From e93e7f67d4f70177c3ab5a34e8cc5b24fa2dde6d Mon Sep 17 00:00:00 2001 From: hrbrmstr Date: Mon, 31 Aug 2026 07:56:38 -0400 Subject: add: bph report iocs --- .../session_search_20260831T113640_b7c6793a.ndjson | 100 +++++++++++++++++++++ 1 file changed, 100 insertions(+) create mode 100644 kevlar/2026-08-31/sponge/ip-sessions/session_search_20260831T113640_b7c6793a.ndjson (limited to 'kevlar/2026-08-31/sponge/ip-sessions/session_search_20260831T113640_b7c6793a.ndjson') diff --git a/kevlar/2026-08-31/sponge/ip-sessions/session_search_20260831T113640_b7c6793a.ndjson b/kevlar/2026-08-31/sponge/ip-sessions/session_search_20260831T113640_b7c6793a.ndjson new file mode 100644 index 0000000..b0510e2 --- /dev/null +++ b/kevlar/2026-08-31/sponge/ip-sessions/session_search_20260831T113640_b7c6793a.ndjson @@ -0,0 +1,100 @@ +{"@timestamp":1788092079945,"_id":"260830-rEL6jP3j04NAjKOk2QvKznha","_index":"arkime_sessions3-260830","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["Private Layer INC"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["Private Layer Inc"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":74,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":1,"port":5060},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[81891],"firstPacket":1788090988281,"ipProtocol":6,"lastPacket":1788090988434,"length":153,"network":{"bytes":202,"community_id":"1:C25nZuxndBoj2eGvperlrFJFu5o=","packets":3},"node":"spark-afae","packetPos":[-81891,2025237,90,1624],"packetRange":{"gte":1788090988281,"lte":1788090988434},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51852 Private Layer INC","number":51852,"organization":{"name":"Private Layer INC"}},"bytes":128,"geo":{"country_iso_code":"CH"},"ip":"179.43.167.2","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":2,"port":26528},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"LACNIC","srcTTL":[50],"srcTTLCnt":1,"tags":["frantech-ts","sensor:frantech-ts","honeypot"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-4-8-1-3_1400_13"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":2217684389},"totDataBytes":0} +{"@timestamp":1788089969724,"_id":"260830--jO-xycDotdLLIm-FCiqZtbJ","_index":"arkime_sessions3-260830","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["Private Layer INC"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["Private Layer Inc"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":74,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":1,"port":5060},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[81876],"firstPacket":1788089260983,"ipProtocol":6,"lastPacket":1788089261137,"length":154,"network":{"bytes":202,"community_id":"1:BsPKwV2uy2oaC9Z5yFvGA3c5Tz0=","packets":3},"node":"spark-afae","packetPos":[-81876,2521932,90,460],"packetRange":{"gte":1788089260983,"lte":1788089261137},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51852 Private Layer INC","number":51852,"organization":{"name":"Private Layer INC"}},"bytes":128,"geo":{"country_iso_code":"CH"},"ip":"179.43.167.2","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":2,"port":60876},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"LACNIC","srcTTL":[50],"srcTTLCnt":1,"tags":["frantech-ts","honeypot","sensor:frantech-ts"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-4-8-1-3_1400_13"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":1986661145},"totDataBytes":0} +{"@timestamp":1788088464484,"_id":"260830-88RhpNJqctBAtY8RDR8_0_sz","_index":"arkime_sessions3-260830","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["Private Layer INC"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["Private Layer Inc"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":74,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":1,"port":5060},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[81866],"firstPacket":1788087533755,"ipProtocol":6,"lastPacket":1788087533906,"length":151,"network":{"bytes":202,"community_id":"1:JhCvk3bc1XTjzCKAfsEwYmbYVeU=","packets":3},"node":"spark-afae","packetPos":[-81866,13605763,90,5490],"packetRange":{"gte":1788087533755,"lte":1788087533906},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51852 Private Layer INC","number":51852,"organization":{"name":"Private Layer INC"}},"bytes":128,"geo":{"country_iso_code":"CH"},"ip":"179.43.167.2","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":2,"port":60292},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"LACNIC","srcTTL":[50],"srcTTLCnt":1,"tags":["honeypot","frantech-ts","sensor:frantech-ts"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-4-8-1-3_1400_13"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":825899392},"totDataBytes":0} +{"@timestamp":1788086367135,"_id":"260830-djPulWmcrjZNM55gBgz5i637","_index":"arkime_sessions3-260830","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["Private Layer INC"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["Private Layer Inc"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":74,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":1,"port":5060},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[81852],"firstPacket":1788085806096,"ipProtocol":6,"lastPacket":1788085806248,"length":152,"network":{"bytes":202,"community_id":"1:BnJYWEAbEJMh57PREx8sHZBdCO0=","packets":3},"node":"spark-afae","packetPos":[-81852,8030353,90,1334],"packetRange":{"gte":1788085806096,"lte":1788085806248},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51852 Private Layer INC","number":51852,"organization":{"name":"Private Layer INC"}},"bytes":128,"geo":{"country_iso_code":"CH"},"ip":"179.43.167.2","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":2,"port":52140},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"LACNIC","srcTTL":[50],"srcTTLCnt":1,"tags":["sensor:frantech-ts","frantech-ts","honeypot"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-4-8-1-3_1400_13"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":334869575},"totDataBytes":0} +{"@timestamp":1788084534164,"_id":"260830-NDP5zPmQh2lBSJHUUUZ9EMoM","_index":"arkime_sessions3-260830","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["Private Layer INC"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["Private Layer Inc"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":74,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":1,"port":5060},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[81840],"firstPacket":1788084078688,"ipProtocol":6,"lastPacket":1788084078841,"length":153,"network":{"bytes":202,"community_id":"1:x4offKgYu6zj5KCZbPsOMLw+pBk=","packets":3},"node":"spark-afae","packetPos":[-81840,3784244,90,1202],"packetRange":{"gte":1788084078688,"lte":1788084078841},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51852 Private Layer INC","number":51852,"organization":{"name":"Private Layer INC"}},"bytes":128,"geo":{"country_iso_code":"CH"},"ip":"179.43.167.2","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":2,"port":2456},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"LACNIC","srcTTL":[50],"srcTTLCnt":1,"tags":["honeypot","sensor:frantech-ts","frantech-ts"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-4-8-1-3_1400_13"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":2051460165},"totDataBytes":0} +{"@timestamp":1788083040841,"_id":"260830-_TJPLsm2RzVDeLTSpQO9Rp0n","_index":"arkime_sessions3-260830","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["Private Layer INC"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["Private Layer Inc"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":74,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":1,"port":5060},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[81829],"firstPacket":1788082351436,"ipProtocol":6,"lastPacket":1788082351588,"length":152,"network":{"bytes":202,"community_id":"1:h6TGd75CCI9GXZM6DJFXUi4Rj00=","packets":3},"node":"spark-afae","packetPos":[-81829,6470321,90,376],"packetRange":{"gte":1788082351436,"lte":1788082351588},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51852 Private Layer INC","number":51852,"organization":{"name":"Private Layer INC"}},"bytes":128,"geo":{"country_iso_code":"CH"},"ip":"179.43.167.2","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":2,"port":1194},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"LACNIC","srcTTL":[50],"srcTTLCnt":1,"tags":["sensor:frantech-ts","frantech-ts","honeypot"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-4-8-1-3_1400_13"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":690467344},"totDataBytes":0} +{"@timestamp":1788081232011,"_id":"260830-RcToI5dEiLpJ15r1-dC75X0g","_index":"arkime_sessions3-260830","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["Private Layer INC"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["Private Layer Inc"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":74,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":1,"port":5060},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[81818],"firstPacket":1788080624370,"ipProtocol":6,"lastPacket":1788080624524,"length":154,"network":{"bytes":202,"community_id":"1:qBTgwmO8HyeSUHw4eN0JdVIx86k=","packets":3},"node":"spark-afae","packetPos":[-81818,14870285,90,753],"packetRange":{"gte":1788080624370,"lte":1788080624524},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51852 Private Layer INC","number":51852,"organization":{"name":"Private Layer INC"}},"bytes":128,"geo":{"country_iso_code":"CH"},"ip":"179.43.167.2","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":2,"port":48516},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"LACNIC","srcTTL":[50],"srcTTLCnt":1,"tags":["frantech-ts","honeypot","sensor:frantech-ts"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-4-8-1-3_1400_13"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":1184018540},"totDataBytes":0} +{"@timestamp":1788079121203,"_id":"260830-eTISM0bs5j9PubJ6IsXIwzz1","_index":"arkime_sessions3-260830","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["Private Layer INC"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["Private Layer Inc"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":74,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":1,"port":5060},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[81804],"firstPacket":1788078896878,"ipProtocol":6,"lastPacket":1788078897030,"length":152,"network":{"bytes":202,"community_id":"1:2+XbnlJr2rAPyaAs3LLgj2CSGE4=","packets":3},"node":"spark-afae","packetPos":[-81804,10615861,90,4253],"packetRange":{"gte":1788078896878,"lte":1788078897030},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51852 Private Layer INC","number":51852,"organization":{"name":"Private Layer INC"}},"bytes":128,"geo":{"country_iso_code":"CH"},"ip":"179.43.167.2","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":2,"port":26126},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"LACNIC","srcTTL":[50],"srcTTLCnt":1,"tags":["sensor:frantech-ts","frantech-ts","honeypot"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-4-8-1-3_1400_13"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":4174125225},"totDataBytes":0} +{"@timestamp":1788078520434,"_id":"260830-7cMSk7qhTz9AGJyyzpWRWFO4","_index":"arkime_sessions3-260830","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["Private Layer INC"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["Private Layer Inc"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":74,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":1,"port":5060},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[81800],"firstPacket":1788077169245,"ipProtocol":6,"lastPacket":1788077169398,"length":153,"network":{"bytes":202,"community_id":"1:UtyPgwBFEBi98QABQsGQ1H5rs9Y=","packets":3},"node":"spark-afae","packetPos":[-81800,85387,90,0],"packetRange":{"gte":1788077169245,"lte":1788077169398},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51852 Private Layer INC","number":51852,"organization":{"name":"Private Layer INC"}},"bytes":128,"geo":{"country_iso_code":"CH"},"ip":"179.43.167.2","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":2,"port":22020},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"LACNIC","srcTTL":[50],"srcTTLCnt":1,"tags":["frantech-ts","honeypot","sensor:frantech-ts"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-4-8-1-3_1400_13"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":215530772},"totDataBytes":0} +{"@timestamp":1788076418406,"_id":"260830-wcO31Aw7AmdLtasIr1OZwNT-","_index":"arkime_sessions3-260830","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["Private Layer INC"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["Private Layer Inc"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":74,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":1,"port":5060},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[81786],"firstPacket":1788075441533,"ipProtocol":6,"lastPacket":1788075441686,"length":153,"network":{"bytes":202,"community_id":"1:byKkU7BMHgTUnfHnOtH9YlL4Nvc=","packets":3},"node":"spark-afae","packetPos":[-81786,4180348,90,338],"packetRange":{"gte":1788075441533,"lte":1788075441686},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51852 Private Layer INC","number":51852,"organization":{"name":"Private Layer INC"}},"bytes":128,"geo":{"country_iso_code":"CH"},"ip":"179.43.167.2","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":2,"port":28440},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"LACNIC","srcTTL":[50],"srcTTLCnt":1,"tags":["frantech-ts","sensor:frantech-ts","honeypot"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-4-8-1-3_1400_13"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":1404748692},"totDataBytes":0} +{"@timestamp":1788074605196,"_id":"260830-1zGLPWJXGChDx4L9sUtRS3Q6","_index":"arkime_sessions3-260830","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["Private Layer INC"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["Private Layer Inc"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":74,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":1,"port":5060},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[81774],"firstPacket":1788073713681,"ipProtocol":6,"lastPacket":1788073713834,"length":153,"network":{"bytes":202,"community_id":"1:hDvYV0H1En43MlIuemew2lkFPlw=","packets":3},"node":"spark-afae","packetPos":[-81774,260525,90,0],"packetRange":{"gte":1788073713681,"lte":1788073713834},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51852 Private Layer INC","number":51852,"organization":{"name":"Private Layer INC"}},"bytes":128,"geo":{"country_iso_code":"CH"},"ip":"179.43.167.2","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":2,"port":1766},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"LACNIC","srcTTL":[50],"srcTTLCnt":1,"tags":["honeypot","sensor:frantech-ts","frantech-ts"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-4-8-1-3_1400_13"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":2638384215},"totDataBytes":0} +{"@timestamp":1788073102098,"_id":"260830-oTF0Wi0M4XpIaatfZR1KtBpd","_index":"arkime_sessions3-260830","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["Private Layer INC"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["Private Layer Inc"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":74,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":1,"port":5060},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[81763],"firstPacket":1788071986047,"ipProtocol":6,"lastPacket":1788071986200,"length":153,"network":{"bytes":202,"community_id":"1:+iadrOyg3KLetxMhm/Nm43QqOVY=","packets":3},"node":"spark-afae","packetPos":[-81763,6970472,90,0],"packetRange":{"gte":1788071986047,"lte":1788071986200},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51852 Private Layer INC","number":51852,"organization":{"name":"Private Layer INC"}},"bytes":128,"geo":{"country_iso_code":"CH"},"ip":"179.43.167.2","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":2,"port":18042},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"LACNIC","srcTTL":[50],"srcTTLCnt":1,"tags":["sensor:frantech-ts","frantech-ts","honeypot"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-4-8-1-3_1400_13"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":3916329058},"totDataBytes":0} +{"@timestamp":1788071292046,"_id":"260830-ScMm7ScUfCRHqY8z1i0lbjfY","_index":"arkime_sessions3-260830","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["Private Layer INC"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["Private Layer Inc"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":74,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":1,"port":5060},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[81752],"firstPacket":1788070258663,"ipProtocol":6,"lastPacket":1788070258816,"length":153,"network":{"bytes":202,"community_id":"1:vxxrgw0yMD8/JJRb/cz2mBUEomk=","packets":3},"node":"spark-afae","packetPos":[-81752,11757955,90,534],"packetRange":{"gte":1788070258663,"lte":1788070258816},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51852 Private Layer INC","number":51852,"organization":{"name":"Private Layer INC"}},"bytes":128,"geo":{"country_iso_code":"CH"},"ip":"179.43.167.2","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":2,"port":42748},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"LACNIC","srcTTL":[50],"srcTTLCnt":1,"tags":["frantech-ts","sensor:frantech-ts","honeypot"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-4-8-1-3_1400_13"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":4033903414},"totDataBytes":0} +{"@timestamp":1788069178277,"_id":"260830-EsNKLXV_Hh9NfZQQ7-7bVEbQ","_index":"arkime_sessions3-260830","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["Private Layer INC"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["Private Layer Inc"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":74,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":1,"port":5060},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[81738],"firstPacket":1788068531028,"ipProtocol":6,"lastPacket":1788068531180,"length":152,"network":{"bytes":202,"community_id":"1:ZIcBsRz/JxCeTdNZ787K8G1z5HI=","packets":3},"node":"spark-afae","packetPos":[-81738,9775885,90,0],"packetRange":{"gte":1788068531028,"lte":1788068531180},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51852 Private Layer INC","number":51852,"organization":{"name":"Private Layer INC"}},"bytes":128,"geo":{"country_iso_code":"CH"},"ip":"179.43.167.2","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":2,"port":50744},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"LACNIC","srcTTL":[50],"srcTTLCnt":1,"tags":["frantech-ts","sensor:frantech-ts","honeypot"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-4-8-1-3_1400_13"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":777090955},"totDataBytes":0} +{"@timestamp":1788067680128,"_id":"260830-8cKTfAppNqlF54Dy-DyL0kXe","_index":"arkime_sessions3-260830","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["Private Layer INC"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["Private Layer Inc"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":74,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":1,"port":5060},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[81727],"firstPacket":1788066803032,"ipProtocol":6,"lastPacket":1788066803184,"length":152,"network":{"bytes":202,"community_id":"1:W/HABediltgy0/OKXcol1kMLA1g=","packets":3},"node":"spark-afae","packetPos":[-81727,6084153,90,590],"packetRange":{"gte":1788066803032,"lte":1788066803184},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51852 Private Layer INC","number":51852,"organization":{"name":"Private Layer INC"}},"bytes":128,"geo":{"country_iso_code":"CH"},"ip":"179.43.167.2","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":2,"port":19264},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"LACNIC","srcTTL":[50],"srcTTLCnt":1,"tags":["sensor:frantech-ts","frantech-ts","honeypot"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-4-8-1-3_1400_13"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":3925690388},"totDataBytes":0} +{"@timestamp":1788065575448,"_id":"260830-xcIcqeD_drxMU4xAnLggQSP3","_index":"arkime_sessions3-260830","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["Private Layer INC"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["Private Layer Inc"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":74,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":1,"port":5060},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[81714],"firstPacket":1788065074416,"ipProtocol":6,"lastPacket":1788065074569,"length":153,"network":{"bytes":202,"community_id":"1:VfIvtq8tS4rhIZNYlPAPHg8Js1I=","packets":3},"node":"spark-afae","packetPos":[-81714,12121362,90,1378],"packetRange":{"gte":1788065074416,"lte":1788065074569},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51852 Private Layer INC","number":51852,"organization":{"name":"Private Layer INC"}},"bytes":128,"geo":{"country_iso_code":"CH"},"ip":"179.43.167.2","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":2,"port":54488},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"LACNIC","srcTTL":[50],"srcTTLCnt":1,"tags":["sensor:frantech-ts","frantech-ts","honeypot"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-4-8-1-3_1400_13"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":2142164314},"totDataBytes":0} +{"@timestamp":1788064052076,"_id":"260830-bzBc0jkpKZJIApiO1SOATGDy","_index":"arkime_sessions3-260830","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["Private Layer INC"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["Private Layer Inc"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":74,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":1,"port":5060},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[81703],"firstPacket":1788063346192,"ipProtocol":6,"lastPacket":1788063346344,"length":152,"network":{"bytes":202,"community_id":"1:WvionPxT0G+Yd+TmDq42TAaWrxo=","packets":3},"node":"spark-afae","packetPos":[-81703,12191005,90,0],"packetRange":{"gte":1788063346192,"lte":1788063346344},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51852 Private Layer INC","number":51852,"organization":{"name":"Private Layer INC"}},"bytes":128,"geo":{"country_iso_code":"CH"},"ip":"179.43.167.2","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":2,"port":8642},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"LACNIC","srcTTL":[50],"srcTTLCnt":1,"tags":["sensor:frantech-ts","frantech-ts","honeypot"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-4-8-1-3_1400_13"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":599019000},"totDataBytes":0} +{"@timestamp":1788061940754,"_id":"260830-YsJ70LECCfFNyLZVJsyA99_v","_index":"arkime_sessions3-260830","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["Private Layer INC"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["Private Layer Inc"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":74,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":1,"port":5060},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[81690],"firstPacket":1788061617608,"ipProtocol":6,"lastPacket":1788061617760,"length":152,"network":{"bytes":202,"community_id":"1:GBdF3wWdfiBdC33lOqLSbcokJrw=","packets":3},"node":"spark-afae","packetPos":[-81690,10249286,90,1278],"packetRange":{"gte":1788061617608,"lte":1788061617760},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51852 Private Layer INC","number":51852,"organization":{"name":"Private Layer INC"}},"bytes":128,"geo":{"country_iso_code":"CH"},"ip":"179.43.167.2","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":2,"port":19098},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"LACNIC","srcTTL":[50],"srcTTLCnt":1,"tags":["sensor:frantech-ts","frantech-ts","honeypot"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-4-8-1-3_1400_13"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":2663502667},"totDataBytes":0} +{"@timestamp":1788053802757,"_id":"260830-m8FqOBtHcKlGJ6FlKfcq7SRz","_index":"arkime_sessions3-260830","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["Private