From e93e7f67d4f70177c3ab5a34e8cc5b24fa2dde6d Mon Sep 17 00:00:00 2001 From: hrbrmstr Date: Mon, 31 Aug 2026 07:56:38 -0400 Subject: add: bph report iocs --- .../session_search_20260831T113638_60e10d8d.ndjson | 4 + .../session_search_20260831T113639_29b53eaa.ndjson | 53 +++++++++++ .../session_search_20260831T113639_67644f88.ndjson | 52 +++++++++++ .../session_search_20260831T113640_9d421320.ndjson | 100 +++++++++++++++++++++ .../session_search_20260831T113640_b7c6793a.ndjson | 100 +++++++++++++++++++++ .../session_search_20260831T113641_4a246a7f.ndjson | 100 +++++++++++++++++++++ .../session_search_20260831T113642_412bf26b.ndjson | 100 +++++++++++++++++++++ .../session_search_20260831T113642_d85fd0f2.ndjson | 0 .../session_search_20260831T113643_ccfc4339.ndjson | 6 ++ 9 files changed, 515 insertions(+) create mode 100644 kevlar/2026-08-31/sponge/ip-sessions/session_search_20260831T113638_60e10d8d.ndjson create mode 100644 kevlar/2026-08-31/sponge/ip-sessions/session_search_20260831T113639_29b53eaa.ndjson create mode 100644 kevlar/2026-08-31/sponge/ip-sessions/session_search_20260831T113639_67644f88.ndjson create mode 100644 kevlar/2026-08-31/sponge/ip-sessions/session_search_20260831T113640_9d421320.ndjson create mode 100644 kevlar/2026-08-31/sponge/ip-sessions/session_search_20260831T113640_b7c6793a.ndjson create mode 100644 kevlar/2026-08-31/sponge/ip-sessions/session_search_20260831T113641_4a246a7f.ndjson create mode 100644 kevlar/2026-08-31/sponge/ip-sessions/session_search_20260831T113642_412bf26b.ndjson create mode 100644 kevlar/2026-08-31/sponge/ip-sessions/session_search_20260831T113642_d85fd0f2.ndjson create mode 100644 kevlar/2026-08-31/sponge/ip-sessions/session_search_20260831T113643_ccfc4339.ndjson (limited to 'kevlar/2026-08-31/sponge/ip-sessions') diff --git a/kevlar/2026-08-31/sponge/ip-sessions/session_search_20260831T113638_60e10d8d.ndjson b/kevlar/2026-08-31/sponge/ip-sessions/session_search_20260831T113638_60e10d8d.ndjson new file mode 100644 index 0000000..e352f01 --- /dev/null +++ b/kevlar/2026-08-31/sponge/ip-sessions/session_search_20260831T113638_60e10d8d.ndjson @@ -0,0 +1,4 @@ +{"@timestamp":1788165167720,"_id":"260831-2UWEhbn4ipBNDIp0rokxW5kW","_index":"arkime_sessions3-260831","client":{"bytes":1470},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo GmbH"],"isp.dstCnt":1,"isp.src":["RouterHosting LLC"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["FranTech Solutions"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS51167 Contabo GmbH","number":51167,"organization":{"name":"Contabo GmbH"}},"bytes":345,"geo":{"country_iso_code":"FR"},"ip":"109.123.246.142","mac":["00:50:56:63:46:a6"],"mac-cnt":1,"packets":5,"port":443},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstPayload8":"15030300020250","dstRIR":"RIPE","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[82376],"firstPacket":1788164739362,"initRTT":8,"ipProtocol":6,"lastPacket":1788164739790,"length":428,"network":{"bytes":2219,"community_id":"1:MLH0NrhNlP4HF8fdMvPCn6gEhTI=","packets":11},"node":"spark-afae","packetPos":[-82376,246570,90,0,82,1552,82,89,82,0,0,0],"packetRange":{"gte":1788164739362,"lte":1788164739790},"protocol":["tls","tcp"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":7},"source":{"as":{"full":"AS14956 RouterHosting LLC","number":14956,"organization":{"name":"RouterHosting LLC"}},"bytes":1874,"geo":{"country_iso_code":"NL"},"ip":"107.189.26.103","mac":["00:c0:1d:c0:ff:ee","c0:69:11:cd:1f:19"],"mac-cnt":2,"packets":6,"port":33844},"srcOui":["Grand Junction Networks, Inc.","Arista Networks"],"srcOuiCnt":2,"srcPayload8":"16030105b9010005","srcRIR":"ARIN","srcTTL":[52],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["993561155603323"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["ac32bdeb-b49d-4079-9e6b-8fbca5e0addf"],"signatureCnt":1,"signatureId":[1031336],"signatureIdCnt":1},"tag":{"block":["false"],"blockCnt":1,"category":["protocol"],"categoryCnt":1,"description":["ip addresses with this tag have been observed attempting to opportunistically crawl the internet and establish tls/ssl connections."],"intention":["unknown"],"intentionCnt":1,"name":["tls/ssl crawler"],"nameCnt":1},"tags":["proxy","sensor:contabo-sponge-02-ts","contabo-sponge-02-ts"],"tagsCnt":3,"tcp":{"ja4ls":"118_64_521","ja4t":["29200_2-4-8-1-3_1460_7"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":5,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":2,"psh":2,"rst":0,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":1728756003},"tls":{"ja3":["052a5e65c3a64e860e1706b1de3c46a9"],"ja3Cnt":1,"ja3string":["771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53,23-65281-10-11-35-13-51-45-43,4588-29-23-24,0"],"ja3stringCnt":1,"ja4":["t13i170900_5b57614c22b0_78e6aca7449b"],"ja4Cnt":1,"ja4_r":["t13i170900_002f,0035,009c,009d,1301,1302,1303,c009,c00a,c013,c014,c02b,c02c,c02f,c030,cca8,cca9_000a,000b,000d,0017,0023,002b,002d,0033,ff01_0403,0804,0401,0503,0805,0501,0806,0601,0201"],"ja4_rCnt":1,"srcSessionId":["1347b6b9644d0f463618be6f76729167fd318995bbdd6ff4c6f292c6cf92a3a8"]},"totDataBytes":1477} +{"@timestamp":1788165167720,"_id":"260831-2UXxDDh1j1VIFokYf7LV4RlC","_index":"arkime_sessions3-260831","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo GmbH"],"isp.dstCnt":1,"isp.src":["RouterHosting LLC"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["FranTech Solutions"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS51167 Contabo GmbH","number":51167,"organization":{"name":"Contabo GmbH"}},"bytes":58,"geo":{"country_iso_code":"FR"},"ip":"109.123.246.142","mac":["00:50:56:63:46:a6"],"mac-cnt":1,"packets":1,"port":443},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[82376],"firstPacket":1788164738834,"ipProtocol":6,"lastPacket":1788164738848,"length":14,"network":{"bytes":238,"community_id":"1:3dlKYEQbkXcmFg7bP98cJXO9+iY=","packets":4},"node":"spark-afae","packetPos":[-82376,245872,76,224,76],"packetRange":{"gte":1788164738834,"lte":1788164738848},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS14956 RouterHosting LLC","number":14956,"organization":{"name":"RouterHosting LLC"}},"bytes":180,"geo":{"country_iso_code":"NL"},"ip":"107.189.26.103","mac":["00:c0:1d:c0:ff:ee","c0:69:11:cd:1f:19"],"mac-cnt":2,"packets":3,"port":52068},"srcOui":["Grand Junction Networks, Inc.","Arista Networks"],"srcOuiCnt":2,"srcRIR":"ARIN","srcTTL":[55],"srcTTLCnt":1,"tags":["proxy","sensor:contabo-sponge-02-ts","contabo-sponge-02-ts"],"tagsCnt":3,"tcp":{"ja4t":["65535_00_00_00"],"ja4tCnt":1,"ja4ts":["64240_2_1460_00"],"ja4tsCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":2,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":1836893100},"totDataBytes":0} +{"@timestamp":1787207209953,"_id":"260820-bL-X-ZPifu1Lt5UBQ07QMww0","_index":"arkime_sessions3-260820","client":{"bytes":1720},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Kaopu Cloud HK Limited"],"isp.dstCnt":1,"isp.src":["RouterHosting LLC"],"isp.srcCnt":1,"org.dst":["LightNode-BH"],"org.dstCnt":1,"org.src":["FranTech Solutions"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":2102,"geo":{"country_iso_code":"BH"},"ip":"38.54.2.209","mac":["52:54:8f:9d:76:48"],"mac-cnt":1,"packets":12,"port":22},"dstPayload8":"5353482d322e302d","dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[76731],"firstPacket":1787206691213,"initRTT":95,"ipProtocol":6,"lastPacket":1787206697080,"length":5867,"network":{"bytes":4820,"community_id":"1:uunVFxOJKG+Gf67JzmfpfijL7Dg=","packets":27},"node":"spark-afae","packetPos":[-76731,1746072,90,600,16601,106,2398,124,1406,82,2578,1642,82,274,98,1292,82,0,2984,142,1010,1438,820,21125,870,1270,82,514],"packetRange":{"gte":1787206691213,"lte":1787206697080},"protocol":["ssh","tcp"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":1302},"source":{"as":{"full":"AS14956 RouterHosting LLC","number":14956,"organization":{"name":"RouterHosting LLC"}},"bytes":2718,"geo":{"country_iso_code":"NL"},"ip":"107.189.26.103","mac":["98:44:ce:60:15:19"],"mac-cnt":1,"packets":15,"port":42346},"srcOui":["Huawei Technologies Co.,Ltd"],"srcOuiCnt":1,"srcPayload8":"5353482d322e302d","srcRIR":"ARIN","srcTTL":[52],"srcTTLCnt":1,"ssh":{"hassh":["19532158b559096b89b1a5f7d17175b2"],"hasshCnt":1,"hasshServer":["41a85c886a9e9b845f0e69d68994492a"],"hasshServerCnt":1,"ja4ssh":["c24s16_c4s7_c9s3"],"ja4sshCnt":1,"version":["ssh-2.0-libssh2_1.11.1","ssh-2.0-openssh_9.6p1 ubuntu-3ubuntu13.5"],"versionCnt":2},"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["917695486512582"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["GPL ATTACK SSH Connection Attempt","537cee16-c4a9-45cd-baf1-75963ab7bdd2"],"signatureCnt":2,"signatureId":[1080086,1000010],"signatureIdCnt":2},"tag":{"block":["true"],"blockCnt":1,"category":["activity"],"categoryCnt":1,"description":["ip addresses with this tag have been observed attempting to negotiate an ssh session."],"intention":["suspicious"],"intentionCnt":1,"name":["ssh connection attempt"],"nameCnt":1},"tags":["sensor:bahrain-sponge-01-ts","bahrain-sponge-01-ts","honeypot"],"tagsCnt":3,"tcp":{"ja4l":"95121_52_435900","ja4ls":"35_64_166662","ja4t":["29200_2-4-8-1-3_1460_7"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":12,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":2,"psh":11,"rst":0,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":1961525166},"totDataBytes":3022} +{"@timestamp":1787207209941,"_id":"260820-bL8X2PKBT6hCmoaS3guIm_W9","_index":"arkime_sessions3-260820","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Kaopu Cloud HK Limited"],"isp.dstCnt":1,"isp.src":["RouterHosting LLC"],"isp.srcCnt":1,"org.dst":["LightNode-BH"],"org.dstCnt":1,"org.src":["FranTech Solutions"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":58,"geo":{"country_iso_code":"BH"},"ip":"38.54.2.209","mac":["52:54:8f:9d:76:48"],"mac-cnt":1,"packets":1,"port":22},"dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[76731],"firstPacket":1787206690084,"ipProtocol":6,"lastPacket":1787206690276,"length":192,"network":{"bytes":220,"community_id":"1:1C5BaSTrFYodU8odrR+6zMIS2Qw=","packets":4},"node":"spark-afae","packetPos":[-76731,1740152,70,1282,70],"packetRange":{"gte":1787206690084,"lte":1787206690276},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS14956 RouterHosting LLC","number":14956,"organization":{"name":"RouterHosting LLC"}},"bytes":162,"geo":{"country_iso_code":"NL"},"ip":"107.189.26.103","mac":["98:44:ce:60:15:19"],"mac-cnt":1,"packets":3,"port":50849},"srcDscp":[40],"srcDscpCnt":1,"srcOui":["Huawei Technologies Co.,Ltd"],"srcOuiCnt":1,"srcRIR":"ARIN","srcTTL":[52],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["645682251986147"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["GPL ATTACK SSH Connection Attempt"],"signatureCnt":1,"signatureId":[1000010],"signatureIdCnt":1},"tags":["sensor:bahrain-sponge-01-ts","bahrain-sponge-01-ts","honeypot"],"tagsCnt":3,"tcp":{"ja4t":["65535_00_00_00"],"ja4tCnt":1,"ja4ts":["64240_2_1460_00"],"ja4tsCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":2,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":641124744},"totDataBytes":0} diff --git a/kevlar/2026-08-31/sponge/ip-sessions/session_search_20260831T113639_29b53eaa.ndjson b/kevlar/2026-08-31/sponge/ip-sessions/session_search_20260831T113639_29b53eaa.ndjson new file mode 100644 index 0000000..801ba6c --- /dev/null +++ b/kevlar/2026-08-31/sponge/ip-sessions/session_search_20260831T113639_29b53eaa.ndjson @@ -0,0 +1,53 @@ +{"@timestamp":1787991936200,"_id":"260829-N7vgw7p2CSVAZo3Eac-9AVUP","_index":"arkime_sessions3-260829","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Hetzner Online GmbH"],"isp.dstCnt":1,"isp.src":["Aeza International LTD"],"isp.srcCnt":1,"org.dst":["HETZNER-DC"],"org.dstCnt":1,"org.src":["Aeza International LTD"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS24940 Hetzner Online GmbH","number":24940,"organization":{"name":"Hetzner Online GmbH"}},"bytes":0,"geo":{"country_iso_code":"FI"},"ip":"89.167.72.144","mac":["92:00:07:4c:82:70"],"mac-cnt":1,"packets":0,"port":8080},"dstRIR":"RIPE","ethertype":2048,"fileId":[81221],"firstPacket":1787991651170,"ipProtocol":6,"lastPacket":1787991652186,"length":1016,"network":{"bytes":148,"community_id":"1:eL4ZHV77N4HFQc9mFEV3MHTbUrI=","packets":2},"node":"spark-afae","packetPos":[-81221,179108,172],"packetRange":{"gte":1787991651170,"lte":1787991652186},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS210644 Aeza Group LLC","number":210644,"organization":{"name":"Aeza Group LLC"}},"bytes":148,"geo":{"country_iso_code":"AT"},"ip":"147.45.71.214","mac":["d2:74:7f:6e:37:e3"],"mac-cnt":1,"packets":2,"port":35120},"spoofable":["true"],"spoofableCnt":1,"srcRIR":"ARIN","srcTTL":[54],"srcTTLCnt":1,"tags":["sensor:sponge-01-ts","honeypot","sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["42340_2-4-8-1-3_1320_13"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":2053509478},"totDataBytes":0} +{"@timestamp":1787990732940,"_id":"260829-JyZPRBEzvntIvqGZ5he1oAVW","_index":"arkime_sessions3-260829","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["netcup GmbH"],"isp.dstCnt":1,"isp.src":["Aeza International LTD"],"isp.srcCnt":1,"org.dst":["Netcup KVM"],"org.dstCnt":1,"org.src":["Aeza International LTD"],"org.srcCnt":1,"usertype.dst":["business"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS197540 netcup GmbH","number":197540,"organization":{"name":"netcup GmbH"}},"bytes":0,"geo":{"country_iso_code":"DE"},"ip":"159.195.21.150","mac":["8a:41:d3:b8:0d:d3"],"mac-cnt":1,"packets":0,"port":8080},"dstRIR":"ARIN","ethertype":2048,"fileId":[81214],"firstPacket":1787990351245,"ipProtocol":6,"lastPacket":1787990352272,"length":1027,"network":{"bytes":148,"community_id":"1:GGalzCq2CCJidVQDewuE/nlZWLg=","packets":2},"node":"spark-afae","packetPos":[-81214,524172,90],"packetRange":{"gte":1787990351245,"lte":1787990352272},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS210644 Aeza Group LLC","number":210644,"organization":{"name":"Aeza Group LLC"}},"bytes":148,"geo":{"country_iso_code":"AT"},"ip":"147.45.71.214","mac":["bc:0f:fe:3d:a3:a7"],"mac-cnt":1,"packets":2,"port":36370},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"ARIN","srcTTL":[52],"srcTTLCnt":1,"tags":["sensor:netcup-ts","honeypot","netcup-ts"],"tagsCnt":3,"tcp":{"ja4t":["42340_2-4-8-1-3_1320_13"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":4001417055},"totDataBytes":0} +{"@timestamp":1787991333465,"_id":"260829-PSaP-yxzqhlH8pIUi5668ScD","_index":"arkime_sessions3-260829","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Kaopu Cloud HK Limited"],"isp.dstCnt":1,"isp.src":["Aeza International LTD"],"isp.srcCnt":1,"org.dst":["LightNode-BH"],"org.dstCnt":1,"org.src":["Aeza International LTD"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":0,"geo":{"country_iso_code":"BH"},"ip":"38.54.2.209","mac":["52:54:8f:9d:76:48"],"mac-cnt":1,"packets":0,"port":8080},"dstRIR":"ARIN","ethertype":2048,"fileId":[81218],"firstPacket":1787990348840,"ipProtocol":6,"lastPacket":1787990349842,"length":1002,"network":{"bytes":148,"community_id":"1:kVHDHgOVwUb4k0RfLwjESx8q5Iw=","packets":2},"node":"spark-afae","packetPos":[-81218,114070,90],"packetRange":{"gte":1787990348840,"lte":1787990349842},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS210644 Aeza Group LLC","number":210644,"organization":{"name":"Aeza Group LLC"}},"bytes":148,"geo":{"country_iso_code":"AT"},"ip":"147.45.71.214","mac":["98:44:ce:60:15:19"],"mac-cnt":1,"packets":2,"port":38912},"spoofable":["true"],"spoofableCnt":1,"srcDscp":[8],"srcDscpCnt":1,"srcOui":["Huawei Technologies