From e93e7f67d4f70177c3ab5a34e8cc5b24fa2dde6d Mon Sep 17 00:00:00 2001 From: hrbrmstr Date: Mon, 31 Aug 2026 07:56:38 -0400 Subject: add: bph report iocs --- .../session_search_20260831T113639_67644f88.ndjson | 52 ++++++++++++++++++++++ 1 file changed, 52 insertions(+) create mode 100644 kevlar/2026-08-31/sponge/ip-sessions/session_search_20260831T113639_67644f88.ndjson (limited to 'kevlar/2026-08-31/sponge/ip-sessions/session_search_20260831T113639_67644f88.ndjson') diff --git a/kevlar/2026-08-31/sponge/ip-sessions/session_search_20260831T113639_67644f88.ndjson b/kevlar/2026-08-31/sponge/ip-sessions/session_search_20260831T113639_67644f88.ndjson new file mode 100644 index 0000000..07c1abb --- /dev/null +++ b/kevlar/2026-08-31/sponge/ip-sessions/session_search_20260831T113639_67644f88.ndjson @@ -0,0 +1,52 @@ +{"@timestamp":1787398665343,"_id":"260822-X4nLaVzv3zJNOLl3p7BHZl0P","_index":"arkime_sessions3-260822","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Kaopu Cloud HK Limited"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Lightnode Limited"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":0,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":0,"port":24031},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[77797],"firstPacket":1787397977573,"ipProtocol":6,"lastPacket":1787397977573,"length":0,"network":{"bytes":66,"community_id":"1:uyfQUu9gAq+Y6XLcT0DheS6CQJo=","packets":1},"node":"spark-afae","packetPos":[-77797,2097061],"packetRange":{"gte":1787397977573,"lte":1787397977573},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":66,"geo":{"country_iso_code":"PH"},"ip":"154.90.37.55","mac":["fc:bd:67:9d:2b:2b"],"mac-cnt":1,"packets":1,"port":54546},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcRIR":"AFRINIC","srcTTL":[121],"srcTTLCnt":1,"tags":["contabo-sponge-01-ts","honeypot","sensor:contabo-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":1,"dstZero":0,"ece":1,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":1706944210},"totDataBytes":0} +{"@timestamp":1787398665159,"_id":"260822-X4nd8srWqnROCLx7W8lIU1z_","_index":"arkime_sessions3-260822","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Kaopu Cloud HK Limited"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Lightnode Limited"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":0,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":0,"port":24030},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[77797],"firstPacket":1787397977555,"ipProtocol":6,"lastPacket":1787397978563,"length":1008,"network":{"bytes":132,"community_id":"1:O6sIB1EGECphqiUfIK51qQTzgUA=","packets":2},"node":"spark-afae","packetPos":[-77797,2094607,116105],"packetRange":{"gte":1787397977555,"lte":1787397978563},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":132,"geo":{"country_iso_code":"PH"},"ip":"154.90.37.55","mac":["fc:bd:67:9d:2b:2b"],"mac-cnt":1,"packets":2,"port":54285},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcRIR":"AFRINIC","srcTTL":[120],"srcTTLCnt":1,"tags":["contabo-sponge-01-ts","honeypot","sensor:contabo-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":1238186765},"totDataBytes":0} +{"@timestamp":1787398665194,"_id":"260822-X4mw8mYbdt1BmKXNaz68E6mR","_index":"arkime_sessions3-260822","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Kaopu Cloud HK Limited"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Lightnode Limited"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":0,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":0,"port":24029},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[77797],"firstPacket":1787397977533,"ipProtocol":6,"lastPacket":1787397978536,"length":1003,"network":{"bytes":132,"community_id":"1:7h3So8ldJYoA6n9nNIJtodk2XMg=","packets":2},"node":"spark-afae","packetPos":[-77797,2091375,118605],"packetRange":{"gte":1787397977533,"lte":1787397978536},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":132,"geo":{"country_iso_code":"PH"},"ip":"154.90.37.55","mac":["fc:bd:67:9d:2b:2b"],"mac-cnt":1,"packets":2,"port":54022},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcRIR":"AFRINIC","srcTTL":[120],"srcTTLCnt":1,"tags":["contabo-sponge-01-ts","honeypot","sensor:contabo-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":2290323738},"totDataBytes":0} +{"@timestamp":1787398665148,"_id":"260822-X4kN0a2_eFZM46SonrPlWXA2","_index":"arkime_sessions3-260822","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Kaopu Cloud HK Limited"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Lightnode Limited"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":0,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":0,"port":24028},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[77797],"firstPacket":1787397977516,"ipProtocol":6,"lastPacket":1787397977516,"length":0,"network":{"bytes":66,"community_id":"1:zZRVm8nnH3TOOtXjyoMBikQzLuE=","packets":1},"node":"spark-afae","packetPos":[-77797,2088605],"packetRange":{"gte":1787397977516,"lte":1787397977516},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":66,"geo":{"country_iso_code":"PH"},"ip":"154.90.37.55","mac":["fc:bd:67:9d:2b:2b"],"mac-cnt":1,"packets":1,"port":53763},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcRIR":"AFRINIC","srcTTL":[120],"srcTTLCnt":1,"tags":["contabo-sponge-01-ts","honeypot","sensor:contabo-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":1,"dstZero":0,"ece":1,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":1083093204},"totDataBytes":0} +{"@timestamp":1787398665208,"_id":"260822-X4n2AVKwFiJObaXqpXnC_61m","_index":"arkime_sessions3-260822","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Kaopu Cloud HK Limited"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Lightnode Limited"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":0,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":0,"port":24027},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[77797],"firstPacket":1787397977494,"ipProtocol":6,"lastPacket":1787397977494,"length":0,"network":{"bytes":66,"community_id":"1:990h68cQiGTChN7KirRm+wed8U8=","packets":1},"node":"spark-afae","packetPos":[-77797,2085355],"packetRange":{"gte":1787397977494,"lte":1787397977494},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":66,"geo":{"country_iso_code":"PH"},"ip":"154.90.37.55","mac":["fc:bd:67:9d:2b:2b"],"mac-cnt":1,"packets":1,"port":53501},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcRIR":"AFRINIC","srcTTL":[121],"srcTTLCnt":1,"tags":["contabo-sponge-01-ts","honeypot","sensor:contabo-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":1,"dstZero":0,"ece":1,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":2642266677},"totDataBytes":0} +{"@timestamp":1787398665183,"_id":"260822-X4n4xbKmUyRGMIOsPR8vENs_","_index":"arkime_sessions3-260822","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Kaopu Cloud HK Limited"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Lightnode Limited"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":0,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":0,"port":24026},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[77797],"firstPacket":1787397977477,"ipProtocol":6,"lastPacket":1787397978486,"length":1009,"network":{"bytes":132,"community_id":"1:AizbHLUae4tyDGxUJ70CM2PsOWY=","packets":2},"node":"spark-afae","packetPos":[-77797,2082001,127007],"packetRange":{"gte":1787397977477,"lte":1787397978486},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":132,"geo":{"country_iso_code":"PH"},"ip":"154.90.37.55","mac":["fc:bd:67:9d:2b:2b"],"mac-cnt":1,"packets":2,"port":53241},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcRIR":"AFRINIC","srcTTL":[121],"srcTTLCnt":1,"tags":["contabo-sponge-01-ts","honeypot","sensor:contabo-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":3641959366},"totDataBytes":0} +{"@timestamp":1787398665184,"_id":"260822-X4mYIIgvZStKpY6WE_YSe4zw","_index":"arkime_sessions3-260822","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Kaopu Cloud HK Limited"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Lightnode Limited"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":0,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":0,"port":24025},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[77797],"firstPacket":1787397977459,"ipProtocol":6,"lastPacket":1787397977459,"length":0,"network":{"bytes":66,"community_id":"1:e/5tDr2xLWC29K5tT+8ni7mG+IQ=","packets":1},"node":"spark-afae","packetPos":[-77797,2077587],"packetRange":{"gte":1787397977459,"lte":1787397977459},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":66,"geo":{"country_iso_code":"PH"},"ip":"154.90.37.55","mac":["fc:bd:67:9d:2b:2b"],"mac-cnt":1,"packets":1,"port":52977},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcRIR":"AFRINIC","srcTTL":[120],"srcTTLCnt":1,"tags":["contabo-sponge-01-ts","honeypot","sensor:contabo-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":1,"dstZero":0,"ece":1,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":974859599},"totDataBytes":0} +{"@timestamp":1787398665543,"_id":"260822-X4kY8d_dt-lPdLHA2Si55NMW","_index":"arkime_sessions3-260822","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Kaopu