Layer INC"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["Private Layer Inc"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":74,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":1,"port":5060},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[81636],"firstPacket":1788053213577,"ipProtocol":6,"lastPacket":1788053213729,"length":152,"network":{"bytes":202,"community_id":"1:Fs6h5KOYMsjQGdKNId/9sXeLKsM=","packets":3},"node":"spark-afae","packetPos":[-81636,6065419,90,242],"packetRange":{"gte":1788053213577,"lte":1788053213729},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51852 Private Layer INC","number":51852,"organization":{"name":"Private Layer INC"}},"bytes":128,"geo":{"country_iso_code":"CH"},"ip":"179.43.167.2","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":2,"port":44020},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"LACNIC","srcTTL":[50],"srcTTLCnt":1,"tags":["honeypot","sensor:frantech-ts","frantech-ts"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-4-8-1-3_1400_13"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":1059631486},"totDataBytes":0} +{"@timestamp":1788053203073,"_id":"260830-5S7rCS_0UhlD171o9VeCO-jv","_index":"arkime_sessions3-260830","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["Private Layer INC"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["Private Layer Inc"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":74,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":1,"port":5060},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[81631],"firstPacket":1788052195147,"ipProtocol":6,"lastPacket":1788052195298,"length":151,"network":{"bytes":202,"community_id":"1:V4mftgeEDQllbvas2Cr73Dx5NW4=","packets":3},"node":"spark-afae","packetPos":[-81631,4261197,90,160],"packetRange":{"gte":1788052195147,"lte":1788052195298},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51852 Private Layer INC","number":51852,"organization":{"name":"Private Layer INC"}},"bytes":128,"geo":{"country_iso_code":"CH"},"ip":"179.43.167.2","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":2,"port":11474},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"LACNIC","srcTTL":[50],"srcTTLCnt":1,"tags":["sensor:frantech-ts","frantech-ts","honeypot"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-4-8-1-3_1400_13"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":1069536578},"totDataBytes":0} +{"@timestamp":1788052289018,"_id":"260830-xC6ifYcWVjxFxYnU9ReP99w4","_index":"arkime_sessions3-260830","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["Private Layer INC"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["Private Layer Inc"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":74,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":1,"port":5060},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[81625],"firstPacket":1788051174385,"ipProtocol":6,"lastPacket":1788051174537,"length":152,"network":{"bytes":202,"community_id":"1:KLhJFMyJ55gr+Yo5kqp9LEjoduA=","packets":3},"node":"spark-afae","packetPos":[-81625,1113442,90,978],"packetRange":{"gte":1788051174385,"lte":1788051174537},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51852 Private Layer INC","number":51852,"organization":{"name":"Private Layer INC"}},"bytes":128,"geo":{"country_iso_code":"CH"},"ip":"179.43.167.2","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":2,"port":12294},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"LACNIC","srcTTL":[50],"srcTTLCnt":1,"tags":["frantech-ts","sensor:frantech-ts","honeypot"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-4-8-1-3_1400_13"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":3759827990},"totDataBytes":0} +{"@timestamp":1788051080546,"_id":"260830-0UCETV8aQCJLIZe1h7iUM23x","_index":"arkime_sessions3-260830","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["Private Layer INC"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["Private Layer Inc"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":74,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":1,"port":5060},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[81618],"firstPacket":1788050150599,"ipProtocol":6,"lastPacket":1788050150752,"length":153,"network":{"bytes":202,"community_id":"1:JL3Z5rVcvl99IDk6eXICGraibx4=","packets":3},"node":"spark-afae","packetPos":[-81618,402066,90,3103],"packetRange":{"gte":1788050150599,"lte":1788050150752},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51852 Private Layer INC","number":51852,"organization":{"name":"Private Layer INC"}},"bytes":128,"geo":{"country_iso_code":"CH"},"ip":"179.43.167.2","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":2,"port":40186},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"LACNIC","srcTTL":[50],"srcTTLCnt":1,"tags":["sensor:frantech-ts","honeypot","frantech-ts"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-4-8-1-3_1400_13"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":1045210964},"totDataBytes":0} +{"@timestamp":1788049563201,"_id":"260830-Yi6xhGWSC0JACpU3NRtix8HU","_index":"arkime_sessions3-260830","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["Private Layer INC"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["Private Layer Inc"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":74,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":1,"port":5060},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[81606],"firstPacket":1788049125164,"ipProtocol":6,"lastPacket":1788049125317,"length":153,"network":{"bytes":202,"community_id":"1:w6lDqFPN0xY66N1Yfqx3wzKFS7c=","packets":3},"node":"spark-afae","packetPos":[-81606,3628798,90,648],"packetRange":{"gte":1788049125164,"lte":1788049125317},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51852 Private Layer INC","number":51852,"organization":{"name":"Private Layer INC"}},"bytes":128,"geo":{"country_iso_code":"CH"},"ip":"179.43.167.2","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":2,"port":5056},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"LACNIC","srcTTL":[50],"srcTTLCnt":1,"tags":["honeypot","frantech-ts","sensor:frantech-ts"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-4-8-1-3_1400_13"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":52786298},"totDataBytes":0} +{"@timestamp":1788048678211,"_id":"260830-F8HHkGg4l91GKY27hGrT_dJ5","_index":"arkime_sessions3-260830","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["Private Layer INC"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["Private Layer Inc"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":74,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":1,"port":5060},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[81601],"firstPacket":1788048098920,"ipProtocol":6,"lastPacket":1788048099072,"length":152,"network":{"bytes":202,"community_id":"1:JdAr8RoWeHpM/QK+I7v/Vetaa54=","packets":3},"node":"spark-afae","packetPos":[-81601,2972395,90,0],"packetRange":{"gte":1788048098920,"lte":1788048099072},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51852 Private Layer INC","number":51852,"organization":{"name":"Private Layer INC"}},"bytes":128,"geo":{"country_iso_code":"CH"},"ip":"179.43.167.2","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":2,"port":1360},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"LACNIC","srcTTL":[50],"srcTTLCnt":1,"tags":["honeypot","frantech-ts","sensor:frantech-ts"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-4-8-1-3_1400_13"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":1841884800},"totDataBytes":0} +{"@timestamp":1788047769116,"_id":"260829-IC4dNx37N5lKPZ3LeIadnh8-","_index":"arkime_sessions3-260829","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["Private Layer INC"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["Private Layer Inc"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":74,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":1,"port":5060},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[81595],"firstPacket":1788047070783,"ipProtocol":6,"lastPacket":1788047070936,"length":153,"network":{"bytes":202,"community_id":"1:vlVbCPWaRUPUwBxObSpySFEKCBU=","packets":3},"node":"spark-afae","packetPos":[-81595,13555544,90,340],"packetRange":{"gte":1788047070783,"lte":1788047070936},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51852 Private Layer INC","number":51852,"organization":{"name":"Private Layer INC"}},"bytes":128,"geo":{"country_iso_code":"CH"},"ip":"179.43.167.2","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":2,"port":24854},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"LACNIC","srcTTL":[50],"srcTTLCnt":1,"tags":["sensor:frantech-ts","honeypot","frantech-ts"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-4-8-1-3_1400_13"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":3441531624},"totDataBytes":0} +{"@timestamp":1788046560355,"_id":"260829-m0BdL_jtJANLoplQ64_ylyqR","_index":"arkime_sessions3-260829","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["Private Layer INC"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["Private Layer Inc"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":74,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":1,"port":5060},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[81588],"firstPacket":1788046040277,"ipProtocol":6,"lastPacket":1788046040430,"length":153,"network":{"bytes":202,"community_id":"1:d6lXf4aQK3i/MXTEyN0bnOi/MnQ=","packets":3},"node":"spark-afae","packetPos":[-81588,9530243,90,270],"packetRange":{"gte":1788046040277,"lte":1788046040430},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51852 Private Layer INC","number":51852,"organization":{"name":"Private Layer INC"}},"bytes":128,"geo":{"country_iso_code":"CH"},"ip":"179.43.167.2","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":2,"port":8288},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"LACNIC","srcTTL":[50],"srcTTLCnt":1,"tags":["honeypot","sensor:frantech-ts","frantech-ts"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-4-8-1-3_1400_13"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":1399286988},"totDataBytes":0} +{"@timestamp":1788045944300,"_id":"260829-6S2ioIGrVsRAzYTv-sV-eJaf","_index":"arkime_sessions3-260829","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["Private Layer INC"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["Private Layer Inc"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":74,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":1,"port":5060},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[81582],"firstPacket":1788045009772,"ipProtocol":6,"lastPacket":1788045009924,"length":152,"network":{"bytes":202,"community_id":"1:uT0PaCYWfy9fuvBGBA6MVoO8UKU=","packets":3},"node":"spark-afae","packetPos":[-81582,17263285,90,398],"packetRange":{"gte":1788045009772,"lte":1788045009924},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51852 Private Layer INC","number":51852,"organization":{"name":"Private Layer INC"}},"bytes":128,"geo":{"country_iso_code":"CH"},"ip":"179.43.167.2","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":2,"port":42182},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"LACNIC","srcTTL":[50],"srcTTLCnt":1,"tags":["sensor:frantech-ts","honeypot","frantech-ts"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-4-8-1-3_1400_13"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":3761630476},"totDataBytes":0} +{"@timestamp":1788045044402,"_id":"260829-hUDGzLBkoStPc6i0o8-E0UU6","_index":"arkime_sessions3-260829","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["Private Layer INC"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["Private Layer Inc"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":74,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":1,"port":5060},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[81577],"firstPacket":1788043977596,"ipProtocol":6,"lastPacket":1788043977748,"length":152,"network":{"bytes":202,"community_id":"1:8hMjqReKp50R/KXLAYSqb2OfAkM=","packets":3},"node":"spark-afae","packetPos":[-81577,13958254,90,0],"packetRange":{"gte":1788043977596,"lte":1788043977748},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51852 Private Layer INC","number":51852,"organization":{"name":"Private Layer INC"}},"bytes":128,"geo":{"country_iso_code":"CH"},"ip":"179.43.167.2","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":2,"port":15344},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"LACNIC","srcTTL":[50],"srcTTLCnt":1,"tags":["frantech-ts","sensor:frantech-ts","honeypot"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-4-8-1-3_1400_13"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":1446188082},"totDataBytes":0} +{"@timestamp":1788044141302,"_id":"260829-py1mdXleXztIFIkHlSfbDi-H","_index":"arkime_sessions3-260829","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["Private Layer INC"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["Private Layer Inc"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":74,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":1,"port":5060},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[81571],"firstPacket":1788042943349,"ipProtocol":6,"lastPacket":1788042943501,"length":152,"network":{"bytes":202,"community_id":"1:gs/MCXA5cMvOjJ+cNSMtF6X4q5o=","packets":3},"node":"spark-afae","packetPos":[-81571,289665,90,1296],"packetRange":{"gte":1788042943349,"lte":1788042943501},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51852 Private Layer INC","number":51852,"organization":{"name":"Private Layer INC"}},"bytes":128,"geo":{"country_iso_code":"CH"},"ip":"179.43.167.2","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":2,"port":22132},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"LACNIC","srcTTL":[50],"srcTTLCnt":1,"tags":["frantech-ts","sensor:frantech-ts","honeypot"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-4-8-1-3_1400_13"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":739345912},"totDataBytes":0} +{"@timestamp":1788042334054,"_id":"260829-ZS176jD1Ku9NfK5APi8zz4gb","_index":"arkime_sessions3-260829","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["Private Layer INC"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["Private Layer Inc"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":74,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":1,"port":5060},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[81559],"firstPacket":1788041911147,"ipProtocol":6,"lastPacket":1788041911300,"length":153,"network":{"bytes":202,"community_id":"1:FxGVKTPFxciBDKA2beZPAISOqSY=","packets":3},"node":"spark-afae","packetPos":[-81559,15121354,90,300],"packetRange":{"gte":1788041911147,"lte":1788041911300},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51852 Private Layer INC","number":51852,"organization":{"name":"Private Layer INC"}},"bytes":128,"geo":{"country_iso_code":"CH"},"ip":"179.43.167.2","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":2,"port":29248},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"LACNIC","srcTTL":[50],"srcTTLCnt":1,"tags":["sensor:frantech-ts","honeypot","frantech-ts"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-4-8-1-3_1400_13"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":2128892515},"totDataBytes":0} +{"@timestamp":1788041432970,"_id":"260829-RC3bnf__DkRL3aYXx1zs4ccV","_index":"arkime_sessions3-260829","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["Private Layer INC"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["Private Layer Inc"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":74,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":1,"port":5060},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[81553],"firstPacket":1788040878730,"ipProtocol":6,"lastPacket":1788040878882,"length":152,"network":{"bytes":202,"community_id":"1:W8lD4VXwVMK9z9F0HRqJW98nTEk=","packets":3},"node":"spark-afae","packetPos":[-81553,12616576,90,1938],"packetRange":{"gte":1788040878730,"lte":1788040878882},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51852 Private Layer INC","number":51852,"organization":{"name":"Private Layer INC"}},"bytes":128,"geo":{"country_iso_code":"CH"},"ip":"179.43.167.2","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":2,"port":34554},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"LACNIC","srcTTL":[50],"srcTTLCnt":1,"tags":["sensor:frantech-ts","honeypot","frantech-ts"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-4-8-1-3_1400_13"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":2250673041},"totDataBytes":0} +{"@timestamp":1788040532223,"_id":"260829-RcDozSabHF1Kf6dPMcTd2ibp","_index":"arkime_sessions3-260829","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["Private Layer INC"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["Private Layer Inc"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":74,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":1,"port":5060},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[81546],"firstPacket":1788039846333,"ipProtocol":6,"lastPacket":1788039846485,"length":152,"network":{"bytes":202,"community_id":"1:SmQ6ZrseVzfEpp0lI/RNoO55S00=","packets":3},"node":"spark-afae","packetPos":[-81546,8465058,90,1016],"packetRange":{"gte":1788039846333,"lte":1788039846485},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51852 Private Layer INC","number":51852,"organization":{"name":"Private Layer INC"}},"bytes":128,"geo":{"country_iso_code":"CH"},"ip":"179.43.167.2","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":2,"port":49128},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"LACNIC","srcTTL":[50],"srcTTLCnt":1,"tags":["sensor:frantech-ts","honeypot","frantech-ts"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-4-8-1-3_1400_13"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":3392562308},"totDataBytes":0} +{"@timestamp":1788039621870,"_id":"260829-Ay0qnyNBULNO8K7zUO2hLmf2","_index":"arkime_sessions3-260829","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["Private Layer INC"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["Private Layer Inc"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":74,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":1,"port":5060},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[81540],"firstPacket":1788038812570,"ipProtocol":6,"lastPacket":1788038812722,"length":152,"network":{"bytes":202,"community_id":"1:wnc9mAOFnslnLRB3RM5SlHTfTos=","packets":3},"node":"spark-afae","packetPos":[-81540,5784489,90,0],"packetRange":{"gte":1788038812570,"lte":1788038812722},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51852 Private Layer INC","number":51852,"organization":{"name":"Private Layer INC"}},"bytes":128,"geo":{"country_iso_code":"CH"},"ip":"179.43.167.2","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":2,"port":21290},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"LACNIC","srcTTL":[50],"srcTTLCnt":1,"tags":["honeypot","sensor:frantech-ts","frantech-ts"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-4-8-1-3_1400_13"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":2509515529},"totDataBytes":0} +{"@timestamp":1788038696048,"_id":"260829-4izuicNqyBlPlpaOxvb0I8vV","_index":"arkime_sessions3-260829","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["Private Layer INC"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["Private Layer Inc"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":74,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":1,"port":5060},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[81534],"firstPacket":1788037777085,"ipProtocol":6,"lastPacket":1788037777237,"length":152,"network":{"bytes":202,"community_id":"1:n9QWhK6cTj+fjhk7/2BzCaqywaA=","packets":3},"node":"spark-afae","packetPos":[-81534,4945928,90,1470],"packetRange":{"gte":1788037777085,"lte":1788037777237},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51852 Private Layer INC","number":51852,"organization":{"name":"Private Layer INC"}},"bytes":128,"geo":{"country_iso_code":"CH"},"ip":"179.43.167.2","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":2,"port":19026},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"LACNIC","srcTTL":[50],"srcTTLCnt":1,"tags":["frantech-ts","honeypot","sensor:frantech-ts"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-4-8-1-3_1400_13"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":1833271266},"totDataBytes":0} +{"@timestamp":1788037794908,"_id":"260829-wSxPxFwZVmJNhqfWoElRFypQ","_index":"arkime_sessions3-260829","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["Private Layer INC"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["Private Layer Inc"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":74,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":1,"port":5060},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[81528],"firstPacket":1788036742213,"ipProtocol":6,"lastPacket":1788036742366,"length":153,"network":{"bytes":202,"community_id":"1:bzSBTMIhcr/rtYi4uZpkB5JaRS8=","packets":3},"node":"spark-afae","packetPos":[-81528,2505609,90,160],"packetRange":{"gte":1788036742213,"lte":1788036742366},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51852 Private Layer INC","number":51852,"organization":{"name":"Private Layer INC"}},"bytes":128,"geo":{"country_iso_code":"CH"},"ip":"179.43.167.2","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":2,"port":31552},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"LACNIC","srcTTL":[50],"srcTTLCnt":1,"tags":["frantech-ts","sensor:frantech-ts","honeypot"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-4-8-1-3_1400_13"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":3382166870},"totDataBytes":0} +{"@timestamp":1788035996083,"_id":"260829-zL8axxyl_ntJMK0VarkJsznD","_index":"arkime_sessions3-260829","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["Private Layer INC"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["Private Layer Inc"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":74,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":1,"port":5060},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[81515],"firstPacket":1788035705356,"ipProtocol":6,"lastPacket":1788035705508,"length":152,"network":{"bytes":202,"community_id":"1:oLlDsV301I+fMLnRSpULFukxP5I=","packets":3},"node":"spark-afae","packetPos":[-81515,4555417,90,940],"packetRange":{"gte":1788035705356,"lte":1788035705508},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51852 Private Layer INC","number":51852,"organization":{"name":"Private Layer INC"}},"bytes":128,"geo":{"country_iso_code":"CH"},"ip":"179.43.167.2","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":2,"port":45666},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"LACNIC","srcTTL":[50],"srcTTLCnt":1,"tags":["sensor:frantech-ts","honeypot","frantech-ts"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-4-8-1-3_1400_13"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":1502402126},"totDataBytes":0} +{"@timestamp":1788032086822,"_id":"260829-8Std4LVu-ApMBK9zmM0yp2k3","_index":"arkime_sessions3-260829","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Kaopu Cloud HK Limited"],"isp.dstCnt":1,"isp.src":["Private Layer INC"],"isp.srcCnt":1,"org.dst":["LightNode-BH"],"org.dstCnt":1,"org.src":["Private Layer Inc"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":0,"geo":{"country_iso_code":"BH"},"ip":"38.54.2.209","mac":["52:54:8f:9d:76:48"],"mac-cnt":1,"packets":0,"port":5060},"dstRIR":"ARIN","ethertype":2048,"fileId":[81491],"firstPacket":1788031039926,"ipProtocol":6,"lastPacket":1788031039926,"length":0,"network":{"bytes":58,"community_id":"1:HFsTF6b8XWkjn6Vdv8SnJyEI9YM=","packets":1},"node":"spark-afae","packetPos":[-81491,427064],"packetRange":{"gte":1788031039926,"lte":1788031039926},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51852 Private Layer INC","number":51852,"organization":{"name":"Private Layer INC"}},"bytes":58,"geo":{"country_iso_code":"CH"},"ip":"179.43.167.2","mac":["98:44:ce:60:15:19"],"mac-cnt":1,"packets":1,"port":42529},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Huawei