From e93e7f67d4f70177c3ab5a34e8cc5b24fa2dde6d Mon Sep 17 00:00:00 2001 From: hrbrmstr Date: Mon, 31 Aug 2026 07:56:38 -0400 Subject: add: bph report iocs --- kevlar/2026-08-31/honeylabs/events-AS14956.ndjson | 36 +++++++++++++++++++++++ 1 file changed, 36 insertions(+) create mode 100644 kevlar/2026-08-31/honeylabs/events-AS14956.ndjson (limited to 'kevlar/2026-08-31/honeylabs/events-AS14956.ndjson') diff --git a/kevlar/2026-08-31/honeylabs/events-AS14956.ndjson b/kevlar/2026-08-31/honeylabs/events-AS14956.ndjson new file mode 100644 index 0000000..33e3ee4 --- /dev/null +++ b/kevlar/2026-08-31/honeylabs/events-AS14956.ndjson @@ -0,0 +1,36 @@ +{"timestamp": "2026-08-24T22:17:44", "event_id": "e3652ca7-8ef2-411e-bdbe-62448b320f7c", "source_ip": "172.86.114.162", "source_port": 57239, "source_domain": "162.114.86.172.static.cloudzy.com", "country_code": "US", "country_name": "United States", "city_name": "Dallas", "asn_number": 14956, "asn_org": "RouterHosting LLC", "dest_port": 445, "network_protocol": "", "application_protocol": "smbv1", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 4, "event_duration": 469000000, "source_bytes": 455, "dest_bytes": 56, "network_bytes": 511, "event_summary": "\u0000\u0000\u0000N\ufffdSMB2\u0000\u0000\u0000\u0000\u0018\u0007\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\u0000\u0000A\u0000\u000f\f\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u00014\ufffd\u0000\u0000\u0000\f\u0000B\u0000\u0000\u0000N\u0000\u0001\u0000\u000e\u0000\r\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000"} +{"timestamp": "2026-08-24T22:17:40", "event_id": "987eac5e-6dc9-4c47-85ae-f09afadb2abf", "source_ip": "172.86.114.162", "source_port": 56423, "source_domain": "162.114.86.172.static.cloudzy.com", "country_code": "US", "country_name": "United States", "city_name": "Dallas", "asn_number": 14956, "asn_org": "RouterHosting LLC", "dest_port": 445, "network_protocol": "", "application_protocol": "smbv1", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 4, "event_duration": 469000000, "source_bytes": 364, "dest_bytes": 56, "network_bytes": 420, "event_summary": "\u0000\u0000\u0000J\ufffdSMB%\u0000\u0000\u0000\u0000\u0018\u0001(\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0010\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000J\u0000\u0000\u0000J\u0000\u0002\u0000#\u0000\u0000\u0000\u0007\u0000\\PIPE\\\u0000"} +{"timestamp": "2026-08-24T22:01:14", "event_id": "9515b94b-2e0f-450c-975a-bf0a1510453c", "source_ip": "172.86.114.162", "source_port": 55118, "source_domain": "162.114.86.172.static.cloudzy.com", "country_code": "US", "country_name": "United States", "city_name": "Dallas", "asn_number": 14956, "asn_org": "RouterHosting LLC", "dest_port": 445, "network_protocol": "", "application_protocol": "smbv1", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 4, "event_duration": 471000000, "source_bytes": 455, "dest_bytes": 56, "network_bytes": 511, "event_summary": "\u0000\u0000\u0000N\ufffdSMB2\u0000\u0000\u0000\u0000\u0018\u0007\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\u0000\u0000A\u0000\u000f\f\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u00014\ufffd\u0000\u0000\u0000\f\u0000B\u0000\u0000\u0000N\u0000\u0001\u0000\u000e\u0000\r\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000"} +{"timestamp": "2026-08-24T22:01:11", "event_id": "cab9eac0-2ece-43f3-8fef-368d40284229", "source_ip": "172.86.114.162", "source_port": 54322, "source_domain": "162.114.86.172.static.cloudzy.com", "country_code": "US", "country_name": "United States", "city_name": "Dallas", "asn_number": 14956, "asn_org": "RouterHosting LLC", "dest_port": 445, "network_protocol": "", "application_protocol": "smbv1", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 4, "event_duration": 471000000, "source_bytes": 364, "dest_bytes": 56, "network_bytes": 420, "event_summary": "\u0000\u0000\u0000J\ufffdSMB%\u0000\u0000\u0000\u0000\u0018\u0001(\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0010\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000J\u0000\u0000\u0000J\u0000\u0002\u0000#\u0000\u0000\u0000\u0007\u0000\\PIPE\\\u0000"} +{"timestamp": "2026-08-24T20:43:14", "event_id": "816fb942-ef87-435a-9d2f-1eddef1c6292", "source_ip": "172.86.114.162", "source_port": 53844, "source_domain": "", "country_code": "US", "country_name": "United States", "city_name": "Dallas", "asn_number": 14956, "asn_org": "RouterHosting LLC", "dest_port": 445, "network_protocol": "", "application_protocol": "smbv1", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 