Cloud HK Limited"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Lightnode Limited"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":0,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":0,"port":24024},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[77797],"firstPacket":1787397977440,"ipProtocol":6,"lastPacket":1787397978454,"length":1014,"network":{"bytes":132,"community_id":"1:TeRseNppQOdihGzDZmB8sIsDCPU=","packets":2},"node":"spark-afae","packetPos":[-77797,2072859,134575],"packetRange":{"gte":1787397977440,"lte":1787397978454},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":132,"geo":{"country_iso_code":"PH"},"ip":"154.90.37.55","mac":["fc:bd:67:9d:2b:2b"],"mac-cnt":1,"packets":2,"port":52714},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcRIR":"AFRINIC","srcTTL":[121],"srcTTLCnt":1,"tags":["contabo-sponge-01-ts","honeypot","sensor:contabo-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":2055315097},"totDataBytes":0} +{"@timestamp":1787398665185,"_id":"260822-X4kxD66oMQdNt4P30FFQH9H2","_index":"arkime_sessions3-260822","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Kaopu Cloud HK Limited"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Lightnode Limited"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":0,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":0,"port":24023},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[77797],"firstPacket":1787397977422,"ipProtocol":6,"lastPacket":1787397978424,"length":1002,"network":{"bytes":132,"community_id":"1:Q49sb7fg0f7P2EM0fvfcnnOP1JA=","packets":2},"node":"spark-afae","packetPos":[-77797,2068391,137169],"packetRange":{"gte":1787397977422,"lte":1787397978424},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":132,"geo":{"country_iso_code":"PH"},"ip":"154.90.37.55","mac":["fc:bd:67:9d:2b:2b"],"mac-cnt":1,"packets":2,"port":52443},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcRIR":"AFRINIC","srcTTL":[121],"srcTTLCnt":1,"tags":["contabo-sponge-01-ts","honeypot","sensor:contabo-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":2750823716},"totDataBytes":0} +{"@timestamp":1787398665206,"_id":"260822-X4lEjQ7FyNlMyq22l8aijtGL","_index":"arkime_sessions3-260822","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Kaopu Cloud HK Limited"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Lightnode Limited"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":0,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":0,"port":24022},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[77797],"firstPacket":1787397977408,"ipProtocol":6,"lastPacket":1787397978410,"length":1002,"network":{"bytes":132,"community_id":"1:fpijL4tokWqauLEQrd1iXwEjt8Y=","packets":2},"node":"spark-afae","packetPos":[-77797,2063543,140711],"packetRange":{"gte":1787397977408,"lte":1787397978410},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":132,"geo":{"country_iso_code":"PH"},"ip":"154.90.37.55","mac":["fc:bd:67:9d:2b:2b"],"mac-cnt":1,"packets":2,"port":52165},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcRIR":"AFRINIC","srcTTL":[120],"srcTTLCnt":1,"tags":["contabo-sponge-01-ts","honeypot","sensor:contabo-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":3512260208},"totDataBytes":0} +{"@timestamp":1787398665543,"_id":"260822-X4n7e3TRO6ZAMLWBQ83sr8qb","_index":"arkime_sessions3-260822","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Kaopu Cloud HK Limited"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Lightnode Limited"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":0,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":0,"port":24021},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[77797],"firstPacket":1787397977386,"ipProtocol":6,"lastPacket":1787397977386,"length":0,"network":{"bytes":66,"community_id":"1:l644tk0x7iSkVzm4AAtOPMzfKIM=","packets":1},"node":"spark-afae","packetPos":[-77797,2056677],"packetRange":{"gte":1787397977386,"lte":1787397977386},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":66,"geo":{"country_iso_code":"PH"},"ip":"154.90.37.55","mac":["fc:bd:67:9d:2b:2b"],"mac-cnt":1,"packets":1,"port":51893},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcRIR":"AFRINIC","srcTTL":[121],"srcTTLCnt":1,"tags":["contabo-sponge-01-ts","honeypot","sensor:contabo-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":1,"dstZero":0,"ece":1,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":2227258719},"totDataBytes":0} +{"@timestamp":1787398665343,"_id":"260822-X4l7TKSifGxGlKu2SQfvQLAb","_index":"arkime_sessions3-260822","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Kaopu Cloud HK Limited"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Lightnode Limited"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":0,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":0,"port":24020},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[77797],"firstPacket":1787397977363,"ipProtocol":6,"lastPacket":1787397978363,"length":1000,"network":{"bytes":132,"community_id":"1:sqX9RGNrfoi4rSiM39dGO5EKIW0=","packets":2},"node":"spark-afae","packetPos":[-77797,2048005,151529],"packetRange":{"gte":1787397977363,"lte":1787397978363},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":132,"geo":{"country_iso_code":"PH"},"ip":"154.90.37.55","mac":["fc:bd:67:9d:2b:2b"],"mac-cnt":1,"packets":2,"port":51621},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcRIR":"AFRINIC","srcTTL":[120],"srcTTLCnt":1,"tags":["contabo-sponge-01-ts","honeypot","sensor:contabo-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":1691784847},"totDataBytes":0} +{"@timestamp":1787398665543,"_id":"260822-X4n6zDVBk3tIsalRNUY-bGYr","_index":"arkime_sessions3-260822","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Kaopu Cloud HK Limited"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Lightnode Limited"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":0,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":0,"port":24019},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[77797],"firstPacket":1787397977345,"ipProtocol":6,"lastPacket":1787397977345,"length":0,"network":{"bytes":66,"community_id":"1:c54CRPHu4j/0IWK1+VlAen0N1hs=","packets":1},"node":"spark-afae","packetPos":[-77797,2038635],"packetRange":{"gte":1787397977345,"lte":1787397977345},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":66,"geo":{"country_iso_code":"PH"},"ip":"154.90.37.55","mac":["fc:bd:67:9d:2b:2b"],"mac-cnt":1,"packets":1,"port":51353},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcRIR":"AFRINIC","srcTTL":[121],"srcTTLCnt":1,"tags":["contabo-sponge-01-ts","honeypot","sensor:contabo-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":1,"dstZero":0,"ece":1,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":3882773355},"totDataBytes":0} +{"@timestamp":1787398665160,"_id":"260822-X4ntziOxl99E8rAf3EWD8NcB","_index":"arkime_sessions3-260822","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Kaopu Cloud HK Limited"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Lightnode Limited"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":0,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":0,"port":24018},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[77797],"firstPacket":1787397977329,"ipProtocol":6,"lastPacket":1787397977329,"length":0,"network":{"bytes":66,"community_id":"1:jV6u8pn6syr3DniiADwUcoO6KAg=","packets":1},"node":"spark-afae","packetPos":[-77797,2029919],"packetRange":{"gte":1787397977329,"lte":1787397977329},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":66,"geo":{"country_iso_code":"PH"},"ip":"154.90.37.55","mac":["fc:bd:67:9d:2b:2b"],"mac-cnt":1,"packets":1,"port":51077},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcRIR":"AFRINIC","srcTTL":[121],"srcTTLCnt":1,"tags":["contabo-sponge-01-ts","honeypot","sensor:contabo-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":1,"dstZero":0,"ece":1,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":950370297},"totDataBytes":0} +{"@timestamp":1787398665186,"_id":"260822-X4kYzpNxB1dNnZV-tpvWifwN","_index":"arkime_sessions3-260822","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Kaopu Cloud HK Limited"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Lightnode