From e93e7f67d4f70177c3ab5a34e8cc5b24fa2dde6d Mon Sep 17 00:00:00 2001 From: hrbrmstr Date: Mon, 31 Aug 2026 07:56:38 -0400 Subject: add: bph report iocs --- .../session_search_20260831T113640_9d421320.ndjson | 100 +++++++++++++++++++++ 1 file changed, 100 insertions(+) create mode 100644 kevlar/2026-08-31/sponge/ip-sessions/session_search_20260831T113640_9d421320.ndjson (limited to 'kevlar/2026-08-31/sponge/ip-sessions/session_search_20260831T113640_9d421320.ndjson') diff --git a/kevlar/2026-08-31/sponge/ip-sessions/session_search_20260831T113640_9d421320.ndjson b/kevlar/2026-08-31/sponge/ip-sessions/session_search_20260831T113640_9d421320.ndjson new file mode 100644 index 0000000..4db24f1 --- /dev/null +++ b/kevlar/2026-08-31/sponge/ip-sessions/session_search_20260831T113640_9d421320.ndjson @@ -0,0 +1,100 @@ +{"@timestamp":1788170577237,"_id":"260831--z4qAe9iP1pMm6s0Ig8pvBDr","_index":"arkime_sessions3-260831","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Kaopu Cloud HK Limited"],"isp.dstCnt":1,"isp.src":["Proton66 OOO"],"isp.srcCnt":1,"org.dst":["LightNode-BH"],"org.dstCnt":1,"org.src":["Proton66 OOO"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["business"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":0,"geo":{"country_iso_code":"BH"},"ip":"38.54.2.209","mac":["52:54:8f:9d:76:48"],"mac-cnt":1,"packets":0,"port":6001},"dstRIR":"ARIN","ethertype":2048,"fileId":[82412],"firstPacket":1788170089640,"ipProtocol":6,"lastPacket":1788170098639,"length":8999,"network":{"bytes":194,"community_id":"1:xlsf6/xULuWzNCf0d4duBXlJTYI=","packets":3},"node":"spark-afae","packetPos":[-82412,199891,2476,3592],"packetRange":{"gte":1788170089640,"lte":1788170098639},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS198953 Proton66 OOO","number":198953,"organization":{"name":"Proton66 OOO"}},"bytes":194,"geo":{"country_iso_code":"RU"},"ip":"176.120.22.61","mac":["98:44:ce:60:15:19"],"mac-cnt":1,"packets":3,"port":63311},"spoofable":["true"],"spoofableCnt":1,"srcDscp":[8],"srcDscpCnt":1,"srcOui":["Huawei Technologies Co.,Ltd"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[117],"srcTTLCnt":1,"tags":["honeypot","sensor:bahrain-sponge-01-ts","bahrain-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["200_2-1-1-4_1460_00","200_2-1-3-1-1-4_1460_0"],"ja4tCnt":2},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":3,"syn-ack":0,"urg":0},"tcpseq":{"src":1032924479},"totDataBytes":0} +{"@timestamp":1788170577038,"_id":"260831--z5OdSSjJJ9M6795oxM3M-NC","_index":"arkime_sessions3-260831","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Kaopu Cloud HK Limited"],"isp.dstCnt":1,"isp.src":["Proton66 OOO"],"isp.srcCnt":1,"org.dst":["LightNode-BH"],"org.dstCnt":1,"org.src":["Proton66 OOO"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["business"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":0,"geo":{"country_iso_code":"BH"},"ip":"38.54.2.209","mac":["52:54:8f:9d:76:48"],"mac-cnt":1,"packets":0,"port":8989},"dstRIR":"ARIN","ethertype":2048,"fileId":[82412],"firstPacket":1788170089640,"ipProtocol":6,"lastPacket":1788170098639,"length":8999,"network":{"bytes":194,"community_id":"1:fxUipZZhHUCAeEe5NBVFlGVi5Q4=","packets":3},"node":"spark-afae","packetPos":[-82412,199973,2476,3432],"packetRange":{"gte":1788170089640,"lte":1788170098639},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS198953 Proton66 OOO","number":198953,"organization":{"name":"Proton66 OOO"}},"bytes":194,"geo":{"country_iso_code":"RU"},"ip":"176.120.22.61","mac":["98:44:ce:60:15:19"],"mac-cnt":1,"packets":3,"port":65383},"spoofable":["true"],"spoofableCnt":1,"srcDscp":[8],"srcDscpCnt":1,"srcOui":["Huawei Technologies Co.,Ltd"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[117],"srcTTLCnt":1,"tags":["honeypot","sensor:bahrain-sponge-01-ts","bahrain-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["200_2-1-1-4_1460_00","200_2-1-3-1-1-4_1460_0"],"ja4tCnt":2},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":3,"syn-ack":0,"urg":0},"tcpseq":{"src":682712236},"totDataBytes":0} +{"@timestamp":1788170577237,"_id":"260831--z7wZg8N_UNCxbl726_eyyHw","_index":"arkime_sessions3-260831","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Kaopu Cloud HK Limited"],"isp.dstCnt":1,"isp.src":["Proton66 OOO"],"isp.srcCnt":1,"org.dst":["LightNode-BH"],"org.dstCnt":1,"org.src":["Proton66 OOO"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["business"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":0,"geo":{"country_iso_code":"BH"},"ip":"38.54.2.209","mac":["52:54:8f:9d:76:48"],"mac-cnt":1,"packets":0,"port":4443},"dstRIR":"ARIN","ethertype":2048,"fileId":[82412],"firstPacket":1788170089636,"ipProtocol":6,"lastPacket":1788170098653,"length":9017,"network":{"bytes":194,"community_id":"1:+m1XEWtF1ginaffVGNM27q7XvDA=","packets":3},"node":"spark-afae","packetPos":[-82412,199809,2722,3506],"packetRange":{"gte":1788170089636,"lte":1788170098653},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS198953 Proton66 OOO","number":198953,"organization":{"name":"Proton66 OOO"}},"bytes":194,"geo":{"country_iso_code":"RU"},"ip":"176.120.22.61","mac":["98:44:ce:60:15:19"],"mac-cnt":1,"packets":3,"port":64696},"spoofable":["true"],"spoofableCnt":1,"srcDscp":[8],"srcDscpCnt":1,"srcOui":["Huawei Technologies Co.,Ltd"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[117],"srcTTLCnt":1,"tags":["honeypot","sensor:bahrain-sponge-01-ts","bahrain-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["200_2-1-1-4_1460_00","200_2-1-3-1-1-4_1460_0"],"ja4tCnt":2},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":3,"syn-ack":0,"urg":0},"tcpseq":{"src":918658525},"totDataBytes":0} +{"@timestamp":1788170577037,"_id":"260831--z5wCHCoLftJML5g58nVVbAy","_index":"arkime_sessions3-260831","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Kaopu Cloud HK Limited"],"isp.dstCnt":1,"isp.src":["Proton66 OOO"],"isp.srcCnt":1,"org.dst":["LightNode-BH"],"org.dstCnt":1,"org.src":["Proton66 OOO"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["business"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":0,"geo":{"country_iso_code":"BH"},"ip":"38.54.2.209","mac":["52:54:8f:9d:76:48"],"mac-cnt":1,"packets":0,"port":443},"dstRIR":"ARIN","ethertype":2048,"fileId":[82412],"firstPacket":1788170089634,"ipProtocol":6,"lastPacket":1788170098619,"length":8985,"network":{"bytes":194,"community_id":"1:hj30LPlPi1NUBMWDNVjQXI6IRGE=","packets":3},"node":"spark-afae","packetPos":[-82412,199727,2394,3526],"packetRange":{"gte":1788170089634,"lte":1788170098619},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS198953 Proton66 OOO","number":198953,"organization":{"name":"Proton66 OOO"}},"bytes":194,"geo":{"country_iso_code":"RU"},"ip":"176.120.22.61","mac":["98:44:ce:60:15:19"],"mac-cnt":1,"packets":3,"port":62804},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Huawei Technologies Co.,Ltd"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[117],"srcTTLCnt":1,"tags":["honeypot","sensor:bahrain-sponge-01-ts","bahrain-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["200_2-1-1-4_1460_00","200_2-1-3-1-1-4_1460_0"],"ja4tCnt":2},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":3,"syn-ack":0,"urg":0},"tcpseq":{"src":3243181880},"totDataBytes":0} +{"@timestamp":1788170577037,"_id":"260831--z7p8pu1LshIZalShh9v5JOp","_index":"arkime_sessions3-260831","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Kaopu Cloud HK Limited"],"isp.dstCnt":1,"isp.src":["Proton66 OOO"],"isp.srcCnt":1,"org.dst":["LightNode-BH"],"org.dstCnt":1,"org.src":["Proton66 OOO"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["business"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":0,"geo":{"country_iso_code":"BH"},"ip":"38.54.2.209","mac":["52:54:8f:9d:76:48"],"mac-cnt":1,"packets":0,"port":1501},"dstRIR":"ARIN","ethertype":2048,"fileId":[82412],"firstPacket":1788170089632,"ipProtocol":6,"lastPacket":1788170098621,"length":8989,"network":{"bytes":194,"community_id":"1:OnrKR0kfRQxEenL7tVHBJ+Rd3gY=","packets":3},"node":"spark-afae","packetPos":[-82412,199645,2558,3522],"packetRange":{"gte":1788170089632,"lte":1788170098621},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS198953 Proton66 OOO","number":198953,"organization":{"name":"Proton66 OOO"}},"bytes":194,"geo":{"country_iso_code":"RU"},"ip":"176.120.22.61","mac":["98:44:ce:60:15:19"],"mac-cnt":1,"packets":3,"port":62783},"spoofable":["true"],"spoofableCnt":1,"srcDscp":[8],"srcDscpCnt":1,"srcOui":["Huawei Technologies Co.,Ltd"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[117],"srcTTLCnt":1,"tags":["honeypot","sensor:bahrain-sponge-01-ts","bahrain-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["200_2-1-1-4_1460_00","200_2-1-3-1-1-4_1460_0"],"ja4tCnt":2},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":3,"syn-ack":0,"urg":0},"tcpseq":{"src":2514283198},"totDataBytes":0} +{"@timestamp":1788170577038,"_id":"260831--z6PPili84VGSpjbZ4DMtwKg","_index":"arkime_sessions3-260831","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Kaopu Cloud HK Limited"],"isp.dstCnt":1,"isp.src":["Proton66 OOO"],"isp.srcCnt":1,"org.dst":["LightNode-BH"],"org.dstCnt":1,"org.src":["Proton66 OOO"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["business"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":0,"geo":{"country_iso_code":"BH"},"ip":"38.54.2.209","mac":["52:54:8f:9d:76:48"],"mac-cnt":1,"packets":0,"port":11443},"dstRIR":"ARIN","ethertype":2048,"fileId":[82412],"firstPacket":1788170089628,"ipProtocol":6,"lastPacket":1788170098619,"length":8991,"network":{"bytes":194,"community_id":"1:deJPN7QOBrl2ZuR4Zee7GE7C4j8=","packets":3},"node":"spark-afae","packetPos":[-82412,199563,2476,3530],"packetRange":{"gte":1788170089628,"lte":1788170098619},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS198953 Proton66 OOO","number":198953,"organization":{"name":"Proton66 OOO"}},"bytes":194,"geo":{"country_iso_code":"RU"},"ip":"176.120.22.61","mac":["98:44:ce:60:15:19"],"mac-cnt":1,"packets":3,"port":64685},"spoofable":["true"],"spoofableCnt":1,"srcDscp":[8],"srcDscpCnt":1,"srcOui":["Huawei Technologies Co.,Ltd"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[117],"srcTTLCnt":1,"tags":["honeypot","sensor:bahrain-sponge-01-ts","bahrain-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["200_2-1-1-4_1460_00","200_2-1-3-1-1-4_1460_0"],"ja4tCnt":2},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":3,"syn-ack":0,"urg":0},"tcpseq":{"src":4154981265},"totDataBytes":0} +{"@timestamp":1788170577038,"_id":"260831--z5bsMc0OiNFeYb31gZ4_jLC","_index":"arkime_sessions3-260831","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Kaopu Cloud HK Limited"],"isp.dstCnt":1,"isp.src":["Proton66 OOO"],"isp.srcCnt":1,"org.dst":["LightNode-BH"],"org.dstCnt":1,"org.src":["Proton66 OOO"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["business"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":0,"geo":{"country_iso_code":"BH"},"ip":"38.54.2.209","mac":["52:54:8f:9d:76:48"],"mac-cnt":1,"packets":0,"port":3005},"dstRIR":"ARIN","ethertype":2048,"fileId":[82412],"firstPacket":1788170089618,"ipProtocol":6,"lastPacket":1788170098606,"length":8988,"network":{"bytes":194,"community_id":"1:Dyswvx4WQGwf1a4iXH7proPBmK8=","packets":3},"node":"spark-afae","packetPos":[-82412,199481,1574,3344],"packetRange":{"gte":1788170089618,"lte":1788170098606},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS198953 Proton66 OOO","number":198953,"organization":{"name":"Proton66 OOO"}},"bytes":194,"geo":{"country_iso_code":"RU"},"ip":"176.120.22.61","mac":["98:44:ce:60:15:19"],"mac-cnt":1,"packets":3,"port":64838},"spoofable":["true"],"spoofableCnt":1,"srcDscp":[8],"srcDscpCnt":1,"srcOui":["Huawei Technologies Co.,Ltd"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[117],"srcTTLCnt":1,"tags":["honeypot","sensor:bahrain-sponge-01-ts","bahrain-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["200_2-1-1-4_1460_00","200_2-1-3-1-1-4_1460_0"],"ja4tCnt":2},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":3,"syn-ack":0,"urg":0},"tcpseq":{"src":309108923},"totDataBytes":0} +{"@timestamp":1788170577038,"_id":"260831--z7VIIzbIEhIzafFjZObNr_9","_index":"arkime_sessions3-260831","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Kaopu Cloud HK Limited"],"isp.dstCnt":1,"isp.src":["Proton66 OOO"],"isp.srcCnt":1,"org.dst":["LightNode-BH"],"org.dstCnt":1,"org.src":["Proton66 OOO"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["business"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":0,"geo":{"country_iso_code":"BH"},"ip":"38.54.2.209","mac":["52:54:8f:9d:76:48"],"mac-cnt":1,"packets":0,"port":43},"dstRIR":"ARIN","ethertype":2048,"fileId":[82412],"firstPacket":1788170089616,"ipProtocol":6,"lastPacket":1788170098602,"length":8986,"network":{"bytes":194,"community_id":"1:G8fPeSe6dVcX/R/yWUtvnpivu4M=","packets":3},"node":"spark-afae","packetPos":[-82412,199399,1328,3594],"packetRange":{"gte":1788170089616,"lte":1788170098602},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS198953 Proton66 OOO","number":198953,"organization":{"name":"Proton66 OOO"}},"bytes":194,"geo":{"country_iso_code":"RU"},"ip":"176.120.22.61","mac":["98:44:ce:60:15:19"],"mac-cnt":1,"packets":3,"port":63861},"spoofable":["true"],"spoofableCnt":1,"srcDscp":[8],"srcDscpCnt":1,"srcOui":["Huawei Technologies Co.,Ltd"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[117],"srcTTLCnt":1,"tags":["honeypot","sensor:bahrain-sponge-01-ts","bahrain-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["200_2-1-1-4_1460_00","200_2-1-3-1-1-4_1460_0"],"ja4tCnt":2},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":3,"syn-ack":0,"urg":0},"tcpseq":{"src":1110524428},"totDataBytes":0} +{"@timestamp":1788170577037,"_id":"260831--z7Dsbns-_BDq4dVHtlqbBu7","_index":"arkime_sessions3-260831","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Kaopu Cloud HK Limited"],"isp.dstCnt":1,"isp.src":["Proton66 OOO"],"isp.srcCnt":1,"org.dst":["LightNode-BH"],"org.dstCnt":1,"org.src":["Proton66 OOO"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["business"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":0,"geo":{"country_iso_code":"BH"},"ip":"38.54.2.209","mac":["52:54:8f:9d:76:48"],"mac-cnt":1,"packets":0,"port":9999},"dstRIR":"ARIN","ethertype":2048,"fileId":[82412],"firstPacket":1788170089611,"ipProtocol":6,"lastPacket":1788170098609,"length":8998,"network":{"bytes":194,"community_id":"1:iMUxbWNUc5lsyL5FjH/FaBVbF3g=","packets":3},"node":"spark-afae","packetPos":[-82412,199317,2558,3538],"packetRange":{"gte":1788170089611,"lte":1788170098609},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS198953 Proton66 OOO","number":198953,"organization":{"name":"Proton66 OOO"}},"bytes":194,"geo":{"country_iso_code":"RU"},"ip":"176.120.22.61","mac":["98:44:ce:60:15:19"],"mac-cnt":1,"packets":3,"port":62935},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Huawei Technologies Co.,Ltd"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[118],"srcTTLCnt":1,"tags":["honeypot","sensor:bahrain-sponge-01-ts","bahrain-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["200_2-1-1-4_1460_00","200_2-1-3-1-1-4_1460_0"],"ja4tCnt":2},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":3,"syn-ack":0,"urg":0},"tcpseq":{"src":425714856},"totDataBytes":0} +{"@timestamp":1788170577037,"_id":"260831--z5Witos6q1Gg5JWHg8YrkHB","_index":"arkime_sessions3-260831","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Kaopu Cloud HK Limited"],"isp.dstCnt":1,"isp.src":["Proton66 OOO"],"isp.srcCnt":1,"org.dst":["LightNode-BH"],"org.dstCnt":1,"org.src":["Proton66 OOO"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["business"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":0,"geo":{"country_iso_code":"BH"},"ip":"38.54.2.209","mac":["52:54:8f:9d:76:48"],"mac-cnt":1,"packets":0,"port":7788},"dstRIR":"ARIN","ethertype":2048,"fileId":[82412],"firstPacket":1788170089609,"ipProtocol":6,"lastPacket":1788170098624,"length":9015,"network":{"bytes":194,"community_id":"1:v69ckg2S08BZNPNtVndt0Ll9ljY=","packets":3},"node":"spark-afae","packetPos":[-82412,199071,3214,3518],"packetRange":{"gte":1788170089609,"lte":1788170098624},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS198953 Proton66 OOO","number":198953,"organization":{"name":"Proton66 OOO"}},"bytes":194,"geo":{"country_iso_code":"RU"},"ip":"176.120.22.61","mac":["98:44:ce:60:15:19"],"mac-cnt":1,"packets":3,"port":63098},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Huawei Technologies Co.,Ltd"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[118],"srcTTLCnt":1,"tags":["honeypot","sensor:bahrain-sponge-01-ts","bahrain-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["200_2-1-1-4_1460_00","200_2-1-3-1-1-4_1460_0"],"ja4tCnt":2},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":3,"syn-ack":0,"urg":0},"tcpseq":{"src":2686436917},"totDataBytes":0} +{"@timestamp":1788170577037,"_id":"260831--z4oHs8krl1LeLC_3AFy0GSh","_index":"arkime_sessions3-260831","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Kaopu Cloud HK Limited"],"isp.dstCnt":1,"isp.src":["Proton66 OOO"],"isp.srcCnt":1,"org.dst":["LightNode-BH"],"org.dstCnt":1,"org.src":["Proton66 OOO"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["business"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":0,"geo":{"country_iso_code":"BH"},"ip":"38.54.2.209","mac":["52:54:8f:9d:76:48"],"mac-cnt":1,"packets":0,"port":8001},"dstRIR":"ARIN","ethertype":2048,"fileId":[82412],"firstPacket":1788170089609,"ipProtocol":6,"lastPacket":1788170098608,"length":8999,"network":{"bytes":194,"community_id":"1:2WARFtef0Y1RjUXXIiEdPegjZ5c=","packets":3},"node":"spark-afae","packetPos":[-82412,199235,2394,3550],"packetRange":{"gte":1788170089609,"lte":1788170098608},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS198953 Proton66 OOO","number":198953,"organization":{"name":"Proton66 OOO"}},"bytes":194,"geo":{"country_iso_code":"RU"},"ip":"176.120.22.61","mac":["98:44:ce:60:15:19"],"mac-cnt":1,"packets":3,"port":64503},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Huawei Technologies Co.,Ltd"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[118],"srcTTLCnt":1,"tags":["honeypot","sensor:bahrain-sponge-01-ts","bahrain-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["200_2-1-1-4_1460_00","200_2-1-3-1-1-4_1460_0"],"ja4tCnt":2},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":3,"syn-ack":0,"urg":0},"tcpseq":{"src":1374599238},"totDataBytes":0} +{"@timestamp":1788170577038,"_id":"260831--z4M7ktS86dF96fT-Og3SGOG","_index":"arkime_sessions3-260831","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Kaopu Cloud HK Limited"],"isp.dstCnt":1,"isp.src":["Proton66 OOO"],"isp.srcCnt":1,"org.dst":["LightNode-BH"],"org.dstCnt":1,"org.src":["Proton66 OOO"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["business"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":0,"geo":{"country_iso_code":"BH"},"ip":"38.54.2.209","mac":["52:54:8f:9d:76:48"],"mac-cnt":1,"packets":0,"port":9001},"dstRIR":"ARIN","ethertype":2048,"fileId":[82412],"firstPacket":1788170089609,"ipProtocol":6,"lastPacket":1788170098607,"length":8998,"network":{"bytes":194,"community_id":"1:X/NhmTgFvyp14o6badjLyRgIJOI=","packets":3},"node":"spark-afae","packetPos":[-82412,198989,2476,3480],"packetRange":{"gte":1788170089609,"lte":1788170098607},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS198953 Proton66 OOO","number":198953,"organization":{"name":"Proton66 OOO"}},"bytes":194,"geo":{"country_iso_code":"RU"},"ip":"176.120.22.61","mac":["98:44:ce:60:15:19"],"mac-cnt":1,"packets":3,"port":63762},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Huawei