4, "event_duration": 469000000, "source_bytes": 455, "dest_bytes": 56, "network_bytes": 511, "event_summary": "\u0000\u0000\u0000N\ufffdSMB2\u0000\u0000\u0000\u0000\u0018\u0007\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\u0000\u0000A\u0000\u000f\f\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u00014\ufffd\u0000\u0000\u0000\f\u0000B\u0000\u0000\u0000N\u0000\u0001\u0000\u000e\u0000\r\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000"} +{"timestamp": "2026-08-25T23:21:07", "event_id": "5a66921e-1611-416f-972c-1b2b14edfff3", "source_ip": "107.189.26.103", "source_port": 51734, "source_domain": "103.26.189.107.static.cloudzy.com", "country_code": "NL", "country_name": "The Netherlands", "city_name": "Zaandam", "asn_number": 14956, "asn_org": "RouterHosting LLC", "dest_port": 80, "network_protocol": "", "application_protocol": "http", "http_method": "GET", "user_agent": "libredtail-http", "url_path": "/containers/json", "url_domain": "", "http_request_headers": "{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"host\":\":80\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "ge11nn0500_39072d476f20", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 49, "event_duration": 21320000000, "source_bytes": 19145, "dest_bytes": 3871, "network_bytes": 23016, "event_summary": ""} +{"timestamp": "2026-08-26T13:35:07", "event_id": "d3513389-2207-4ff1-9756-1c5341ab5860", "source_ip": "107.189.17.181", "source_port": 36309, "source_domain": "181.17.189.107.static.cloudzy.com", "country_code": "NL", "country_name": "The Netherlands", "city_name": "Zaandam", "asn_number": 14956, "asn_org": "RouterHosting LLC", "dest_port": 5060, "network_protocol": "", "application_protocol": "sip", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 402, "dest_bytes": 79, "network_bytes": 481, "event_summary": "OPTIONS sip::5060 SIP/2.0\r\nVia: SIP/2.0/TCP 107.189.17.181:36309;branch=z9hG4bKf7bdb105bc304299b1846392adcc4825;rport\r\nMax-Forwards: 70\r\nTo: :5060>\r\nFrom: \"306898751\" ;tag=288630618\r\nCall-ID: 7526c76e39e0447b98e7237f13949988\r\nContact: \r\nUser-Agent: Z 5.6.4 v2.10.20.4\r\nCSeq: 1 OPTIONS\r\nContent-Length: 0\r\n\r\n"} +{"timestamp": "2026-08-26T13:35:01", "event_id": "093afdf1-ad72-4792-b74a-516a5a3e24ff", "source_ip": "107.189.17.181", "source_port": 34819, "source_domain": "181.17.189.107.static.cloudzy.com", "country_code": "NL", "country_name": "The Netherlands", "city_name": "Zaandam", "asn_number": 14956, "asn_org": "RouterHosting LLC", "dest_port": 5060, "network_protocol": "", "application_protocol": "sip", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 402, "dest_bytes": 79, "network_bytes": 481, "event_summary": "OPTIONS sip::5060 SIP/2.0\r\nVia: SIP/2.0/TCP 107.189.17.181:34819;branch=z9hG4bK22d506c18ecd40bc9a52ee95354fa970;rport\r\nMax-Forwards: 70\r\nTo: :5060>\r\nFrom: \"347968744\" ;tag=780011372\r\nCall-ID: 9024c9deb5094e7a96a5584de702411a\r\nContact: \r\nUser-Agent: Z 5.6.4 v2.10.20.4\r\nCSeq: 1 OPTIONS\r\nContent-Length: 0\r\n\r\n"} +{"timestamp": "2026-08-27T21:19:12", "event_id": "71901ade-895a-4cfd-b64a-6ad0f85f98a5", "source_ip": "144.172.99.12", "source_port": 55206, "source_domain": "12.99.172.144.static.cloudzy.com", "country_code": "US", "country_name": "United States", "city_name": "Staten Island", "asn_number": 14956, "asn_org": "RouterHosting LLC", "dest_port": 443, "network_protocol": "tls", "application_protocol": "http", "http_method": "GET", "user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36", "url_path": "/.env", "url_domain": "", "http_request_headers": "{\"connection\":\"keep-alive\",\"host\":\"\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36\"}", "ssh_client_hassh": "", "tls_client_ja4": "t13i100900_61a7ad8aa9b6_88aa062a14c8", "tls_client_ja3": "92e3065cf9444ba90adc1bce4206011c", "tls_client_version": "TLSv1.3", "tls_client_cipher": "TLS_AES_128_GCM_SHA256", "http_request_ja4h": "ge11nn0300_7fd797acd99d", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 193, "dest_bytes": 78, "network_bytes": 271, "event_summary": ""} +{"timestamp": "2026-08-27T21:11:23", "event_id": "09b3fe28-4a88-492e-a54e-2135f43502c4", "source_ip": "144.172.99.12", "source_port": 59694, "source_domain": "12.99.172.144.static.cloudzy.com", "country_code": "US", "country_name": "United States", "city_name": "Staten Island", "asn_number": 14956, "asn_org": "RouterHosting LLC", "dest_port": 