Technologies Co.,Ltd"],"srcOuiCnt":1,"srcRIR":"LACNIC","srcTTL":[240],"srcTTLCnt":1,"tags":["bahrain-sponge-01-ts","honeypot","sensor:bahrain-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["1025_2_1460_00"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":3658342513},"totDataBytes":0} +{"@timestamp":1788032086730,"_id":"260829-9z9bA7qUvhdO9LogqR6zmzPt","_index":"arkime_sessions3-260829","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["netcup GmbH"],"isp.dstCnt":1,"isp.src":["Private Layer INC"],"isp.srcCnt":1,"org.dst":["Netcup KVM"],"org.dstCnt":1,"org.src":["Private Layer Inc"],"org.srcCnt":1,"usertype.dst":["business"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS197540 netcup GmbH","number":197540,"organization":{"name":"netcup GmbH"}},"bytes":0,"geo":{"country_iso_code":"DE"},"ip":"159.195.21.150","mac":["8a:41:d3:b8:0d:d3"],"mac-cnt":1,"packets":0,"port":5060},"dstRIR":"ARIN","ethertype":2048,"fileId":[81489],"firstPacket":1788030982173,"ipProtocol":6,"lastPacket":1788030982173,"length":0,"network":{"bytes":58,"community_id":"1:F7sRfecPRlV9kMYWHbIe0Gk4gq4=","packets":1},"node":"spark-afae","packetPos":[-81489,43467],"packetRange":{"gte":1788030982173,"lte":1788030982173},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51852 Private Layer INC","number":51852,"organization":{"name":"Private Layer INC"}},"bytes":58,"geo":{"country_iso_code":"CH"},"ip":"179.43.167.2","mac":["bc:0f:fe:38:0b:a3"],"mac-cnt":1,"packets":1,"port":42545},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"LACNIC","srcTTL":[245],"srcTTLCnt":1,"tags":["sensor:netcup-ts","netcup-ts","honeypot"],"tagsCnt":3,"tcp":{"ja4t":["1025_2_1460_00"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":3619368882},"totDataBytes":0} +{"@timestamp":1788031784389,"_id":"260829-ar-KnS_4uk5GZKeZyhNSVaDE","_index":"arkime_sessions3-260829","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Hetzner Online GmbH"],"isp.dstCnt":1,"isp.src":["Private Layer INC"],"isp.srcCnt":1,"org.dst":["HETZNER-DC"],"org.dstCnt":1,"org.src":["Private Layer Inc"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS24940 Hetzner Online GmbH","number":24940,"organization":{"name":"Hetzner Online GmbH"}},"bytes":0,"geo":{"country_iso_code":"FI"},"ip":"89.167.72.144","mac":["92:00:07:4c:82:70"],"mac-cnt":1,"packets":0,"port":5060},"dstRIR":"RIPE","ethertype":2048,"fileId":[81487],"firstPacket":1788030726110,"ipProtocol":6,"lastPacket":1788030726110,"length":0,"network":{"bytes":58,"community_id":"1:HIR58sl/8FJAa8XuMBeNw/c3++M=","packets":1},"node":"spark-afae","packetPos":[-81487,244875],"packetRange":{"gte":1788030726110,"lte":1788030726110},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51852 Private Layer INC","number":51852,"organization":{"name":"Private Layer INC"}},"bytes":58,"geo":{"country_iso_code":"CH"},"ip":"179.43.167.2","mac":["d2:74:7f:6e:37:e3"],"mac-cnt":1,"packets":1,"port":42529},"spoofable":["true"],"spoofableCnt":1,"srcRIR":"LACNIC","srcTTL":[242],"srcTTLCnt":1,"tags":["sensor:sponge-01-ts","sponge-01-ts","honeypot"],"tagsCnt":3,"tcp":{"ja4t":["1025_2_1460_00"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":3731721594},"totDataBytes":0} +{"@timestamp":1788027269466,"_id":"260829-Qis8Ig-gMCVMDIv0WKnnQKMa","_index":"arkime_sessions3-260829","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Private Layer INC"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Private Layer Inc"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":0,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":0,"port":5060},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[81458],"firstPacket":1788026610307,"ipProtocol":6,"lastPacket":1788026610307,"length":0,"network":{"bytes":60,"community_id":"1:dkrF4B7furyXw1jMjAz/jhrYgak=","packets":1},"node":"spark-afae","packetPos":[-81458,1193271],"packetRange":{"gte":1788026610307,"lte":1788026610307},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51852 Private Layer INC","number":51852,"organization":{"name":"Private Layer INC"}},"bytes":60,"geo":{"country_iso_code":"CH"},"ip":"179.43.167.2","mac":["fc:bd:67:9d:2b:2b"],"mac-cnt":1,"packets":1,"port":42529},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcRIR":"LACNIC","srcTTL":[243],"srcTTLCnt":1,"tags":["sensor:contabo-sponge-01-ts","contabo-sponge-01-ts","honeypot"],"tagsCnt":3,"tcp":{"ja4t":["1025_2_1460_00"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":2914157596},"totDataBytes":0} +{"@timestamp":1788024246581,"_id":"260829-1CqvypkrMbJDypjjaEzjiTnE","_index":"arkime_sessions3-260829","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["Private Layer INC"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["Private Layer Inc"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":58,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":1,"port":5060},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[81438],"firstPacket":1788023175653,"ipProtocol":6,"lastPacket":1788023175811,"length":158,"network":{"bytes":228,"community_id":"1:N1tNIAlTU0cnEXhiIao1RDYQ8g0=","packets":4},"node":"spark-afae","packetPos":[-81438,201512,74,658,70],"packetRange":{"gte":1788023175653,"lte":1788023175811},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51852 Private Layer INC","number":51852,"organization":{"name":"Private Layer INC"}},"bytes":170,"geo":{"country_iso_code":"CH"},"ip":"179.43.167.2","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":3,"port":42545},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"LACNIC","srcTTL":[50,241],"srcTTLCnt":2,"tags":["honeypot","frantech-ts","sensor:frantech-ts"],"tagsCnt":3,"tcp":{"ja4t":["1025_2_1400_00"],"ja4tCnt":1,"ja4ts":["64240_2_1460_00"],"ja4tsCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":2,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":804529315},"totDataBytes":0} +{"@timestamp":1788023946002,"_id":"260829-mr5jPuIo22pMC4A1HVljILJI","_index":"arkime_sessions3-260829","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo GmbH"],"isp.dstCnt":1,"isp.src":["Private Layer INC"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Private Layer Inc"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS51167 Contabo GmbH","number":51167,"organization":{"name":"Contabo GmbH"}},"bytes":0,"geo":{"country_iso_code":"FR"},"ip":"109.123.246.142","mac":["00:50:56:63:46:a6"],"mac-cnt":1,"packets":0,"port":5060},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[81435],"firstPacket":1788022912114,"ipProtocol":6,"lastPacket":1788022912114,"length":0,"network":{"bytes":60,"community_id":"1:4kMZE6pGewJJ4HoInJUFY5j2cY0=","packets":1},"node":"spark-afae","packetPos":[-81435,739308],"packetRange":{"gte":1788022912114,"lte":1788022912114},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51852 Private Layer INC","number":51852,"organization":{"name":"Private Layer INC"}},"bytes":60,"geo":{"country_iso_code":"CH"},"ip":"179.43.167.2","mac":["c0:69:11:cd:1f:19"],"mac-cnt":1,"packets":1,"port":42545},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcRIR":"LACNIC","srcTTL":[246],"srcTTLCnt":1,"tags":["sensor:contabo-sponge-02-ts","proxy","contabo-sponge-02-ts"],"tagsCnt":3,"tcp":{"ja4t":["1025_2_1460_00"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":4205690105},"totDataBytes":0} +{"@timestamp":1787686412368,"_id":"260825-f6CEUHmJTmdJlqBriAESBogb","_index":"arkime_sessions3-260825","client":{"bytes":1016},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["netcup GmbH"],"isp.dstCnt":1,"isp.src":["Private Layer INC"],"isp.srcCnt":1,"org.dst":["Netcup KVM"],"org.dstCnt":1,"org.src":["Private Layer Inc"],"org.srcCnt":1,"usertype.dst":["business"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS197540 netcup GmbH","number":197540,"organization":{"name":"netcup GmbH"}},"bytes":0,"geo":{"country_iso_code":"DE"},"ip":"159.195.21.150","mac":["8a:41:d3:b8:0d:d3"],"mac-cnt":1,"packets":0,"port":5060},"dstRIR":"ARIN","ethertype":2048,"fileId":[79395],"firstPacket":1787686017959,"ipProtocol":17,"lastPacket":1787686017959,"length":0,"network":{"bytes":1058,"community_id":"1:7AnH0XAaTyE661Wc1yEaM/9JHbk=","packets":1},"node":"spark-afae","packetPos":[-79395,1480971],"packetRange":{"gte":1787686017959,"lte":1787686017959},"protocol":["udp","sip"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":0},"sip":{"callid":["Un6Y04y67FIR4bMMXJtfJc.."],"callidCnt":1,"contact":["\u003csip:17168465496@179.43.167.2:26631\u003e"],"contactCnt":1,"from":["\u003csip:17168465496@179.43.167.2\u003e;tag=4920fd1d"],"fromCnt":1,"method":["INVITE"],"methodCnt":1,"to":["\u003csip:8103908351673002@159.195.21.150:5060\u003e"],"toCnt":1,"user":["8103908351673002","17168465496"],"userCnt":2,"useragent":["OpenVox"],"useragentCnt":1,"via":["SIP/2.0/UDP 179.43.167.2:26631;branch=z9hG4bK-524287-1---bfa9515ffed485b6"],"viaCnt":1},"source":{"as":{"full":"AS51852 Private Layer INC","number":51852,"organization":{"name":"Private Layer INC"}},"bytes":1058,"geo":{"country_iso_code":"CH"},"ip":"179.43.167.2","mac":["bc:0f:fe:38:0b:a3"],"mac-cnt":1,"packets":1,"port":26631},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcPayload8":"494e564954452073","srcRIR":"LACNIC","srcTTL":[54],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["461308078748594"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["b05640bd-eb2a-4d9d-8d73-d14d7cbeb44a"],"signatureCnt":1,"signatureId":[1071802],"signatureIdCnt":1},"tag":{"block":["false"],"blockCnt":1,"category":["protocol"],"categoryCnt":1,"description":["ip addresses with this tag have been observed sending sip traffic."],"intention":["unknown"],"intentionCnt":1,"name":["sip protocol"],"nameCnt":1},"tags":["netcup-ts","honeypot","sensor:netcup-ts"],"tagsCnt":3,"totDataBytes":1016} +{"@timestamp":1787683061865,"_id":"260825-MqCCGejTU3xNrbDLJEgw1Gif","_index":"arkime_sessions3-260825","client":{"bytes":1019},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Private Layer INC"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Private Layer Inc"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":0,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":0,"port":5060},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[79376],"firstPacket":1787682213182,"ipProtocol":17,"lastPacket":1787682213182,"length":0,"network":{"bytes":1061,"community_id":"1:XLxiiDmLvds/E3gfRZpspuILYvg=","packets":1},"node":"spark-afae","packetPos":[-79376,2762257],"packetRange":{"gte":1787682213182,"lte":1787682213182},"protocol":["udp","sip"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":0},"sip":{"callid":["l4bDAGQK8PFQTqL9Rh5TJe.."],"callidCnt":1,"contact":["\u003csip:16724692132@179.43.167.2:26631\u003e"],"contactCnt":1,"from":["\u003csip:16724692132@179.43.167.2\u003e;tag=b79c5cb3"],"fromCnt":1,"method":["INVITE"],"methodCnt":1,"to":["\u003csip:8103908351673002@217.15.163.226:5060\u003e"],"toCnt":1,"user":["8103908351673002","16724692132"],"userCnt":2,"useragent":["Yate/6.0.0"],"useragentCnt":1,"via":["SIP/2.0/UDP 179.43.167.2:26631;branch=z9hG4bK-524287-1---58ed9910de873b15"],"viaCnt":1},"source":{"as":{"full":"AS51852 Private Layer INC","number":51852,"organization":{"name":"Private Layer INC"}},"bytes":1061,"geo":{"country_iso_code":"CH"},"ip":"179.43.167.2","mac":["fc:bd:67:9d:2b:2b"],"mac-cnt":1,"packets":1,"port":26631},"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcPayload8":"494e564954452073","srcRIR":"LACNIC","srcTTL":[52],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["1626403712497842"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["b05640bd-eb2a-4d9d-8d73-d14d7cbeb44a"],"signatureCnt":1,"signatureId":[1071802],"signatureIdCnt":1},"tag":{"block":["false"],"blockCnt":1,"category":["protocol"],"categoryCnt":1,"description":["ip addresses with this tag have been observed sending sip traffic."],"intention":["unknown"],"intentionCnt":1,"name":["sip protocol"],"nameCnt":1},"tags":["contabo-sponge-01-ts","honeypot","sensor:contabo-sponge-01-ts"],"tagsCnt":3,"totDataBytes":1019} +{"@timestamp":1787681534713,"_id":"260825-pP30EittxndMfKD9QPQqaJ_W","_index":"arkime_sessions3-260825","client":{"bytes":1019},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Kaopu Cloud HK Limited"],"isp.dstCnt":1,"isp.src":["Private Layer INC"],"isp.srcCnt":1,"org.dst":["LightNode-BH"],"org.dstCnt":1,"org.src":["Private Layer Inc"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":0,"geo":{"country_iso_code":"BH"},"ip":"38.54.2.209","mac":["52:54:8f:9d:76:48"],"mac-cnt":1,"packets":0,"port":5060},"dstRIR":"ARIN","ethertype":2048,"fileId":[79368],"firstPacket":1787680831708,"ipProtocol":17,"lastPacket":1787680831708,"length":0,"network":{"bytes":1061,"community_id":"1:oNeQPu1kcxGQVW2VNpGuaftbOSU=","packets":1},"node":"spark-afae","packetPos":[-79368,1042653],"packetRange":{"gte":1787680831708,"lte":1787680831708},"protocol":["udp","sip"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":0},"sip":{"callid":["Anv0jvM3Aop8bQYEF4E5mL.."],"callidCnt":1,"contact":["\u003csip:16563628947@179.43.167.2:26631\u003e"],"contactCnt":1,"from":["\u003csip:16563628947@179.43.167.2\u003e;tag=cfc9d284"],"fromCnt":1,"method":["INVITE"],"methodCnt":1,"to":["\u003csip:8103908351673002@38.54.2.209:5060\u003e"],"toCnt":1,"user":["16563628947","8103908351673002"],"userCnt":2,"useragent":["Yealink SIP-T46S"],"useragentCnt":1,"via":["SIP/2.0/UDP 179.43.167.2:26631;branch=z9hG4bK-524287-1---ee81ac434e4f1950"],"viaCnt":1},"source":{"as":{"full":"AS51852 Private Layer INC","number":51852,"organization":{"name":"Private Layer INC"}},"bytes":1061,"geo":{"country_iso_code":"CH"},"ip":"179.43.167.2","mac":["98:44:ce:60:15:19"],"mac-cnt":1,"packets":1,"port":26631},"srcOui":["Huawei Technologies Co.,Ltd"],"srcOuiCnt":1,"srcPayload8":"494e564954452073","srcRIR":"LACNIC","srcTTL":[50],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["2197338749859177"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["b05640bd-eb2a-4d9d-8d73-d14d7cbeb44a"],"signatureCnt":1,"signatureId":[1071802],"signatureIdCnt":1},"tag":{"block":["false"],"blockCnt":1,"category":["protocol"],"categoryCnt":1,"description":["ip addresses with this tag have been observed sending sip traffic."],"intention":["unknown"],"intentionCnt":1,"name":["sip protocol"],"nameCnt":1},"tags":["bahrain-sponge-01-ts","honeypot","sensor:bahrain-sponge-01-ts"],"tagsCnt":3,"totDataBytes":1019} +{"@timestamp":1787679126204,"_id":"260825-Tf1mSKKefE1KJLLO7phjF-js","_index":"arkime_sessions3-260825","client":{"bytes":1024},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo GmbH"],"isp.dstCnt":1,"isp.src":["Private Layer INC"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Private Layer Inc"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS51167 Contabo GmbH","number":51167,"organization":{"name":"Contabo GmbH"}},"bytes":0,"geo":{"country_iso_code":"FR"},"ip":"109.123.246.142","mac":["00:50:56:63:46:a6"],"mac-cnt":1,"packets":0,"port":5060},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[79354],"firstPacket":1787678581809,"ipProtocol":17,"lastPacket":1787678581809,"length":0,"network":{"bytes":1066,"community_id":"1:kIUR+WIfgssGLHaTY30dt1EUHYg=","packets":1},"node":"spark-afae","packetPos":[-79354,839113],"packetRange":{"gte":1787678581809,"lte":1787678581809},"protocol":["udp","sip"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":0},"sip":{"callid":["dGcKTlc1xzFVXpqmUS6gTf.."],"callidCnt":1,"contact":["\u003csip:16299777872@179.43.167.2:26631\u003e"],"contactCnt":1,"from":["\u003csip:16299777872@179.43.167.2\u003e;tag=b5ac4942"],"fromCnt":1,"method":["INVITE"],"methodCnt":1,"to":["\u003csip:8103908351673002@109.123.246.142:5060\u003e"],"toCnt":1,"user":["16299777872","8103908351673002"],"userCnt":2,"useragent":["Cisco CP-8851"],"useragentCnt":1,"via":["SIP/2.0/UDP 179.43.167.2:26631;branch=z9hG4bK-524287-1---092ff1a5456d4623"],"viaCnt":1},"source":{"as":{"full":"AS51852 Private Layer INC","number":51852,"organization":{"name":"Private Layer INC"}},"bytes":1066,"geo":{"country_iso_code":"CH"},"ip":"179.43.167.2","mac":["c0:69:11:cd:1f:19"],"mac-cnt":1,"packets":1,"port":26631},"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcPayload8":"494e564954452073","srcRIR":"LACNIC","srcTTL":[55],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["1504380979877684"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["b05640bd-eb2a-4d9d-8d73-d14d7cbeb44a"],"signatureCnt":1,"signatureId":[1071802],"signatureIdCnt":1},"tag":{"block":["false"],"blockCnt":1,"category":["protocol"],"categoryCnt":1,"description":["ip addresses with this tag have been observed sending sip traffic."],"intention":["unknown"],"intentionCnt":1,"name":["sip protocol"],"nameCnt":1},"tags":["proxy","sensor:contabo-sponge-02-ts","contabo-sponge-02-ts"],"tagsCnt":3,"totDataBytes":1024} +{"@timestamp":1787668582818,"_id":"260825-2PsXyilkaZRE5Z8-Ue7o7R0i","_index":"arkime_sessions3-260825","client":{"bytes":1022},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Private Layer INC"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Private Layer Inc"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":0,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":0,"port":5060},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[79296],"firstPacket":1787667676755,"ipProtocol":17,"lastPacket":1787667676755,"length":0,"network":{"bytes":1064,"community_id":"1:VA2NQG8IWuJpg/T5ANqGaR2x4hc=","packets":1},"node":"spark-afae","packetPos":[-79296,1078746],"packetRange":{"gte":1787667676755,"lte":1787667676755},"protocol":["sip","udp"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":0},"sip":{"callid":["NZsVxF9hT68IVliffpKmyZ.."],"callidCnt":1,"contact":["\u003csip:16724692132@179.43.167.2:22342\u003e"],"contactCnt":1,"from":["\u003csip:16724692132@179.43.167.2\u003e;tag=28d48438"],"fromCnt":1,"method":["INVITE"],"methodCnt":1,"to":["\u003csip:0003908351673002@217.15.163.226:5060\u003e"],"toCnt":1,"user":["16724692132","0003908351673002"],"userCnt":2,"useragent":["Cisco-CUCM6.1"],"useragentCnt":1,"via":["SIP/2.0/UDP 179.43.167.2:22342;branch=z9hG4bK-524287-1---2327a6c48bb49559"],"viaCnt":1},"source":{"as":{"full":"AS51852 Private Layer INC","number":51852,"organization":{"name":"Private Layer INC"}},"bytes":1064,"geo":{"country_iso_code":"CH"},"ip":"179.43.167.2","mac":["fc:bd:67:9d:2b:2b"],"mac-cnt":1,"packets":1,"port":22342},"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcPayload8":"494e564954452073","srcRIR":"LACNIC","srcTTL":[52],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["1273157764429593"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["b05640bd-eb2a-4d9d-8d73-d14d7cbeb44a"],"signatureCnt":1,"signatureId":[1071802],"signatureIdCnt":1},"tag":{"block":["false"],"blockCnt":1,"category":["protocol"],"categoryCnt":1,"description":["ip addresses with this tag have been observed sending sip traffic."],"intention":["unknown"],"intentionCnt":1,"name":["sip protocol"],"nameCnt":1},"tags":["honeypot","contabo-sponge-01-ts","sensor:contabo-sponge-01-ts"],"tagsCnt":3,"totDataBytes":1022} +{"@timestamp":1787664645730,"_id":"260825-Vft5npeBZjxN-L4Q7bt1DSI7","_index":"arkime_sessions3-260825","client":{"bytes":1018},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo GmbH"],"isp.dstCnt":1,"isp.src":["Private Layer INC"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Private Layer Inc"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS51167 Contabo GmbH","number":51167,"organization":{"name":"Contabo GmbH"}},"bytes":0,"geo":{"country_iso_code":"FR"},"ip":"109.123.246.142","mac":["00:50:56:63:46:a6"],"mac-cnt":1,"packets":0,"port":5060},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[79274],"firstPacket":1787664055527,"ipProtocol":17,"lastPacket":1787664055527,"length":0,"network":{"bytes":1060,"community_id":"1:5XFrow/68Qf0a1HBsLWoaE1iNZQ=","packets":1},"node":"spark-afae","packetPos":[-79274,175784],"packetRange":{"gte":1787664055527,"lte":1787664055527},"protocol":["udp","sip"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":0},"sip":{"callid":["MdRNnng9MVgSNsEYSLKsbo.."],"callidCnt":1,"contact":["\u003csip:16299777872@179.43.167.2:22342\u003e"],"contactCnt":1,"from":["\u003csip:16299777872@179.43.167.2\u003e;tag=e032d4da"],"fromCnt":1,"method":["INVITE"],"methodCnt":1,"to":["\u003csip:0003908351673002@109.123.246.142:5060\u003e"],"toCnt":1,"user":["16299777872","0003908351673002"],"userCnt":2,"useragent":["Dinstar"],"useragentCnt":1,"via":["SIP/2.0/UDP 179.43.167.2:22342;branch=z9hG4bK-524287-1---9f49d53a9e72d640"],"viaCnt":1},"source":{"as":{"full":"AS51852 Private Layer INC","number":51852,"organization":{"name":"Private Layer INC"}},"bytes":1060,"geo":{"country_iso_code":"CH"},"ip":"179.43.167.2","mac":["c0:69:11:cd:1f:19"],"mac-cnt":1,"packets":1,"port":22342},"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcPayload8":"494e564954452073","srcRIR":"LACNIC","srcTTL":[55],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["1985221277801659"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["b05640bd-eb2a-4d9d-8d73-d14d7cbeb44a"],"signatureCnt":1,"signatureId":[1071802],"signatureIdCnt":1},"tag":{"block":["false"],"blockCnt":1,"category":["protocol"],"categoryCnt":1,"description":["ip addresses with this tag have been observed sending sip traffic."],"intention":["unknown"],"intentionCnt":1,"name":["sip protocol"],"nameCnt":1},"tags":["contabo-sponge-02-ts","sensor:contabo-sponge-02-ts","proxy"],"tagsCnt":3,"totDataBytes":1018} +{"@timestamp":1787654074113,"_id":"260825-7PkcUwl7o0lAjqrnCGAQcLWF","_index":"arkime_sessions3-260825","client":{"bytes":1024},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Private Layer INC"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Private Layer Inc"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":0,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":0,"port":5060},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[79216],"firstPacket":1787653173403,"ipProtocol":17,"lastPacket":1787653173403,"length":0,"network":{"bytes":1066,"community_id":"1:T1lPzT/6FLkaIY+89LYsRMkOaEU=","packets":1},"node":"spark-afae","packetPos":[-79216,520213],"packetRange":{"gte":1787653173403,"lte":1787653173403},"protocol":["udp","sip"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":0},"sip":{"callid":["VRwlIzi9tOCLMtZzRYj9LN.."],"callidCnt":1,"contact":["\u003csip:16724692132@179.43.167.2:27009\u003e"],"contactCnt":1,"from":["\u003csip:16724692132@179.43.167.2\u003e;tag=5f0012e8"],"fromCnt":1,"method":["INVITE"],"methodCnt":1,"to":["\u003csip:98103908351673002@217.15.163.226:5060\u003e"],"toCnt":1,"user":["98103908351673002","16724692132"],"userCnt":2,"useragent":["baresip/2.9.0"],"useragentCnt":1,"via":["SIP/2.0/UDP 179.43.167.2:27009;branch=z9hG4bK-524287-1---7f649933386f4508"],"viaCnt":1},"source":{"as":{"full":"AS51852 Private Layer INC","number":51852,"organization":{"name":"Private Layer INC"}},"bytes":1066,"geo":{"country_iso_code":"CH"},"ip":"179.43.167.2","mac":["fc:bd:67:9d:2b:2b"],"mac-cnt":1,"packets":1,"port":27009},"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcPayload8":"494e564954452073","srcRIR":"LACNIC","srcTTL":[52],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["1450429409333683"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["b05640bd-eb2a-4d9d-8d73-d14d7cbeb44a"],"signatureCnt":1,"signatureId":[1071802],"signatureIdCnt":1},"tag":{"block":["false"],"blockCnt":1,"category":["protocol"],"categoryCnt":1,"description":["ip addresses with this tag have been observed sending sip traffic."],"intention":["unknown"],"intentionCnt":1,"name":["sip protocol"],"nameCnt":1},"tags":["contabo-sponge-01-ts","sensor:contabo-sponge-01-ts","honeypot"],"tagsCnt":3,"totDataBytes":1024} +{"@timestamp":1787652576260,"_id":"260825-wPljv3iTVYdFJY9u-1L7RHiY","_index":"arkime_sessions3-260825","client":{"bytes":1021},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Kaopu Cloud HK Limited"],"isp.dstCnt":1,"isp.src":["Private Layer INC"],"isp.srcCnt":1,"org.dst":["LightNode-BH"],"org.dstCnt":1,"org.src":["Private Layer