Technologies Co.,Ltd"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[118],"srcTTLCnt":1,"tags":["honeypot","sensor:bahrain-sponge-01-ts","bahrain-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["200_2-1-1-4_1460_00","200_2-1-3-1-1-4_1460_0"],"ja4tCnt":2},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":3,"syn-ack":0,"urg":0},"tcpseq":{"src":962591335},"totDataBytes":0} +{"@timestamp":1788170577038,"_id":"260831--z7rLx2fRYxKPrBcCQeH5_5y","_index":"arkime_sessions3-260831","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Kaopu Cloud HK Limited"],"isp.dstCnt":1,"isp.src":["Proton66 OOO"],"isp.srcCnt":1,"org.dst":["LightNode-BH"],"org.dstCnt":1,"org.src":["Proton66 OOO"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["business"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":0,"geo":{"country_iso_code":"BH"},"ip":"38.54.2.209","mac":["52:54:8f:9d:76:48"],"mac-cnt":1,"packets":0,"port":44443},"dstRIR":"ARIN","ethertype":2048,"fileId":[82412],"firstPacket":1788170089609,"ipProtocol":6,"lastPacket":1788170098608,"length":8999,"network":{"bytes":194,"community_id":"1:BvTPqwMVPKNzHVWI49H9dGGZnYY=","packets":3},"node":"spark-afae","packetPos":[-82412,199153,2558,3546],"packetRange":{"gte":1788170089609,"lte":1788170098608},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS198953 Proton66 OOO","number":198953,"organization":{"name":"Proton66 OOO"}},"bytes":194,"geo":{"country_iso_code":"RU"},"ip":"176.120.22.61","mac":["98:44:ce:60:15:19"],"mac-cnt":1,"packets":3,"port":63442},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Huawei Technologies Co.,Ltd"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[118],"srcTTLCnt":1,"tags":["honeypot","sensor:bahrain-sponge-01-ts","bahrain-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["200_2-1-1-4_1460_00","200_2-1-3-1-1-4_1460_0"],"ja4tCnt":2},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":3,"syn-ack":0,"urg":0},"tcpseq":{"src":132441986},"totDataBytes":0} +{"@timestamp":1788170577237,"_id":"260831--z6OaEN6qsxKBonft8qDBmyJ","_index":"arkime_sessions3-260831","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Kaopu Cloud HK Limited"],"isp.dstCnt":1,"isp.src":["Proton66 OOO"],"isp.srcCnt":1,"org.dst":["LightNode-BH"],"org.dstCnt":1,"org.src":["Proton66 OOO"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["business"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":0,"geo":{"country_iso_code":"BH"},"ip":"38.54.2.209","mac":["52:54:8f:9d:76:48"],"mac-cnt":1,"packets":0,"port":10443},"dstRIR":"ARIN","ethertype":2048,"fileId":[82412],"firstPacket":1788170089608,"ipProtocol":6,"lastPacket":1788170098615,"length":9007,"network":{"bytes":194,"community_id":"1:MrfegbmZeItQ2kft5BL3Fbjr2WE=","packets":3},"node":"spark-afae","packetPos":[-82412,198661,3296,3534],"packetRange":{"gte":1788170089608,"lte":1788170098615},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS198953 Proton66 OOO","number":198953,"organization":{"name":"Proton66 OOO"}},"bytes":194,"geo":{"country_iso_code":"RU"},"ip":"176.120.22.61","mac":["98:44:ce:60:15:19"],"mac-cnt":1,"packets":3,"port":65187},"spoofable":["true"],"spoofableCnt":1,"srcDscp":[8],"srcDscpCnt":1,"srcOui":["Huawei Technologies Co.,Ltd"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[117],"srcTTLCnt":1,"tags":["honeypot","sensor:bahrain-sponge-01-ts","bahrain-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["200_2-1-1-4_1460_00","200_2-1-3-1-1-4_1460_0"],"ja4tCnt":2},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":3,"syn-ack":0,"urg":0},"tcpseq":{"src":961637960},"totDataBytes":0} +{"@timestamp":1788170577037,"_id":"260831--z534Ydc-6ZEVIJBS_vJhyzO","_index":"arkime_sessions3-260831","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Kaopu Cloud HK Limited"],"isp.dstCnt":1,"isp.src":["Proton66 OOO"],"isp.srcCnt":1,"org.dst":["LightNode-BH"],"org.dstCnt":1,"org.src":["Proton66 OOO"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["business"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":0,"geo":{"country_iso_code":"BH"},"ip":"38.54.2.209","mac":["52:54:8f:9d:76:48"],"mac-cnt":1,"packets":0,"port":5005},"dstRIR":"ARIN","ethertype":2048,"fileId":[82412],"firstPacket":1788170089608,"ipProtocol":6,"lastPacket":1788170098606,"length":8998,"network":{"bytes":194,"community_id":"1:CH556LYmmJWZab+MSnVppmEUTKo=","packets":3},"node":"spark-afae","packetPos":[-82412,198825,2476,3410],"packetRange":{"gte":1788170089608,"lte":1788170098606},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS198953 Proton66 OOO","number":198953,"organization":{"name":"Proton66 OOO"}},"bytes":194,"geo":{"country_iso_code":"RU"},"ip":"176.120.22.61","mac":["98:44:ce:60:15:19"],"mac-cnt":1,"packets":3,"port":62906},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Huawei Technologies Co.,Ltd"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[118],"srcTTLCnt":1,"tags":["honeypot","sensor:bahrain-sponge-01-ts","bahrain-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["200_2-1-1-4_1460_00","200_2-1-3-1-1-4_1460_0"],"ja4tCnt":2},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":3,"syn-ack":0,"urg":0},"tcpseq":{"src":1563772734},"totDataBytes":0} +{"@timestamp":1788170577037,"_id":"260831--z4EHD391UhJManSV6KAtQAS","_index":"arkime_sessions3-260831","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Kaopu Cloud HK Limited"],"isp.dstCnt":1,"isp.src":["Proton66 OOO"],"isp.srcCnt":1,"org.dst":["LightNode-BH"],"org.dstCnt":1,"org.src":["Proton66 OOO"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["business"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":0,"geo":{"country_iso_code":"BH"},"ip":"38.54.2.209","mac":["52:54:8f:9d:76:48"],"mac-cnt":1,"packets":0,"port":8899},"dstRIR":"ARIN","ethertype":2048,"fileId":[82412],"firstPacket":1788170089608,"ipProtocol":6,"lastPacket":1788170098606,"length":8998,"network":{"bytes":194,"community_id":"1:ubNMFI0xmekvViGtFmSZIWsL1ZE=","packets":3},"node":"spark-afae","packetPos":[-82412,198907,2312,3570],"packetRange":{"gte":1788170089608,"lte":1788170098606},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS198953 Proton66 OOO","number":198953,"organization":{"name":"Proton66 OOO"}},"bytes":194,"geo":{"country_iso_code":"RU"},"ip":"176.120.22.61","mac":["98:44:ce:60:15:19"],"mac-cnt":1,"packets":3,"port":65351},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Huawei Technologies Co.,Ltd"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[118],"srcTTLCnt":1,"tags":["honeypot","sensor:bahrain-sponge-01-ts","bahrain-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["200_2-1-1-4_1460_00","200_2-1-3-1-1-4_1460_0"],"ja4tCnt":2},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":3,"syn-ack":0,"urg":0},"tcpseq":{"src":515725400},"totDataBytes":0} +{"@timestamp":1788170577037,"_id":"260831--z7mVBJ5CMJPlac-Ku1bPs9o","_index":"arkime_sessions3-260831","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Kaopu Cloud HK Limited"],"isp.dstCnt":1,"isp.src":["Proton66 OOO"],"isp.srcCnt":1,"org.dst":["LightNode-BH"],"org.dstCnt":1,"org.src":["Proton66 OOO"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["business"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":0,"geo":{"country_iso_code":"BH"},"ip":"38.54.2.209","mac":["52:54:8f:9d:76:48"],"mac-cnt":1,"packets":0,"port":5678},"dstRIR":"ARIN","ethertype":2048,"fileId":[82412],"firstPacket":1788170089608,"ipProtocol":6,"lastPacket":1788170098606,"length":8998,"network":{"bytes":194,"community_id":"1:VnXZ4Pr5TMykBtZ344YLCMVsN0o=","packets":3},"node":"spark-afae","packetPos":[-82412,198743,2394,3730],"packetRange":{"gte":1788170089608,"lte":1788170098606},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS198953 Proton66 OOO","number":198953,"organization":{"name":"Proton66 OOO"}},"bytes":194,"geo":{"country_iso_code":"RU"},"ip":"176.120.22.61","mac":["98:44:ce:60:15:19"],"mac-cnt":1,"packets":3,"port":62722},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Huawei Technologies Co.,Ltd"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[118],"srcTTLCnt":1,"tags":["honeypot","sensor:bahrain-sponge-01-ts","bahrain-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["200_2-1-1-4_1460_00","200_2-1-3-1-1-4_1460_0"],"ja4tCnt":2},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":3,"syn-ack":0,"urg":0},"tcpseq":{"src":1937039927},"totDataBytes":0} +{"@timestamp":1788170577037,"_id":"260831--z7oFkzLAvZBvLPM-7Y8v5RG","_index":"arkime_sessions3-260831","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Kaopu Cloud HK Limited"],"isp.dstCnt":1,"isp.src":["Proton66 OOO"],"isp.srcCnt":1,"org.dst":["LightNode-BH"],"org.dstCnt":1,"org.src":["Proton66 OOO"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["business"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":0,"geo":{"country_iso_code":"BH"},"ip":"38.54.2.209","mac":["52:54:8f:9d:76:48"],"mac-cnt":1,"packets":0,"port":5000},"dstRIR":"ARIN","ethertype":2048,"fileId":[82412],"firstPacket":1788170089607,"ipProtocol":6,"lastPacket":1788170098606,"length":8999,"network":{"bytes":194,"community_id":"1:0vYnzS0UAu4YWtat+Fbsl8fgN14=","packets":3},"node":"spark-afae","packetPos":[-82412,198251,2558,3824],"packetRange":{"gte":1788170089607,"lte":1788170098606},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS198953 Proton66 OOO","number":198953,"organization":{"name":"Proton66 OOO"}},"bytes":194,"geo":{"country_iso_code":"RU"},"ip":"176.120.22.61","mac":["98:44:ce:60:15:19"],"mac-cnt":1,"packets":3,"port":62818},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Huawei Technologies Co.,Ltd"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[118],"srcTTLCnt":1,"tags":["honeypot","sensor:bahrain-sponge-01-ts","bahrain-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["200_2-1-1-4_1460_00","200_2-1-3-1-1-4_1460_0"],"ja4tCnt":2},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":3,"syn-ack":0,"urg":0},"tcpseq":{"src":3612898615},"totDataBytes":0} +{"@timestamp":1788170577037,"_id":"260831--z6CoZLSfXdI2JDFpJi-M186","_index":"arkime_sessions3-260831","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Kaopu Cloud HK Limited"],"isp.dstCnt":1,"isp.src":["Proton66 OOO"],"isp.srcCnt":1,"org.dst":["LightNode-BH"],"org.dstCnt":1,"org.src":["Proton66 OOO"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["business"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":0,"geo":{"country_iso_code":"BH"},"ip":"38.54.2.209","mac":["52:54:8f:9d:76:48"],"mac-cnt":1,"packets":0,"port":8888},"dstRIR":"ARIN","ethertype":2048,"fileId":[82412],"firstPacket":1788170089607,"ipProtocol":6,"lastPacket":1788170098606,"length":8999,"network":{"bytes":194,"community_id":"1:BoKZGJagXcKFIXEp4PnVDALqC3c=","packets":3},"node":"spark-afae","packetPos":[-82412,198497,2394,3664],"packetRange":{"gte":1788170089607,"lte":1788170098606},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS198953 Proton66 OOO","number":198953,"organization":{"name":"Proton66 OOO"}},"bytes":194,"geo":{"country_iso_code":"RU"},"ip":"176.120.22.61","mac":["98:44:ce:60:15:19"],"mac-cnt":1,"packets":3,"port":62346},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Huawei Technologies Co.,Ltd"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[118],"srcTTLCnt":1,"tags":["honeypot","sensor:bahrain-sponge-01-ts","bahrain-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["200_2-1-1-4_1460_00","200_2-1-3-1-1-4_1460_0"],"ja4tCnt":2},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":3,"syn-ack":0,"urg":0},"tcpseq":{"src":4137148438},"totDataBytes":0} +{"@timestamp":1788170577037,"_id":"260831--z54eOBrdRJO_4YXy-z8Uzu0","_index":"arkime_sessions3-260831","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Kaopu Cloud HK Limited"],"isp.dstCnt":1,"isp.src":["Proton66 OOO"],"isp.srcCnt":1,"org.dst":["LightNode-BH"],"org.dstCnt":1,"org.src":["Proton66 OOO"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["business"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":0,"geo":{"country_iso_code":"BH"},"ip":"38.54.2.209","mac":["52:54:8f:9d:76:48"],"mac-cnt":1,"packets":0,"port":6000},"dstRIR":"ARIN","ethertype":2048,"fileId":[82412],"firstPacket":1788170089607,"ipProtocol":6,"lastPacket":1788170098606,"length":8999,"network":{"bytes":194,"community_id":"1:wKZ0ryt7JtLMIi9rlHCV0x7s5PU=","packets":3},"node":"spark-afae","packetPos":[-82412,198415,2558,3504],"packetRange":{"gte":1788170089607,"lte":1788170098606},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS198953 Proton66 OOO","number":198953,"organization":{"name":"Proton66 OOO"}},"bytes":194,"geo":{"country_iso_code":"RU"},"ip":"176.120.22.61","mac":["98:44:ce:60:15:19"],"mac-cnt":1,"packets":3,"port":62631},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Huawei Technologies Co.,Ltd"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[118],"srcTTLCnt":1,"tags":["honeypot","sensor:bahrain-sponge-01-ts","bahrain-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["200_2-1-1-4_1460_00","200_2-1-3-1-1-4_1460_0"],"ja4tCnt":2},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":3,"syn-ack":0,"urg":0},"tcpseq":{"src":860346444},"totDataBytes":0} +{"@timestamp":1788170577038,"_id":"260831--z4aMiI9qwlJLLjc-YPxmdxM","_index":"arkime_sessions3-260831","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Kaopu Cloud HK Limited"],"isp.dstCnt":1,"isp.src":["Proton66 OOO"],"isp.srcCnt":1,"org.dst":["LightNode-BH"],"org.dstCnt":1,"org.src":["Proton66 OOO"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["business"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":0,"geo":{"country_iso_code":"BH"},"ip":"38.54.2.209","mac":["52:54:8f:9d:76:48"],"mac-cnt":1,"packets":0,"port":4433},"dstRIR":"ARIN","ethertype":2048,"fileId":[82412],"firstPacket":1788170089607,"ipProtocol":6,"lastPacket":1788170098608,"length":9001,"network":{"bytes":194,"community_id":"1:UcR6xUgA1aQs5iJv+5FqDeR9flY=","packets":3},"node":"spark-afae","packetPos":[-82412,198333,3214,3554],"packetRange":{"gte":1788170089607,"lte":1788170098608},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS198953 Proton66 OOO","number":198953,"organization":{"name":"Proton66 OOO"}},"bytes":194,"geo":{"country_iso_code":"RU"},"ip":"176.120.22.61","mac":["98:44:ce:60:15:19"],"mac-cnt":1,"packets":3,"port":65350},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Huawei Technologies Co.,Ltd"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[118],"srcTTLCnt":1,"tags":["honeypot","sensor:bahrain-sponge-01-ts","bahrain-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["200_2-1-1-4_1460_00","200_2-1-3-1-1-4_1460_0"],"ja4tCnt":2},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":3,"syn-ack":0,"urg":0},"tcpseq":{"src":2643619161},"totDataBytes":0} +{"@timestamp":1788170577038,"_id":"260831--z7o_SmOOhtJxoa48CtN8TlB","_index":"arkime_sessions3-260831","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Kaopu Cloud HK Limited"],"isp.dstCnt":1,"isp.src":["Proton66 OOO"],"isp.srcCnt":1,"org.dst":["LightNode-BH"],"org.dstCnt":1,"org.src":["Proton66 OOO"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["business"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":0,"geo":{"country_iso_code":"BH"},"ip":"38.54.2.209","mac":["52:54:8f:9d:76:48"],"mac-cnt":1,"packets":0,"port":3333},"dstRIR":"ARIN","ethertype":2048,"fileId":[82412],"firstPacket":1788170089607,"ipProtocol":6,"lastPacket":1788170098609,"length":9002,"network":{"bytes":194,"community_id":"1:H+2NtDhzKo0hRZzqLu2x2Jw+qgw=","packets":3},"node":"spark-afae","packetPos":[-82412,198579,3214,3542],"packetRange":{"gte":1788170089607,"lte":1788170098609},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS198953 Proton66 OOO","number":198953,"organization":{"name":"Proton66 OOO"}},"bytes":194,"geo":{"country_iso_code":"RU"},"ip":"176.120.22.61","mac":["98:44:ce:60:15:19"],"mac-cnt":1,"packets":3,"port":63497},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Huawei Technologies Co.,Ltd"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[118],"srcTTLCnt":1,"tags":["honeypot","sensor:bahrain-sponge-01-ts","bahrain-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["200_2-1-1-4_1460_00","200_2-1-3-1-1-4_1460_0"],"ja4tCnt":2},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":3,"syn-ack":0,"urg":0},"tcpseq":{"src":320596176},"totDataBytes":0} +{"@timestamp":1788170577237,"_id":"260831--z4JX_PG_PlNwYcwmiOqHr9y","_index":"arkime_sessions3-260831","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Kaopu Cloud HK Limited"],"isp.dstCnt":1,"isp.src":["Proton66 OOO"],"isp.srcCnt":1,"org.dst":["LightNode-BH"],"org.dstCnt":1,"org.src":["Proton66 OOO"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["business"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":0,"geo":{"country_iso_code":"BH"},"ip":"38.54.2.209","mac":["52:54:8f:9d:76:48"],"mac-cnt":1,"packets":0,"port":2008},"dstRIR":"ARIN","ethertype":2048,"fileId":[82412],"firstPacket":1788170089605,"ipProtocol":6,"lastPacket":1788170098592,"length":8987,"network":{"bytes":194,"community_id":"1:bJnyYJ9JizJJT/icth5lxFqLn7k=","packets":3},"node":"spark-afae","packetPos":[-82412,198169,2312,3684],"packetRange":{"gte":1788170089605,"lte":1788170098592},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS198953 Proton66 OOO","number":198953,"organization":{"name":"Proton66 OOO"}},"bytes":194,"geo":{"country_iso_code":"RU"},"ip":"176.120.22.61","mac":["98:44:ce:60:15:19"],"mac-cnt":1,"packets":3,"port":65361},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Huawei Technologies Co.,Ltd"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[118],"srcTTLCnt":1,"tags":["honeypot","sensor:bahrain-sponge-01-ts","bahrain-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["200_2-1-1-4_1460_00","200_2-1-3-1-1-4_1460_0"],"ja4tCnt":2},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":3,"syn-ack":0,"urg":0},"tcpseq":{"src":2120225160},"totDataBytes":0} +{"@timestamp":1788170577037,"_id":"260831--z7e909iD1RLLavH39j28ucw","_index":"arkime_sessions3-260831","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Kaopu Cloud HK Limited"],"isp.dstCnt":1,"isp.src":["Proton66 OOO"],"isp.srcCnt":1,"org.dst":["LightNode-BH"],"org.dstCnt":1,"org.src":["Proton66 OOO"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["business"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":0,"geo":{"country_iso_code":"BH"},"ip":"38.54.2.209","mac":["52:54:8f:9d:76:48"],"mac-cnt":1,"packets":0,"port":1500},"dstRIR":"ARIN","ethertype":2048,"fileId":[82412],"firstPacket":1788170089604,"ipProtocol":6,"lastPacket":1788170098592,"length":8988,"network":{"bytes":194,"community_id":"1:AocsVOaJMMwAtAT5/jIMsMydW/Y=","packets":3},"node":"spark-afae","packetPos":[-82412,198087,2558,3598],"packetRange":{"gte":1788170089604,"lte":1788170098592},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS198953 Proton66 OOO","number":198953,"organization":{"name":"Proton66 OOO"}},"bytes":194,"geo":{"country_iso_code":"RU"},"ip":"176.120.22.61","mac":["98:44:ce:60:15:19"],"mac-cnt":1,"packets":3,"port":65135},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Huawei Technologies Co.,Ltd"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[118],"srcTTLCnt":1,"tags":["honeypot","sensor:bahrain-sponge-01-ts","bahrain-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["200_2-1-1-4_1460_00","200_2-1-3-1-1-4_1460_0"],"ja4tCnt":2},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":3,"syn-ack":0,"urg":0},"tcpseq":{"src":2003931571},"totDataBytes":0} +{"@timestamp":1788170577238,"_id":"260831--z748Klk3IxNUYacmdDBIw-y","_index":"arkime_sessions3-260831","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Kaopu