443, "network_protocol": "tls", "application_protocol": "http", "http_method": "GET", "user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36", "url_path": "/.env", "url_domain": "", "http_request_headers": "{\"connection\":\"keep-alive\",\"host\":\"\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36\"}", "ssh_client_hassh": "", "tls_client_ja4": "t13i100900_61a7ad8aa9b6_88aa062a14c8", "tls_client_ja3": "92e3065cf9444ba90adc1bce4206011c", "tls_client_version": "TLSv1.3", "tls_client_cipher": "TLS_AES_128_GCM_SHA256", "http_request_ja4h": "ge11nn0300_7fd797acd99d", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 193, "dest_bytes": 78, "network_bytes": 271, "event_summary": ""} +{"timestamp": "2026-08-27T18:42:45", "event_id": "3fcc8342-6edb-41dc-b64a-8a06a58cd19c", "source_ip": "107.189.17.181", "source_port": 11207, "source_domain": "181.17.189.107.static.cloudzy.com", "country_code": "NL", "country_name": "The Netherlands", "city_name": "Zaandam", "asn_number": 14956, "asn_org": "RouterHosting LLC", "dest_port": 5060, "network_protocol": "", "application_protocol": "sip", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 404, "dest_bytes": 79, "network_bytes": 483, "event_summary": "OPTIONS sip::5060 SIP/2.0\r\nVia: SIP/2.0/TCP 107.189.17.181:11207;branch=z9hG4bK4389b244c27c4e638cef8b92266da0bd;rport\r\nMax-Forwards: 70\r\nTo: :5060>\r\nFrom: \"539062981\" ;tag=678161121\r\nCall-ID: b6891c008a1d4c52a9c7bdf7260d21bc\r\nContact: \r\nUser-Agent: Z 5.6.4 v2.10.20.4\r\nCSeq: 1 OPTIONS\r\nContent-Length: 0\r\n\r\n"} +{"timestamp": "2026-08-27T17:33:12", "event_id": "ac563e81-2afc-4677-af55-6812c473a8ed", "source_ip": "144.172.94.243", "source_port": 5207, "source_domain": "243.94.172.144.static.cloudzy.com", "country_code": "US", "country_name": "United States", "city_name": "Ogden", "asn_number": 14956, "asn_org": "RouterHosting LLC", "dest_port": 5060, "network_protocol": "", "application_protocol": "sip", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 404, "dest_bytes": 79, "network_bytes": 483, "event_summary": "OPTIONS sip::5060 SIP/2.0\r\nVia: SIP/2.0/TCP 144.172.94.243:5207;branch=z9hG4bK9e6f7ce508844a508cc8e4c938e8d715;rport\r\nMax-Forwards: 70\r\nTo: :5060>\r\nFrom: \"636960680\" ;tag=376297213\r\nCall-ID: 736b8198516345d292c3b3ac27f11387\r\nContact: \r\nUser-Agent: Z 5.6.4 v2.10.20.4\r\nCSeq: 1 OPTIONS\r\nContent-Length: 0\r\n\r\n"} +{"timestamp": "2026-08-27T16:30:48", "event_id": "4bfe9040-6a55-4a5a-8543-c2630eb82e7a", "source_ip": "45.61.182.81", "source_port": 47858, "source_domain": "81.182.61.45.static.cloudzy.com", "country_code": "US", "country_name": "United States", "city_name": "Dallas", "asn_number": 14956, "asn_org": "RouterHosting LLC", "dest_port": 22, "network_protocol": "", "application_protocol": "ssh", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "bf7dbf67fa9b26ee9f9deb99c49320ba", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 218000000, "source_bytes": 1388, "dest_bytes": 12, "network_bytes": 1400, "event_summary": "SSH-2.0-Go\r\n\u0000\u0000\u0005\\\u0012\u0014Rf{8\ufffd\ufffdVU\ufffdM\u0017\ufffd'\ufffdU?\u0000\u0000\u0001`mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com\u0000\u0000\u0001\ufffdrsa-sha2-256-cert-v01@openssh.com,rsa-sha2-512-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss,ssh-ed25519\u0000\u0000\u0000\ufffdaes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour256,arcfour128,arcfour\u0000\u0000\u0000\ufffdaes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour256,arcfour128,arcfour\u0000\u0000\u0000nhmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96\u0000\u0000\u0000nhmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96\u0000\u0000\u0000\u0004none\u0000\u0000\u0000\u0004none\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000)\ufffd\u0004\ufffd\u070bEZZ:\ufffd\ufffd\u0010\u0014\ufffd\u000e\ufffd\ufffd"} +{"timestamp": "2026-08-27T16:30:47", "event_id": "8884740f-ff7a-43b8-8b17-07987681daec", "source_ip": "45.61.182.81", "source_port": 47852, "source_domain": "81.182.61.45.static.cloudzy.com", "country_code": "US", "country_name": "United States", "city_name": "Dallas", "asn_number": 14956, "asn_org": "RouterHosting LLC", "dest_port": 22, "network_protocol": "", "application_protocol": "ssh", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "bf7dbf67fa9b26ee9f9deb99c49320ba", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 221000000, "source_bytes": 1388, "dest_bytes": 12, "network_bytes": 