Hosting LLC"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":0,"geo":{"country_iso_code":"BH"},"ip":"38.54.2.209","mac":["52:54:8f:9d:76:48"],"mac-cnt":1,"packets":0,"port":28888},"dstRIR":"ARIN","ethertype":2048,"fileId":[82228],"firstPacket":1788141786888,"ipProtocol":6,"lastPacket":1788141786888,"length":0,"network":{"bytes":54,"community_id":"1:wcmpDWImB3TPBI0FQW3De5JQw7U=","packets":1},"node":"spark-afae","packetPos":[-82228,388989],"packetRange":{"gte":1788141786888,"lte":1788141786888},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51396 Pfcloud UG (haftungsbeschrankt)","number":51396,"organization":{"name":"Pfcloud UG (haftungsbeschrankt)"}},"bytes":54,"geo":{"country_iso_code":"NL"},"ip":"204.76.203.7","mac":["98:44:ce:60:15:19"],"mac-cnt":1,"packets":1,"port":53194},"spoofable":["true"],"spoofableCnt":1,"srcDscp":[18],"srcDscpCnt":1,"srcOui":["Huawei Technologies Co.,Ltd"],"srcOuiCnt":1,"srcRIR":"ARIN","srcTTL":[241],"srcTTLCnt":1,"tags":["honeypot","sensor:bahrain-sponge-01-ts","bahrain-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["65535_00_00_00"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":1898245424},"totDataBytes":0} +{"@timestamp":1788142233089,"_id":"260831-fsotzh_aFgBCZ7akNQmHyKhM","_index":"arkime_sessions3-260831","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Hetzner Online GmbH"],"isp.dstCnt":1,"isp.src":["Pfcloud UG"],"isp.srcCnt":1,"org.dst":["HETZNER-DC"],"org.dstCnt":1,"org.src":["Intelligence Hosting LLC"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS24940 Hetzner Online GmbH","number":24940,"organization":{"name":"Hetzner Online GmbH"}},"bytes":0,"geo":{"country_iso_code":"FI"},"ip":"89.167.72.144","mac":["92:00:07:4c:82:70"],"mac-cnt":1,"packets":0,"port":28888},"dstRIR":"RIPE","ethertype":2048,"fileId":[82224],"firstPacket":1788141676153,"ipProtocol":6,"lastPacket":1788141676153,"length":0,"network":{"bytes":54,"community_id":"1:mnlGOofWoOo3WP2Q8bEKgfiUAYQ=","packets":1},"node":"spark-afae","packetPos":[-82224,92246],"packetRange":{"gte":1788141676153,"lte":1788141676153},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51396 Pfcloud UG (haftungsbeschrankt)","number":51396,"organization":{"name":"Pfcloud UG (haftungsbeschrankt)"}},"bytes":54,"geo":{"country_iso_code":"NL"},"ip":"204.76.203.7","mac":["d2:74:7f:6e:37:e3"],"mac-cnt":1,"packets":1,"port":38480},"spoofable":["true"],"spoofableCnt":1,"srcRIR":"ARIN","srcTTL":[245],"srcTTLCnt":1,"tags":["sponge-01-ts","honeypot","sensor:sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["65535_00_00_00"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":814544853},"totDataBytes":0} +{"@timestamp":1788141628493,"_id":"260831-KQr6tJ9lrA9JP5ZLYpvfSyke","_index":"arkime_sessions3-260831","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo GmbH"],"isp.dstCnt":1,"isp.src":["Pfcloud UG"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Intelligence Hosting LLC"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS51167 Contabo GmbH","number":51167,"organization":{"name":"Contabo GmbH"}},"bytes":0,"geo":{"country_iso_code":"FR"},"ip":"109.123.246.142","mac":["00:50:56:63:46:a6"],"mac-cnt":1,"packets":0,"port":28888},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[82217],"firstPacket":1788141042802,"ipProtocol":6,"lastPacket":1788141042802,"length":0,"network":{"bytes":60,"community_id":"1:h/TRCwKYBlgAYM5lPena7X6L80g=","packets":1},"node":"spark-afae","packetPos":[-82217,202016],"packetRange":{"gte":1788141042802,"lte":1788141042802},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51396 Pfcloud UG (haftungsbeschrankt)","number":51396,"organization":{"name":"Pfcloud UG (haftungsbeschrankt)"}},"bytes":60,"geo":{"country_iso_code":"NL"},"ip":"204.76.203.7","mac":["c0:69:11:cd:1f:19"],"mac-cnt":1,"packets":1,"port":51559},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcRIR":"ARIN","srcTTL":[243],"srcTTLCnt":1,"tags":["contabo-sponge-02-ts","sensor:contabo-sponge-02-ts","proxy"],"tagsCnt":3,"tcp":{"ja4t":["65535_00_00_00"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":2005429026},"totDataBytes":0} +{"@timestamp":1788141014144,"_id":"260831-9TqJvboli1lLGZ8u2m_abld0","_index":"arkime_sessions3-260831","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["netcup GmbH"],"isp.dstCnt":1,"isp.src":["Pfcloud UG"],"isp.srcCnt":1,"org.dst":["Netcup KVM"],"org.dstCnt":1,"org.src":["Intelligence Hosting LLC"],"org.srcCnt":1,"usertype.dst":["business"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS197540 netcup GmbH","number":197540,"organization":{"name":"netcup GmbH"}},"bytes":0,"geo":{"country_iso_code":"DE"},"ip":"159.195.21.150","mac":["8a:41:d3:b8:0d:d3"],"mac-cnt":1,"packets":0,"port":29290},"dstRIR":"ARIN","ethertype":2048,"fileId":[82216],"firstPacket":1788139838296,"ipProtocol":6,"lastPacket":1788139838296,"length":0,"network":{"bytes":56,"community_id":"1:nPknmfT9Uzdo90wn4vCb93XGhEA=","packets":1},"node":"spark-afae","packetPos":[-82216,2315],"packetRange":{"gte":1788139838296,"lte":1788139838296},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51396 Pfcloud UG (haftungsbeschrankt)","number":51396,"organization":{"name":"Pfcloud UG (haftungsbeschrankt)"}},"bytes":56,"geo":{"country_iso_code":"NL"},"ip":"204.76.203.7","mac":["bc:0f:fe:38:0b:a3"],"mac-cnt":1,"packets":1,"port":37436},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"ARIN","srcTTL":[248],"srcTTLCnt":1,"tags":["netcup-ts","honeypot","sensor:netcup-ts"],"tagsCnt":3,"tcp":{"ja4t":["65535_00_00_00"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":2318213173},"totDataBytes":0} +{"@timestamp":1788139190881,"_id":"260831-MMroVL7mzCNDX5a3aii20JJi","_index":"arkime_sessions3-260831","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Pfcloud UG"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Intelligence Hosting LLC"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":0,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":0,"port":29290},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[82204],"firstPacket":1788137901044,"ipProtocol":6,"lastPacket":1788137901044,"length":0,"network":{"bytes":60,"community_id":"1:atU3tFQqdFkeJafji1nGACr6nh0=","packets":1},"node":"spark-afae","packetPos":[-82204,289362],"packetRange":{"gte":1788137901044,"lte":1788137901044},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51396 Pfcloud UG (haftungsbeschrankt)","number":51396,"organization":{"name":"Pfcloud UG (haftungsbeschrankt)"}},"bytes":60,"geo":{"country_iso_code":"NL"},"ip":"204.76.203.7","mac":["fc:bd:67:9d:2b:2b"],"mac-cnt":1,"packets":1,"port":56181},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcRIR":"ARIN","srcTTL":[245],"srcTTLCnt":1,"tags":["honeypot","sensor:contabo-sponge-01-ts","contabo-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["65535_00_00_00"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":3210504997},"totDataBytes":0} +{"@timestamp":1788138287861,"_id":"260831-GcpiyAiyi-RL_6o4jS9FHuCz","_index":"arkime_sessions3-260831","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo GmbH"],"isp.dstCnt":1,"isp.src":["Pfcloud UG"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Intelligence Hosting LLC"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS51167 Contabo GmbH","number":51167,"organization":{"name":"Contabo GmbH"}},"bytes":0,"geo":{"country_iso_code":"FR"},"ip":"109.123.246.142","mac":["00:50:56:63:46:a6"],"mac-cnt":1,"packets":0,"port":29290},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[82199],"firstPacket":1788137304413,"ipProtocol":6,"lastPacket":1788137304413,"length":0,"network":{"bytes":60,"community_id":"1:RtJV4cZ9vDYiEK3j8VaHxlgenh0=","packets":1},"node":"spark-afae","packetPos":[-82199,131994],"packetRange":{"gte":1788137304413,"lte":1788137304413},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51396 Pfcloud UG (haftungsbeschrankt)","number":51396,"organization":{"name":"Pfcloud UG (haftungsbeschrankt)"}},"bytes":60,"geo":{"country_iso_code":"NL"},"ip":"204.76.203.7","mac":["c0:69:11:cd:1f:19"],"mac-cnt":1,"packets":1,"port":50256},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcRIR":"ARIN","srcTTL":[244],"srcTTLCnt":1,"tags":["sensor:contabo-sponge-02-ts","proxy","contabo-sponge-02-ts"],"tagsCnt":3,"tcp":{"ja4t":["65535_00_00_00"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":971956736},"totDataBytes":0} +{"@timestamp":1788138286732,"_id":"260831-nToxLYpLoFpGqJvjVu9mOVQ3","_index":"arkime_sessions3-260831","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Kaopu Cloud HK Limited"],"isp.dstCnt":1,"isp.src":["Pfcloud UG"],"isp.srcCnt":1,"org.dst":["LightNode-BH"],"org.dstCnt":1,"org.src":["Intelligence Hosting LLC"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":0,"geo":{"country_iso_code":"BH"},"ip":"38.54.2.209","mac":["52:54:8f:9d:76:48"],"mac-cnt":1,"packets":0,"port":29290},"dstRIR":"ARIN","ethertype":2048,"fileId":[82198],"firstPacket":1788137187576,"ipProtocol":6,"lastPacket":1788137187576,"length":0,"network":{"bytes":54,"community_id":"1:OtZs9E6l/uBhIOK9/c0ej6VmAH8=","packets":1},"node":"spark-afae","packetPos":[-82198,6758],"packetRange":{"gte":1788137187576,"lte":1788137187576},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51396 Pfcloud UG (haftungsbeschrankt)","number":51396,"organization":{"name":"Pfcloud UG (haftungsbeschrankt)"}},"bytes":54,"geo":{"country_iso_code":"NL"},"ip":"204.76.203.7","mac":["98:44:ce:60:15:19"],"mac-cnt":1,"packets":1,"port":42959},"spoofable":["true"],"spoofableCnt":1,"srcDscp":[18],"srcDscpCnt":1,"srcOui":["Huawei Technologies Co.,Ltd"],"srcOuiCnt":1,"srcRIR":"ARIN","srcTTL":[241],"srcTTLCnt":1,"tags":["bahrain-sponge-01-ts","honeypot","sensor:bahrain-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["65535_00_00_00"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":1015653785},"totDataBytes":0} +{"@timestamp":1788137986733,"_id":"260831-Dspvptefz-5K36vNbDaZ4_Wp","_index":"arkime_sessions3-260831","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["Pfcloud UG"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["Intelligence Hosting LLC"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":0,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":0,"port":29290},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstRIR":"ARIN","ethertype":2048,"fileId":[82196],"firstPacket":1788137182080,"ipProtocol":6,"lastPacket":1788137182080,"length":0,"network":{"bytes":58,"community_id":"1:a5HrDeKV+ApRgP/AQKXp0p5VX6Y=","packets":1},"node":"spark-afae","packetPos":[-82196,1549327],"packetRange":{"gte":1788137182080,"lte":1788137182080},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51396 Pfcloud UG (haftungsbeschrankt)","number":51396,"organization":{"name":"Pfcloud UG (haftungsbeschrankt)"}},"bytes":58,"geo":{"country_iso_code":"NL"},"ip":"204.76.203.7","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":1,"port":37856},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"ARIN","srcTTL":[242],"srcTTLCnt":1,"tags":["sensor:frantech-ts","frantech-ts","honeypot"],"tagsCnt":3,"tcp":{"ja4t":["65535_2_536_00"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":3762767177},"totDataBytes":0} +{"@timestamp":1788137987098,"_id":"260831-mkQYYLJsuKtPo6-Q3DMKtvu-","_index":"arkime_sessions3-260831","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Hetzner Online GmbH"],"isp.dstCnt":1,"isp.src":["Pfcloud UG"],"isp.srcCnt":1,"org.dst":["HETZNER-DC"],"org.dstCnt":1,"org.src":["Intelligence Hosting LLC"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS24940 Hetzner Online GmbH","number":24940,"organization":{"name":"Hetzner Online GmbH"}},"bytes":0,"geo":{"country_iso_code":"FI"},"ip":"89.167.72.144","mac":["92:00:07:4c:82:70"],"mac-cnt":1,"packets":0,"port":29290},"dstRIR":"RIPE","ethertype":2048,"fileId":[82194],"firstPacket":1788137045828,"ipProtocol":6,"lastPacket":1788137045828,"length":0,"network":{"bytes":54,"community_id":"1:8ZzqLH2LgTFzGL9qqtCoyG8qEJc=","packets":1},"node":"spark-afae","packetPos":[-82194,43996],"packetRange":{"gte":1788137045828,"lte":1788137045828},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51396 Pfcloud UG (haftungsbeschrankt)","number":51396,"organization":{"name":"Pfcloud UG (haftungsbeschrankt)"}},"bytes":54,"geo":{"country_iso_code":"NL"},"ip":"204.76.203.7","mac":["d2:74:7f:6e:37:e3"],"mac-cnt":1,"packets":1,"port":43711},"spoofable":["true"],"spoofableCnt":1,"srcRIR":"ARIN","srcTTL":[244],"srcTTLCnt":1,"tags":["sensor:sponge-01-ts","honeypot","sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["65535_00_00_00"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":763123731},"totDataBytes":0} +{"@timestamp":1788137985762,"_id":"260831-DsopHMe1xMJIU7Q-9sDMcX72","_index":"arkime_sessions3-260831","client":{"bytes":3},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["Pfcloud UG"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["Intelligence Hosting LLC"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":800,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":12,"port":30000},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[82196],"firstPacket":1788136681801,"initRTT":65,"ipProtocol":6,"lastPacket":1788136771666,"length":89865,"network":{"bytes":1801,"community_id":"1:dnZ/SB1Uy7k3VqZW6IcyNPcloSw=","packets":27},"node":"spark-afae","packetPos":[-82196,212045,90,230,82,85,13576,82,0,614,14483,82,152,0,16223,82,484,222,28027,82,152,0,18369,82,0,402,11294,82],"packetRange":{"gte":1788136681801,"lte":1788136771666},"protocol":["tcp"],"protocolCnt":1,"rootId":"260831-DsopHMe1xMJIU7Q-9sDMcX72","segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51396 Pfcloud UG (haftungsbeschrankt)","number":51396,"organization":{"name":"Pfcloud UG (haftungsbeschrankt)"}},"bytes":1001,"geo":{"country_iso_code":"NL"},"ip":"204.76.203.7","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":15,"port":34526},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcPayload8":"050100","srcRIR":"ARIN","srcTTL":[50],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":["Attempted Information Leak",""],"categoryCnt":2,"flowId":["344489378686822"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[2,3],"severityCnt":2,"signature":["553b5765-6241-4e9a-9982-0ca113796134","5a66c944-faed-4791-9d94-b44b7bd48352"],"signatureCnt":2,"signatureId":[1031235,2000181],"signatureIdCnt":2},"tags":["sensor:frantech-ts","frantech-ts","honeypot"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-4-8-1-3_1400_7"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":22,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":1,"psh":1,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":4240499847},"totDataBytes":3} +{"@timestamp":1788136786557,"_id":"260831-cTru6y_bsQFHpIRRi3GcsNB2","_index":"arkime_sessions3-260831","client":{"bytes":125},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["Pfcloud UG"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["Intelligence Hosting LLC"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":625,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":5,"port":30000},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstPayload8":"485454502f312e31","dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[82189],"firstPacket":1788136533803,"http":{"bodyMagic":["text/html"],"bodyMagicCnt":1,"clientVersion":["1.1"],"clientVersionCnt":1,"host":["azenv.net"],"hostCnt":1,"ja4h":["ge11nn040000_8391bea91fb6_000000000000_000000000000"],"ja4hCnt":1,"ja4h_r":["ge11nn040000_Host,User-Agent,Accept-Encoding,Connection__"],"ja4h_rCnt":1,"md5":["0f87454a3ea15f0db55ae928dbcd82fc"],"md5Cnt":1,"method":["GET"],"method-GET":1,"methodCnt":1,"path":["http://azenv.net/"],"pathCnt":1,"requestHeader":["accept-encoding","host","connection","user-agent"],"requestHeaderCnt":4,"requestHeaderField":["accept-encoding","connection"],"requestHeaderValue":["gzip","close"],"requestHeaderValueCnt":2,"response-server":["Apache/2.4.41 (Ubuntu)"],"response-serverCnt":1,"response-x-powered-by":["PHP/7.4.3"],"response-x-powered-byCnt":1,"responseHeader":["date","server","connection","content-type","x-powered-by","content-length"],"responseHeaderCnt":6,"responseHeaderField":["connection","content-type","date","content-length"],"responseHeaderValue":["close","text/plain; charset=utf-8","mon, 