Inc"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":0,"geo":{"country_iso_code":"BH"},"ip":"38.54.2.209","mac":["52:54:8f:9d:76:48"],"mac-cnt":1,"packets":0,"port":5060},"dstRIR":"ARIN","ethertype":2048,"fileId":[79206],"firstPacket":1787651800338,"ipProtocol":17,"lastPacket":1787651800338,"length":0,"network":{"bytes":1063,"community_id":"1:Y54d1/cN/aHvKm1Mavi130Yp0AI=","packets":1},"node":"spark-afae","packetPos":[-79206,323760],"packetRange":{"gte":1787651800338,"lte":1787651800338},"protocol":["udp","sip"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":0},"sip":{"callid":["RH0Op2lcBynMEHHCd3Hrfr.."],"callidCnt":1,"contact":["\u003csip:16563628947@179.43.167.2:27009\u003e"],"contactCnt":1,"from":["\u003csip:16563628947@179.43.167.2\u003e;tag=4ee4d0d2"],"fromCnt":1,"method":["INVITE"],"methodCnt":1,"to":["\u003csip:98103908351673002@38.54.2.209:5060\u003e"],"toCnt":1,"user":["16563628947","98103908351673002"],"userCnt":2,"useragent":["snom320/8.7.5.32"],"useragentCnt":1,"via":["SIP/2.0/UDP 179.43.167.2:27009;branch=z9hG4bK-524287-1---18c7c75da3aa4e9b"],"viaCnt":1},"source":{"as":{"full":"AS51852 Private Layer INC","number":51852,"organization":{"name":"Private Layer INC"}},"bytes":1063,"geo":{"country_iso_code":"CH"},"ip":"179.43.167.2","mac":["98:44:ce:60:15:19"],"mac-cnt":1,"packets":1,"port":27009},"srcOui":["Huawei Technologies Co.,Ltd"],"srcOuiCnt":1,"srcPayload8":"494e564954452073","srcRIR":"LACNIC","srcTTL":[50],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["45429645017569"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["b05640bd-eb2a-4d9d-8d73-d14d7cbeb44a"],"signatureCnt":1,"signatureId":[1071802],"signatureIdCnt":1},"tag":{"block":["false"],"blockCnt":1,"category":["protocol"],"categoryCnt":1,"description":["ip addresses with this tag have been observed sending sip traffic."],"intention":["unknown"],"intentionCnt":1,"name":["sip protocol"],"nameCnt":1},"tags":["sensor:bahrain-sponge-01-ts","bahrain-sponge-01-ts","honeypot"],"tagsCnt":3,"totDataBytes":1021} +{"@timestamp":1787643208093,"_id":"260825-w5w68F5IFyhKB7Ez96g6x6n9","_index":"arkime_sessions3-260825","client":{"bytes":1019},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["netcup GmbH"],"isp.dstCnt":1,"isp.src":["Private Layer INC"],"isp.srcCnt":1,"org.dst":["Netcup KVM"],"org.dstCnt":1,"org.src":["Private Layer Inc"],"org.srcCnt":1,"usertype.dst":["business"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS197540 netcup GmbH","number":197540,"organization":{"name":"netcup GmbH"}},"bytes":0,"geo":{"country_iso_code":"DE"},"ip":"159.195.21.150","mac":["8a:41:d3:b8:0d:d3"],"mac-cnt":1,"packets":0,"port":5060},"dstRIR":"ARIN","ethertype":2048,"fileId":[79155],"firstPacket":1787642434634,"ipProtocol":17,"lastPacket":1787642434634,"length":0,"network":{"bytes":1061,"community_id":"1:WtKyizZHZ4zpLVtGDkyBazRc/K4=","packets":1},"node":"spark-afae","packetPos":[-79155,5131404],"packetRange":{"gte":1787642434634,"lte":1787642434634},"protocol":["udp","sip"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":0},"sip":{"callid":["wC6WgAl35T2xuvXd2tLffM.."],"callidCnt":1,"contact":["\u003csip:17168465496@179.43.167.2:29703\u003e"],"contactCnt":1,"from":["\u003csip:17168465496@179.43.167.2\u003e;tag=1ac78660"],"fromCnt":1,"method":["INVITE"],"methodCnt":1,"to":["\u003csip:9003908351673002@159.195.21.150:5060\u003e"],"toCnt":1,"user":["9003908351673002","17168465496"],"userCnt":2,"useragent":["SIPp/3.6.2"],"useragentCnt":1,"via":["SIP/2.0/UDP 179.43.167.2:29703;branch=z9hG4bK-524287-1---af8e82e7be30803b"],"viaCnt":1},"source":{"as":{"full":"AS51852 Private Layer INC","number":51852,"organization":{"name":"Private Layer INC"}},"bytes":1061,"geo":{"country_iso_code":"CH"},"ip":"179.43.167.2","mac":["bc:0f:fe:38:0b:a3"],"mac-cnt":1,"packets":1,"port":29703},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcPayload8":"494e564954452073","srcRIR":"LACNIC","srcTTL":[54],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["756163361513940"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["b05640bd-eb2a-4d9d-8d73-d14d7cbeb44a"],"signatureCnt":1,"signatureId":[1071802],"signatureIdCnt":1},"tag":{"block":["false"],"blockCnt":1,"category":["protocol"],"categoryCnt":1,"description":["ip addresses with this tag have been observed sending sip traffic."],"intention":["unknown"],"intentionCnt":1,"name":["sip protocol"],"nameCnt":1},"tags":["honeypot","netcup-ts","sensor:netcup-ts"],"tagsCnt":3,"totDataBytes":1019} +{"@timestamp":1787639865684,"_id":"260825-IPilGpQ-7rlFdpavEsgVFOoz","_index":"arkime_sessions3-260825","client":{"bytes":1026},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Private Layer INC"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Private Layer Inc"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":0,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":0,"port":5060},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[79136],"firstPacket":1787638651882,"ipProtocol":17,"lastPacket":1787638651882,"length":0,"network":{"bytes":1068,"community_id":"1:naWCNG1wdY5ChytDQ+Bdl4077dM=","packets":1},"node":"spark-afae","packetPos":[-79136,147290],"packetRange":{"gte":1787638651882,"lte":1787638651882},"protocol":["sip","udp"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":0},"sip":{"callid":["I7MpDlDgZEQ0m0DOMBotBH.."],"callidCnt":1,"contact":["\u003csip:16724692132@179.43.167.2:29703\u003e"],"contactCnt":1,"from":["\u003csip:16724692132@179.43.167.2\u003e;tag=8925d99b"],"fromCnt":1,"method":["INVITE"],"methodCnt":1,"to":["\u003csip:9003908351673002@217.15.163.226:5060\u003e"],"toCnt":1,"user":["9003908351673002","16724692132"],"userCnt":2,"useragent":["Grandstream HT812"],"useragentCnt":1,"via":["SIP/2.0/UDP 179.43.167.2:29703;branch=z9hG4bK-524287-1---10c86719d2a50de6"],"viaCnt":1},"source":{"as":{"full":"AS51852 Private Layer INC","number":51852,"organization":{"name":"Private Layer INC"}},"bytes":1068,"geo":{"country_iso_code":"CH"},"ip":"179.43.167.2","mac":["fc:bd:67:9d:2b:2b"],"mac-cnt":1,"packets":1,"port":29703},"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcPayload8":"494e564954452073","srcRIR":"LACNIC","srcTTL":[52],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["977102229462202"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["b05640bd-eb2a-4d9d-8d73-d14d7cbeb44a"],"signatureCnt":1,"signatureId":[1071802],"signatureIdCnt":1},"tag":{"block":["false"],"blockCnt":1,"category":["protocol"],"categoryCnt":1,"description":["ip addresses with this tag have been observed sending sip traffic."],"intention":["unknown"],"intentionCnt":1,"name":["sip protocol"],"nameCnt":1},"tags":["sensor:contabo-sponge-01-ts","contabo-sponge-01-ts","honeypot"],"tagsCnt":3,"totDataBytes":1026} +{"@timestamp":1787638354594,"_id":"260825-6ff2vgY7L_NNaLW1OZ85Cy9K","_index":"arkime_sessions3-260825","client":{"bytes":1013},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Kaopu Cloud HK Limited"],"isp.dstCnt":1,"isp.src":["Private Layer INC"],"isp.srcCnt":1,"org.dst":["LightNode-BH"],"org.dstCnt":1,"org.src":["Private Layer Inc"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":0,"geo":{"country_iso_code":"BH"},"ip":"38.54.2.209","mac":["52:54:8f:9d:76:48"],"mac-cnt":1,"packets":0,"port":5060},"dstRIR":"ARIN","ethertype":2048,"fileId":[79127],"firstPacket":1787637275120,"ipProtocol":17,"lastPacket":1787637275120,"length":0,"network":{"bytes":1055,"community_id":"1:EgTQnlL86zSDKubpSij7KJwnsg4=","packets":1},"node":"spark-afae","packetPos":[-79127,99705],"packetRange":{"gte":1787637275120,"lte":1787637275120},"protocol":["udp","sip"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":0},"sip":{"callid":["9Cuv7ALOkCTb40SCT4EmvL.."],"callidCnt":1,"contact":["\u003csip:16563628947@179.43.167.2:29703\u003e"],"contactCnt":1,"from":["\u003csip:16563628947@179.43.167.2\u003e;tag=bd351b98"],"fromCnt":1,"method":["INVITE"],"methodCnt":1,"to":["\u003csip:9003908351673002@38.54.2.209:5060\u003e"],"toCnt":1,"user":["16563628947","9003908351673002"],"userCnt":2,"useragent":["Mitel 6863"],"useragentCnt":1,"via":["SIP/2.0/UDP 179.43.167.2:29703;branch=z9hG4bK-524287-1---1e597a12dfc945a1"],"viaCnt":1},"source":{"as":{"full":"AS51852 Private Layer INC","number":51852,"organization":{"name":"Private Layer INC"}},"bytes":1055,"geo":{"country_iso_code":"CH"},"ip":"179.43.167.2","mac":["98:44:ce:60:15:19"],"mac-cnt":1,"packets":1,"port":29703},"srcOui":["Huawei Technologies Co.,Ltd"],"srcOuiCnt":1,"srcPayload8":"494e564954452073","srcRIR":"LACNIC","srcTTL":[50],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["1082509063213718"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["b05640bd-eb2a-4d9d-8d73-d14d7cbeb44a"],"signatureCnt":1,"signatureId":[1071802],"signatureIdCnt":1},"tag":{"block":["false"],"blockCnt":1,"category":["protocol"],"categoryCnt":1,"description":["ip addresses with this tag have been observed sending sip traffic."],"intention":["unknown"],"intentionCnt":1,"name":["sip protocol"],"nameCnt":1},"tags":["bahrain-sponge-01-ts","honeypot","sensor:bahrain-sponge-01-ts"],"tagsCnt":3,"totDataBytes":1013} +{"@timestamp":1787635951734,"_id":"260825-nvf-MxIv26VFIoEdeK9UrnuA","_index":"arkime_sessions3-260825","client":{"bytes":1039},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo GmbH"],"isp.dstCnt":1,"isp.src":["Private Layer INC"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Private Layer Inc"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS51167 Contabo GmbH","number":51167,"organization":{"name":"Contabo GmbH"}},"bytes":0,"geo":{"country_iso_code":"FR"},"ip":"109.123.246.142","mac":["00:50:56:63:46:a6"],"mac-cnt":1,"packets":0,"port":5060},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[79114],"firstPacket":1787635029332,"ipProtocol":17,"lastPacket":1787635029332,"length":0,"network":{"bytes":1081,"community_id":"1:4a2i9SItj7P3JcAOaD70px365Pc=","packets":1},"node":"spark-afae","packetPos":[-79114,144473],"packetRange":{"gte":1787635029332,"lte":1787635029332},"protocol":["udp","sip"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":0},"sip":{"callid":["3PlnREfpHce1iqOssmqDBh.."],"callidCnt":1,"contact":["\u003csip:16299777872@179.43.167.2:29703\u003e"],"contactCnt":1,"from":["\u003csip:16299777872@179.43.167.2\u003e;tag=a7b50e59"],"fromCnt":1,"method":["INVITE"],"methodCnt":1,"to":["\u003csip:9003908351673002@109.123.246.142:5060\u003e"],"toCnt":1,"user":["16299777872","9003908351673002"],"userCnt":2,"useragent":["Yealink SIP-CP960 73.86.0.15"],"useragentCnt":1,"via":["SIP/2.0/UDP 179.43.167.2:29703;branch=z9hG4bK-524287-1---de4c716ae43168eb"],"viaCnt":1},"source":{"as":{"full":"AS51852 Private Layer INC","number":51852,"organization":{"name":"Private Layer INC"}},"bytes":1081,"geo":{"country_iso_code":"CH"},"ip":"179.43.167.2","mac":["c0:69:11:cd:1f:19"],"mac-cnt":1,"packets":1,"port":29703},"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcPayload8":"494e564954452073","srcRIR":"LACNIC","srcTTL":[55],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["1429248137461094"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["b05640bd-eb2a-4d9d-8d73-d14d7cbeb44a"],"signatureCnt":1,"signatureId":[1071802],"signatureIdCnt":1},"tag":{"block":["false"],"blockCnt":1,"category":["protocol"],"categoryCnt":1,"description":["ip addresses with this tag have been observed sending sip traffic."],"intention":["unknown"],"intentionCnt":1,"name":["sip protocol"],"nameCnt":1},"tags":["proxy","sensor:contabo-sponge-02-ts","contabo-sponge-02-ts"],"tagsCnt":3,"totDataBytes":1039} +{"@timestamp":1787628731838,"_id":"260825-mpsdnYcRXLBO_JvVvGNS_NRq","_index":"arkime_sessions3-260825","client":{"bytes":1018},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["netcup GmbH"],"isp.dstCnt":1,"isp.src":["Private Layer INC"],"isp.srcCnt":1,"org.dst":["Netcup KVM"],"org.dstCnt":1,"org.src":["Private Layer Inc"],"org.srcCnt":1,"usertype.dst":["business"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS197540 netcup GmbH","number":197540,"organization":{"name":"netcup GmbH"}},"bytes":0,"geo":{"country_iso_code":"DE"},"ip":"159.195.21.150","mac":["8a:41:d3:b8:0d:d3"],"mac-cnt":1,"packets":0,"port":5060},"dstRIR":"ARIN","ethertype":2048,"fileId":[79075],"firstPacket":1787627923703,"ipProtocol":17,"lastPacket":1787627923703,"length":0,"network":{"bytes":1060,"community_id":"1:+EsuGOwWNzyeImNpBBNZb+ME/Co=","packets":1},"node":"spark-afae","packetPos":[-79075,927411],"packetRange":{"gte":1787627923703,"lte":1787627923703},"protocol":["udp","sip"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":0},"sip":{"callid":["ft5G1r0rEk67NNY0Xrx37h.."],"callidCnt":1,"contact":["\u003csip:17168465496@179.43.167.2:25698\u003e"],"contactCnt":1,"from":["\u003csip:17168465496@179.43.167.2\u003e;tag=a4f73cd2"],"fromCnt":1,"method":["INVITE"],"methodCnt":1,"to":["\u003csip:3908351673002@159.195.21.150:5060\u003e"],"toCnt":1,"user":["3908351673002","17168465496"],"userCnt":2,"useragent":["MicroSIP/3.20.2"],"useragentCnt":1,"via":["SIP/2.0/UDP 179.43.167.2:25698;branch=z9hG4bK-524287-1---877fa2d26de392ae"],"viaCnt":1},"source":{"as":{"full":"AS51852 Private Layer INC","number":51852,"organization":{"name":"Private Layer INC"}},"bytes":1060,"geo":{"country_iso_code":"CH"},"ip":"179.43.167.2","mac":["bc:0f:fe:38:0b:a3"],"mac-cnt":1,"packets":1,"port":25698},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcPayload8":"494e564954452073","srcRIR":"LACNIC","srcTTL":[54],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["1049533492814731"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["b05640bd-eb2a-4d9d-8d73-d14d7cbeb44a"],"signatureCnt":1,"signatureId":[1071802],"signatureIdCnt":1},"tag":{"block":["false"],"blockCnt":1,"category":["protocol"],"categoryCnt":1,"description":["ip addresses with this tag have been observed sending sip traffic."],"intention":["unknown"],"intentionCnt":1,"name":["sip protocol"],"nameCnt":1},"tags":["honeypot","sensor:netcup-ts","netcup-ts"],"tagsCnt":3,"totDataBytes":1018} +{"@timestamp":1787624803903,"_id":"260825-Qpv8pX2-tO5ERImBZZBgNZZ6","_index":"arkime_sessions3-260825","client":{"bytes":1010},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Private Layer INC"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Private Layer Inc"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":0,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":0,"port":5060},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[79051],"firstPacket":1787624147114,"ipProtocol":17,"lastPacket":1787624147114,"length":0,"network":{"bytes":1052,"community_id":"1:ZgNPhBdNR00QVU6SA9mqrUMb2g0=","packets":1},"node":"spark-afae","packetPos":[-79051,4477420],"packetRange":{"gte":1787624147114,"lte":1787624147114},"protocol":["udp","sip"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":0},"sip":{"callid":["MmZXFcj69uGTXUCnMxwVoH.."],"callidCnt":1,"contact":["\u003csip:16724692132@179.43.167.2:25698\u003e"],"contactCnt":1,"from":["\u003csip:16724692132@179.43.167.2\u003e;tag=57c035a6"],"fromCnt":1,"method":["INVITE"],"methodCnt":1,"to":["\u003csip:3908351673002@217.15.163.226:5060\u003e"],"toCnt":1,"user":["3908351673002","16724692132"],"userCnt":2,"useragent":["snom710"],"useragentCnt":1,"via":["SIP/2.0/UDP 179.43.167.2:25698;branch=z9hG4bK-524287-1---b33237f274f4d9bb"],"viaCnt":1},"source":{"as":{"full":"AS51852 Private Layer INC","number":51852,"organization":{"name":"Private Layer INC"}},"bytes":1052,"geo":{"country_iso_code":"CH"},"ip":"179.43.167.2","mac":["fc:bd:67:9d:2b:2b"],"mac-cnt":1,"packets":1,"port":25698},"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcPayload8":"494e564954452073","srcRIR":"LACNIC","srcTTL":[52],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["1053568210456383"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["b05640bd-eb2a-4d9d-8d73-d14d7cbeb44a"],"signatureCnt":1,"signatureId":[1071802],"signatureIdCnt":1},"tag":{"block":["false"],"blockCnt":1,"category":["protocol"],"categoryCnt":1,"description":["ip addresses with this tag have been observed sending sip traffic."],"intention":["unknown"],"intentionCnt":1,"name":["sip protocol"],"nameCnt":1},"tags":["honeypot","contabo-sponge-01-ts","sensor:contabo-sponge-01-ts"],"tagsCnt":3,"totDataBytes":1010} +{"@timestamp":1787621452764,"_id":"260825-AJtez9UrHAtESKYjEFfM2Ti9","_index":"arkime_sessions3-260825","client":{"bytes":1014},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo GmbH"],"isp.dstCnt":1,"isp.src":["Private Layer INC"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Private Layer Inc"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS51167 Contabo GmbH","number":51167,"organization":{"name":"Contabo GmbH"}},"bytes":0,"geo":{"country_iso_code":"FR"},"ip":"109.123.246.142","mac":["00:50:56:63:46:a6"],"mac-cnt":1,"packets":0,"port":5060},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[79033],"firstPacket":1787620534349,"ipProtocol":17,"lastPacket":1787620534349,"length":0,"network":{"bytes":1056,"community_id":"1:f4UxVR2L7HuXmiO0Sbuo/R0bIRM=","packets":1},"node":"spark-afae","packetPos":[-79033,29651],"packetRange":{"gte":1787620534349,"lte":1787620534349},"protocol":["udp","sip"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":0},"sip":{"callid":["LNrLj45nNZoYd2TjoEQ29j.."],"callidCnt":1,"contact":["\u003csip:16299777872@179.43.167.2:25698\u003e"],"contactCnt":1,"from":["\u003csip:16299777872@179.43.167.2\u003e;tag=a5821cd3"],"fromCnt":1,"method":["INVITE"],"methodCnt":1,"to":["\u003csip:3908351673002@109.123.246.142:5060\u003e"],"toCnt":1,"user":["16299777872","3908351673002"],"userCnt":2,"useragent":["Fanvil X6"],"useragentCnt":1,"via":["SIP/2.0/UDP 179.43.167.2:25698;branch=z9hG4bK-524287-1---c932ca6439fadb76"],"viaCnt":1},"source":{"as":{"full":"AS51852 Private Layer INC","number":51852,"organization":{"name":"Private Layer INC"}},"bytes":1056,"geo":{"country_iso_code":"CH"},"ip":"179.43.167.2","mac":["c0:69:11:cd:1f:19"],"mac-cnt":1,"packets":1,"port":25698},"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcPayload8":"494e564954452073","srcRIR":"LACNIC","srcTTL":[55],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["1783967469148490"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["b05640bd-eb2a-4d9d-8d73-d14d7cbeb44a"],"signatureCnt":1,"signatureId":[1071802],"signatureIdCnt":1},"tag":{"block":["false"],"blockCnt":1,"category":["protocol"],"categoryCnt":1,"description":["ip addresses with this tag have been observed sending sip traffic."],"intention":["unknown"],"intentionCnt":1,"name":["sip protocol"],"nameCnt":1},"tags":["sensor:contabo-sponge-02-ts","contabo-sponge-02-ts","proxy"],"tagsCnt":3,"totDataBytes":1014} +{"@timestamp":1787614493546,"_id":"260824-IjPfaUZGbGtAMbGVhFjCpmlM","_index":"arkime_sessions3-260824","client":{"bytes":1011},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["netcup GmbH"],"isp.dstCnt":1,"isp.src":["Private Layer INC"],"isp.srcCnt":1,"org.dst":["Netcup KVM"],"org.dstCnt":1,"org.src":["Private Layer Inc"],"org.srcCnt":1,"usertype.dst":["business"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS197540 netcup GmbH","number":197540,"organization":{"name":"netcup GmbH"}},"bytes":0,"geo":{"country_iso_code":"DE"},"ip":"159.195.21.150","mac":["8a:41:d3:b8:0d:d3"],"mac-cnt":1,"packets":0,"port":5060},"dstRIR":"ARIN","ethertype":2048,"fileId":[78995],"firstPacket":1787613415133,"ipProtocol":17,"lastPacket":1787613415133,"length":0,"network":{"bytes":1053,"community_id":"1:BaAA7HbtIgwO7B8Rme8eTatx0dQ=","packets":1},"node":"spark-afae","packetPos":[-78995,384875],"packetRange":{"gte":1787613415133,"lte":1787613415133},"protocol":["udp","sip"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":0},"sip":{"callid":["9Un0Tkw4QoONykTbvfnZ9x.."],"callidCnt":1,"contact":["\u003csip:17168465496@179.43.167.2:32992\u003e"],"contactCnt":1,"from":["\u003csip:17168465496@179.43.167.2\u003e;tag=59692108"],"fromCnt":1,"method":["INVITE"],"methodCnt":1,"to":["\u003csip:003908351673002@159.195.21.150:5060\u003e"],"toCnt":1,"user":["17168465496","003908351673002"],"userCnt":2,"useragent":["Algo"],"useragentCnt":1,"via":["SIP/2.0/UDP 179.43.167.2:32992;branch=z9hG4bK-524287-1---3b1319fbd5e9895e"],"viaCnt":1},"source":{"as":{"full":"AS51852 Private Layer INC","number":51852,"organization":{"name":"Private Layer INC"}},"bytes":1053,"geo":{"country_iso_code":"CH"},"ip":"179.43.167.2","mac":["bc:0f:fe:38:0b:a3"],"mac-cnt":1,"packets":1,"port":32992},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcPayload8":"494e564954452073","srcRIR":"LACNIC","srcTTL":[54],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["1980870534876109"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["b05640bd-eb2a-4d9d-8d73-d14d7cbeb44a"],"signatureCnt":1,"signatureId":[1071802],"signatureIdCnt":1},"tag":{"block":["false"],"blockCnt":1,"category":["protocol"],"categoryCnt":1,"description":["ip addresses with this tag have been observed sending sip traffic."],"intention":["unknown"],"intentionCnt":1,"name":["sip protocol"],"nameCnt":1},"tags":["honeypot","netcup-ts","sensor:netcup-ts"],"tagsCnt":3,"totDataBytes":1011} +{"@timestamp":1787609985494,"_id":"260824-EPSnxNUsEaBKeK_3-naCpHRv","_index":"arkime_sessions3-260824","client":{"bytes":1017},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Private Layer INC"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Private Layer Inc"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":0,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":0,"port":5060},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[78970],"firstPacket":1787609626007,"ipProtocol":17,"lastPacket":1787609626007,"length":0,"network":{"bytes":1059,"community_id":"1:9D4PwpViJdHOhBPrB8Q9xb/dj/Q=","packets":1},"node":"spark-afae","packetPos":[-78970,3433325],"packetRange":{"gte":1787609626007,"lte":1787609626007},"protocol":["udp","sip"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":0},"sip":{"callid":["OBr7JwPdlak7g70liqWkRv.."],"callidCnt":1,"contact":["\u003csip:16724692132@179.43.167.2:32992\u003e"],"contactCnt":1,"from":["\u003csip:16724692132@179.43.167.2\u003e;tag=3ad70497"],"fromCnt":1,"method":["INVITE"],"methodCnt":1,"to":["\u003csip:003908351673002@217.15.163.226:5060\u003e"],"toCnt":1,"user":["16724692132","003908351673002"],"userCnt":2,"useragent":["FreeSWITCH"],"useragentCnt":1,"via":["SIP/2.0/UDP 179.43.167.2:32992;branch=z9hG4bK-524287-1---09a45d0ab49150ad"],"viaCnt":1},"source":{"as":{"full":"AS51852 Private Layer INC","number":51852,"organization":{"name":"Private Layer INC"}},"bytes":1059,"geo":{"country_iso_code":"CH"},"ip":"179.43.167.2","mac":["fc:bd:67:9d:2b:2b"],"mac-cnt":1,"packets":1,"port":32992},"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcPayload8":"494e564954452073","srcRIR":"LACNIC","srcTTL":[52],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["597098679017244"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["b05640bd-eb2a-4d9d-8d73-d14d7cbeb44a"],"signatureCnt":1,"signatureId":[1071802],"signatureIdCnt":1},"tag":{"block":["false"],"blockCnt":1,"category":["protocol"],"categoryCnt":1,"description":["ip addresses with this tag have been observed sending sip traffic."],"intention":["unknown"],"intentionCnt":1,"name":["sip protocol"],"nameCnt":1},"tags":["contabo-sponge-01-ts","sensor:contabo-sponge-01-ts","honeypot"],"tagsCnt":3,"totDataBytes":1017} +{"@timestamp":1787608481975,"_id":"260824-5PMMOBqwuAJMprFKxGV1ydHY","_index":"arkime_sessions3-260824","client":{"bytes":1018},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Kaopu Cloud HK Limited"],"isp.dstCnt":1,"isp.src":["Private Layer INC"],"isp.srcCnt":1,"org.dst":["LightNode-BH"],"org.dstCnt":1,"org.src":["Private Layer Inc"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":0,"geo":{"country_iso_code":"BH"},"ip":"38.54.2.209","mac":["52:54:8f:9d:76:48"],"mac-cnt":1,"packets":0,"port":5060},"dstRIR":"ARIN","ethertype":2048,"fileId":[78962],"firstPacket":1787608248172,"ipProtocol":17,"lastPacket":1787608248172,"length":0,"network":{"bytes":1060,"community_id":"1:F8izqP1Yp3/1xikXHMM/YU3kWMo=","packets":1},"node":"spark-afae","packetPos":[-78962,1528616],"packetRange":{"gte":1787608248172,"lte":1787608248172},"protocol":["udp","sip"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":0},"sip":{"callid":["m7SJYZ7E0DsnI7BRVHbrgM.."],"callidCnt":1,"contact":["\u003csip:16563628947@179.43.167.2:32992\u003e"],"contactCnt":1,"from":["\u003csip:16563628947@179.43.167.2\u003e;tag=a3c06f32"],"fromCnt":1,"method":["INVITE"],"methodCnt":1,"to":["\u003csip:003908351673002@38.54.2.209:5060\u003e"],"toCnt":1,"user":["16563628947","003908351673002"],"userCnt":2,"useragent":["Cisco-CP7940G/8.0"],"useragentCnt":1,"via":["SIP/2.0/UDP 