Co.,Ltd"],"srcOuiCnt":1,"srcRIR":"ARIN","srcTTL":[54],"srcTTLCnt":1,"tags":["sensor:bahrain-sponge-01-ts","bahrain-sponge-01-ts","honeypot"],"tagsCnt":3,"tcp":{"ja4t":["42340_2-4-8-1-3_1320_13"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":2067320260},"totDataBytes":0} +{"@timestamp":1787989232002,"_id":"260829-8iU7Srj9pjhO977qYKN1i74I","_index":"arkime_sessions3-260829","client":{"bytes":135},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["Aeza International LTD"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["Aeza International LTD"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":429,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":5,"port":8090},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstPayload8":"485454502f312e31","dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[81204],"firstPacket":1787988675072,"http":{"bodyMagic":["text/plain"],"bodyMagicCnt":1,"responseHeader":["content-type","connection"],"responseHeaderCnt":2,"responseHeaderField":["content-type","connection"],"responseHeaderValue":["text/plain; charset=utf-8","close"],"responseHeaderValueCnt":2,"serverVersion":["1.1"],"serverVersionCnt":1,"statuscode":[400],"statuscodeCnt":1},"initRTT":74,"ipProtocol":6,"lastPacket":1787988675404,"length":332,"network":{"bytes":902,"community_id":"1:uxawoEdIi9OVrKDoJgGgM+GHw5k=","packets":10},"node":"spark-afae","packetPos":[-81204,6282457,90,160,82,210,82,185,82,278,89],"packetRange":{"gte":1787988675072,"lte":1787988675404},"protocol":["tcp","tls","http"],"protocolCnt":3,"segmentCnt":1,"server":{"bytes":103},"source":{"as":{"full":"AS210644 Aeza Group LLC","number":210644,"organization":{"name":"Aeza Group LLC"}},"bytes":473,"geo":{"country_iso_code":"AT"},"ip":"147.45.71.214","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":5,"port":39668},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcPayload8":"160301007b010000","srcRIR":"ARIN","srcTTL":[51],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["873895570045471"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["ac32bdeb-b49d-4079-9e6b-8fbca5e0addf"],"signatureCnt":1,"signatureId":[1031336],"signatureIdCnt":1},"tag":{"block":["false"],"blockCnt":1,"category":["protocol"],"categoryCnt":1,"description":["ip addresses with this tag have been observed attempting to opportunistically crawl the internet and establish tls/ssl connections."],"intention":["unknown"],"intentionCnt":1,"name":["tls/ssl crawler"],"nameCnt":1},"tags":["honeypot","frantech-ts","sensor:frantech-ts"],"tagsCnt":3,"tcp":{"ja4l":"74037_51_tcp","ja4ls":"31_64_136","ja4t":["42340_2-4-8-1-3_1320_13"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":3,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":1,"psh":3,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":371097084},"tls":{"ja3":["cba7f34191ef2379c1325641f6c6c4f4"],"ja3Cnt":1,"ja3string":["771,49199-49195-49169-49159-49171-49161-49172-49162-5-47-53-49170-10,5-10-11-13-65281,23-24-25,0"],"ja3stringCnt":1,"ja4":["t12i130500_2d7513195f68_e51b7354d87f"],"ja4Cnt":1,"ja4_r":["t12i130500_0005,000a,002f,0035,c007,c009,c00a,c011,c012,c013,c014,c02b,c02f_0005,000a,000b,000d,ff01_0401,0403,0201,0203,0401,0501,0601"],"ja4_rCnt":1},"totDataBytes":238} +{"@timestamp":1787989231405,"_id":"260829-8iWGhDIZrlxK6b9XePYZmxyh","_index":"arkime_sessions3-260829","client":{"bytes":252},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["Aeza International LTD"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["Aeza International LTD"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":625,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":5,"port":8090},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstPayload8":"485454502f312e31","dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[81204],"firstPacket":1787988674763,"http":{"bodyMagic":["text/html"],"bodyMagicCnt":1,"clientVersion":["1.1"],"clientVersionCnt":1,"host":["209.141.62.110:8090","209.141.62.110"],"hostCnt":2,"ja4h":["ge11nn050000_57c5e92682a8_000000000000_000000000000"],"ja4hCnt":1,"ja4h_r":["ge11nn050000_Host,User-Agent,Accept-Charset,Accept-Encoding,Connection__"],"ja4h_rCnt":1,"md5":["0f87454a3ea15f0db55ae928dbcd82fc"],"md5Cnt":1,"method":["GET"],"method-GET":1,"methodCnt":1,"path":["/favicon.ico"],"pathCnt":1,"requestHeader":["host","user-agent","accept-charset","accept-encoding","connection"],"requestHeaderCnt":5,"requestHeaderField":["accept-charset","accept-encoding","connection"],"requestHeaderValue":["utf-8","gzip","close"],"requestHeaderValueCnt":3,"response-server":["Apache/2.4.41 (Ubuntu)"],"response-serverCnt":1,"response-x-powered-by":["PHP/7.4.3"],"response-x-powered-byCnt":1,"responseHeader":["content-type","content-length","server","x-powered-by","connection","date"],"responseHeaderCnt":6,"responseHeaderField":["connection","content-type","date","content-length"],"responseHeaderValue":["close","text/plain; charset=utf-8","sat, 29 aug 2026 07:31:14 gmt","94"],"responseHeaderValueCnt":4,"serverVersion":["1.1"],"serverVersionCnt":1,"sha256":["1ca624415b2889dbeb3f969890b848b7bc5eaf96ca5e8fdd7461f943b45d10cb"],"sha256Cnt":1,"statuscode":[200],"statuscodeCnt":1,"uri":["209.141.62.110:8090/favicon.ico"],"uriCnt":1,"useragent":["Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.5 Safari/605.2.22"],"useragentCnt":1},"initRTT":74,"ipProtocol":6,"lastPacket":1787988675072,"length":309,"network":{"bytes":1215,"community_id":"1:Zt3Sxso44M5VUUvuKEss42Nl7/4=","packets":10},"node":"spark-afae","packetPos":[-81204,6280512,90,0,82,334,82,369,652,82,0],"packetRange":{"gte":1787988674763,"lte":1787988675072},"protocol":["tcp","http"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":287},"source":{"as":{"full":"AS210644 Aeza Group LLC","number":210644,"organization":{"name":"Aeza Group LLC"}},"bytes":590,"geo":{"country_iso_code":"AT"},"ip":"147.45.71.214","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":5,"port":39666},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcPayload8":"474554202f666176","srcRIR":"ARIN","srcTTL":[51],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["746957014419118"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["869feaa1-dc77-4037-aee2-247b7a39cf7d","ce8622a8-6d2f-4fe3-ab81-0cc86e19363e","ee583a2e-d308-4c53-b8e2-a1cd45cd1bb7","f63d9281-086b-4182-9002-663ffb13d931"],"signatureCnt":4,"signatureId":[2000166,2000009,1031486,2000008],"signatureIdCnt":4},"tag":{"block":["false","true"],"blockCnt":2,"category":["recon","attack","protocol"],"categoryCnt":3,"cves":[""],"cvesCnt":1,"description":["generic favicon request detection. requests for /favicon.ico are commonly issued by web crawlers and browsers during normal browsing, but can also indicate automated scanning activity.","ip addresses with this tag have been seen crawling http(s) servers around the internet.","generic web crawler traffic detected. the simple pattern of get requests without specific exploitation indicators suggests automated crawling activity, possibly for search indexing or vulnerability scanning.","cloud credential scanning probe detected. requests for sensitive configuration files and credentials indicate automated scanning for exposed secrets and api keys."],"intention":["suspicious","unknown"],"intentionCnt":2,"name":["favicon crawler","web crawler","root path scanner"],"nameCnt":3},"tags":["honeypot","frantech-ts","sensor:frantech-ts"],"tagsCnt":3,"tcp":{"ja4ls":"52_64_tcp","ja4t":["42340_2-4-8-1-3_1320_13"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":4,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":2,"psh":2,"rst":0,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":1302908324},"totDataBytes":539} +{"@timestamp":1787989232002,"_id":"260829-8iWRE2jdvJRMOLk5YVC7Bdse","_index":"arkime_sessions3-260829","client":{"bytes":135},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["Aeza International LTD"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["Aeza International LTD"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":429,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":5,"port":8090},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstPayload8":"485454502f312e31","dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[81204],"firstPacket":1787988674319,"http":{"bodyMagic":["text/plain"],"bodyMagicCnt":1,"responseHeader":["content-type","connection"],"responseHeaderCnt":2,"responseHeaderField":["content-type","connection"],"responseHeaderValue":["text/plain; charset=utf-8","close"],"responseHeaderValueCnt":2,"serverVersion":["1.1"],"serverVersionCnt":1,"statuscode":[400],"statuscodeCnt":1},"initRTT":73,"ipProtocol":6,"lastPacket":1787988674669,"length":350,"network":{"bytes":968,"community_id":"1:htAHriicJaClpAZni31hChsAJ2U=","packets":11},"node":"spark-afae","packetPos":[-81204,6279098,90,360,82,210,82,185,82,0,0,89],"packetRange":{"gte":1787988674319,"lte":1787988674669},"protocol":["tcp","tls","http"],"protocolCnt":3,"segmentCnt":1,"server":{"bytes":103},"source":{"as":{"full":"AS210644 Aeza Group LLC","number":210644,"organization":{"name":"Aeza Group LLC"}},"bytes":539,"geo":{"country_iso_code":"AT"},"ip":"147.45.71.214","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":6,"port":39652},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcPayload8":"160301007b010000","srcRIR":"ARIN","srcTTL":[51],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["807980301493381"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["ac32bdeb-b49d-4079-9e6b-8fbca5e0addf"],"signatureCnt":1,"signatureId":[1031336],"signatureIdCnt":1},"tag":{"block":["false"],"blockCnt":1,"category":["protocol"],"categoryCnt":1,"description":["ip addresses with this tag have been observed attempting to opportunistically crawl the internet and establish tls/ssl connections."],"intention":["unknown"],"intentionCnt":1,"name":["tls/ssl crawler"],"nameCnt":1},"tags":["honeypot","frantech-ts","sensor:frantech-ts"],"tagsCnt":3,"tcp":{"ja4l":"73584_51_tcp","ja4ls":"25_64_61","ja4t":["42340_2-4-8-1-3_1320_13"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":4,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":1,"psh":3,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":2461629858},"tls":{"ja3":["cba7f34191ef2379c1325641f6c6c4f4"],"ja3Cnt":1,"ja3string":["771,49199-49195-49169-49159-49171-49161-49172-49162-5-47-53-49170-10,5-10-11-13-65281,23-24-25,0"],"ja3stringCnt":1,"ja4":["t12i130500_2d7513195f68_e51b7354d87f"],"ja4Cnt":1,"ja4_r":["t12i130500_0005,000a,002f,0035,c007,c009,c00a,c011,c012,c013,c014,c02b,c02f_0005,000a,000b,000d,ff01_0401,0403,0201,0203,0401,0501,0601"],"ja4_rCnt":1},"totDataBytes":238} +{"@timestamp":1787989231405,"_id":"260829-8iUMBJkeH1tMt79ppkR65LUG","_index":"arkime_sessions3-260829","client":{"bytes":241},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["Aeza International LTD"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["Aeza International LTD"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":625,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":5,"port":8090},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstPayload8":"485454502f312e31","dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[81204],"firstPacket":1787988674009,"http":{"bodyMagic":["text/html"],"bodyMagicCnt":1,"clientVersion":["1.1"],"clientVersionCnt":1,"host":["209.141.62.110:8090","209.141.62.110"],"hostCnt":2,"ja4h":["ge11nn050000_57c5e92682a8_000000000000_000000000000"],"ja4hCnt":1,"ja4h_r":["ge11nn050000_Host,User-Agent,Accept-Charset,Accept-Encoding,Connection__"],"ja4h_rCnt":1,"md5":["0f87454a3ea15f0db55ae928dbcd82fc"],"md5Cnt":1,"method":["GET"],"method-GET":1,"methodCnt":1,"path":["/"],"pathCnt":1,"requestHeader":["host","user-agent","accept-charset","accept-encoding","connection"],"requestHeaderCnt":5,"requestHeaderField":["accept-charset","accept-encoding","connection"],"requestHeaderValue":["utf-8","gzip","close"],"requestHeaderValueCnt":3,"response-server":["Apache/2.4.41 (Ubuntu)"],"response-serverCnt":1,"response-x-powered-by":["PHP/7.4.3"],"response-x-powered-byCnt":1,"responseHeader":["content-type","content-length","server","x-powered-by","connection","date"],"responseHeaderCnt":6,"responseHeaderField":["connection","content-type","date","content-length"],"responseHeaderValue":["close","text/plain; charset=utf-8","sat, 29 aug 2026 07:31:14 gmt","94"],"responseHeaderValueCnt":4,"serverVersion":["1.1"],"serverVersionCnt":1,"sha256":["1ca624415b2889dbeb3f969890b848b7bc5eaf96ca5e8fdd7461f943b45d10cb"],"sha256Cnt":1,"statuscode":[200],"statuscodeCnt":1,"uri":["209.141.62.110:8090/"],"uriCnt":1,"useragent":["Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.5 Safari/605.2.22"],"useragentCnt":1},"initRTT":73,"ipProtocol":6,"lastPacket":1787988674317,"length":308,"network":{"bytes":1204,"community_id":"1:xHF483LzNV4C2HWHwKUc89PDlik=","packets":10},"node":"spark-afae","packetPos":[-81204,6277575,90,249,82,323,82,369,82,0,0],"packetRange":{"gte":1787988674009,"lte":1787988674317},"protocol":["tcp","http"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":287},"source":{"as":{"full":"AS210644 Aeza Group LLC","number":210644,"organization":{"name":"Aeza Group LLC"}},"bytes":579,"geo":{"country_iso_code":"AT"},"ip":"147.45.71.214","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":5,"port":39648},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcPayload8":"474554202f204854","srcRIR":"ARIN","srcTTL":[51],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["601795474186862"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["869feaa1-dc77-4037-aee2-247b7a39cf7d","ce8622a8-6d2f-4fe3-ab81-0cc86e19363e","ee583a2e-d308-4c53-b8e2-a1cd45cd1bb7"],"signatureCnt":3,"signatureId":[2000166,1031486,2000008],"signatureIdCnt":3},"tag":{"block":["false","true"],"blockCnt":2,"category":["recon","attack","protocol"],"categoryCnt":3,"cves":[""],"cvesCnt":1,"description":["ip addresses with this tag have been seen crawling http(s) servers around the internet.","generic web crawler traffic detected. the simple pattern of get requests without specific exploitation indicators suggests automated crawling activity, possibly for search indexing or vulnerability scanning.","cloud credential scanning probe detected. requests for sensitive configuration files and credentials indicate automated scanning for exposed secrets and api keys."],"intention":["suspicious","unknown"],"intentionCnt":2,"name":["web crawler","root path scanner"],"nameCnt":2},"tags":["honeypot","frantech-ts","sensor:frantech-ts"],"tagsCnt":3,"tcp":{"ja4ls":"28_64_tcp","ja4t":["42340_2-4-8-1-3_1320_13"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":4,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":2,"psh":2,"rst":0,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":37769695},"totDataBytes":528} +{"@timestamp":1787989232002,"_id":"260829-8iX_KKREQIJDy7u4046l507c","_index":"arkime_sessions3-260829","client":{"bytes":135},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["Aeza International LTD"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["Aeza International LTD"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":429,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":5,"port":8090},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstPayload8":"485454502f312e31","dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[81204],"firstPacket":1787988673689,"http":{"bodyMagic":["text/plain"],"bodyMagicCnt":1,"responseHeader":["content-type","connection"],"responseHeaderCnt":2,"responseHeaderField":["content-type","connection"],"responseHeaderValue":["text/plain; charset=utf-8","close"],"responseHeaderValueCnt":2,"serverVersion":["1.1"],"serverVersionCnt":1,"statuscode":[400],"statuscodeCnt":1},"initRTT":74,"ipProtocol":6,"lastPacket":1787988674009,"length":320,"network":{"bytes":902,"community_id":"1:70uOdbeDOG8Fdk+1kXqdkEjHIUc=","packets":10},"node":"spark-afae","packetPos":[-81204,6276402,90,0,82,210,82,185,352,262,89],"packetRange":{"gte":1787988673689,"lte":1787988674009},"protocol":["tcp","tls","http"],"protocolCnt":3,"segmentCnt":1,"server":{"bytes":103},"source":{"as":{"full":"AS210644 