31 aug 2026 00:35:33 gmt","94"],"responseHeaderValueCnt":4,"serverVersion":["1.1"],"serverVersionCnt":1,"sha256":["1ca624415b2889dbeb3f969890b848b7bc5eaf96ca5e8fdd7461f943b45d10cb"],"sha256Cnt":1,"statuscode":[200],"statuscodeCnt":1,"uri":["http://azenv.net/"],"uriCnt":1,"useragent":["Go-http-client/1.1"],"useragentCnt":1},"initRTT":64,"ipProtocol":6,"lastPacket":1788136534060,"length":257,"network":{"bytes":1088,"community_id":"1:xqd7qCbRjQjmFP9xG2+V9vAEono=","packets":10},"node":"spark-afae","packetPos":[-82189,15376489,90,230,82,207,82,369,82,0,0],"packetRange":{"gte":1788136533803,"lte":1788136534060},"protocol":["http","tcp"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":287},"source":{"as":{"full":"AS51396 Pfcloud UG (haftungsbeschrankt)","number":51396,"organization":{"name":"Pfcloud UG (haftungsbeschrankt)"}},"bytes":463,"geo":{"country_iso_code":"NL"},"ip":"204.76.203.7","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":5,"port":44396},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcPayload8":"4745542068747470","srcRIR":"ARIN","srcTTL":[50],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["1479308480467253"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["ee583a2e-d308-4c53-b8e2-a1cd45cd1bb7","ce8622a8-6d2f-4fe3-ab81-0cc86e19363e","3d144850-efcc-436a-9008-c5d28ac581ae","23e6932c-e2bd-48cf-80b8-aa98ae9276c4","869feaa1-dc77-4037-aee2-247b7a39cf7d"],"signatureCnt":5,"signatureId":[2000166,1070034,1030619,1031486,2000008],"signatureIdCnt":5},"tag":{"block":["true","false"],"blockCnt":2,"category":["activity","protocol","tool","attack","recon"],"categoryCnt":5,"cves":[""],"cvesCnt":1,"description":["cloud credential scanning probe detected. requests for sensitive configuration files and credentials indicate automated scanning for exposed secrets and api keys.","generic web crawler traffic detected. the simple pattern of get requests without specific exploitation indicators suggests automated crawling activity, possibly for search indexing or vulnerability scanning.","ip addresses with this tag have been seen crawling http(s) servers around the internet.","ip addresses with this tag have been observed crawling the internet for unauthenticated web proxies and testing if they are functional.","ip addresses with this tag have been observed scanning the internet using the golang http client."],"intention":["suspicious","unknown","malicious"],"intentionCnt":3,"name":["go http client","open proxy scanner","web crawler","root path scanner"],"nameCnt":4},"tags":["sensor:frantech-ts","honeypot","frantech-ts"],"tagsCnt":3,"tcp":{"ja4ls":"79_64_tcp","ja4t":["64240_2-4-8-1-3_1400_7"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":4,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":2,"psh":2,"rst":0,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":799213434},"totDataBytes":412} +{"@timestamp":1788136482173,"_id":"260831-hETy3lZp1Q9K2YJUafKnpV4V","_index":"arkime_sessions3-260831","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["netcup GmbH"],"isp.dstCnt":1,"isp.src":["Pfcloud UG"],"isp.srcCnt":1,"org.dst":["Netcup KVM"],"org.dstCnt":1,"org.src":["Intelligence Hosting LLC"],"org.srcCnt":1,"usertype.dst":["business"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS197540 netcup GmbH","number":197540,"organization":{"name":"netcup GmbH"}},"bytes":0,"geo":{"country_iso_code":"DE"},"ip":"159.195.21.150","mac":["8a:41:d3:b8:0d:d3"],"mac-cnt":1,"packets":0,"port":30000},"dstRIR":"ARIN","ethertype":2048,"fileId":[82185],"firstPacket":1788136099667,"ipProtocol":6,"lastPacket":1788136099667,"length":0,"network":{"bytes":56,"community_id":"1:HTzAAZF1Pjr/t8fiUd8uKjOINR4=","packets":1},"node":"spark-afae","packetPos":[-82185,823320],"packetRange":{"gte":1788136099667,"lte":1788136099667},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51396 Pfcloud UG (haftungsbeschrankt)","number":51396,"organization":{"name":"Pfcloud UG (haftungsbeschrankt)"}},"bytes":56,"geo":{"country_iso_code":"NL"},"ip":"204.76.203.7","mac":["bc:0f:fe:38:0b:a3"],"mac-cnt":1,"packets":1,"port":54356},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"ARIN","srcTTL":[248],"srcTTLCnt":1,"tags":["honeypot","netcup-ts","sensor:netcup-ts"],"tagsCnt":3,"tcp":{"ja4t":["65535_00_00_00"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":1993494910},"totDataBytes":0} +{"@timestamp":1788135280511,"_id":"260831-OjrDOSAvVXNOoa7pxf-6bw4K","_index":"arkime_sessions3-260831","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Pfcloud UG"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Intelligence Hosting LLC"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":0,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":0,"port":30000},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[82178],"firstPacket":1788134851910,"ipProtocol":6,"lastPacket":1788134851910,"length":0,"network":{"bytes":60,"community_id":"1:8eHc8D7H++r4EPcFE85cyVid7gM=","packets":1},"node":"spark-afae","packetPos":[-82178,1687187],"packetRange":{"gte":1788134851910,"lte":1788134851910},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51396 Pfcloud UG (haftungsbeschrankt)","number":51396,"organization":{"name":"Pfcloud UG (haftungsbeschrankt)"}},"bytes":60,"geo":{"country_iso_code":"NL"},"ip":"204.76.203.7","mac":["fc:bd:67:9d:2b:2b"],"mac-cnt":1,"packets":1,"port":51057},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcRIR":"ARIN","srcTTL":[245],"srcTTLCnt":1,"tags":["honeypot","contabo-sponge-01-ts","sensor:contabo-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["65535_00_00_00"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":3848156381},"totDataBytes":0} +{"@timestamp":1788135579890,"_id":"260830-zMlZllLV5gpEQoZXHWAsNt-u","_index":"arkime_sessions3-260830","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo GmbH"],"isp.dstCnt":1,"isp.src":["Pfcloud UG"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Intelligence Hosting LLC"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS51167 Contabo GmbH","number":51167,"organization":{"name":"Contabo GmbH"}},"bytes":0,"geo":{"country_iso_code":"FR"},"ip":"109.123.246.142","mac":["00:50:56:63:46:a6"],"mac-cnt":1,"packets":0,"port":30000},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[82180],"firstPacket":1788134339309,"ipProtocol":6,"lastPacket":1788134339309,"length":0,"network":{"bytes":60,"community_id":"1:gPXH77EEO9Pt4fCIYYnm6/ql6Kc=","packets":1},"node":"spark-afae","packetPos":[-82180,7466],"packetRange":{"gte":1788134339309,"lte":1788134339309},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51396 Pfcloud UG (haftungsbeschrankt)","number":51396,"organization":{"name":"Pfcloud UG (haftungsbeschrankt)"}},"bytes":60,"geo":{"country_iso_code":"NL"},"ip":"204.76.203.7","mac":["c0:69:11:cd:1f:19"],"mac-cnt":1,"packets":1,"port":46615},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcRIR":"ARIN","srcTTL":[244],"srcTTLCnt":1,"tags":["sensor:contabo-sponge-02-ts","proxy","contabo-sponge-02-ts"],"tagsCnt":3,"tcp":{"ja4t":["65535_00_00_00"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":481489574},"totDataBytes":0} +{"@timestamp":1788134978273,"_id":"260830-tsk4cYKkE4pDk4vQF97qthC4","_index":"arkime_sessions3-260830","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["Pfcloud UG"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["Intelligence Hosting LLC"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":58,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":1,"port":30000},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[82176],"firstPacket":1788134267818,"ipProtocol":6,"lastPacket":1788134267953,"length":135,"network":{"bytes":170,"community_id":"1:X3c6I/PPRmgeqkII4n/EIppGQFA=","packets":3},"node":"spark-afae","packetPos":[-82176,939475,74,2138],"packetRange":{"gte":1788134267818,"lte":1788134267953},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51396 Pfcloud UG (haftungsbeschrankt)","number":51396,"organization":{"name":"Pfcloud UG (haftungsbeschrankt)"}},"bytes":112,"geo":{"country_iso_code":"NL"},"ip":"204.76.203.7","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":2,"port":58875},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"ARIN","srcTTL":[51,242],"srcTTLCnt":2,"tags":["frantech-ts","honeypot","sensor:frantech-ts"],"tagsCnt":3,"tcp":{"ja4t":["65535_2_536_00"],"ja4tCnt":1,"ja4ts":["64240_2_1460_00"],"ja4tsCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":812891657},"totDataBytes":0} +{"@timestamp":1788134978785,"_id":"260830-Lzp7xs7DO-NGLqV9AZh8Vdmo","_index":"arkime_sessions3-260830","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Kaopu Cloud HK Limited"],"isp.dstCnt":1,"isp.src":["Pfcloud UG"],"isp.srcCnt":1,"org.dst":["LightNode-BH"],"org.dstCnt":1,"org.src":["Intelligence Hosting LLC"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":0,"geo":{"country_iso_code":"BH"},"ip":"38.54.2.209","mac":["52:54:8f:9d:76:48"],"mac-cnt":1,"packets":0,"port":30000},"dstRIR":"ARIN","ethertype":2048,"fileId":[82175],"firstPacket":1788133561287,"ipProtocol":6,"lastPacket":1788133561287,"length":0,"network":{"bytes":54,"community_id":"1:+HhfJ6Rt00pWASG5jOUpli2HHL0=","packets":1},"node":"spark-afae","packetPos":[-82175,4430],"packetRange":{"gte":1788133561287,"lte":1788133561287},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51396 Pfcloud UG (haftungsbeschrankt)","number":51396,"organization":{"name":"Pfcloud UG (haftungsbeschrankt)"}},"bytes":54,"geo":{"country_iso_code":"NL"},"ip":"204.76.203.7","mac":["98:44:ce:60:15:19"],"mac-cnt":1,"packets":1,"port":59914},"spoofable":["true"],"spoofableCnt":1,"srcDscp":[18],"srcDscpCnt":1,"srcOui":["Huawei Technologies Co.,Ltd"],"srcOuiCnt":1,"srcRIR":"ARIN","srcTTL":[241],"srcTTLCnt":1,"tags":["bahrain-sponge-01-ts","sensor:bahrain-sponge-01-ts","honeypot"],"tagsCnt":3,"tcp":{"ja4t":["65535_00_00_00"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":1620709661},"totDataBytes":0} +{"@timestamp":1788133477337,"_id":"260830-iskt59XOMzFITpZZM2yS_4rV","_index":"arkime_sessions3-260830","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Hetzner Online GmbH"],"isp.dstCnt":1,"isp.src":["Pfcloud UG"],"isp.srcCnt":1,"org.dst":["HETZNER-DC"],"org.dstCnt":1,"org.src":["Intelligence Hosting LLC"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS24940 Hetzner Online GmbH","number":24940,"organization":{"name":"Hetzner Online GmbH"}},"bytes":0,"geo":{"country_iso_code":"FI"},"ip":"89.167.72.144","mac":["92:00:07:4c:82:70"],"mac-cnt":1,"packets":0,"port":30000},"dstRIR":"RIPE","ethertype":2048,"fileId":[82165],"firstPacket":1788132679104,"ipProtocol":6,"lastPacket":1788132679104,"length":0,"network":{"bytes":54,"community_id":"1:7RHyzkE7qnPVX0DFCUmj6K/h7ig=","packets":1},"node":"spark-afae","packetPos":[-82165,80346],"packetRange":{"gte":1788132679104,"lte":1788132679104},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51396 Pfcloud UG (haftungsbeschrankt)","number":51396,"organization":{"name":"Pfcloud UG (haftungsbeschrankt)"}},"bytes":54,"geo":{"country_iso_code":"NL"},"ip":"204.76.203.7","mac":["d2:74:7f:6e:37:e3"],"mac-cnt":1,"packets":1,"port":48434},"spoofable":["true"],"spoofableCnt":1,"srcRIR":"ARIN","srcTTL":[244],"srcTTLCnt":1,"tags":["sensor:sponge-01-ts","sponge-01-ts","honeypot"],"tagsCnt":3,"tcp":{"ja4t":["65535_00_00_00"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":479118179},"totDataBytes":0} +{"@timestamp":1788133175638,"_id":"260830-7zkOf__-DqBC-bJLuSonnlnK","_index":"arkime_sessions3-260830","client":{"bytes":3},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["Pfcloud UG"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["Intelligence Hosting LLC"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":932,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":14,"port":30001},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[82164],"firstPacket":1788132161217,"initRTT":64,"ipProtocol":6,"lastPacket":1788132265007,"length":103790,"network":{"bytes":2065,"community_id":"1:5Df6HM6ZxUZJ/Vf6DJhc8cMQ9ko=","packets":31},"node":"spark-afae","packetPos":[-82164,170194,90,0,82,85,26191,82,246,344,18960,82,150,572,15364,82,246,164,15624,82,0,246,14673,82,1162,164,17415,82,0,246,15428,82],"packetRange":{"gte":1788132161217,"lte":1788132265007},"protocol":["tcp"],"protocolCnt":1,"rootId":"260830-7zkOf__-DqBC-bJLuSonnlnK","segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51396 Pfcloud UG (haftungsbeschrankt)","number":51396,"organization":{"name":"Pfcloud UG (haftungsbeschrankt)"}},"bytes":1133,"geo":{"country_iso_code":"NL"},"ip":"204.76.203.7","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":17,"port":53250},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcPayload8":"050100","srcRIR":"ARIN","srcTTL":[51],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":["Attempted Information Leak",""],"categoryCnt":2,"flowId":["370731583544697"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[2,3],"severityCnt":2,"signature":["5a66c944-faed-4791-9d94-b44b7bd48352","553b5765-6241-4e9a-9982-0ca113796134"],"signatureCnt":2,"signatureId":[1031235,2000181],"signatureIdCnt":2},"tags":["frantech-ts","sensor:frantech-ts","honeypot"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-4-8-1-3_1400_7"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":26,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":1,"psh":1,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":3233187118},"totDataBytes":3} +{"@timestamp":1788132273674,"_id":"260830-zjlxXgOvDYpKia068YY7cus4","_index":"arkime_sessions3-260830","client":{"bytes":125},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["Pfcloud UG"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["Intelligence Hosting LLC"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":625,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":5,"port":30001},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstPayload8":"485454502f312e31","dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[82158],"firstPacket":1788132017026,"http":{"bodyMagic":["text/html"],"bodyMagicCnt":1,"clientVersion":["1.1"],"clientVersionCnt":1,"host":["azenv.net"],"hostCnt":1,"ja4h":["ge11nn040000_8391bea91fb6_000000000000_000000000000"],"ja4hCnt":1,"ja4h_r":["ge11nn040000_Host,User-Agent,Accept-Encoding,Connection__"],"ja4h_rCnt":1,"md5":["0f87454a3ea15f0db55ae928dbcd82fc"],"md5Cnt":1,"method":["GET"],"method-GET":1,"methodCnt":1,"path":["http://azenv.net/"],"pathCnt":1,"requestHeader":["connection","user-agent","host","accept-encoding"],"requestHeaderCnt":4,"requestHeaderField":["accept-encoding","connection"],"requestHeaderValue":["gzip","close"],"requestHeaderValueCnt":2,"response-server":["Apache/2.4.41 (Ubuntu)"],"response-serverCnt":1,"response-x-powered-by":["PHP/7.4.3"],"response-x-powered-byCnt":1,"responseHeader":["server","connection","x-powered-by","date","content-type","content-length"],"responseHeaderCnt":6,"responseHeaderField":["connection","content-type","date","content-length"],"responseHeaderValue":["close","text/plain; charset=utf-8","sun, 30 aug 2026 23:20:17 gmt","94"],"responseHeaderValueCnt":4,"serverVersion":["1.1"],"serverVersionCnt":1,"sha256":["1ca624415b2889dbeb3f969890b848b7bc5eaf96ca5e8fdd7461f943b45d10cb"],"sha256Cnt":1,"statuscode":[200],"statuscodeCnt":1,"uri":["http://azenv.net/"],"uriCnt":1,"useragent":["Go-http-client/1.1"],"useragentCnt":1},"initRTT":64,"ipProtocol":6,"lastPacket":1788132017287,"length":261,"network":{"bytes":1088,"community_id":"1:dsvRwluyT/b6KXxhFZ+Px+lHOLc=","packets":10},"node":"spark-afae","packetPos":[-82158,6715130,90,172,82,207,82,369,82,0,0],"packetRange":{"gte":1788132017026,"lte":1788132017287},"protocol":["tcp","http"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":287},"source":{"as":{"full":"AS51396 Pfcloud UG (haftungsbeschrankt)","number":51396,"organization":{"name":"Pfcloud UG (haftungsbeschrankt)"}},"bytes":463,"geo":{"country_iso_code":"NL"},"ip":"204.76.203.7","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":5,"port":53012},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcPayload8":"4745542068747470","srcRIR":"ARIN","srcTTL":[50],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["396948687801212"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["869feaa1-dc77-4037-aee2-247b7a39cf7d","3d144850-efcc-436a-9008-c5d28ac581ae","23e6932c-e2bd-48cf-80b8-aa98ae9276c4","ee583a2e-d308-4c53-b8e2-a1cd45cd1bb7","ce8622a8-6d2f-4fe3-ab81-0cc86e19363e"],"signatureCnt":5,"signatureId":[2000166,1070034,1030619,1031486,2000008],"signatureIdCnt":5},"tag":{"block":["false","true"],"blockCnt":2,"category":["attack","tool","activity","recon","protocol"],"categoryCnt":5,"cves":[""],"cvesCnt":1,"description":["ip addresses with this tag have been seen crawling http(s) servers around the internet.","ip addresses with this tag have been observed scanning the internet using the golang http client.","ip addresses with this tag have been observed crawling the internet for unauthenticated web proxies and testing if they are functional.","cloud credential scanning probe detected. requests for sensitive configuration files and credentials indicate automated scanning for exposed secrets and api keys.","generic web crawler traffic detected. the simple pattern of get requests without specific exploitation indicators suggests automated crawling activity, possibly for search indexing or vulnerability scanning."],"intention":["malicious","unknown","suspicious"],"intentionCnt":3,"name":["go http client","open proxy scanner","web crawler","root path scanner"],"nameCnt":4},"tags":["frantech-ts","sensor:frantech-ts","honeypot"],"tagsCnt":3,"tcp":{"ja4ls":"46_64_tcp","ja4t":["64240_2-4-8-1-3_1400_7"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":4,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":2,"psh":2,"rst":0,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":815154421},"totDataBytes":412} +{"@timestamp":1788131072756,"_id":"260830-WES186TBN9BBD4Z5-yZkgrW1","_index":"arkime_sessions3-260830","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo GmbH"],"isp.dstCnt":1,"isp.src":["Pfcloud UG"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Intelligence Hosting LLC"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS51167 Contabo GmbH","number":51167,"organization":{"name":"Contabo GmbH"}},"bytes":0,"geo":{"country_iso_code":"FR"},"ip":"109.123.246.142","mac":["00:50:56:63:46:a6"],"mac-cnt":1,"packets":0,"port":30001},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[82148],"firstPacket":1788130372311,"ipProtocol":6,"lastPacket":1788130372311,"length":0,"network":{"bytes":60,"community_id":"1:WYUGWalE5n6sE/BZ9EmHPWWE7nU=","packets":1},"node":"spark-afae","packetPos":[-82148,247942],"packetRange":{"gte":1788130372311,"lte":1788130372311},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51396 Pfcloud UG (haftungsbeschrankt)","number":51396,"organization":{"name":"Pfcloud UG (haftungsbeschrankt)"}},"bytes":60,"geo":{"country_iso_code":"NL"},"ip":"204.76.203.7","mac":["c0:69:11:cd:1f:19"],"mac-cnt":1,"packets":1,"port":59550},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcRIR":"ARIN","srcTTL":[244],"srcTTLCnt":1,"tags":["sensor:contabo-sponge-02-ts","proxy","contabo-sponge-02-ts"],"tagsCnt":3,"tcp":{"ja4t":["65535_00_00_00"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":3402996338},"totDataBytes":0} +{"@timestamp":1788131370941,"_id":"260830-rTkYf13UYT9A_43IM8iioMlK","_index":"arkime_sessions3-260830","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["Pfcloud UG"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["Intelligence Hosting LLC"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":58,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":1,"port":30001},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[82152],"firstPacket":1788130235614,"ipProtocol":6,"lastPacket":1788130235749,"length":135,"network":{"bytes":170,"community_id":"1:F6HbFlVKuCQj/eaoM3c7ByD2GMQ=","packets":3},"node":"spark-afae","packetPos":[-82152,3306,74,1190],"packetRange":{"gte":1788130235614,"lte":1788130235749},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51396 Pfcloud UG (haftungsbeschrankt)","number":51396,"organization":{"name":"Pfcloud UG (haftungsbeschrankt)"}},"bytes":112,"geo":{"country_iso_code":"NL"},"ip":"204.76.203.7","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":2,"port":44961},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"ARIN","srcTTL":[51,242],"srcTTLCnt":2,"tags":["sensor:frantech-ts","frantech-ts","honeypot"],"tagsCnt":3,"tcp":{"ja4t":["65535_2_536_00"],"ja4tCnt":1,"ja4ts":["64240_2_1460_00"],"ja4tsCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":766774919},"totDataBytes":0} +{"@timestamp":1788131072279,"_id":"260830-HgoF556RO65KjL-wl3OGIs6v","_index":"arkime_sessions3-260830","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["netcup GmbH"],"isp.dstCnt":1,"isp.src":["Pfcloud UG"],"isp.srcCnt":1,"org.dst":["Netcup KVM"],"org.dstCnt":1,"org.src":["Intelligence Hosting LLC"],"org.srcCnt":1,"usertype.dst":["business"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS197540 netcup GmbH","number":197540,"organization":{"name":"netcup GmbH"}},"bytes":0,"geo":{"country_iso_code":"DE"},"ip":"159.195.21.150","mac":["8a:41:d3:b8:0d:d3"],"mac-cnt":1,"packets":0,"port":30001},"dstRIR":"ARIN","ethertype":2048,"fileId":[82149],"firstPacket":1788130189819,"ipProtocol":6,"lastPacket":1788130189819,"length":0,"network":{"bytes":56,"community_id":"1:ve4e1re66Cnkd034Q3CwCGlBJOQ=","packets":1},"node":"spark-afae","packetPos":[-82149,430413],"packetRange":{"gte":1788130189819,"lte":1788130189819},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51396 Pfcloud UG (haftungsbeschrankt)","number":51396,"organization":{"name":"Pfcloud UG (haftungsbeschrankt)"}},"bytes":56,"geo":{"country_iso_code":"NL"},"ip":"204.76.203.7","mac":["bc:0f:fe:38:0b:a3"],"mac-cnt":1,"packets":1,"port":51718},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"ARIN","srcTTL":[248],"srcTTLCnt":1,"tags":["honeypot","sensor:netcup-ts","netcup-ts"],"tagsCnt":3,"tcp":{"ja4t":["65535_00_00_00"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":3904939883},"totDataBytes":0} +{"@timestamp":1788130772467,"_id":"260830-SMlM3rXpW4dMV5PhG2h6JbT6","_index":"arkime_sessions3-260830","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Hetzner Online GmbH"],"isp.dstCnt":1,"isp.src":["Pfcloud UG"],"isp.srcCnt":1,"org.dst":["HETZNER-DC"],"org.dstCnt":1,"org.src":["Intelligence Hosting LLC"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS24940 Hetzner Online GmbH","number":24940,"organization":{"name":"Hetzner Online GmbH"}},"bytes":0,"geo":{"country_iso_code":"FI"},"ip":"89.167.72.144","mac":["92:00:07:4c:82:70"],"mac-cnt":1,"packets":0,"port":30001},"dstRIR":"RIPE","ethertype":2048,"fileId":[82146],"firstPacket":1788129904283,"ipProtocol":6,"lastPacket":1788129904283,"length":0,"network":{"bytes":54,"community_id":"1:1vnTe2XqOlK+ftaiEAnf4M3NNE0=","packets":1},"node":"spark-afae","packetPos":[-82146,193548],"packetRange":{"gte":1788129904283,"lte":1788129904283},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51396 Pfcloud UG (haftungsbeschrankt)","number":51396,"organization":{"name":"Pfcloud UG (haftungsbeschrankt)"}},"bytes":54,"geo":{"country_iso_code":"NL"},"ip":"204.76.203.7","mac":["d2:74:7f:6e:37:e3"],"mac-cnt":1,"packets":1,"port":39493},"spoofable":["true"],"spoofableCnt":1,"srcRIR":"ARIN","srcTTL":[244],"srcTTLCnt":1,"tags":["sponge-01-ts","honeypot","sensor:sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["65535_00_00_00"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":509711478},"totDataBytes":0} +{"@timestamp":1788130473500,"_id":"260830-jDmZkEZBnxNOBZUlVEGsSrwJ","_index":"arkime_sessions3-260830","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Kaopu Cloud HK Limited"],"isp.dstCnt":1,"isp.src":["Pfcloud UG"],"isp.srcCnt":1,"org.dst":["LightNode-BH"],"org.dstCnt":1,"org.src":["Intelligence Hosting LLC"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":0,"geo":{"country_iso_code":"BH"},"ip":"38.54.2.209","mac":["52:54:8f:9d:76:48"],"mac-cnt":1,"packets":0,"port":30001},"dstRIR":"ARIN","ethertype":2048,"fileId":[82145],"firstPacket":1788129829778,"ipProtocol":6,"lastPacket":1788129829778,"length":0,"network":{"bytes":54,"community_id":"1:vVUFcZk6YcGIDfa9eweCBbC/jbc=","packets":1},"node":"spark-afae","packetPos":[-82145,136812],"packetRange":{"gte":1788129829778,"lte":1788129829778},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51396 