179.43.167.2:32992;branch=z9hG4bK-524287-1---2b6b7902bdd970fa"],"viaCnt":1},"source":{"as":{"full":"AS51852 Private Layer INC","number":51852,"organization":{"name":"Private Layer INC"}},"bytes":1060,"geo":{"country_iso_code":"CH"},"ip":"179.43.167.2","mac":["98:44:ce:60:15:19"],"mac-cnt":1,"packets":1,"port":32992},"srcOui":["Huawei Technologies Co.,Ltd"],"srcOuiCnt":1,"srcPayload8":"494e564954452073","srcRIR":"LACNIC","srcTTL":[50],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["178052737022826"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["b05640bd-eb2a-4d9d-8d73-d14d7cbeb44a"],"signatureCnt":1,"signatureId":[1071802],"signatureIdCnt":1},"tag":{"block":["false"],"blockCnt":1,"category":["protocol"],"categoryCnt":1,"description":["ip addresses with this tag have been observed sending sip traffic."],"intention":["unknown"],"intentionCnt":1,"name":["sip protocol"],"nameCnt":1},"tags":["sensor:bahrain-sponge-01-ts","bahrain-sponge-01-ts","honeypot"],"tagsCnt":3,"totDataBytes":1018} +{"@timestamp":1787607279733,"_id":"260824-45kdHNq1EVtDQr4qN-bulDyl","_index":"arkime_sessions3-260824","client":{"bytes":1040},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo GmbH"],"isp.dstCnt":1,"isp.src":["Private Layer INC"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Private Layer Inc"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS51167 Contabo GmbH","number":51167,"organization":{"name":"Contabo GmbH"}},"bytes":0,"geo":{"country_iso_code":"FR"},"ip":"109.123.246.142","mac":["00:50:56:63:46:a6"],"mac-cnt":1,"packets":0,"port":5060},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[78954],"firstPacket":1787605998407,"ipProtocol":17,"lastPacket":1787605998407,"length":0,"network":{"bytes":1082,"community_id":"1:v+cGN5qLos/fmwh/HXJhptZpF6E=","packets":1},"node":"spark-afae","packetPos":[-78954,12206],"packetRange":{"gte":1787605998407,"lte":1787605998407},"protocol":["udp","sip"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":0},"sip":{"callid":["IivvkRIjNb7PVlVTAxNuf5.."],"callidCnt":1,"contact":["\u003csip:16299777872@179.43.167.2:32992\u003e"],"contactCnt":1,"from":["\u003csip:16299777872@179.43.167.2\u003e;tag=8ee36063"],"fromCnt":1,"method":["INVITE"],"methodCnt":1,"to":["\u003csip:003908351673002@109.123.246.142:5060\u003e"],"toCnt":1,"user":["16299777872","003908351673002"],"userCnt":2,"useragent":["Kamailio (5.6.3 (x86_64/linux))"],"useragentCnt":1,"via":["SIP/2.0/UDP 179.43.167.2:32992;branch=z9hG4bK-524287-1---901ea7b2e4b2c81d"],"viaCnt":1},"source":{"as":{"full":"AS51852 Private Layer INC","number":51852,"organization":{"name":"Private Layer INC"}},"bytes":1082,"geo":{"country_iso_code":"CH"},"ip":"179.43.167.2","mac":["c0:69:11:cd:1f:19"],"mac-cnt":1,"packets":1,"port":32992},"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcPayload8":"494e564954452073","srcRIR":"LACNIC","srcTTL":[55],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["1750202066730461"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["b05640bd-eb2a-4d9d-8d73-d14d7cbeb44a"],"signatureCnt":1,"signatureId":[1071802],"signatureIdCnt":1},"tag":{"block":["false"],"blockCnt":1,"category":["protocol"],"categoryCnt":1,"description":["ip addresses with this tag have been observed sending sip traffic."],"intention":["unknown"],"intentionCnt":1,"name":["sip protocol"],"nameCnt":1},"tags":["contabo-sponge-02-ts","sensor:contabo-sponge-02-ts","proxy"],"tagsCnt":3,"totDataBytes":1040} +{"@timestamp":1787600341693,"_id":"260824-SZmRp2wg3wpBKYCtJfCDW2MV","_index":"arkime_sessions3-260824","client":{"bytes":1021},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["netcup GmbH"],"isp.dstCnt":1,"isp.src":["Private Layer INC"],"isp.srcCnt":1,"org.dst":["Netcup KVM"],"org.dstCnt":1,"org.src":["Private Layer Inc"],"org.srcCnt":1,"usertype.dst":["business"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS197540 netcup GmbH","number":197540,"organization":{"name":"netcup GmbH"}},"bytes":0,"geo":{"country_iso_code":"DE"},"ip":"159.195.21.150","mac":["8a:41:d3:b8:0d:d3"],"mac-cnt":1,"packets":0,"port":5060},"dstRIR":"ARIN","ethertype":2048,"fileId":[78916],"firstPacket":1787598882087,"ipProtocol":17,"lastPacket":1787598882087,"length":0,"network":{"bytes":1063,"community_id":"1:54Vjmhh0oFrffPddPiZgxhg8/b0=","packets":1},"node":"spark-afae","packetPos":[-78916,39658],"packetRange":{"gte":1787598882087,"lte":1787598882087},"protocol":["udp","sip"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":0},"sip":{"callid":["MkKT2YwQwTZ4RLjdF6Fbfy.."],"callidCnt":1,"contact":["\u003csip:17168465496@179.43.167.2:31423\u003e"],"contactCnt":1,"from":["\u003csip:17168465496@179.43.167.2\u003e;tag=c8626475"],"fromCnt":1,"method":["INVITE"],"methodCnt":1,"to":["\u003csip:90113908351673002@159.195.21.150:5060\u003e"],"toCnt":1,"user":["90113908351673002","17168465496"],"userCnt":2,"useragent":["SIPp/3.6.2"],"useragentCnt":1,"via":["SIP/2.0/UDP 179.43.167.2:31423;branch=z9hG4bK-524287-1---26c1a6997450c1b8"],"viaCnt":1},"source":{"as":{"full":"AS51852 Private Layer INC","number":51852,"organization":{"name":"Private Layer INC"}},"bytes":1063,"geo":{"country_iso_code":"CH"},"ip":"179.43.167.2","mac":["bc:0f:fe:38:0b:a3"],"mac-cnt":1,"packets":1,"port":31423},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcPayload8":"494e564954452073","srcRIR":"LACNIC","srcTTL":[54],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["659034900133398"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["b05640bd-eb2a-4d9d-8d73-d14d7cbeb44a"],"signatureCnt":1,"signatureId":[1071802],"signatureIdCnt":1},"tag":{"block":["false"],"blockCnt":1,"category":["protocol"],"categoryCnt":1,"description":["ip addresses with this tag have been observed sending sip traffic."],"intention":["unknown"],"intentionCnt":1,"name":["sip protocol"],"nameCnt":1},"tags":["sensor:netcup-ts","honeypot","netcup-ts"],"tagsCnt":3,"totDataBytes":1021} +{"@timestamp":1787595833108,"_id":"260824-NvLbMWZvr6FHl7ymBnYt0SQX","_index":"arkime_sessions3-260824","client":{"bytes":1020},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Private Layer INC"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Private Layer Inc"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":0,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":0,"port":5060},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[78891],"firstPacket":1787595114001,"ipProtocol":17,"lastPacket":1787595114001,"length":0,"network":{"bytes":1062,"community_id":"1:gKWQMzlo31InDewapnZKYrLPDEU=","packets":1},"node":"spark-afae","packetPos":[-78891,3067669],"packetRange":{"gte":1787595114001,"lte":1787595114001},"protocol":["udp","sip"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":0},"sip":{"callid":["YQGXjVWCp2Rs3CS70LaiJ1.."],"callidCnt":1,"contact":["\u003csip:16724692132@179.43.167.2:31423\u003e"],"contactCnt":1,"from":["\u003csip:16724692132@179.43.167.2\u003e;tag=db81321a"],"fromCnt":1,"method":["INVITE"],"methodCnt":1,"to":["\u003csip:90113908351673002@217.15.163.226:5060\u003e"],"toCnt":1,"user":["90113908351673002","16724692132"],"userCnt":2,"useragent":["Sonus SBC"],"useragentCnt":1,"via":["SIP/2.0/UDP 179.43.167.2:31423;branch=z9hG4bK-524287-1---c13b5ec35615ebba"],"viaCnt":1},"source":{"as":{"full":"AS51852 Private Layer INC","number":51852,"organization":{"name":"Private Layer INC"}},"bytes":1062,"geo":{"country_iso_code":"CH"},"ip":"179.43.167.2","mac":["fc:bd:67:9d:2b:2b"],"mac-cnt":1,"packets":1,"port":31423},"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcPayload8":"494e564954452073","srcRIR":"LACNIC","srcTTL":[52],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["567976400945703"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["b05640bd-eb2a-4d9d-8d73-d14d7cbeb44a"],"signatureCnt":1,"signatureId":[1071802],"signatureIdCnt":1},"tag":{"block":["false"],"blockCnt":1,"category":["protocol"],"categoryCnt":1,"description":["ip addresses with this tag have been observed sending sip traffic."],"intention":["unknown"],"intentionCnt":1,"name":["sip protocol"],"nameCnt":1},"tags":["honeypot","contabo-sponge-01-ts","sensor:contabo-sponge-01-ts"],"tagsCnt":3,"totDataBytes":1020} +{"@timestamp":1787594323574,"_id":"260824-API6FCGjFtxD2LCz_WHF6N8y","_index":"arkime_sessions3-260824","client":{"bytes":1015},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Kaopu Cloud HK Limited"],"isp.dstCnt":1,"isp.src":["Private Layer INC"],"isp.srcCnt":1,"org.dst":["LightNode-BH"],"org.dstCnt":1,"org.src":["Private Layer Inc"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":0,"geo":{"country_iso_code":"BH"},"ip":"38.54.2.209","mac":["52:54:8f:9d:76:48"],"mac-cnt":1,"packets":0,"port":5060},"dstRIR":"ARIN","ethertype":2048,"fileId":[78884],"firstPacket":1787593746869,"ipProtocol":17,"lastPacket":1787593746869,"length":0,"network":{"bytes":1057,"community_id":"1:YQMf+R6ejuJNYoYYO9sO8HSVjBo=","packets":1},"node":"spark-afae","packetPos":[-78884,1718479],"packetRange":{"gte":1787593746869,"lte":1787593746869},"protocol":["udp","sip"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":0},"sip":{"callid":["1XxPItsuni3DaR3Xo52sEl.."],"callidCnt":1,"contact":["\u003csip:16563628947@179.43.167.2:31423\u003e"],"contactCnt":1,"from":["\u003csip:16563628947@179.43.167.2\u003e;tag=3fbc0cbc"],"fromCnt":1,"method":["INVITE"],"methodCnt":1,"to":["\u003csip:90113908351673002@38.54.2.209:5060\u003e"],"toCnt":1,"user":["16563628947","90113908351673002"],"userCnt":2,"useragent":["Yate/6.0.0"],"useragentCnt":1,"via":["SIP/2.0/UDP 179.43.167.2:31423;branch=z9hG4bK-524287-1---7571e2d19587e16b"],"viaCnt":1},"source":{"as":{"full":"AS51852 Private Layer INC","number":51852,"organization":{"name":"Private Layer INC"}},"bytes":1057,"geo":{"country_iso_code":"CH"},"ip":"179.43.167.2","mac":["98:44:ce:60:15:19"],"mac-cnt":1,"packets":1,"port":31423},"srcOui":["Huawei Technologies Co.,Ltd"],"srcOuiCnt":1,"srcPayload8":"494e564954452073","srcRIR":"LACNIC","srcTTL":[50],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["638541589972429"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["b05640bd-eb2a-4d9d-8d73-d14d7cbeb44a"],"signatureCnt":1,"signatureId":[1071802],"signatureIdCnt":1},"tag":{"block":["false"],"blockCnt":1,"category":["protocol"],"categoryCnt":1,"description":["ip addresses with this tag have been observed sending sip traffic."],"intention":["unknown"],"intentionCnt":1,"name":["sip protocol"],"nameCnt":1},"tags":["sensor:bahrain-sponge-01-ts","honeypot","bahrain-sponge-01-ts"],"tagsCnt":3,"totDataBytes":1015} +{"@timestamp":1787592822735,"_id":"260824-pZg1YPaZmlRBTIa1Puf8i-Gs","_index":"arkime_sessions3-260824","client":{"bytes":1034},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo GmbH"],"isp.dstCnt":1,"isp.src":["Private Layer INC"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Private Layer Inc"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS51167 Contabo GmbH","number":51167,"organization":{"name":"Contabo GmbH"}},"bytes":0,"geo":{"country_iso_code":"FR"},"ip":"109.123.246.142","mac":["00:50:56:63:46:a6"],"mac-cnt":1,"packets":0,"port":5060},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[78873],"firstPacket":1787591505949,"ipProtocol":17,"lastPacket":1787591505949,"length":0,"network":{"bytes":1076,"community_id":"1:xEwN2TNWVeajG8sbYQpmPxZdL4M=","packets":1},"node":"spark-afae","packetPos":[-78873,1817],"packetRange":{"gte":1787591505949,"lte":1787591505949},"protocol":["udp","sip"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":0},"sip":{"callid":["uyskoFzcUHFw3JP5qk8UaW.."],"callidCnt":1,"contact":["\u003csip:16299777872@179.43.167.2:31423\u003e"],"contactCnt":1,"from":["\u003csip:16299777872@179.43.167.2\u003e;tag=b279b7cb"],"fromCnt":1,"method":["INVITE"],"methodCnt":1,"to":["\u003csip:90113908351673002@109.123.246.142:5060\u003e"],"toCnt":1,"user":["16299777872","90113908351673002"],"userCnt":2,"useragent":["Linksys/SPA942-5.1.10"],"useragentCnt":1,"via":["SIP/2.0/UDP 179.43.167.2:31423;branch=z9hG4bK-524287-1---a790ee7a03233448"],"viaCnt":1},"source":{"as":{"full":"AS51852 Private Layer INC","number":51852,"organization":{"name":"Private Layer INC"}},"bytes":1076,"geo":{"country_iso_code":"CH"},"ip":"179.43.167.2","mac":["c0:69:11:cd:1f:19"],"mac-cnt":1,"packets":1,"port":31423},"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcPayload8":"494e564954452073","srcRIR":"LACNIC","srcTTL":[55],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["420974140947385"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["b05640bd-eb2a-4d9d-8d73-d14d7cbeb44a"],"signatureCnt":1,"signatureId":[1071802],"signatureIdCnt":1},"tag":{"block":["false"],"blockCnt":1,"category":["protocol"],"categoryCnt":1,"description":["ip addresses with this tag have been observed sending sip traffic."],"intention":["unknown"],"intentionCnt":1,"name":["sip protocol"],"nameCnt":1},"tags":["sensor:contabo-sponge-02-ts","proxy","contabo-sponge-02-ts"],"tagsCnt":3,"totDataBytes":1034} +{"@timestamp":1787581352933,"_id":"260824-VfAI0F6soG1CyaDDQLsMdUh4","_index":"arkime_sessions3-260824","client":{"bytes":1028},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Private Layer INC"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Private Layer Inc"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":0,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":0,"port":5060},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[78811],"firstPacket":1787580606417,"ipProtocol":17,"lastPacket":1787580606417,"length":0,"network":{"bytes":1070,"community_id":"1:z0qEHwg7IpvFU4z++gMKaVw9NAw=","packets":1},"node":"spark-afae","packetPos":[-78811,2558094],"packetRange":{"gte":1787580606417,"lte":1787580606417},"protocol":["sip","udp"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":0},"sip":{"callid":["Fm9EuQlwYKQCN6zN9yyscm.."],"callidCnt":1,"contact":["\u003csip:16724692132@179.43.167.2:23377\u003e"],"contactCnt":1,"from":["\u003csip:16724692132@179.43.167.2\u003e;tag=602313d0"],"fromCnt":1,"method":["INVITE"],"methodCnt":1,"to":["\u003csip:0113908351673002@217.15.163.226:5060\u003e"],"toCnt":1,"user":["0113908351673002","16724692132"],"userCnt":2,"useragent":["Asterisk PBX 18.9.0"],"useragentCnt":1,"via":["SIP/2.0/UDP 179.43.167.2:23377;branch=z9hG4bK-524287-1---59dfaba515e48073"],"viaCnt":1},"source":{"as":{"full":"AS51852 Private Layer INC","number":51852,"organization":{"name":"Private Layer INC"}},"bytes":1070,"geo":{"country_iso_code":"CH"},"ip":"179.43.167.2","mac":["fc:bd:67:9d:2b:2b"],"mac-cnt":1,"packets":1,"port":23377},"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcPayload8":"494e564954452073","srcRIR":"LACNIC","srcTTL":[52],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["1791547634671365"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["b05640bd-eb2a-4d9d-8d73-d14d7cbeb44a"],"signatureCnt":1,"signatureId":[1071802],"signatureIdCnt":1},"tag":{"block":["false"],"blockCnt":1,"category":["protocol"],"categoryCnt":1,"description":["ip addresses with this tag have been observed sending sip traffic."],"intention":["unknown"],"intentionCnt":1,"name":["sip protocol"],"nameCnt":1},"tags":["honeypot","sensor:contabo-sponge-01-ts","contabo-sponge-01-ts"],"tagsCnt":3,"totDataBytes":1028} +{"@timestamp":1787577438610,"_id":"260824-UZfHEX0D9KJID5BQ7LFWGdFy","_index":"arkime_sessions3-260824","client":{"bytes":1020},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo GmbH"],"isp.dstCnt":1,"isp.src":["Private Layer INC"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Private Layer Inc"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS51167 Contabo GmbH","number":51167,"organization":{"name":"Contabo GmbH"}},"bytes":0,"geo":{"country_iso_code":"FR"},"ip":"109.123.246.142","mac":["00:50:56:63:46:a6"],"mac-cnt":1,"packets":0,"port":5060},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[78788],"firstPacket":1787576983511,"ipProtocol":17,"lastPacket":1787576983511,"length":0,"network":{"bytes":1062,"community_id":"1:sI0CwOu5F2CEkyx/BgPqpuPEr8g=","packets":1},"node":"spark-afae","packetPos":[-78788,826508],"packetRange":{"gte":1787576983511,"lte":1787576983511},"protocol":["udp","sip"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":0},"sip":{"callid":["ing7dDodSB62gQyCZttknW.."],"callidCnt":1,"contact":["\u003csip:16299777872@179.43.167.2:23377\u003e"],"contactCnt":1,"from":["\u003csip:16299777872@179.43.167.2\u003e;tag=069b055f"],"fromCnt":1,"method":["INVITE"],"methodCnt":1,"to":["\u003csip:0113908351673002@109.123.246.142:5060\u003e"],"toCnt":1,"user":["0113908351673002","16299777872"],"userCnt":2,"useragent":["NEC DT800"],"useragentCnt":1,"via":["SIP/2.0/UDP 179.43.167.2:23377;branch=z9hG4bK-524287-1---b6d50b7828f7bd98"],"viaCnt":1},"source":{"as":{"full":"AS51852 Private Layer INC","number":51852,"organization":{"name":"Private Layer INC"}},"bytes":1062,"geo":{"country_iso_code":"CH"},"ip":"179.43.167.2","mac":["c0:69:11:cd:1f:19"],"mac-cnt":1,"packets":1,"port":23377},"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcPayload8":"494e564954452073","srcRIR":"LACNIC","srcTTL":[55],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["2197865105138760"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["b05640bd-eb2a-4d9d-8d73-d14d7cbeb44a"],"signatureCnt":1,"signatureId":[1071802],"signatureIdCnt":1},"tag":{"block":["false"],"blockCnt":1,"category":["protocol"],"categoryCnt":1,"description":["ip addresses with this tag have been observed sending sip traffic."],"intention":["unknown"],"intentionCnt":1,"name":["sip protocol"],"nameCnt":1},"tags":["proxy","sensor:contabo-sponge-02-ts","contabo-sponge-02-ts"],"tagsCnt":3,"totDataBytes":1020} +{"@timestamp":1787570184147,"_id":"260824-rZZc-GNX69hKF65RsJicqE1L","_index":"arkime_sessions3-260824","client":{"bytes":1021},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["netcup GmbH"],"isp.dstCnt":1,"isp.src":["Private Layer INC"],"isp.srcCnt":1,"org.dst":["Netcup KVM"],"org.dstCnt":1,"org.src":["Private Layer Inc"],"org.srcCnt":1,"usertype.dst":["business"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS197540 netcup GmbH","number":197540,"organization":{"name":"netcup GmbH"}},"bytes":0,"geo":{"country_iso_code":"DE"},"ip":"159.195.21.150","mac":["8a:41:d3:b8:0d:d3"],"mac-cnt":1,"packets":0,"port":5060},"dstRIR":"ARIN","ethertype":2048,"fileId":[78748],"firstPacket":1787569886282,"ipProtocol":17,"lastPacket":1787569886282,"length":0,"network":{"bytes":1063,"community_id":"1:VKffe4oH3kXJxTUfVQvAkERN6Mc=","packets":1},"node":"spark-afae","packetPos":[-78748,4077008],"packetRange":{"gte":1787569886282,"lte":1787569886282},"protocol":["udp","sip"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":0},"sip":{"callid":["afjZDEbfnuGShnk7btWjjv.."],"callidCnt":1,"contact":["\u003csip:17168465496@179.43.167.2:32545\u003e"],"contactCnt":1,"from":["\u003csip:17168465496@179.43.167.2\u003e;tag=8551011e"],"fromCnt":1,"method":["INVITE"],"methodCnt":1,"to":["\u003csip:+3908351673002@159.195.21.150:5060\u003e"],"toCnt":1,"user":["+3908351673002","17168465496"],"userCnt":2,"useragent":["Yealink SIP-T40P"],"useragentCnt":1,"via":["SIP/2.0/UDP 179.43.167.2:32545;branch=z9hG4bK-524287-1---cc82fc1ef8693600"],"viaCnt":1},"source":{"as":{"full":"AS51852 Private Layer INC","number":51852,"organization":{"name":"Private Layer INC"}},"bytes":1063,"geo":{"country_iso_code":"CH"},"ip":"179.43.167.2","mac":["bc:0f:fe:38:0b:a3"],"mac-cnt":1,"packets":1,"port":32545},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcPayload8":"494e564954452073","srcRIR":"LACNIC","srcTTL":[54],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["1775198638540024"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["b05640bd-eb2a-4d9d-8d73-d14d7cbeb44a"],"signatureCnt":1,"signatureId":[1071802],"signatureIdCnt":1},"tag":{"block":["false"],"blockCnt":1,"category":["protocol"],"categoryCnt":1,"description":["ip addresses with this tag have been observed sending sip traffic."],"intention":["unknown"],"intentionCnt":1,"name":["sip protocol"],"nameCnt":1},"tags":["netcup-ts","honeypot","sensor:netcup-ts"],"tagsCnt":3,"totDataBytes":1021} +{"@timestamp":1787566863956,"_id":"260824-k-6YwaqYfd9PKIy9gKJTeCQp","_index":"arkime_sessions3-260824","client":{"bytes":1033},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Private Layer INC"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Private Layer Inc"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":0,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":0,"port":5060},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[78731],"firstPacket":1787566112776,"ipProtocol":17,"lastPacket":1787566112776,"length":0,"network":{"bytes":1075,"community_id":"1:zxFaY3a7Vnl6muc7sT98zqv03+s=","packets":1},"node":"spark-afae","packetPos":[-78731,1687627],"packetRange":{"gte":1787566112776,"lte":1787566112776},"protocol":["udp","sip"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":0},"sip":{"callid":["gk3N68Y28J1IRpqIqHl6y1.."],"callidCnt":1,"contact":["\u003csip:16724692132@179.43.167.2:32545\u003e"],"contactCnt":1,"from":["\u003csip:16724692132@179.43.167.2\u003e;tag=56270a1c"],"fromCnt":1,"method":["INVITE"],"methodCnt":1,"to":["\u003csip:+3908351673002@217.15.163.226:5060\u003e"],"toCnt":1,"user":["16724692132","+3908351673002"],"userCnt":2,"useragent":["Grandstream GRP2615 1.0.5.93"],"useragentCnt":1,"via":["SIP/2.0/UDP 179.43.167.2:32545;branch=z9hG4bK-524287-1---087d436f774deef2"],"viaCnt":1},"source":{"as":{"full":"AS51852 Private Layer INC","number":51852,"organization":{"name":"Private Layer INC"}},"bytes":1075,"geo":{"country_iso_code":"CH"},"ip":"179.43.167.2","mac":["fc:bd:67:9d:2b:2b"],"mac-cnt":1,"packets":1,"port":32545},"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcPayload8":"494e564954452073","srcRIR":"LACNIC","srcTTL":[52],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["237549536327387"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["b05640bd-eb2a-4d9d-8d73-d14d7cbeb44a"],"signatureCnt":1,"signatureId":[1071802],"signatureIdCnt":1},"tag":{"block":["false"],"blockCnt":1,"category":["protocol"],"categoryCnt":1,"description":["ip addresses with this tag have been observed sending sip traffic."],"intention":["unknown"],"intentionCnt":1,"name":["sip protocol"],"nameCnt":1},"tags":["honeypot","contabo-sponge-01-ts","sensor:contabo-sponge-01-ts"],"tagsCnt":3,"totDataBytes":1033} +{"@timestamp":1787562933248,"_id":"260824-Hpb7psvtn3lJX4HhoBU6Ude2","_index":"arkime_sessions3-260824","client":{"bytes":1036},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo GmbH"],"isp.dstCnt":1,"isp.src":["Private Layer INC"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Private Layer Inc"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS51167 Contabo GmbH","number":51167,"organization":{"name":"Contabo GmbH"}},"bytes":0,"geo":{"country_iso_code":"FR"},"ip":"109.123.246.142","mac":["00:50:56:63:46:a6"],"mac-cnt":1,"packets":0,"port":5060},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[78708],"firstPacket":1787562501224,"ipProtocol":17,"lastPacket":1787562501224,"length":0,"network":{"bytes":1078,"community_id":"1:usbZBmotc9CtAmMX+AcHilAODgI=","packets":1},"node":"spark-afae","packetPos":[-78708,4235899],"packetRange":{"gte":1787562501224,"lte":1787562501224},"protocol":["udp","sip"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":0},"sip":{"callid":["WtJPzMqLNS80oTKunaslH4.."],"callidCnt":1,"contact":["\u003csip:16299777872@179.43.167.2:32545\u003e"],"contactCnt":1,"from":["\u003csip:16299777872@179.43.167.2\u003e;tag=1c60feb7"],"fromCnt":1,"method":["INVITE"],"methodCnt":1,"to":["\u003csip:+3908351673002@109.123.246.142:5060\u003e"],"toCnt":1,"user":["16299777872","+3908351673002"],"userCnt":2,"useragent":["Grandstream