1400, "event_summary": "SSH-2.0-Go\r\n\u0000\u0000\u0005\\\u0012\u0014*N\ufffdw'\u0010\ufffd=k\ufffd\u0014\ufffd\ufffd8r\ufffd\u0000\u0000\u0001`mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com\u0000\u0000\u0001\ufffdrsa-sha2-256-cert-v01@openssh.com,rsa-sha2-512-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss,ssh-ed25519\u0000\u0000\u0000\ufffdaes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour256,arcfour128,arcfour\u0000\u0000\u0000\ufffdaes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour256,arcfour128,arcfour\u0000\u0000\u0000nhmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96\u0000\u0000\u0000nhmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96\u0000\u0000\u0000\u0004none\u0000\u0000\u0000\u0004none\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000C\ufffd\ufffd\ufffd\ufffd\ufffd~(\ufffdI\bIrK\ufffd\ufffd\ufffd\ufffd"} +{"timestamp": "2026-08-27T13:48:28", "event_id": "e08397c6-4ae8-4c4c-b808-7ea985fdb1ed", "source_ip": "153.75.82.185", "source_port": 51978, "source_domain": "", "country_code": "US", "country_name": "United States", "city_name": "Ogden", "asn_number": 14956, "asn_org": "RouterHosting LLC", "dest_port": 22, "network_protocol": "", "application_protocol": "ssh", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "bf7dbf67fa9b26ee9f9deb99c49320ba", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 133000000, "source_bytes": 1388, "dest_bytes": 13, "network_bytes": 1401, "event_summary": "SSH-2.0-Go\r\n\u0000\u0000\u0005\\\u0012\u0014\ufffd*\ufffdU5\ufffd\ufffd\u0011(V\u04bdP\ufffdz\ufffd\u0000\u0000\u0001`mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com\u0000\u0000\u0001\ufffdrsa-sha2-256-cert-v01@openssh.com,rsa-sha2-512-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss,ssh-ed25519\u0000\u0000\u0000\ufffdaes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour256,arcfour128,arcfour\u0000\u0000\u0000\ufffdaes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour256,arcfour128,arcfour\u0000\u0000\u0000nhmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96\u0000\u0000\u0000nhmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96\u0000\u0000\u0000\u0004none\u0000\u0000\u0000\u0004none\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd*@\u0014qmO\u000e\ufffd\ufffd~ \r\ufffd\ufffd\ufffd\u001d\ufffd"} +{"timestamp": "2026-08-27T13:48:28", "event_id": "3e933299-7703-445d-922f-3f9faeb399d3", "source_ip": "153.75.82.185", "source_port": 51964, "source_domain": "", "country_code": "US", "country_name": "United States", "city_name": "Ogden", "asn_number": 14956, "asn_org": "RouterHosting LLC", "dest_port": 22, "network_protocol": "", "application_protocol": "ssh", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "bf7dbf67fa9b26ee9f9deb99c49320ba", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 132000000, "source_bytes": 1388, "dest_bytes": 13, "network_bytes": 1401, "event_summary": "SSH-2.0-Go\r\n\u0000\u0000\u0005\\\u0012\u0014\ufffd\ufffd\u0003g\ufffd\ufffd\ufffdu\ufffd\u0007\ufffd.\u0005\ufffd\b:\u0000\u0000\u0001`mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com\u0000\u0000\u0001\ufffdrsa-sha2-256-cert-v01@openssh.com,rsa-sha2-512-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss,ssh-ed25519\u0000\u0000\u0000\ufffdaes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour256,arcfour128,arcfour\u0000\u0000\u0000\ufffdaes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour256,arcfour128,arcfour\u0000\u0000\u0000nhmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96\u0000\u0000\u0000nhmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96\u0000\u0000\u0000\u0004none\u0000\u0000\u0000\u0004none\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u001d\u03b0Jw#L\ufffd\u0011Q\ufffd\ufffdk7\u00d4\ufffd\u0001"} +{"timestamp": "2026-08-27T12:46:18", "event_id": "44f04d10-b1ae-403d-8da1-ac22416ac39c", "source_ip": "45.61.177.179", "source_port": 40906, "source_domain": "179.177.61.45.static.cloudzy.com", "country_code": "US", "country_name": "United States", "city_name": "Ogden", "asn_number": 14956, "asn_org": "RouterHosting LLC", "dest_port": 22, "network_protocol": "", "application_protocol": "ssh", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "bf7dbf67fa9b26ee9f9deb99c49320ba", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 191000000, "source_bytes": 1388, "dest_bytes": 13, "network_bytes": 