Limited"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":0,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":0,"port":24017},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[77797],"firstPacket":1787397977316,"ipProtocol":6,"lastPacket":1787397978316,"length":1000,"network":{"bytes":132,"community_id":"1:kPVwW+VbK06/azywZvJ/Q5TAL6s=","packets":2},"node":"spark-afae","packetPos":[-77797,2023619,170199],"packetRange":{"gte":1787397977316,"lte":1787397978316},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":132,"geo":{"country_iso_code":"PH"},"ip":"154.90.37.55","mac":["fc:bd:67:9d:2b:2b"],"mac-cnt":1,"packets":2,"port":50803},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcRIR":"AFRINIC","srcTTL":[121],"srcTTLCnt":1,"tags":["contabo-sponge-01-ts","honeypot","sensor:contabo-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":3502804748},"totDataBytes":0} +{"@timestamp":1787398665183,"_id":"260822-X4lnWOYXaqhDCK15IS_n8OcG","_index":"arkime_sessions3-260822","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Kaopu Cloud HK Limited"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Lightnode Limited"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":0,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":0,"port":24016},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[77797],"firstPacket":1787397977295,"ipProtocol":6,"lastPacket":1787397978299,"length":1004,"network":{"bytes":132,"community_id":"1:8Mdj3olbcc0yxCwIJq99M6QTti4=","packets":2},"node":"spark-afae","packetPos":[-77797,2011089,180117],"packetRange":{"gte":1787397977295,"lte":1787397978299},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":132,"geo":{"country_iso_code":"PH"},"ip":"154.90.37.55","mac":["fc:bd:67:9d:2b:2b"],"mac-cnt":1,"packets":2,"port":50533},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcRIR":"AFRINIC","srcTTL":[121],"srcTTLCnt":1,"tags":["contabo-sponge-01-ts","honeypot","sensor:contabo-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":78548080},"totDataBytes":0} +{"@timestamp":1787398665169,"_id":"260822-X4lReoiKeblIv5nUCVC8UVJF","_index":"arkime_sessions3-260822","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Kaopu Cloud HK Limited"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Lightnode Limited"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":0,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":0,"port":24015},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[77797],"firstPacket":1787397977276,"ipProtocol":6,"lastPacket":1787397977276,"length":0,"network":{"bytes":66,"community_id":"1:UteZMS6bFtBhJUObRucNuP4nqxQ=","packets":1},"node":"spark-afae","packetPos":[-77797,1998311],"packetRange":{"gte":1787397977276,"lte":1787397977276},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":66,"geo":{"country_iso_code":"PH"},"ip":"154.90.37.55","mac":["fc:bd:67:9d:2b:2b"],"mac-cnt":1,"packets":1,"port":50260},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcRIR":"AFRINIC","srcTTL":[120],"srcTTLCnt":1,"tags":["contabo-sponge-01-ts","honeypot","sensor:contabo-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":1,"dstZero":0,"ece":1,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":2683492483},"totDataBytes":0} +{"@timestamp":1787398665155,"_id":"260822-X4ktteaKUx1O4Ju3O81nGHiC","_index":"arkime_sessions3-260822","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Kaopu Cloud HK Limited"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Lightnode Limited"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":0,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":0,"port":24014},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[77797],"firstPacket":1787397977261,"ipProtocol":6,"lastPacket":1787397977261,"length":0,"network":{"bytes":66,"community_id":"1:QBzjmguGzyUgbiVXzwgaJrXkufM=","packets":1},"node":"spark-afae","packetPos":[-77797,1987353],"packetRange":{"gte":1787397977261,"lte":1787397977261},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":66,"geo":{"country_iso_code":"PH"},"ip":"154.90.37.55","mac":["fc:bd:67:9d:2b:2b"],"mac-cnt":1,"packets":1,"port":49977},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcRIR":"AFRINIC","srcTTL":[121],"srcTTLCnt":1,"tags":["contabo-sponge-01-ts","honeypot","sensor:contabo-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":1,"dstZero":0,"ece":1,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":4209373780},"totDataBytes":0} +{"@timestamp":1787398665171,"_id":"260822-X4kYBumUEJNMxJT1XYMBVlZv","_index":"arkime_sessions3-260822","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Kaopu Cloud HK Limited"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Lightnode Limited"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":0,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":0,"port":24013},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[77797],"firstPacket":1787397977237,"ipProtocol":6,"lastPacket":1787397978251,"length":1014,"network":{"bytes":132,"community_id":"1:ZCUODL8E0HtDJHG6N0o82rnv2ok=","packets":2},"node":"spark-afae","packetPos":[-77797,1969579,213591],"packetRange":{"gte":1787397977237,"lte":1787397978251},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":132,"geo":{"country_iso_code":"PH"},"ip":"154.90.37.55","mac":["fc:bd:67:9d:2b:2b"],"mac-cnt":1,"packets":2,"port":49701},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcRIR":"AFRINIC","srcTTL":[120],"srcTTLCnt":1,"tags":["contabo-sponge-01-ts","honeypot","sensor:contabo-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":1700359251},"totDataBytes":0} +{"@timestamp":1787398665169,"_id":"260822-X4kESF-pxkhE_KTlfI0U1p_p","_index":"arkime_sessions3-260822","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Kaopu Cloud HK Limited"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Lightnode Limited"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":0,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":0,"port":24012},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[77797],"firstPacket":1787397977191,"ipProtocol":6,"lastPacket":1787397977191,"length":0,"network":{"bytes":66,"community_id":"1:uxZC/MZMI6gXSSAp+MfawbzKskc=","packets":1},"node":"spark-afae","packetPos":[-77797,1932007],"packetRange":{"gte":1787397977191,"lte":1787397977191},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":66,"geo":{"country_iso_code":"PH"},"ip":"154.90.37.55","mac":["fc:bd:67:9d:2b:2b"],"mac-cnt":1,"packets":1,"port":49422},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcRIR":"AFRINIC","srcTTL":[121],"srcTTLCnt":1,"tags":["contabo-sponge-01-ts","honeypot","sensor:contabo-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":1,"dstZero":0,"ece":1,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":4166961922},"totDataBytes":0} +{"@timestamp":1787398665343,"_id":"260822-X4lAnsiXnS5L_YEGUQOWQe2R","_index":"arkime_sessions3-260822","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Kaopu Cloud HK Limited"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Lightnode Limited"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":0,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":0,"port":24011},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[77797],"firstPacket":1787397977177,"ipProtocol":6,"lastPacket":1787397978193,"length":1016,"network":{"bytes":132,"community_id":"1:57rsRhbsd8MgSCo4/zLOQNBRCCY=","packets":2},"node":"spark-afae","packetPos":[-77797,1919085,252049],"packetRange":{"gte":1787397977177,"lte":1787397978193},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":132,"geo":{"country_iso_code":"PH"},"ip":"154.90.37.55","mac":["fc:bd:67:9d:2b:2b"],"mac-cnt":1,"packets":2,"port":65528},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcRIR":"AFRINIC","srcTTL":[120],"srcTTLCnt":1,"tags":["contabo-sponge-01-ts","honeypot","sensor:contabo-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":918305215},"totDataBytes":0} +{"@timestamp":1787398665207,"_id":"260822-X4knW85YgYRGTYH5ARv4bU0j","_index":"arkime_sessions3-260822","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Kaopu Cloud HK Limited"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Lightnode Limited"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":0,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":0,"port":24010},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[77797],"firstPacket":1787397977158,"ipProtocol":6,"lastPacket":1787397977158,"length":0,"network":{"bytes":66,"community_id":"1:ljifRjMBa42O7jmqBjftrMfcRvA=","packets":1},"node":"spark-afae","packetPos":[-77797,1897079],"packetRange":{"gte":1787397977158,"lte":1787397977158},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":66,"geo":{"country_iso_code":"PH"},"ip":"154.90.37.55","mac":["fc:bd:67:9d:2b:2b"],"mac-cnt":1,"packets":1,"port":65253},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcRIR":"AFRINIC","srcTTL":[120],"srcTTLCnt":1,"tags":["contabo-sponge-01-ts","honeypot","sensor:contabo-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":1,"dstZero":0,"ece":1,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":519800436},"totDataBytes":0} +{"@timestamp":1787398665206,"_id":"260822-X4nQZIx5ahlJG6c9rSFDlxY_","_index":"arkime_sessions3-260822","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Kaopu Cloud HK Limited"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Lightnode