GXP2170 1.0.11.57"],"useragentCnt":1,"via":["SIP/2.0/UDP 179.43.167.2:32545;branch=z9hG4bK-524287-1---65cb7343dd00a383"],"viaCnt":1},"source":{"as":{"full":"AS51852 Private Layer INC","number":51852,"organization":{"name":"Private Layer INC"}},"bytes":1078,"geo":{"country_iso_code":"CH"},"ip":"179.43.167.2","mac":["c0:69:11:cd:1f:19"],"mac-cnt":1,"packets":1,"port":32545},"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcPayload8":"494e564954452073","srcRIR":"LACNIC","srcTTL":[55],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["1526226263178284"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["b05640bd-eb2a-4d9d-8d73-d14d7cbeb44a"],"signatureCnt":1,"signatureId":[1071802],"signatureIdCnt":1},"tag":{"block":["false"],"blockCnt":1,"category":["protocol"],"categoryCnt":1,"description":["ip addresses with this tag have been observed sending sip traffic."],"intention":["unknown"],"intentionCnt":1,"name":["sip protocol"],"nameCnt":1},"tags":["sensor:contabo-sponge-02-ts","proxy","contabo-sponge-02-ts"],"tagsCnt":3,"totDataBytes":1036} +{"@timestamp":1787561093203,"_id":"260824-1-3AroIx2yRE_5G1TUoiG4y-","_index":"arkime_sessions3-260824","client":{"bytes":1009},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Kaopu Cloud HK Limited"],"isp.dstCnt":1,"isp.src":["Private Layer INC"],"isp.srcCnt":1,"org.dst":["LightNode-BH"],"org.dstCnt":1,"org.src":["Private Layer Inc"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":0,"geo":{"country_iso_code":"BH"},"ip":"38.54.2.209","mac":["52:54:8f:9d:76:48"],"mac-cnt":1,"packets":0,"port":5060},"dstRIR":"ARIN","ethertype":2048,"fileId":[78699],"firstPacket":1787560164467,"ipProtocol":17,"lastPacket":1787560164467,"length":0,"network":{"bytes":1051,"community_id":"1:6Rq3Vq4S6IscFgrflxiYV1/sPVc=","packets":1},"node":"spark-afae","packetPos":[-78699,2073631],"packetRange":{"gte":1787560164467,"lte":1787560164467},"protocol":["sip","udp"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":0},"sip":{"callid":["BmT3GxOWzOoB8CqHXqvtKT.."],"callidCnt":1,"contact":["\u003csip:16563628947@179.43.167.2:22456\u003e"],"contactCnt":1,"from":["\u003csip:16563628947@179.43.167.2\u003e;tag=24993a77"],"fromCnt":1,"method":["INVITE"],"methodCnt":1,"to":["\u003csip:0013908351673002@38.54.2.209:5060\u003e"],"toCnt":1,"user":["16563628947","0013908351673002"],"userCnt":2,"useragent":["X-Lite"],"useragentCnt":1,"via":["SIP/2.0/UDP 179.43.167.2:22456;branch=z9hG4bK-524287-1---e518bcb681f32451"],"viaCnt":1},"source":{"as":{"full":"AS51852 Private Layer INC","number":51852,"organization":{"name":"Private Layer INC"}},"bytes":1051,"geo":{"country_iso_code":"CH"},"ip":"179.43.167.2","mac":["98:44:ce:60:15:19"],"mac-cnt":1,"packets":1,"port":22456},"srcOui":["Huawei Technologies Co.,Ltd"],"srcOuiCnt":1,"srcPayload8":"494e564954452073","srcRIR":"LACNIC","srcTTL":[50],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["1164876226023445"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["b05640bd-eb2a-4d9d-8d73-d14d7cbeb44a"],"signatureCnt":1,"signatureId":[1071802],"signatureIdCnt":1},"tag":{"block":["false"],"blockCnt":1,"category":["protocol"],"categoryCnt":1,"description":["ip addresses with this tag have been observed sending sip traffic."],"intention":["unknown"],"intentionCnt":1,"name":["sip protocol"],"nameCnt":1},"tags":["sensor:bahrain-sponge-01-ts","honeypot","bahrain-sponge-01-ts"],"tagsCnt":3,"totDataBytes":1009} +{"@timestamp":1787558678493,"_id":"260824-xpXNj0-ZRk1IbrYhrCn3J2yF","_index":"arkime_sessions3-260824","client":{"bytes":1027},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo GmbH"],"isp.dstCnt":1,"isp.src":["Private Layer INC"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Private Layer Inc"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS51167 Contabo GmbH","number":51167,"organization":{"name":"Contabo GmbH"}},"bytes":0,"geo":{"country_iso_code":"FR"},"ip":"109.123.246.142","mac":["00:50:56:63:46:a6"],"mac-cnt":1,"packets":0,"port":5060},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[78684],"firstPacket":1787557923115,"ipProtocol":17,"lastPacket":1787557923115,"length":0,"network":{"bytes":1069,"community_id":"1:LBaJ4lMIifNevEkMaa9TEo5dwJg=","packets":1},"node":"spark-afae","packetPos":[-78684,975913],"packetRange":{"gte":1787557923115,"lte":1787557923115},"protocol":["udp","sip"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":0},"sip":{"callid":["dY4D2aidAtkHaLcsjynYyD.."],"callidCnt":1,"contact":["\u003csip:16299777872@179.43.167.2:22456\u003e"],"contactCnt":1,"from":["\u003csip:16299777872@179.43.167.2\u003e;tag=d78aa1bd"],"fromCnt":1,"method":["INVITE"],"methodCnt":1,"to":["\u003csip:0013908351673002@109.123.246.142:5060\u003e"],"toCnt":1,"user":["16299777872","0013908351673002"],"userCnt":2,"useragent":["Yealink SIP-T48G"],"useragentCnt":1,"via":["SIP/2.0/UDP 179.43.167.2:22456;branch=z9hG4bK-524287-1---71fe388e6fd0a273"],"viaCnt":1},"source":{"as":{"full":"AS51852 Private Layer INC","number":51852,"organization":{"name":"Private Layer INC"}},"bytes":1069,"geo":{"country_iso_code":"CH"},"ip":"179.43.167.2","mac":["c0:69:11:cd:1f:19"],"mac-cnt":1,"packets":1,"port":22456},"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcPayload8":"494e564954452073","srcRIR":"LACNIC","srcTTL":[55],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["1057153776352758"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["b05640bd-eb2a-4d9d-8d73-d14d7cbeb44a"],"signatureCnt":1,"signatureId":[1071802],"signatureIdCnt":1},"tag":{"block":["false"],"blockCnt":1,"category":["protocol"],"categoryCnt":1,"description":["ip addresses with this tag have been observed sending sip traffic."],"intention":["unknown"],"intentionCnt":1,"name":["sip protocol"],"nameCnt":1},"tags":["proxy","sensor:contabo-sponge-02-ts","contabo-sponge-02-ts"],"tagsCnt":3,"totDataBytes":1027} +{"@timestamp":1787551404736,"_id":"260824-jDGnQBUAJYpDAKoP-N9EruFT","_index":"arkime_sessions3-260824","client":{"bytes":1028},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["netcup GmbH"],"isp.dstCnt":1,"isp.src":["Private Layer INC"],"isp.srcCnt":1,"org.dst":["Netcup KVM"],"org.dstCnt":1,"org.src":["Private Layer Inc"],"org.srcCnt":1,"usertype.dst":["business"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS197540 netcup GmbH","number":197540,"organization":{"name":"netcup GmbH"}},"bytes":0,"geo":{"country_iso_code":"DE"},"ip":"159.195.21.150","mac":["8a:41:d3:b8:0d:d3"],"mac-cnt":1,"packets":0,"port":5060},"dstRIR":"ARIN","ethertype":2048,"fileId":[78646],"firstPacket":1787550835395,"ipProtocol":17,"lastPacket":1787550835395,"length":0,"network":{"bytes":1070,"community_id":"1:hsOrhKAKPYnJULQ7rnk+2UzPcN8=","packets":1},"node":"spark-afae","packetPos":[-78646,11594494],"packetRange":{"gte":1787550835395,"lte":1787550835395},"protocol":["udp","sip"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":0},"sip":{"callid":["uFxHOxZy76t3UXd3pcZrsV.."],"callidCnt":1,"contact":["\u003csip:17168465496@179.43.167.2:32781\u003e"],"contactCnt":1,"from":["\u003csip:17168465496@179.43.167.2\u003e;tag=7109eb40"],"fromCnt":1,"method":["INVITE"],"methodCnt":1,"to":["\u003csip:0123908351673002@159.195.21.150:5060\u003e"],"toCnt":1,"user":["0123908351673002","17168465496"],"userCnt":2,"useragent":["Panasonic KX-HDV230"],"useragentCnt":1,"via":["SIP/2.0/UDP 179.43.167.2:32781;branch=z9hG4bK-524287-1---23f478c736af478c"],"viaCnt":1},"source":{"as":{"full":"AS51852 Private Layer INC","number":51852,"organization":{"name":"Private Layer INC"}},"bytes":1070,"geo":{"country_iso_code":"CH"},"ip":"179.43.167.2","mac":["bc:0f:fe:38:0b:a3"],"mac-cnt":1,"packets":1,"port":32781},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcPayload8":"494e564954452073","srcRIR":"LACNIC","srcTTL":[54],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["854299085445119"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["b05640bd-eb2a-4d9d-8d73-d14d7cbeb44a"],"signatureCnt":1,"signatureId":[1071802],"signatureIdCnt":1},"tag":{"block":["false"],"blockCnt":1,"category":["protocol"],"categoryCnt":1,"description":["ip addresses with this tag have been observed sending sip traffic."],"intention":["unknown"],"intentionCnt":1,"name":["sip protocol"],"nameCnt":1},"tags":["honeypot","netcup-ts","sensor:netcup-ts"],"tagsCnt":3,"totDataBytes":1028} +{"@timestamp":1787547789200,"_id":"260824-GezaKUeRDdBO8Z8jXCckY5dg","_index":"arkime_sessions3-260824","client":{"bytes":1035},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Private Layer INC"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Private Layer Inc"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":0,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":0,"port":5060},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[78625],"firstPacket":1787547059257,"ipProtocol":17,"lastPacket":1787547059257,"length":0,"network":{"bytes":1077,"community_id":"1:VpYdLBt8znNEMiavM0YqfXxsgxs=","packets":1},"node":"spark-afae","packetPos":[-78625,1173708],"packetRange":{"gte":1787547059257,"lte":1787547059257},"protocol":["udp","sip"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":0},"sip":{"callid":["289u45Lm1u7ajNPgUgafKX.."],"callidCnt":1,"contact":["\u003csip:16724692132@179.43.167.2:32781\u003e"],"contactCnt":1,"from":["\u003csip:16724692132@179.43.167.2\u003e;tag=8012ca01"],"fromCnt":1,"method":["INVITE"],"methodCnt":1,"to":["\u003csip:0123908351673002@217.15.163.226:5060\u003e"],"toCnt":1,"user":["0123908351673002","16724692132"],"userCnt":2,"useragent":["Yealink SIP-T46S 66.86.0.5"],"useragentCnt":1,"via":["SIP/2.0/UDP 179.43.167.2:32781;branch=z9hG4bK-524287-1---17877d0905eef029"],"viaCnt":1},"source":{"as":{"full":"AS51852 Private Layer INC","number":51852,"organization":{"name":"Private Layer INC"}},"bytes":1077,"geo":{"country_iso_code":"CH"},"ip":"179.43.167.2","mac":["fc:bd:67:9d:2b:2b"],"mac-cnt":1,"packets":1,"port":32781},"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcPayload8":"494e564954452073","srcRIR":"LACNIC","srcTTL":[52],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["1106193010171113"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["b05640bd-eb2a-4d9d-8d73-d14d7cbeb44a"],"signatureCnt":1,"signatureId":[1071802],"signatureIdCnt":1},"tag":{"block":["false"],"blockCnt":1,"category":["protocol"],"categoryCnt":1,"description":["ip addresses with this tag have been observed sending sip traffic."],"intention":["unknown"],"intentionCnt":1,"name":["sip protocol"],"nameCnt":1},"tags":["honeypot","contabo-sponge-01-ts","sensor:contabo-sponge-01-ts"],"tagsCnt":3,"totDataBytes":1035} +{"@timestamp":1787544184808,"_id":"260824-q-vP144cR4dPEaCuIY6dNVht","_index":"arkime_sessions3-260824","client":{"bytes":1037},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo GmbH"],"isp.dstCnt":1,"isp.src":["Private Layer INC"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Private Layer Inc"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS51167 Contabo GmbH","number":51167,"organization":{"name":"Contabo GmbH"}},"bytes":0,"geo":{"country_iso_code":"FR"},"ip":"109.123.246.142","mac":["00:50:56:63:46:a6"],"mac-cnt":1,"packets":0,"port":5060},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[78604],"firstPacket":1787543451666,"ipProtocol":17,"lastPacket":1787543451666,"length":0,"network":{"bytes":1079,"community_id":"1:+YrUICl5cySasOFohh9jHN14r1Q=","packets":1},"node":"spark-afae","packetPos":[-78604,88673],"packetRange":{"gte":1787543451666,"lte":1787543451666},"protocol":["udp","sip"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":0},"sip":{"callid":["yNLLiNXVcPIv9k3TCqI0vJ.."],"callidCnt":1,"contact":["\u003csip:16299777872@179.43.167.2:32781\u003e"],"contactCnt":1,"from":["\u003csip:16299777872@179.43.167.2\u003e;tag=0b57dc04"],"fromCnt":1,"method":["INVITE"],"methodCnt":1,"to":["\u003csip:0123908351673002@109.123.246.142:5060\u003e"],"toCnt":1,"user":["0123908351673002","16299777872"],"userCnt":2,"useragent":["Avaya-IP-Phone-9608 S6.6.4"],"useragentCnt":1,"via":["SIP/2.0/UDP 179.43.167.2:32781;branch=z9hG4bK-524287-1---e4a234c1cd766836"],"viaCnt":1},"source":{"as":{"full":"AS51852 Private Layer INC","number":51852,"organization":{"name":"Private Layer INC"}},"bytes":1079,"geo":{"country_iso_code":"CH"},"ip":"179.43.167.2","mac":["c0:69:11:cd:1f:19"],"mac-cnt":1,"packets":1,"port":32781},"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcPayload8":"494e564954452073","srcRIR":"LACNIC","srcTTL":[55],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["890235784963217"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["b05640bd-eb2a-4d9d-8d73-d14d7cbeb44a"],"signatureCnt":1,"signatureId":[1071802],"signatureIdCnt":1},"tag":{"block":["false"],"blockCnt":1,"category":["protocol"],"categoryCnt":1,"description":["ip addresses with this tag have been observed sending sip traffic."],"intention":["unknown"],"intentionCnt":1,"name":["sip protocol"],"nameCnt":1},"tags":["contabo-sponge-02-ts","sensor:contabo-sponge-02-ts","proxy"],"tagsCnt":3,"totDataBytes":1037} +{"@timestamp":1787537234099,"_id":"260824-HTHKObzT-gJPtrBjF6fZ09LB","_index":"arkime_sessions3-260824","client":{"bytes":1026},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["netcup GmbH"],"isp.dstCnt":1,"isp.src":["Private Layer INC"],"isp.srcCnt":1,"org.dst":["Netcup KVM"],"org.dstCnt":1,"org.src":["Private Layer Inc"],"org.srcCnt":1,"usertype.dst":["business"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS197540 netcup GmbH","number":197540,"organization":{"name":"netcup GmbH"}},"bytes":0,"geo":{"country_iso_code":"DE"},"ip":"159.195.21.150","mac":["8a:41:d3:b8:0d:d3"],"mac-cnt":1,"packets":0,"port":5060},"dstRIR":"ARIN","ethertype":2048,"fileId":[78565],"firstPacket":1787536351309,"ipProtocol":17,"lastPacket":1787536351309,"length":0,"network":{"bytes":1068,"community_id":"1:/Rg8sNfnZ5dP+RhHguWIzguM05Q=","packets":1},"node":"spark-afae","packetPos":[-78565,2097753],"packetRange":{"gte":1787536351309,"lte":1787536351309},"protocol":["udp","sip"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":0},"sip":{"callid":["PdvG9KpY5QBYbUAg36aiUj.."],"callidCnt":1,"contact":["\u003csip:17168465496@179.43.167.2:29343\u003e"],"contactCnt":1,"from":["\u003csip:17168465496@179.43.167.2\u003e;tag=52ecfd6f"],"fromCnt":1,"method":["INVITE"],"methodCnt":1,"to":["\u003csip:0103908351673002@159.195.21.150:5060\u003e"],"toCnt":1,"user":["0103908351673002","17168465496"],"userCnt":2,"useragent":["Grandstream HT802"],"useragentCnt":1,"via":["SIP/2.0/UDP 179.43.167.2:29343;branch=z9hG4bK-524287-1---0c8c2c6f8085a997"],"viaCnt":1},"source":{"as":{"full":"AS51852 Private Layer INC","number":51852,"organization":{"name":"Private Layer INC"}},"bytes":1068,"geo":{"country_iso_code":"CH"},"ip":"179.43.167.2","mac":["bc:0f:fe:38:0b:a3"],"mac-cnt":1,"packets":1,"port":29343},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcPayload8":"494e564954452073","srcRIR":"LACNIC","srcTTL":[54],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["2174047328236938"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["b05640bd-eb2a-4d9d-8d73-d14d7cbeb44a"],"signatureCnt":1,"signatureId":[1071802],"signatureIdCnt":1},"tag":{"block":["false"],"blockCnt":1,"category":["protocol"],"categoryCnt":1,"description":["ip addresses with this tag have been observed sending sip traffic."],"intention":["unknown"],"intentionCnt":1,"name":["sip protocol"],"nameCnt":1},"tags":["sensor:netcup-ts","honeypot","netcup-ts"],"tagsCnt":3,"totDataBytes":1026} +{"@timestamp":1787533624118,"_id":"260824-VOpYd5JWpjBEnpQO2dtdJKpW","_index":"arkime_sessions3-260824","client":{"bytes":1041},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Private Layer INC"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Private Layer Inc"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":0,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":0,"port":5060},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[78547],"firstPacket":1787532583908,"ipProtocol":17,"lastPacket":1787532583908,"length":0,"network":{"bytes":1083,"community_id":"1:vjITv3q1bLBYJ3V2Qbw9zNjcD70=","packets":1},"node":"spark-afae","packetPos":[-78547,7631992],"packetRange":{"gte":1787532583908,"lte":1787532583908},"protocol":["sip","udp"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":0},"sip":{"callid":["0Kx6bf1mNHFYs1JiYHTf2E.."],"callidCnt":1,"contact":["\u003csip:16724692132@179.43.167.2:29343\u003e"],"contactCnt":1,"from":["\u003csip:16724692132@179.43.167.2\u003e;tag=1a05cfdb"],"fromCnt":1,"method":["INVITE"],"methodCnt":1,"to":["\u003csip:0103908351673002@217.15.163.226:5060\u003e"],"toCnt":1,"user":["16724692132","0103908351673002"],"userCnt":2,"useragent":["Avaya Aura Communication Manager"],"useragentCnt":1,"via":["SIP/2.0/UDP 179.43.167.2:29343;branch=z9hG4bK-524287-1---847787544c5aaa25"],"viaCnt":1},"source":{"as":{"full":"AS51852 Private Layer INC","number":51852,"organization":{"name":"Private Layer INC"}},"bytes":1083,"geo":{"country_iso_code":"CH"},"ip":"179.43.167.2","mac":["fc:bd:67:9d:2b:2b"],"mac-cnt":1,"packets":1,"port":29343},"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcPayload8":"494e564954452073","srcRIR":"LACNIC","srcTTL":[52],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["2213163786049354"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["b05640bd-eb2a-4d9d-8d73-d14d7cbeb44a"],"signatureCnt":1,"signatureId":[1071802],"signatureIdCnt":1},"tag":{"block":["false"],"blockCnt":1,"category":["protocol"],"categoryCnt":1,"description":["ip addresses with this tag have been observed sending sip traffic."],"intention":["unknown"],"intentionCnt":1,"name":["sip protocol"],"nameCnt":1},"tags":["sensor:contabo-sponge-01-ts","contabo-sponge-01-ts","honeypot"],"tagsCnt":3,"totDataBytes":1041} +{"@timestamp":1787532422263,"_id":"260824-KOrqz35_CClPca5Bvd8Pg_eV","_index":"arkime_sessions3-260824","client":{"bytes":1017},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Kaopu Cloud HK Limited"],"isp.dstCnt":1,"isp.src":["Private Layer INC"],"isp.srcCnt":1,"org.dst":["LightNode-BH"],"org.dstCnt":1,"org.src":["Private Layer Inc"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":0,"geo":{"country_iso_code":"BH"},"ip":"38.54.2.209","mac":["52:54:8f:9d:76:48"],"mac-cnt":1,"packets":0,"port":5060},"dstRIR":"ARIN","ethertype":2048,"fileId":[78540],"firstPacket":1787531214646,"ipProtocol":17,"lastPacket":1787531214646,"length":0,"network":{"bytes":1059,"community_id":"1:reK2V4uAx79R0cYn0CgYf2UzkGc=","packets":1},"node":"spark-afae","packetPos":[-78540,1824664],"packetRange":{"gte":1787531214646,"lte":1787531214646},"protocol":["udp","sip"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":0},"sip":{"callid":["keLd4wk6oH5jupP0vFG9un.."],"callidCnt":1,"contact":["\u003csip:16563628947@179.43.167.2:29343\u003e"],"contactCnt":1,"from":["\u003csip:16563628947@179.43.167.2\u003e;tag=b7c0ae1f"],"fromCnt":1,"method":["INVITE"],"methodCnt":1,"to":["\u003csip:0103908351673002@38.54.2.209:5060\u003e"],"toCnt":1,"user":["16563628947","0103908351673002"],"userCnt":2,"useragent":["Vodia PBX 65.0"],"useragentCnt":1,"via":["SIP/2.0/UDP 179.43.167.2:29343;branch=z9hG4bK-524287-1---c89bc8c8ed8699d7"],"viaCnt":1},"source":{"as":{"full":"AS51852 Private Layer INC","number":51852,"organization":{"name":"Private Layer INC"}},"bytes":1059,"geo":{"country_iso_code":"CH"},"ip":"179.43.167.2","mac":["98:44:ce:60:15:19"],"mac-cnt":1,"packets":1,"port":29343},"srcOui":["Huawei Technologies Co.,Ltd"],"srcOuiCnt":1,"srcPayload8":"494e564954452073","srcRIR":"LACNIC","srcTTL":[50],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["1932763830375370"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["b05640bd-eb2a-4d9d-8d73-d14d7cbeb44a"],"signatureCnt":1,"signatureId":[1071802],"signatureIdCnt":1},"tag":{"block":["false"],"blockCnt":1,"category":["protocol"],"categoryCnt":1,"description":["ip addresses with this tag have been observed sending sip traffic."],"intention":["unknown"],"intentionCnt":1,"name":["sip protocol"],"nameCnt":1},"tags":["bahrain-sponge-01-ts","honeypot","sensor:bahrain-sponge-01-ts"],"tagsCnt":3,"totDataBytes":1017} +{"@timestamp":1787529702287,"_id":"260823-x-kDF6vDrA9Fn5ehMTsj9whI","_index":"arkime_sessions3-260823","client":{"bytes":1025},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo GmbH"],"isp.dstCnt":1,"isp.src":["Private Layer INC"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Private Layer Inc"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS51167 Contabo GmbH","number":51167,"organization":{"name":"Contabo GmbH"}},"bytes":0,"geo":{"country_iso_code":"FR"},"ip":"109.123.246.142","mac":["00:50:56:63:46:a6"],"mac-cnt":1,"packets":0,"port":5060},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[78524],"firstPacket":1787528976763,"ipProtocol":17,"lastPacket":1787528976763,"length":0,"network":{"bytes":1067,"community_id":"1:RmkKf+oNgDNLSi3kOMHCbjmEmr4=","packets":1},"node":"spark-afae","packetPos":[-78524,503509],"packetRange":{"gte":1787528976763,"lte":1787528976763},"protocol":["udp","sip"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":0},"sip":{"callid":["wjNDbMIlm0aHoe3vZSVXBk.."],"callidCnt":1,"contact":["\u003csip:16299777872@179.43.167.2:29343\u003e"],"contactCnt":1,"from":["\u003csip:16299777872@179.43.167.2\u003e;tag=f1d4165c"],"fromCnt":1,"method":["INVITE"],"methodCnt":1,"to":["\u003csip:0103908351673002@109.123.246.142:5060\u003e"],"toCnt":1,"user":["16299777872","0103908351673002"],"userCnt":2,"useragent":["Avaya IP Phone"],"useragentCnt":1,"via":["SIP/2.0/UDP 179.43.167.2:29343;branch=z9hG4bK-524287-1---b11fa0fbeb104e4f"],"viaCnt":1},"source":{"as":{"full":"AS51852 Private Layer INC","number":51852,"organization":{"name":"Private Layer INC"}},"bytes":1067,"geo":{"country_iso_code":"CH"},"ip":"179.43.167.2","mac":["c0:69:11:cd:1f:19"],"mac-cnt":1,"packets":1,"port":29343},"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcPayload8":"494e564954452073","srcRIR":"LACNIC","srcTTL":[55],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["184371763504474"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["b05640bd-eb2a-4d9d-8d73-d14d7cbeb44a"],"signatureCnt":1,"signatureId":[1071802],"signatureIdCnt":1},"tag":{"block":["false"],"blockCnt":1,"category":["protocol"],"categoryCnt":1,"description":["ip addresses with this tag have been observed sending sip traffic."],"intention":["unknown"],"intentionCnt":1,"name":["sip protocol"],"nameCnt":1},"tags":["contabo-sponge-02-ts","sensor:contabo-sponge-02-ts","proxy"],"tagsCnt":3,"totDataBytes":1025} +{"@timestamp":1787522752404,"_id":"260823--5KD-Ib_Gp9AK5dNrmV_ieXM","_index":"arkime_sessions3-260823","client":{"bytes":1024},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["netcup GmbH"],"isp.dstCnt":1,"isp.src":["Private Layer INC"],"isp.srcCnt":1,"org.dst":["Netcup KVM"],"org.dstCnt":1,"org.src":["Private Layer Inc"],"org.srcCnt":1,"usertype.dst":["business"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS197540 netcup GmbH","number":197540,"organization":{"name":"netcup GmbH"}},"bytes":0,"geo":{"country_iso_code":"DE"},"ip":"159.195.21.150","mac":["8a:41:d3:b8:0d:d3"],"mac-cnt":1,"packets":0,"port":5060},"dstRIR":"ARIN","ethertype":2048,"fileId":[78485],"firstPacket":1787521858614,"ipProtocol":17,"lastPacket":1787521858614,"length":0,"network":{"bytes":1066,"community_id":"1:fTaOVpmKNGrUAM7ypCaYKI4OpKE=","packets":1},"node":"spark-afae","packetPos":[-78485,4252587],"packetRange":{"gte":1787521858614,"lte":1787521858614},"protocol":["udp","sip"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":0},"sip":{"callid":["eFvy9PfYaL8rPv8uPbDBvB.."],"callidCnt":1,"contact":["\u003csip:17168465496@179.43.167.2:25405\u003e"],"contactCnt":1,"from":["\u003csip:17168465496@179.43.167.2\u003e;tag=124eff89"],"fromCnt":1,"method":["INVITE"],"methodCnt":1,"to":["\u003csip:00113908351673002@159.195.21.150:5060\u003e"],"toCnt":1,"user":["00113908351673002","17168465496"],"userCnt":2,"useragent":["Linksys PAP2T"],"useragentCnt":1,"via":["SIP/2.0/UDP 179.43.167.2:25405;branch=z9hG4bK-524287-1---6c4dfdc751063d6b"],"viaCnt":1},"source":{"as":{"full":"AS51852 Private Layer