Aeza Group LLC","number":210644,"organization":{"name":"Aeza Group LLC"}},"bytes":473,"geo":{"country_iso_code":"AT"},"ip":"147.45.71.214","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":5,"port":39646},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcPayload8":"160301007b010000","srcRIR":"ARIN","srcTTL":[51],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["426365615991645"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["ac32bdeb-b49d-4079-9e6b-8fbca5e0addf"],"signatureCnt":1,"signatureId":[1031336],"signatureIdCnt":1},"tag":{"block":["false"],"blockCnt":1,"category":["protocol"],"categoryCnt":1,"description":["ip addresses with this tag have been observed attempting to opportunistically crawl the internet and establish tls/ssl connections."],"intention":["unknown"],"intentionCnt":1,"name":["tls/ssl crawler"],"nameCnt":1},"tags":["honeypot","frantech-ts","sensor:frantech-ts"],"tagsCnt":3,"tcp":{"ja4l":"74415_51_tcp","ja4ls":"45_64_86","ja4t":["42340_2-4-8-1-3_1320_13"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":3,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":1,"psh":3,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":2484838809},"tls":{"ja3":["cba7f34191ef2379c1325641f6c6c4f4"],"ja3Cnt":1,"ja3string":["771,49199-49195-49169-49159-49171-49161-49172-49162-5-47-53-49170-10,5-10-11-13-65281,23-24-25,0"],"ja3stringCnt":1,"ja4":["t12i130500_2d7513195f68_e51b7354d87f"],"ja4Cnt":1,"ja4_r":["t12i130500_0005,000a,002f,0035,c007,c009,c00a,c011,c012,c013,c014,c02b,c02f_0005,000a,000b,000d,ff01_0401,0403,0201,0203,0401,0501,0601"],"ja4_rCnt":1},"totDataBytes":238} +{"@timestamp":1787989231403,"_id":"260829-8iVhAQC8pDZDrbMbKut2M2FB","_index":"arkime_sessions3-260829","client":{"bytes":211},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["Aeza International LTD"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["Aeza International LTD"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":625,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":5,"port":8090},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstPayload8":"485454502f312e31","dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[81204],"firstPacket":1787988626241,"http":{"bodyMagic":["text/html"],"bodyMagicCnt":1,"clientVersion":["1.1"],"clientVersionCnt":1,"host":["209.141.62.110:8090","209.141.62.110"],"hostCnt":2,"ja4h":["ge11nn040000_e1d2031bdfea_000000000000_000000000000"],"ja4hCnt":1,"ja4h_r":["ge11nn040000_Host,User-Agent,Accept,Accept-Encoding__"],"ja4h_rCnt":1,"md5":["0f87454a3ea15f0db55ae928dbcd82fc"],"md5Cnt":1,"method":["GET"],"method-GET":1,"methodCnt":1,"path":["/"],"pathCnt":1,"requestHeader":["host","accept","user-agent","accept-encoding"],"requestHeaderCnt":4,"requestHeaderField":["accept","accept-encoding"],"requestHeaderValue":["*/*","gzip"],"requestHeaderValueCnt":2,"response-server":["Apache/2.4.41 (Ubuntu)"],"response-serverCnt":1,"response-x-powered-by":["PHP/7.4.3"],"response-x-powered-byCnt":1,"responseHeader":["content-type","content-length","server","x-powered-by","connection","date"],"responseHeaderCnt":6,"responseHeaderField":["connection","content-type","date","content-length"],"responseHeaderValue":["close","text/plain; charset=utf-8","sat, 29 aug 2026 07:30:26 gmt","94"],"responseHeaderValueCnt":4,"serverVersion":["1.1"],"serverVersionCnt":1,"sha256":["1ca624415b2889dbeb3f969890b848b7bc5eaf96ca5e8fdd7461f943b45d10cb"],"sha256Cnt":1,"statuscode":[200],"statuscodeCnt":1,"uri":["209.141.62.110:8090/"],"uriCnt":1,"useragent":["Mozilla/5.0 (Macintosh; Intel Mac OS X 15_7_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.0 Safari/605.1.15"],"useragentCnt":1},"initRTT":71,"ipProtocol":6,"lastPacket":1787988626527,"length":286,"network":{"bytes":1240,"community_id":"1:nCfEpictZ2fhOZY+buZGsWc6qdg=","packets":11},"node":"spark-afae","packetPos":[-81204,6162398,90,410,82,293,82,369,172,82,0,0],"packetRange":{"gte":1787988626241,"lte":1787988626527},"protocol":["tcp","http"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":287},"source":{"as":{"full":"AS210644 Aeza Group LLC","number":210644,"organization":{"name":"Aeza Group LLC"}},"bytes":615,"geo":{"country_iso_code":"AT"},"ip":"147.45.71.214","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":6,"port":49334},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcPayload8":"474554202f204854","srcRIR":"ARIN","srcTTL":[51],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["757261300706659"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["869feaa1-dc77-4037-aee2-247b7a39cf7d","ce8622a8-6d2f-4fe3-ab81-0cc86e19363e","ee583a2e-d308-4c53-b8e2-a1cd45cd1bb7"],"signatureCnt":3,"signatureId":[2000166,1031486,2000008],"signatureIdCnt":3},"tag":{"block":["false","true"],"blockCnt":2,"category":["recon","attack","protocol"],"categoryCnt":3,"cves":[""],"cvesCnt":1,"description":["ip addresses with this tag have been seen crawling http(s) servers around the internet.","generic web crawler traffic detected. the simple pattern of get requests without specific exploitation indicators suggests automated crawling activity, possibly for search indexing or vulnerability scanning.","cloud credential scanning probe detected. requests for sensitive configuration files and credentials indicate automated scanning for exposed secrets and api keys."],"intention":["suspicious","unknown"],"intentionCnt":2,"name":["web crawler","root path scanner"],"nameCnt":2},"tags":["honeypot","frantech-ts","sensor:frantech-ts"],"tagsCnt":3,"tcp":{"ja4ls":"45_64_tcp","ja4t":["42340_2-4-8-1-3_1320_13"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":5,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":2,"psh":2,"rst":0,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":2928161800},"totDataBytes":498} +{"@timestamp":1787982872397,"_id":"260829-9SR0arAIZFBBVZV2_O7esHrf","_index":"arkime_sessions3-260829","client":{"bytes":135},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["Aeza International LTD"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["Aeza International LTD"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":429,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":5,"port":3000},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstPayload8":"485454502f312e31","dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[81154],"firstPacket":1787982250385,"http":{"bodyMagic":["text/plain"],"bodyMagicCnt":1,"responseHeader":["content-type","connection"],"responseHeaderCnt":2,"responseHeaderField":["content-type","connection"],"responseHeaderValue":["text/plain; charset=utf-8","close"],"responseHeaderValueCnt":2,"serverVersion":["1.1"],"serverVersionCnt":1,"statuscode":[400],"statuscodeCnt":1},"initRTT":70,"ipProtocol":6,"lastPacket":1787982250855,"length":470,"network":{"bytes":968,"community_id":"1:jieErXBJP8GVwDk7RvSzQufK12s=","packets":11},"node":"spark-afae","packetPos":[-81154,2217961,90,712,402,210,82,185,1744,292,82,89],"packetRange":{"gte":1787982250385,"lte":1787982250855},"protocol":["tls","http","tcp"],"protocolCnt":3,"segmentCnt":1,"server":{"bytes":103},"source":{"as":{"full":"AS210644 Aeza Group LLC","number":210644,"organization":{"name":"Aeza Group LLC"}},"bytes":539,"geo":{"country_iso_code":"AT"},"ip":"147.45.71.214","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":6,"port":60300},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcPayload8":"160301007b010000","srcRIR":"ARIN","srcTTL":[51],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["811069510869961"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["ac32bdeb-b49d-4079-9e6b-8fbca5e0addf"],"signatureCnt":1,"signatureId":[1031336],"signatureIdCnt":1},"tag":{"block":["false"],"blockCnt":1,"category":["protocol"],"categoryCnt":1,"description":["ip addresses with this tag have been observed attempting to opportunistically crawl the internet and establish tls/ssl connections."],"intention":["unknown"],"intentionCnt":1,"name":["tls/ssl crawler"],"nameCnt":1},"tags":["sensor:frantech-ts","honeypot","frantech-ts"],"tagsCnt":3,"tcp":{"ja4l":"70791_51_tcp","ja4ls":"40_64_135","ja4t":["42340_2-4-8-1-3_1320_13"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":4,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":1,"psh":3,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":3059006402},"tls":{"ja3":["cba7f34191ef2379c1325641f6c6c4f4"],"ja3Cnt":1,"ja3string":["771,49199-49195-49169-49159-49171-49161-49172-49162-5-47-53-49170-10,5-10-11-13-65281,23-24-25,0"],"ja3stringCnt":1,"ja4":["t12i130500_2d7513195f68_e51b7354d87f"],"ja4Cnt":1,"ja4_r":["t12i130500_0005,000a,002f,0035,c007,c009,c00a,c011,c012,c013,c014,c02b,c02f_0005,000a,000b,000d,ff01_0401,0403,0201,0203,0401,0501,0601"],"ja4_rCnt":1},"totDataBytes":238} +{"@timestamp":1787982872337,"_id":"260829-9SSKfQx4eXNERafqSZR9ptWS","_index":"arkime_sessions3-260829","client":{"bytes":239},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["Aeza International LTD"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["Aeza International LTD"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":625,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":5,"port":3000},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstPayload8":"485454502f312e31","dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[81154],"firstPacket":1787982249668,"http":{"bodyMagic":["text/html"],"bodyMagicCnt":1,"clientVersion":["1.1"],"clientVersionCnt":1,"host":["209.141.62.110:3000","209.141.62.110"],"hostCnt":2,"ja4h":["ge11nn050000_57c5e92682a8_000000000000_000000000000"],"ja4hCnt":1,"ja4h_r":["ge11nn050000_Host,User-Agent,Accept-Charset,Accept-Encoding,Connection__"],"ja4h_rCnt":1,"md5":["0f87454a3ea15f0db55ae928dbcd82fc"],"md5Cnt":1,"method":["GET"],"method-GET":1,"methodCnt":1,"path":["/favicon.ico"],"pathCnt":1,"requestHeader":["user-agent","accept-encoding","host","accept-charset","connection"],"requestHeaderCnt":5,"requestHeaderField":["accept-charset","accept-encoding","connection"],"requestHeaderValue":["utf-8","gzip","close"],"requestHeaderValueCnt":3,"response-server":["Apache/2.4.41 (Ubuntu)"],"response-serverCnt":1,"response-x-powered-by":["PHP/7.4.3"],"response-x-powered-byCnt":1,"responseHeader":["x-powered-by","content-type","content-length","server","date","connection"],"responseHeaderCnt":6,"responseHeaderField":["connection","content-type","date","content-length"],"responseHeaderValue":["close","text/plain; charset=utf-8","sat, 29 aug 2026 05:44:10 gmt","94"],"responseHeaderValueCnt":4,"serverVersion":["1.1"],"serverVersionCnt":1,"sha256":["1ca624415b2889dbeb3f969890b848b7bc5eaf96ca5e8fdd7461f943b45d10cb"],"sha256Cnt":1,"statuscode":[200],"statuscodeCnt":1,"uri":["209.141.62.110:3000/favicon.ico"],"uriCnt":1,"useragent":["Mozilla/5.0 (CentOS; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36"],"useragentCnt":1},"initRTT":71,"ipProtocol":6,"lastPacket":1787982250299,"length":631,"network":{"bytes":1268,"community_id":"1:xjEbXBdsE108KaWVL1BgoVQex1c=","packets":11},"node":"spark-afae","packetPos":[-81154,2215053,90,442,460,321,82,369,242,82,336,82],"packetRange":{"gte":1787982249668,"lte":1787982250299},"protocol":["http","tcp"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":287},"source":{"as":{"full":"AS210644 Aeza Group LLC","number":210644,"organization":{"name":"Aeza Group LLC"}},"bytes":643,"geo":{"country_iso_code":"AT"},"ip":"147.45.71.214","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":6,"port":60294},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcPayload8":"474554202f666176","srcRIR":"ARIN","srcTTL":[51],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["335914626835621"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["ce8622a8-6d2f-4fe3-ab81-0cc86e19363e","ee583a2e-d308-4c53-b8e2-a1cd45cd1bb7","f63d9281-086b-4182-9002-663ffb13d931","869feaa1-dc77-4037-aee2-247b7a39cf7d"],"signatureCnt":4,"signatureId":[2000166,2000009,1031486,2000008],"signatureIdCnt":4},"tag":{"block":["false","true"],"blockCnt":2,"category":["attack","recon","protocol"],"categoryCnt":3,"cves":[""],"cvesCnt":1,"description":["ip addresses with this tag have been seen crawling http(s) servers around the internet.","cloud credential scanning probe detected. requests for sensitive configuration files and credentials indicate automated scanning for exposed secrets and api keys.","generic favicon request detection. requests for /favicon.ico are commonly issued by web crawlers and browsers during normal browsing, but can also indicate automated scanning activity.","generic web crawler traffic detected. the simple pattern of get requests without specific exploitation indicators suggests automated crawling activity, possibly for search indexing or vulnerability scanning."],"intention":["unknown","suspicious"],"intentionCnt":2,"name":["favicon crawler","web crawler","root path scanner"],"nameCnt":3},"tags":["sensor:frantech-ts","honeypot","frantech-ts"],"tagsCnt":3,"tcp":{"ja4ls":"27_64_tcp","ja4t":["42340_2-4-8-1-3_1320_13"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":5,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":2,"psh":2,"rst":0,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":519290863},"totDataBytes":526} +{"@timestamp":1787982872397,"_id":"260829-9SQTe90O9HFFm66XpmNaOkz8","_index":"arkime_sessions3-260829","client":{"bytes":135},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["Aeza International LTD"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["Aeza International LTD"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":429,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":5,"port":3000},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstPayload8":"485454502f312e31","dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[81154],"firstPacket":1787982249048,"http":{"bodyMagic":["text/plain"],"bodyMagicCnt":1,"responseHeader":["content-type","connection"],"responseHeaderCnt":2,"responseHeaderField":["content-type","connection"],"responseHeaderValue":["text/plain; charset=utf-8","close"],"responseHeaderValueCnt":2,"serverVersion":["1.1"],"serverVersionCnt":1,"statuscode":[400],"statuscodeCnt":1},"initRTT":71,"ipProtocol":6,"lastPacket":1787982249667,"length":619,"network":{"bytes":968,"community_id":"1:NLqrWBN3Yw4J5U/v7M8mYGl8fDg=","packets":11},"node":"spark-afae","packetPos":[-81154,2212869,90,0,872,210,82,185,262,152,82,89],"packetRange":{"gte":1787982249048,"lte":1787982249667},"protocol":["tls","http","tcp"],"protocolCnt":3,"segmentCnt":1,"server":{"bytes":103},"source":{"as":{"full":"AS210644 Aeza Group LLC","number":210644,"organization":{"name":"Aeza Group LLC"}},"bytes":539,"geo":{"country_iso_code":"AT"},"ip":"147.45.71.214","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":6,"port":60282},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcPayload8":"160301007b010000","srcRIR":"ARIN","srcTTL":[51],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["490828286713626"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["ac32bdeb-b49d-4079-9e6b-8fbca5e0addf"],"signatureCnt":1,"signatureId":[1031336],"signatureIdCnt":1},"tag":{"block":["false"],"blockCnt":1,"category":["protocol"],"categoryCnt":1,"description":["ip addresses with this tag have been observed attempting to opportunistically crawl the internet and establish tls/ssl connections."],"intention":["unknown"],"intentionCnt":1,"name":["tls/ssl