Limited"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":0,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":0,"port":24009},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[77797],"firstPacket":1787397977146,"ipProtocol":6,"lastPacket":1787397977146,"length":0,"network":{"bytes":66,"community_id":"1:Uww6L25Vvf0iIGiJhb3II0qbxoE=","packets":1},"node":"spark-afae","packetPos":[-77797,1882411],"packetRange":{"gte":1787397977146,"lte":1787397977146},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":66,"geo":{"country_iso_code":"PH"},"ip":"154.90.37.55","mac":["fc:bd:67:9d:2b:2b"],"mac-cnt":1,"packets":1,"port":64987},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcRIR":"AFRINIC","srcTTL":[120],"srcTTLCnt":1,"tags":["contabo-sponge-01-ts","honeypot","sensor:contabo-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":1,"dstZero":0,"ece":1,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":2646449100},"totDataBytes":0} +{"@timestamp":1787299489035,"_id":"260821-6cvE9BYbzShI3I93qIx6Z3sH","_index":"arkime_sessions3-260821","client":{"bytes":4},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Kaopu Cloud HK Limited"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Lightnode Limited"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":331,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":4,"port":9025},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstPayload8":"485454502f312e31","dstRIR":"RIPE","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[77245],"firstPacket":1787298703705,"http":{"bodyMagic":["text/plain"],"bodyMagicCnt":1,"responseHeader":["content-type","connection"],"responseHeaderCnt":2,"responseHeaderField":["content-type","connection"],"responseHeaderValue":["text/plain; charset=utf-8","close"],"responseHeaderValueCnt":2,"serverVersion":["1.1"],"serverVersionCnt":1,"statuscode":[400],"statuscodeCnt":1},"initRTT":18,"ipProtocol":6,"lastPacket":1787298708729,"length":5024,"network":{"bytes":697,"community_id":"1:Ie2LUZdJsfzMqjOMqksg6UdOMI8=","packets":10},"node":"spark-afae","packetPos":[-77245,1552857,82,0,76,0,14314,76,173,70,76],"packetRange":{"gte":1787298703705,"lte":1787298708729},"protocol":["http","tcp"],"protocolCnt":2,"rootId":"260821-6cvE9BYbzShI3I93qIx6Z3sH","segmentCnt":1,"server":{"bytes":103},"source":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":366,"geo":{"country_iso_code":"PH"},"ip":"154.90.37.55","mac":["00:c0:1d:c0:ff:ee","fc:bd:67:9d:2b:2b"],"mac-cnt":2,"packets":6,"port":49439},"srcOui":["Arista Networks","Grand Junction Networks, Inc."],"srcOuiCnt":2,"srcPayload8":"05020002","srcRIR":"AFRINIC","srcTTL":[120],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":["Attempted Information Leak"],"categoryCnt":1,"flowId":["2185538806691242"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[2],"severityCnt":1,"signature":["5a66c944-faed-4791-9d94-b44b7bd48352"],"signatureCnt":1,"signatureId":[2000181],"signatureIdCnt":1},"tag":{"block":["false"],"blockCnt":1,"category":["recon"],"categoryCnt":1,"cves":[""],"cvesCnt":1,"description":["socks proxy protocol negotiation"],"intention":["suspicious"],"intentionCnt":1,"name":["socks proxy protocol negotiation"],"nameCnt":1},"tags":["sensor:contabo-sponge-01-ts","honeypot","contabo-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4ls":"67_64_2475171","ja4t":["64240_2-1-3-1-1-4_1460_8"],"ja4tCnt":1,"ja4ts":["64240_2-1-1-4-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":2,"ae":0,"cwr":1,"dstZero":0,"ece":2,"fin":2,"psh":2,"rst":2,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":2362182561},"totDataBytes":107} +{"@timestamp":1787299489000,"_id":"260821-6cv6JD4vXF9LiIoSpKOoVAua","_index":"arkime_sessions3-260821","client":{"bytes":4},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Kaopu Cloud HK Limited"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Lightnode Limited"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":331,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":4,"port":2135},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstPayload8":"485454502f312e31","dstRIR":"RIPE","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[77245],"firstPacket":1787298371502,"http":{"bodyMagic":["text/plain"],"bodyMagicCnt":1,"responseHeader":["content-type","connection"],"responseHeaderCnt":2,"responseHeaderField":["content-type","connection"],"responseHeaderValue":["text/plain; charset=utf-8","close"],"responseHeaderValueCnt":2,"serverVersion":["1.1"],"serverVersionCnt":1,"statuscode":[400],"statuscodeCnt":1},"initRTT":16,"ipProtocol":6,"lastPacket":1787298376529,"length":5027,"network":{"bytes":697,"community_id":"1:bqcna2qyFaPEEndWic7vSIdekYM=","packets":10},"node":"spark-afae","packetPos":[-77245,55475,82,337,76,0,16131,76,173,70,76],"packetRange":{"gte":1787298371502,"lte":1787298376529},"protocol":["http","tcp"],"protocolCnt":2,"rootId":"260821-6cv6JD4vXF9LiIoSpKOoVAua","segmentCnt":1,"server":{"bytes":103},"source":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":366,"geo":{"country_iso_code":"PH"},"ip":"154.90.37.55","mac":["00:c0:1d:c0:ff:ee","fc:bd:67:9d:2b:2b"],"mac-cnt":2,"packets":6,"port":50649},"srcOui":["Arista Networks","Grand Junction Networks, Inc."],"srcOuiCnt":2,"srcPayload8":"05020002","srcRIR":"AFRINIC","srcTTL":[121],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":["Attempted Information Leak"],"categoryCnt":1,"flowId":["1031945960960602"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[2],"severityCnt":1,"signature":["5a66c944-faed-4791-9d94-b44b7bd48352"],"signatureCnt":1,"signatureId":[2000181],"signatureIdCnt":1},"tags":["sensor:contabo-sponge-01-ts","honeypot","contabo-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4ls":"94_64_2479472","ja4t":["64240_2-1-3-1-1-4_1460_8"],"ja4tCnt":1,"ja4ts":["64240_2-1-1-4-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":2,"ae":0,"cwr":1,"dstZero":0,"ece":2,"fin":2,"psh":2,"rst":2,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":177164305},"totDataBytes":107} +{"@timestamp":1787295282368,"_id":"260821-W8tFHV_19yxORrQJlkPfP1Dz","_index":"arkime_sessions3-260821","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Kaopu Cloud HK Limited"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Lightnode Limited"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":0,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":0,"port":8868},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[77221],"firstPacket":1787294686198,"ipProtocol":6,"lastPacket":1787294687188,"length":990,"network":{"bytes":132,"community_id":"1:IA7BHmZO+VVOCtjN2Xnk6H1MCwE=","packets":2},"node":"spark-afae","packetPos":[-77221,3186883,208514],"packetRange":{"gte":1787294686198,"lte":1787294687188},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":132,"geo":{"country_iso_code":"PH"},"ip":"154.90.37.55","mac":["fc:bd:67:9d:2b:2b"],"mac-cnt":1,"packets":2,"port":50672},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcRIR":"AFRINIC","srcTTL":[120],"srcTTLCnt":1,"tags":["sensor:contabo-sponge-01-ts","honeypot","contabo-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":1945144188},"totDataBytes":0} +{"@timestamp":1787295282350,"_id":"260821-W8vUeTKqR3FMTLbvxHOEmx0P","_index":"arkime_sessions3-260821","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Kaopu Cloud HK Limited"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Lightnode Limited"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":0,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":0,"port":8867},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[77221],"firstPacket":1787294686174,"ipProtocol":6,"lastPacket":1787294686174,"length":0,"network":{"bytes":66,"community_id":"1:P+mZnm96l90ULzRD8X5izUsffRg=","packets":1},"node":"spark-afae","packetPos":[-77221,3180907],"packetRange":{"gte":1787294686174,"lte":1787294686174},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":66,"geo":{"country_iso_code":"PH"},"ip":"154.90.37.55","mac":["fc:bd:67:9d:2b:2b"],"mac-cnt":1,"packets":1,"port":50410},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcRIR":"AFRINIC","srcTTL":[120],"srcTTLCnt":1,"tags":["sensor:contabo-sponge-01-ts","honeypot","contabo-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":1,"dstZero":0,"ece":1,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":710168394},"totDataBytes":0} +{"@timestamp":1787295282314,"_id":"260821-W8uVsS0ldmxEq6vYepNhIqey","_index":"arkime_sessions3-260821","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Kaopu Cloud HK Limited"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Lightnode Limited"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":120,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":2,"port":8866},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[77221],"firstPacket":1787294686168,"initRTT":16,"ipProtocol":6,"lastPacket":1787294686236,"length":68,"network":{"bytes":366,"community_id":"1:jeVFkz3ykCaFeUe0+GHp1v2Jq1Q=","packets":6},"node":"spark-afae","packetPos":[-77221,3172913,480,19674,316,228,13406],"packetRange":{"gte":1787294686168,"lte":1787294686236},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":246,"geo":{"country_iso_code":"PH"},"ip":"154.90.37.55","mac":["fc:bd:67:9d:2b:2b","00:c0:1d:c0:ff:ee"],"mac-cnt":2,"packets":4,"port":50144},"srcOui":["Arista