Cloud HK Limited"],"isp.dstCnt":1,"isp.src":["Proton66 OOO"],"isp.srcCnt":1,"org.dst":["LightNode-BH"],"org.dstCnt":1,"org.src":["Proton66 OOO"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["business"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":0,"geo":{"country_iso_code":"BH"},"ip":"38.54.2.209","mac":["52:54:8f:9d:76:48"],"mac-cnt":1,"packets":0,"port":1800},"dstRIR":"ARIN","ethertype":2048,"fileId":[82412],"firstPacket":1788170089603,"ipProtocol":6,"lastPacket":1788170098592,"length":8989,"network":{"bytes":194,"community_id":"1:AxfxM1wZzjWoufJ6HKj5FLkCZrQ=","packets":3},"node":"spark-afae","packetPos":[-82412,198005,2394,3610],"packetRange":{"gte":1788170089603,"lte":1788170098592},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS198953 Proton66 OOO","number":198953,"organization":{"name":"Proton66 OOO"}},"bytes":194,"geo":{"country_iso_code":"RU"},"ip":"176.120.22.61","mac":["98:44:ce:60:15:19"],"mac-cnt":1,"packets":3,"port":64398},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Huawei Technologies Co.,Ltd"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[118],"srcTTLCnt":1,"tags":["honeypot","sensor:bahrain-sponge-01-ts","bahrain-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["200_2-1-1-4_1460_00","200_2-1-3-1-1-4_1460_0"],"ja4tCnt":2},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":3,"syn-ack":0,"urg":0},"tcpseq":{"src":2809760729},"totDataBytes":0} +{"@timestamp":1788170577038,"_id":"260831--z58UrOcvnNHj5VwHAAVCV3s","_index":"arkime_sessions3-260831","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Kaopu Cloud HK Limited"],"isp.dstCnt":1,"isp.src":["Proton66 OOO"],"isp.srcCnt":1,"org.dst":["LightNode-BH"],"org.dstCnt":1,"org.src":["Proton66 OOO"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["business"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":0,"geo":{"country_iso_code":"BH"},"ip":"38.54.2.209","mac":["52:54:8f:9d:76:48"],"mac-cnt":1,"packets":0,"port":12443},"dstRIR":"ARIN","ethertype":2048,"fileId":[82412],"firstPacket":1788170089602,"ipProtocol":6,"lastPacket":1788170098607,"length":9005,"network":{"bytes":194,"community_id":"1:BS36BzDeN0+0xjYg/smICtS51XI=","packets":3},"node":"spark-afae","packetPos":[-82412,197923,3460,3640],"packetRange":{"gte":1788170089602,"lte":1788170098607},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS198953 Proton66 OOO","number":198953,"organization":{"name":"Proton66 OOO"}},"bytes":194,"geo":{"country_iso_code":"RU"},"ip":"176.120.22.61","mac":["98:44:ce:60:15:19"],"mac-cnt":1,"packets":3,"port":64091},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Huawei Technologies Co.,Ltd"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[118],"srcTTLCnt":1,"tags":["honeypot","sensor:bahrain-sponge-01-ts","bahrain-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["200_2-1-1-4_1460_00","200_2-1-3-1-1-4_1460_0"],"ja4tCnt":2},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":3,"syn-ack":0,"urg":0},"tcpseq":{"src":1640109991},"totDataBytes":0} +{"@timestamp":1788170577037,"_id":"260831--z6egMOKe-NMx7SjB6PXWD_Z","_index":"arkime_sessions3-260831","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Kaopu Cloud HK Limited"],"isp.dstCnt":1,"isp.src":["Proton66 OOO"],"isp.srcCnt":1,"org.dst":["LightNode-BH"],"org.dstCnt":1,"org.src":["Proton66 OOO"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["business"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":0,"geo":{"country_iso_code":"BH"},"ip":"38.54.2.209","mac":["52:54:8f:9d:76:48"],"mac-cnt":1,"packets":0,"port":12345},"dstRIR":"ARIN","ethertype":2048,"fileId":[82412],"firstPacket":1788170089602,"ipProtocol":6,"lastPacket":1788170098592,"length":8990,"network":{"bytes":194,"community_id":"1:WXFpBTeEO8V3qzQnOEl1TFP5D+M=","packets":3},"node":"spark-afae","packetPos":[-82412,197841,2722,3524],"packetRange":{"gte":1788170089602,"lte":1788170098592},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS198953 Proton66 OOO","number":198953,"organization":{"name":"Proton66 OOO"}},"bytes":194,"geo":{"country_iso_code":"RU"},"ip":"176.120.22.61","mac":["98:44:ce:60:15:19"],"mac-cnt":1,"packets":3,"port":64989},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Huawei Technologies Co.,Ltd"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[118],"srcTTLCnt":1,"tags":["honeypot","sensor:bahrain-sponge-01-ts","bahrain-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["200_2-1-1-4_1460_00","200_2-1-3-1-1-4_1460_0"],"ja4tCnt":2},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":3,"syn-ack":0,"urg":0},"tcpseq":{"src":3903503155},"totDataBytes":0} +{"@timestamp":1788170577037,"_id":"260831--z5r8YTZ8l9KV4bhwXA9My7n","_index":"arkime_sessions3-260831","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Kaopu Cloud HK Limited"],"isp.dstCnt":1,"isp.src":["Proton66 OOO"],"isp.srcCnt":1,"org.dst":["LightNode-BH"],"org.dstCnt":1,"org.src":["Proton66 OOO"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["business"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":0,"geo":{"country_iso_code":"BH"},"ip":"38.54.2.209","mac":["52:54:8f:9d:76:48"],"mac-cnt":1,"packets":0,"port":1434},"dstRIR":"ARIN","ethertype":2048,"fileId":[82412],"firstPacket":1788170089601,"ipProtocol":6,"lastPacket":1788170098591,"length":8990,"network":{"bytes":194,"community_id":"1:KvLeXQ65vriWSSMqujoU3o4KS+k=","packets":3},"node":"spark-afae","packetPos":[-82412,197759,2476,3618],"packetRange":{"gte":1788170089601,"lte":1788170098591},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS198953 Proton66 OOO","number":198953,"organization":{"name":"Proton66 OOO"}},"bytes":194,"geo":{"country_iso_code":"RU"},"ip":"176.120.22.61","mac":["98:44:ce:60:15:19"],"mac-cnt":1,"packets":3,"port":64198},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Huawei Technologies Co.,Ltd"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[118],"srcTTLCnt":1,"tags":["honeypot","sensor:bahrain-sponge-01-ts","bahrain-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["200_2-1-1-4_1460_00","200_2-1-3-1-1-4_1460_0"],"ja4tCnt":2},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":3,"syn-ack":0,"urg":0},"tcpseq":{"src":765870725},"totDataBytes":0} +{"@timestamp":1788170577038,"_id":"260831--z4lQ-Hmd-NB0bQenChs3P2l","_index":"arkime_sessions3-260831","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Kaopu Cloud HK Limited"],"isp.dstCnt":1,"isp.src":["Proton66 OOO"],"isp.srcCnt":1,"org.dst":["LightNode-BH"],"org.dstCnt":1,"org.src":["Proton66 OOO"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["business"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":0,"geo":{"country_iso_code":"BH"},"ip":"38.54.2.209","mac":["52:54:8f:9d:76:48"],"mac-cnt":1,"packets":0,"port":1433},"dstRIR":"ARIN","ethertype":2048,"fileId":[82412],"firstPacket":1788170089601,"ipProtocol":6,"lastPacket":1788170098591,"length":8990,"network":{"bytes":194,"community_id":"1:ZeUiRdy2otqvy2cK0FTbLB3QlA4=","packets":3},"node":"spark-afae","packetPos":[-82412,197677,2640,3614],"packetRange":{"gte":1788170089601,"lte":1788170098591},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS198953 Proton66 OOO","number":198953,"organization":{"name":"Proton66 OOO"}},"bytes":194,"geo":{"country_iso_code":"RU"},"ip":"176.120.22.61","mac":["98:44:ce:60:15:19"],"mac-cnt":1,"packets":3,"port":62692},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Huawei Technologies Co.,Ltd"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[118],"srcTTLCnt":1,"tags":["honeypot","sensor:bahrain-sponge-01-ts","bahrain-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["200_2-1-1-4_1460_00","200_2-1-3-1-1-4_1460_0"],"ja4tCnt":2},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":3,"syn-ack":0,"urg":0},"tcpseq":{"src":1151301433},"totDataBytes":0} +{"@timestamp":1788112934719,"_id":"260830-MDdZjJRoI_9O27ASNuRDEjzK","_index":"arkime_sessions3-260830","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Kaopu Cloud HK Limited"],"isp.dstCnt":1,"isp.src":["Proton66 OOO"],"isp.srcCnt":1,"org.dst":["LightNode-BH"],"org.dstCnt":1,"org.src":["Proton66 OOO"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["business"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":0,"geo":{"country_iso_code":"BH"},"ip":"38.54.2.209","mac":["52:54:8f:9d:76:48"],"mac-cnt":1,"packets":0,"port":9999},"dstRIR":"ARIN","ethertype":2048,"fileId":[82029],"firstPacket":1788112159371,"ipProtocol":6,"lastPacket":1788112168367,"length":8996,"network":{"bytes":194,"community_id":"1:QFwP6fvpDFd3q5UX8GaJ+qVfjl8=","packets":3},"node":"spark-afae","packetPos":[-82029,105480,1921,2576],"packetRange":{"gte":1788112159371,"lte":1788112168367},"protocol":["tcp"],"protocolCnt":1,"rootId":"260830-MDdZjJRoI_9O27ASNuRDEjzK","segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS198953 Proton66 OOO","number":198953,"organization":{"name":"Proton66 OOO"}},"bytes":194,"geo":{"country_iso_code":"RU"},"ip":"176.120.22.61","mac":["98:44:ce:60:15:19"],"mac-cnt":1,"packets":3,"port":52689},"spoofable":["true"],"spoofableCnt":1,"srcDscp":[8],"srcDscpCnt":1,"srcOui":["Huawei Technologies Co.,Ltd"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[117],"srcTTLCnt":1,"tags":["honeypot","bahrain-sponge-01-ts","sensor:bahrain-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["8192_2-1-3-1-1-4_1460_8","8192_2-1-1-4_1460_00"],"ja4tCnt":2},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":3,"syn-ack":0,"urg":0},"tcpseq":{"src":3131433924},"totDataBytes":0} +{"@timestamp":1788112934719,"_id":"260830-MDeHogoU3uxDZYLWSEw-bu9S","_index":"arkime_sessions3-260830","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Kaopu Cloud HK Limited"],"isp.dstCnt":1,"isp.src":["Proton66 OOO"],"isp.srcCnt":1,"org.dst":["LightNode-BH"],"org.dstCnt":1,"org.src":["Proton66 OOO"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["business"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":0,"geo":{"country_iso_code":"BH"},"ip":"38.54.2.209","mac":["52:54:8f:9d:76:48"],"mac-cnt":1,"packets":0,"port":9001},"dstRIR":"ARIN","ethertype":2048,"fileId":[82029],"firstPacket":1788112159370,"ipProtocol":6,"lastPacket":1788112168364,"length":8994,"network":{"bytes":194,"community_id":"1:N/8IHGS2ayhVPQZcB/5CRFNMqos=","packets":3},"node":"spark-afae","packetPos":[-82029,105398,1921,2580],"packetRange":{"gte":1788112159370,"lte":1788112168364},"protocol":["tcp"],"protocolCnt":1,"rootId":"260830-MDeHogoU3uxDZYLWSEw-bu9S","segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS198953 Proton66 OOO","number":198953,"organization":{"name":"Proton66 OOO"}},"bytes":194,"geo":{"country_iso_code":"RU"},"ip":"176.120.22.61","mac":["98:44:ce:60:15:19"],"mac-cnt":1,"packets":3,"port":52688},"spoofable":["true"],"spoofableCnt":1,"srcDscp":[8],"srcDscpCnt":1,"srcOui":["Huawei Technologies Co.,Ltd"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[117],"srcTTLCnt":1,"tags":["honeypot","bahrain-sponge-01-ts","sensor:bahrain-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["8192_2-1-3-1-1-4_1460_8","8192_2-1-1-4_1460_00"],"ja4tCnt":2},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":3,"syn-ack":0,"urg":0},"tcpseq":{"src":3514635461},"totDataBytes":0} +{"@timestamp":1788112934719,"_id":"260830-MDegpMyQ36lPyr8TH_QB6b2h","_index":"arkime_sessions3-260830","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Kaopu Cloud HK Limited"],"isp.dstCnt":1,"isp.src":["Proton66 OOO"],"isp.srcCnt":1,"org.dst":["LightNode-BH"],"org.dstCnt":1,"org.src":["Proton66 OOO"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["business"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":0,"geo":{"country_iso_code":"BH"},"ip":"38.54.2.209","mac":["52:54:8f:9d:76:48"],"mac-cnt":1,"packets":0,"port":8888},"dstRIR":"ARIN","ethertype":2048,"fileId":[82029],"firstPacket":1788112159369,"ipProtocol":6,"lastPacket":1788112168372,"length":9003,"network":{"bytes":194,"community_id":"1:UG9nFCNisFxskm1n6hfw9WmUoQY=","packets":3},"node":"spark-afae","packetPos":[-82029,105316,2249,2568],"packetRange":{"gte":1788112159369,"lte":1788112168372},"protocol":["tcp"],"protocolCnt":1,"rootId":"260830-MDegpMyQ36lPyr8TH_QB6b2h","segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS198953 Proton66 OOO","number":198953,"organization":{"name":"Proton66 OOO"}},"bytes":194,"geo":{"country_iso_code":"RU"},"ip":"176.120.22.61","mac":["98:44:ce:60:15:19"],"mac-cnt":1,"packets":3,"port":52664},"spoofable":["true"],"spoofableCnt":1,"srcDscp":[8],"srcDscpCnt":1,"srcOui":["Huawei Technologies Co.,Ltd"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[117],"srcTTLCnt":1,"tags":["honeypot","bahrain-sponge-01-ts","sensor:bahrain-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["8192_2-1-3-1-1-4_1460_8","8192_2-1-1-4_1460_00"],"ja4tCnt":2},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":3,"syn-ack":0,"urg":0},"tcpseq":{"src":195272261},"totDataBytes":0} +{"@timestamp":1788112934719,"_id":"260830-MDfLsrbcK-1IA4O3C1ls-4s_","_index":"arkime_sessions3-260830","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Kaopu Cloud HK Limited"],"isp.dstCnt":1,"isp.src":["Proton66 OOO"],"isp.srcCnt":1,"org.dst":["LightNode-BH"],"org.dstCnt":1,"org.src":["Proton66 OOO"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["business"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":0,"geo":{"country_iso_code":"BH"},"ip":"38.54.2.209","mac":["52:54:8f:9d:76:48"],"mac-cnt":1,"packets":0,"port":6001},"dstRIR":"ARIN","ethertype":2048,"fileId":[82029],"firstPacket":1788112159364,"ipProtocol":6,"lastPacket":1788112168368,"length":9004,"network":{"bytes":194,"community_id":"1:qy9gtdIs+w0hB/U0d4ulPOx2o6Q=","packets":3},"node":"spark-afae","packetPos":[-82029,105234,2249,2572],"packetRange":{"gte":1788112159364,"lte":1788112168368},"protocol":["tcp"],"protocolCnt":1,"rootId":"260830-MDfLsrbcK-1IA4O3C1ls-4s_","segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS198953 Proton66 OOO","number":198953,"organization":{"name":"Proton66 OOO"}},"bytes":194,"geo":{"country_iso_code":"RU"},"ip":"176.120.22.61","mac":["98:44:ce:60:15:19"],"mac-cnt":1,"packets":3,"port":52660},"spoofable":["true"],"spoofableCnt":1,"srcDscp":[8],"srcDscpCnt":1,"srcOui":["Huawei Technologies Co.,Ltd"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[117],"srcTTLCnt":1,"tags":["honeypot","bahrain-sponge-01-ts","sensor:bahrain-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["8192_2-1-3-1-1-4_1460_8","65535_2-1-1-4_1460_00"],"ja4tCnt":2},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":3,"syn-ack":0,"urg":0},"tcpseq":{"src":2606542954},"totDataBytes":0} +{"@timestamp":1788112934722,"_id":"260830-MDdZfu3VK9ZBMoI0afa0sG4k","_index":"arkime_sessions3-260830","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Kaopu Cloud HK Limited"],"isp.dstCnt":1,"isp.src":["Proton66 OOO"],"isp.srcCnt":1,"org.dst":["LightNode-BH"],"org.dstCnt":1,"org.src":["Proton66 OOO"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["business"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":0,"geo":{"country_iso_code":"BH"},"ip":"38.54.2.209","mac":["52:54:8f:9d:76:48"],"mac-cnt":1,"packets":0,"port":7788},"dstRIR":"ARIN","ethertype":2048,"fileId":[82029],"firstPacket":1788112159363,"ipProtocol":6,"lastPacket":1788112168361,"length":8998,"network":{"bytes":194,"community_id":"1:GFojdFqqRXa3ut2a8tnViq6JuEo=","packets":3},"node":"spark-afae","packetPos":[-82029,105152,2085,2584],"packetRange":{"gte":1788112159363,"lte":1788112168361},"protocol":["tcp"],"protocolCnt":1,"rootId":"260830-MDdZfu3VK9ZBMoI0afa0sG4k","segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS198953 Proton66 OOO","number":198953,"organization":{"name":"Proton66 OOO"}},"bytes":194,"geo":{"country_iso_code":"RU"},"ip":"176.120.22.61","mac":["98:44:ce:60:15:19"],"mac-cnt":1,"packets":3,"port":52662},"spoofable":["true"],"spoofableCnt":1,"srcDscp":[8],"srcDscpCnt":1,"srcOui":["Huawei Technologies Co.,Ltd"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[117],"srcTTLCnt":1,"tags":["honeypot","bahrain-sponge-01-ts","sensor:bahrain-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["8192_2-1-3-1-1-4_1460_8","65535_2-1-1-4_1460_00"],"ja4tCnt":2},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":3,"syn-ack":0,"urg":0},"tcpseq":{"src":2758541865},"totDataBytes":0} +{"@timestamp":1788112934719,"_id":"260830-MDcVMz_0iFhLV5zT_iQUhPoq","_index":"arkime_sessions3-260830","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Kaopu Cloud HK Limited"],"isp.dstCnt":1,"isp.src":["Proton66 OOO"],"isp.srcCnt":1,"org.dst":["LightNode-BH"],"org.dstCnt":1,"org.src":["Proton66 OOO"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["business"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":0,"geo":{"country_iso_code":"BH"},"ip":"38.54.2.209","mac":["52:54:8f:9d:76:48"],"mac-cnt":1,"packets":0,"port":5000},"dstRIR":"ARIN","ethertype":2048,"fileId":[82029],"firstPacket":1788112159356,"ipProtocol":6,"lastPacket":1788112168353,"length":8997,"network":{"bytes":194,"community_id":"1:AzWv8VbqvfrRfQ/DhH51Tu4z4sc=","packets":3},"node":"spark-afae","packetPos":[-82029,105070,2085,2588],"packetRange":{"gte":1788112159356,"lte":1788112168353},"protocol":["tcp"],"protocolCnt":1,"rootId":"260830-MDcVMz_0iFhLV5zT_iQUhPoq","segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS198953 Proton66 OOO","number":198953,"organization":{"name":"Proton66 OOO"}},"bytes":194,"geo":{"country_iso_code":"RU"},"ip":"176.120.22.61","mac":["98:44:ce:60:15:19"],"mac-cnt":1,"packets":3,"port":52637},"spoofable":["true"],"spoofableCnt":1,"srcDscp":[8],"srcDscpCnt":1,"srcOui":["Huawei Technologies Co.,Ltd"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[117],"srcTTLCnt":1,"tags":["honeypot","bahrain-sponge-01-ts","sensor:bahrain-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["8192_2-1-3-1-1-4_1460_8","8192_2-1-1-4_1460_00"],"ja4tCnt":2},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":3,"syn-ack":0,"urg":0},"tcpseq":{"src":2941125720},"totDataBytes":0} +{"@timestamp":1788112934719,"_id":"260830-MDdwE_XUV9NFopVEB9kcqIq3","_index":"arkime_sessions3-260830","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Kaopu Cloud HK Limited"],"isp.dstCnt":1,"isp.src":["Proton66 OOO"],"isp.srcCnt":1,"org.dst":["LightNode-BH"],"org.dstCnt":1,"org.src":["Proton66 OOO"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["business"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":0,"geo":{"country_iso_code":"BH"},"ip":"38.54.2.209","mac":["52:54:8f:9d:76:48"],"mac-cnt":1,"packets":0,"port":3005},"dstRIR":"ARIN","ethertype":2048,"fileId":[82029],"firstPacket":1788112159355,"ipProtocol":6,"lastPacket":1788112168351,"length":8996,"network":{"bytes":194,"community_id":"1:xGQSUL3f2V6oWYg208rVyVjmBHc=","packets":3},"node":"spark-afae","packetPos":[-82029,104988,2003,2596],"packetRange":{"gte":1788112159355,"lte":1788112168351},"protocol":["tcp"],"protocolCnt":1,"rootId":"260830-MDdwE_XUV9NFopVEB9kcqIq3","segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS198953 Proton66 OOO","number":198953,"organization":{"name":"Proton66 OOO"}},"bytes":194,"geo":{"country_iso_code":"RU"},"ip":"176.120.22.61","mac":["98:44:ce:60:15:19"],"mac-cnt":1,"packets":3,"port":52633},"spoofable":["true"],"spoofableCnt":1,"srcDscp":[8],"srcDscpCnt":1,"srcOui":["Huawei Technologies