1401, "event_summary": "SSH-2.0-Go\r\n\u0000\u0000\u0005\\\u0012\u00142\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd&q\ufffd\ufffd\ufffd\ufffd\fb\ufffd\u0000\u0000\u0001`mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com\u0000\u0000\u0001\ufffdrsa-sha2-256-cert-v01@openssh.com,rsa-sha2-512-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss,ssh-ed25519\u0000\u0000\u0000\ufffdaes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour256,arcfour128,arcfour\u0000\u0000\u0000\ufffdaes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour256,arcfour128,arcfour\u0000\u0000\u0000nhmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96\u0000\u0000\u0000nhmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96\u0000\u0000\u0000\u0004none\u0000\u0000\u0000\u0004none\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000j\ufffd\ufffd\ufffd\ufffdK\ufffd\ufffd\u000eWuLD\ufffd5\ufffd.:"} +{"timestamp": "2026-08-27T12:46:17", "event_id": "35c8367a-9ec7-4de2-983f-dfa92904fbff", "source_ip": "45.61.177.179", "source_port": 40892, "source_domain": "179.177.61.45.static.cloudzy.com", "country_code": "US", "country_name": "United States", "city_name": "Ogden", "asn_number": 14956, "asn_org": "RouterHosting LLC", "dest_port": 22, "network_protocol": "", "application_protocol": "ssh", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "bf7dbf67fa9b26ee9f9deb99c49320ba", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 426000000, "source_bytes": 1388, "dest_bytes": 13, "network_bytes": 1401, "event_summary": "SSH-2.0-Go\r\n\u0000\u0000\u0005\\\u0012\u0014\u6ff9\u001a\u04489\ufffdr=U\ufffd\ufffd\ufffd\ufffdI\u0000\u0000\u0001`mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com\u0000\u0000\u0001\ufffdrsa-sha2-256-cert-v01@openssh.com,rsa-sha2-512-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss,ssh-ed25519\u0000\u0000\u0000\ufffdaes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour256,arcfour128,arcfour\u0000\u0000\u0000\ufffdaes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour256,arcfour128,arcfour\u0000\u0000\u0000nhmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96\u0000\u0000\u0000nhmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96\u0000\u0000\u0000\u0004none\u0000\u0000\u0000\u0004none\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u00000z\u000b[\ufffd\u0019\"\ufffd\ufffd\u00fbR\ufffd\ufffd\ufffd\u0005\u0003\u0014"} +{"timestamp": "2026-08-27T11:42:29", "event_id": "18346f67-3fec-4682-a407-d0e00f5d6b72", "source_ip": "144.172.99.12", "source_port": 35054, "source_domain": "12.99.172.144.static.cloudzy.com", "country_code": "US", "country_name": "United States", "city_name": "Staten Island", "asn_number": 14956, "asn_org": "RouterHosting LLC", "dest_port": 443, "network_protocol": "tls", "application_protocol": "http", "http_method": "GET", "user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36", "url_path": "/.env", "url_domain": "", "http_request_headers": "{\"connection\":\"keep-alive\",\"host\":\"\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36\"}", "ssh_client_hassh": "", "tls_client_ja4": "t13i100900_61a7ad8aa9b6_88aa062a14c8", "tls_client_ja3": "92e3065cf9444ba90adc1bce4206011c", "tls_client_version": "TLSv1.3", "tls_client_cipher": "TLS_CHACHA20_POLY1305_SHA256", "http_request_ja4h": "ge11nn0300_7fd797acd99d", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 191, "dest_bytes": 78, "network_bytes": 269, "event_summary": ""} +{"timestamp": "2026-08-27T10:35:10", "event_id": "f9848029-509b-4477-bf14-19ef54c588be", "source_ip": "45.61.129.23", "source_port": 63690, "source_domain": "23.129.61.45.static.cloudzy.com", "country_code": "US", "country_name": "United States", "city_name": "Las Vegas", "asn_number": 14956, "asn_org": "RouterHosting LLC", "dest_port": 445, "network_protocol": "", "application_protocol": "", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 101000000, "source_bytes": 51, "dest_bytes": 12, "network_bytes": 63, "event_summary": "\u0000\u0000\u0000/\ufffdSMBr\u0000\u0000\u0000\u0000\u0018\u0001H\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd \u0000\u0000\u0000\u0000\u0000\f\u0000\u0002NT LM 0.12\u0000"} +{"timestamp": "2026-08-27T10:35:10", "event_id": "734cc4ff-8014-4845-ac7c-378bc472453d", "source_ip": "45.61.129.23", "source_port": 63664, "source_domain": "23.129.61.45.static.cloudzy.com", "country_code": "US", "country_name": "United States", "city_name": "Las Vegas", "asn_number": 14956, "asn_org": "RouterHosting LLC", "dest_port": 445, "network_protocol": "", "application_protocol": "", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 101000000, "source_bytes": 51, "dest_bytes": 12, "network_bytes": 