crawler"],"nameCnt":1},"tags":["sensor:frantech-ts","honeypot","frantech-ts"],"tagsCnt":3,"tcp":{"ja4l":"71109_51_tcp","ja4ls":"44_64_108","ja4t":["42340_2-4-8-1-3_1320_13"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":4,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":1,"psh":3,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":4206213335},"tls":{"ja3":["cba7f34191ef2379c1325641f6c6c4f4"],"ja3Cnt":1,"ja3string":["771,49199-49195-49169-49159-49171-49161-49172-49162-5-47-53-49170-10,5-10-11-13-65281,23-24-25,0"],"ja3stringCnt":1,"ja4":["t12i130500_2d7513195f68_e51b7354d87f"],"ja4Cnt":1,"ja4_r":["t12i130500_0005,000a,002f,0035,c007,c009,c00a,c011,c012,c013,c014,c02b,c02f_0005,000a,000b,000d,ff01_0401,0403,0201,0203,0401,0501,0601"],"ja4_rCnt":1},"totDataBytes":238} +{"@timestamp":1787982872319,"_id":"260829-9SRsdUpEgeROv68Sju7Kc_L2","_index":"arkime_sessions3-260829","client":{"bytes":228},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["Aeza International LTD"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["Aeza International LTD"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":625,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":5,"port":3000},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstPayload8":"485454502f312e31","dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[81154],"firstPacket":1787982248396,"http":{"bodyMagic":["text/html"],"bodyMagicCnt":1,"clientVersion":["1.1"],"clientVersionCnt":1,"host":["209.141.62.110:3000","209.141.62.110"],"hostCnt":2,"ja4h":["ge11nn050000_57c5e92682a8_000000000000_000000000000"],"ja4hCnt":1,"ja4h_r":["ge11nn050000_Host,User-Agent,Accept-Charset,Accept-Encoding,Connection__"],"ja4h_rCnt":1,"md5":["0f87454a3ea15f0db55ae928dbcd82fc"],"md5Cnt":1,"method":["GET"],"method-GET":1,"methodCnt":1,"path":["/"],"pathCnt":1,"requestHeader":["user-agent","accept-encoding","host","accept-charset","connection"],"requestHeaderCnt":5,"requestHeaderField":["accept-charset","accept-encoding","connection"],"requestHeaderValue":["utf-8","gzip","close"],"requestHeaderValueCnt":3,"response-server":["Apache/2.4.41 (Ubuntu)"],"response-serverCnt":1,"response-x-powered-by":["PHP/7.4.3"],"response-x-powered-byCnt":1,"responseHeader":["x-powered-by","content-type","content-length","server","date","connection"],"responseHeaderCnt":6,"responseHeaderField":["connection","content-type","date","content-length"],"responseHeaderValue":["close","text/plain; charset=utf-8","sat, 29 aug 2026 05:44:08 gmt","94"],"responseHeaderValueCnt":4,"serverVersion":["1.1"],"serverVersionCnt":1,"sha256":["1ca624415b2889dbeb3f969890b848b7bc5eaf96ca5e8fdd7461f943b45d10cb"],"sha256Cnt":1,"statuscode":[200],"statuscodeCnt":1,"uri":["209.141.62.110:3000/"],"uriCnt":1,"useragent":["Mozilla/5.0 (CentOS; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36"],"useragentCnt":1},"initRTT":70,"ipProtocol":6,"lastPacket":1787982248972,"length":576,"network":{"bytes":1257,"community_id":"1:phJMcBwdabHDf7N+vCJFGJA2VLo=","packets":11},"node":"spark-afae","packetPos":[-81154,2209554,90,610,172,310,82,369,1016,172,240,82],"packetRange":{"gte":1787982248396,"lte":1787982248972},"protocol":["http","tcp"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":287},"source":{"as":{"full":"AS210644 Aeza Group LLC","number":210644,"organization":{"name":"Aeza Group LLC"}},"bytes":632,"geo":{"country_iso_code":"AT"},"ip":"147.45.71.214","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":6,"port":49738},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcPayload8":"474554202f204854","srcRIR":"ARIN","srcTTL":[51],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["12429962218702"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["ce8622a8-6d2f-4fe3-ab81-0cc86e19363e","ee583a2e-d308-4c53-b8e2-a1cd45cd1bb7","869feaa1-dc77-4037-aee2-247b7a39cf7d"],"signatureCnt":3,"signatureId":[2000166,1031486,2000008],"signatureIdCnt":3},"tag":{"block":["false","true"],"blockCnt":2,"category":["attack","recon","protocol"],"categoryCnt":3,"cves":[""],"cvesCnt":1,"description":["ip addresses with this tag have been seen crawling http(s) servers around the internet.","cloud credential scanning probe detected. requests for sensitive configuration files and credentials indicate automated scanning for exposed secrets and api keys.","generic web crawler traffic detected. the simple pattern of get requests without specific exploitation indicators suggests automated crawling activity, possibly for search indexing or vulnerability scanning."],"intention":["unknown","suspicious"],"intentionCnt":2,"name":["web crawler","root path scanner"],"nameCnt":2},"tags":["sensor:frantech-ts","honeypot","frantech-ts"],"tagsCnt":3,"tcp":{"ja4ls":"44_64_tcp","ja4t":["42340_2-4-8-1-3_1320_13"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":5,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":2,"psh":2,"rst":0,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":909814970},"totDataBytes":515} +{"@timestamp":1787982872991,"_id":"260829-9SRn8gEZGfxGhZAEgX8CmNhb","_index":"arkime_sessions3-260829","client":{"bytes":135},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["Aeza International LTD"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["Aeza International LTD"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":429,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":5,"port":3000},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstPayload8":"485454502f312e31","dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[81154],"firstPacket":1787982247782,"http":{"bodyMagic":["text/plain"],"bodyMagicCnt":1,"responseHeader":["content-type","connection"],"responseHeaderCnt":2,"responseHeaderField":["content-type","connection"],"responseHeaderValue":["text/plain; charset=utf-8","close"],"responseHeaderValueCnt":2,"serverVersion":["1.1"],"serverVersionCnt":1,"statuscode":[400],"statuscodeCnt":1},"initRTT":70,"ipProtocol":6,"lastPacket":1787982248266,"length":484,"network":{"bytes":968,"community_id":"1:US8DKec5ekaa0LFcjWKqGv4nn4Q=","packets":11},"node":"spark-afae","packetPos":[-81154,2206072,90,918,352,210,82,185,622,82,0,89],"packetRange":{"gte":1787982247782,"lte":1787982248266},"protocol":["tls","http","tcp"],"protocolCnt":3,"segmentCnt":1,"server":{"bytes":103},"source":{"as":{"full":"AS210644 Aeza Group LLC","number":210644,"organization":{"name":"Aeza Group LLC"}},"bytes":539,"geo":{"country_iso_code":"AT"},"ip":"147.45.71.214","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":6,"port":49734},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcPayload8":"160301007b010000","srcRIR":"ARIN","srcTTL":[51],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["2234941089644812"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["ac32bdeb-b49d-4079-9e6b-8fbca5e0addf"],"signatureCnt":1,"signatureId":[1031336],"signatureIdCnt":1},"tag":{"block":["false"],"blockCnt":1,"category":["protocol"],"categoryCnt":1,"description":["ip addresses with this tag have been observed attempting to opportunistically crawl the internet and establish tls/ssl connections."],"intention":["unknown"],"intentionCnt":1,"name":["tls/ssl crawler"],"nameCnt":1},"tags":["sensor:frantech-ts","honeypot","frantech-ts"],"tagsCnt":3,"tcp":{"ja4l":"70758_51_tcp","ja4ls":"45_64_117","ja4t":["42340_2-4-8-1-3_1320_13"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":4,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":1,"psh":3,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":97261827},"tls":{"ja3":["cba7f34191ef2379c1325641f6c6c4f4"],"ja3Cnt":1,"ja3string":["771,49199-49195-49169-49159-49171-49161-49172-49162-5-47-53-49170-10,5-10-11-13-65281,23-24-25,0"],"ja3stringCnt":1,"ja4":["t12i130500_2d7513195f68_e51b7354d87f"],"ja4Cnt":1,"ja4_r":["t12i130500_0005,000a,002f,0035,c007,c009,c00a,c011,c012,c013,c014,c02b,c02f_0005,000a,000b,000d,ff01_0401,0403,0201,0203,0401,0501,0601"],"ja4_rCnt":1},"totDataBytes":238} +{"@timestamp":1787982872317,"_id":"260829-9SQmeo0nCFFN07nC6NCZp3vy","_index":"arkime_sessions3-260829","client":{"bytes":211},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["Aeza International LTD"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["Aeza International LTD"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":625,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":5,"port":3000},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstPayload8":"485454502f312e31","dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[81154],"firstPacket":1787982160277,"http":{"bodyMagic":["text/html"],"bodyMagicCnt":1,"clientVersion":["1.1"],"clientVersionCnt":1,"host":["209.141.62.110:3000","209.141.62.110"],"hostCnt":2,"ja4h":["ge11nn040000_e1d2031bdfea_000000000000_000000000000"],"ja4hCnt":1,"ja4h_r":["ge11nn040000_Host,User-Agent,Accept,Accept-Encoding__"],"ja4h_rCnt":1,"md5":["0f87454a3ea15f0db55ae928dbcd82fc"],"md5Cnt":1,"method":["GET"],"method-GET":1,"methodCnt":1,"path":["/"],"pathCnt":1,"requestHeader":["user-agent","accept-encoding","host","accept"],"requestHeaderCnt":4,"requestHeaderField":["accept","accept-encoding"],"requestHeaderValue":["*/*","gzip"],"requestHeaderValueCnt":2,"response-server":["Apache/2.4.41 (Ubuntu)"],"response-serverCnt":1,"response-x-powered-by":["PHP/7.4.3"],"response-x-powered-byCnt":1,"responseHeader":["x-powered-by","content-type","content-length","server","date","connection"],"responseHeaderCnt":6,"responseHeaderField":["connection","content-type","date","content-length"],"responseHeaderValue":["close","text/plain; charset=utf-8","sat, 29 aug 2026 05:42:40 gmt","94"],"responseHeaderValueCnt":4,"serverVersion":["1.1"],"serverVersionCnt":1,"sha256":["1ca624415b2889dbeb3f969890b848b7bc5eaf96ca5e8fdd7461f943b45d10cb"],"sha256Cnt":1,"statuscode":[200],"statuscodeCnt":1,"uri":["209.141.62.110:3000/"],"uriCnt":1,"useragent":["Mozilla/5.0 (Macintosh; Intel Mac OS X 15_7_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.0 Safari/605.1.15"],"useragentCnt":1},"initRTT":70,"ipProtocol":6,"lastPacket":1787982160562,"length":285,"network":{"bytes":1174,"community_id":"1:NxyOgXM0U7i8ZqDbbscexhe/f2s=","packets":10},"node":"spark-afae","packetPos":[-81154,1987912,90,434,82,293,82,369,572,82,0],"packetRange":{"gte":1787982160277,"lte":1787982160562},"protocol":["http","tcp"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":287},"source":{"as":{"full":"AS210644 Aeza Group LLC","number":210644,"organization":{"name":"Aeza Group LLC"}},"bytes":549,"geo":{"country_iso_code":"AT"},"ip":"147.45.71.214","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":5,"port":41740},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcPayload8":"474554202f204854","srcRIR":"ARIN","srcTTL":[51],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["66972320729093"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["ce8622a8-6d2f-4fe3-ab81-0cc86e19363e","ee583a2e-d308-4c53-b8e2-a1cd45cd1bb7","869feaa1-dc77-4037-aee2-247b7a39cf7d"],"signatureCnt":3,"signatureId":[2000166,1031486,2000008],"signatureIdCnt":3},"tag":{"block":["false","true"],"blockCnt":2,"category":["attack","recon","protocol"],"categoryCnt":3,"cves":[""],"cvesCnt":1,"description":["ip addresses with this tag have been seen crawling http(s) servers around the internet.","cloud credential scanning probe detected. requests for sensitive configuration files and credentials indicate automated scanning for exposed secrets and api keys.","generic web crawler traffic detected. the simple pattern of get requests without specific exploitation indicators suggests automated crawling activity, possibly for search indexing or vulnerability scanning."],"intention":["unknown","suspicious"],"intentionCnt":2,"name":["web crawler","root path scanner"],"nameCnt":2},"tags":["sensor:frantech-ts","honeypot","frantech-ts"],"tagsCnt":3,"tcp":{"ja4ls":"43_64_tcp","ja4t":["42340_2-4-8-1-3_1320_13"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":4,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":2,"psh":2,"rst":0,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":1913934558},"totDataBytes":498} +{"@timestamp":1787981067587,"_id":"260829-4Lnb130YY9BJUpJUeLXTTN_3","_index":"arkime_sessions3-260829","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Hetzner Online GmbH"],"isp.dstCnt":1,"isp.src":["Aeza International LTD"],"isp.srcCnt":1,"org.dst":["HETZNER-DC"],"org.dstCnt":1,"org.src":["Aeza International LTD"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS24940 Hetzner Online GmbH","number":24940,"organization":{"name":"Hetzner Online GmbH"}},"bytes":0,"geo":{"country_iso_code":"FI"},"ip":"89.167.72.144","mac":["92:00:07:4c:82:70"],"mac-cnt":1,"packets":0,"port":3000},"dstRIR":"RIPE","ethertype":2048,"fileId":[81141],"firstPacket":1787980511624,"ipProtocol":6,"lastPacket":1787980512629,"length":1005,"network":{"bytes":148,"community_id":"1:dq81+I36DuIv06HqeSBJsvbEsIU=","packets":2},"node":"spark-afae","packetPos":[-81141,1068016,384],"packetRange":{"gte":1787980511624,"lte":1787980512629},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS210644 Aeza Group LLC","number":210644,"organization":{"name":"Aeza Group LLC"}},"bytes":148,"geo":{"country_iso_code":"AT"},"ip":"147.45.71.214","mac":["d2:74:7f:6e:37:e3"],"mac-cnt":1,"packets":2,"port":46216},"spoofable":["true"],"spoofableCnt":1,"srcRIR":"ARIN","srcTTL":[54],"srcTTLCnt":1,"tags":["sponge-01-ts","honeypot","sensor:sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["42340_2-4-8-1-3_1320_13"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":1413806104},"totDataBytes":0} +{"@timestamp":1787981067587,"_id":"260829-4LkwHJ7YFAVIbY8G_Xa3P1vm","_index":"arkime_sessions3-260829","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Hetzner Online GmbH"],"isp.dstCnt":1,"isp.src":["Aeza International LTD"],"isp.srcCnt":1,"org.dst":["HETZNER-DC"],"org.dstCnt":1,"org.src":["Aeza International LTD"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS24940 Hetzner Online GmbH","number":24940,"organization":{"name":"Hetzner Online GmbH"}},"bytes":0,"geo":{"country_iso_code":"FI"},"ip":"89.167.72.144","mac":["92:00:07:4c:82:70"],"mac-cnt":1,"packets":0,"port":3000},"dstRIR":"RIPE","ethertype":2048,"fileId":[81141],"firstPacket":1787980509623,"ipProtocol":6,"lastPacket":1787980510648,"length":1025,"network":{"bytes":148,"community_id":"1:kn9CMIoAZUZG60OFgsnSpGVWAjs=","packets":2},"node":"spark-afae","packetPos":[-81141,1065642,1814],"packetRange":{"gte":1787980509623,"lte":1787980510648},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS210644 Aeza Group LLC","number":210644,"organization":{"name":"Aeza Group LLC"}},"bytes":148,"geo":{"country_iso_code":"AT"},"ip":"147.45.71.214","mac":["d2:74:7f:6e:37:e3"],"mac-cnt":1,"packets":2,"port":46200},"spoofable":["true"],"spoofableCnt":1,"srcRIR":"ARIN","srcTTL":[54],"srcTTLCnt":1,"tags":["sponge-01-ts","honeypot","sensor:sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["42340_2-4-8-1-3_1320_13"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":1935626081},"totDataBytes":0} +{"@timestamp":1787979565462,"_id":"260829-qrmF7eSRPHlD46E8nsILVruK","_index":"arkime_sessions3-260829","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Aeza International LTD"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Aeza International LTD"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":0,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":0,"port":8080},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[81131],"firstPacket":1787979241033,"ipProtocol":6,"lastPacket":1787979242037,"length":1004,"network":{"bytes":148,"community_id":"1:2zl1aTzDtuEgFScLLAoWR6fKS2Q=","packets":2},"node":"spark-afae","packetPos":[-81131,1230132,1682],"packetRange":{"gte":1787979241033,"lte":1787979242037},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS210644 Aeza Group LLC","number":210644,"organization":{"name":"Aeza Group LLC"}},"bytes":148,"geo":{"country_iso_code":"AT"},"ip":"147.45.71.214","mac":["fc:bd:67:9d:2b:2b"],"mac-cnt":1,"packets":2,"port":41610},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcRIR":"ARIN","srcTTL":[55],"srcTTLCnt":1,"tags":["sensor:contabo-sponge-01-ts","honeypot","contabo-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["42340_2-4-8-1-3_1320_13"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":2089066181},"totDataBytes":0} +{"@timestamp":1787979565462,"_id":"260829-qrn6pCTV4_FGdKRUcC1L78Dy","_index":"arkime_sessions3-260829","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Aeza