diff options
Diffstat (limited to 'kevlar/2026-08-31/sponge/ip-sessions/session_search_20260831T113643_ccfc4339.ndjson')
| -rw-r--r-- | kevlar/2026-08-31/sponge/ip-sessions/session_search_20260831T113643_ccfc4339.ndjson | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/kevlar/2026-08-31/sponge/ip-sessions/session_search_20260831T113643_ccfc4339.ndjson b/kevlar/2026-08-31/sponge/ip-sessions/session_search_20260831T113643_ccfc4339.ndjson new file mode 100644 index 0000000..0f45ff3 --- /dev/null +++ b/kevlar/2026-08-31/sponge/ip-sessions/session_search_20260831T113643_ccfc4339.ndjson @@ -0,0 +1,6 @@ +{"@timestamp":1787898583931,"_id":"260828-MBlXqVmj1VlHw7CkyI6x7um0","_index":"arkime_sessions3-260828","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Kaopu Cloud HK Limited"],"isp.dstCnt":1,"isp.src":["Femo IT Solutions Limited"],"isp.srcCnt":1,"org.dst":["LightNode-BH"],"org.dstCnt":1,"org.src":["Femo IT Solutions Limited"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["business"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":0,"geo":{"country_iso_code":"BH"},"ip":"38.54.2.209","mac":["52:54:8f:9d:76:48"],"mac-cnt":1,"packets":0,"port":1723},"dstRIR":"ARIN","ethertype":2048,"fileId":[80584],"firstPacket":1787897596892,"ipProtocol":6,"lastPacket":1787897604118,"length":7226,"network":{"bytes":296,"community_id":"1:F2EvHiQirlc6ShhfoIhtFYMQNsU=","packets":4},"node":"spark-afae","packetPos":[-80584,197629,306,90,262],"packetRange":{"gte":1787897596892,"lte":1787897604118},"protocol":["tcp"],"protocolCnt":1,"rootId":"260828-MBlXqVmj1VlHw7CkyI6x7um0","segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS214351 Femo It Solutions Limited","number":214351,"organization":{"name":"Femo It Solutions Limited"}},"bytes":296,"geo":{"country_iso_code":"DE"},"ip":"62.60.226.150","mac":["98:44:ce:60:15:19"],"mac-cnt":1,"packets":4,"port":43984},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Huawei Technologies Co.,Ltd"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[49],"srcTTLCnt":1,"tags":["bahrain-sponge-01-ts","sensor:bahrain-sponge-01-ts","honeypot"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-4-8-1-3_1394_7"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":4,"syn-ack":0,"urg":0},"tcpseq":{"src":233533529},"totDataBytes":0} +{"@timestamp":1787699384732,"_id":"260825-hqF32jJtNnJDx46pDgxM6Nqb","_index":"arkime_sessions3-260825","client":{"bytes":156},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["Femo IT Solutions Limited"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["Femo IT Solutions Limited"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["business"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":375,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":4,"port":1723},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstPayload8":"485454502f312e31","dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[79467],"firstPacket":1787698922647,"http":{"bodyMagic":["text/plain"],"bodyMagicCnt":1,"md5":["6196dba52703776af2e6593f772ed7ce"],"md5Cnt":1,"responseHeader":["connection","content-type"],"responseHeaderCnt":2,"responseHeaderField":["content-type","connection"],"responseHeaderValue":["text/plain; charset=utf-8","close"],"responseHeaderValueCnt":2,"serverVersion":["1.1"],"serverVersionCnt":1,"sha256":["19b843cc92cb12aa314bb3c3913b2feeb852e85969bf06cb9d096931bfda34ba"],"sha256Cnt":1,"statuscode":[400],"statuscodeCnt":1},"initRTT":73,"ipProtocol":6,"lastPacket":1787698930785,"length":8138,"network":{"bytes":857,"community_id":"1:GGzGR7YfREyMzCSy0+9D/rKTYSg=","packets":9},"node":"spark-afae","packetPos":[-79467,3160913,90,0,82,238,21364,82,185,292],"packetRange":{"gte":1787698922647,"lte":1787698930785},"protocol":["tcp","http"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":103},"source":{"as":{"full":"AS214351 Femo It Solutions Limited","number":214351,"organization":{"name":"Femo It Solutions Limited"}},"bytes":482,"geo":{"country_iso_code":"DE"},"ip":"62.60.226.150","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":5,"port":58938},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcPayload8":"009c00011a2b3c4d","srcRIR":"RIPE","srcTTL":[47],"srcTTLCnt":1,"tags":["honeypot","frantech-ts","sensor:frantech-ts"],"tagsCnt":3,"tcp":{"ja4ls":"47_64_3922961","ja4t":["64240_2-4-8-1-3_1394_7"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":2,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":2,"psh":2,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":3767985395},"totDataBytes":259} +{"@timestamp":1787677019495,"_id":"260825-rp83mjU0fCJOzo6wEdQK-iQ0","_index":"arkime_sessions3-260825","client":{"bytes":156},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Femo