INC","number":51852,"organization":{"name":"Private Layer INC"}},"bytes":1066,"geo":{"country_iso_code":"CH"},"ip":"179.43.167.2","mac":["bc:0f:fe:38:0b:a3"],"mac-cnt":1,"packets":1,"port":25405},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcPayload8":"494e564954452073","srcRIR":"LACNIC","srcTTL":[54],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["668011170023988"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["b05640bd-eb2a-4d9d-8d73-d14d7cbeb44a"],"signatureCnt":1,"signatureId":[1071802],"signatureIdCnt":1},"tag":{"block":["false"],"blockCnt":1,"category":["protocol"],"categoryCnt":1,"description":["ip addresses with this tag have been observed sending sip traffic."],"intention":["unknown"],"intentionCnt":1,"name":["sip protocol"],"nameCnt":1},"tags":["sensor:netcup-ts","honeypot","netcup-ts"],"tagsCnt":3,"totDataBytes":1024} +{"@timestamp":1787519441082,"_id":"260823-cuiYJlmHIXBOkrSFOE3YvIU3","_index":"arkime_sessions3-260823","client":{"bytes":1026},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Private Layer INC"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Private Layer Inc"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":0,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":0,"port":5060},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[78467],"firstPacket":1787518080720,"ipProtocol":17,"lastPacket":1787518080720,"length":0,"network":{"bytes":1068,"community_id":"1:dONUx83apcheOFKzG5cAqcTvUrQ=","packets":1},"node":"spark-afae","packetPos":[-78467,543210],"packetRange":{"gte":1787518080720,"lte":1787518080720},"protocol":["sip","udp"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":0},"sip":{"callid":["0NpsSqYgPP51E8gmqXT2Rv.."],"callidCnt":1,"contact":["\u003csip:16724692132@179.43.167.2:25405\u003e"],"contactCnt":1,"from":["\u003csip:16724692132@179.43.167.2\u003e;tag=bfedd890"],"fromCnt":1,"method":["INVITE"],"methodCnt":1,"to":["\u003csip:00113908351673002@217.15.163.226:5060\u003e"],"toCnt":1,"user":["16724692132","00113908351673002"],"userCnt":2,"useragent":["MicroSIP/3.20.2"],"useragentCnt":1,"via":["SIP/2.0/UDP 179.43.167.2:25405;branch=z9hG4bK-524287-1---404b5ad4fb9d2d7c"],"viaCnt":1},"source":{"as":{"full":"AS51852 Private Layer INC","number":51852,"organization":{"name":"Private Layer INC"}},"bytes":1068,"geo":{"country_iso_code":"CH"},"ip":"179.43.167.2","mac":["fc:bd:67:9d:2b:2b"],"mac-cnt":1,"packets":1,"port":25405},"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcPayload8":"494e564954452073","srcRIR":"LACNIC","srcTTL":[52],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["278214572270679"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["b05640bd-eb2a-4d9d-8d73-d14d7cbeb44a"],"signatureCnt":1,"signatureId":[1071802],"signatureIdCnt":1},"tag":{"block":["false"],"blockCnt":1,"category":["protocol"],"categoryCnt":1,"description":["ip addresses with this tag have been observed sending sip traffic."],"intention":["unknown"],"intentionCnt":1,"name":["sip protocol"],"nameCnt":1},"tags":["honeypot","sensor:contabo-sponge-01-ts","contabo-sponge-01-ts"],"tagsCnt":3,"totDataBytes":1026} +{"@timestamp":1787517938799,"_id":"260823-R-jAmSPVf6RJqKjWOUNU00EC","_index":"arkime_sessions3-260823","client":{"bytes":1016},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Kaopu Cloud HK Limited"],"isp.dstCnt":1,"isp.src":["Private Layer INC"],"isp.srcCnt":1,"org.dst":["LightNode-BH"],"org.dstCnt":1,"org.src":["Private Layer Inc"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":0,"geo":{"country_iso_code":"BH"},"ip":"38.54.2.209","mac":["52:54:8f:9d:76:48"],"mac-cnt":1,"packets":0,"port":5060},"dstRIR":"ARIN","ethertype":2048,"fileId":[78459],"firstPacket":1787516710246,"ipProtocol":17,"lastPacket":1787516710246,"length":0,"network":{"bytes":1058,"community_id":"1:aNSby1NisA6fdtsHjeBTqQDWKhs=","packets":1},"node":"spark-afae","packetPos":[-78459,503563],"packetRange":{"gte":1787516710246,"lte":1787516710246},"protocol":["udp","sip"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":0},"sip":{"callid":["xCgWKu0P5ZymnRD2UnDDfa.."],"callidCnt":1,"contact":["\u003csip:16563628947@179.43.167.2:25405\u003e"],"contactCnt":1,"from":["\u003csip:16563628947@179.43.167.2\u003e;tag=e96bff4c"],"fromCnt":1,"method":["INVITE"],"methodCnt":1,"to":["\u003csip:00113908351673002@38.54.2.209:5060\u003e"],"toCnt":1,"user":["16563628947","00113908351673002"],"userCnt":2,"useragent":["KPhone/3.13"],"useragentCnt":1,"via":["SIP/2.0/UDP 179.43.167.2:25405;branch=z9hG4bK-524287-1---d7d002cf449d0162"],"viaCnt":1},"source":{"as":{"full":"AS51852 Private Layer INC","number":51852,"organization":{"name":"Private Layer INC"}},"bytes":1058,"geo":{"country_iso_code":"CH"},"ip":"179.43.167.2","mac":["98:44:ce:60:15:19"],"mac-cnt":1,"packets":1,"port":25405},"srcOui":["Huawei Technologies Co.,Ltd"],"srcOuiCnt":1,"srcPayload8":"494e564954452073","srcRIR":"LACNIC","srcTTL":[50],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["1901997835078302"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["b05640bd-eb2a-4d9d-8d73-d14d7cbeb44a"],"signatureCnt":1,"signatureId":[1071802],"signatureIdCnt":1},"tag":{"block":["false"],"blockCnt":1,"category":["protocol"],"categoryCnt":1,"description":["ip addresses with this tag have been observed sending sip traffic."],"intention":["unknown"],"intentionCnt":1,"name":["sip protocol"],"nameCnt":1},"tags":["bahrain-sponge-01-ts","honeypot","sensor:bahrain-sponge-01-ts"],"tagsCnt":3,"totDataBytes":1016} +{"@timestamp":1787515228017,"_id":"260823-VpKXNdz1k_NGDIa9gi_7suB0","_index":"arkime_sessions3-260823","client":{"bytes":1039},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo GmbH"],"isp.dstCnt":1,"isp.src":["Private Layer INC"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Private Layer Inc"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS51167 Contabo GmbH","number":51167,"organization":{"name":"Contabo GmbH"}},"bytes":0,"geo":{"country_iso_code":"FR"},"ip":"109.123.246.142","mac":["00:50:56:63:46:a6"],"mac-cnt":1,"packets":0,"port":5060},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[78443],"firstPacket":1787514472162,"ipProtocol":17,"lastPacket":1787514472162,"length":0,"network":{"bytes":1081,"community_id":"1:3AyKjFCGQcDj41e4STiPjt5Qo7s=","packets":1},"node":"spark-afae","packetPos":[-78443,237519],"packetRange":{"gte":1787514472162,"lte":1787514472162},"protocol":["udp","sip"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":0},"sip":{"callid":["TAO6a8Tlq0dtK2NoomuvzK.."],"callidCnt":1,"contact":["\u003csip:16299777872@179.43.167.2:25405\u003e"],"contactCnt":1,"from":["\u003csip:16299777872@179.43.167.2\u003e;tag=6d0f6446"],"fromCnt":1,"method":["INVITE"],"methodCnt":1,"to":["\u003csip:00113908351673002@109.123.246.142:5060\u003e"],"toCnt":1,"user":["16299777872","00113908351673002"],"userCnt":2,"useragent":["Grandstream HT813 1.0.17.5"],"useragentCnt":1,"via":["SIP/2.0/UDP 179.43.167.2:25405;branch=z9hG4bK-524287-1---c7f68184d7acacd0"],"viaCnt":1},"source":{"as":{"full":"AS51852 Private Layer INC","number":51852,"organization":{"name":"Private Layer INC"}},"bytes":1081,"geo":{"country_iso_code":"CH"},"ip":"179.43.167.2","mac":["c0:69:11:cd:1f:19"],"mac-cnt":1,"packets":1,"port":25405},"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcPayload8":"494e564954452073","srcRIR":"LACNIC","srcTTL":[55],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["134470214295364"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["b05640bd-eb2a-4d9d-8d73-d14d7cbeb44a"],"signatureCnt":1,"signatureId":[1071802],"signatureIdCnt":1},"tag":{"block":["false"],"blockCnt":1,"category":["protocol"],"categoryCnt":1,"description":["ip addresses with this tag have been observed sending sip traffic."],"intention":["unknown"],"intentionCnt":1,"name":["sip protocol"],"nameCnt":1},"tags":["proxy","contabo-sponge-02-ts","sensor:contabo-sponge-02-ts"],"tagsCnt":3,"totDataBytes":1039} +{"@timestamp":1787508246281,"_id":"260823-nQchAOrn4aVN67DFVxNePyKe","_index":"arkime_sessions3-260823","client":{"bytes":1025},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["netcup GmbH"],"isp.dstCnt":1,"isp.src":["Private Layer INC"],"isp.srcCnt":1,"org.dst":["Netcup KVM"],"org.dstCnt":1,"org.src":["Private Layer Inc"],"org.srcCnt":1,"usertype.dst":["business"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS197540 netcup GmbH","number":197540,"organization":{"name":"netcup GmbH"}},"bytes":0,"geo":{"country_iso_code":"DE"},"ip":"159.195.21.150","mac":["8a:41:d3:b8:0d:d3"],"mac-cnt":1,"packets":0,"port":5060},"dstRIR":"ARIN","ethertype":2048,"fileId":[78404],"firstPacket":1787507358595,"ipProtocol":17,"lastPacket":1787507358595,"length":0,"network":{"bytes":1067,"community_id":"1:yqyIFnqsQM5ifzJ8zHqealfk0rg=","packets":1},"node":"spark-afae","packetPos":[-78404,4697579],"packetRange":{"gte":1787507358595,"lte":1787507358595},"protocol":["udp","sip"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":0},"sip":{"callid":["eqEKestYhleciUySKcjhIc.."],"callidCnt":1,"contact":["\u003csip:17168465496@179.43.167.2:28637\u003e"],"contactCnt":1,"from":["\u003csip:17168465496@179.43.167.2\u003e;tag=d108fb1b"],"fromCnt":1,"method":["INVITE"],"methodCnt":1,"to":["\u003csip:8103908351673002@159.195.21.150:5060\u003e"],"toCnt":1,"user":["8103908351673002","17168465496"],"userCnt":2,"useragent":["Yealink SIP-T54W"],"useragentCnt":1,"via":["SIP/2.0/UDP 179.43.167.2:28637;branch=z9hG4bK-524287-1---b508379401809c95"],"viaCnt":1},"source":{"as":{"full":"AS51852 Private Layer INC","number":51852,"organization":{"name":"Private Layer INC"}},"bytes":1067,"geo":{"country_iso_code":"CH"},"ip":"179.43.167.2","mac":["bc:0f:fe:38:0b:a3"],"mac-cnt":1,"packets":1,"port":28637},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcPayload8":"494e564954452073","srcRIR":"LACNIC","srcTTL":[54],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["1711267206632658"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["b05640bd-eb2a-4d9d-8d73-d14d7cbeb44a"],"signatureCnt":1,"signatureId":[1071802],"signatureIdCnt":1},"tag":{"block":["false"],"blockCnt":1,"category":["protocol"],"categoryCnt":1,"description":["ip addresses with this tag have been observed sending sip traffic."],"intention":["unknown"],"intentionCnt":1,"name":["sip protocol"],"nameCnt":1},"tags":["honeypot","netcup-ts","sensor:netcup-ts"],"tagsCnt":3,"totDataBytes":1025} +{"@timestamp":1787504936135,"_id":"260823-kZGrdCjf4ktAZY4L48D6RqwY","_index":"arkime_sessions3-260823","client":{"bytes":1015},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Private Layer INC"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Private Layer Inc"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":0,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":0,"port":5060},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[78386],"firstPacket":1787503581027,"ipProtocol":17,"lastPacket":1787503581027,"length":0,"network":{"bytes":1057,"community_id":"1:/WOpgMppCn5LZCZKSIK2SIP1i3U=","packets":1},"node":"spark-afae","packetPos":[-78386,24],"packetRange":{"gte":1787503581027,"lte":1787503581027},"protocol":["udp","sip"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":0},"sip":{"callid":["taxpAUKcV9HX8qt84E3CcS.."],"callidCnt":1,"contact":["\u003csip:16724692132@179.43.167.2:28637\u003e"],"contactCnt":1,"from":["\u003csip:16724692132@179.43.167.2\u003e;tag=3147bcc2"],"fromCnt":1,"method":["INVITE"],"methodCnt":1,"to":["\u003csip:8103908351673002@217.15.163.226:5060\u003e"],"toCnt":1,"user":["8103908351673002","16724692132"],"userCnt":2,"useragent":["Vonage"],"useragentCnt":1,"via":["SIP/2.0/UDP 179.43.167.2:28637;branch=z9hG4bK-524287-1---f8c6f3436fd76b5c"],"viaCnt":1},"source":{"as":{"full":"AS51852 Private Layer INC","number":51852,"organization":{"name":"Private Layer INC"}},"bytes":1057,"geo":{"country_iso_code":"CH"},"ip":"179.43.167.2","mac":["fc:bd:67:9d:2b:2b"],"mac-cnt":1,"packets":1,"port":28637},"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcPayload8":"494e564954452073","srcRIR":"LACNIC","srcTTL":[52],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["1525534115980502"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["b05640bd-eb2a-4d9d-8d73-d14d7cbeb44a"],"signatureCnt":1,"signatureId":[1071802],"signatureIdCnt":1},"tag":{"block":["false"],"blockCnt":1,"category":["protocol"],"categoryCnt":1,"description":["ip addresses with this tag have been observed sending sip traffic."],"intention":["unknown"],"intentionCnt":1,"name":["sip protocol"],"nameCnt":1},"tags":["sensor:contabo-sponge-01-ts","honeypot","contabo-sponge-01-ts"],"tagsCnt":3,"totDataBytes":1015} +{"@timestamp":1787502822843,"_id":"260823-WObC-m7A6olB1Ziy4YUk4IOs","_index":"arkime_sessions3-260823","client":{"bytes":1015},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Kaopu Cloud HK Limited"],"isp.dstCnt":1,"isp.src":["Private Layer INC"],"isp.srcCnt":1,"org.dst":["LightNode-BH"],"org.dstCnt":1,"org.src":["Private Layer Inc"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":0,"geo":{"country_iso_code":"BH"},"ip":"38.54.2.209","mac":["52:54:8f:9d:76:48"],"mac-cnt":1,"packets":0,"port":5060},"dstRIR":"ARIN","ethertype":2048,"fileId":[78375],"firstPacket":1787502209014,"ipProtocol":17,"lastPacket":1787502209014,"length":0,"network":{"bytes":1057,"community_id":"1:3cDlAY2HSa+E3wnze1iR/5DiPtc=","packets":1},"node":"spark-afae","packetPos":[-78375,2077209],"packetRange":{"gte":1787502209014,"lte":1787502209014},"protocol":["udp","sip"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":0},"sip":{"callid":["PpPXQcCdyopR0Jd34OlSst.."],"callidCnt":1,"contact":["\u003csip:16563628947@179.43.167.2:28637\u003e"],"contactCnt":1,"from":["\u003csip:16563628947@179.43.167.2\u003e;tag=6ca8e228"],"fromCnt":1,"method":["INVITE"],"methodCnt":1,"to":["\u003csip:8103908351673002@38.54.2.209:5060\u003e"],"toCnt":1,"user":["16563628947","8103908351673002"],"userCnt":2,"useragent":["Yealink W52P"],"useragentCnt":1,"via":["SIP/2.0/UDP 179.43.167.2:28637;branch=z9hG4bK-524287-1---aeed3cb4733f9d58"],"viaCnt":1},"source":{"as":{"full":"AS51852 Private Layer INC","number":51852,"organization":{"name":"Private Layer INC"}},"bytes":1057,"geo":{"country_iso_code":"CH"},"ip":"179.43.167.2","mac":["98:44:ce:60:15:19"],"mac-cnt":1,"packets":1,"port":28637},"srcOui":["Huawei Technologies Co.,Ltd"],"srcOuiCnt":1,"srcPayload8":"494e564954452073","srcRIR":"LACNIC","srcTTL":[50],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["343201292703974"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["b05640bd-eb2a-4d9d-8d73-d14d7cbeb44a"],"signatureCnt":1,"signatureId":[1071802],"signatureIdCnt":1},"tag":{"block":["false"],"blockCnt":1,"category":["protocol"],"categoryCnt":1,"description":["ip addresses with this tag have been observed sending sip traffic."],"intention":["unknown"],"intentionCnt":1,"name":["sip protocol"],"nameCnt":1},"tags":["sensor:bahrain-sponge-01-ts","bahrain-sponge-01-ts","honeypot"],"tagsCnt":3,"totDataBytes":1015} +{"@timestamp":1787500710733,"_id":"260823-FuYKRxSmHCVIFYahc1KEDHZG","_index":"arkime_sessions3-260823","client":{"bytes":1018},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo GmbH"],"isp.dstCnt":1,"isp.src":["Private Layer INC"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Private Layer Inc"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS51167 Contabo GmbH","number":51167,"organization":{"name":"Contabo GmbH"}},"bytes":0,"geo":{"country_iso_code":"FR"},"ip":"109.123.246.142","mac":["00:50:56:63:46:a6"],"mac-cnt":1,"packets":0,"port":5060},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[78363],"firstPacket":1787499965279,"ipProtocol":17,"lastPacket":1787499965279,"length":0,"network":{"bytes":1060,"community_id":"1:MTPEHW+wiEs6r4hlqmkXQljuJkc=","packets":1},"node":"spark-afae","packetPos":[-78363,831596],"packetRange":{"gte":1787499965279,"lte":1787499965279},"protocol":["udp","sip"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":0},"sip":{"callid":["boP4dhKKS9jLmaPgskvPF3.."],"callidCnt":1,"contact":["\u003csip:16299777872@179.43.167.2:28637\u003e"],"contactCnt":1,"from":["\u003csip:16299777872@179.43.167.2\u003e;tag=2e06e824"],"fromCnt":1,"method":["INVITE"],"methodCnt":1,"to":["\u003csip:8103908351673002@109.123.246.142:5060\u003e"],"toCnt":1,"user":["16299777872","8103908351673002"],"userCnt":2,"useragent":["FreePBX"],"useragentCnt":1,"via":["SIP/2.0/UDP 179.43.167.2:28637;branch=z9hG4bK-524287-1---09807af7ab6cf441"],"viaCnt":1},"source":{"as":{"full":"AS51852 Private Layer INC","number":51852,"organization":{"name":"Private Layer INC"}},"bytes":1060,"geo":{"country_iso_code":"CH"},"ip":"179.43.167.2","mac":["c0:69:11:cd:1f:19"],"mac-cnt":1,"packets":1,"port":28637},"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcPayload8":"494e564954452073","srcRIR":"LACNIC","srcTTL":[55],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["1483025503420473"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["b05640bd-eb2a-4d9d-8d73-d14d7cbeb44a"],"signatureCnt":1,"signatureId":[1071802],"signatureIdCnt":1},"tag":{"block":["false"],"blockCnt":1,"category":["protocol"],"categoryCnt":1,"description":["ip addresses with this tag have been observed sending sip traffic."],"intention":["unknown"],"intentionCnt":1,"name":["sip protocol"],"nameCnt":1},"tags":["sensor:contabo-sponge-02-ts","proxy","contabo-sponge-02-ts"],"tagsCnt":3,"totDataBytes":1018} +{"@timestamp":1787493788928,"_id":"260823-hwdxexUrZbJH9bhwRrvwVC6z","_index":"arkime_sessions3-260823","client":{"bytes":1017},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["netcup GmbH"],"isp.dstCnt":1,"isp.src":["Private Layer INC"],"isp.srcCnt":1,"org.dst":["Netcup KVM"],"org.dstCnt":1,"org.src":["Private Layer Inc"],"org.srcCnt":1,"usertype.dst":["business"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS197540 netcup GmbH","number":197540,"organization":{"name":"netcup GmbH"}},"bytes":0,"geo":{"country_iso_code":"DE"},"ip":"159.195.21.150","mac":["8a:41:d3:b8:0d:d3"],"mac-cnt":1,"packets":0,"port":5060},"dstRIR":"ARIN","ethertype":2048,"fileId":[78326],"firstPacket":1787492864625,"ipProtocol":17,"lastPacket":1787492864625,"length":0,"network":{"bytes":1059,"community_id":"1:jrUsKTKgSil/KMENbtyZEHhMXBQ=","packets":1},"node":"spark-afae","packetPos":[-78326,2994486],"packetRange":{"gte":1787492864625,"lte":1787492864625},"protocol":["udp","sip"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":0},"sip":{"callid":["alKf9MXenRhv0rofBcj6ux.."],"callidCnt":1,"contact":["\u003csip:17168465496@179.43.167.2:27272\u003e"],"contactCnt":1,"from":["\u003csip:17168465496@179.43.167.2\u003e;tag=1bb09932"],"fromCnt":1,"method":["INVITE"],"methodCnt":1,"to":["\u003csip:0003908351673002@159.195.21.150:5060\u003e"],"toCnt":1,"user":["17168465496","0003908351673002"],"userCnt":2,"useragent":["snomD765"],"useragentCnt":1,"via":["SIP/2.0/UDP 179.43.167.2:27272;branch=z9hG4bK-524287-1---d6f59ed437fdd003"],"viaCnt":1},"source":{"as":{"full":"AS51852 Private Layer INC","number":51852,"organization":{"name":"Private Layer INC"}},"bytes":1059,"geo":{"country_iso_code":"CH"},"ip":"179.43.167.2","mac":["bc:0f:fe:38:0b:a3"],"mac-cnt":1,"packets":1,"port":27272},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcPayload8":"494e564954452073","srcRIR":"LACNIC","srcTTL":[54],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["153592705797692"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["b05640bd-eb2a-4d9d-8d73-d14d7cbeb44a"],"signatureCnt":1,"signatureId":[1071802],"signatureIdCnt":1},"tag":{"block":["false"],"blockCnt":1,"category":["protocol"],"categoryCnt":1,"description":["ip addresses with this tag have been observed sending sip traffic."],"intention":["unknown"],"intentionCnt":1,"name":["sip protocol"],"nameCnt":1},"tags":["sensor:netcup-ts","netcup-ts","honeypot"],"tagsCnt":3,"totDataBytes":1017} +{"@timestamp":1787488371717,"_id":"260823-n-R7dSXjpH1C_6AvvLZ9HqVl","_index":"arkime_sessions3-260823","client":{"bytes":1021},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Kaopu Cloud HK Limited"],"isp.dstCnt":1,"isp.src":["Private Layer INC"],"isp.srcCnt":1,"org.dst":["LightNode-BH"],"org.dstCnt":1,"org.src":["Private Layer Inc"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":0,"geo":{"country_iso_code":"BH"},"ip":"38.54.2.209","mac":["52:54:8f:9d:76:48"],"mac-cnt":1,"packets":0,"port":5060},"dstRIR":"ARIN","ethertype":2048,"fileId":[78294],"firstPacket":1787487718645,"ipProtocol":17,"lastPacket":1787487718645,"length":0,"network":{"bytes":1063,"community_id":"1:fkJdTHj2U975DaBf1Um0R7B4dCU=","packets":1},"node":"spark-afae","packetPos":[-78294,1103135],"packetRange":{"gte":1787487718645,"lte":1787487718645},"protocol":["udp","sip"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":0},"sip":{"callid":["4UqGAZJF2I2o8Y0DxzKLI0.."],"callidCnt":1,"contact":["\u003csip:16563628947@179.43.167.2:27272\u003e"],"contactCnt":1,"from":["\u003csip:16563628947@179.43.167.2\u003e;tag=5d6340ee"],"fromCnt":1,"method":["INVITE"],"methodCnt":1,"to":["\u003csip:0003908351673002@38.54.2.209:5060\u003e"],"toCnt":1,"user":["16563628947","0003908351673002"],"userCnt":2,"useragent":["Cisco/SPA303-7.6.2"],"useragentCnt":1,"via":["SIP/2.0/UDP 179.43.167.2:27272;branch=z9hG4bK-524287-1---76fd40570ba2c61f"],"viaCnt":1},"source":{"as":{"full":"AS51852 Private Layer INC","number":51852,"organization":{"name":"Private Layer INC"}},"bytes":1063,"geo":{"country_iso_code":"CH"},"ip":"179.43.167.2","mac":["98:44:ce:60:15:19"],"mac-cnt":1,"packets":1,"port":27272},"srcOui":["Huawei Technologies Co.,Ltd"],"srcOuiCnt":1,"srcPayload8":"494e564954452073","srcRIR":"LACNIC","srcTTL":[50],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["1926574189609429"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["b05640bd-eb2a-4d9d-8d73-d14d7cbeb44a"],"signatureCnt":1,"signatureId":[1071802],"signatureIdCnt":1},"tag":{"block":["false"],"blockCnt":1,"category":["protocol"],"categoryCnt":1,"description":["ip addresses with this tag have been observed sending sip traffic."],"intention":["unknown"],"intentionCnt":1,"name":["sip protocol"],"nameCnt":1},"tags":["bahrain-sponge-01-ts","honeypot","sensor:bahrain-sponge-01-ts"],"tagsCnt":3,"totDataBytes":1021} +{"@timestamp":1787486568760,"_id":"260823--4984p4xGnNNtr-vLC1wBKwd","_index":"arkime_sessions3-260823","client":{"bytes":1025},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo GmbH"],"isp.dstCnt":1,"isp.src":["Private Layer INC"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Private Layer Inc"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS51167 Contabo GmbH","number":51167,"organization":{"name":"Contabo GmbH"}},"bytes":0,"geo":{"country_iso_code":"FR"},"ip":"109.123.246.142","mac":["00:50:56:63:46:a6"],"mac-cnt":1,"packets":0,"port":5060},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[78283],"firstPacket":1787485479786,"ipProtocol":17,"lastPacket":1787485479786,"length":0,"network":{"bytes":1067,"community_id":"1:cFPme/WCtCgQXbE5bKPznTcQ1GE=","packets":1},"node":"spark-afae","packetPos":[-78283,225288],"packetRange":{"gte":1787485479786,"lte":1787485479786},"protocol":["udp","sip"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":0},"sip":{"callid":["gYIEI1qOqZWRVKAtkuwLYs.."],"callidCnt":1,"contact":["\u003csip:16299777872@179.43.167.2:27272\u003e"],"contactCnt":1,"from":["\u003csip:16299777872@179.43.167.2\u003e;tag=058f579f"],"fromCnt":1,"method":["INVITE"],"methodCnt":1,"to":["\u003csip:0003908351673002@109.123.246.142:5060\u003e"],"toCnt":1,"user":["16299777872","0003908351673002"],"userCnt":2,"useragent":["Linksys SPA942"],"useragentCnt":1,"via":["SIP/2.0/UDP 179.43.167.2:27272;branch=z9hG4bK-524287-1---65776144ca88d929"],"viaCnt":1},"source":{"as":{"full":"AS51852 Private Layer INC","number":51852,"organization":{"name":"Private Layer INC"}},"bytes":1067,"geo":{"country_iso_code":"CH"},"ip":"179.43.167.2","mac":["c0:69:11:cd:1f:19"],"mac-cnt":1,"packets":1,"port":27272},"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcPayload8":"494e564954452073","srcRIR":"LACNIC","srcTTL":[55],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["2251761002148449"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["b05640bd-eb2a-4d9d-8d73-d14d7cbeb44a"],"signatureCnt":1,"signatureId":[1071802],"signatureIdCnt":1},"tag":{"block":["false"],"blockCnt":1,"category":["protocol"],"categoryCnt":1,"description":["ip