International LTD"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Aeza International LTD"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":0,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":0,"port":8080},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[81131],"firstPacket":1787979239033,"ipProtocol":6,"lastPacket":1787979240053,"length":1020,"network":{"bytes":148,"community_id":"1:VfxB6ddklOV8D2Q0YPDi1teh/4U=","packets":2},"node":"spark-afae","packetPos":[-81131,1228284,962],"packetRange":{"gte":1787979239033,"lte":1787979240053},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS210644 Aeza Group LLC","number":210644,"organization":{"name":"Aeza Group LLC"}},"bytes":148,"geo":{"country_iso_code":"AT"},"ip":"147.45.71.214","mac":["fc:bd:67:9d:2b:2b"],"mac-cnt":1,"packets":2,"port":41604},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcRIR":"ARIN","srcTTL":[55],"srcTTLCnt":1,"tags":["sensor:contabo-sponge-01-ts","honeypot","contabo-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["42340_2-4-8-1-3_1320_13"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":252850851},"totDataBytes":0} +{"@timestamp":1787979263595,"_id":"260829-cSTXOXZMYr9NZaglnUx3-VC9","_index":"arkime_sessions3-260829","client":{"bytes":135},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["Aeza International LTD"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["Aeza International LTD"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":429,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":5,"port":8282},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstPayload8":"485454502f312e31","dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[81130],"firstPacket":1787978336859,"http":{"bodyMagic":["text/plain"],"bodyMagicCnt":1,"responseHeader":["connection","content-type"],"responseHeaderCnt":2,"responseHeaderField":["content-type","connection"],"responseHeaderValue":["text/plain; charset=utf-8","close"],"responseHeaderValueCnt":2,"serverVersion":["1.1"],"serverVersionCnt":1,"statuscode":[400],"statuscodeCnt":1},"initRTT":71,"ipProtocol":6,"lastPacket":1787978337152,"length":293,"network":{"bytes":902,"community_id":"1:kiCxLaX9V90cvC8maASZKoCunFo=","packets":10},"node":"spark-afae","packetPos":[-81130,8272224,90,6546,82,210,82,185,1536,246,89],"packetRange":{"gte":1787978336859,"lte":1787978337152},"protocol":["tls","http","tcp"],"protocolCnt":3,"rootId":"260829-cSTXOXZMYr9NZaglnUx3-VC9","segmentCnt":1,"server":{"bytes":103},"source":{"as":{"full":"AS210644 Aeza Group LLC","number":210644,"organization":{"name":"Aeza Group LLC"}},"bytes":473,"geo":{"country_iso_code":"AT"},"ip":"147.45.71.214","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":5,"port":39138},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcPayload8":"160301007b010000","srcRIR":"ARIN","srcTTL":[51],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["32088612477998"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["ac32bdeb-b49d-4079-9e6b-8fbca5e0addf"],"signatureCnt":1,"signatureId":[1031336],"signatureIdCnt":1},"tag":{"block":["false"],"blockCnt":1,"category":["protocol"],"categoryCnt":1,"description":["ip addresses with this tag have been observed attempting to opportunistically crawl the internet and establish tls/ssl connections."],"intention":["unknown"],"intentionCnt":1,"name":["tls/ssl crawler"],"nameCnt":1},"tags":["frantech-ts","sensor:frantech-ts","honeypot"],"tagsCnt":3,"tcp":{"ja4l":"71172_51_tcp","ja4ls":"25_64_127","ja4t":["42340_2-4-8-1-3_1320_13"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":3,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":1,"psh":3,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":136089276},"tls":{"ja3":["cba7f34191ef2379c1325641f6c6c4f4"],"ja3Cnt":1,"ja3string":["771,49199-49195-49169-49159-49171-49161-49172-49162-5-47-53-49170-10,5-10-11-13-65281,23-24-25,0"],"ja3stringCnt":1,"ja4":["t12i130500_2d7513195f68_e51b7354d87f"],"ja4Cnt":1,"ja4_r":["t12i130500_0005,000a,002f,0035,c007,c009,c00a,c011,c012,c013,c014,c02b,c02f_0005,000a,000b,000d,ff01_0401,0403,0201,0203,0401,0501,0601"],"ja4_rCnt":1},"totDataBytes":238} +{"@timestamp":1787979263580,"_id":"260829-cSS3bb26z3pB65XnWlNXx_SS","_index":"arkime_sessions3-260829","client":{"bytes":239},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["Aeza International LTD"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["Aeza International LTD"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":625,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":5,"port":8282},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstPayload8":"485454502f312e31","dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[81130],"firstPacket":1787978336545,"http":{"bodyMagic":["text/html"],"bodyMagicCnt":1,"clientVersion":["1.1"],"clientVersionCnt":1,"host":["209.141.62.110:8282","209.141.62.110"],"hostCnt":2,"ja4h":["ge11nn050000_57c5e92682a8_000000000000_000000000000"],"ja4hCnt":1,"ja4h_r":["ge11nn050000_Host,User-Agent,Accept-Charset,Accept-Encoding,Connection__"],"ja4h_rCnt":1,"md5":["0f87454a3ea15f0db55ae928dbcd82fc"],"md5Cnt":1,"method":["GET"],"method-GET":1,"methodCnt":1,"path":["/favicon.ico"],"pathCnt":1,"requestHeader":["accept-encoding","connection","accept-charset","user-agent","host"],"requestHeaderCnt":5,"requestHeaderField":["accept-charset","accept-encoding","connection"],"requestHeaderValue":["utf-8","gzip","close"],"requestHeaderValueCnt":3,"response-server":["Apache/2.4.41 (Ubuntu)"],"response-serverCnt":1,"response-x-powered-by":["PHP/7.4.3"],"response-x-powered-byCnt":1,"responseHeader":["content-length","connection","content-type","date","server","x-powered-by"],"responseHeaderCnt":6,"responseHeaderField":["connection","content-type","date","content-length"],"responseHeaderValue":["close","text/plain; charset=utf-8","sat, 29 aug 2026 04:38:56 gmt","94"],"responseHeaderValueCnt":4,"serverVersion":["1.1"],"serverVersionCnt":1,"sha256":["1ca624415b2889dbeb3f969890b848b7bc5eaf96ca5e8fdd7461f943b45d10cb"],"sha256Cnt":1,"statuscode":[200],"statuscodeCnt":1,"uri":["209.141.62.110:8282/favicon.ico"],"uriCnt":1,"useragent":["Mozilla/5.0 (CentOS; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36"],"useragentCnt":1},"initRTT":72,"ipProtocol":6,"lastPacket":1787978336860,"length":315,"network":{"bytes":1202,"community_id":"1:p+QuUE3w5BGyy2ds/1LbZlGPpEw=","packets":10},"node":"spark-afae","packetPos":[-81130,8268610,90,600,152,321,82,369,1848,332,82],"packetRange":{"gte":1787978336545,"lte":1787978336860},"protocol":["http","tcp"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":287},"source":{"as":{"full":"AS210644 Aeza Group LLC","number":210644,"organization":{"name":"Aeza Group LLC"}},"bytes":577,"geo":{"country_iso_code":"AT"},"ip":"147.45.71.214","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":5,"port":39136},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcPayload8":"474554202f666176","srcRIR":"ARIN","srcTTL":[51],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["89710223611259"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["f63d9281-086b-4182-9002-663ffb13d931","869feaa1-dc77-4037-aee2-247b7a39cf7d","ee583a2e-d308-4c53-b8e2-a1cd45cd1bb7","ce8622a8-6d2f-4fe3-ab81-0cc86e19363e"],"signatureCnt":4,"signatureId":[2000166,2000009,1031486,2000008],"signatureIdCnt":4},"tag":{"block":["false","true"],"blockCnt":2,"category":["recon","attack","protocol"],"categoryCnt":3,"cves":[""],"cvesCnt":1,"description":["cloud credential scanning probe detected. requests for sensitive configuration files and credentials indicate automated scanning for exposed secrets and api keys.","generic favicon request detection. requests for /favicon.ico are commonly issued by web crawlers and browsers during normal browsing, but can also indicate automated scanning activity.","generic web crawler traffic detected. the simple pattern of get requests without specific exploitation indicators suggests automated crawling activity, possibly for search indexing or vulnerability scanning.","ip addresses with this tag have been seen crawling http(s) servers around the internet."],"intention":["unknown","suspicious"],"intentionCnt":2,"name":["root path scanner","web crawler","favicon crawler"],"nameCnt":3},"tags":["frantech-ts","sensor:frantech-ts","honeypot"],"tagsCnt":3,"tcp":{"ja4ls":"22_64_tcp","ja4t":["42340_2-4-8-1-3_1320_13"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":4,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":2,"psh":2,"rst":0,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":2848402240},"totDataBytes":526} +{"@timestamp":1787979263610,"_id":"260829-cSRLtJtqGP5CFLhUcuMX7YIn","_index":"arkime_sessions3-260829","client":{"bytes":135},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["Aeza International LTD"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["Aeza International LTD"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":429,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":5,"port":8282},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstPayload8":"485454502f312e31","dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[81130],"firstPacket":1787978336258,"http":{"bodyMagic":["text/plain"],"bodyMagicCnt":1,"responseHeader":["connection","content-type"],"responseHeaderCnt":2,"responseHeaderField":["content-type","connection"],"responseHeaderValue":["text/plain; charset=utf-8","close"],"responseHeaderValueCnt":2,"serverVersion":["1.1"],"serverVersionCnt":1,"statuscode":[400],"statuscodeCnt":1},"initRTT":71,"ipProtocol":6,"lastPacket":1787978336543,"length":285,"network":{"bytes":902,"community_id":"1:3ercAXinTJU2jFoq/lLhLcaDh1o=","packets":10},"node":"spark-afae","packetPos":[-81130,8266852,90,786,82,210,82,185,82,0,89],"packetRange":{"gte":1787978336258,"lte":1787978336543},"protocol":["tls","http","tcp"],"protocolCnt":3,"segmentCnt":1,"server":{"bytes":103},"source":{"as":{"full":"AS210644 Aeza Group LLC","number":210644,"organization":{"name":"Aeza Group LLC"}},"bytes":473,"geo":{"country_iso_code":"AT"},"ip":"147.45.71.214","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":5,"port":39130},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcPayload8":"160301007b010000","srcRIR":"ARIN","srcTTL":[51],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["264036190766110"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["ac32bdeb-b49d-4079-9e6b-8fbca5e0addf"],"signatureCnt":1,"signatureId":[1031336],"signatureIdCnt":1},"tag":{"block":["false"],"blockCnt":1,"category":["protocol"],"categoryCnt":1,"description":["ip addresses with this tag have been observed attempting to opportunistically crawl the internet and establish tls/ssl connections."],"intention":["unknown"],"intentionCnt":1,"name":["tls/ssl crawler"],"nameCnt":1},"tags":["frantech-ts","sensor:frantech-ts","honeypot"],"tagsCnt":3,"tcp":{"ja4l":"71260_51_tcp","ja4ls":"24_64_170","ja4t":["42340_2-4-8-1-3_1320_13"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":3,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":1,"psh":3,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":785169277},"tls":{"ja3":["cba7f34191ef2379c1325641f6c6c4f4"],"ja3Cnt":1,"ja3string":["771,49199-49195-49169-49159-49171-49161-49172-49162-5-47-53-49170-10,5-10-11-13-65281,23-24-25,0"],"ja3stringCnt":1,"ja4":["t12i130500_2d7513195f68_e51b7354d87f"],"ja4Cnt":1,"ja4_r":["t12i130500_0005,000a,002f,0035,c007,c009,c00a,c011,c012,c013,c014,c02b,c02f_0005,000a,000b,000d,ff01_0401,0403,0201,0203,0401,0501,0601"],"ja4_rCnt":1},"totDataBytes":238} +{"@timestamp":1787979263565,"_id":"260829-cST1sGDzoRtESYhfvobYC4yJ","_index":"arkime_sessions3-260829","client":{"bytes":228},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["Aeza International LTD"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["Aeza International LTD"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":625,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":5,"port":8282},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstPayload8":"485454502f312e31","dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[81130],"firstPacket":1787978335937,"http":{"bodyMagic":["text/html"],"bodyMagicCnt":1,"clientVersion":["1.1"],"clientVersionCnt":1,"host":["209.141.62.110:8282","209.141.62.110"],"hostCnt":2,"ja4h":["ge11nn050000_57c5e92682a8_000000000000_000000000000"],"ja4hCnt":1,"ja4h_r":["ge11nn050000_Host,User-Agent,Accept-Charset,Accept-Encoding,Connection__"],"ja4h_rCnt":1,"md5":["0f87454a3ea15f0db55ae928dbcd82fc"],"md5Cnt":1,"method":["GET"],"method-GET":1,"methodCnt":1,"path":["/"],"pathCnt":1,"requestHeader":["accept-encoding","connection","accept-charset","user-agent","host"],"requestHeaderCnt":5,"requestHeaderField":["accept-charset","accept-encoding","connection"],"requestHeaderValue":["utf-8","gzip","close"],"requestHeaderValueCnt":3,"response-server":["Apache/2.4.41 (Ubuntu)"],"response-serverCnt":1,"response-x-powered-by":["PHP/7.4.3"],"response-x-powered-byCnt":1,"responseHeader":["content-length","connection","content-type","date","server","x-powered-by"],"responseHeaderCnt":6,"responseHeaderField":["connection","content-type","date","content-length"],"responseHeaderValue":["close","text/plain; charset=utf-8","sat, 29 aug 2026 04:38:56 gmt","94"],"responseHeaderValueCnt":4,"serverVersion":["1.1"],"serverVersionCnt":1,"sha256":["1ca624415b2889dbeb3f969890b848b7bc5eaf96ca5e8fdd7461f943b45d10cb"],"sha256Cnt":1,"statuscode":[200],"statuscodeCnt":1,"uri":["209.141.62.110:8282/"],"uriCnt":1,"useragent":["Mozilla/5.0 (CentOS; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36"],"useragentCnt":1},"initRTT":72,"ipProtocol":6,"lastPacket":1787978336256,"length":319,"network":{"bytes":1191,"community_id":"1:HOgJU+xj1PprHMwLAXTy8hy57ZI=","packets":10},"node":"spark-afae","packetPos":[-81130,8260269,90,1794,940,310,82,369,2752,82,0],"packetRange":{"gte":1787978335937,"lte":1787978336256},"protocol":["http","tcp"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":287},"source":{"as":{"full":"AS210644 Aeza Group LLC","number":210644,"organization":{"name":"Aeza Group LLC"}},"bytes":566,"geo":{"country_iso_code":"AT"},"ip":"147.45.71.214","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":5,"port":39116},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcPayload8":"474554202f204854","srcRIR":"ARIN","srcTTL":[51],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["2057751460676937"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["869feaa1-dc77-4037-aee2-247b7a39cf7d","ee583a2e-d308-4c53-b8e2-a1cd45cd1bb7","ce8622a8-6d2f-4fe3-ab81-0cc86e19363e"],"signatureCnt":3,"signatureId":[2000166,1031486,2000008],"signatureIdCnt":3},"tag":{"block":["false","true"],"blockCnt":2,"category":["recon","attack","protocol"],"categoryCnt":3,"cves":[""],"cvesCnt":1,"description":["cloud credential scanning probe detected. requests for sensitive configuration files and credentials indicate automated scanning for exposed secrets and api keys.","generic web crawler traffic detected. the simple pattern of get requests without specific exploitation indicators suggests automated crawling activity, possibly for search indexing or vulnerability scanning.","ip addresses with this tag have been seen crawling http(s) servers around the internet."],"intention":["unknown","suspicious"],"intentionCnt":2,"name":["root path scanner","web