Networks","Grand Junction Networks, Inc."],"srcOuiCnt":2,"srcRIR":"AFRINIC","srcTTL":[121],"srcTTLCnt":1,"tags":["sensor:contabo-sponge-01-ts","honeypot","contabo-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-1-3-1-1-4_1460_8"],"ja4tCnt":1,"ja4ts":["64240_2-1-1-4-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":2,"ae":0,"cwr":1,"dstZero":0,"ece":2,"fin":2,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":3125454625},"totDataBytes":0} +{"@timestamp":1787295282329,"_id":"260821-W8sSPyO4QuZC1IuUUmwSS0jq","_index":"arkime_sessions3-260821","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Kaopu Cloud HK Limited"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Lightnode Limited"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":0,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":0,"port":8865},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[77221],"firstPacket":1787294686145,"ipProtocol":6,"lastPacket":1787294687157,"length":1012,"network":{"bytes":132,"community_id":"1:5yWbtuhunbIhjz5+erasnVvumQE=","packets":2},"node":"spark-afae","packetPos":[-77221,3166129,226891],"packetRange":{"gte":1787294686145,"lte":1787294687157},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":132,"geo":{"country_iso_code":"PH"},"ip":"154.90.37.55","mac":["fc:bd:67:9d:2b:2b"],"mac-cnt":1,"packets":2,"port":49881},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcRIR":"AFRINIC","srcTTL":[121],"srcTTLCnt":1,"tags":["sensor:contabo-sponge-01-ts","honeypot","contabo-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":3819536499},"totDataBytes":0} +{"@timestamp":1787295282333,"_id":"260821-W8udM2PdVztCiZT5T1ifZYdV","_index":"arkime_sessions3-260821","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Kaopu Cloud HK Limited"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Lightnode Limited"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":0,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":0,"port":8864},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[77221],"firstPacket":1787294686131,"ipProtocol":6,"lastPacket":1787294687149,"length":1018,"network":{"bytes":132,"community_id":"1:zi6Pte/EDSBL3rym13tO+lFjxFc=","packets":2},"node":"spark-afae","packetPos":[-77221,3158299,233093],"packetRange":{"gte":1787294686131,"lte":1787294687149},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":132,"geo":{"country_iso_code":"PH"},"ip":"154.90.37.55","mac":["fc:bd:67:9d:2b:2b"],"mac-cnt":1,"packets":2,"port":49602},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcRIR":"AFRINIC","srcTTL":[120],"srcTTLCnt":1,"tags":["sensor:contabo-sponge-01-ts","honeypot","contabo-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":707614983},"totDataBytes":0} +{"@timestamp":1787295282400,"_id":"260821-W8tsQjQGVclFrZ8dUDXyMmbo","_index":"arkime_sessions3-260821","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Kaopu Cloud HK Limited"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Lightnode Limited"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":0,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":0,"port":8863},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[77221],"firstPacket":1787294686111,"ipProtocol":6,"lastPacket":1787294686111,"length":0,"network":{"bytes":66,"community_id":"1:ucL0hJ+lM/fnjuaRQCKddo3AN+M=","packets":1},"node":"spark-afae","packetPos":[-77221,3144649],"packetRange":{"gte":1787294686111,"lte":1787294686111},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":66,"geo":{"country_iso_code":"PH"},"ip":"154.90.37.55","mac":["fc:bd:67:9d:2b:2b"],"mac-cnt":1,"packets":1,"port":49335},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcRIR":"AFRINIC","srcTTL":[121],"srcTTLCnt":1,"tags":["sensor:contabo-sponge-01-ts","honeypot","contabo-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":1,"dstZero":0,"ece":1,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":83758623},"totDataBytes":0} +{"@timestamp":1787295282391,"_id":"260821-W8uXpUpbF4FEn6Z2-BRBDN9T","_index":"arkime_sessions3-260821","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Kaopu Cloud HK Limited"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Lightnode Limited"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":0,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":0,"port":8862},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[77221],"firstPacket":1787294686088,"ipProtocol":6,"lastPacket":1787294686088,"length":0,"network":{"bytes":66,"community_id":"1:wldU4BO25vKRSXe8V7CH2ggTiZU=","packets":1},"node":"spark-afae","packetPos":[-77221,3131463],"packetRange":{"gte":1787294686088,"lte":1787294686088},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":66,"geo":{"country_iso_code":"PH"},"ip":"154.90.37.55","mac":["fc:bd:67:9d:2b:2b"],"mac-cnt":1,"packets":1,"port":65454},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcRIR":"AFRINIC","srcTTL":[121],"srcTTLCnt":1,"tags":["sensor:contabo-sponge-01-ts","honeypot","contabo-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":1,"dstZero":0,"ece":1,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":2326875972},"totDataBytes":0} +{"@timestamp":1787295282342,"_id":"260821-W8tNXuTfZIBAJ5LGeLskt4ms","_index":"arkime_sessions3-260821","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Kaopu Cloud HK Limited"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Lightnode Limited"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":0,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":0,"port":8861},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[77221],"firstPacket":1787294686078,"ipProtocol":6,"lastPacket":1787294686078,"length":0,"network":{"bytes":66,"community_id":"1:px3mT4LvJV35xQysImb4FwuKB3s=","packets":1},"node":"spark-afae","packetPos":[-77221,3125967],"packetRange":{"gte":1787294686078,"lte":1787294686078},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":66,"geo":{"country_iso_code":"PH"},"ip":"154.90.37.55","mac":["fc:bd:67:9d:2b:2b"],"mac-cnt":1,"packets":1,"port":65194},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcRIR":"AFRINIC","srcTTL":[120],"srcTTLCnt":1,"tags":["sensor:contabo-sponge-01-ts","honeypot","contabo-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":1,"dstZero":0,"ece":1,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":3479844389},"totDataBytes":0} +{"@timestamp":1787295282351,"_id":"260821-W8vwZYZSKxZNK7F35cLBm2-O","_index":"arkime_sessions3-260821","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Kaopu Cloud HK Limited"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Lightnode Limited"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":0,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":0,"port":8860},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[77221],"firstPacket":1787294686066,"ipProtocol":6,"lastPacket":1787294687074,"length":1008,"network":{"bytes":132,"community_id":"1:TkM92ZmWl9JP/rLrBYaeqdalauQ=","packets":2},"node":"spark-afae","packetPos":[-77221,3112747,270465],"packetRange":{"gte":1787294686066,"lte":1787294687074},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":132,"geo":{"country_iso_code":"PH"},"ip":"154.90.37.55","mac":["fc:bd:67:9d:2b:2b"],"mac-cnt":1,"packets":2,"port":64933},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcRIR":"AFRINIC","srcTTL":[121],"srcTTLCnt":1,"tags":["sensor:contabo-sponge-01-ts","honeypot","contabo-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":3894118945},"totDataBytes":0} +{"@timestamp":1787295282356,"_id":"260821-W8vzhVbrZn1Gia36Ar-iS1m9","_index":"arkime_sessions3-260821","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Kaopu Cloud HK Limited"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Lightnode Limited"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":0,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":0,"port":8859},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[77221],"firstPacket":1787294686053,"ipProtocol":6,"lastPacket":1787294686053,"length":0,"network":{"bytes":66,"community_id":"1:oiwlxAjPyIWZhAlTFZNNTGEIV9s=","packets":1},"node":"spark-afae","packetPos":[-77221,3102425],"packetRange":{"gte":1787294686053,"lte":1787294686053},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":66,"geo":{"country_iso_code":"PH"},"ip":"154.90.37.55","mac":["fc:bd:67:9d:2b:2b"],"mac-cnt":1,"packets":1,"port":64669},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcRIR":"AFRINIC","srcTTL":[120],"srcTTLCnt":1,"tags":["sensor:contabo-sponge-01-ts","honeypot","contabo-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":1,"dstZero":0,"ece":1,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":1532565211},"totDataBytes":0} +{"@timestamp":1787295282365,"_id":"260821-W8uPwTa2z25FR6A3L7Tfa7lP","_index":"arkime_sessions3-260821","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Kaopu