Co.,Ltd"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[117],"srcTTLCnt":1,"tags":["honeypot","bahrain-sponge-01-ts","sensor:bahrain-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["8192_2-1-3-1-1-4_1460_8","8192_2-1-1-4_1460_00"],"ja4tCnt":2},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":3,"syn-ack":0,"urg":0},"tcpseq":{"src":1423425643},"totDataBytes":0} +{"@timestamp":1788112934722,"_id":"260830-MDddxJB6wRhP5K86nLazUAhL","_index":"arkime_sessions3-260830","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Kaopu Cloud HK Limited"],"isp.dstCnt":1,"isp.src":["Proton66 OOO"],"isp.srcCnt":1,"org.dst":["LightNode-BH"],"org.dstCnt":1,"org.src":["Proton66 OOO"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["business"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":0,"geo":{"country_iso_code":"BH"},"ip":"38.54.2.209","mac":["52:54:8f:9d:76:48"],"mac-cnt":1,"packets":0,"port":8899},"dstRIR":"ARIN","ethertype":2048,"fileId":[82029],"firstPacket":1788112159351,"ipProtocol":6,"lastPacket":1788112168351,"length":9000,"network":{"bytes":194,"community_id":"1:WjeHPFEjd1JCQGBoESIUqG0JJvM=","packets":3},"node":"spark-afae","packetPos":[-82029,104906,2167,2592],"packetRange":{"gte":1788112159351,"lte":1788112168351},"protocol":["tcp"],"protocolCnt":1,"rootId":"260830-MDddxJB6wRhP5K86nLazUAhL","segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS198953 Proton66 OOO","number":198953,"organization":{"name":"Proton66 OOO"}},"bytes":194,"geo":{"country_iso_code":"RU"},"ip":"176.120.22.61","mac":["98:44:ce:60:15:19"],"mac-cnt":1,"packets":3,"port":52676},"spoofable":["true"],"spoofableCnt":1,"srcDscp":[8],"srcDscpCnt":1,"srcOui":["Huawei Technologies Co.,Ltd"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[117],"srcTTLCnt":1,"tags":["honeypot","bahrain-sponge-01-ts","sensor:bahrain-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["8192_2-1-3-1-1-4_1460_8","8192_2-1-1-4_1460_00"],"ja4tCnt":2},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":3,"syn-ack":0,"urg":0},"tcpseq":{"src":3701044199},"totDataBytes":0} +{"@timestamp":1788112934722,"_id":"260830-MDd5iXpOI7FCH5eah8B7LO4V","_index":"arkime_sessions3-260830","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Kaopu Cloud HK Limited"],"isp.dstCnt":1,"isp.src":["Proton66 OOO"],"isp.srcCnt":1,"org.dst":["LightNode-BH"],"org.dstCnt":1,"org.src":["Proton66 OOO"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["business"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":0,"geo":{"country_iso_code":"BH"},"ip":"38.54.2.209","mac":["52:54:8f:9d:76:48"],"mac-cnt":1,"packets":0,"port":8989},"dstRIR":"ARIN","ethertype":2048,"fileId":[82029],"firstPacket":1788112159345,"ipProtocol":6,"lastPacket":1788112168347,"length":9002,"network":{"bytes":194,"community_id":"1:ShSphBD1AfWweewRqkTMVpwDNd4=","packets":3},"node":"spark-afae","packetPos":[-82029,104824,2085,2600],"packetRange":{"gte":1788112159345,"lte":1788112168347},"protocol":["tcp"],"protocolCnt":1,"rootId":"260830-MDd5iXpOI7FCH5eah8B7LO4V","segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS198953 Proton66 OOO","number":198953,"organization":{"name":"Proton66 OOO"}},"bytes":194,"geo":{"country_iso_code":"RU"},"ip":"176.120.22.61","mac":["98:44:ce:60:15:19"],"mac-cnt":1,"packets":3,"port":52677},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Huawei Technologies Co.,Ltd"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[118],"srcTTLCnt":1,"tags":["honeypot","bahrain-sponge-01-ts","sensor:bahrain-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["8192_2-1-3-1-1-4_1460_8","8192_2-1-1-4_1460_00"],"ja4tCnt":2},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":3,"syn-ack":0,"urg":0},"tcpseq":{"src":4146533757},"totDataBytes":0} +{"@timestamp":1788112934722,"_id":"260830-MDcpN9Kp6X5JqLvHl2Kd-3El","_index":"arkime_sessions3-260830","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Kaopu Cloud HK Limited"],"isp.dstCnt":1,"isp.src":["Proton66 OOO"],"isp.srcCnt":1,"org.dst":["LightNode-BH"],"org.dstCnt":1,"org.src":["Proton66 OOO"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["business"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":0,"geo":{"country_iso_code":"BH"},"ip":"38.54.2.209","mac":["52:54:8f:9d:76:48"],"mac-cnt":1,"packets":0,"port":8001},"dstRIR":"ARIN","ethertype":2048,"fileId":[82029],"firstPacket":1788112159344,"ipProtocol":6,"lastPacket":1788112168342,"length":8998,"network":{"bytes":194,"community_id":"1:iiICHJEKmnyf7JaT3SVPr23Vp5A=","packets":3},"node":"spark-afae","packetPos":[-82029,104742,2085,2604],"packetRange":{"gte":1788112159344,"lte":1788112168342},"protocol":["tcp"],"protocolCnt":1,"rootId":"260830-MDcpN9Kp6X5JqLvHl2Kd-3El","segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS198953 Proton66 OOO","number":198953,"organization":{"name":"Proton66 OOO"}},"bytes":194,"geo":{"country_iso_code":"RU"},"ip":"176.120.22.61","mac":["98:44:ce:60:15:19"],"mac-cnt":1,"packets":3,"port":52663},"spoofable":["true"],"spoofableCnt":1,"srcDscp":[8],"srcDscpCnt":1,"srcOui":["Huawei Technologies Co.,Ltd"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[117],"srcTTLCnt":1,"tags":["honeypot","bahrain-sponge-01-ts","sensor:bahrain-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["8192_2-1-3-1-1-4_1460_8","65535_2-1-1-4_1460_00"],"ja4tCnt":2},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":3,"syn-ack":0,"urg":0},"tcpseq":{"src":2324561050},"totDataBytes":0} +{"@timestamp":1788112934719,"_id":"260830-MDcYfX0nYrlOEbRB7_Bld459","_index":"arkime_sessions3-260830","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Kaopu Cloud HK Limited"],"isp.dstCnt":1,"isp.src":["Proton66 OOO"],"isp.srcCnt":1,"org.dst":["LightNode-BH"],"org.dstCnt":1,"org.src":["Proton66 OOO"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["business"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":0,"geo":{"country_iso_code":"BH"},"ip":"38.54.2.209","mac":["52:54:8f:9d:76:48"],"mac-cnt":1,"packets":0,"port":2008},"dstRIR":"ARIN","ethertype":2048,"fileId":[82029],"firstPacket":1788112159342,"ipProtocol":6,"lastPacket":1788112168338,"length":8996,"network":{"bytes":194,"community_id":"1:QXv5vX3+Y2xqJSnc0xVQC1bsG/0=","packets":3},"node":"spark-afae","packetPos":[-82029,104660,2085,2608],"packetRange":{"gte":1788112159342,"lte":1788112168338},"protocol":["tcp"],"protocolCnt":1,"rootId":"260830-MDcYfX0nYrlOEbRB7_Bld459","segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS198953 Proton66 OOO","number":198953,"organization":{"name":"Proton66 OOO"}},"bytes":194,"geo":{"country_iso_code":"RU"},"ip":"176.120.22.61","mac":["98:44:ce:60:15:19"],"mac-cnt":1,"packets":3,"port":52632},"spoofable":["true"],"spoofableCnt":1,"srcDscp":[8],"srcDscpCnt":1,"srcOui":["Huawei Technologies Co.,Ltd"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[117],"srcTTLCnt":1,"tags":["honeypot","bahrain-sponge-01-ts","sensor:bahrain-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["8192_2-1-3-1-1-4_1460_8","8192_2-1-1-4_1460_00"],"ja4tCnt":2},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":3,"syn-ack":0,"urg":0},"tcpseq":{"src":3310846614},"totDataBytes":0} +{"@timestamp":1788112934722,"_id":"260830-MDciouvsFd5FpabRfT-fCPnt","_index":"arkime_sessions3-260830","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Kaopu Cloud HK Limited"],"isp.dstCnt":1,"isp.src":["Proton66 OOO"],"isp.srcCnt":1,"org.dst":["LightNode-BH"],"org.dstCnt":1,"org.src":["Proton66 OOO"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["business"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":0,"geo":{"country_iso_code":"BH"},"ip":"38.54.2.209","mac":["52:54:8f:9d:76:48"],"mac-cnt":1,"packets":0,"port":1800},"dstRIR":"ARIN","ethertype":2048,"fileId":[82029],"firstPacket":1788112159340,"ipProtocol":6,"lastPacket":1788112168337,"length":8997,"network":{"bytes":194,"community_id":"1:Ai/p0Ku6+ng7ouleypvV2n2w0SY=","packets":3},"node":"spark-afae","packetPos":[-82029,104578,2085,2612],"packetRange":{"gte":1788112159340,"lte":1788112168337},"protocol":["tcp"],"protocolCnt":1,"rootId":"260830-MDciouvsFd5FpabRfT-fCPnt","segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS198953 Proton66 OOO","number":198953,"organization":{"name":"Proton66 OOO"}},"bytes":194,"geo":{"country_iso_code":"RU"},"ip":"176.120.22.61","mac":["98:44:ce:60:15:19"],"mac-cnt":1,"packets":3,"port":52630},"spoofable":["true"],"spoofableCnt":1,"srcDscp":[8],"srcDscpCnt":1,"srcOui":["Huawei Technologies Co.,Ltd"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[117],"srcTTLCnt":1,"tags":["honeypot","bahrain-sponge-01-ts","sensor:bahrain-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["8192_2-1-3-1-1-4_1460_8","8192_2-1-1-4_1460_00"],"ja4tCnt":2},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":3,"syn-ack":0,"urg":0},"tcpseq":{"src":1537337139},"totDataBytes":0} +{"@timestamp":1788112934722,"_id":"260830-MDeo7sWw7PVKN681GITQiHKS","_index":"arkime_sessions3-260830","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Kaopu Cloud HK Limited"],"isp.dstCnt":1,"isp.src":["Proton66 OOO"],"isp.srcCnt":1,"org.dst":["LightNode-BH"],"org.dstCnt":1,"org.src":["Proton66 OOO"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["business"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":0,"geo":{"country_iso_code":"BH"},"ip":"38.54.2.209","mac":["52:54:8f:9d:76:48"],"mac-cnt":1,"packets":0,"port":6000},"dstRIR":"ARIN","ethertype":2048,"fileId":[82029],"firstPacket":1788112159338,"ipProtocol":6,"lastPacket":1788112168332,"length":8994,"network":{"bytes":194,"community_id":"1:UxUlq/QSeEcZSb1FGTl27P/NlPk=","packets":3},"node":"spark-afae","packetPos":[-82029,104496,1757,2632],"packetRange":{"gte":1788112159338,"lte":1788112168332},"protocol":["tcp"],"protocolCnt":1,"rootId":"260830-MDeo7sWw7PVKN681GITQiHKS","segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS198953 Proton66 OOO","number":198953,"organization":{"name":"Proton66 OOO"}},"bytes":194,"geo":{"country_iso_code":"RU"},"ip":"176.120.22.61","mac":["98:44:ce:60:15:19"],"mac-cnt":1,"packets":3,"port":52644},"spoofable":["true"],"spoofableCnt":1,"srcDscp":[8],"srcDscpCnt":1,"srcOui":["Huawei Technologies Co.,Ltd"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[117],"srcTTLCnt":1,"tags":["honeypot","bahrain-sponge-01-ts","sensor:bahrain-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["8192_2-1-3-1-1-4_1460_8","8192_2-1-1-4_1460_00"],"ja4tCnt":2},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":3,"syn-ack":0,"urg":0},"tcpseq":{"src":2079742221},"totDataBytes":0} +{"@timestamp":1788112934719,"_id":"260830-MDf_gXazIBJAcYeycEmG9C2y","_index":"arkime_sessions3-260830","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Kaopu Cloud HK Limited"],"isp.dstCnt":1,"isp.src":["Proton66 OOO"],"isp.srcCnt":1,"org.dst":["LightNode-BH"],"org.dstCnt":1,"org.src":["Proton66 OOO"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["business"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":0,"geo":{"country_iso_code":"BH"},"ip":"38.54.2.209","mac":["52:54:8f:9d:76:48"],"mac-cnt":1,"packets":0,"port":1500},"dstRIR":"ARIN","ethertype":2048,"fileId":[82029],"firstPacket":1788112159335,"ipProtocol":6,"lastPacket":1788112168336,"length":9001,"network":{"bytes":194,"community_id":"1:f/+/r0SXYpX7dy6jrOdJru5oQl0=","packets":3},"node":"spark-afae","packetPos":[-82029,104168,2331,2620],"packetRange":{"gte":1788112159335,"lte":1788112168336},"protocol":["tcp"],"protocolCnt":1,"rootId":"260830-MDf_gXazIBJAcYeycEmG9C2y","segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS198953 Proton66 OOO","number":198953,"organization":{"name":"Proton66 OOO"}},"bytes":194,"geo":{"country_iso_code":"RU"},"ip":"176.120.22.61","mac":["98:44:ce:60:15:19"],"mac-cnt":1,"packets":3,"port":52628},"spoofable":["true"],"spoofableCnt":1,"srcDscp":[8],"srcDscpCnt":1,"srcOui":["Huawei Technologies Co.,Ltd"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[117],"srcTTLCnt":1,"tags":["honeypot","bahrain-sponge-01-ts","sensor:bahrain-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["8192_2-1-3-1-1-4_1460_8","8192_2-1-1-4_1460_00"],"ja4tCnt":2},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":3,"syn-ack":0,"urg":0},"tcpseq":{"src":3109523257},"totDataBytes":0} +{"@timestamp":1788112934719,"_id":"260830-MDeJvnWVZJhOdoXlVrBWZeT0","_index":"arkime_sessions3-260830","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Kaopu Cloud HK Limited"],"isp.dstCnt":1,"isp.src":["Proton66 OOO"],"isp.srcCnt":1,"org.dst":["LightNode-BH"],"org.dstCnt":1,"org.src":["Proton66 OOO"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["business"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":0,"geo":{"country_iso_code":"BH"},"ip":"38.54.2.209","mac":["52:54:8f:9d:76:48"],"mac-cnt":1,"packets":0,"port":1501},"dstRIR":"ARIN","ethertype":2048,"fileId":[82029],"firstPacket":1788112159335,"ipProtocol":6,"lastPacket":1788112168336,"length":9001,"network":{"bytes":194,"community_id":"1:gqdL273BIzaUrKxcbbAjOsrZGRo=","packets":3},"node":"spark-afae","packetPos":[-82029,104250,2331,2616],"packetRange":{"gte":1788112159335,"lte":1788112168336},"protocol":["tcp"],"protocolCnt":1,"rootId":"260830-MDeJvnWVZJhOdoXlVrBWZeT0","segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS198953 Proton66 OOO","number":198953,"organization":{"name":"Proton66 OOO"}},"bytes":194,"geo":{"country_iso_code":"RU"},"ip":"176.120.22.61","mac":["98:44:ce:60:15:19"],"mac-cnt":1,"packets":3,"port":52629},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Huawei Technologies Co.,Ltd"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[118],"srcTTLCnt":1,"tags":["honeypot","bahrain-sponge-01-ts","sensor:bahrain-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["8192_2-1-3-1-1-4_1460_8","8192_2-1-1-4_1460_00"],"ja4tCnt":2},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":3,"syn-ack":0,"urg":0},"tcpseq":{"src":1012425512},"totDataBytes":0} +{"@timestamp":1788112934719,"_id":"260830-MDern2on-4dFFZPJOOb9utM8","_index":"arkime_sessions3-260830","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Kaopu Cloud HK Limited"],"isp.dstCnt":1,"isp.src":["Proton66 OOO"],"isp.srcCnt":1,"org.dst":["LightNode-BH"],"org.dstCnt":1,"org.src":["Proton66 OOO"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["business"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":0,"geo":{"country_iso_code":"BH"},"ip":"38.54.2.209","mac":["52:54:8f:9d:76:48"],"mac-cnt":1,"packets":0,"port":5005},"dstRIR":"ARIN","ethertype":2048,"fileId":[82029],"firstPacket":1788112159335,"ipProtocol":6,"lastPacket":1788112168335,"length":9000,"network":{"bytes":194,"community_id":"1:UM5k6VpBGSXfRFzp8XDvAD/rvg4=","packets":3},"node":"spark-afae","packetPos":[-82029,104414,2003,2624],"packetRange":{"gte":1788112159335,"lte":1788112168335},"protocol":["tcp"],"protocolCnt":1,"rootId":"260830-MDern2on-4dFFZPJOOb9utM8","segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS198953 Proton66 OOO","number":198953,"organization":{"name":"Proton66 OOO"}},"bytes":194,"geo":{"country_iso_code":"RU"},"ip":"176.120.22.61","mac":["98:44:ce:60:15:19"],"mac-cnt":1,"packets":3,"port":52638},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Huawei Technologies Co.,Ltd"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[118],"srcTTLCnt":1,"tags":["honeypot","bahrain-sponge-01-ts","sensor:bahrain-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["8192_2-1-3-1-1-4_1460_8","8192_2-1-1-4_1460_00"],"ja4tCnt":2},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":3,"syn-ack":0,"urg":0},"tcpseq":{"src":3796912439},"totDataBytes":0} +{"@timestamp":1788112934722,"_id":"260830-MDeqrUQ-EEpM35Ixy2OER7NU","_index":"arkime_sessions3-260830","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Kaopu Cloud HK Limited"],"isp.dstCnt":1,"isp.src":["Proton66 OOO"],"isp.srcCnt":1,"org.dst":["LightNode-BH"],"org.dstCnt":1,"org.src":["Proton66 OOO"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["business"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":0,"geo":{"country_iso_code":"BH"},"ip":"38.54.2.209","mac":["52:54:8f:9d:76:48"],"mac-cnt":1,"packets":0,"port":3333},"dstRIR":"ARIN","ethertype":2048,"fileId":[82029],"firstPacket":1788112159335,"ipProtocol":6,"lastPacket":1788112168332,"length":8997,"network":{"bytes":194,"community_id":"1:meR6nJxUBETtfoby7B5aiLfl0Ow=","packets":3},"node":"spark-afae","packetPos":[-82029,104332,1839,2636],"packetRange":{"gte":1788112159335,"lte":1788112168332},"protocol":["tcp"],"protocolCnt":1,"rootId":"260830-MDeqrUQ-EEpM35Ixy2OER7NU","segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS198953 Proton66 OOO","number":198953,"organization":{"name":"Proton66 OOO"}},"bytes":194,"geo":{"country_iso_code":"RU"},"ip":"176.120.22.61","mac":["98:44:ce:60:15:19"],"mac-cnt":1,"packets":3,"port":52634},"spoofable":["true"],"spoofableCnt":1,"srcDscp":[8],"srcDscpCnt":1,"srcOui":["Huawei Technologies Co.,Ltd"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[117],"srcTTLCnt":1,"tags":["honeypot","bahrain-sponge-01-ts","sensor:bahrain-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["8192_2-1-3-1-1-4_1460_8","65535_2-1-1-4_1460_00"],"ja4tCnt":2},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":3,"syn-ack":0,"urg":0},"tcpseq":{"src":1132740616},"totDataBytes":0} +{"@timestamp":1788112934722,"_id":"260830-MDdAg7Nc4BRPSKGfLBFQSGlC","_index":"arkime_sessions3-260830","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Kaopu Cloud HK Limited"],"isp.dstCnt":1,"isp.src":["Proton66 OOO"],"isp.srcCnt":1,"org.dst":["LightNode-BH"],"org.dstCnt":1,"org.src":["Proton66 OOO"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["business"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":0,"geo":{"country_iso_code":"BH"},"ip":"38.54.2.209","mac":["52:54:8f:9d:76:48"],"mac-cnt":1,"packets":0,"port":1433},"dstRIR":"ARIN","ethertype":2048,"fileId":[82029],"firstPacket":1788112159333,"ipProtocol":6,"lastPacket":1788112168329,"length":8996,"network":{"bytes":194,"community_id":"1:KVjSxgSYjXPjJeRT6xXTHrX5qQA=","packets":3},"node":"spark-afae","packetPos":[-82029,104086,1839,2648],"packetRange":{"gte":1788112159333,"lte":1788112168329},"protocol":["tcp"],"protocolCnt":1,"rootId":"260830-MDdAg7Nc4BRPSKGfLBFQSGlC","segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS198953 Proton66 OOO","number":198953,"organization":{"name":"Proton66 OOO"}},"bytes":194,"geo":{"country_iso_code":"RU"},"ip":"176.120.22.61","mac":["98:44:ce:60:15:19"],"mac-cnt":1,"packets":3,"port":52625},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Huawei Technologies Co.,Ltd"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[118],"srcTTLCnt":1,"tags":["honeypot","bahrain-sponge-01-ts","sensor:bahrain-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["8192_2-1-3-1-1-4_1460_8","65535_2-1-1-4_1460_00"],"ja4tCnt":2},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":3,"syn-ack":0,"urg":0},"tcpseq":{"src":2580259990},"totDataBytes":0} +{"@timestamp":1788112934722,"_id":"260830-MDduVNtM0qpEa64UxnLCc-K7","_index":"arkime_sessions3-260830","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Kaopu Cloud HK Limited"],"isp.dstCnt":1,"isp.src":["Proton66 OOO"],"isp.srcCnt":1,"org.dst":["LightNode-BH"],"org.dstCnt":1,"org.src":["Proton66 OOO"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["business"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":0,"geo":{"country_iso_code":"BH"},"ip":"38.54.2.209","mac":["52:54:8f:9d:76:48"],"mac-cnt":1,"packets":0,"port":4433},"dstRIR":"ARIN","ethertype":2048,"fileId":[82029],"firstPacket":1788112159332,"ipProtocol":6,"lastPacket":1788112168333,"length":9001,"network":{"bytes":194,"community_id":"1:dX5UCGqjDowHlkSm2cwgg0y15hg=","packets":3},"node":"spark-afae","packetPos":[-82029,104004,2331,2628],"packetRange":{"gte":1788112159332,"lte":1788112168333},"protocol":["tcp"],"protocolCnt":1,"rootId":"260830-MDduVNtM0qpEa64UxnLCc-K7","segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS198953 