crawler"],"nameCnt":2},"tags":["frantech-ts","sensor:frantech-ts","honeypot"],"tagsCnt":3,"tcp":{"ja4ls":"15_64_tcp","ja4t":["42340_2-4-8-1-3_1320_13"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":4,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":2,"psh":2,"rst":0,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":2095950953},"totDataBytes":515} +{"@timestamp":1787979263610,"_id":"260829-cSRzOPJrcGRPIKTib8CUGKWQ","_index":"arkime_sessions3-260829","client":{"bytes":135},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["Aeza International LTD"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["Aeza International LTD"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":429,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":5,"port":8282},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstPayload8":"485454502f312e31","dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[81130],"firstPacket":1787978335531,"http":{"bodyMagic":["text/plain"],"bodyMagicCnt":1,"responseHeader":["connection","content-type"],"responseHeaderCnt":2,"responseHeaderField":["content-type","connection"],"responseHeaderValue":["text/plain; charset=utf-8","close"],"responseHeaderValueCnt":2,"serverVersion":["1.1"],"serverVersionCnt":1,"statuscode":[400],"statuscodeCnt":1},"initRTT":71,"ipProtocol":6,"lastPacket":1787978335937,"length":406,"network":{"bytes":902,"community_id":"1:iB5F0Xx2/DQjkQtKo//OXu1tpG4=","packets":10},"node":"spark-afae","packetPos":[-81130,8241742,90,11231,4140,210,82,185,2348,82,89],"packetRange":{"gte":1787978335531,"lte":1787978335937},"protocol":["tls","http","tcp"],"protocolCnt":3,"segmentCnt":1,"server":{"bytes":103},"source":{"as":{"full":"AS210644 Aeza Group LLC","number":210644,"organization":{"name":"Aeza Group LLC"}},"bytes":473,"geo":{"country_iso_code":"AT"},"ip":"147.45.71.214","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":5,"port":39114},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcPayload8":"160301007b010000","srcRIR":"ARIN","srcTTL":[51],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["2001076178067247"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["ac32bdeb-b49d-4079-9e6b-8fbca5e0addf"],"signatureCnt":1,"signatureId":[1031336],"signatureIdCnt":1},"tag":{"block":["false"],"blockCnt":1,"category":["protocol"],"categoryCnt":1,"description":["ip addresses with this tag have been observed attempting to opportunistically crawl the internet and establish tls/ssl connections."],"intention":["unknown"],"intentionCnt":1,"name":["tls/ssl crawler"],"nameCnt":1},"tags":["frantech-ts","sensor:frantech-ts","honeypot"],"tagsCnt":3,"tcp":{"ja4l":"71247_51_tcp","ja4ls":"20_64_106","ja4t":["42340_2-4-8-1-3_1320_13"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":3,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":1,"psh":3,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":2194083733},"tls":{"ja3":["cba7f34191ef2379c1325641f6c6c4f4"],"ja3Cnt":1,"ja3string":["771,49199-49195-49169-49159-49171-49161-49172-49162-5-47-53-49170-10,5-10-11-13-65281,23-24-25,0"],"ja3stringCnt":1,"ja4":["t12i130500_2d7513195f68_e51b7354d87f"],"ja4Cnt":1,"ja4_r":["t12i130500_0005,000a,002f,0035,c007,c009,c00a,c011,c012,c013,c014,c02b,c02f_0005,000a,000b,000d,ff01_0401,0403,0201,0203,0401,0501,0601"],"ja4_rCnt":1},"totDataBytes":238} +{"@timestamp":1787979263565,"_id":"260829-cSSRVpmXazFNEbFiq9dCvWmv","_index":"arkime_sessions3-260829","client":{"bytes":211},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["Aeza International LTD"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["Aeza International LTD"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":625,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":5,"port":8282},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstPayload8":"485454502f312e31","dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[81130],"firstPacket":1787978267096,"http":{"bodyMagic":["text/html"],"bodyMagicCnt":1,"clientVersion":["1.1"],"clientVersionCnt":1,"host":["209.141.62.110:8282","209.141.62.110"],"hostCnt":2,"ja4h":["ge11nn040000_e1d2031bdfea_000000000000_000000000000"],"ja4hCnt":1,"ja4h_r":["ge11nn040000_Host,User-Agent,Accept,Accept-Encoding__"],"ja4h_rCnt":1,"md5":["0f87454a3ea15f0db55ae928dbcd82fc"],"md5Cnt":1,"method":["GET"],"method-GET":1,"methodCnt":1,"path":["/"],"pathCnt":1,"requestHeader":["accept-encoding","user-agent","host","accept"],"requestHeaderCnt":4,"requestHeaderField":["accept","accept-encoding"],"requestHeaderValue":["*/*","gzip"],"requestHeaderValueCnt":2,"response-server":["Apache/2.4.41 (Ubuntu)"],"response-serverCnt":1,"response-x-powered-by":["PHP/7.4.3"],"response-x-powered-byCnt":1,"responseHeader":["content-length","connection","content-type","date","server","x-powered-by"],"responseHeaderCnt":6,"responseHeaderField":["connection","content-type","date","content-length"],"responseHeaderValue":["close","text/plain; charset=utf-8","sat, 29 aug 2026 04:37:47 gmt","94"],"responseHeaderValueCnt":4,"serverVersion":["1.1"],"serverVersionCnt":1,"sha256":["1ca624415b2889dbeb3f969890b848b7bc5eaf96ca5e8fdd7461f943b45d10cb"],"sha256Cnt":1,"statuscode":[200],"statuscodeCnt":1,"uri":["209.141.62.110:8282/"],"uriCnt":1,"useragent":["Mozilla/5.0 (Macintosh; Intel Mac OS X 15_7_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.0 Safari/605.1.15"],"useragentCnt":1},"initRTT":70,"ipProtocol":6,"lastPacket":1787978267379,"length":283,"network":{"bytes":1174,"community_id":"1:umwYdyigufck9PteMGkwHYAxN9Q=","packets":10},"node":"spark-afae","packetPos":[-81130,6262678,90,172,82,293,82,369,82,0,0],"packetRange":{"gte":1787978267096,"lte":1787978267379},"protocol":["http","tcp"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":287},"source":{"as":{"full":"AS210644 Aeza Group LLC","number":210644,"organization":{"name":"Aeza Group LLC"}},"bytes":549,"geo":{"country_iso_code":"AT"},"ip":"147.45.71.214","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":5,"port":53906},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcPayload8":"474554202f204854","srcRIR":"ARIN","srcTTL":[51],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["976400909590354"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["869feaa1-dc77-4037-aee2-247b7a39cf7d","ee583a2e-d308-4c53-b8e2-a1cd45cd1bb7","ce8622a8-6d2f-4fe3-ab81-0cc86e19363e"],"signatureCnt":3,"signatureId":[2000166,1031486,2000008],"signatureIdCnt":3},"tag":{"block":["false","true"],"blockCnt":2,"category":["recon","attack","protocol"],"categoryCnt":3,"cves":[""],"cvesCnt":1,"description":["cloud credential scanning probe detected. requests for sensitive configuration files and credentials indicate automated scanning for exposed secrets and api keys.","generic web crawler traffic detected. the simple pattern of get requests without specific exploitation indicators suggests automated crawling activity, possibly for search indexing or vulnerability scanning.","ip addresses with this tag have been seen crawling http(s) servers around the internet."],"intention":["unknown","suspicious"],"intentionCnt":2,"name":["root path scanner","web crawler"],"nameCnt":2},"tags":["frantech-ts","sensor:frantech-ts","honeypot"],"tagsCnt":3,"tcp":{"ja4ls":"41_64_tcp","ja4t":["42340_2-4-8-1-3_1320_13"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":4,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":2,"psh":2,"rst":0,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":1758606928},"totDataBytes":498} +{"@timestamp":1787966894479,"_id":"260829-riL3cDy3_VVHhZYSw0P685qB","_index":"arkime_sessions3-260829","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Kaopu Cloud HK Limited"],"isp.dstCnt":1,"isp.src":["Aeza International LTD"],"isp.srcCnt":1,"org.dst":["LightNode-BH"],"org.dstCnt":1,"org.src":["Aeza International LTD"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":0,"geo":{"country_iso_code":"BH"},"ip":"38.54.2.209","mac":["52:54:8f:9d:76:48"],"mac-cnt":1,"packets":0,"port":8989},"dstRIR":"ARIN","ethertype":2048,"fileId":[81046],"firstPacket":1787965850894,"ipProtocol":6,"lastPacket":1787965851897,"length":1003,"network":{"bytes":148,"community_id":"1:H0XRM9TJDWUto9NvZ8EaQzn5aDY=","packets":2},"node":"spark-afae","packetPos":[-81046,20920,90],"packetRange":{"gte":1787965850894,"lte":1787965851897},"protocol":["tcp"],"protocolCnt":1,"rootId":"260829-riL3cDy3_VVHhZYSw0P685qB","segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS210644 Aeza Group LLC","number":210644,"organization":{"name":"Aeza Group LLC"}},"bytes":148,"geo":{"country_iso_code":"AT"},"ip":"147.45.71.214","mac":["98:44:ce:60:15:19"],"mac-cnt":1,"packets":2,"port":50520},"spoofable":["true"],"spoofableCnt":1,"srcDscp":[8],"srcDscpCnt":1,"srcOui":["Huawei Technologies Co.,Ltd"],"srcOuiCnt":1,"srcRIR":"ARIN","srcTTL":[54],"srcTTLCnt":1,"tags":["bahrain-sponge-01-ts","honeypot","sensor:bahrain-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["42340_2-4-8-1-3_1320_13"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":3225210541},"totDataBytes":0} +{"@timestamp":1787966894479,"_id":"260829-riKeCPlR7nlOQLpdXG9QMRnA","_index":"arkime_sessions3-260829","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Kaopu Cloud HK Limited"],"isp.dstCnt":1,"isp.src":["Aeza International LTD"],"isp.srcCnt":1,"org.dst":["LightNode-BH"],"org.dstCnt":1,"org.src":["Aeza International LTD"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":0,"geo":{"country_iso_code":"BH"},"ip":"38.54.2.209","mac":["52:54:8f:9d:76:48"],"mac-cnt":1,"packets":0,"port":8989},"dstRIR":"ARIN","ethertype":2048,"fileId":[81046],"firstPacket":1787965848916,"ipProtocol":6,"lastPacket":1787965849936,"length":1020,"network":{"bytes":148,"community_id":"1:Jjf+7vJoVNjqbLMeJ0wM7Nz5AYw=","packets":2},"node":"spark-afae","packetPos":[-81046,20740,90],"packetRange":{"gte":1787965848916,"lte":1787965849936},"protocol":["tcp"],"protocolCnt":1,"rootId":"260829-riKeCPlR7nlOQLpdXG9QMRnA","segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS210644 Aeza Group LLC","number":210644,"organization":{"name":"Aeza Group LLC"}},"bytes":148,"geo":{"country_iso_code":"AT"},"ip":"147.45.71.214","mac":["98:44:ce:60:15:19"],"mac-cnt":1,"packets":2,"port":50504},"spoofable":["true"],"spoofableCnt":1,"srcDscp":[8],"srcDscpCnt":1,"srcOui":["Huawei Technologies Co.,Ltd"],"srcOuiCnt":1,"srcRIR":"ARIN","srcTTL":[54],"srcTTLCnt":1,"tags":["bahrain-sponge-01-ts","honeypot","sensor:bahrain-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["42340_2-4-8-1-3_1320_13"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":1877473896},"totDataBytes":0} +{"@timestamp":1787966894586,"_id":"260829-QbjP1ZYevENBUK5fGA_0k2DH","_index":"arkime_sessions3-260829","client":{"bytes":135},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["Aeza International LTD"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["Aeza International LTD"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":429,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":5,"port":8085},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstPayload8":"485454502f312e31","dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[81047],"firstPacket":1787965699853,"http":{"bodyMagic":["text/plain"],"bodyMagicCnt":1,"responseHeader":["content-type","connection"],"responseHeaderCnt":2,"responseHeaderField":["content-type","connection"],"responseHeaderValue":["text/plain; charset=utf-8","close"],"responseHeaderValueCnt":2,"serverVersion":["1.1"],"serverVersionCnt":1,"statuscode":[400],"statuscodeCnt":1},"initRTT":71,"ipProtocol":6,"lastPacket":1787965700142,"length":289,"network":{"bytes":902,"community_id":"1:kovvRQfA8YucB1USaikfEDyAYZI=","packets":10},"node":"spark-afae","packetPos":[-81047,390445,90,1044,82,210,82,185,82,0,89],"packetRange":{"gte":1787965699853,"lte":1787965700142},"protocol":["http","tls","tcp"],"protocolCnt":3,"rootId":"260829-QbjP1ZYevENBUK5fGA_0k2DH","segmentCnt":1,"server":{"bytes":103},"source":{"as":{"full":"AS210644 Aeza Group LLC","number":210644,"organization":{"name":"Aeza Group LLC"}},"bytes":473,"geo":{"country_iso_code":"AT"},"ip":"147.45.71.214","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":5,"port":53714},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcPayload8":"160301007b010000","srcRIR":"ARIN","srcTTL":[51],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["851342421051377"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["ac32bdeb-b49d-4079-9e6b-8fbca5e0addf"],"signatureCnt":1,"signatureId":[1031336],"signatureIdCnt":1},"tag":{"block":["false"],"blockCnt":1,"category":["protocol"],"categoryCnt":1,"description":["ip addresses with this tag have been observed attempting to opportunistically crawl the internet and establish tls/ssl connections."],"intention":["unknown"],"intentionCnt":1,"name":["tls/ssl crawler"],"nameCnt":1},"tags":["honeypot","frantech-ts","sensor:frantech-ts"],"tagsCnt":3,"tcp":{"ja4l":"71649_51_tcp","ja4ls":"24_64_63","ja4t":["42340_2-4-8-1-3_1320_13"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":3,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":1,"psh":3,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":3302045940},"tls":{"ja3":["cba7f34191ef2379c1325641f6c6c4f4"],"ja3Cnt":1,"ja3string":["771,49199-49195-49169-49159-49171-49161-49172-49162-5-47-53-49170-10,5-10-11-13-65281,23-24-25,0"],"ja3stringCnt":1,"ja4":["t12i130500_2d7513195f68_e51b7354d87f"],"ja4Cnt":1,"ja4_r":["t12i130500_0005,000a,002f,0035,c007,c009,c00a,c011,c012,c013,c014,c02b,c02f_0005,000a,000b,000d,ff01_0401,0403,0201,0203,0401,0501,0601"],"ja4_rCnt":1},"totDataBytes":238} +{"@timestamp":1787966894557,"_id":"260829-QbibHO8PwjVCfrSQGvGaQMJn","_index":"arkime_sessions3-260829","client":{"bytes":254},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["Aeza International LTD"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["Aeza International LTD"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":625,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":5,"port":8085},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstPayload8":"485454502f312e31","dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[81047],"firstPacket":1787965699559,"http":{"bodyMagic":["text/html"],"bodyMagicCnt":1,"clientVersion":["1.1"],"clientVersionCnt":1,"host":["209.141.62.110","209.141.62.110:8085"],"hostCnt":2,"ja4h":["ge11nn050000_57c5e92682a8_000000000000_000000000000"],"ja4hCnt":1,"ja4h_r":["ge11nn050000_Host,User-Agent,Accept-Charset,Accept-Encoding,Connection__"],"ja4h_rCnt":1,"md5":["0f87454a3ea15f0db55ae928dbcd82fc"],"md5Cnt":1,"method":["GET"],"method-GET":1,"methodCnt":1,"path":["/favicon.ico"],"pathCnt":1,"requestHeader":["accept-encoding","host","connection","accept-charset","user-agent"],"requestHeaderCnt":5,"requestHeaderField":["accept-charset","accept-encoding","connection"],"requestHeaderValue":["utf-8","gzip","close"],"requestHeaderValueCnt":3,"response-server":["Apache/2.4.41 (Ubuntu)"],"response-serverCnt":1,"response-x-powered-by":["PHP/7.4.3"],"response-x-powered-byCnt":1,"responseHeader":["content-type","date","x-powered-by","connection","content-length","server"],"responseHeaderCnt":6,"responseHeaderField":["connection","content-type","date","content-length"],"responseHeaderValue":["close","text/plain; charset=utf-8","sat, 29 aug 2026 01:08:19 gmt","94"],"responseHeaderValueCnt":4,"serverVersion":["1.1"],"serverVersionCnt":1,"sha256":["1ca624415b2889dbeb3f969890b848b7bc5eaf96ca5e8fdd7461f943b45d10cb"],"sha256Cnt":1,"statuscode":[200],"statuscodeCnt":1,"uri":["209.141.62.110:8085/favicon.ico"],"uriCnt":1,"useragent":["Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Safari/605.7.24"],"useragentCnt":1},"initRTT":70,"ipProtocol":6,"lastPacket":1787965699852,"length":293,"network":{"bytes":1217,"community_id":"1:kbWvO5pfB6I8/oR+arC5XLmYMPk=","packets":10},"node":"spark-afae","packetPos":[-81047,386986,90,1236,82,336,82,369,1018,82,0],"packetRange":{"gte":1787965699559,"lte":1787965699852},"protocol":["http","tcp"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":287},"source":{"as":{"full":"AS210644 