Cloud HK Limited"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Lightnode Limited"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":0,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":0,"port":8858},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[77221],"firstPacket":1787294686039,"ipProtocol":6,"lastPacket":1787294687048,"length":1009,"network":{"bytes":132,"community_id":"1:CSKRqG5c/+KM25J7zkuGephZFzM=","packets":2},"node":"spark-afae","packetPos":[-77221,3093161,284010],"packetRange":{"gte":1787294686039,"lte":1787294687048},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":132,"geo":{"country_iso_code":"PH"},"ip":"154.90.37.55","mac":["fc:bd:67:9d:2b:2b"],"mac-cnt":1,"packets":2,"port":64406},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcRIR":"AFRINIC","srcTTL":[120],"srcTTLCnt":1,"tags":["sensor:contabo-sponge-01-ts","honeypot","contabo-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":3504527314},"totDataBytes":0} +{"@timestamp":1787295282317,"_id":"260821-W8vTDr3R_h9EkqmIh5fMBWyu","_index":"arkime_sessions3-260821","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Kaopu Cloud HK Limited"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Lightnode Limited"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":0,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":0,"port":8857},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[77221],"firstPacket":1787294686023,"ipProtocol":6,"lastPacket":1787294686023,"length":0,"network":{"bytes":66,"community_id":"1:jf+L6uus9e240DsOR4JY6DQ1NHM=","packets":1},"node":"spark-afae","packetPos":[-77221,3077953],"packetRange":{"gte":1787294686023,"lte":1787294686023},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":66,"geo":{"country_iso_code":"PH"},"ip":"154.90.37.55","mac":["fc:bd:67:9d:2b:2b"],"mac-cnt":1,"packets":1,"port":64143},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcRIR":"AFRINIC","srcTTL":[120],"srcTTLCnt":1,"tags":["sensor:contabo-sponge-01-ts","honeypot","contabo-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":1,"dstZero":0,"ece":1,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":3736444422},"totDataBytes":0} +{"@timestamp":1787295282393,"_id":"260821-W8u98abx81xIWoVcChQR2N5v","_index":"arkime_sessions3-260821","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Kaopu Cloud HK Limited"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Lightnode Limited"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":0,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":0,"port":8856},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[77221],"firstPacket":1787294686015,"ipProtocol":6,"lastPacket":1787294687015,"length":1000,"network":{"bytes":132,"community_id":"1:obOc3V7pcOuhShBPYFKaJ4TOgbQ=","packets":2},"node":"spark-afae","packetPos":[-77221,3069767,304488],"packetRange":{"gte":1787294686015,"lte":1787294687015},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":132,"geo":{"country_iso_code":"PH"},"ip":"154.90.37.55","mac":["fc:bd:67:9d:2b:2b"],"mac-cnt":1,"packets":2,"port":63873},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcRIR":"AFRINIC","srcTTL":[120],"srcTTLCnt":1,"tags":["sensor:contabo-sponge-01-ts","honeypot","contabo-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":3472757763},"totDataBytes":0} +{"@timestamp":1787295282332,"_id":"260821-W8t_wXLpQQxNy7_ZoNnQNu3y","_index":"arkime_sessions3-260821","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Kaopu Cloud HK Limited"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Lightnode Limited"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":0,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":0,"port":8855},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[77221],"firstPacket":1787294685997,"ipProtocol":6,"lastPacket":1787294687005,"length":1008,"network":{"bytes":132,"community_id":"1:fa8+MxZUu6YaRY+NvDY/HBLEgrA=","packets":2},"node":"spark-afae","packetPos":[-77221,3056525,314390],"packetRange":{"gte":1787294685997,"lte":1787294687005},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":132,"geo":{"country_iso_code":"PH"},"ip":"154.90.37.55","mac":["fc:bd:67:9d:2b:2b"],"mac-cnt":1,"packets":2,"port":63606},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcRIR":"AFRINIC","srcTTL":[121],"srcTTLCnt":1,"tags":["sensor:contabo-sponge-01-ts","honeypot","contabo-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":1290248661},"totDataBytes":0} +{"@timestamp":1787295282382,"_id":"260821-W8s1Ir25kIVBKKM0nNKz8JDf","_index":"arkime_sessions3-260821","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Kaopu Cloud HK Limited"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Lightnode Limited"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":0,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":0,"port":8854},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[77221],"firstPacket":1787294685988,"ipProtocol":6,"lastPacket":1787294686996,"length":1008,"network":{"bytes":132,"community_id":"1:rfW5CCxW+gW4d1XgX0Q5BXxIAzE=","packets":2},"node":"spark-afae","packetPos":[-77221,3042493,326712],"packetRange":{"gte":1787294685988,"lte":1787294686996},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":132,"geo":{"country_iso_code":"PH"},"ip":"154.90.37.55","mac":["fc:bd:67:9d:2b:2b"],"mac-cnt":1,"packets":2,"port":63333},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcRIR":"AFRINIC","srcTTL":[121],"srcTTLCnt":1,"tags":["sensor:contabo-sponge-01-ts","honeypot","contabo-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":3577240244},"totDataBytes":0} +{"@timestamp":1787295282342,"_id":"260821-W8tlKAjZi1ZOMK9_R5sZ46-Z","_index":"arkime_sessions3-260821","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Kaopu Cloud HK Limited"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Lightnode Limited"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":0,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":0,"port":8853},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[77221],"firstPacket":1787294685977,"ipProtocol":6,"lastPacket":1787294685977,"length":0,"network":{"bytes":66,"community_id":"1:sGO6AOSy+AR2qPMUh38BM7cqtKk=","packets":1},"node":"spark-afae","packetPos":[-77221,3027665],"packetRange":{"gte":1787294685977,"lte":1787294685977},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":66,"geo":{"country_iso_code":"PH"},"ip":"154.90.37.55","mac":["fc:bd:67:9d:2b:2b"],"mac-cnt":1,"packets":1,"port":63076},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcRIR":"AFRINIC","srcTTL":[121],"srcTTLCnt":1,"tags":["sensor:contabo-sponge-01-ts","honeypot","contabo-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":1,"dstZero":0,"ece":1,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":1716716909},"totDataBytes":0} +{"@timestamp":1787295282319,"_id":"260821-W8vaOlFYuDRAMLGFXWZvr2Lf","_index":"arkime_sessions3-260821","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Kaopu Cloud HK Limited"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Lightnode Limited"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":0,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":0,"port":8852},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[77221],"firstPacket":1787294685957,"ipProtocol":6,"lastPacket":1787294685957,"length":0,"network":{"bytes":66,"community_id":"1:MXy/dbcibLbyUeI5vzg7GVQPBSw=","packets":1},"node":"spark-afae","packetPos":[-77221,2997723],"packetRange":{"gte":1787294685957,"lte":1787294685957},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":66,"geo":{"country_iso_code":"PH"},"ip":"154.90.37.55","mac":["fc:bd:67:9d:2b:2b"],"mac-cnt":1,"packets":1,"port":62811},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcRIR":"AFRINIC","srcTTL":[120],"srcTTLCnt":1,"tags":["sensor:contabo-sponge-01-ts","honeypot","contabo-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":1,"dstZero":0,"ece":1,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":1130549068},"totDataBytes":0} +{"@timestamp":1787295282380,"_id":"260821-W8vWj0OWvAdCKodim-xIDEs-","_index":"arkime_sessions3-260821","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Kaopu Cloud HK Limited"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Lightnode Limited"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":0,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":0,"port":8851},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[77221],"firstPacket":1787294685932,"ipProtocol":6,"lastPacket":1787294685932,"length":0,"network":{"bytes":66,"community_id":"1:4gwZivz/LHzmbk9VCGAUNJbVidI=","packets":1},"node":"spark-afae","packetPos":[-77221,2957463],"packetRange":{"gte":1787294685932,"lte":1787294685932},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":66,"geo":{"country_iso_code":"PH"},"ip":"154.90.37.55","mac":["fc:bd:67:9d:2b:2b"],"mac-cnt":1,"packets":1,"port":62548},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcRIR":"AFRINIC","srcTTL":[121],"srcTTLCnt":1,"tags":["sensor:contabo-sponge-01-ts","honeypot","contabo-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":1,"dstZero":0,"ece":1,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":1856043160},"totDataBytes":0} +{"@timestamp":1787295282388,"_id":"260821-W8vJQRYUtDdNZ50cUcIktMaV","_index":"arkime_sessions3-260821","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Kaopu