IT Solutions Limited"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Femo IT Solutions Limited"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["business"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":375,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":4,"port":1723},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstPayload8":"485454502f312e31","dstRIR":"RIPE","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[79342],"firstPacket":1787676267895,"http":{"bodyMagic":["text/plain"],"bodyMagicCnt":1,"md5":["6196dba52703776af2e6593f772ed7ce"],"md5Cnt":1,"responseHeader":["content-type","connection"],"responseHeaderCnt":2,"responseHeaderField":["content-type","connection"],"responseHeaderValue":["text/plain; charset=utf-8","close"],"responseHeaderValueCnt":2,"serverVersion":["1.1"],"serverVersionCnt":1,"sha256":["19b843cc92cb12aa314bb3c3913b2feeb852e85969bf06cb9d096931bfda34ba"],"sha256Cnt":1,"statuscode":[400],"statuscodeCnt":1},"initRTT":80,"ipProtocol":6,"lastPacket":1787676276046,"length":8151,"network":{"bytes":863,"community_id":"1:qFmqrPUOGfSt2K7xp4O+GXDw0hk=","packets":9},"node":"spark-afae","packetPos":[-79342,2275107,90,254,82,238,17640,82,185,82],"packetRange":{"gte":1787676267895,"lte":1787676276046},"protocol":["tcp","http"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":103},"source":{"as":{"full":"AS214351 Femo It Solutions Limited","number":214351,"organization":{"name":"Femo It Solutions Limited"}},"bytes":488,"geo":{"country_iso_code":"DE"},"ip":"62.60.226.150","mac":["00:c0:1d:c0:ff:ee","fc:bd:67:9d:2b:2b"],"mac-cnt":2,"packets":5,"port":60586},"srcOui":["Arista Networks","Grand Junction Networks, Inc."],"srcOuiCnt":2,"srcPayload8":"009c00011a2b3c4d","srcRIR":"RIPE","srcTTL":[51],"srcTTLCnt":1,"tags":["honeypot","sensor:contabo-sponge-01-ts","contabo-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4ls":"60_64_3916546","ja4t":["64240_2-4-8-1-3_1394_7"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":2,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":2,"psh":2,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":828789835},"totDataBytes":259} +{"@timestamp":1787595533070,"_id":"260824-K_JAJkut32dLU6cUeR3Eo26S","_index":"arkime_sessions3-260824","client":{"bytes":156},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Kaopu Cloud HK Limited"],"isp.dstCnt":1,"isp.src":["Femo IT Solutions Limited"],"isp.srcCnt":1,"org.dst":["LightNode-BH"],"org.dstCnt":1,"org.src":["Femo IT Solutions Limited"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["business"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":375,"geo":{"country_iso_code":"BH"},"ip":"38.54.2.209","mac":["52:54:8f:9d:76:48"],"mac-cnt":1,"packets":4,"port":1723},"dstPayload8":"485454502f312e31","dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[78890],"firstPacket":1787594284327,"http":{"bodyMagic":["text/plain"],"bodyMagicCnt":1,"responseHeader":["content-type","connection"],"responseHeaderCnt":2,"responseHeaderField":["content-type","connection"],"responseHeaderValue":["text/plain; charset=utf-8","close"],"responseHeaderValueCnt":2,"serverVersion":["1.1"],"serverVersionCnt":1,"statuscode":[400],"statuscodeCnt":1},"initRTT":50,"ipProtocol":6,"lastPacket":1787594292420,"length":8093,"network":{"bytes":857,"community_id":"1:9+pgazzoxnMWanb+kIFrioedXWE=","packets":9},"node":"spark-afae","packetPos":[-78890,1009930,90,180,82,238,10986,82,185,344],"packetRange":{"gte":1787594284327,"lte":1787594292420},"protocol":["http","tcp"],"protocolCnt":2,"rootId":"260824-K_JAJkut32dLU6cUeR3Eo26S","segmentCnt":1,"server":{"bytes":103},"source":{"as":{"full":"AS214351 Femo It Solutions Limited","number":214351,"organization":{"name":"Femo It Solutions Limited"}},"bytes":482,"geo":{"country_iso_code":"DE"},"ip":"62.60.226.150","mac":["98:44:ce:60:15:19"],"mac-cnt":1,"packets":5,"port":41582},"srcDscp":[8],"srcDscpCnt":1,"srcOui":["Huawei Technologies Co.,Ltd"],"srcOuiCnt":1,"srcPayload8":"009c00011a2b3c4d","srcRIR":"RIPE","srcTTL":[50],"srcTTLCnt":1,"tags":["bahrain-sponge-01-ts","honeypot","sensor:bahrain-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4ls":"34_64_3946084","ja4t":["64240_2-4-8-1-3_1394_7"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":2,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":2,"psh":2,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":936974917},"totDataBytes":259} +{"@timestamp":1787404409987,"_id":"260822-ay0-hY0NOYdGbLZMm_PnK46C","_index":"arkime_sessions3-260822","client":{"bytes":156},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["Femo