Proton66 OOO","number":198953,"organization":{"name":"Proton66 OOO"}},"bytes":194,"geo":{"country_iso_code":"RU"},"ip":"176.120.22.61","mac":["98:44:ce:60:15:19"],"mac-cnt":1,"packets":3,"port":52635},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Huawei Technologies Co.,Ltd"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[118],"srcTTLCnt":1,"tags":["honeypot","bahrain-sponge-01-ts","sensor:bahrain-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["8192_2-1-3-1-1-4_1460_8","8192_2-1-1-4_1460_00"],"ja4tCnt":2},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":3,"syn-ack":0,"urg":0},"tcpseq":{"src":1101358277},"totDataBytes":0} +{"@timestamp":1788112934722,"_id":"260830-MDdf-UA2rWxN0b9PMNA40fM4","_index":"arkime_sessions3-260830","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Kaopu Cloud HK Limited"],"isp.dstCnt":1,"isp.src":["Proton66 OOO"],"isp.srcCnt":1,"org.dst":["LightNode-BH"],"org.dstCnt":1,"org.src":["Proton66 OOO"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["business"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":0,"geo":{"country_iso_code":"BH"},"ip":"38.54.2.209","mac":["52:54:8f:9d:76:48"],"mac-cnt":1,"packets":0,"port":5678},"dstRIR":"ARIN","ethertype":2048,"fileId":[82029],"firstPacket":1788112159331,"ipProtocol":6,"lastPacket":1788112168330,"length":8999,"network":{"bytes":194,"community_id":"1:aCR1SBHf6WcVbsUx/dlXBQJJ2gg=","packets":3},"node":"spark-afae","packetPos":[-82029,103922,2085,2644],"packetRange":{"gte":1788112159331,"lte":1788112168330},"protocol":["tcp"],"protocolCnt":1,"rootId":"260830-MDdf-UA2rWxN0b9PMNA40fM4","segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS198953 Proton66 OOO","number":198953,"organization":{"name":"Proton66 OOO"}},"bytes":194,"geo":{"country_iso_code":"RU"},"ip":"176.120.22.61","mac":["98:44:ce:60:15:19"],"mac-cnt":1,"packets":3,"port":52643},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Huawei Technologies Co.,Ltd"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[118],"srcTTLCnt":1,"tags":["honeypot","bahrain-sponge-01-ts","sensor:bahrain-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["8192_2-1-3-1-1-4_1460_8","8192_2-1-1-4_1460_00"],"ja4tCnt":2},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":3,"syn-ack":0,"urg":0},"tcpseq":{"src":3671712436},"totDataBytes":0} +{"@timestamp":1788112934722,"_id":"260830-MDeR55WiXW5DgJu907NpucyU","_index":"arkime_sessions3-260830","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Kaopu Cloud HK Limited"],"isp.dstCnt":1,"isp.src":["Proton66 OOO"],"isp.srcCnt":1,"org.dst":["LightNode-BH"],"org.dstCnt":1,"org.src":["Proton66 OOO"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["business"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":0,"geo":{"country_iso_code":"BH"},"ip":"38.54.2.209","mac":["52:54:8f:9d:76:48"],"mac-cnt":1,"packets":0,"port":1434},"dstRIR":"ARIN","ethertype":2048,"fileId":[82029],"firstPacket":1788112159330,"ipProtocol":6,"lastPacket":1788112168327,"length":8997,"network":{"bytes":194,"community_id":"1:WDbjdCgYLceFVP+1s4m0DcJkSnA=","packets":3},"node":"spark-afae","packetPos":[-82029,103840,2003,2652],"packetRange":{"gte":1788112159330,"lte":1788112168327},"protocol":["tcp"],"protocolCnt":1,"rootId":"260830-MDeR55WiXW5DgJu907NpucyU","segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS198953 Proton66 OOO","number":198953,"organization":{"name":"Proton66 OOO"}},"bytes":194,"geo":{"country_iso_code":"RU"},"ip":"176.120.22.61","mac":["98:44:ce:60:15:19"],"mac-cnt":1,"packets":3,"port":52626},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Huawei Technologies Co.,Ltd"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[118],"srcTTLCnt":1,"tags":["honeypot","bahrain-sponge-01-ts","sensor:bahrain-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["8192_2-1-3-1-1-4_1460_8","8192_2-1-1-4_1460_00"],"ja4tCnt":2},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":3,"syn-ack":0,"urg":0},"tcpseq":{"src":2210081724},"totDataBytes":0} +{"@timestamp":1788112934722,"_id":"260830-MDd8uqH9cn1C66WZriNLrxCy","_index":"arkime_sessions3-260830","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Kaopu Cloud HK Limited"],"isp.dstCnt":1,"isp.src":["Proton66 OOO"],"isp.srcCnt":1,"org.dst":["LightNode-BH"],"org.dstCnt":1,"org.src":["Proton66 OOO"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["business"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":0,"geo":{"country_iso_code":"BH"},"ip":"38.54.2.209","mac":["52:54:8f:9d:76:48"],"mac-cnt":1,"packets":0,"port":12345},"dstRIR":"ARIN","ethertype":2048,"fileId":[82029],"firstPacket":1788112159329,"ipProtocol":6,"lastPacket":1788112168331,"length":9002,"network":{"bytes":194,"community_id":"1:d1Ra6KYymuRQV8eXRY8++EBPsKE=","packets":3},"node":"spark-afae","packetPos":[-82029,103758,2331,2640],"packetRange":{"gte":1788112159329,"lte":1788112168331},"protocol":["tcp"],"protocolCnt":1,"rootId":"260830-MDd8uqH9cn1C66WZriNLrxCy","segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS198953 Proton66 OOO","number":198953,"organization":{"name":"Proton66 OOO"}},"bytes":194,"geo":{"country_iso_code":"RU"},"ip":"176.120.22.61","mac":["98:44:ce:60:15:19"],"mac-cnt":1,"packets":3,"port":52624},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Huawei Technologies Co.,Ltd"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[118],"srcTTLCnt":1,"tags":["honeypot","bahrain-sponge-01-ts","sensor:bahrain-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["8192_2-1-3-1-1-4_1460_8","8192_2-1-1-4_1460_00"],"ja4tCnt":2},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":3,"syn-ack":0,"urg":0},"tcpseq":{"src":949184783},"totDataBytes":0} +{"@timestamp":1788006152283,"_id":"260829-wby7O_-D0LlMAbmYVg3OQOUq","_index":"arkime_sessions3-260829","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["netcup GmbH"],"isp.dstCnt":1,"isp.src":["Proton66 OOO"],"isp.srcCnt":1,"org.dst":["Netcup KVM"],"org.dstCnt":1,"org.src":["Proton66 OOO"],"org.srcCnt":1,"usertype.dst":["business"],"usertype.dstCnt":1,"usertype.src":["business"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS197540 netcup GmbH","number":197540,"organization":{"name":"netcup GmbH"}},"bytes":0,"geo":{"country_iso_code":"DE"},"ip":"159.195.21.150","mac":["8a:41:d3:b8:0d:d3"],"mac-cnt":1,"packets":0,"port":22222},"dstRIR":"ARIN","ethertype":2048,"fileId":[81316],"firstPacket":1788005478284,"ipProtocol":6,"lastPacket":1788005481284,"length":3000,"network":{"bytes":132,"community_id":"1:xYM8wpoXdQTsLZZZ8b1Q8yRpYik=","packets":2},"node":"spark-afae","packetPos":[-81316,325659,448],"packetRange":{"gte":1788005478284,"lte":1788005481284},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS198953 Proton66 OOO","number":198953,"organization":{"name":"Proton66 OOO"}},"bytes":132,"geo":{"country_iso_code":"RU"},"ip":"176.120.22.61","mac":["bc:0f:fe:38:0b:a3"],"mac-cnt":1,"packets":2,"port":19645},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[121],"srcTTLCnt":1,"tags":["honeypot","netcup-ts","sensor:netcup-ts"],"tagsCnt":3,"tcp":{"ja4t":["8192_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":2264969605},"totDataBytes":0} +{"@timestamp":1788006152281,"_id":"260829-wbxArDzDDR5F3a_APpy4Z3kq","_index":"arkime_sessions3-260829","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["netcup GmbH"],"isp.dstCnt":1,"isp.src":["Proton66 OOO"],"isp.srcCnt":1,"org.dst":["Netcup KVM"],"org.dstCnt":1,"org.src":["Proton66 OOO"],"org.srcCnt":1,"usertype.dst":["business"],"usertype.dstCnt":1,"usertype.src":["business"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS197540 netcup GmbH","number":197540,"organization":{"name":"netcup GmbH"}},"bytes":0,"geo":{"country_iso_code":"DE"},"ip":"159.195.21.150","mac":["8a:41:d3:b8:0d:d3"],"mac-cnt":1,"packets":0,"port":22222},"dstRIR":"ARIN","ethertype":2048,"fileId":[81316],"firstPacket":1788005471291,"ipProtocol":6,"lastPacket":1788005474291,"length":3000,"network":{"bytes":132,"community_id":"1:qLKhKpVWvNheeDoNzRGucLBBaE8=","packets":2},"node":"spark-afae","packetPos":[-81316,325045,442],"packetRange":{"gte":1788005471291,"lte":1788005474291},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS198953 Proton66 OOO","number":198953,"organization":{"name":"Proton66 OOO"}},"bytes":132,"geo":{"country_iso_code":"RU"},"ip":"176.120.22.61","mac":["bc:0f:fe:3d:a3:a7"],"mac-cnt":1,"packets":2,"port":25807},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[119],"srcTTLCnt":1,"tags":["honeypot","netcup-ts","sensor:netcup-ts"],"tagsCnt":3,"tcp":{"ja4t":["8192_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":1543411983},"totDataBytes":0} +{"@timestamp":1788006152279,"_id":"260829-wbyeR6h8f3VAwJH4fJQjFL1C","_index":"arkime_sessions3-260829","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["netcup GmbH"],"isp.dstCnt":1,"isp.src":["Proton66 OOO"],"isp.srcCnt":1,"org.dst":["Netcup KVM"],"org.dstCnt":1,"org.src":["Proton66 OOO"],"org.srcCnt":1,"usertype.dst":["business"],"usertype.dstCnt":1,"usertype.src":["business"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS197540 netcup GmbH","number":197540,"organization":{"name":"netcup GmbH"}},"bytes":0,"geo":{"country_iso_code":"DE"},"ip":"159.195.21.150","mac":["8a:41:d3:b8:0d:d3"],"mac-cnt":1,"packets":0,"port":22222},"dstRIR":"ARIN","ethertype":2048,"fileId":[81316],"firstPacket":1788005464283,"ipProtocol":6,"lastPacket":1788005467280,"length":2997,"network":{"bytes":132,"community_id":"1:qsciZ8YXgCc+Ii5veF5AAr/dBWk=","packets":2},"node":"spark-afae","packetPos":[-81316,323673,334],"packetRange":{"gte":1788005464283,"lte":1788005467280},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS198953 Proton66 OOO","number":198953,"organization":{"name":"Proton66 OOO"}},"bytes":132,"geo":{"country_iso_code":"RU"},"ip":"176.120.22.61","mac":["bc:0f:fe:38:0b:a3"],"mac-cnt":1,"packets":2,"port":2931},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[121],"srcTTLCnt":1,"tags":["honeypot","netcup-ts","sensor:netcup-ts"],"tagsCnt":3,"tcp":{"ja4t":["8192_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":902270654},"totDataBytes":0} +{"@timestamp":1788006152283,"_id":"260829-wbzCBq-pIHtAfpDp3hYdWTFn","_index":"arkime_sessions3-260829","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["netcup GmbH"],"isp.dstCnt":1,"isp.src":["Proton66 OOO"],"isp.srcCnt":1,"org.dst":["Netcup KVM"],"org.dstCnt":1,"org.src":["Proton66 OOO"],"org.srcCnt":1,"usertype.dst":["business"],"usertype.dstCnt":1,"usertype.src":["business"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS197540 netcup GmbH","number":197540,"organization":{"name":"netcup GmbH"}},"bytes":0,"geo":{"country_iso_code":"DE"},"ip":"159.195.21.150","mac":["8a:41:d3:b8:0d:d3"],"mac-cnt":1,"packets":0,"port":22222},"dstRIR":"ARIN","ethertype":2048,"fileId":[81316],"firstPacket":1788005457282,"ipProtocol":6,"lastPacket":1788005460288,"length":3006,"network":{"bytes":132,"community_id":"1:X81R841BVxDo3dacXeCks3B61rc=","packets":2},"node":"spark-afae","packetPos":[-81316,322389,532],"packetRange":{"gte":1788005457282,"lte":1788005460288},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS198953 Proton66 OOO","number":198953,"organization":{"name":"Proton66 OOO"}},"bytes":132,"geo":{"country_iso_code":"RU"},"ip":"176.120.22.61","mac":["bc:0f:fe:38:0b:a3"],"mac-cnt":1,"packets":2,"port":54748},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[121],"srcTTLCnt":1,"tags":["honeypot","netcup-ts","sensor:netcup-ts"],"tagsCnt":3,"tcp":{"ja4t":["8192_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":980989782},"totDataBytes":0} +{"@timestamp":1788006152284,"_id":"260829-wbwzT_tkAQBLWZbjPWY7Nfg8","_index":"arkime_sessions3-260829","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["netcup GmbH"],"isp.dstCnt":1,"isp.src":["Proton66 OOO"],"isp.srcCnt":1,"org.dst":["Netcup KVM"],"org.dstCnt":1,"org.src":["Proton66 OOO"],"org.srcCnt":1,"usertype.dst":["business"],"usertype.dstCnt":1,"usertype.src":["business"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS197540 netcup GmbH","number":197540,"organization":{"name":"netcup GmbH"}},"bytes":0,"geo":{"country_iso_code":"DE"},"ip":"159.195.21.150","mac":["8a:41:d3:b8:0d:d3"],"mac-cnt":1,"packets":0,"port":22222},"dstRIR":"ARIN","ethertype":2048,"fileId":[81316],"firstPacket":1788005450287,"ipProtocol":6,"lastPacket":1788005453292,"length":3005,"network":{"bytes":132,"community_id":"1:aaOdqjqLaZETuZ/O382V4yTjA2U=","packets":2},"node":"spark-afae","packetPos":[-81316,320956,1017],"packetRange":{"gte":1788005450287,"lte":1788005453292},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS198953 Proton66 OOO","number":198953,"organization":{"name":"Proton66 OOO"}},"bytes":132,"geo":{"country_iso_code":"RU"},"ip":"176.120.22.61","mac":["bc:0f:fe:3d:a3:a7"],"mac-cnt":1,"packets":2,"port":44875},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[119],"srcTTLCnt":1,"tags":["honeypot","netcup-ts","sensor:netcup-ts"],"tagsCnt":3,"tcp":{"ja4t":["8192_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":208868613},"totDataBytes":0} +{"@timestamp":1788006152280,"_id":"260829-wbxEJprjw71HgbR4EOftZwEe","_index":"arkime_sessions3-260829","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["netcup GmbH"],"isp.dstCnt":1,"isp.src":["Proton66 OOO"],"isp.srcCnt":1,"org.dst":["Netcup KVM"],"org.dstCnt":1,"org.src":["Proton66 OOO"],"org.srcCnt":1,"usertype.dst":["business"],"usertype.dstCnt":1,"usertype.src":["business"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS197540 netcup GmbH","number":197540,"organization":{"name":"netcup GmbH"}},"bytes":0,"geo":{"country_iso_code":"DE"},"ip":"159.195.21.150","mac":["8a:41:d3:b8:0d:d3"],"mac-cnt":1,"packets":0,"port":2222},"dstRIR":"ARIN","ethertype":2048,"fileId":[81316],"firstPacket":1788005448720,"ipProtocol":6,"lastPacket":1788005451720,"length":3000,"network":{"bytes":132,"community_id":"1:BiSgMwpl93RJjkE+EfUrNJNMRkk=","packets":2},"node":"spark-afae","packetPos":[-81316,320514,982],"packetRange":{"gte":1788005448720,"lte":1788005451720},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS198953 Proton66 OOO","number":198953,"organization":{"name":"Proton66 OOO"}},"bytes":132,"geo":{"country_iso_code":"RU"},"ip":"176.120.22.61","mac":["bc:0f:fe:3d:a3:a7"],"mac-cnt":1,"packets":2,"port":31207},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[119],"srcTTLCnt":1,"tags":["honeypot","netcup-ts","sensor:netcup-ts"],"tagsCnt":3,"tcp":{"ja4t":["8192_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":414791664},"totDataBytes":0} +{"@timestamp":1788006152281,"_id":"260829-wbzWeg0OC5FMu78_USf7o1ly","_index":"arkime_sessions3-260829","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["netcup GmbH"],"isp.dstCnt":1,"isp.src":["Proton66 OOO"],"isp.srcCnt":1,"org.dst":["Netcup KVM"],"org.dstCnt":1,"org.src":["Proton66 OOO"],"org.srcCnt":1,"usertype.dst":["business"],"usertype.dstCnt":1,"usertype.src":["business"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS197540 netcup GmbH","number":197540,"organization":{"name":"netcup GmbH"}},"bytes":0,"geo":{"country_iso_code":"DE"},"ip":"159.195.21.150","mac":["8a:41:d3:b8:0d:d3"],"mac-cnt":1,"packets":0,"port":22222},"dstRIR":"ARIN","ethertype":2048,"fileId":[81316],"firstPacket":1788005443282,"ipProtocol":6,"lastPacket":1788005446282,"length":3000,"network":{"bytes":132,"community_id":"1:QhTVytbHkUimH3NheqP6YYtapSo=","packets":2},"node":"spark-afae","packetPos":[-81316,311761,600],"packetRange":{"gte":1788005443282,"lte":1788005446282},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS198953 Proton66 OOO","number":198953,"organization":{"name":"Proton66 OOO"}},"bytes":132,"geo":{"country_iso_code":"RU"},"ip":"176.120.22.61","mac":["bc:0f:fe:38:0b:a3"],"mac-cnt":1,"packets":2,"port":54692},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[121],"srcTTLCnt":1,"tags":["honeypot","netcup-ts","sensor:netcup-ts"],"tagsCnt":3,"tcp":{"ja4t":["8192_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":2574055230},"totDataBytes":0} +{"@timestamp":1788006152280,"_id":"260829-wbwjMoBMwBtB8b3E-JBF92vv","_index":"arkime_sessions3-260829","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["netcup GmbH"],"isp.dstCnt":1,"isp.src":["Proton66 OOO"],"isp.srcCnt":1,"org.dst":["Netcup KVM"],"org.dstCnt":1,"org.src":["Proton66 OOO"],"org.srcCnt":1,"usertype.dst":["business"],"usertype.dstCnt":1,"usertype.src":["business"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS197540 netcup GmbH","number":197540,"organization":{"name":"netcup GmbH"}},"bytes":0,"geo":{"country_iso_code":"DE"},"ip":"159.195.21.150","mac":["8a:41:d3:b8:0d:d3"],"mac-cnt":1,"packets":0,"port":2222},"dstRIR":"ARIN","ethertype":2048,"fileId":[81316],"firstPacket":1788005441718,"ipProtocol":6,"lastPacket":1788005444718,"length":3000,"network":{"bytes":132,"community_id":"1:aUditjwwmUIWqF8Tf3oaHIhaT0g=","packets":2},"node":"spark-afae","packetPos":[-81316,311679,326],"packetRange":{"gte":1788005441718,"lte":1788005444718},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS198953 Proton66 OOO","number":198953,"organization":{"name":"Proton66 OOO"}},"bytes":132,"geo":{"country_iso_code":"RU"},"ip":"176.120.22.61","mac":["bc:0f:fe:3d:a3:a7"],"mac-cnt":1,"packets":2,"port":28205},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[119],"srcTTLCnt":1,"tags":["honeypot","netcup-ts","sensor:netcup-ts"],"tagsCnt":3,"tcp":{"ja4t":["8192_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":2101126976},"totDataBytes":0} +{"@timestamp":1788006152280,"_id":"260829-wbwrEL3KE2FPOLUND_oyOJqV","_index":"arkime_sessions3-260829","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["netcup GmbH"],"isp.dstCnt":1,"isp.src":["Proton66 OOO"],"isp.srcCnt":1,"org.dst":["Netcup KVM"],"org.dstCnt":1,"org.src":["Proton66 OOO"],"org.srcCnt":1,"usertype.dst":["business"],"usertype.dstCnt":1,"usertype.src":["business"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS197540 netcup GmbH","number":197540,"organization":{"name":"netcup GmbH"}},"bytes":0,"geo":{"country_iso_code":"DE"},"ip":"159.195.21.150","mac":["8a:41:d3:b8:0d:d3"],"mac-cnt":1,"packets":0,"port":22222},"dstRIR":"ARIN","ethertype":2048,"fileId":[81316],"firstPacket":1788005436291,"ipProtocol":6,"lastPacket":1788005439288,"length":2997,"network":{"bytes":132,"community_id":"1:6Pi+9wmX7sNvVYjcVaDB5YB9E5o=","packets":2},"node":"spark-afae","packetPos":[-81316,305089,896],"packetRange":{"gte":1788005436291,"lte":1788005439288},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS198953 Proton66 OOO","number":198953,"organization":{"name":"Proton66 OOO"}},"bytes":132,"geo":{"country_iso_code":"RU"},"ip":"176.120.22.61","mac":["bc:0f:fe:3d:a3:a7"],"mac-cnt":1,"packets":2,"port":29091},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[119],"srcTTLCnt":1,"tags":["honeypot","netcup-ts","sensor:netcup-ts"],"tagsCnt":3,"tcp":{"ja4t":["8192_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":3202895285},"totDataBytes":0} +{"@timestamp":1788006152280,"_id":"260829-wbzMY6A--9tMMrsRG3K9K9rc","_index":"arkime_sessions3-260829","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["netcup GmbH"],"isp.dstCnt":1,"isp.src":["Proton66 OOO"],"isp.srcCnt":1,"org.dst":["Netcup KVM"],"org.dstCnt":1,"org.src":["Proton66 