Cloud HK Limited"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Lightnode Limited"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":0,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":0,"port":8850},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[77221],"firstPacket":1787294685919,"ipProtocol":6,"lastPacket":1787294686925,"length":1006,"network":{"bytes":132,"community_id":"1:iE95t1gYhLvBo7cBrCUoLv2959o=","packets":2},"node":"spark-afae","packetPos":[-77221,2940327,415984],"packetRange":{"gte":1787294685919,"lte":1787294686925},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":132,"geo":{"country_iso_code":"PH"},"ip":"154.90.37.55","mac":["fc:bd:67:9d:2b:2b"],"mac-cnt":1,"packets":2,"port":62284},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcRIR":"AFRINIC","srcTTL":[121],"srcTTLCnt":1,"tags":["sensor:contabo-sponge-01-ts","honeypot","contabo-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":2266514894},"totDataBytes":0} +{"@timestamp":1787295282329,"_id":"260821-W8uWRH0RRaZFW7V38Hsowg-Z","_index":"arkime_sessions3-260821","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Kaopu Cloud HK Limited"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Lightnode Limited"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":0,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":0,"port":8849},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[77221],"firstPacket":1787294685897,"ipProtocol":6,"lastPacket":1787294685897,"length":0,"network":{"bytes":66,"community_id":"1:u9Qm1TRQrdHzwzFA//dZOWKtY30=","packets":1},"node":"spark-afae","packetPos":[-77221,2914653],"packetRange":{"gte":1787294685897,"lte":1787294685897},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":66,"geo":{"country_iso_code":"PH"},"ip":"154.90.37.55","mac":["fc:bd:67:9d:2b:2b"],"mac-cnt":1,"packets":1,"port":62017},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcRIR":"AFRINIC","srcTTL":[121],"srcTTLCnt":1,"tags":["sensor:contabo-sponge-01-ts","honeypot","contabo-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":1,"dstZero":0,"ece":1,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":2003973733},"totDataBytes":0} +{"@timestamp":1787295282354,"_id":"260821-W8vTga9--79Ch5HXWEuf5N6M","_index":"arkime_sessions3-260821","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Kaopu Cloud HK Limited"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Lightnode Limited"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":0,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":0,"port":8848},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[77221],"firstPacket":1787294685887,"ipProtocol":6,"lastPacket":1787294686890,"length":1003,"network":{"bytes":132,"community_id":"1:H10iVoOJuAsVrH7lb2y0LVi9JWc=","packets":2},"node":"spark-afae","packetPos":[-77221,2890021,458354],"packetRange":{"gte":1787294685887,"lte":1787294686890},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":132,"geo":{"country_iso_code":"PH"},"ip":"154.90.37.55","mac":["fc:bd:67:9d:2b:2b"],"mac-cnt":1,"packets":2,"port":61751},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcRIR":"AFRINIC","srcTTL":[121],"srcTTLCnt":1,"tags":["sensor:contabo-sponge-01-ts","honeypot","contabo-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":3367511455},"totDataBytes":0} +{"@timestamp":1787295282356,"_id":"260821-W8toz655PGpCZ7RnlTw6_Fh8","_index":"arkime_sessions3-260821","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Kaopu Cloud HK Limited"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Lightnode Limited"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":0,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":0,"port":8847},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[77221],"firstPacket":1787294685883,"ipProtocol":6,"lastPacket":1787294686872,"length":989,"network":{"bytes":132,"community_id":"1:zbpHudVmiEBqwvWE+PCw7XOPJvs=","packets":2},"node":"spark-afae","packetPos":[-77221,2864049,479956],"packetRange":{"gte":1787294685883,"lte":1787294686872},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":132,"geo":{"country_iso_code":"PH"},"ip":"154.90.37.55","mac":["fc:bd:67:9d:2b:2b"],"mac-cnt":1,"packets":2,"port":61484},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcRIR":"AFRINIC","srcTTL":[121],"srcTTLCnt":1,"tags":["sensor:contabo-sponge-01-ts","honeypot","contabo-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":1245753742},"totDataBytes":0} +{"@timestamp":1787295282331,"_id":"260821-W8sziO3rAHZBwoZd2MAMwoAK","_index":"arkime_sessions3-260821","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Kaopu Cloud HK Limited"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Lightnode Limited"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":0,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":0,"port":8846},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[77221],"firstPacket":1787294685855,"ipProtocol":6,"lastPacket":1787294685855,"length":0,"network":{"bytes":66,"community_id":"1:xoBVpByDwDE/zOxZGZ1Y9utCcRk=","packets":1},"node":"spark-afae","packetPos":[-77221,2838141],"packetRange":{"gte":1787294685855,"lte":1787294685855},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":66,"geo":{"country_iso_code":"PH"},"ip":"154.90.37.55","mac":["fc:bd:67:9d:2b:2b"],"mac-cnt":1,"packets":1,"port":61219},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcRIR":"AFRINIC","srcTTL":[121],"srcTTLCnt":1,"tags":["sensor:contabo-sponge-01-ts","honeypot","contabo-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":1,"dstZero":0,"ece":1,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":176276568},"totDataBytes":0} +{"@timestamp":1785185629328,"_id":"260727-kjipZuEuiL9Bk5E9TrMcQCe9","_index":"arkime_sessions3-260727","client":{"bytes":9},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Kaopu Cloud HK Limited"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Lightnode Limited"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":331,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":4,"port":123},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstPayload8":"485454502f312e31","dstRIR":"RIPE","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[65530],"firstPacket":1785184326416,"http":{"bodyMagic":["text/plain"],"bodyMagicCnt":1,"responseHeader":["connection","content-type"],"responseHeaderCnt":2,"responseHeaderField":["content-type","connection"],"responseHeaderValue":["text/plain; charset=utf-8","close"],"responseHeaderValueCnt":2,"serverVersion":["1.1"],"serverVersionCnt":1,"statuscode":[400],"statuscodeCnt":1},"initRTT":21,"ipProtocol":6,"lastPacket":1785184331448,"length":5032,"network":{"bytes":700,"community_id":"1:GVbm0WqZD2jXczgeTDk1k/AjKUI=","packets":10},"node":"spark-afae","packetPos":[-65530,399560,82,246,76,79,19039,76,173,866,76],"packetRange":{"gte":1785184326416,"lte":1785184331448},"protocol":["http","tcp"],"protocolCnt":2,"rootId":"260727-kjipZuEuiL9Bk5E9TrMcQCe9","segmentCnt":1,"server":{"bytes":103},"source":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":369,"geo":{"country_iso_code":"PH"},"ip":"154.90.37.55","mac":["fc:bd:67:9d:2b:2b","00:c0:1d:c0:ff:ee"],"mac-cnt":2,"packets":6,"port":51533},"srcOui":["Arista Networks","Grand Junction Networks, Inc."],"srcOuiCnt":2,"srcPayload8":"0401005001010101","srcRIR":"AFRINIC","srcTTL":[121],"srcTTLCnt":1,"tags":["contabo-sponge-01-ts","sensor:contabo-sponge-01-ts","honeypot"],"tagsCnt":3,"tcp":{"ja4ls":"77_64_2478366","ja4t":["64240_2-1-3-1-1-4_1460_8"],"ja4tCnt":1,"ja4ts":["64240_2-1-1-4-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":2,"ae":0,"cwr":1,"dstZero":0,"ece":2,"fin":2,"psh":2,"rst":2,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":639078340},"totDataBytes":112} +{"@timestamp":1784793925673,"_id":"260723-6Qerye6InqFDeoYEQ1ySwMp3","_index":"arkime_sessions3-260723","client":{"bytes":159},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Kaopu Cloud HK Limited"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Lightnode Limited"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":515,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":4,"port":591},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstPayload8":"485454502f312e31","dstRIR":"RIPE","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[63354],"firstPacket":1784793550837,"http":{"bodyMagic":["text/html"],"bodyMagicCnt":1,"clientVersion":["1.1"],"clientVersionCnt":1,"host":["www.google.com:443","www.google.com"],"hostCnt":2,"ja4h":["co11nn020000_818f42cc3fd7_000000000000_000000000000"],"ja4hCnt":1,"ja4h_r":["co11nn020000_Host,User-Agent__"],"ja4h_rCnt":1,"md5":["0f87454a3ea15f0db55ae928dbcd82fc"],"md5Cnt":1,"method":["CONNECT"],"method-CONNECT":1,"methodCnt":1,"path":["www.google.com:443"],"pathCnt":1,"requestHeader":["host","user-agent"],"requestHeaderCnt":2,"response-server":["Apache/2.4.41 (Ubuntu)"],"response-serverCnt":1,"response-x-powered-by":["PHP/7.4.3"],"response-x-powered-byCnt":1,"responseHeader":["connection","server","x-powered-by","content-type","content-length","date"],"responseHeaderCnt":6,"responseHeaderField":["connection","content-type","date","content-length"],"responseHeaderValue":["close","text/plain; charset=utf-8","thu, 23 jul 2026 07:59:10 gmt","94"],"responseHeaderValueCnt":4,"serverVersion":["1.1"],"serverVersionCnt":1,"sha256":["1ca624415b2889dbeb3f969890b848b7bc5eaf96ca5e8fdd7461f943b45d10cb"],"sha256Cnt":1,"statuscode":[200],"statuscodeCnt":1,"uri":["www.google.com:443"],"uriCnt":1,"useragent":["Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:145.0) Gecko/20100101 Firefox/145.0"],"useragentCnt":1},"initRTT":16,"ipProtocol":6,"lastPacket":1784793550906,"length":69,"network":{"bytes":974,"community_id":"1:nHmcKWVAuQsy+nJd0pRP4OKoVzY=","packets":9},"node":"spark-afae","packetPos":[-63354,10427900,82,0,76,229,70,357,70,76],"packetRange":{"gte":1784793550837,"lte":1784793550906},"protocol":["http","tcp"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":287},"source":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":459,"geo":{"country_iso_code":"PH"},"ip":"154.90.37.55","mac":["fc:bd:67:9d:2b:2b","00:c0:1d:c0:ff:ee"],"mac-cnt":2,"packets":5,"port":50402},"srcOui":["Arista Networks","Grand Junction Networks, Inc."],"srcOuiCnt":2,"srcPayload8":"434f4e4e45435420","srcRIR":"AFRINIC","srcTTL":[121],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["1908087464943045"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["869feaa1-dc77-4037-aee2-247b7a39cf7d","23e6932c-e2bd-48cf-80b8-aa98ae9276c4"],"signatureCnt":2,"signatureId":[1031486,1030991],"signatureIdCnt":2},"tag":{"block":["false","true"],"blockCnt":2,"category":["activity","protocol"],"categoryCnt":2,"description":["ip addresses with this tag have been seen crawling http(s) servers around the internet.","ip addresses with this tag have been observed crawling the internet for unauthenticated web proxies and testing if they are functional."],"intention":["malicious","unknown"],"intentionCnt":2,"name":["open proxy scanner","web crawler"],"nameCnt":2},"tags":["sensor:contabo-sponge-01-ts","contabo-sponge-01-ts","honeypot"],"tagsCnt":3,"tcp":{"ja4ls":"47_64_tcp","ja4t":["64240_2-1-3-1-1-4_1460_8"],"ja4tCnt":1,"ja4ts":["64240_2-1-1-4-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":3,"ae":0,"cwr":1,"dstZero":0,"ece":2,"fin":1,"psh":2,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":2097132136},"totDataBytes":446} +{"@timestamp":1784793925634,"_id":"260723-6QdimMeQvpJKcLpaH7RV9lYm","_index":"arkime_sessions3-260723","client":{"bytes":159},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Kaopu Cloud HK Limited"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Lightnode Limited"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":515,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":4,"port":222},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstPayload8":"485454502f312e31","dstRIR":"RIPE","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[63354],"firstPacket":1784792818465,"http":{"bodyMagic":["text/html"],"bodyMagicCnt":1,"clientVersion":["1.1"],"clientVersionCnt":1,"host":["www.google.com:443","www.google.com"],"hostCnt":2,"ja4h":["co11nn020000_818f42cc3fd7_000000000000_000000000000"],"ja4hCnt":1,"ja4h_r":["co11nn020000_Host,User-Agent__"],"ja4h_rCnt":1,"md5":["0f87454a3ea15f0db55ae928dbcd82fc"],"md5Cnt":1,"method":["CONNECT"],"method-CONNECT":1,"methodCnt":1,"path":["www.google.com:443"],"pathCnt":1,"requestHeader":["host","user-agent"],"requestHeaderCnt":2,"response-server":["Apache/2.4.41 (Ubuntu)"],"response-serverCnt":1,"response-x-powered-by":["PHP/7.4.3"],"response-x-powered-byCnt":1,"responseHeader":["connection","server","x-powered-by","content-type","content-length","date"],"responseHeaderCnt":6,"responseHeaderField":["connection","content-type","date","content-length"],"responseHeaderValue":["close","text/plain; charset=utf-8","thu, 23 jul 2026 07:46:58 gmt","94"],"responseHeaderValueCnt":4,"serverVersion":["1.1"],"serverVersionCnt":1,"sha256":["1ca624415b2889dbeb3f969890b848b7bc5eaf96ca5e8fdd7461f943b45d10cb"],"sha256Cnt":1,"statuscode":[200],"statuscodeCnt":1,"uri":["www.google.com:443"],"uriCnt":1,"useragent":["Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:145.0) Gecko/20100101 Firefox/145.0"],"useragentCnt":1},"initRTT":16,"ipProtocol":6,"lastPacket":1784792818534,"length":69,"network":{"bytes":974,"community_id":"1:XrRrGn/otH7cYhvl7YCeljQSHG0=","packets":9},"node":"spark-afae","packetPos":[-63354,746921,164,714,76,229,70,357,70,76],"packetRange":{"gte":1784792818465,"lte":1784792818534},"protocol":["http","tcp"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":287},"source":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":459,"geo":{"country_iso_code":"PH"},"ip":"154.90.37.55","mac":["fc:bd:67:9d:2b:2b","00:c0:1d:c0:ff:ee"],"mac-cnt":2,"packets":5,"port":50364},"srcOui":["Arista Networks","Grand Junction Networks, Inc."],"srcOuiCnt":2,"srcPayload8":"434f4e4e45435420","srcRIR":"AFRINIC","srcTTL":[120],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["591728373511023"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["869feaa1-dc77-4037-aee2-247b7a39cf7d","23e6932c-e2bd-48cf-80b8-aa98ae9276c4"],"signatureCnt":2,"signatureId":[1031486,1030991],"signatureIdCnt":2},"tag":{"block":["false","true"],"blockCnt":2,"category":["activity","protocol"],"categoryCnt":2,"description":["ip addresses with this tag have been seen crawling http(s) servers around the internet.","ip addresses with this tag have been observed crawling the internet for unauthenticated web proxies and testing if they are functional."],"intention":["malicious","unknown"],"intentionCnt":2,"name":["open proxy scanner","web crawler"],"nameCnt":2},"tags":["sensor:contabo-sponge-01-ts","contabo-sponge-01-ts","honeypot"],"tagsCnt":3,"tcp":{"ja4ls":"154_64_tcp","ja4t":["64240_2-1-3-1-1-4_1460_8"],"ja4tCnt":1,"ja4ts":["64240_2-1-1-4-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":3,"ae":0,"cwr":1,"dstZero":0,"ece":2,"fin":1,"psh":2,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":4217937109},"totDataBytes":446} +{"@timestamp":1784714152127,"_id":"260722-ePxaU5a5gldDDIwhk-50R1KN","_index":"arkime_sessions3-260722","client":{"bytes":4},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["Kaopu Cloud HK Limited"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["Lightnode Limited"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":331,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":4,"port":10087},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstPayload8":"485454502f312e31","dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[62909],"firstPacket":1784712875300,"http":{"bodyMagic":["text/plain"],"bodyMagicCnt":1,"responseHeader":["content-type","connection"],"responseHeaderCnt":2,"responseHeaderField":["content-type","connection"],"responseHeaderValue":["text/plain; charset=utf-8","close"],"responseHeaderValueCnt":2,"serverVersion":["1.1"],"serverVersionCnt":1,"statuscode":[400],"statuscodeCnt":1},"initRTT":92,"ipProtocol":6,"lastPacket":1784712880489,"length":5189,"network":{"bytes":671,"community_id":"1:RNDO+y8BaZzkQEX1D9bsBXLg2dw=","packets":10},"node":"spark-afae","packetPos":[-62909,112654,82,1082,70,74,7077,70,173,362,70],"packetRange":{"gte":1784712875300,"lte":1784712880489},"protocol":["http","tcp"],"protocolCnt":2,"rootId":"260722-ePxaU5a5gldDDIwhk-50R1KN","segmentCnt":1,"server":{"bytes":103},"source":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":340,"geo":{"country_iso_code":"PH"},"ip":"154.90.37.55","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":6,"port":53425},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcPayload8":"05020002","srcRIR":"AFRINIC","srcTTL":[113],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":["Attempted Information Leak"],"categoryCnt":1,"flowId":["1007713187855869"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[2],"severityCnt":1,"signature":["5a66c944-faed-4791-9d94-b44b7bd48352"],"signatureCnt":1,"signatureId":[2000181],"signatureIdCnt":1},"tags":["frantech-ts","sensor:frantech-ts","honeypot"],"tagsCnt":3,"tcp":{"ja4ls":"51_64_2409223","ja4t":["64240_2-1-3-1-1-4_1400_8"],"ja4tCnt":1,"ja4ts":["64240_2-1-1-4-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":2,"ae":0,"cwr":1,"dstZero":0,"ece":2,"fin":2,"psh":2,"rst":2,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":1352326926},"totDataBytes":107} -- cgit v1.2.3