63, "event_summary": "\u0000\u0000\u0000/\ufffdSMBr\u0000\u0000\u0000\u0000\u0018\u0001H\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd \u0000\u0000\u0000\u0000\u0000\f\u0000\u0002NT LM 0.12\u0000"} +{"timestamp": "2026-08-27T09:48:12", "event_id": "073137a7-f4bf-4f1b-863d-ef38dc7d33d3", "source_ip": "45.61.177.185", "source_port": 45368, "source_domain": "185.177.61.45.static.cloudzy.com", "country_code": "US", "country_name": "United States", "city_name": "Ogden", "asn_number": 14956, "asn_org": "RouterHosting LLC", "dest_port": 22, "network_protocol": "", "application_protocol": "ssh", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "bf7dbf67fa9b26ee9f9deb99c49320ba", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 142000000, "source_bytes": 1388, "dest_bytes": 13, "network_bytes": 1401, "event_summary": "SSH-2.0-Go\r\n\u0000\u0000\u0005\\\u0012\u0014\b\ufffd\ufffd\ufffd\ufffd\ufffd\u0007\u03a0QO\ufffd\ufffd\ufffd\ufffd>\u0000\u0000\u0001`mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com\u0000\u0000\u0001\ufffdrsa-sha2-256-cert-v01@openssh.com,rsa-sha2-512-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss,ssh-ed25519\u0000\u0000\u0000\ufffdaes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour256,arcfour128,arcfour\u0000\u0000\u0000\ufffdaes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour256,arcfour128,arcfour\u0000\u0000\u0000nhmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96\u0000\u0000\u0000nhmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96\u0000\u0000\u0000\u0004none\u0000\u0000\u0000\u0004none\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\\c\ufffd.e\ufffd\ufffd_\u0019@\ufffd\u0012\ufffd\ufffd\ufffd(''"} +{"timestamp": "2026-08-27T01:23:55", "event_id": "17aceb51-9c31-4de4-86ad-13b40d2b3b33", "source_ip": "45.61.177.185", "source_port": 58928, "source_domain": "185.177.61.45.static.cloudzy.com", "country_code": "US", "country_name": "United States", "city_name": "Ogden", "asn_number": 14956, "asn_org": "RouterHosting LLC", "dest_port": 22, "network_protocol": "", "application_protocol": "ssh", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "bf7dbf67fa9b26ee9f9deb99c49320ba", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 132000000, "source_bytes": 1388, "dest_bytes": 13, "network_bytes": 1401, "event_summary": "SSH-2.0-Go\r\n\u0000\u0000\u0005\\\u0012\u0014\ufffd\ufffd\u0003\ufffds\ufffd\ufffd;\ufffdV=\ufffd\ufffdc\ufffd\u001f\u0000\u0000\u0001`mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com\u0000\u0000\u0001\ufffdrsa-sha2-256-cert-v01@openssh.com,rsa-sha2-512-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss,ssh-ed25519\u0000\u0000\u0000\ufffdaes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour256,arcfour128,arcfour\u0000\u0000\u0000\ufffdaes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour256,arcfour128,arcfour\u0000\u0000\u0000nhmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96\u0000\u0000\u0000nhmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96\u0000\u0000\u0000\u0004none\u0000\u0000\u0000\u0004none\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0200\u001cqL\ufffd\u0007\tSp{ \u001e\ufffd\ufffd\u0005\u007f\ufffd"} +{"timestamp": "2026-08-27T00:57:33", "event_id": "80b4b385-ca8b-4315-8c83-168f3b29217f", "source_ip": "45.61.170.85", "source_port": 36984, "source_domain": "powered-by.atomicnetworks.co", "country_code": "US", "country_name": "United States", "city_name": "Las Vegas", "asn_number": 14956, "asn_org": "RouterHosting LLC", "dest_port": 22, "network_protocol": "", "application_protocol": "ssh", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "bf7dbf67fa9b26ee9f9deb99c49320ba", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 250000000, "source_bytes": 1388, "dest_bytes": 12, "network_bytes": 1400, "event_summary": "SSH-2.0-Go\r\n\u0000\u0000\u0005\\\u0012\u0014\ufffd\ufffdP>u\ufffd=\ufffdY\ufffd\ufffd,\u00039\ufffdu\u0000\u0000\u0001`mlkem768x25519-sha256,curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com\u0000\u0000\u0001\ufffdrsa-sha2-256-cert-v01@openssh.com,rsa-sha2-512-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss,ssh-ed25519\u0000\u0000\u0000\ufffdaes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour256,arcfour128,arcfour\u0000\u0000\u0000\ufffdaes128-gcm@openssh.com,aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,arcfour256,arcfour128,arcfour\u0000\u0000\u0000nhmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96\u0000\u0000\u0000nhmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96\u0000\u0000\u0000\u0004none\u0000\u0000\u0000\u0004none\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\u02dc\ufffd\r\u0019\ufffd~\ufffd\ufffdY\u0007\ufffd/n\ufffdYg"} +{"timestamp": "2026-08-28T23:50:10", "event_id": "80199e47-111b-4806-8c8e-d55e08f30a57", "source_ip": "167.88.168.121", "source_port": 