Pfcloud UG (haftungsbeschrankt)","number":51396,"organization":{"name":"Pfcloud UG (haftungsbeschrankt)"}},"bytes":54,"geo":{"country_iso_code":"NL"},"ip":"204.76.203.7","mac":["98:44:ce:60:15:19"],"mac-cnt":1,"packets":1,"port":46860},"spoofable":["true"],"spoofableCnt":1,"srcDscp":[18],"srcDscpCnt":1,"srcOui":["Huawei Technologies Co.,Ltd"],"srcOuiCnt":1,"srcRIR":"ARIN","srcTTL":[241],"srcTTLCnt":1,"tags":["honeypot","sensor:bahrain-sponge-01-ts","bahrain-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["65535_00_00_00"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":4071662634},"totDataBytes":0} +{"@timestamp":1788129871579,"_id":"260830-djmzor9L9yJPPYt2P00BBHgU","_index":"arkime_sessions3-260830","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Pfcloud UG"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Intelligence Hosting LLC"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":0,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":0,"port":30001},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[82143],"firstPacket":1788129167110,"ipProtocol":6,"lastPacket":1788129167110,"length":0,"network":{"bytes":60,"community_id":"1:YxM8O5ZZI4PDrtD/IRmWW4c9L5k=","packets":1},"node":"spark-afae","packetPos":[-82143,797634],"packetRange":{"gte":1788129167110,"lte":1788129167110},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51396 Pfcloud UG (haftungsbeschrankt)","number":51396,"organization":{"name":"Pfcloud UG (haftungsbeschrankt)"}},"bytes":60,"geo":{"country_iso_code":"NL"},"ip":"204.76.203.7","mac":["fc:bd:67:9d:2b:2b"],"mac-cnt":1,"packets":1,"port":32789},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcRIR":"ARIN","srcTTL":[244],"srcTTLCnt":1,"tags":["honeypot","contabo-sponge-01-ts","sensor:contabo-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["65535_00_00_00"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":1505260832},"totDataBytes":0} +{"@timestamp":1788129563551,"_id":"260830-azl00varU3BIwYZvas7GZ8PX","_index":"arkime_sessions3-260830","client":{"bytes":3},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["Pfcloud UG"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["Intelligence Hosting LLC"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":800,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":12,"port":30002},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[82140],"firstPacket":1788128963630,"initRTT":65,"ipProtocol":6,"lastPacket":1788129051142,"length":87512,"network":{"bytes":1801,"community_id":"1:kxUonW4mzIXuvrGnib6ZL3JbFcQ=","packets":27},"node":"spark-afae","packetPos":[-82140,11682896,90,370,82,85,122408,152,220,82,38397,82,332,82,18677,152,462,82,46072,82,474,82,726121,1108,496,82,20118,82],"packetRange":{"gte":1788128963630,"lte":1788129051142},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51396 Pfcloud UG (haftungsbeschrankt)","number":51396,"organization":{"name":"Pfcloud UG (haftungsbeschrankt)"}},"bytes":1001,"geo":{"country_iso_code":"NL"},"ip":"204.76.203.7","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":15,"port":45270},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcPayload8":"050100","srcRIR":"ARIN","srcTTL":[51],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":["Attempted Information Leak",""],"categoryCnt":2,"flowId":["1019610670446578"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[2,3],"severityCnt":2,"signature":["553b5765-6241-4e9a-9982-0ca113796134","5a66c944-faed-4791-9d94-b44b7bd48352"],"signatureCnt":2,"signatureId":[1031235,2000181],"signatureIdCnt":2},"tag":{"block":["false","true"],"blockCnt":2,"category":["recon","activity"],"categoryCnt":2,"cves":[""],"cvesCnt":1,"description":["ip addresses with this tag have been observed attempting to discover socks5 proxies that do not require authentication.","socks proxy protocol negotiation"],"intention":["suspicious"],"intentionCnt":1,"name":["socks5 proxy scanner","socks proxy protocol negotiation"],"nameCnt":2},"tags":["sensor:frantech-ts","honeypot","frantech-ts"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-4-8-1-3_1400_7"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":22,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":1,"psh":1,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":1607578471},"totDataBytes":3} +{"@timestamp":1788129562105,"_id":"260830-aznazsdqN0dKZKQviAyyLzV1","_index":"arkime_sessions3-260830","client":{"bytes":125},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["Pfcloud UG"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["Intelligence Hosting LLC"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":625,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":5,"port":30002},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstPayload8":"485454502f312e31","dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[82140],"firstPacket":1788128824667,"http":{"bodyMagic":["text/html"],"bodyMagicCnt":1,"clientVersion":["1.1"],"clientVersionCnt":1,"host":["azenv.net"],"hostCnt":1,"ja4h":["ge11nn040000_8391bea91fb6_000000000000_000000000000"],"ja4hCnt":1,"ja4h_r":["ge11nn040000_Host,User-Agent,Accept-Encoding,Connection__"],"ja4h_rCnt":1,"md5":["0f87454a3ea15f0db55ae928dbcd82fc"],"md5Cnt":1,"method":["GET"],"method-GET":1,"methodCnt":1,"path":["http://azenv.net/"],"pathCnt":1,"requestHeader":["host","accept-encoding","user-agent","connection"],"requestHeaderCnt":4,"requestHeaderField":["accept-encoding","connection"],"requestHeaderValue":["gzip","close"],"requestHeaderValueCnt":2,"response-server":["Apache/2.4.41 (Ubuntu)"],"response-serverCnt":1,"response-x-powered-by":["PHP/7.4.3"],"response-x-powered-byCnt":1,"responseHeader":["x-powered-by","content-type","server","content-length","connection","date"],"responseHeaderCnt":6,"responseHeaderField":["connection","content-type","date","content-length"],"responseHeaderValue":["close","text/plain; charset=utf-8","sun, 30 aug 2026 22:27:04 gmt","94"],"responseHeaderValueCnt":4,"serverVersion":["1.1"],"serverVersionCnt":1,"sha256":["1ca624415b2889dbeb3f969890b848b7bc5eaf96ca5e8fdd7461f943b45d10cb"],"sha256Cnt":1,"statuscode":[200],"statuscodeCnt":1,"uri":["http://azenv.net/"],"uriCnt":1,"useragent":["Go-http-client/1.1"],"useragentCnt":1},"initRTT":65,"ipProtocol":6,"lastPacket":1788128824929,"length":262,"network":{"bytes":1088,"community_id":"1:F2Dw9AS5/Nd8jxj6qt17SNFyU9g=","packets":10},"node":"spark-afae","packetPos":[-82140,10962346,90,706,82,207,82,369,232,82,0],"packetRange":{"gte":1788128824667,"lte":1788128824929},"protocol":["http","tcp"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":287},"source":{"as":{"full":"AS51396 Pfcloud UG (haftungsbeschrankt)","number":51396,"organization":{"name":"Pfcloud UG (haftungsbeschrankt)"}},"bytes":463,"geo":{"country_iso_code":"NL"},"ip":"204.76.203.7","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":5,"port":44944},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcPayload8":"4745542068747470","srcRIR":"ARIN","srcTTL":[50],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["51164267721549"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["869feaa1-dc77-4037-aee2-247b7a39cf7d","23e6932c-e2bd-48cf-80b8-aa98ae9276c4","ee583a2e-d308-4c53-b8e2-a1cd45cd1bb7","ce8622a8-6d2f-4fe3-ab81-0cc86e19363e","3d144850-efcc-436a-9008-c5d28ac581ae"],"signatureCnt":5,"signatureId":[2000166,1070034,1030619,1031486,2000008],"signatureIdCnt":5},"tag":{"block":["false","true"],"blockCnt":2,"category":["tool","attack","recon","activity","protocol"],"categoryCnt":5,"cves":[""],"cvesCnt":1,"description":["ip addresses with this tag have been observed crawling the internet for unauthenticated web proxies and testing if they are functional.","cloud credential scanning probe detected. requests for sensitive configuration files and credentials indicate automated scanning for exposed secrets and api