OOO"],"org.srcCnt":1,"usertype.dst":["business"],"usertype.dstCnt":1,"usertype.src":["business"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS197540 netcup GmbH","number":197540,"organization":{"name":"netcup GmbH"}},"bytes":0,"geo":{"country_iso_code":"DE"},"ip":"159.195.21.150","mac":["8a:41:d3:b8:0d:d3"],"mac-cnt":1,"packets":0,"port":2222},"dstRIR":"ARIN","ethertype":2048,"fileId":[81316],"firstPacket":1788005434713,"ipProtocol":6,"lastPacket":1788005437717,"length":3004,"network":{"bytes":132,"community_id":"1:86meJU8fo2BpfvPHJyKNO55m3Io=","packets":2},"node":"spark-afae","packetPos":[-81316,300048,5557],"packetRange":{"gte":1788005434713,"lte":1788005437717},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS198953 Proton66 OOO","number":198953,"organization":{"name":"Proton66 OOO"}},"bytes":132,"geo":{"country_iso_code":"RU"},"ip":"176.120.22.61","mac":["bc:0f:fe:38:0b:a3"],"mac-cnt":1,"packets":2,"port":9647},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[121],"srcTTLCnt":1,"tags":["honeypot","netcup-ts","sensor:netcup-ts"],"tagsCnt":3,"tcp":{"ja4t":["8192_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":3260619754},"totDataBytes":0} +{"@timestamp":1788006152283,"_id":"260829-wbxJPPYP2OdIMqCfuDnpygE0","_index":"arkime_sessions3-260829","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["netcup GmbH"],"isp.dstCnt":1,"isp.src":["Proton66 OOO"],"isp.srcCnt":1,"org.dst":["Netcup KVM"],"org.dstCnt":1,"org.src":["Proton66 OOO"],"org.srcCnt":1,"usertype.dst":["business"],"usertype.dstCnt":1,"usertype.src":["business"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS197540 netcup GmbH","number":197540,"organization":{"name":"netcup GmbH"}},"bytes":0,"geo":{"country_iso_code":"DE"},"ip":"159.195.21.150","mac":["8a:41:d3:b8:0d:d3"],"mac-cnt":1,"packets":0,"port":22222},"dstRIR":"ARIN","ethertype":2048,"fileId":[81316],"firstPacket":1788005429291,"ipProtocol":6,"lastPacket":1788005432297,"length":3006,"network":{"bytes":132,"community_id":"1:gQreJljiy4fGn4cYrMMP68GWKok=","packets":2},"node":"spark-afae","packetPos":[-81316,298362,990],"packetRange":{"gte":1788005429291,"lte":1788005432297},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS198953 Proton66 OOO","number":198953,"organization":{"name":"Proton66 OOO"}},"bytes":132,"geo":{"country_iso_code":"RU"},"ip":"176.120.22.61","mac":["bc:0f:fe:3d:a3:a7"],"mac-cnt":1,"packets":2,"port":45244},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[119],"srcTTLCnt":1,"tags":["honeypot","netcup-ts","sensor:netcup-ts"],"tagsCnt":3,"tcp":{"ja4t":["8192_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":2130577374},"totDataBytes":0} +{"@timestamp":1788006152280,"_id":"260829-wbzZGeLVxMJFTr0ee1b-JJq9","_index":"arkime_sessions3-260829","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["netcup GmbH"],"isp.dstCnt":1,"isp.src":["Proton66 OOO"],"isp.srcCnt":1,"org.dst":["Netcup KVM"],"org.dstCnt":1,"org.src":["Proton66 OOO"],"org.srcCnt":1,"usertype.dst":["business"],"usertype.dstCnt":1,"usertype.src":["business"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS197540 netcup GmbH","number":197540,"organization":{"name":"netcup GmbH"}},"bytes":0,"geo":{"country_iso_code":"DE"},"ip":"159.195.21.150","mac":["8a:41:d3:b8:0d:d3"],"mac-cnt":1,"packets":0,"port":2222},"dstRIR":"ARIN","ethertype":2048,"fileId":[81316],"firstPacket":1788005427708,"ipProtocol":6,"lastPacket":1788005430708,"length":3000,"network":{"bytes":132,"community_id":"1:oHolpRs3wYvXKKrbYAOWfk4kXEE=","packets":2},"node":"spark-afae","packetPos":[-81316,297679,1125],"packetRange":{"gte":1788005427708,"lte":1788005430708},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS198953 Proton66 OOO","number":198953,"organization":{"name":"Proton66 OOO"}},"bytes":132,"geo":{"country_iso_code":"RU"},"ip":"176.120.22.61","mac":["bc:0f:fe:38:0b:a3"],"mac-cnt":1,"packets":2,"port":27052},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[121],"srcTTLCnt":1,"tags":["honeypot","netcup-ts","sensor:netcup-ts"],"tagsCnt":3,"tcp":{"ja4t":["8192_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":1370512258},"totDataBytes":0} +{"@timestamp":1788006152283,"_id":"260829-wbyhBOmiGIZAL4MWruRQrqPL","_index":"arkime_sessions3-260829","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["netcup GmbH"],"isp.dstCnt":1,"isp.src":["Proton66 OOO"],"isp.srcCnt":1,"org.dst":["Netcup KVM"],"org.dstCnt":1,"org.src":["Proton66 OOO"],"org.srcCnt":1,"usertype.dst":["business"],"usertype.dstCnt":1,"usertype.src":["business"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS197540 netcup GmbH","number":197540,"organization":{"name":"netcup GmbH"}},"bytes":0,"geo":{"country_iso_code":"DE"},"ip":"159.195.21.150","mac":["8a:41:d3:b8:0d:d3"],"mac-cnt":1,"packets":0,"port":22222},"dstRIR":"ARIN","ethertype":2048,"fileId":[81316],"firstPacket":1788005422281,"ipProtocol":6,"lastPacket":1788005425288,"length":3007,"network":{"bytes":132,"community_id":"1:j/Yyh8wol16INHj8VBrbbmLKrYk=","packets":2},"node":"spark-afae","packetPos":[-81316,296367,690],"packetRange":{"gte":1788005422281,"lte":1788005425288},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS198953 Proton66 OOO","number":198953,"organization":{"name":"Proton66 OOO"}},"bytes":132,"geo":{"country_iso_code":"RU"},"ip":"176.120.22.61","mac":["bc:0f:fe:38:0b:a3"],"mac-cnt":1,"packets":2,"port":52933},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[121],"srcTTLCnt":1,"tags":["honeypot","netcup-ts","sensor:netcup-ts"],"tagsCnt":3,"tcp":{"ja4t":["8192_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":238384640},"totDataBytes":0} +{"@timestamp":1788006152279,"_id":"260829-wbziY4pTF-JMA4LfPwzOiY3v","_index":"arkime_sessions3-260829","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["netcup GmbH"],"isp.dstCnt":1,"isp.src":["Proton66 OOO"],"isp.srcCnt":1,"org.dst":["Netcup KVM"],"org.dstCnt":1,"org.src":["Proton66 OOO"],"org.srcCnt":1,"usertype.dst":["business"],"usertype.dstCnt":1,"usertype.src":["business"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS197540 netcup GmbH","number":197540,"organization":{"name":"netcup GmbH"}},"bytes":0,"geo":{"country_iso_code":"DE"},"ip":"159.195.21.150","mac":["8a:41:d3:b8:0d:d3"],"mac-cnt":1,"packets":0,"port":2222},"dstRIR":"ARIN","ethertype":2048,"fileId":[81316],"firstPacket":1788005420708,"ipProtocol":6,"lastPacket":1788005423708,"length":3000,"network":{"bytes":132,"community_id":"1:rUVSfXWU4un9lLvPXUDMJM9VZzQ=","packets":2},"node":"spark-afae","packetPos":[-81316,295885,834],"packetRange":{"gte":1788005420708,"lte":1788005423708},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS198953 Proton66 OOO","number":198953,"organization":{"name":"Proton66 OOO"}},"bytes":132,"geo":{"country_iso_code":"RU"},"ip":"176.120.22.61","mac":["bc:0f:fe:38:0b:a3"],"mac-cnt":1,"packets":2,"port":30991},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[121],"srcTTLCnt":1,"tags":["honeypot","netcup-ts","sensor:netcup-ts"],"tagsCnt":3,"tcp":{"ja4t":["8192_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":1085192892},"totDataBytes":0} +{"@timestamp":1788006152279,"_id":"260829-wbyOPs1JeqZJGY4O9AFI3gHl","_index":"arkime_sessions3-260829","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["netcup GmbH"],"isp.dstCnt":1,"isp.src":["Proton66 OOO"],"isp.srcCnt":1,"org.dst":["Netcup KVM"],"org.dstCnt":1,"org.src":["Proton66 OOO"],"org.srcCnt":1,"usertype.dst":["business"],"usertype.dstCnt":1,"usertype.src":["business"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS197540 netcup GmbH","number":197540,"organization":{"name":"netcup GmbH"}},"bytes":0,"geo":{"country_iso_code":"DE"},"ip":"159.195.21.150","mac":["8a:41:d3:b8:0d:d3"],"mac-cnt":1,"packets":0,"port":22222},"dstRIR":"ARIN","ethertype":2048,"fileId":[81316],"firstPacket":1788005415285,"ipProtocol":6,"lastPacket":1788005418285,"length":3000,"network":{"bytes":132,"community_id":"1:kwMjbHrvedXq4qhmRMN82P48KBs=","packets":2},"node":"spark-afae","packetPos":[-81316,295239,368],"packetRange":{"gte":1788005415285,"lte":1788005418285},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS198953 Proton66 OOO","number":198953,"organization":{"name":"Proton66 OOO"}},"bytes":132,"geo":{"country_iso_code":"RU"},"ip":"176.120.22.61","mac":["bc:0f:fe:3d:a3:a7"],"mac-cnt":1,"packets":2,"port":35805},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[119],"srcTTLCnt":1,"tags":["honeypot","netcup-ts","sensor:netcup-ts"],"tagsCnt":3,"tcp":{"ja4t":["8192_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":686292296},"totDataBytes":0} +{"@timestamp":1788006152279,"_id":"260829-wbyhwWtxF8JBO5WiYsfvLdCx","_index":"arkime_sessions3-260829","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["netcup GmbH"],"isp.dstCnt":1,"isp.src":["Proton66 OOO"],"isp.srcCnt":1,"org.dst":["Netcup KVM"],"org.dstCnt":1,"org.src":["Proton66 OOO"],"org.srcCnt":1,"usertype.dst":["business"],"usertype.dstCnt":1,"usertype.src":["business"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS197540 netcup GmbH","number":197540,"organization":{"name":"netcup GmbH"}},"bytes":0,"geo":{"country_iso_code":"DE"},"ip":"159.195.21.150","mac":["8a:41:d3:b8:0d:d3"],"mac-cnt":1,"packets":0,"port":2222},"dstRIR":"ARIN","ethertype":2048,"fileId":[81316],"firstPacket":1788005413719,"ipProtocol":6,"lastPacket":1788005416715,"length":2996,"network":{"bytes":132,"community_id":"1:AWH501FGQyrhVLT1PkzHEfC7T78=","packets":2},"node":"spark-afae","packetPos":[-81316,294961,564],"packetRange":{"gte":1788005413719,"lte":1788005416715},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS198953 Proton66 OOO","number":198953,"organization":{"name":"Proton66 OOO"}},"bytes":132,"geo":{"country_iso_code":"RU"},"ip":"176.120.22.61","mac":["bc:0f:fe:3d:a3:a7"],"mac-cnt":1,"packets":2,"port":21603},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[119],"srcTTLCnt":1,"tags":["honeypot","netcup-ts","sensor:netcup-ts"],"tagsCnt":3,"tcp":{"ja4t":["8192_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":1257081650},"totDataBytes":0} +{"@timestamp":1788006152280,"_id":"260829-wbyQe2W-ZgVKd6baqXt61_fR","_index":"arkime_sessions3-260829","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["netcup GmbH"],"isp.dstCnt":1,"isp.src":["Proton66 OOO"],"isp.srcCnt":1,"org.dst":["Netcup KVM"],"org.dstCnt":1,"org.src":["Proton66 OOO"],"org.srcCnt":1,"usertype.dst":["business"],"usertype.dstCnt":1,"usertype.src":["business"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS197540 netcup GmbH","number":197540,"organization":{"name":"netcup GmbH"}},"bytes":0,"geo":{"country_iso_code":"DE"},"ip":"159.195.21.150","mac":["8a:41:d3:b8:0d:d3"],"mac-cnt":1,"packets":0,"port":22222},"dstRIR":"ARIN","ethertype":2048,"fileId":[81316],"firstPacket":1788005408286,"ipProtocol":6,"lastPacket":1788005411289,"length":3003,"network":{"bytes":132,"community_id":"1:Emo+eq2bsPuEe+jpHMvcXKRmB/0=","packets":2},"node":"spark-afae","packetPos":[-81316,294643,164],"packetRange":{"gte":1788005408286,"lte":1788005411289},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS198953 Proton66 OOO","number":198953,"organization":{"name":"Proton66 OOO"}},"bytes":132,"geo":{"country_iso_code":"RU"},"ip":"176.120.22.61","mac":["bc:0f:fe:3d:a3:a7"],"mac-cnt":1,"packets":2,"port":5230},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[119],"srcTTLCnt":1,"tags":["honeypot","netcup-ts","sensor:netcup-ts"],"tagsCnt":3,"tcp":{"ja4t":["8192_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":2774556211},"totDataBytes":0} +{"@timestamp":1788006152279,"_id":"260829-wbw7gVzKhHpPSL0YsKgAzzp2","_index":"arkime_sessions3-260829","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["netcup GmbH"],"isp.dstCnt":1,"isp.src":["Proton66 OOO"],"isp.srcCnt":1,"org.dst":["Netcup KVM"],"org.dstCnt":1,"org.src":["Proton66 OOO"],"org.srcCnt":1,"usertype.dst":["business"],"usertype.dstCnt":1,"usertype.src":["business"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS197540 netcup GmbH","number":197540,"organization":{"name":"netcup GmbH"}},"bytes":0,"geo":{"country_iso_code":"DE"},"ip":"159.195.21.150","mac":["8a:41:d3:b8:0d:d3"],"mac-cnt":1,"packets":0,"port":2222},"dstRIR":"ARIN","ethertype":2048,"fileId":[81316],"firstPacket":1788005406707,"ipProtocol":6,"lastPacket":1788005409712,"length":3005,"network":{"bytes":132,"community_id":"1:ve75C77cbsZ2fBVHTvoJa0ZMWbM=","packets":2},"node":"spark-afae","packetPos":[-81316,294357,368],"packetRange":{"gte":1788005406707,"lte":1788005409712},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS198953 Proton66 OOO","number":198953,"organization":{"name":"Proton66 OOO"}},"bytes":132,"geo":{"country_iso_code":"RU"},"ip":"176.120.22.61","mac":["bc:0f:fe:38:0b:a3"],"mac-cnt":1,"packets":2,"port":39808},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[121],"srcTTLCnt":1,"tags":["honeypot","netcup-ts","sensor:netcup-ts"],"tagsCnt":3,"tcp":{"ja4t":["8192_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":2282683438},"totDataBytes":0} +{"@timestamp":1788006152284,"_id":"260829-wbxDxunRAAFF0YXiAbBL7oAY","_index":"arkime_sessions3-260829","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["netcup GmbH"],"isp.dstCnt":1,"isp.src":["Proton66 OOO"],"isp.srcCnt":1,"org.dst":["Netcup KVM"],"org.dstCnt":1,"org.src":["Proton66 OOO"],"org.srcCnt":1,"usertype.dst":["business"],"usertype.dstCnt":1,"usertype.src":["business"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS197540 netcup GmbH","number":197540,"organization":{"name":"netcup GmbH"}},"bytes":0,"geo":{"country_iso_code":"DE"},"ip":"159.195.21.150","mac":["8a:41:d3:b8:0d:d3"],"mac-cnt":1,"packets":0,"port":22222},"dstRIR":"ARIN","ethertype":2048,"fileId":[81316],"firstPacket":1788005401285,"ipProtocol":6,"lastPacket":1788005404285,"length":3000,"network":{"bytes":132,"community_id":"1:dFUk9wgRD9GeMYnBIrzUfxpIL7E=","packets":2},"node":"spark-afae","packetPos":[-81316,293327,516],"packetRange":{"gte":1788005401285,"lte":1788005404285},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS198953 Proton66 OOO","number":198953,"organization":{"name":"Proton66 OOO"}},"bytes":132,"geo":{"country_iso_code":"RU"},"ip":"176.120.22.61","mac":["bc:0f:fe:3d:a3:a7"],"mac-cnt":1,"packets":2,"port":37929},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[119],"srcTTLCnt":1,"tags":["honeypot","netcup-ts","sensor:netcup-ts"],"tagsCnt":3,"tcp":{"ja4t":["8192_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":1542265539},"totDataBytes":0} +{"@timestamp":1788006152280,"_id":"260829-wbzBgoLFaDJJK5_rRJe12pDK","_index":"arkime_sessions3-260829","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["netcup GmbH"],"isp.dstCnt":1,"isp.src":["Proton66 OOO"],"isp.srcCnt":1,"org.dst":["Netcup KVM"],"org.dstCnt":1,"org.src":["Proton66 OOO"],"org.srcCnt":1,"usertype.dst":["business"],"usertype.dstCnt":1,"usertype.src":["business"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS197540 netcup GmbH","number":197540,"organization":{"name":"netcup GmbH"}},"bytes":0,"geo":{"country_iso_code":"DE"},"ip":"159.195.21.150","mac":["8a:41:d3:b8:0d:d3"],"mac-cnt":1,"packets":0,"port":2222},"dstRIR":"ARIN","ethertype":2048,"fileId":[81316],"firstPacket":1788005399708,"ipProtocol":6,"lastPacket":1788005402706,"length":2998,"network":{"bytes":132,"community_id":"1:d2C5lW01dTiR0d4SrXkHeIQSmrI=","packets":2},"node":"spark-afae","packetPos":[-81316,292903,596],"packetRange":{"gte":1788005399708,"lte":1788005402706},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS198953 Proton66 OOO","number":198953,"organization":{"name":"Proton66 OOO"}},"bytes":132,"geo":{"country_iso_code":"RU"},"ip":"176.120.22.61","mac":["bc:0f:fe:38:0b:a3"],"mac-cnt":1,"packets":2,"port":20171},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[121],"srcTTLCnt":1,"tags":["honeypot","netcup-ts","sensor:netcup-ts"],"tagsCnt":3,"tcp":{"ja4t":["8192_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":2046569135},"totDataBytes":0} +{"@timestamp":1788006152283,"_id":"260829-wbyfensCmPdKVpssyZxlQB62","_index":"arkime_sessions3-260829","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["netcup GmbH"],"isp.dstCnt":1,"isp.src":["Proton66 OOO"],"isp.srcCnt":1,"org.dst":["Netcup KVM"],"org.dstCnt":1,"org.src":["Proton66 OOO"],"org.srcCnt":1,"usertype.dst":["business"],"usertype.dstCnt":1,"usertype.src":["business"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS197540 netcup GmbH","number":197540,"organization":{"name":"netcup GmbH"}},"bytes":0,"geo":{"country_iso_code":"DE"},"ip":"159.195.21.150","mac":["8a:41:d3:b8:0d:d3"],"mac-cnt":1,"packets":0,"port":22222},"dstRIR":"ARIN","ethertype":2048,"fileId":[81316],"firstPacket":1788005394288,"ipProtocol":6,"lastPacket":1788005397287,"length":2999,"network":{"bytes":132,"community_id":"1:1kP6AigdxSr2cMYkOYezcbOuhw0=","packets":2},"node":"spark-afae","packetPos":[-81316,292314,164],"packetRange":{"gte":1788005394288,"lte":1788005397287},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS198953 Proton66 OOO","number":198953,"organization":{"name":"Proton66 OOO"}},"bytes":132,"geo":{"country_iso_code":"RU"},"ip":"176.120.22.61","mac":["bc:0f:fe:3d:a3:a7"],"mac-cnt":1,"packets":2,"port":49200},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[119],"srcTTLCnt":1,"tags":["honeypot","netcup-ts","sensor:netcup-ts"],"tagsCnt":3,"tcp":{"ja4t":["8192_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":784407058},"totDataBytes":0} +{"@timestamp":1788006152280,"_id":"260829-wbxAZJIZhCRBIr47bPw01l5s","_index":"arkime_sessions3-260829","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["netcup GmbH"],"isp.dstCnt":1,"isp.src":["Proton66 OOO"],"isp.srcCnt":1,"org.dst":["Netcup KVM"],"org.dstCnt":1,"org.src":["Proton66 OOO"],"org.srcCnt":1,"usertype.dst":["business"],"usertype.dstCnt":1,"usertype.src":["business"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS197540 netcup GmbH","number":197540,"organization":{"name":"netcup GmbH"}},"bytes":0,"geo":{"country_iso_code":"DE"},"ip":"159.195.21.150","mac":["8a:41:d3:b8:0d:d3"],"mac-cnt":1,"packets":0,"port":2222},"dstRIR":"ARIN","ethertype":2048,"fileId":[81316],"firstPacket":1788005392725,"ipProtocol":6,"lastPacket":1788005395726,"length":3001,"network":{"bytes":132,"community_id":"1:DipOp0S7VuZ+GuueGhsdGfCIjcw=","packets":2},"node":"spark-afae","packetPos":[-81316,291898,498],"packetRange":{"gte":1788005392725,"lte":1788005395726},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS198953 Proton66 OOO","number":198953,"organization":{"name":"Proton66 OOO"}},"bytes":132,"geo":{"country_iso_code":"RU"},"ip":"176.120.22.61","mac":["bc:0f:fe:3d:a3:a7"],"mac-cnt":1,"packets":2,"port":29396},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[118],"srcTTLCnt":1,"tags":["honeypot","netcup-ts","sensor:netcup-ts"],"tagsCnt":3,"tcp":{"ja4t":["8192_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":2713014452},"totDataBytes":0} +{"@timestamp":1788006152281,"_id":"260829-wbzn3oXGICtNpr-QJeSB31oZ","_index":"arkime_sessions3-260829","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["netcup GmbH"],"isp.dstCnt":1,"isp.src":["Proton66 OOO"],"isp.srcCnt":1,"org.dst":["Netcup KVM"],"org.dstCnt":1,"org.src":["Proton66 OOO"],"org.srcCnt":1,"usertype.dst":["business"],"usertype.dstCnt":1,"usertype.src":["business"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS197540 netcup GmbH","number":197540,"organization":{"name":"netcup