Aeza Group LLC","number":210644,"organization":{"name":"Aeza Group LLC"}},"bytes":592,"geo":{"country_iso_code":"AT"},"ip":"147.45.71.214","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":5,"port":53708},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcPayload8":"474554202f666176","srcRIR":"ARIN","srcTTL":[51],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["995815163088959"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["f63d9281-086b-4182-9002-663ffb13d931","869feaa1-dc77-4037-aee2-247b7a39cf7d","ee583a2e-d308-4c53-b8e2-a1cd45cd1bb7","ce8622a8-6d2f-4fe3-ab81-0cc86e19363e"],"signatureCnt":4,"signatureId":[2000166,2000009,1031486,2000008],"signatureIdCnt":4},"tag":{"block":["true","false"],"blockCnt":2,"category":["attack","protocol","recon"],"categoryCnt":3,"cves":[""],"cvesCnt":1,"description":["generic web crawler traffic detected. the simple pattern of get requests without specific exploitation indicators suggests automated crawling activity, possibly for search indexing or vulnerability scanning.","cloud credential scanning probe detected. requests for sensitive configuration files and credentials indicate automated scanning for exposed secrets and api keys.","generic favicon request detection. requests for /favicon.ico are commonly issued by web crawlers and browsers during normal browsing, but can also indicate automated scanning activity.","ip addresses with this tag have been seen crawling http(s) servers around the internet."],"intention":["suspicious","unknown"],"intentionCnt":2,"name":["root path scanner","favicon crawler","web crawler"],"nameCnt":3},"tags":["honeypot","frantech-ts","sensor:frantech-ts"],"tagsCnt":3,"tcp":{"ja4ls":"24_64_tcp","ja4t":["42340_2-4-8-1-3_1320_13"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":4,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":2,"psh":2,"rst":0,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":4176389842},"totDataBytes":541} +{"@timestamp":1787966894608,"_id":"260829-QbhfgMdYWbJOgIngeTyVzbAb","_index":"arkime_sessions3-260829","client":{"bytes":135},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["Aeza International LTD"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["Aeza International LTD"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":429,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":5,"port":8085},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstPayload8":"485454502f312e31","dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[81047],"firstPacket":1787965699266,"http":{"bodyMagic":["text/plain"],"bodyMagicCnt":1,"responseHeader":["content-type","connection"],"responseHeaderCnt":2,"responseHeaderField":["content-type","connection"],"responseHeaderValue":["text/plain; charset=utf-8","close"],"responseHeaderValueCnt":2,"serverVersion":["1.1"],"serverVersionCnt":1,"statuscode":[400],"statuscodeCnt":1},"initRTT":71,"ipProtocol":6,"lastPacket":1787965699557,"length":291,"network":{"bytes":902,"community_id":"1:h9U5qPsj3fzajrsd48I2Lnctxdo=","packets":10},"node":"spark-afae","packetPos":[-81047,385714,90,300,82,210,82,185,82,0,89],"packetRange":{"gte":1787965699266,"lte":1787965699557},"protocol":["http","tls","tcp"],"protocolCnt":3,"segmentCnt":1,"server":{"bytes":103},"source":{"as":{"full":"AS210644 Aeza Group LLC","number":210644,"organization":{"name":"Aeza Group LLC"}},"bytes":473,"geo":{"country_iso_code":"AT"},"ip":"147.45.71.214","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":5,"port":53694},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcPayload8":"160301007b010000","srcRIR":"ARIN","srcTTL":[51],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["861940700523628"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["ac32bdeb-b49d-4079-9e6b-8fbca5e0addf"],"signatureCnt":1,"signatureId":[1031336],"signatureIdCnt":1},"tag":{"block":["false"],"blockCnt":1,"category":["protocol"],"categoryCnt":1,"description":["ip addresses with this tag have been observed attempting to opportunistically crawl the internet and establish tls/ssl connections."],"intention":["unknown"],"intentionCnt":1,"name":["tls/ssl crawler"],"nameCnt":1},"tags":["honeypot","frantech-ts","sensor:frantech-ts"],"tagsCnt":3,"tcp":{"ja4l":"71149_51_tcp","ja4ls":"22_64_87","ja4t":["42340_2-4-8-1-3_1320_13"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":3,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":1,"psh":3,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":3993212616},"tls":{"ja3":["cba7f34191ef2379c1325641f6c6c4f4"],"ja3Cnt":1,"ja3string":["771,49199-49195-49169-49159-49171-49161-49172-49162-5-47-53-49170-10,5-10-11-13-65281,23-24-25,0"],"ja3stringCnt":1,"ja4":["t12i130500_2d7513195f68_e51b7354d87f"],"ja4Cnt":1,"ja4_r":["t12i130500_0005,000a,002f,0035,c007,c009,c00a,c011,c012,c013,c014,c02b,c02f_0005,000a,000b,000d,ff01_0401,0403,0201,0203,0401,0501,0601"],"ja4_rCnt":1},"totDataBytes":238} +{"@timestamp":1787966894551,"_id":"260829-Qbi41rBdfCpIo4_i3zekgvvq","_index":"arkime_sessions3-260829","client":{"bytes":243},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["Aeza International LTD"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["Aeza International LTD"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":625,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":5,"port":8085},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstPayload8":"485454502f312e31","dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[81047],"firstPacket":1787965698940,"http":{"bodyMagic":["text/html"],"bodyMagicCnt":1,"clientVersion":["1.1"],"clientVersionCnt":1,"host":["209.141.62.110","209.141.62.110:8085"],"hostCnt":2,"ja4h":["ge11nn050000_57c5e92682a8_000000000000_000000000000"],"ja4hCnt":1,"ja4h_r":["ge11nn050000_Host,User-Agent,Accept-Charset,Accept-Encoding,Connection__"],"ja4h_rCnt":1,"md5":["0f87454a3ea15f0db55ae928dbcd82fc"],"md5Cnt":1,"method":["GET"],"method-GET":1,"methodCnt":1,"path":["/"],"pathCnt":1,"requestHeader":["accept-encoding","host","connection","accept-charset","user-agent"],"requestHeaderCnt":5,"requestHeaderField":["accept-charset","accept-encoding","connection"],"requestHeaderValue":["utf-8","gzip","close"],"requestHeaderValueCnt":3,"response-server":["Apache/2.4.41 (Ubuntu)"],"response-serverCnt":1,"response-x-powered-by":["PHP/7.4.3"],"response-x-powered-byCnt":1,"responseHeader":["content-type","date","x-powered-by","connection","content-length","server"],"responseHeaderCnt":6,"responseHeaderField":["connection","content-type","date","content-length"],"responseHeaderValue":["close","text/plain; charset=utf-8","sat, 29 aug 2026 01:08:19 gmt","94"],"responseHeaderValueCnt":4,"serverVersion":["1.1"],"serverVersionCnt":1,"sha256":["1ca624415b2889dbeb3f969890b848b7bc5eaf96ca5e8fdd7461f943b45d10cb"],"sha256Cnt":1,"statuscode":[200],"statuscodeCnt":1,"uri":["209.141.62.110:8085/"],"uriCnt":1,"useragent":["Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Safari/605.7.24"],"useragentCnt":1},"initRTT":71,"ipProtocol":6,"lastPacket":1787965699266,"length":326,"network":{"bytes":1206,"community_id":"1:Hlpx+/Vc3GYaoWkeoRhKtLBoRUk=","packets":10},"node":"spark-afae","packetPos":[-81047,377832,90,2122,164,325,82,369,2722,1844,82],"packetRange":{"gte":1787965698940,"lte":1787965699266},"protocol":["http","tcp"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":287},"source":{"as":{"full":"AS210644 Aeza Group LLC","number":210644,"organization":{"name":"Aeza Group LLC"}},"bytes":581,"geo":{"country_iso_code":"AT"},"ip":"147.45.71.214","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":5,"port":53684},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcPayload8":"474554202f204854","srcRIR":"ARIN","srcTTL":[51],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["659922695354663"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["869feaa1-dc77-4037-aee2-247b7a39cf7d","ee583a2e-d308-4c53-b8e2-a1cd45cd1bb7","ce8622a8-6d2f-4fe3-ab81-0cc86e19363e"],"signatureCnt":3,"signatureId":[2000166,1031486,2000008],"signatureIdCnt":3},"tag":{"block":["true","false"],"blockCnt":2,"category":["attack","protocol","recon"],"categoryCnt":3,"cves":[""],"cvesCnt":1,"description":["generic web crawler traffic detected. the simple pattern of get requests without specific exploitation indicators suggests automated crawling activity, possibly for search indexing or vulnerability scanning.","cloud credential scanning probe detected. requests for sensitive configuration files and credentials indicate automated scanning for exposed secrets and api keys.","ip addresses with this tag have been seen crawling http(s) servers around the internet."],"intention":["suspicious","unknown"],"intentionCnt":2,"name":["root path scanner","web crawler"],"nameCnt":2},"tags":["honeypot","frantech-ts","sensor:frantech-ts"],"tagsCnt":3,"tcp":{"ja4ls":"13_64_tcp","ja4t":["42340_2-4-8-1-3_1320_13"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":4,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":2,"psh":2,"rst":0,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":234219942},"totDataBytes":530} +{"@timestamp":1787966894608,"_id":"260829-QbiWNs4W8eNJEY69Q8gf0eXp","_index":"arkime_sessions3-260829","client":{"bytes":135},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["Aeza International LTD"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["Aeza International LTD"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":429,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":5,"port":8085},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstPayload8":"485454502f312e31","dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[81047],"firstPacket":1787965698614,"http":{"bodyMagic":["text/plain"],"bodyMagicCnt":1,"responseHeader":["content-type","connection"],"responseHeaderCnt":2,"responseHeaderField":["content-type","connection"],"responseHeaderValue":["text/plain; charset=utf-8","close"],"responseHeaderValueCnt":2,"serverVersion":["1.1"],"serverVersionCnt":1,"statuscode":[400],"statuscodeCnt":1},"initRTT":71,"ipProtocol":6,"lastPacket":1787965698939,"length":325,"network":{"bytes":902,"community_id":"1:EVerslJWtuc+1rZsgviG/fFN/nk=","packets":10},"node":"spark-afae","packetPos":[-81047,371924,90,3048,152,210,82,185,1002,980,89],"packetRange":{"gte":1787965698614,"lte":1787965698939},"protocol":["http","tls","tcp"],"protocolCnt":3,"segmentCnt":1,"server":{"bytes":103},"source":{"as":{"full":"AS210644 Aeza Group LLC","number":210644,"organization":{"name":"Aeza Group LLC"}},"bytes":473,"geo":{"country_iso_code":"AT"},"ip":"147.45.71.214","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":5,"port":53680},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcPayload8":"160301007b010000","srcRIR":"ARIN","srcTTL":[51],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["667303906405465"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["ac32bdeb-b49d-4079-9e6b-8fbca5e0addf"],"signatureCnt":1,"signatureId":[1031336],"signatureIdCnt":1},"tag":{"block":["false"],"blockCnt":1,"category":["protocol"],"categoryCnt":1,"description":["ip addresses with this tag have been observed attempting to opportunistically crawl the internet and establish tls/ssl connections."],"intention":["unknown"],"intentionCnt":1,"name":["tls/ssl crawler"],"nameCnt":1},"tags":["honeypot","frantech-ts","sensor:frantech-ts"],"tagsCnt":3,"tcp":{"ja4l":"71658_51_tcp","ja4ls":"19_64_106","ja4t":["42340_2-4-8-1-3_1320_13"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":3,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":1,"psh":3,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":3802924506},"tls":{"ja3":["cba7f34191ef2379c1325641f6c6c4f4"],"ja3Cnt":1,"ja3string":["771,49199-49195-49169-49159-49171-49161-49172-49162-5-47-53-49170-10,5-10-11-13-65281,23-24-25,0"],"ja3stringCnt":1,"ja4":["t12i130500_2d7513195f68_e51b7354d87f"],"ja4Cnt":1,"ja4_r":["t12i130500_0005,000a,002f,0035,c007,c009,c00a,c011,c012,c013,c014,c02b,c02f_0005,000a,000b,000d,ff01_0401,0403,0201,0203,0401,0501,0601"],"ja4_rCnt":1},"totDataBytes":238} +{"@timestamp":1787966894550,"_id":"260829-QbiV7v4mMA5PCpiewFSyNMIF","_index":"arkime_sessions3-260829","client":{"bytes":211},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["Aeza International LTD"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["Aeza International LTD"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":625,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":5,"port":8085},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstPayload8":"485454502f312e31","dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[81047],"firstPacket":1787965656581,"http":{"bodyMagic":["text/html"],"bodyMagicCnt":1,"clientVersion":["1.1"],"clientVersionCnt":1,"host":["209.141.62.110","209.141.62.110:8085"],"hostCnt":2,"ja4h":["ge11nn040000_e1d2031bdfea_000000000000_000000000000"],"ja4hCnt":1,"ja4h_r":["ge11nn040000_Host,User-Agent,Accept,Accept-Encoding__"],"ja4h_rCnt":1,"md5":["0f87454a3ea15f0db55ae928dbcd82fc"],"md5Cnt":1,"method":["GET"],"method-GET":1,"methodCnt":1,"path":["/"],"pathCnt":1,"requestHeader":["accept-encoding","host","user-agent","accept"],"requestHeaderCnt":4,"requestHeaderField":["accept","accept-encoding"],"requestHeaderValue":["*/*","gzip"],"requestHeaderValueCnt":2,"response-server":["Apache/2.4.41 (Ubuntu)"],"response-serverCnt":1,"response-x-powered-by":["PHP/7.4.3"],"response-x-powered-byCnt":1,"responseHeader":["content-type","date","x-powered-by","connection","content-length","server"],"responseHeaderCnt":6,"responseHeaderField":["connection","content-type","date","content-length"],"responseHeaderValue":["close","text/plain; charset=utf-8","sat, 29 aug 2026 01:07:36 gmt","94"],"responseHeaderValueCnt":4,"serverVersion":["1.1"],"serverVersionCnt":1,"sha256":["1ca624415b2889dbeb3f969890b848b7bc5eaf96ca5e8fdd7461f943b45d10cb"],"sha256Cnt":1,"statuscode":[200],"statuscodeCnt":1,"uri":["209.141.62.110:8085/"],"uriCnt":1,"useragent":["Mozilla/5.0 (Macintosh; Intel Mac OS X 15_7_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.0 Safari/605.1.15"],"useragentCnt":1},"initRTT":71,"ipProtocol":6,"lastPacket":1787965656866,"length":285,"network":{"bytes":1174,"community_id":"1:D0qdPSnv/60hRCQcm63VWRRIiWg=","packets":10},"node":"spark-afae","packetPos":[-81047,235232,90,158,82,293,82,369,82,0,0],"packetRange":{"gte":1787965656581,"lte":1787965656866},"protocol":["http","tcp"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":287},"source":{"as":{"full":"AS210644 Aeza Group LLC","number":210644,"organization":{"name":"Aeza Group LLC"}},"bytes":549,"geo":{"country_iso_code":"AT"},"ip":"147.45.71.214","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":5,"port":35332},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcPayload8":"474554202f204854","srcRIR":"ARIN","srcTTL":[51],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["243706120450829"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["869feaa1-dc77-4037-aee2-247b7a39cf7d","ee583a2e-d308-4c53-b8e2-a1cd45cd1bb7","ce8622a8-6d2f-4fe3-ab81-0cc86e19363e"],"signatureCnt":3,"signatureId":[2000166,1031486,2000008],"signatureIdCnt":3},"tag":{"block":["true","false"],"blockCnt":2,"category":["attack","protocol","recon"],"categoryCnt":3,"cves":[""],"cvesCnt":1,"description":["generic web crawler traffic detected. the simple pattern of get requests without specific exploitation indicators suggests automated crawling activity, possibly for search indexing or vulnerability scanning.","cloud credential scanning probe detected. requests for sensitive configuration files and credentials indicate automated scanning for exposed secrets and api keys.","ip addresses with this tag have been seen crawling http(s) servers around the