IT Solutions Limited"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["Femo IT Solutions Limited"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["business"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":375,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":4,"port":1723},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstPayload8":"485454502f312e31","dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[77828],"firstPacket":1787403129363,"http":{"bodyMagic":["text/plain"],"bodyMagicCnt":1,"responseHeader":["content-type","connection"],"responseHeaderCnt":2,"responseHeaderField":["content-type","connection"],"responseHeaderValue":["text/plain; charset=utf-8","close"],"responseHeaderValueCnt":2,"serverVersion":["1.1"],"serverVersionCnt":1,"statuscode":[400],"statuscodeCnt":1},"initRTT":72,"ipProtocol":6,"lastPacket":1787403137500,"length":8137,"network":{"bytes":857,"community_id":"1:bspKSR+dyoR8GvtZhQtEWhYbRlQ=","packets":9},"node":"spark-afae","packetPos":[-77828,1700042,90,164,82,238,14174,82,185,382],"packetRange":{"gte":1787403129363,"lte":1787403137500},"protocol":["tcp","http"],"protocolCnt":2,"rootId":"260822-ay0-hY0NOYdGbLZMm_PnK46C","segmentCnt":1,"server":{"bytes":103},"source":{"as":{"full":"AS214351 Femo It Solutions Limited","number":214351,"organization":{"name":"Femo It Solutions Limited"}},"bytes":482,"geo":{"country_iso_code":"DE"},"ip":"62.60.226.150","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":5,"port":51330},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcPayload8":"009c00011a2b3c4d","srcRIR":"RIPE","srcTTL":[46],"srcTTLCnt":1,"tags":["sensor:frantech-ts","frantech-ts","honeypot"],"tagsCnt":3,"tcp":{"ja4ls":"66_64_3923492","ja4t":["64240_2-4-8-1-3_1394_7"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":2,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":2,"psh":2,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":1605903274},"totDataBytes":259} +{"@timestamp":1787381511765,"_id":"260822-udYXXGTrx8tLc7zZlxu7XLuH","_index":"arkime_sessions3-260822","client":{"bytes":156},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Femo IT Solutions Limited"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Femo IT Solutions Limited"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["business"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":375,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":4,"port":1723},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstPayload8":"485454502f312e31","dstRIR":"RIPE","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[77700],"firstPacket":1787380468805,"http":{"bodyMagic":["text/plain"],"bodyMagicCnt":1,"responseHeader":["connection","content-type"],"responseHeaderCnt":2,"responseHeaderField":["content-type","connection"],"responseHeaderValue":["text/plain; charset=utf-8","close"],"responseHeaderValueCnt":2,"serverVersion":["1.1"],"serverVersionCnt":1,"statuscode":[400],"statuscodeCnt":1},"initRTT":80,"ipProtocol":6,"lastPacket":1787380476958,"length":8153,"network":{"bytes":863,"community_id":"1:cyHT0yF/pVfHqh0HDbUUCVouB4g=","packets":9},"node":"spark-afae","packetPos":[-77700,489847,90,1338,82,238,15079,82,185,1243],"packetRange":{"gte":1787380468805,"lte":1787380476958},"protocol":["http","tcp"],"protocolCnt":2,"rootId":"260822-udYXXGTrx8tLc7zZlxu7XLuH","segmentCnt":1,"server":{"bytes":103},"source":{"as":{"full":"AS214351 Femo It Solutions Limited","number":214351,"organization":{"name":"Femo It Solutions Limited"}},"bytes":488,"geo":{"country_iso_code":"DE"},"ip":"62.60.226.150","mac":["fc:bd:67:9d:2b:2b","00:c0:1d:c0:ff:ee"],"mac-cnt":2,"packets":5,"port":41240},"srcOui":["Arista Networks","Grand Junction Networks, Inc."],"srcOuiCnt":2,"srcPayload8":"009c00011a2b3c4d","srcRIR":"RIPE","srcTTL":[52],"srcTTLCnt":1,"tags":["contabo-sponge-01-ts","honeypot","sensor:contabo-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4ls":"68_64_3911989","ja4t":["64240_2-4-8-1-3_1394_7"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":2,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":2,"psh":2,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":338230336},"totDataBytes":259} |