GmbH"}},"bytes":0,"geo":{"country_iso_code":"DE"},"ip":"159.195.21.150","mac":["8a:41:d3:b8:0d:d3"],"mac-cnt":1,"packets":0,"port":22222},"dstRIR":"ARIN","ethertype":2048,"fileId":[81316],"firstPacket":1788005387279,"ipProtocol":6,"lastPacket":1788005390282,"length":3003,"network":{"bytes":132,"community_id":"1:AOQs4fhHJi2A688rQH1tKPgyYHY=","packets":2},"node":"spark-afae","packetPos":[-81316,290095,852],"packetRange":{"gte":1788005387279,"lte":1788005390282},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS198953 Proton66 OOO","number":198953,"organization":{"name":"Proton66 OOO"}},"bytes":132,"geo":{"country_iso_code":"RU"},"ip":"176.120.22.61","mac":["bc:0f:fe:38:0b:a3"],"mac-cnt":1,"packets":2,"port":46878},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[121],"srcTTLCnt":1,"tags":["honeypot","netcup-ts","sensor:netcup-ts"],"tagsCnt":3,"tcp":{"ja4t":["8192_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":3464068200},"totDataBytes":0} +{"@timestamp":1788006152281,"_id":"260829-wbzr994XHiBBn5hsynUu1KIS","_index":"arkime_sessions3-260829","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["netcup GmbH"],"isp.dstCnt":1,"isp.src":["Proton66 OOO"],"isp.srcCnt":1,"org.dst":["Netcup KVM"],"org.dstCnt":1,"org.src":["Proton66 OOO"],"org.srcCnt":1,"usertype.dst":["business"],"usertype.dstCnt":1,"usertype.src":["business"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS197540 netcup GmbH","number":197540,"organization":{"name":"netcup GmbH"}},"bytes":0,"geo":{"country_iso_code":"DE"},"ip":"159.195.21.150","mac":["8a:41:d3:b8:0d:d3"],"mac-cnt":1,"packets":0,"port":2222},"dstRIR":"ARIN","ethertype":2048,"fileId":[81316],"firstPacket":1788005385725,"ipProtocol":6,"lastPacket":1788005388732,"length":3007,"network":{"bytes":132,"community_id":"1:7+5Se+d70XiGws7F61lKo4gErew=","packets":2},"node":"spark-afae","packetPos":[-81316,282834,7589],"packetRange":{"gte":1788005385725,"lte":1788005388732},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS198953 Proton66 OOO","number":198953,"organization":{"name":"Proton66 OOO"}},"bytes":132,"geo":{"country_iso_code":"RU"},"ip":"176.120.22.61","mac":["bc:0f:fe:3d:a3:a7"],"mac-cnt":1,"packets":2,"port":40710},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[118],"srcTTLCnt":1,"tags":["honeypot","netcup-ts","sensor:netcup-ts"],"tagsCnt":3,"tcp":{"ja4t":["8192_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":2138971756},"totDataBytes":0} +{"@timestamp":1788006152283,"_id":"260829-wbyfU1uAKa5ANaFCNyARxlM-","_index":"arkime_sessions3-260829","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["netcup GmbH"],"isp.dstCnt":1,"isp.src":["Proton66 OOO"],"isp.srcCnt":1,"org.dst":["Netcup KVM"],"org.dstCnt":1,"org.src":["Proton66 OOO"],"org.srcCnt":1,"usertype.dst":["business"],"usertype.dstCnt":1,"usertype.src":["business"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS197540 netcup GmbH","number":197540,"organization":{"name":"netcup GmbH"}},"bytes":0,"geo":{"country_iso_code":"DE"},"ip":"159.195.21.150","mac":["8a:41:d3:b8:0d:d3"],"mac-cnt":1,"packets":0,"port":22222},"dstRIR":"ARIN","ethertype":2048,"fileId":[81316],"firstPacket":1788005380285,"ipProtocol":6,"lastPacket":1788005383288,"length":3003,"network":{"bytes":132,"community_id":"1:1yi9CXWDlLhUQjP/1zIxeL3lbMQ=","packets":2},"node":"spark-afae","packetPos":[-81316,281263,696],"packetRange":{"gte":1788005380285,"lte":1788005383288},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS198953 Proton66 OOO","number":198953,"organization":{"name":"Proton66 OOO"}},"bytes":132,"geo":{"country_iso_code":"RU"},"ip":"176.120.22.61","mac":["bc:0f:fe:3d:a3:a7"],"mac-cnt":1,"packets":2,"port":27051},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[119],"srcTTLCnt":1,"tags":["honeypot","netcup-ts","sensor:netcup-ts"],"tagsCnt":3,"tcp":{"ja4t":["8192_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":786083214},"totDataBytes":0} +{"@timestamp":1788006152281,"_id":"260829-wbyN-_iDa_pNDoAVQ36yHAR7","_index":"arkime_sessions3-260829","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["netcup GmbH"],"isp.dstCnt":1,"isp.src":["Proton66 OOO"],"isp.srcCnt":1,"org.dst":["Netcup KVM"],"org.dstCnt":1,"org.src":["Proton66 OOO"],"org.srcCnt":1,"usertype.dst":["business"],"usertype.dstCnt":1,"usertype.src":["business"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS197540 netcup GmbH","number":197540,"organization":{"name":"netcup GmbH"}},"bytes":0,"geo":{"country_iso_code":"DE"},"ip":"159.195.21.150","mac":["8a:41:d3:b8:0d:d3"],"mac-cnt":1,"packets":0,"port":2222},"dstRIR":"ARIN","ethertype":2048,"fileId":[81316],"firstPacket":1788005378705,"ipProtocol":6,"lastPacket":1788005381706,"length":3001,"network":{"bytes":132,"community_id":"1:YsXNNXEHpdqy070HmNLU2b7qWFA=","packets":2},"node":"spark-afae","packetPos":[-81316,280719,806],"packetRange":{"gte":1788005378705,"lte":1788005381706},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS198953 Proton66 OOO","number":198953,"organization":{"name":"Proton66 OOO"}},"bytes":132,"geo":{"country_iso_code":"RU"},"ip":"176.120.22.61","mac":["bc:0f:fe:38:0b:a3"],"mac-cnt":1,"packets":2,"port":19838},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[121],"srcTTLCnt":1,"tags":["honeypot","netcup-ts","sensor:netcup-ts"],"tagsCnt":3,"tcp":{"ja4t":["8192_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":913908123},"totDataBytes":0} +{"@timestamp":1788006152279,"_id":"260829-wbzYRBg7khZP-7SyWsAeksDB","_index":"arkime_sessions3-260829","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["netcup GmbH"],"isp.dstCnt":1,"isp.src":["Proton66 OOO"],"isp.srcCnt":1,"org.dst":["Netcup KVM"],"org.dstCnt":1,"org.src":["Proton66 OOO"],"org.srcCnt":1,"usertype.dst":["business"],"usertype.dstCnt":1,"usertype.src":["business"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS197540 netcup GmbH","number":197540,"organization":{"name":"netcup GmbH"}},"bytes":0,"geo":{"country_iso_code":"DE"},"ip":"159.195.21.150","mac":["8a:41:d3:b8:0d:d3"],"mac-cnt":1,"packets":0,"port":22222},"dstRIR":"ARIN","ethertype":2048,"fileId":[81316],"firstPacket":1788005373282,"ipProtocol":6,"lastPacket":1788005376282,"length":3000,"network":{"bytes":132,"community_id":"1:x48LuDEl6NI5pfx/AhJ7y7ikZt0=","packets":2},"node":"spark-afae","packetPos":[-81316,273698,6595],"packetRange":{"gte":1788005373282,"lte":1788005376282},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS198953 Proton66 OOO","number":198953,"organization":{"name":"Proton66 OOO"}},"bytes":132,"geo":{"country_iso_code":"RU"},"ip":"176.120.22.61","mac":["bc:0f:fe:3d:a3:a7"],"mac-cnt":1,"packets":2,"port":44203},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[119],"srcTTLCnt":1,"tags":["honeypot","netcup-ts","sensor:netcup-ts"],"tagsCnt":3,"tcp":{"ja4t":["8192_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":850263268},"totDataBytes":0} +{"@timestamp":1788006152280,"_id":"260829-wbzj1aC501NB35um1UTfyyHB","_index":"arkime_sessions3-260829","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["netcup GmbH"],"isp.dstCnt":1,"isp.src":["Proton66 OOO"],"isp.srcCnt":1,"org.dst":["Netcup KVM"],"org.dstCnt":1,"org.src":["Proton66 OOO"],"org.srcCnt":1,"usertype.dst":["business"],"usertype.dstCnt":1,"usertype.src":["business"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS197540 netcup GmbH","number":197540,"organization":{"name":"netcup GmbH"}},"bytes":0,"geo":{"country_iso_code":"DE"},"ip":"159.195.21.150","mac":["8a:41:d3:b8:0d:d3"],"mac-cnt":1,"packets":0,"port":2222},"dstRIR":"ARIN","ethertype":2048,"fileId":[81316],"firstPacket":1788005371708,"ipProtocol":6,"lastPacket":1788005374708,"length":3000,"network":{"bytes":132,"community_id":"1:trTzA+UHfNsGTtx3Vq2WZ5UztNY=","packets":2},"node":"spark-afae","packetPos":[-81316,273142,1170],"packetRange":{"gte":1788005371708,"lte":1788005374708},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS198953 Proton66 OOO","number":198953,"organization":{"name":"Proton66 OOO"}},"bytes":132,"geo":{"country_iso_code":"RU"},"ip":"176.120.22.61","mac":["bc:0f:fe:38:0b:a3"],"mac-cnt":1,"packets":2,"port":38839},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[121],"srcTTLCnt":1,"tags":["honeypot","netcup-ts","sensor:netcup-ts"],"tagsCnt":3,"tcp":{"ja4t":["8192_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":2877244906},"totDataBytes":0} +{"@timestamp":1788006152284,"_id":"260829-wbzyUHx5OlJMsJp-emkgXOwr","_index":"arkime_sessions3-260829","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["netcup GmbH"],"isp.dstCnt":1,"isp.src":["Proton66 OOO"],"isp.srcCnt":1,"org.dst":["Netcup KVM"],"org.dstCnt":1,"org.src":["Proton66 OOO"],"org.srcCnt":1,"usertype.dst":["business"],"usertype.dstCnt":1,"usertype.src":["business"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS197540 netcup GmbH","number":197540,"organization":{"name":"netcup GmbH"}},"bytes":0,"geo":{"country_iso_code":"DE"},"ip":"159.195.21.150","mac":["8a:41:d3:b8:0d:d3"],"mac-cnt":1,"packets":0,"port":22222},"dstRIR":"ARIN","ethertype":2048,"fileId":[81316],"firstPacket":1788005366291,"ipProtocol":6,"lastPacket":1788005369291,"length":3000,"network":{"bytes":132,"community_id":"1:M9ygShYo9VkK1VMdS4AJ+8ydzF0=","packets":2},"node":"spark-afae","packetPos":[-81316,271580,596],"packetRange":{"gte":1788005366291,"lte":1788005369291},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS198953 Proton66 OOO","number":198953,"organization":{"name":"Proton66 OOO"}},"bytes":132,"geo":{"country_iso_code":"RU"},"ip":"176.120.22.61","mac":["bc:0f:fe:3d:a3:a7"],"mac-cnt":1,"packets":2,"port":35504},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[118],"srcTTLCnt":1,"tags":["honeypot","netcup-ts","sensor:netcup-ts"],"tagsCnt":3,"tcp":{"ja4t":["8192_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":3932485593},"totDataBytes":0} +{"@timestamp":1788006152282,"_id":"260829-wbzm5pfZWXpBDoV_GnG0WLE4","_index":"arkime_sessions3-260829","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["netcup GmbH"],"isp.dstCnt":1,"isp.src":["Proton66 OOO"],"isp.srcCnt":1,"org.dst":["Netcup KVM"],"org.dstCnt":1,"org.src":["Proton66 OOO"],"org.srcCnt":1,"usertype.dst":["business"],"usertype.dstCnt":1,"usertype.src":["business"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS197540 netcup GmbH","number":197540,"organization":{"name":"netcup GmbH"}},"bytes":0,"geo":{"country_iso_code":"DE"},"ip":"159.195.21.150","mac":["8a:41:d3:b8:0d:d3"],"mac-cnt":1,"packets":0,"port":2222},"dstRIR":"ARIN","ethertype":2048,"fileId":[81316],"firstPacket":1788005364717,"ipProtocol":6,"lastPacket":1788005367719,"length":3002,"network":{"bytes":132,"community_id":"1:MlAxOq4RYljMDoSkWocXN+yanBU=","packets":2},"node":"spark-afae","packetPos":[-81316,271228,506],"packetRange":{"gte":1788005364717,"lte":1788005367719},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS198953 Proton66 OOO","number":198953,"organization":{"name":"Proton66 OOO"}},"bytes":132,"geo":{"country_iso_code":"RU"},"ip":"176.120.22.61","mac":["bc:0f:fe:3d:a3:a7"],"mac-cnt":1,"packets":2,"port":29152},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[119],"srcTTLCnt":1,"tags":["honeypot","netcup-ts","sensor:netcup-ts"],"tagsCnt":3,"tcp":{"ja4t":["8192_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":235223978},"totDataBytes":0} +{"@timestamp":1788006152284,"_id":"260829-wbwVzI5DWN1MtLJYvAOOlTAP","_index":"arkime_sessions3-260829","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["netcup GmbH"],"isp.dstCnt":1,"isp.src":["Proton66 OOO"],"isp.srcCnt":1,"org.dst":["Netcup KVM"],"org.dstCnt":1,"org.src":["Proton66 OOO"],"org.srcCnt":1,"usertype.dst":["business"],"usertype.dstCnt":1,"usertype.src":["business"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS197540 netcup GmbH","number":197540,"organization":{"name":"netcup GmbH"}},"bytes":0,"geo":{"country_iso_code":"DE"},"ip":"159.195.21.150","mac":["8a:41:d3:b8:0d:d3"],"mac-cnt":1,"packets":0,"port":22222},"dstRIR":"ARIN","ethertype":2048,"fileId":[81316],"firstPacket":1788005359273,"ipProtocol":6,"lastPacket":1788005362269,"length":2996,"network":{"bytes":132,"community_id":"1:DlGkrGWHU6Conh3/iJTcslIPvPY=","packets":2},"node":"spark-afae","packetPos":[-81316,269358,1080],"packetRange":{"gte":1788005359273,"lte":1788005362269},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS198953 Proton66 OOO","number":198953,"organization":{"name":"Proton66 OOO"}},"bytes":132,"geo":{"country_iso_code":"RU"},"ip":"176.120.22.61","mac":["bc:0f:fe:38:0b:a3"],"mac-cnt":1,"packets":2,"port":59563},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[121],"srcTTLCnt":1,"tags":["honeypot","netcup-ts","sensor:netcup-ts"],"tagsCnt":3,"tcp":{"ja4t":["8192_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":3418561348},"totDataBytes":0} +{"@timestamp":1788006152283,"_id":"260829-wby7GanQ1gtD77Bj6zR-vkMf","_index":"arkime_sessions3-260829","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["netcup GmbH"],"isp.dstCnt":1,"isp.src":["Proton66 OOO"],"isp.srcCnt":1,"org.dst":["Netcup KVM"],"org.dstCnt":1,"org.src":["Proton66 OOO"],"org.srcCnt":1,"usertype.dst":["business"],"usertype.dstCnt":1,"usertype.src":["business"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS197540 netcup GmbH","number":197540,"organization":{"name":"netcup GmbH"}},"bytes":0,"geo":{"country_iso_code":"DE"},"ip":"159.195.21.150","mac":["8a:41:d3:b8:0d:d3"],"mac-cnt":1,"packets":0,"port":2222},"dstRIR":"ARIN","ethertype":2048,"fileId":[81316],"firstPacket":1788005357719,"ipProtocol":6,"lastPacket":1788005360719,"length":3000,"network":{"bytes":132,"community_id":"1:93pDAD+qdGmCU/cmdWd983g7kTo=","packets":2},"node":"spark-afae","packetPos":[-81316,269198,806],"packetRange":{"gte":1788005357719,"lte":1788005360719},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS198953 Proton66 OOO","number":198953,"organization":{"name":"Proton66 OOO"}},"bytes":132,"geo":{"country_iso_code":"RU"},"ip":"176.120.22.61","mac":["bc:0f:fe:3d:a3:a7"],"mac-cnt":1,"packets":2,"port":53462},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[119],"srcTTLCnt":1,"tags":["honeypot","netcup-ts","sensor:netcup-ts"],"tagsCnt":3,"tcp":{"ja4t":["8192_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":2233077227},"totDataBytes":0} +{"@timestamp":1788006152279,"_id":"260829-wbzttJ-udtpJCqPdF0wADB4M","_index":"arkime_sessions3-260829","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["netcup GmbH"],"isp.dstCnt":1,"isp.src":["Proton66 OOO"],"isp.srcCnt":1,"org.dst":["Netcup KVM"],"org.dstCnt":1,"org.src":["Proton66 OOO"],"org.srcCnt":1,"usertype.dst":["business"],"usertype.dstCnt":1,"usertype.src":["business"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS197540 netcup GmbH","number":197540,"organization":{"name":"netcup GmbH"}},"bytes":0,"geo":{"country_iso_code":"DE"},"ip":"159.195.21.150","mac":["8a:41:d3:b8:0d:d3"],"mac-cnt":1,"packets":0,"port":22222},"dstRIR":"ARIN","ethertype":2048,"fileId":[81316],"firstPacket":1788005352286,"ipProtocol":6,"lastPacket":1788005355278,"length":2992,"network":{"bytes":132,"community_id":"1:s9uw9/+rpUWspTXsgKmVEhhUPYE=","packets":2},"node":"spark-afae","packetPos":[-81316,267962,884],"packetRange":{"gte":1788005352286,"lte":1788005355278},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS198953 Proton66 OOO","number":198953,"organization":{"name":"Proton66 OOO"}},"bytes":132,"geo":{"country_iso_code":"RU"},"ip":"176.120.22.61","mac":["bc:0f:fe:3d:a3:a7"],"mac-cnt":1,"packets":2,"port":16737},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[119],"srcTTLCnt":1,"tags":["honeypot","netcup-ts","sensor:netcup-ts"],"tagsCnt":3,"tcp":{"ja4t":["8192_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":902121588},"totDataBytes":0} +{"@timestamp":1788006152284,"_id":"260829-wbwm2OfepCxBbLlnLvdYcFNx","_index":"arkime_sessions3-260829","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["netcup GmbH"],"isp.dstCnt":1,"isp.src":["Proton66 OOO"],"isp.srcCnt":1,"org.dst":["Netcup KVM"],"org.dstCnt":1,"org.src":["Proton66 OOO"],"org.srcCnt":1,"usertype.dst":["business"],"usertype.dstCnt":1,"usertype.src":["business"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS197540 netcup GmbH","number":197540,"organization":{"name":"netcup GmbH"}},"bytes":0,"geo":{"country_iso_code":"DE"},"ip":"159.195.21.150","mac":["8a:41:d3:b8:0d:d3"],"mac-cnt":1,"packets":0,"port":2222},"dstRIR":"ARIN","ethertype":2048,"fileId":[81316],"firstPacket":1788005350719,"ipProtocol":6,"lastPacket":1788005353718,"length":2999,"network":{"bytes":132,"community_id":"1:+3G8NiiSE8oO6qWF34Hl1fRlexY=","packets":2},"node":"spark-afae","packetPos":[-81316,267538,1136],"packetRange":{"gte":1788005350719,"lte":1788005353718},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS198953 Proton66 OOO","number":198953,"organization":{"name":"Proton66 OOO"}},"bytes":132,"geo":{"country_iso_code":"RU"},"ip":"176.120.22.61","mac":["bc:0f:fe:3d:a3:a7"],"mac-cnt":1,"packets":2,"port":53076},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[119],"srcTTLCnt":1,"tags":["honeypot","netcup-ts","sensor:netcup-ts"],"tagsCnt":3,"tcp":{"ja4t":["8192_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":2130920672},"totDataBytes":0} +{"@timestamp":1788006152279,"_id":"260829-wbzYYYAlE_VKJKldn96pzSU_","_index":"arkime_sessions3-260829","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["netcup GmbH"],"isp.dstCnt":1,"isp.src":["Proton66 OOO"],"isp.srcCnt":1,"org.dst":["Netcup KVM"],"org.dstCnt":1,"org.src":["Proton66 OOO"],"org.srcCnt":1,"usertype.dst":["business"],"usertype.dstCnt":1,"usertype.src":["business"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS197540 netcup GmbH","number":197540,"organization":{"name":"netcup GmbH"}},"bytes":0,"geo":{"country_iso_code":"DE"},"ip":"159.195.21.150","mac":["8a:41:d3:b8:0d:d3"],"mac-cnt":1,"packets":0,"port":22222},"dstRIR":"ARIN","ethertype":2048,"fileId":[81316],"firstPacket":1788005345285,"ipProtocol":6,"lastPacket":1788005348280,"length":2995,"network":{"bytes":132,"community_id":"1:ArZy7gU1KcAvuGN8D/YQmeSfBvw=","packets":2},"node":"spark-afae","packetPos":[-81316,265604,794],"packetRange":{"gte":1788005345285,"lte":1788005348280},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS198953 Proton66 OOO","number":198953,"organization":{"name":"Proton66 OOO"}},"bytes":132,"geo":{"country_iso_code":"RU"},"ip":"176.120.22.61","mac":["bc:0f:fe:3d:a3:a7"],"mac-cnt":1,"packets":2,"port":49405},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[119],"srcTTLCnt":1,"tags":["honeypot","netcup-ts","sensor:netcup-ts"],"tagsCnt":3,"tcp":{"ja4t":["8192_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":2571752732},"totDataBytes":0} +{"@timestamp":1788006152281,"_id":"260829-wbwIBMX_St5EeIBs15inSBr4","_index":"arkime_sessions3-260829","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["netcup GmbH"],"isp.dstCnt":1,"isp.src":["Proton66 OOO"],"isp.srcCnt":1,"org.dst":["Netcup KVM"],"org.dstCnt":1,"org.src":["Proton66 OOO"],"org.srcCnt":1,"usertype.dst":["business"],"usertype.dstCnt":1,"usertype.src":["business"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS197540 netcup GmbH","number":197540,"organization":{"name":"netcup GmbH"}},"bytes":0,"geo":{"country_iso_code":"DE"},"ip":"159.195.21.150","mac":["8a:41:d3:b8:0d:d3"],"mac-cnt":1,"packets":0,"port":2222},"dstRIR":"ARIN","ethertype":2048,"fileId":[81316],"firstPacket":1788005343718,"ipProtocol":6,"lastPacket":1788005346712,"length":2994,"network":{"bytes":132,"community_id":"1:85tHpu3IFQGC7gENENhmBbwwDMA=","packets":2},"node":"spark-afae","packetPos":[-81316,264828,1038],"packetRange":{"gte":1788005343718,"lte":1788005346712},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS198953 Proton66 OOO","number":198953,"organization":{"name":"Proton66 