60540, "source_domain": "121.168.88.167.static.cloudzy.com", "country_code": "US", "country_name": "United States", "city_name": "Dallas", "asn_number": 14956, "asn_org": "RouterHosting LLC", "dest_port": 80, "network_protocol": "", "application_protocol": "http", "http_method": "GET", "user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0", "url_path": "/", "url_domain": "", "http_request_headers": "{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0\"}", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "ge11nn0400_9c3956fad5da", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 164, "dest_bytes": 79, "network_bytes": 243, "event_summary": ""} +{"timestamp": "2026-08-28T23:08:44", "event_id": "7989b41a-30ef-4ae6-985a-96d2bebc5614", "source_ip": "167.88.168.121", "source_port": 32782, "source_domain": "121.168.88.167.static.cloudzy.com", "country_code": "US", "country_name": "United States", "city_name": "Dallas", "asn_number": 14956, "asn_org": "RouterHosting LLC", "dest_port": 80, "network_protocol": "", "application_protocol": "http", "http_method": "GET", "user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0", "url_path": "/", "url_domain": "", "http_request_headers": "{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0\"}", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "ge11nn0400_9c3956fad5da", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 164, "dest_bytes": 79, "network_bytes": 243, "event_summary": ""} +{"timestamp": "2026-08-28T21:31:40", "event_id": "01995649-8cc2-4929-b829-ab3d1b4e8bb7", "source_ip": "172.86.114.254", "source_port": 61592, "source_domain": "254.114.86.172.static.cloudzy.com", "country_code": "US", "country_name": "United States", "city_name": "Dallas", "asn_number": 14956, "asn_org": "RouterHosting LLC", "dest_port": 445, "network_protocol": "", "application_protocol": "smbv1", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 4, "event_duration": 469000000, "source_bytes": 455, "dest_bytes": 56, "network_bytes": 511, "event_summary": "\u0000\u0000\u0000N\ufffdSMB2\u0000\u0000\u0000\u0000\u0018\u0007\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\u0000\u0000A\u0000\u000f\f\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u00014\ufffd\u0000\u0000\u0000\f\u0000B\u0000\u0000\u0000N\u0000\u0001\u0000\u000e\u0000\r\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000"} +{"timestamp": "2026-08-28T21:31:36", "event_id": "203d3d38-170b-443a-a261-006ccf36b8e1", "source_ip": "172.86.114.254", "source_port": 60820, "source_domain": "254.114.86.172.static.cloudzy.com", "country_code": "US", "country_name": "United States", "city_name": "Dallas", "asn_number": 14956, "asn_org": "RouterHosting LLC", "dest_port": 445, "network_protocol": "", "application_protocol": "smbv1", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 4, "event_duration": 470000000, "source_bytes": 364, "dest_bytes": 56, "network_bytes": 420, "event_summary": "\u0000\u0000\u0000J\ufffdSMB%\u0000\u0000\u0000\u0000\u0018\u0001(\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0010\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000J\u0000\u0000\u0000J\u0000\u0002\u0000#\u0000\u0000\u0000\u0007\u0000\\PIPE\\\u0000"} +{"timestamp": "2026-08-30T07:11:38", "event_id": "be5e969e-3b83-4571-84f3-08a56e79d504", "source_ip": "144.172.111.21", "source_port": 33266, "source_domain": "21.111.172.144.static.cloudzy.com", "country_code": "US", "country_name": "United States", "city_name": "Las Vegas", "asn_number": 14956, "asn_org": "RouterHosting LLC", "dest_port": 1723, "network_protocol": "", "application_protocol": "pptp", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 100000000, "source_bytes": 156, "dest_bytes": 14, "network_bytes": 170, "event_summary": "\u0000\ufffd\u0000\u0001\u001a+:5061 SIP/2.0\r\nVia: SIP/2.0/TLS 144.172.115.222:45912;branch=z9hG4bK86f2e261d5;rport\r\nFrom: ;tag=41bf8220\r\nTo: :5061>\r\nCall-ID: b15233ac-2733-4105-81a4-a481cce74742@144.172.115.222\r\nCSeq: 1 INVITE\r\nContact: \r\nMax-Forwards: 70\r\nUser-Agent: 1001/GOLIATH\r\nAccept: application/sdp\r\nContent-Type: application/sdp\r\nContent-Length: 217\r\n\r\nv=0\r\no=- 1787742823 