keys.","generic web crawler traffic detected. the simple pattern of get requests without specific exploitation indicators suggests automated crawling activity, possibly for search indexing or vulnerability scanning.","ip addresses with this tag have been observed scanning the internet using the golang http client.","ip addresses with this tag have been seen crawling http(s) servers around the internet."],"intention":["suspicious","unknown","malicious"],"intentionCnt":3,"name":["go http client","web crawler","root path scanner","open proxy scanner"],"nameCnt":4},"tags":["sensor:frantech-ts","honeypot","frantech-ts"],"tagsCnt":3,"tcp":{"ja4ls":"40_64_tcp","ja4t":["64240_2-4-8-1-3_1400_7"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":4,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":2,"psh":2,"rst":0,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":741358885},"totDataBytes":412} +{"@timestamp":1788128953711,"_id":"260830-VTmLGMFIo1BLk5846kLWrIa7","_index":"arkime_sessions3-260830","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Pfcloud UG"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Intelligence Hosting LLC"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":0,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":0,"port":30002},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[82137],"firstPacket":1788128361978,"ipProtocol":6,"lastPacket":1788128361978,"length":0,"network":{"bytes":60,"community_id":"1:McL1TL4HT/ohJE/ECKDmvElgPWE=","packets":1},"node":"spark-afae","packetPos":[-82137,798064],"packetRange":{"gte":1788128361978,"lte":1788128361978},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51396 Pfcloud UG (haftungsbeschrankt)","number":51396,"organization":{"name":"Pfcloud UG (haftungsbeschrankt)"}},"bytes":60,"geo":{"country_iso_code":"NL"},"ip":"204.76.203.7","mac":["fc:bd:67:9d:2b:2b"],"mac-cnt":1,"packets":1,"port":43849},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcRIR":"ARIN","srcTTL":[244],"srcTTLCnt":1,"tags":["contabo-sponge-01-ts","honeypot","sensor:contabo-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["65535_00_00_00"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":2405335583},"totDataBytes":0} +{"@timestamp":1788128339872,"_id":"260830-Pzl_uoMyC7VH8ojtPNot3Gvs","_index":"arkime_sessions3-260830","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Kaopu Cloud HK Limited"],"isp.dstCnt":1,"isp.src":["Pfcloud UG"],"isp.srcCnt":1,"org.dst":["LightNode-BH"],"org.dstCnt":1,"org.src":["Intelligence Hosting LLC"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":0,"geo":{"country_iso_code":"BH"},"ip":"38.54.2.209","mac":["52:54:8f:9d:76:48"],"mac-cnt":1,"packets":0,"port":30002},"dstRIR":"ARIN","ethertype":2048,"fileId":[82132],"firstPacket":1788127919977,"ipProtocol":6,"lastPacket":1788127919977,"length":0,"network":{"bytes":54,"community_id":"1:FpKkhc+toqWFtB2xi7UCUxUtyLs=","packets":1},"node":"spark-afae","packetPos":[-82132,124352],"packetRange":{"gte":1788127919977,"lte":1788127919977},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51396 Pfcloud UG (haftungsbeschrankt)","number":51396,"organization":{"name":"Pfcloud UG (haftungsbeschrankt)"}},"bytes":54,"geo":{"country_iso_code":"NL"},"ip":"204.76.203.7","mac":["98:44:ce:60:15:19"],"mac-cnt":1,"packets":1,"port":46894},"spoofable":["true"],"spoofableCnt":1,"srcDscp":[18],"srcDscpCnt":1,"srcOui":["Huawei Technologies Co.,Ltd"],"srcOuiCnt":1,"srcRIR":"ARIN","srcTTL":[240],"srcTTLCnt":1,"tags":["sensor:bahrain-sponge-01-ts","bahrain-sponge-01-ts","honeypot"],"tagsCnt":3,"tcp":{"ja4t":["65535_00_00_00"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":2547715482},"totDataBytes":0} +{"@timestamp":1788127733013,"_id":"260830-KTm1JMAjwfVPjoHs0YzsyjPw","_index":"arkime_sessions3-260830","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["Pfcloud UG"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["Intelligence Hosting LLC"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":58,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":1,"port":30002},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[82128],"firstPacket":1788127171595,"ipProtocol":6,"lastPacket":1788127171727,"length":132,"network":{"bytes":170,"community_id":"1:6nByggNjrD05Llq8XQoqNY6DRFw=","packets":3},"node":"spark-afae","packetPos":[-82128,7330765,74,3842],"packetRange":{"gte":1788127171595,"lte":1788127171727},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51396 Pfcloud UG (haftungsbeschrankt)","number":51396,"organization":{"name":"Pfcloud UG (haftungsbeschrankt)"}},"bytes":112,"geo":{"country_iso_code":"NL"},"ip":"204.76.203.7","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":2,"port":51308},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"ARIN","srcTTL":[50,241],"srcTTLCnt":2,"tags":["honeypot","frantech-ts","sensor:frantech-ts"],"tagsCnt":3,"tcp":{"ja4t":["65535_2_536_00"],"ja4tCnt":1,"ja4ts":["64240_2_1460_00"],"ja4tsCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":1341238343},"totDataBytes":0} +{"@timestamp":1788127433611,"_id":"260830-N0REeoRX5htKDKBz5Vm_v_k1","_index":"arkime_sessions3-260830","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["netcup GmbH"],"isp.dstCnt":1,"isp.src":["Pfcloud UG"],"isp.srcCnt":1,"org.dst":["Netcup KVM"],"org.dstCnt":1,"org.src":["Intelligence Hosting LLC"],"org.srcCnt":1,"usertype.dst":["business"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS197540 netcup GmbH","number":197540,"organization":{"name":"netcup GmbH"}},"bytes":0,"geo":{"country_iso_code":"DE"},"ip":"159.195.21.150","mac":["8a:41:d3:b8:0d:d3"],"mac-cnt":1,"packets":0,"port":30002},"dstRIR":"ARIN","ethertype":2048,"fileId":[82126],"firstPacket":1788127081041,"ipProtocol":6,"lastPacket":1788127081041,"length":0,"network":{"bytes":56,"community_id":"1:hR3M1hNGuqVRc/pcUdOskI3H7LU=","packets":1},"node":"spark-afae","packetPos":[-82126,367364],"packetRange":{"gte":1788127081041,"lte":1788127081041},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51396 Pfcloud UG (haftungsbeschrankt)","number":51396,"organization":{"name":"Pfcloud UG (haftungsbeschrankt)"}},"bytes":56,"geo":{"country_iso_code":"NL"},"ip":"204.76.203.7","mac":["bc:0f:fe:38:0b:a3"],"mac-cnt":1,"packets":1,"port":34707},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"ARIN","srcTTL":[248],"srcTTLCnt":1,"tags":["netcup-ts","honeypot","sensor:netcup-ts"],"tagsCnt":3,"tcp":{"ja4t":["65535_00_00_00"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":4037021180},"totDataBytes":0} +{"@timestamp":1788127433087,"_id":"260830--shVSS0N_MBHa5VX1nceMofv","_index":"arkime_sessions3-260830","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo GmbH"],"isp.dstCnt":1,"isp.src":["Pfcloud UG"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Intelligence Hosting LLC"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS51167 Contabo GmbH","number":51167,"organization":{"name":"Contabo GmbH"}},"bytes":0,"geo":{"country_iso_code":"FR"},"ip":"109.123.246.142","mac":["00:50:56:63:46:a6"],"mac-cnt":1,"packets":0,"port":30002},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[82125],"firstPacket":1788126270098,"ipProtocol":6,"lastPacket":1788126270098,"length":0,"network":{"bytes":60,"community_id":"1:6CVoWDE3B41D+9UykWHks1nFBbA=","packets":1},"node":"spark-afae","packetPos":[-82125,22409],"packetRange":{"gte":1788126270098,"lte":1788126270098},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51396 Pfcloud UG (haftungsbeschrankt)","number":51396,"organization":{"name":"Pfcloud UG (haftungsbeschrankt)"}},"bytes":60,"geo":{"country_iso_code":"NL"},"ip":"204.76.203.7","mac":["c0:69:11:cd:1f:19"],"mac-cnt":1,"packets":1,"port":47899},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcRIR":"ARIN","srcTTL":[243],"srcTTLCnt":1,"tags":["contabo-sponge-02-ts","proxy","sensor:contabo-sponge-02-ts"],"tagsCnt":3,"tcp":{"ja4t":["65535_00_00_00"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":1936657872},"totDataBytes":0} +{"@timestamp":1788127119134,"_id":"260830-LEQSdJVbOn5Dz7Dlg_vQ4QeQ","_index":"arkime_sessions3-260830","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Hetzner