OOO"}},"bytes":132,"geo":{"country_iso_code":"RU"},"ip":"176.120.22.61","mac":["bc:0f:fe:3d:a3:a7"],"mac-cnt":1,"packets":2,"port":35843},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[119],"srcTTLCnt":1,"tags":["honeypot","netcup-ts","sensor:netcup-ts"],"tagsCnt":3,"tcp":{"ja4t":["8192_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":2858951524},"totDataBytes":0} +{"@timestamp":1788006152280,"_id":"260829-wbxg9YxIR1lOY6fGwBg2oEsk","_index":"arkime_sessions3-260829","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["netcup GmbH"],"isp.dstCnt":1,"isp.src":["Proton66 OOO"],"isp.srcCnt":1,"org.dst":["Netcup KVM"],"org.dstCnt":1,"org.src":["Proton66 OOO"],"org.srcCnt":1,"usertype.dst":["business"],"usertype.dstCnt":1,"usertype.src":["business"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS197540 netcup GmbH","number":197540,"organization":{"name":"netcup GmbH"}},"bytes":0,"geo":{"country_iso_code":"DE"},"ip":"159.195.21.150","mac":["8a:41:d3:b8:0d:d3"],"mac-cnt":1,"packets":0,"port":22222},"dstRIR":"ARIN","ethertype":2048,"fileId":[81316],"firstPacket":1788005338288,"ipProtocol":6,"lastPacket":1788005341283,"length":2995,"network":{"bytes":132,"community_id":"1:3+H51WHtzcydFe1cNb6yKqrpNGg=","packets":2},"node":"spark-afae","packetPos":[-81316,263868,512],"packetRange":{"gte":1788005338288,"lte":1788005341283},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS198953 Proton66 OOO","number":198953,"organization":{"name":"Proton66 OOO"}},"bytes":132,"geo":{"country_iso_code":"RU"},"ip":"176.120.22.61","mac":["bc:0f:fe:3d:a3:a7"],"mac-cnt":1,"packets":2,"port":37019},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[118],"srcTTLCnt":1,"tags":["honeypot","netcup-ts","sensor:netcup-ts"],"tagsCnt":3,"tcp":{"ja4t":["8192_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":3473581366},"totDataBytes":0} +{"@timestamp":1788006152280,"_id":"260829-wbzREKwCxxBLOraTCFrcewHg","_index":"arkime_sessions3-260829","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["netcup GmbH"],"isp.dstCnt":1,"isp.src":["Proton66 OOO"],"isp.srcCnt":1,"org.dst":["Netcup KVM"],"org.dstCnt":1,"org.src":["Proton66 OOO"],"org.srcCnt":1,"usertype.dst":["business"],"usertype.dstCnt":1,"usertype.src":["business"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS197540 netcup GmbH","number":197540,"organization":{"name":"netcup GmbH"}},"bytes":0,"geo":{"country_iso_code":"DE"},"ip":"159.195.21.150","mac":["8a:41:d3:b8:0d:d3"],"mac-cnt":1,"packets":0,"port":2222},"dstRIR":"ARIN","ethertype":2048,"fileId":[81316],"firstPacket":1788005336717,"ipProtocol":6,"lastPacket":1788005339713,"length":2996,"network":{"bytes":132,"community_id":"1:fWiDNK0EWtq0Kpt4t9IYW5Vq3Bo=","packets":2},"node":"spark-afae","packetPos":[-81316,263614,516],"packetRange":{"gte":1788005336717,"lte":1788005339713},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS198953 Proton66 OOO","number":198953,"organization":{"name":"Proton66 OOO"}},"bytes":132,"geo":{"country_iso_code":"RU"},"ip":"176.120.22.61","mac":["bc:0f:fe:3d:a3:a7"],"mac-cnt":1,"packets":2,"port":12718},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[119],"srcTTLCnt":1,"tags":["honeypot","netcup-ts","sensor:netcup-ts"],"tagsCnt":3,"tcp":{"ja4t":["8192_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":4092884829},"totDataBytes":0} +{"@timestamp":1788006152280,"_id":"260829-wbyn35A4YIVFbLlxcs-rIVZ0","_index":"arkime_sessions3-260829","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["netcup GmbH"],"isp.dstCnt":1,"isp.src":["Proton66 OOO"],"isp.srcCnt":1,"org.dst":["Netcup KVM"],"org.dstCnt":1,"org.src":["Proton66 OOO"],"org.srcCnt":1,"usertype.dst":["business"],"usertype.dstCnt":1,"usertype.src":["business"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS197540 netcup GmbH","number":197540,"organization":{"name":"netcup GmbH"}},"bytes":0,"geo":{"country_iso_code":"DE"},"ip":"159.195.21.150","mac":["8a:41:d3:b8:0d:d3"],"mac-cnt":1,"packets":0,"port":22222},"dstRIR":"ARIN","ethertype":2048,"fileId":[81316],"firstPacket":1788005331275,"ipProtocol":6,"lastPacket":1788005334268,"length":2993,"network":{"bytes":132,"community_id":"1:aCgA74/Y15S15VCtbmyrdIrWyc8=","packets":2},"node":"spark-afae","packetPos":[-81316,261948,872],"packetRange":{"gte":1788005331275,"lte":1788005334268},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS198953 Proton66 OOO","number":198953,"organization":{"name":"Proton66 OOO"}},"bytes":132,"geo":{"country_iso_code":"RU"},"ip":"176.120.22.61","mac":["bc:0f:fe:38:0b:a3"],"mac-cnt":1,"packets":2,"port":13665},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[121],"srcTTLCnt":1,"tags":["honeypot","netcup-ts","sensor:netcup-ts"],"tagsCnt":3,"tcp":{"ja4t":["8192_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":155144595},"totDataBytes":0} +{"@timestamp":1788006152281,"_id":"260829-wbzWWE0zFUBKs5CeK3AM1pHO","_index":"arkime_sessions3-260829","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["netcup GmbH"],"isp.dstCnt":1,"isp.src":["Proton66 OOO"],"isp.srcCnt":1,"org.dst":["Netcup KVM"],"org.dstCnt":1,"org.src":["Proton66 OOO"],"org.srcCnt":1,"usertype.dst":["business"],"usertype.dstCnt":1,"usertype.src":["business"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS197540 netcup GmbH","number":197540,"organization":{"name":"netcup GmbH"}},"bytes":0,"geo":{"country_iso_code":"DE"},"ip":"159.195.21.150","mac":["8a:41:d3:b8:0d:d3"],"mac-cnt":1,"packets":0,"port":2222},"dstRIR":"ARIN","ethertype":2048,"fileId":[81316],"firstPacket":1788005329706,"ipProtocol":6,"lastPacket":1788005332698,"length":2992,"network":{"bytes":132,"community_id":"1:uu6wWiNP3bhPCsA557pLxCg44/U=","packets":2},"node":"spark-afae","packetPos":[-81316,260387,2093],"packetRange":{"gte":1788005329706,"lte":1788005332698},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS198953 Proton66 OOO","number":198953,"organization":{"name":"Proton66 OOO"}},"bytes":132,"geo":{"country_iso_code":"RU"},"ip":"176.120.22.61","mac":["bc:0f:fe:38:0b:a3"],"mac-cnt":1,"packets":2,"port":51015},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[121],"srcTTLCnt":1,"tags":["honeypot","netcup-ts","sensor:netcup-ts"],"tagsCnt":3,"tcp":{"ja4t":["8192_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":1977522491},"totDataBytes":0} +{"@timestamp":1788006152279,"_id":"260829-wbwy19SWeLRLQY3glNd_40pt","_index":"arkime_sessions3-260829","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["netcup GmbH"],"isp.dstCnt":1,"isp.src":["Proton66 OOO"],"isp.srcCnt":1,"org.dst":["Netcup KVM"],"org.dstCnt":1,"org.src":["Proton66 OOO"],"org.srcCnt":1,"usertype.dst":["business"],"usertype.dstCnt":1,"usertype.src":["business"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS197540 netcup GmbH","number":197540,"organization":{"name":"netcup GmbH"}},"bytes":0,"geo":{"country_iso_code":"DE"},"ip":"159.195.21.150","mac":["8a:41:d3:b8:0d:d3"],"mac-cnt":1,"packets":0,"port":22222},"dstRIR":"ARIN","ethertype":2048,"fileId":[81316],"firstPacket":1788005324283,"ipProtocol":6,"lastPacket":1788005327281,"length":2998,"network":{"bytes":132,"community_id":"1:bEkU5cLeVSg9pA2VdxW91Qe4kDQ=","packets":2},"node":"spark-afae","packetPos":[-81316,247328,8081],"packetRange":{"gte":1788005324283,"lte":1788005327281},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS198953 Proton66 OOO","number":198953,"organization":{"name":"Proton66 OOO"}},"bytes":132,"geo":{"country_iso_code":"RU"},"ip":"176.120.22.61","mac":["bc:0f:fe:3d:a3:a7"],"mac-cnt":1,"packets":2,"port":42706},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[119],"srcTTLCnt":1,"tags":["honeypot","netcup-ts","sensor:netcup-ts"],"tagsCnt":3,"tcp":{"ja4t":["8192_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":3273353994},"totDataBytes":0} +{"@timestamp":1788006152279,"_id":"260829-wby3U9n_VDhDFIpbynIlSVMR","_index":"arkime_sessions3-260829","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["netcup GmbH"],"isp.dstCnt":1,"isp.src":["Proton66 OOO"],"isp.srcCnt":1,"org.dst":["Netcup KVM"],"org.dstCnt":1,"org.src":["Proton66 OOO"],"org.srcCnt":1,"usertype.dst":["business"],"usertype.dstCnt":1,"usertype.src":["business"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS197540 netcup GmbH","number":197540,"organization":{"name":"netcup GmbH"}},"bytes":0,"geo":{"country_iso_code":"DE"},"ip":"159.195.21.150","mac":["8a:41:d3:b8:0d:d3"],"mac-cnt":1,"packets":0,"port":2222},"dstRIR":"ARIN","ethertype":2048,"fileId":[81316],"firstPacket":1788005322712,"ipProtocol":6,"lastPacket":1788005325705,"length":2993,"network":{"bytes":132,"community_id":"1:T4Aw3+tzcFncJ1RPQvBvp2CIXgI=","packets":2},"node":"spark-afae","packetPos":[-81316,247164,426],"packetRange":{"gte":1788005322712,"lte":1788005325705},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS198953 Proton66 OOO","number":198953,"organization":{"name":"Proton66 OOO"}},"bytes":132,"geo":{"country_iso_code":"RU"},"ip":"176.120.22.61","mac":["bc:0f:fe:3d:a3:a7"],"mac-cnt":1,"packets":2,"port":26485},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[119],"srcTTLCnt":1,"tags":["honeypot","netcup-ts","sensor:netcup-ts"],"tagsCnt":3,"tcp":{"ja4t":["8192_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":1399368929},"totDataBytes":0} +{"@timestamp":1788006152281,"_id":"260829-wbw_mib9KdFGWJHd0MVJhlFN","_index":"arkime_sessions3-260829","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["netcup GmbH"],"isp.dstCnt":1,"isp.src":["Proton66 OOO"],"isp.srcCnt":1,"org.dst":["Netcup KVM"],"org.dstCnt":1,"org.src":["Proton66 OOO"],"org.srcCnt":1,"usertype.dst":["business"],"usertype.dstCnt":1,"usertype.src":["business"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS197540 netcup GmbH","number":197540,"organization":{"name":"netcup GmbH"}},"bytes":0,"geo":{"country_iso_code":"DE"},"ip":"159.195.21.150","mac":["8a:41:d3:b8:0d:d3"],"mac-cnt":1,"packets":0,"port":22222},"dstRIR":"ARIN","ethertype":2048,"fileId":[81316],"firstPacket":1788005317280,"ipProtocol":6,"lastPacket":1788005320278,"length":2998,"network":{"bytes":132,"community_id":"1:ukNnhyNRI7Y+qdEeklmX3EryT84=","packets":2},"node":"spark-afae","packetPos":[-81316,246198,704],"packetRange":{"gte":1788005317280,"lte":1788005320278},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS198953 Proton66 OOO","number":198953,"organization":{"name":"Proton66 OOO"}},"bytes":132,"geo":{"country_iso_code":"RU"},"ip":"176.120.22.61","mac":["bc:0f:fe:3d:a3:a7"],"mac-cnt":1,"packets":2,"port":41989},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[119],"srcTTLCnt":1,"tags":["honeypot","netcup-ts","sensor:netcup-ts"],"tagsCnt":3,"tcp":{"ja4t":["8192_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":3740669437},"totDataBytes":0} +{"@timestamp":1788006152279,"_id":"260829-wbzlkthsrchGKa5c6zL1e2HP","_index":"arkime_sessions3-260829","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["netcup GmbH"],"isp.dstCnt":1,"isp.src":["Proton66 OOO"],"isp.srcCnt":1,"org.dst":["Netcup KVM"],"org.dstCnt":1,"org.src":["Proton66 OOO"],"org.srcCnt":1,"usertype.dst":["business"],"usertype.dstCnt":1,"usertype.src":["business"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS197540 netcup GmbH","number":197540,"organization":{"name":"netcup GmbH"}},"bytes":0,"geo":{"country_iso_code":"DE"},"ip":"159.195.21.150","mac":["8a:41:d3:b8:0d:d3"],"mac-cnt":1,"packets":0,"port":2222},"dstRIR":"ARIN","ethertype":2048,"fileId":[81316],"firstPacket":1788005315701,"ipProtocol":6,"lastPacket":1788005318698,"length":2997,"network":{"bytes":132,"community_id":"1:mBZMMpYwfMwZx1Pzgs94Ui8LRWw=","packets":2},"node":"spark-afae","packetPos":[-81316,245846,794],"packetRange":{"gte":1788005315701,"lte":1788005318698},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS198953 Proton66 OOO","number":198953,"organization":{"name":"Proton66 OOO"}},"bytes":132,"geo":{"country_iso_code":"RU"},"ip":"176.120.22.61","mac":["bc:0f:fe:38:0b:a3"],"mac-cnt":1,"packets":2,"port":23777},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[121],"srcTTLCnt":1,"tags":["honeypot","netcup-ts","sensor:netcup-ts"],"tagsCnt":3,"tcp":{"ja4t":["8192_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":555141042},"totDataBytes":0} +{"@timestamp":1788006152282,"_id":"260829-wbwMFwSi6SxGFpRNl1aKYMPm","_index":"arkime_sessions3-260829","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["netcup GmbH"],"isp.dstCnt":1,"isp.src":["Proton66 OOO"],"isp.srcCnt":1,"org.dst":["Netcup KVM"],"org.dstCnt":1,"org.src":["Proton66 OOO"],"org.srcCnt":1,"usertype.dst":["business"],"usertype.dstCnt":1,"usertype.src":["business"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS197540 netcup GmbH","number":197540,"organization":{"name":"netcup GmbH"}},"bytes":0,"geo":{"country_iso_code":"DE"},"ip":"159.195.21.150","mac":["8a:41:d3:b8:0d:d3"],"mac-cnt":1,"packets":0,"port":22222},"dstRIR":"ARIN","ethertype":2048,"fileId":[81316],"firstPacket":1788005310285,"ipProtocol":6,"lastPacket":1788005313283,"length":2998,"network":{"bytes":132,"community_id":"1:9x8cOXWWaVBXiC8Se6GD9VWKw3o=","packets":2},"node":"spark-afae","packetPos":[-81316,240223,5459],"packetRange":{"gte":1788005310285,"lte":1788005313283},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS198953 Proton66 OOO","number":198953,"organization":{"name":"Proton66 OOO"}},"bytes":132,"geo":{"country_iso_code":"RU"},"ip":"176.120.22.61","mac":["bc:0f:fe:3d:a3:a7"],"mac-cnt":1,"packets":2,"port":15345},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[119],"srcTTLCnt":1,"tags":["honeypot","netcup-ts","sensor:netcup-ts"],"tagsCnt":3,"tcp":{"ja4t":["8192_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":3204280097},"totDataBytes":0} +{"@timestamp":1788006152279,"_id":"260829-wbxmklEhVidPwrBFLpSSALZs","_index":"arkime_sessions3-260829","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["netcup GmbH"],"isp.dstCnt":1,"isp.src":["Proton66 OOO"],"isp.srcCnt":1,"org.dst":["Netcup KVM"],"org.dstCnt":1,"org.src":["Proton66 OOO"],"org.srcCnt":1,"usertype.dst":["business"],"usertype.dstCnt":1,"usertype.src":["business"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS197540 netcup GmbH","number":197540,"organization":{"name":"netcup GmbH"}},"bytes":0,"geo":{"country_iso_code":"DE"},"ip":"159.195.21.150","mac":["8a:41:d3:b8:0d:d3"],"mac-cnt":1,"packets":0,"port":2222},"dstRIR":"ARIN","ethertype":2048,"fileId":[81316],"firstPacket":1788005308700,"ipProtocol":6,"lastPacket":1788005311699,"length":2999,"network":{"bytes":132,"community_id":"1:LCaFeqTDNN0N9Llu43i2bRhHcDs=","packets":2},"node":"spark-afae","packetPos":[-81316,240051,5165],"packetRange":{"gte":1788005308700,"lte":1788005311699},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS198953 Proton66 OOO","number":198953,"organization":{"name":"Proton66 OOO"}},"bytes":132,"geo":{"country_iso_code":"RU"},"ip":"176.120.22.61","mac":["bc:0f:fe:38:0b:a3"],"mac-cnt":1,"packets":2,"port":1422},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[121],"srcTTLCnt":1,"tags":["honeypot","netcup-ts","sensor:netcup-ts"],"tagsCnt":3,"tcp":{"ja4t":["8192_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":3728919024},"totDataBytes":0} +{"@timestamp":1788006152280,"_id":"260829-wbzriv9iTWhEdKUIy2R5T5oP","_index":"arkime_sessions3-260829","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["netcup GmbH"],"isp.dstCnt":1,"isp.src":["Proton66 OOO"],"isp.srcCnt":1,"org.dst":["Netcup KVM"],"org.dstCnt":1,"org.src":["Proton66 OOO"],"org.srcCnt":1,"usertype.dst":["business"],"usertype.dstCnt":1,"usertype.src":["business"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS197540 netcup GmbH","number":197540,"organization":{"name":"netcup GmbH"}},"bytes":0,"geo":{"country_iso_code":"DE"},"ip":"159.195.21.150","mac":["8a:41:d3:b8:0d:d3"],"mac-cnt":1,"packets":0,"port":22222},"dstRIR":"ARIN","ethertype":2048,"fileId":[81316],"firstPacket":1788005303271,"ipProtocol":6,"lastPacket":1788005306273,"length":3002,"network":{"bytes":132,"community_id":"1:ZWtCjmUIOcgtZNA9vnKCuiptJ/c=","packets":2},"node":"spark-afae","packetPos":[-81316,239601,164],"packetRange":{"gte":1788005303271,"lte":1788005306273},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS198953 Proton66 OOO","number":198953,"organization":{"name":"Proton66 OOO"}},"bytes":132,"geo":{"country_iso_code":"RU"},"ip":"176.120.22.61","mac":["bc:0f:fe:38:0b:a3"],"mac-cnt":1,"packets":2,"port":6783},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[121],"srcTTLCnt":1,"tags":["honeypot","netcup-ts","sensor:netcup-ts"],"tagsCnt":3,"tcp":{"ja4t":["8192_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":3421019936},"totDataBytes":0} +{"@timestamp":1788006152279,"_id":"260829-wbzW9n0n4TRPnpW38f5ZVPXq","_index":"arkime_sessions3-260829","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["netcup GmbH"],"isp.dstCnt":1,"isp.src":["Proton66 OOO"],"isp.srcCnt":1,"org.dst":["Netcup KVM"],"org.dstCnt":1,"org.src":["Proton66 OOO"],"org.srcCnt":1,"usertype.dst":["business"],"usertype.dstCnt":1,"usertype.src":["business"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS197540 netcup GmbH","number":197540,"organization":{"name":"netcup GmbH"}},"bytes":0,"geo":{"country_iso_code":"DE"},"ip":"159.195.21.150","mac":["8a:41:d3:b8:0d:d3"],"mac-cnt":1,"packets":0,"port":2222},"dstRIR":"ARIN","ethertype":2048,"fileId":[81316],"firstPacket":1788005301699,"ipProtocol":6,"lastPacket":1788005304698,"length":2999,"network":{"bytes":132,"community_id":"1:vt2b2QvnbZjUJUZKYatsCfbyh6Y=","packets":2},"node":"spark-afae","packetPos":[-81316,239519,164],"packetRange":{"gte":1788005301699,"lte":1788005304698},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS198953 Proton66 OOO","number":198953,"organization":{"name":"Proton66 OOO"}},"bytes":132,"geo":{"country_iso_code":"RU"},"ip":"176.120.22.61","mac":["bc:0f:fe:38:0b:a3"],"mac-cnt":1,"packets":2,"port":36994},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[121],"srcTTLCnt":1,"tags":["honeypot","netcup-ts","sensor:netcup-ts"],"tagsCnt":3,"tcp":{"ja4t":["8192_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":4210692492},"totDataBytes":0} +{"@timestamp":1788006152279,"_id":"260829-wbzq6GH_8UJO4aeh4Ci46Xem","_index":"arkime_sessions3-260829","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["netcup GmbH"],"isp.dstCnt":1,"isp.src":["Proton66 OOO"],"isp.srcCnt":1,"org.dst":["Netcup KVM"],"org.dstCnt":1,"org.src":["Proton66 OOO"],"org.srcCnt":1,"usertype.dst":["business"],"usertype.dstCnt":1,"usertype.src":["business"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS197540 netcup GmbH","number":197540,"organization":{"name":"netcup GmbH"}},"bytes":0,"geo":{"country_iso_code":"DE"},"ip":"159.195.21.150","mac":["8a:41:d3:b8:0d:d3"],"mac-cnt":1,"packets":0,"port":22222},"dstRIR":"ARIN","ethertype":2048,"fileId":[81316],"firstPacket":1788005296269,"ipProtocol":6,"lastPacket":1788005299273,"length":3004,"network":{"bytes":132,"community_id":"1:d7wN8ziClHFkCL0PZxsFW7WSbTY=","packets":2},"node":"spark-afae","packetPos":[-81316,239069,368],"packetRange":{"gte":1788005296269,"lte":1788005299273},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS198953 Proton66 OOO","number":198953,"organization":{"name":"Proton66 OOO"}},"bytes":132,"geo":{"country_iso_code":"RU"},"ip":"176.120.22.61","mac":["bc:0f:fe:38:0b:a3"],"mac-cnt":1,"packets":2,"port":38097},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[121],"srcTTLCnt":1,"tags":["honeypot","netcup-ts","sensor:netcup-ts"],"tagsCnt":3,"tcp":{"ja4t":["8192_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":3364488069},"totDataBytes":0} -- cgit v1.2.3