addresses with this tag have been observed sending sip traffic."],"intention":["unknown"],"intentionCnt":1,"name":["sip protocol"],"nameCnt":1},"tags":["proxy","sensor:contabo-sponge-02-ts","contabo-sponge-02-ts"],"tagsCnt":3,"totDataBytes":1025} +{"@timestamp":1787479602023,"_id":"260823-fAcbDRRh9hpJUbHF8fukNzj8","_index":"arkime_sessions3-260823","client":{"bytes":1024},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["netcup GmbH"],"isp.dstCnt":1,"isp.src":["Private Layer INC"],"isp.srcCnt":1,"org.dst":["Netcup KVM"],"org.dstCnt":1,"org.src":["Private Layer Inc"],"org.srcCnt":1,"usertype.dst":["business"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS197540 netcup GmbH","number":197540,"organization":{"name":"netcup GmbH"}},"bytes":0,"geo":{"country_iso_code":"DE"},"ip":"159.195.21.150","mac":["8a:41:d3:b8:0d:d3"],"mac-cnt":1,"packets":0,"port":5060},"dstRIR":"ARIN","ethertype":2048,"fileId":[78246],"firstPacket":1787478371147,"ipProtocol":17,"lastPacket":1787478371147,"length":0,"network":{"bytes":1066,"community_id":"1:sG63/uE5yP7ylYgBE4ze382KAyA=","packets":1},"node":"spark-afae","packetPos":[-78246,378001],"packetRange":{"gte":1787478371147,"lte":1787478371147},"protocol":["udp","sip"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":0},"sip":{"callid":["sW5djJIfZKufWvtpWA0AeQ.."],"callidCnt":1,"contact":["\u003csip:17168465496@179.43.167.2:20344\u003e"],"contactCnt":1,"from":["\u003csip:17168465496@179.43.167.2\u003e;tag=fc030f58"],"fromCnt":1,"method":["INVITE"],"methodCnt":1,"to":["\u003csip:98103908351673002@159.195.21.150:5060\u003e"],"toCnt":1,"user":["98103908351673002","17168465496"],"userCnt":2,"useragent":["Cisco CP-8841"],"useragentCnt":1,"via":["SIP/2.0/UDP 179.43.167.2:20344;branch=z9hG4bK-524287-1---d14cb21ea4b45081"],"viaCnt":1},"source":{"as":{"full":"AS51852 Private Layer INC","number":51852,"organization":{"name":"Private Layer INC"}},"bytes":1066,"geo":{"country_iso_code":"CH"},"ip":"179.43.167.2","mac":["bc:0f:fe:38:0b:a3"],"mac-cnt":1,"packets":1,"port":20344},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcPayload8":"494e564954452073","srcRIR":"LACNIC","srcTTL":[54],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["916483871438286"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["b05640bd-eb2a-4d9d-8d73-d14d7cbeb44a"],"signatureCnt":1,"signatureId":[1071802],"signatureIdCnt":1},"tag":{"block":["false"],"blockCnt":1,"category":["protocol"],"categoryCnt":1,"description":["ip addresses with this tag have been observed sending sip traffic."],"intention":["unknown"],"intentionCnt":1,"name":["sip protocol"],"nameCnt":1},"tags":["netcup-ts","honeypot","sensor:netcup-ts"],"tagsCnt":3,"totDataBytes":1024} +{"@timestamp":1787475362805,"_id":"260823-_uK-ih-YJBpNBaLkJ9YuYPOr","_index":"arkime_sessions3-260823","client":{"bytes":1020},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Private Layer INC"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Private Layer Inc"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":0,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":0,"port":5060},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[78222],"firstPacket":1787474598635,"ipProtocol":17,"lastPacket":1787474598635,"length":0,"network":{"bytes":1062,"community_id":"1:hX9PDah5LpycplLjbBWZZ0i9dFE=","packets":1},"node":"spark-afae","packetPos":[-78222,18756504],"packetRange":{"gte":1787474598635,"lte":1787474598635},"protocol":["udp","sip"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":0},"sip":{"callid":["QgdpxkURuefV0hMWu9vDBw.."],"callidCnt":1,"contact":["\u003csip:16724692132@179.43.167.2:20344\u003e"],"contactCnt":1,"from":["\u003csip:16724692132@179.43.167.2\u003e;tag=af350d5d"],"fromCnt":1,"method":["INVITE"],"methodCnt":1,"to":["\u003csip:98103908351673002@217.15.163.226:5060\u003e"],"toCnt":1,"user":["98103908351673002","16724692132"],"userCnt":2,"useragent":["Fanvil X6"],"useragentCnt":1,"via":["SIP/2.0/UDP 179.43.167.2:20344;branch=z9hG4bK-524287-1---90bde41471b7cd2f"],"viaCnt":1},"source":{"as":{"full":"AS51852 Private Layer INC","number":51852,"organization":{"name":"Private Layer INC"}},"bytes":1062,"geo":{"country_iso_code":"CH"},"ip":"179.43.167.2","mac":["fc:bd:67:9d:2b:2b"],"mac-cnt":1,"packets":1,"port":20344},"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcPayload8":"494e564954452073","srcRIR":"LACNIC","srcTTL":[52],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["1883145559022551"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["b05640bd-eb2a-4d9d-8d73-d14d7cbeb44a"],"signatureCnt":1,"signatureId":[1071802],"signatureIdCnt":1},"tag":{"block":["false"],"blockCnt":1,"category":["protocol"],"categoryCnt":1,"description":["ip addresses with this tag have been observed sending sip traffic."],"intention":["unknown"],"intentionCnt":1,"name":["sip protocol"],"nameCnt":1},"tags":["sensor:contabo-sponge-01-ts","contabo-sponge-01-ts","honeypot"],"tagsCnt":3,"totDataBytes":1020} +{"@timestamp":1787472045263,"_id":"260823-544I6izZB7BOa4rETLTuRPvK","_index":"arkime_sessions3-260823","client":{"bytes":1019},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo GmbH"],"isp.dstCnt":1,"isp.src":["Private Layer INC"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Private Layer Inc"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS51167 Contabo GmbH","number":51167,"organization":{"name":"Contabo GmbH"}},"bytes":0,"geo":{"country_iso_code":"FR"},"ip":"109.123.246.142","mac":["00:50:56:63:46:a6"],"mac-cnt":1,"packets":0,"port":5060},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[78203],"firstPacket":1787470975441,"ipProtocol":17,"lastPacket":1787470975441,"length":0,"network":{"bytes":1061,"community_id":"1:4Of7+8tStB24jI+NnJJCPmm6qEk=","packets":1},"node":"spark-afae","packetPos":[-78203,14223],"packetRange":{"gte":1787470975441,"lte":1787470975441},"protocol":["udp","sip"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":0},"sip":{"callid":["avvga2l9AINvlRZLTt2Bt4.."],"callidCnt":1,"contact":["\u003csip:16299777872@179.43.167.2:20344\u003e"],"contactCnt":1,"from":["\u003csip:16299777872@179.43.167.2\u003e;tag=f825e816"],"fromCnt":1,"method":["INVITE"],"methodCnt":1,"to":["\u003csip:98103908351673002@109.123.246.142:5060\u003e"],"toCnt":1,"user":["16299777872","98103908351673002"],"userCnt":2,"useragent":["Twilio"],"useragentCnt":1,"via":["SIP/2.0/UDP 179.43.167.2:20344;branch=z9hG4bK-524287-1---186b6fc4f11b6b20"],"viaCnt":1},"source":{"as":{"full":"AS51852 Private Layer INC","number":51852,"organization":{"name":"Private Layer INC"}},"bytes":1061,"geo":{"country_iso_code":"CH"},"ip":"179.43.167.2","mac":["c0:69:11:cd:1f:19"],"mac-cnt":1,"packets":1,"port":20344},"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcPayload8":"494e564954452073","srcRIR":"LACNIC","srcTTL":[55],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["2176268649652169"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["b05640bd-eb2a-4d9d-8d73-d14d7cbeb44a"],"signatureCnt":1,"signatureId":[1071802],"signatureIdCnt":1},"tag":{"block":["false"],"blockCnt":1,"category":["protocol"],"categoryCnt":1,"description":["ip addresses with this tag have been observed sending sip traffic."],"intention":["unknown"],"intentionCnt":1,"name":["sip protocol"],"nameCnt":1},"tags":["sensor:contabo-sponge-02-ts","proxy","contabo-sponge-02-ts"],"tagsCnt":3,"totDataBytes":1019} +{"@timestamp":1787465095947,"_id":"260823-b45VpzKtKr5A8pIsgBACR7cZ","_index":"arkime_sessions3-260823","client":{"bytes":1021},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["netcup GmbH"],"isp.dstCnt":1,"isp.src":["Private Layer INC"],"isp.srcCnt":1,"org.dst":["Netcup KVM"],"org.dstCnt":1,"org.src":["Private Layer Inc"],"org.srcCnt":1,"usertype.dst":["business"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS197540 netcup GmbH","number":197540,"organization":{"name":"netcup GmbH"}},"bytes":0,"geo":{"country_iso_code":"DE"},"ip":"159.195.21.150","mac":["8a:41:d3:b8:0d:d3"],"mac-cnt":1,"packets":0,"port":5060},"dstRIR":"ARIN","ethertype":2048,"fileId":[78166],"firstPacket":1787463863429,"ipProtocol":17,"lastPacket":1787463863429,"length":0,"network":{"bytes":1063,"community_id":"1:bkMThsF4Csn959SRyhArO4dnjCA=","packets":1},"node":"spark-afae","packetPos":[-78166,78693],"packetRange":{"gte":1787463863429,"lte":1787463863429},"protocol":["udp","sip"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":0},"sip":{"callid":["vyYAiMFKBeFX6gbq8oUY5G.."],"callidCnt":1,"contact":["\u003csip:17168465496@179.43.167.2:23387\u003e"],"contactCnt":1,"from":["\u003csip:17168465496@179.43.167.2\u003e;tag=b07d775c"],"fromCnt":1,"method":["INVITE"],"methodCnt":1,"to":["\u003csip:9003908351673002@159.195.21.150:5060\u003e"],"toCnt":1,"user":["9003908351673002","17168465496"],"userCnt":2,"useragent":["Yealink W52P"],"useragentCnt":1,"via":["SIP/2.0/UDP 179.43.167.2:23387;branch=z9hG4bK-524287-1---534b11b03a4c28b2"],"viaCnt":1},"source":{"as":{"full":"AS51852 Private Layer INC","number":51852,"organization":{"name":"Private Layer INC"}},"bytes":1063,"geo":{"country_iso_code":"CH"},"ip":"179.43.167.2","mac":["bc:0f:fe:38:0b:a3"],"mac-cnt":1,"packets":1,"port":23387},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcPayload8":"494e564954452073","srcRIR":"LACNIC","srcTTL":[54],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["2125787743185204"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["b05640bd-eb2a-4d9d-8d73-d14d7cbeb44a"],"signatureCnt":1,"signatureId":[1071802],"signatureIdCnt":1},"tag":{"block":["false"],"blockCnt":1,"category":["protocol"],"categoryCnt":1,"description":["ip addresses with this tag have been observed sending sip traffic."],"intention":["unknown"],"intentionCnt":1,"name":["sip protocol"],"nameCnt":1},"tags":["sensor:netcup-ts","netcup-ts","honeypot"],"tagsCnt":3,"totDataBytes":1021} +{"@timestamp":1787460885374,"_id":"260823-JeGYMbNLqSJAyJ0eh127NPtX","_index":"arkime_sessions3-260823","client":{"bytes":1034},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Private Layer INC"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Private Layer Inc"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":0,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":0,"port":5060},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[78142],"firstPacket":1787460093004,"ipProtocol":17,"lastPacket":1787460093004,"length":0,"network":{"bytes":1076,"community_id":"1:gxtf09a+SSVghf7JwD7qZBu7deQ=","packets":1},"node":"spark-afae","packetPos":[-78142,3458590],"packetRange":{"gte":1787460093004,"lte":1787460093004},"protocol":["udp","sip"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":0},"sip":{"callid":["jGFtrr9ueIjIrUfoX98OEq.."],"callidCnt":1,"contact":["\u003csip:16724692132@179.43.167.2:23387\u003e"],"contactCnt":1,"from":["\u003csip:16724692132@179.43.167.2\u003e;tag=fe868f86"],"fromCnt":1,"method":["INVITE"],"methodCnt":1,"to":["\u003csip:9003908351673002@217.15.163.226:5060\u003e"],"toCnt":1,"user":["9003908351673002","16724692132"],"userCnt":2,"useragent":["Groundwire/4.1.1 (iPhone)"],"useragentCnt":1,"via":["SIP/2.0/UDP 179.43.167.2:23387;branch=z9hG4bK-524287-1---202f5d24e7cf3904"],"viaCnt":1},"source":{"as":{"full":"AS51852 Private Layer INC","number":51852,"organization":{"name":"Private Layer INC"}},"bytes":1076,"geo":{"country_iso_code":"CH"},"ip":"179.43.167.2","mac":["fc:bd:67:9d:2b:2b"],"mac-cnt":1,"packets":1,"port":23387},"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcPayload8":"494e564954452073","srcRIR":"LACNIC","srcTTL":[52],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["1427364544492463"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["b05640bd-eb2a-4d9d-8d73-d14d7cbeb44a"],"signatureCnt":1,"signatureId":[1071802],"signatureIdCnt":1},"tag":{"block":["false"],"blockCnt":1,"category":["protocol"],"categoryCnt":1,"description":["ip addresses with this tag have been observed sending sip traffic."],"intention":["unknown"],"intentionCnt":1,"name":["sip protocol"],"nameCnt":1},"tags":["honeypot","sensor:contabo-sponge-01-ts","contabo-sponge-01-ts"],"tagsCnt":3,"totDataBytes":1034} +{"@timestamp":1787459381801,"_id":"260823-7-BmVSdErC9B7aGPzPLMTFSp","_index":"arkime_sessions3-260823","client":{"bytes":1013},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Kaopu Cloud HK Limited"],"isp.dstCnt":1,"isp.src":["Private Layer INC"],"isp.srcCnt":1,"org.dst":["LightNode-BH"],"org.dstCnt":1,"org.src":["Private Layer Inc"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":0,"geo":{"country_iso_code":"BH"},"ip":"38.54.2.209","mac":["52:54:8f:9d:76:48"],"mac-cnt":1,"packets":0,"port":5060},"dstRIR":"ARIN","ethertype":2048,"fileId":[78134],"firstPacket":1787458716094,"ipProtocol":17,"lastPacket":1787458716094,"length":0,"network":{"bytes":1055,"community_id":"1:BPPB6He510dg1MD0v8fJXCdeePA=","packets":1},"node":"spark-afae","packetPos":[-78134,630370],"packetRange":{"gte":1787458716094,"lte":1787458716094},"protocol":["udp","sip"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":0},"sip":{"callid":["a1Ck3xrk1jz0S4ai5ycgii.."],"callidCnt":1,"contact":["\u003csip:16563628947@179.43.167.2:23387\u003e"],"contactCnt":1,"from":["\u003csip:16563628947@179.43.167.2\u003e;tag=af25a6b2"],"fromCnt":1,"method":["INVITE"],"methodCnt":1,"to":["\u003csip:9003908351673002@38.54.2.209:5060\u003e"],"toCnt":1,"user":["16563628947","9003908351673002"],"userCnt":2,"useragent":["Avaya J169"],"useragentCnt":1,"via":["SIP/2.0/UDP 179.43.167.2:23387;branch=z9hG4bK-524287-1---bd1de1904466e8d6"],"viaCnt":1},"source":{"as":{"full":"AS51852 Private Layer INC","number":51852,"organization":{"name":"Private Layer INC"}},"bytes":1055,"geo":{"country_iso_code":"CH"},"ip":"179.43.167.2","mac":["98:44:ce:60:15:19"],"mac-cnt":1,"packets":1,"port":23387},"srcOui":["Huawei Technologies Co.,Ltd"],"srcOuiCnt":1,"srcPayload8":"494e564954452073","srcRIR":"LACNIC","srcTTL":[50],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["1251584431864523"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["b05640bd-eb2a-4d9d-8d73-d14d7cbeb44a"],"signatureCnt":1,"signatureId":[1071802],"signatureIdCnt":1},"tag":{"block":["false"],"blockCnt":1,"category":["protocol"],"categoryCnt":1,"description":["ip addresses with this tag have been observed sending sip traffic."],"intention":["unknown"],"intentionCnt":1,"name":["sip protocol"],"nameCnt":1},"tags":["honeypot","bahrain-sponge-01-ts","sensor:bahrain-sponge-01-ts"],"tagsCnt":3,"totDataBytes":1013} +{"@timestamp":1787457569346,"_id":"260823-7I076Rl65YVGa5A3gckBNSU5","_index":"arkime_sessions3-260823","client":{"bytes":1021},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo GmbH"],"isp.dstCnt":1,"isp.src":["Private Layer INC"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Private Layer Inc"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS51167 Contabo GmbH","number":51167,"organization":{"name":"Contabo GmbH"}},"bytes":0,"geo":{"country_iso_code":"FR"},"ip":"109.123.246.142","mac":["00:50:56:63:46:a6"],"mac-cnt":1,"packets":0,"port":5060},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[78123],"firstPacket":1787456473372,"ipProtocol":17,"lastPacket":1787456473372,"length":0,"network":{"bytes":1063,"community_id":"1:8URTeV8ZORkSKhIqHgpBLT41ky8=","packets":1},"node":"spark-afae","packetPos":[-78123,28429],"packetRange":{"gte":1787456473372,"lte":1787456473372},"protocol":["udp","sip"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":0},"sip":{"callid":["DjfrVZjmxZsBKGmF3XO1lZ.."],"callidCnt":1,"contact":["\u003csip:16299777872@179.43.167.2:23387\u003e"],"contactCnt":1,"from":["\u003csip:16299777872@179.43.167.2\u003e;tag=4defa540"],"fromCnt":1,"method":["INVITE"],"methodCnt":1,"to":["\u003csip:9003908351673002@109.123.246.142:5060\u003e"],"toCnt":1,"user":["16299777872","9003908351673002"],"userCnt":2,"useragent":["Telnyx SIP"],"useragentCnt":1,"via":["SIP/2.0/UDP 179.43.167.2:23387;branch=z9hG4bK-524287-1---7b73ac2585004751"],"viaCnt":1},"source":{"as":{"full":"AS51852 Private Layer INC","number":51852,"organization":{"name":"Private Layer INC"}},"bytes":1063,"geo":{"country_iso_code":"CH"},"ip":"179.43.167.2","mac":["c0:69:11:cd:1f:19"],"mac-cnt":1,"packets":1,"port":23387},"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcPayload8":"494e564954452073","srcRIR":"LACNIC","srcTTL":[55],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["474541173497043"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["b05640bd-eb2a-4d9d-8d73-d14d7cbeb44a"],"signatureCnt":1,"signatureId":[1071802],"signatureIdCnt":1},"tag":{"block":["false"],"blockCnt":1,"category":["protocol"],"categoryCnt":1,"description":["ip addresses with this tag have been observed sending sip traffic."],"intention":["unknown"],"intentionCnt":1,"name":["sip protocol"],"nameCnt":1},"tags":["proxy","sensor:contabo-sponge-02-ts","contabo-sponge-02-ts"],"tagsCnt":3,"totDataBytes":1021} +{"@timestamp":1787449717113,"_id":"260823-qS7tg89oMetGY4fiWqt7Mz74","_index":"arkime_sessions3-260823","client":{"bytes":1018},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["netcup GmbH"],"isp.dstCnt":1,"isp.src":["Private Layer INC"],"isp.srcCnt":1,"org.dst":["Netcup KVM"],"org.dstCnt":1,"org.src":["Private Layer Inc"],"org.srcCnt":1,"usertype.dst":["business"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS197540 netcup GmbH","number":197540,"organization":{"name":"netcup GmbH"}},"bytes":0,"geo":{"country_iso_code":"DE"},"ip":"159.195.21.150","mac":["8a:41:d3:b8:0d:d3"],"mac-cnt":1,"packets":0,"port":5060},"dstRIR":"ARIN","ethertype":2048,"fileId":[78080],"firstPacket":1787449373649,"ipProtocol":17,"lastPacket":1787449373649,"length":0,"network":{"bytes":1060,"community_id":"1:COm1GLENSoaTSgjSSPOx7ZT4Zss=","packets":1},"node":"spark-afae","packetPos":[-78080,3519315],"packetRange":{"gte":1787449373649,"lte":1787449373649},"protocol":["udp","sip"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":0},"sip":{"callid":["5MG3Q6fL113agGy6U7voJL.."],"callidCnt":1,"contact":["\u003csip:17168465496@179.43.167.2:27778\u003e"],"contactCnt":1,"from":["\u003csip:17168465496@179.43.167.2\u003e;tag=9ff7c0c8"],"fromCnt":1,"method":["INVITE"],"methodCnt":1,"to":["\u003csip:3908351673002@159.195.21.150:5060\u003e"],"toCnt":1,"user":["3908351673002","17168465496"],"userCnt":2,"useragent":["Polycom VVX 301"],"useragentCnt":1,"via":["SIP/2.0/UDP 179.43.167.2:27778;branch=z9hG4bK-524287-1---2714313eaf3ae0f9"],"viaCnt":1},"source":{"as":{"full":"AS51852 Private Layer INC","number":51852,"organization":{"name":"Private Layer INC"}},"bytes":1060,"geo":{"country_iso_code":"CH"},"ip":"179.43.167.2","mac":["bc:0f:fe:38:0b:a3"],"mac-cnt":1,"packets":1,"port":27778},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcPayload8":"494e564954452073","srcRIR":"LACNIC","srcTTL":[54],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["1663626691475017"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["b05640bd-eb2a-4d9d-8d73-d14d7cbeb44a"],"signatureCnt":1,"signatureId":[1071802],"signatureIdCnt":1},"tag":{"block":["false"],"blockCnt":1,"category":["protocol"],"categoryCnt":1,"description":["ip addresses with this tag have been observed sending sip traffic."],"intention":["unknown"],"intentionCnt":1,"name":["sip protocol"],"nameCnt":1},"tags":["sensor:netcup-ts","netcup-ts","honeypot"],"tagsCnt":3,"totDataBytes":1018} +{"@timestamp":1787446403040,"_id":"260823-S9-UOFHc-EZE15kDpF_y2zV4","_index":"arkime_sessions3-260823","client":{"bytes":1009},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Private Layer INC"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Private Layer Inc"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":0,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":0,"port":5060},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[78061],"firstPacket":1787445613723,"ipProtocol":17,"lastPacket":1787445613723,"length":0,"network":{"bytes":1051,"community_id":"1:K2V2Jy3ubrKxxI/vMhRVO0Okqps=","packets":1},"node":"spark-afae","packetPos":[-78061,1614970],"packetRange":{"gte":1787445613723,"lte":1787445613723},"protocol":["udp","sip"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":0},"sip":{"callid":["7WFsOkjzytkWnzYcD2qNRJ.."],"callidCnt":1,"contact":["\u003csip:16724692132@179.43.167.2:27778\u003e"],"contactCnt":1,"from":["\u003csip:16724692132@179.43.167.2\u003e;tag=28461ecf"],"fromCnt":1,"method":["INVITE"],"methodCnt":1,"to":["\u003csip:3908351673002@217.15.163.226:5060\u003e"],"toCnt":1,"user":["3908351673002","16724692132"],"userCnt":2,"useragent":["Fanvil"],"useragentCnt":1,"via":["SIP/2.0/UDP 179.43.167.2:27778;branch=z9hG4bK-524287-1---891c1154cad95c36"],"viaCnt":1},"source":{"as":{"full":"AS51852 Private Layer INC","number":51852,"organization":{"name":"Private Layer INC"}},"bytes":1051,"geo":{"country_iso_code":"CH"},"ip":"179.43.167.2","mac":["fc:bd:67:9d:2b:2b"],"mac-cnt":1,"packets":1,"port":27778},"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcPayload8":"494e564954452073","srcRIR":"LACNIC","srcTTL":[52],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["1417368209197506"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["b05640bd-eb2a-4d9d-8d73-d14d7cbeb44a"],"signatureCnt":1,"signatureId":[1071802],"signatureIdCnt":1},"tag":{"block":["false"],"blockCnt":1,"category":["protocol"],"categoryCnt":1,"description":["ip addresses with this tag have been observed sending sip traffic."],"intention":["unknown"],"intentionCnt":1,"name":["sip protocol"],"nameCnt":1},"tags":["honeypot","sensor:contabo-sponge-01-ts","contabo-sponge-01-ts"],"tagsCnt":3,"totDataBytes":1009} +{"@timestamp":1787445192746,"_id":"260823-H99YhR3T6KFHyLZGoHqty9_O","_index":"arkime_sessions3-260823","client":{"bytes":1004},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Kaopu Cloud HK Limited"],"isp.dstCnt":1,"isp.src":["Private Layer INC"],"isp.srcCnt":1,"org.dst":["LightNode-BH"],"org.dstCnt":1,"org.src":["Private Layer Inc"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":0,"geo":{"country_iso_code":"BH"},"ip":"38.54.2.209","mac":["52:54:8f:9d:76:48"],"mac-cnt":1,"packets":0,"port":5060},"dstRIR":"ARIN","ethertype":2048,"fileId":[78054],"firstPacket":1787444245506,"ipProtocol":17,"lastPacket":1787444245506,"length":0,"network":{"bytes":1046,"community_id":"1:QcnPP3ffY75E7/ViClnFAo4CExw=","packets":1},"node":"spark-afae","packetPos":[-78054,702547],"packetRange":{"gte":1787444245506,"lte":1787444245506},"protocol":["udp","sip"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":0},"sip":{"callid":["l5PRcCaAOpe2UsnKW7osbW.."],"callidCnt":1,"contact":["\u003csip:16563628947@179.43.167.2:27778\u003e"],"contactCnt":1,"from":["\u003csip:16563628947@179.43.167.2\u003e;tag=e2da7078"],"fromCnt":1,"method":["INVITE"],"methodCnt":1,"to":["\u003csip:3908351673002@38.54.2.209:5060\u003e"],"toCnt":1,"user":["16563628947","3908351673002"],"userCnt":2,"useragent":["snom360"],"useragentCnt":1,"via":["SIP/2.0/UDP 179.43.167.2:27778;branch=z9hG4bK-524287-1---8fd27433178a685c"],"viaCnt":1},"source":{"as":{"full":"AS51852 Private Layer INC","number":51852,"organization":{"name":"Private Layer INC"}},"bytes":1046,"geo":{"country_iso_code":"CH"},"ip":"179.43.167.2","mac":["98:44:ce:60:15:19"],"mac-cnt":1,"packets":1,"port":27778},"srcOui":["Huawei Technologies Co.,Ltd"],"srcOuiCnt":1,"srcPayload8":"494e564954452073","srcRIR":"LACNIC","srcTTL":[50],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["1613407203178507"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["b05640bd-eb2a-4d9d-8d73-d14d7cbeb44a"],"signatureCnt":1,"signatureId":[1071802],"signatureIdCnt":1},"tag":{"block":["false"],"blockCnt":1,"category":["protocol"],"categoryCnt":1,"description":["ip addresses with this tag have been observed sending sip traffic."],"intention":["unknown"],"intentionCnt":1,"name":["sip protocol"],"nameCnt":1},"tags":["bahrain-sponge-01-ts","honeypot","sensor:bahrain-sponge-01-ts"],"tagsCnt":3,"totDataBytes":1004} -- cgit v1.2.3