1787742823 IN IP4 144.172.115.222\r\ns=Call\r\nc=IN IP4 144.172.115.222\r\nt=0 0\r\nm=audio 7078 RTP/AVP 0 8 101\r\na=rtpmap:0 PCMU/8000\r\na=rtpmap:8 PCMA/8000\r\na=rtpmap:101 telephone-event/8000\r\na=sendrecv\r\n"} +{"timestamp": "2026-08-30T05:46:50", "event_id": "0262682e-0ab6-4b85-823b-e8af651fab99", "source_ip": "144.172.115.222", "source_port": 38624, "source_domain": "222.115.172.144.static.cloudzy.com", "country_code": "US", "country_name": "United States", "city_name": "Ogden", "asn_number": 14956, "asn_org": "RouterHosting LLC", "dest_port": 5061, "network_protocol": "tls", "application_protocol": "sip", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "t13i311000_e8f1e7e78f70_d41ae481755e", "tls_client_ja3": "004556e859f3c26c5d19746b3a957c74", "tls_client_version": "TLSv1.3", "tls_client_cipher": "TLS_CHACHA20_POLY1305_SHA256", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 474000000, "source_bytes": 424, "dest_bytes": 80, "network_bytes": 504, "event_summary": "OPTIONS sip::5061 SIP/2.0\r\nVia: SIP/2.0/TLS 144.172.115.222:38624;branch=z9hG4bK929f7920c7;rport\r\nFrom: ;tag=afdcb41c\r\nTo: :5061>\r\nCall-ID: c304a861-41e9-4047-9568-490a46629140@144.172.115.222\r\nCSeq: 1 OPTIONS\r\nContact: \r\nMax-Forwards: 70\r\nUser-Agent: 1001/GOLIATH\r\nAccept: application/sdp\r\nContent-Length: 0\r\n\r\n"} +{"timestamp": "2026-08-30T05:07:17", "event_id": "fc7ee807-c618-4aeb-8c9b-544c624f3bea", "source_ip": "172.86.91.225", "source_port": 52492, "source_domain": "225.91.86.172.static.cloudzy.com", "country_code": "US", "country_name": "United States", "city_name": "Dallas", "asn_number": 14956, "asn_org": "RouterHosting LLC", "dest_port": 445, "network_protocol": "", "application_protocol": "smbv1", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 4, "event_duration": 469000000, "source_bytes": 455, "dest_bytes": 52, "network_bytes": 507, "event_summary": "\u0000\u0000\u0000N\ufffdSMB2\u0000\u0000\u0000\u0000\u0018\u0007\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\ufffd\ufffd\u0000\u0000A\u0000\u000f\f\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u00014\ufffd\u0000\u0000\u0000\f\u0000B\u0000\u0000\u0000N\u0000\u0001\u0000\u000e\u0000\r\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000"} +{"timestamp": "2026-08-30T05:07:14", "event_id": "f1c34577-bffc-4658-97df-5020d5e96308", "source_ip": "172.86.91.225", "source_port": 51736, "source_domain": "225.91.86.172.static.cloudzy.com", "country_code": "US", "country_name": "United States", "city_name": "Dallas", "asn_number": 14956, "asn_org": "RouterHosting LLC", "dest_port": 445, "network_protocol": "", "application_protocol": "smbv1", "http_method": "", "user_agent": "", "url_path": "", "url_domain": "", "http_request_headers": "", "ssh_client_hassh": "", "tls_client_ja4": "", "tls_client_ja3": "", "tls_client_version": "", "tls_client_cipher": "", "http_request_ja4h": "", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 4, "event_duration": 469000000, "source_bytes": 364, "dest_bytes": 52, "network_bytes": 416, "event_summary": "\u0000\u0000\u0000J\ufffdSMB%\u0000\u0000\u0000\u0000\u0018\u0001(\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0010\u0000\u0000\u0000\u0000\ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000J\u0000\u0000\u0000J\u0000\u0002\u0000#\u0000\u0000\u0000\u0007\u0000\\PIPE\\\u0000"} +{"timestamp": "2026-08-30T00:48:19", "event_id": "51d0bf9d-938d-4f8c-8b51-c8a331f2b7cb", "source_ip": "144.172.99.12", "source_port": 43924, "source_domain": "12.99.172.144.static.cloudzy.com", "country_code": "US", "country_name": "United States", "city_name": "Staten Island", "asn_number": 14956, "asn_org": "RouterHosting LLC", "dest_port": 443, "network_protocol": "tls", "application_protocol": "http", "http_method": "GET", "user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36", "url_path": "/.env", "url_domain": "", "http_request_headers": "{\"connection\":\"keep-alive\",\"host\":\"\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36\"}", "ssh_client_hassh": "", "tls_client_ja4": "t13i100900_61a7ad8aa9b6_88aa062a14c8", "tls_client_ja3": "92e3065cf9444ba90adc1bce4206011c", "tls_client_version": "TLSv1.3", "tls_client_cipher": "TLS_AES_128_GCM_SHA256", "http_request_ja4h": "ge11nn0300_7fd797acd99d", "tls_client_server_name": "", "tls_client_cert_subject": "", "tls_client_cert_issuer": "", "event_sequence": 1, "event_duration": 101000000, "source_bytes": 191, "dest_bytes": 78, "network_bytes": 269, "event_summary": ""} -- cgit v1.2.3