Online GmbH"],"isp.dstCnt":1,"isp.src":["Pfcloud UG"],"isp.srcCnt":1,"org.dst":["HETZNER-DC"],"org.dstCnt":1,"org.src":["Intelligence Hosting LLC"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS24940 Hetzner Online GmbH","number":24940,"organization":{"name":"Hetzner Online GmbH"}},"bytes":0,"geo":{"country_iso_code":"FI"},"ip":"89.167.72.144","mac":["92:00:07:4c:82:70"],"mac-cnt":1,"packets":0,"port":30002},"dstRIR":"RIPE","ethertype":2048,"fileId":[82122],"firstPacket":1788126068063,"ipProtocol":6,"lastPacket":1788126068063,"length":0,"network":{"bytes":54,"community_id":"1:i6MGe4wWYk7arsamwar86Vek46U=","packets":1},"node":"spark-afae","packetPos":[-82122,25534],"packetRange":{"gte":1788126068063,"lte":1788126068063},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51396 Pfcloud UG (haftungsbeschrankt)","number":51396,"organization":{"name":"Pfcloud UG (haftungsbeschrankt)"}},"bytes":54,"geo":{"country_iso_code":"NL"},"ip":"204.76.203.7","mac":["d2:74:7f:6e:37:e3"],"mac-cnt":1,"packets":1,"port":41671},"spoofable":["true"],"spoofableCnt":1,"srcRIR":"ARIN","srcTTL":[244],"srcTTLCnt":1,"tags":["sensor:sponge-01-ts","sponge-01-ts","honeypot"],"tagsCnt":3,"tcp":{"ja4t":["65535_00_00_00"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":3897506870},"totDataBytes":0} +{"@timestamp":1788126216732,"_id":"260830-2shE7Nf9SfZH376ZLdorZJj9","_index":"arkime_sessions3-260830","client":{"bytes":3},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["Pfcloud UG"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["Intelligence Hosting LLC"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":404,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":6,"port":30003},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[82118],"firstPacket":1788125595034,"initRTT":65,"ipProtocol":6,"lastPacket":1788125640725,"length":45691,"network":{"bytes":1009,"community_id":"1:divrrLgkFc+WaNv3RzQxWYUL83s=","packets":15},"node":"spark-afae","packetPos":[-82118,7358648,90,0,82,85,20731,82,0,288,27651,82,818,246,31671,82],"packetRange":{"gte":1788125595034,"lte":1788125640725},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51396 Pfcloud UG (haftungsbeschrankt)","number":51396,"organization":{"name":"Pfcloud UG (haftungsbeschrankt)"}},"bytes":605,"geo":{"country_iso_code":"NL"},"ip":"204.76.203.7","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":9,"port":56940},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcPayload8":"050100","srcRIR":"ARIN","srcTTL":[50],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":["","Attempted Information Leak"],"categoryCnt":2,"flowId":["991618623057523"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[2,3],"severityCnt":2,"signature":["553b5765-6241-4e9a-9982-0ca113796134","5a66c944-faed-4791-9d94-b44b7bd48352"],"signatureCnt":2,"signatureId":[1031235,2000181],"signatureIdCnt":2},"tag":{"block":["false","true"],"blockCnt":2,"category":["recon","activity"],"categoryCnt":2,"cves":[""],"cvesCnt":1,"description":["socks proxy protocol negotiation","ip addresses with this tag have been observed attempting to discover socks5 proxies that do not require authentication."],"intention":["suspicious"],"intentionCnt":1,"name":["socks proxy protocol negotiation","socks5 proxy scanner"],"nameCnt":2},"tags":["frantech-ts","honeypot","sensor:frantech-ts"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-4-8-1-3_1400_7"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":10,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":1,"psh":1,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":1321906750},"totDataBytes":3} +{"@timestamp":1788126215895,"_id":"260830-2sjO1WA_Yt9PtZ_Ak00634D4","_index":"arkime_sessions3-260830","client":{"bytes":125},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["Pfcloud UG"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["Intelligence Hosting LLC"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":625,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":5,"port":30003},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstPayload8":"485454502f312e31","dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[82118],"firstPacket":1788125444348,"http":{"bodyMagic":["text/html"],"bodyMagicCnt":1,"clientVersion":["1.1"],"clientVersionCnt":1,"host":["azenv.net"],"hostCnt":1,"ja4h":["ge11nn040000_8391bea91fb6_000000000000_000000000000"],"ja4hCnt":1,"ja4h_r":["ge11nn040000_Host,User-Agent,Accept-Encoding,Connection__"],"ja4h_rCnt":1,"md5":["0f87454a3ea15f0db55ae928dbcd82fc"],"md5Cnt":1,"method":["GET"],"method-GET":1,"methodCnt":1,"path":["http://azenv.net/"],"pathCnt":1,"requestHeader":["connection","accept-encoding","host","user-agent"],"requestHeaderCnt":4,"requestHeaderField":["accept-encoding","connection"],"requestHeaderValue":["gzip","close"],"requestHeaderValueCnt":2,"response-server":["Apache/2.4.41 (Ubuntu)"],"response-serverCnt":1,"response-x-powered-by":["PHP/7.4.3"],"response-x-powered-byCnt":1,"responseHeader":["x-powered-by","content-length","date","connection","content-type","server"],"responseHeaderCnt":6,"responseHeaderField":["connection","content-type","date","content-length"],"responseHeaderValue":["close","text/plain; charset=utf-8","sun, 30 aug 2026 21:30:44 gmt","94"],"responseHeaderValueCnt":4,"serverVersion":["1.1"],"serverVersionCnt":1,"sha256":["1ca624415b2889dbeb3f969890b848b7bc5eaf96ca5e8fdd7461f943b45d10cb"],"sha256Cnt":1,"statuscode":[200],"statuscodeCnt":1,"uri":["http://azenv.net/"],"uriCnt":1,"useragent":["Go-http-client/1.1"],"useragentCnt":1},"initRTT":65,"ipProtocol":6,"lastPacket":1788125444610,"length":262,"network":{"bytes":1088,"community_id":"1:G30sMzWDVLKnoLwDQRBDMy4dMA0=","packets":10},"node":"spark-afae","packetPos":[-82118,6955717,90,978,82,207,82,369,472,82,0],"packetRange":{"gte":1788125444348,"lte":1788125444610},"protocol":["http","tcp"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":287},"source":{"as":{"full":"AS51396 Pfcloud UG (haftungsbeschrankt)","number":51396,"organization":{"name":"Pfcloud UG (haftungsbeschrankt)"}},"bytes":463,"geo":{"country_iso_code":"NL"},"ip":"204.76.203.7","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":5,"port":48016},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcPayload8":"4745542068747470","srcRIR":"ARIN","srcTTL":[49],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["1216331664851689"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["869feaa1-dc77-4037-aee2-247b7a39cf7d","23e6932c-e2bd-48cf-80b8-aa98ae9276c4","ee583a2e-d308-4c53-b8e2-a1cd45cd1bb7","ce8622a8-6d2f-4fe3-ab81-0cc86e19363e","3d144850-efcc-436a-9008-c5d28ac581ae"],"signatureCnt":5,"signatureId":[2000166,1070034,1030619,1031486,2000008],"signatureIdCnt":5},"tag":{"block":["false","true"],"blockCnt":2,"category":["recon","protocol","attack","activity","tool"],"categoryCnt":5,"cves":[""],"cvesCnt":1,"description":["generic web crawler traffic detected. the simple pattern of get requests without specific exploitation indicators suggests automated crawling activity, possibly for search indexing or vulnerability scanning.","ip addresses with this tag have been observed scanning the internet using the golang http client.","cloud credential scanning probe detected. requests for sensitive configuration files and credentials indicate automated scanning for exposed secrets and api keys.","ip addresses with this tag have been observed crawling the internet for unauthenticated web proxies and testing if they are functional.","ip addresses with this tag have been seen crawling http(s) servers around the internet."],"intention":["malicious","unknown","suspicious"],"intentionCnt":3,"name":["root path scanner","open proxy scanner","web crawler","go http client"],"nameCnt":4},"tags":["frantech-ts","honeypot","sensor:frantech-ts"],"tagsCnt":3,"tcp":{"ja4ls":"44_64_tcp","ja4t":["64240_2-4-8-1-3_1400_7"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":4,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":2,"psh":2,"rst":0,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":2516290599},"totDataBytes":412} |