internet."],"intention":["suspicious","unknown"],"intentionCnt":2,"name":["root path scanner","web crawler"],"nameCnt":2},"tags":["honeypot","frantech-ts","sensor:frantech-ts"],"tagsCnt":3,"tcp":{"ja4ls":"49_64_tcp","ja4t":["42340_2-4-8-1-3_1320_13"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":4,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":2,"psh":2,"rst":0,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":1226285677},"totDataBytes":498} +{"@timestamp":1787963872674,"_id":"260829-jgnbzS8yv7ZK865VgrRIv6p8","_index":"arkime_sessions3-260829","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Hetzner Online GmbH"],"isp.dstCnt":1,"isp.src":["Aeza International LTD"],"isp.srcCnt":1,"org.dst":["HETZNER-DC"],"org.dstCnt":1,"org.src":["Aeza International LTD"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS24940 Hetzner Online GmbH","number":24940,"organization":{"name":"Hetzner Online GmbH"}},"bytes":0,"geo":{"country_iso_code":"FI"},"ip":"89.167.72.144","mac":["92:00:07:4c:82:70"],"mac-cnt":1,"packets":0,"port":8999},"dstRIR":"RIPE","ethertype":2048,"fileId":[81025],"firstPacket":1787963083997,"ipProtocol":6,"lastPacket":1787963085020,"length":1023,"network":{"bytes":148,"community_id":"1:zMrmpyxmpDCeXMGmXHhR8ieCzAM=","packets":2},"node":"spark-afae","packetPos":[-81025,156751,90],"packetRange":{"gte":1787963083997,"lte":1787963085020},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS210644 Aeza Group LLC","number":210644,"organization":{"name":"Aeza Group LLC"}},"bytes":148,"geo":{"country_iso_code":"AT"},"ip":"147.45.71.214","mac":["d2:74:7f:6e:37:e3"],"mac-cnt":1,"packets":2,"port":56798},"spoofable":["true"],"spoofableCnt":1,"srcRIR":"ARIN","srcTTL":[54],"srcTTLCnt":1,"tags":["sponge-01-ts","honeypot","sensor:sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["42340_2-4-8-1-3_1320_13"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":2014963968},"totDataBytes":0} +{"@timestamp":1787963872674,"_id":"260829-jgnYGDL30ulI-YlPa4xqgYJZ","_index":"arkime_sessions3-260829","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Hetzner Online GmbH"],"isp.dstCnt":1,"isp.src":["Aeza International LTD"],"isp.srcCnt":1,"org.dst":["HETZNER-DC"],"org.dstCnt":1,"org.src":["Aeza International LTD"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS24940 Hetzner Online GmbH","number":24940,"organization":{"name":"Hetzner Online GmbH"}},"bytes":0,"geo":{"country_iso_code":"FI"},"ip":"89.167.72.144","mac":["92:00:07:4c:82:70"],"mac-cnt":1,"packets":0,"port":8999},"dstRIR":"RIPE","ethertype":2048,"fileId":[81025],"firstPacket":1787963081996,"ipProtocol":6,"lastPacket":1787963083004,"length":1008,"network":{"bytes":148,"community_id":"1:B6O1kw/1xZjvGFNgs4D2nW8WTGw=","packets":2},"node":"spark-afae","packetPos":[-81025,156497,164],"packetRange":{"gte":1787963081996,"lte":1787963083004},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS210644 Aeza Group LLC","number":210644,"organization":{"name":"Aeza Group LLC"}},"bytes":148,"geo":{"country_iso_code":"AT"},"ip":"147.45.71.214","mac":["d2:74:7f:6e:37:e3"],"mac-cnt":1,"packets":2,"port":56788},"spoofable":["true"],"spoofableCnt":1,"srcRIR":"ARIN","srcTTL":[54],"srcTTLCnt":1,"tags":["sponge-01-ts","honeypot","sensor:sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["42340_2-4-8-1-3_1320_13"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":312170498},"totDataBytes":0} +{"@timestamp":1787960243637,"_id":"260828-m7c1NVLy_jxBIbyGJK9KiEwM","_index":"arkime_sessions3-260828","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Hetzner Online GmbH"],"isp.dstCnt":1,"isp.src":["Aeza International LTD"],"isp.srcCnt":1,"org.dst":["HETZNER-DC"],"org.dstCnt":1,"org.src":["Aeza International LTD"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS24940 Hetzner Online GmbH","number":24940,"organization":{"name":"Hetzner Online GmbH"}},"bytes":0,"geo":{"country_iso_code":"FI"},"ip":"89.167.72.144","mac":["92:00:07:4c:82:70"],"mac-cnt":1,"packets":0,"port":8090},"dstRIR":"RIPE","ethertype":2048,"fileId":[81002],"firstPacket":1787959291351,"ipProtocol":6,"lastPacket":1787959292379,"length":1028,"network":{"bytes":148,"community_id":"1:bg9TsW31ap9Q/H8UmtHnax4ZMEY=","packets":2},"node":"spark-afae","packetPos":[-81002,107968,90],"packetRange":{"gte":1787959291351,"lte":1787959292379},"protocol":["tcp"],"protocolCnt":1,"rootId":"260828-m7c1NVLy_jxBIbyGJK9KiEwM","segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS210644 Aeza Group LLC","number":210644,"organization":{"name":"Aeza Group LLC"}},"bytes":148,"geo":{"country_iso_code":"AT"},"ip":"147.45.71.214","mac":["d2:74:7f:6e:37:e3"],"mac-cnt":1,"packets":2,"port":35284},"spoofable":["true"],"spoofableCnt":1,"srcRIR":"ARIN","srcTTL":[54],"srcTTLCnt":1,"tags":["sensor:sponge-01-ts","sponge-01-ts","honeypot"],"tagsCnt":3,"tcp":{"ja4t":["42340_2-4-8-1-3_1320_13"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":1677705326},"totDataBytes":0} +{"@timestamp":1787960243637,"_id":"260828-m7ebyUyA7dFNf4RMaGFxZ2y2","_index":"arkime_sessions3-260828","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Hetzner Online GmbH"],"isp.dstCnt":1,"isp.src":["Aeza International LTD"],"isp.srcCnt":1,"org.dst":["HETZNER-DC"],"org.dstCnt":1,"org.src":["Aeza International LTD"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS24940 Hetzner Online GmbH","number":24940,"organization":{"name":"Hetzner Online GmbH"}},"bytes":0,"geo":{"country_iso_code":"FI"},"ip":"89.167.72.144","mac":["92:00:07:4c:82:70"],"mac-cnt":1,"packets":0,"port":8090},"dstRIR":"RIPE","ethertype":2048,"fileId":[81002],"firstPacket":1787959289351,"ipProtocol":6,"lastPacket":1787959290363,"length":1012,"network":{"bytes":148,"community_id":"1:7GjogiBPbXLsc14Rp3PTEoY3jlY=","packets":2},"node":"spark-afae","packetPos":[-81002,107788,90],"packetRange":{"gte":1787959289351,"lte":1787959290363},"protocol":["tcp"],"protocolCnt":1,"rootId":"260828-m7ebyUyA7dFNf4RMaGFxZ2y2","segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS210644 Aeza Group LLC","number":210644,"organization":{"name":"Aeza Group LLC"}},"bytes":148,"geo":{"country_iso_code":"AT"},"ip":"147.45.71.214","mac":["d2:74:7f:6e:37:e3"],"mac-cnt":1,"packets":2,"port":35276},"spoofable":["true"],"spoofableCnt":1,"srcRIR":"ARIN","srcTTL":[54],"srcTTLCnt":1,"tags":["sensor:sponge-01-ts","sponge-01-ts","honeypot"],"tagsCnt":3,"tcp":{"ja4t":["42340_2-4-8-1-3_1320_13"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":2250061751},"totDataBytes":0} +{"@timestamp":1787954795399,"_id":"260828-DyGql_S6gsFNM5J2Z5u1DgOC","_index":"arkime_sessions3-260828","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["netcup GmbH"],"isp.dstCnt":1,"isp.src":["Aeza International LTD"],"isp.srcCnt":1,"org.dst":["Netcup KVM"],"org.dstCnt":1,"org.src":["Aeza International LTD"],"org.srcCnt":1,"usertype.dst":["business"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS197540 netcup GmbH","number":197540,"organization":{"name":"netcup GmbH"}},"bytes":0,"geo":{"country_iso_code":"DE"},"ip":"159.195.21.150","mac":["8a:41:d3:b8:0d:d3"],"mac-cnt":1,"packets":0,"port":8085},"dstRIR":"ARIN","ethertype":2048,"fileId":[80966],"firstPacket":1787953739088,"ipProtocol":6,"lastPacket":1787953740113,"length":1025,"network":{"bytes":148,"community_id":"1:IApMBbj77BVmjxxWQKCACsjEteI=","packets":2},"node":"spark-afae","packetPos":[-80966,61790,551633],"packetRange":{"gte":1787953739088,"lte":1787953740113},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS210644 Aeza Group LLC","number":210644,"organization":{"name":"Aeza Group LLC"}},"bytes":148,"geo":{"country_iso_code":"AT"},"ip":"147.45.71.214","mac":["bc:0f:fe:38:0b:a3"],"mac-cnt":1,"packets":2,"port":49486},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"ARIN","srcTTL":[53],"srcTTLCnt":1,"tags":["sensor:netcup-ts","netcup-ts","honeypot"],"tagsCnt":3,"tcp":{"ja4t":["42340_2-4-8-1-3_1320_13"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":1720701256},"totDataBytes":0} +{"@timestamp":1787954795399,"_id":"260828-DyGMHmi4aEhFWr_sLvdyj4zO","_index":"arkime_sessions3-260828","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["netcup GmbH"],"isp.dstCnt":1,"isp.src":["Aeza International LTD"],"isp.srcCnt":1,"org.dst":["Netcup KVM"],"org.dstCnt":1,"org.src":["Aeza International LTD"],"org.srcCnt":1,"usertype.dst":["business"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS197540 netcup GmbH","number":197540,"organization":{"name":"netcup GmbH"}},"bytes":0,"geo":{"country_iso_code":"DE"},"ip":"159.195.21.150","mac":["8a:41:d3:b8:0d:d3"],"mac-cnt":1,"packets":0,"port":8085},"dstRIR":"ARIN","ethertype":2048,"fileId":[80966],"firstPacket":1787953737090,"ipProtocol":6,"lastPacket":1787953738100,"length":1010,"network":{"bytes":148,"community_id":"1:FOO5MVZ3hdnbECPW/e0yDoj6WuE=","packets":2},"node":"spark-afae","packetPos":[-80966,45064,13644],"packetRange":{"gte":1787953737090,"lte":1787953738100},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS210644 Aeza Group LLC","number":210644,"organization":{"name":"Aeza Group LLC"}},"bytes":148,"geo":{"country_iso_code":"AT"},"ip":"147.45.71.214","mac":["bc:0f:fe:3d:a3:a7"],"mac-cnt":1,"packets":2,"port":34222},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"ARIN","srcTTL":[53],"srcTTLCnt":1,"tags":["sensor:netcup-ts","netcup-ts","honeypot"],"tagsCnt":3,"tcp":{"ja4t":["42340_2-4-8-1-3_1320_13"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":2301782099},"totDataBytes":0} +{"@timestamp":1787949946101,"_id":"260828-bCA2opEpYMtMTaxC7v76ly10","_index":"arkime_sessions3-260828","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Kaopu Cloud HK Limited"],"isp.dstCnt":1,"isp.src":["Aeza International LTD"],"isp.srcCnt":1,"org.dst":["LightNode-BH"],"org.dstCnt":1,"org.src":["Aeza International LTD"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":0,"geo":{"country_iso_code":"BH"},"ip":"38.54.2.209","mac":["52:54:8f:9d:76:48"],"mac-cnt":1,"packets":0,"port":6363},"dstRIR":"ARIN","ethertype":2048,"fileId":[80935],"firstPacket":1787949166513,"ipProtocol":6,"lastPacket":1787949167545,"length":1032,"network":{"bytes":148,"community_id":"1:iIZ+SrFhlpiX6cfAuJa7zjHr7tI=","packets":2},"node":"spark-afae","packetPos":[-80935,283930,532],"packetRange":{"gte":1787949166513,"lte":1787949167545},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS210644 Aeza Group LLC","number":210644,"organization":{"name":"Aeza Group LLC"}},"bytes":148,"geo":{"country_iso_code":"AT"},"ip":"147.45.71.214","mac":["98:44:ce:60:15:19"],"mac-cnt":1,"packets":2,"port":37246},"spoofable":["true"],"spoofableCnt":1,"srcDscp":[8],"srcDscpCnt":1,"srcOui":["Huawei Technologies Co.,Ltd"],"srcOuiCnt":1,"srcRIR":"ARIN","srcTTL":[54],"srcTTLCnt":1,"tags":["honeypot","bahrain-sponge-01-ts","sensor:bahrain-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["42340_2-4-8-1-3_1320_13"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":3234508539},"totDataBytes":0} +{"@timestamp":1787949946101,"_id":"260828-bCAAXGmaOl1FtIIwwkFjrSs_","_index":"arkime_sessions3-260828","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Kaopu Cloud HK Limited"],"isp.dstCnt":1,"isp.src":["Aeza International LTD"],"isp.srcCnt":1,"org.dst":["LightNode-BH"],"org.dstCnt":1,"org.src":["Aeza International LTD"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":0,"geo":{"country_iso_code":"BH"},"ip":"38.54.2.209","mac":["52:54:8f:9d:76:48"],"mac-cnt":1,"packets":0,"port":6363},"dstRIR":"ARIN","ethertype":2048,"fileId":[80935],"firstPacket":1787949164510,"ipProtocol":6,"lastPacket":1787949165522,"length":1012,"network":{"bytes":148,"community_id":"1:1ad7kkimJ3JlNN22OOueGEG1pIg=","packets":2},"node":"spark-afae","packetPos":[-80935,283090,516],"packetRange":{"gte":1787949164510,"lte":1787949165522},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS210644 Aeza Group LLC","number":210644,"organization":{"name":"Aeza Group LLC"}},"bytes":148,"geo":{"country_iso_code":"AT"},"ip":"147.45.71.214","mac":["98:44:ce:60:15:19"],"mac-cnt":1,"packets":2,"port":37236},"spoofable":["true"],"spoofableCnt":1,"srcDscp":[8],"srcDscpCnt":1,"srcOui":["Huawei Technologies Co.,Ltd"],"srcOuiCnt":1,"srcRIR":"ARIN","srcTTL":[54],"srcTTLCnt":1,"tags":["honeypot","bahrain-sponge-01-ts","sensor:bahrain-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["42340_2-4-8-1-3_1320_13"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":529347749},"totDataBytes":0} +{"@timestamp":1787948442930,"_id":"260828-NSBVjoocT9pAV5ClIo1lw62P","_index":"arkime_sessions3-260828","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["netcup GmbH"],"isp.dstCnt":1,"isp.src":["Aeza International LTD"],"isp.srcCnt":1,"org.dst":["Netcup KVM"],"org.dstCnt":1,"org.src":["Aeza International LTD"],"org.srcCnt":1,"usertype.dst":["business"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS197540 netcup GmbH","number":197540,"organization":{"name":"netcup GmbH"}},"bytes":0,"geo":{"country_iso_code":"DE"},"ip":"159.195.21.150","mac":["8a:41:d3:b8:0d:d3"],"mac-cnt":1,"packets":0,"port":8086},"dstRIR":"ARIN","ethertype":2048,"fileId":[80924],"firstPacket":1787947724664,"ipProtocol":6,"lastPacket":1787947725683,"length":1019,"network":{"bytes":148,"community_id":"1:OpTFkaN8aqCo79OGhDbicCA1PV8=","packets":2},"node":"spark-afae","packetPos":[-80924,1519462,90],"packetRange":{"gte":1787947724664,"lte":1787947725683},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS210644 Aeza Group LLC","number":210644,"organization":{"name":"Aeza Group LLC"}},"bytes":148,"geo":{"country_iso_code":"AT"},"ip":"147.45.71.214","mac":["bc:0f:fe:3d:a3:a7"],"mac-cnt":1,"packets":2,"port":45816},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"ARIN","srcTTL":[53],"srcTTLCnt":1,"tags":["honeypot","netcup-ts","sensor:netcup-ts"],"tagsCnt":3,"tcp":{"ja4t":["42340_2-4-8-1-3_1320_13"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":200817858},"totDataBytes":0} +{"@timestamp":1787948442930,"_id":"260828-NSDoAIHlJVRHtJnFywUyomme","_index":"arkime_sessions3-260828","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["netcup GmbH"],"isp.dstCnt":1,"isp.src":["Aeza International LTD"],"isp.srcCnt":1,"org.dst":["Netcup KVM"],"org.dstCnt":1,"org.src":["Aeza International LTD"],"org.srcCnt":1,"usertype.dst":["business"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS197540 netcup GmbH","number":197540,"organization":{"name":"netcup GmbH"}},"bytes":0,"geo":{"country_iso_code":"DE"},"ip":"159.195.21.150","mac":["8a:41:d3:b8:0d:d3"],"mac-cnt":1,"packets":0,"port":8086},"dstRIR":"ARIN","ethertype":2048,"fileId":[80924],"firstPacket":1787947722661,"ipProtocol":6,"lastPacket":1787947723692,"length":1031,"network":{"bytes":148,"community_id":"1:5JIkWvI5zP+buQUs9pF0Rc58Jqc=","packets":2},"node":"spark-afae","packetPos":[-80924,1519192,90],"packetRange":{"gte":1787947722661,"lte":1787947723692},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS210644 Aeza Group LLC","number":210644,"organization":{"name":"Aeza Group LLC"}},"bytes":148,"geo":{"country_iso_code":"AT"},"ip":"147.45.71.214","mac":["bc:0f:fe:38:0b:a3"],"mac-cnt":1,"packets":2,"port":45806},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"ARIN","srcTTL":[53],"srcTTLCnt":1,"tags":["honeypot","netcup-ts","sensor:netcup-ts"],"tagsCnt":3,"tcp":{"ja4t":["42340_2-4-8-1-3_1320_13"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":1553906581},"totDataBytes":0} +{"@timestamp":1787948441525,"_id":"260828-UrZLo-s2jqhMn6Glpi8aXQKt","_index":"arkime_sessions3-260828","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Hetzner Online GmbH"],"isp.dstCnt":1,"isp.src":["Aeza International LTD"],"isp.srcCnt":1,"org.dst":["HETZNER-DC"],"org.dstCnt":1,"org.src":["Aeza International LTD"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS24940 Hetzner Online GmbH","number":24940,"organization":{"name":"Hetzner Online GmbH"}},"bytes":0,"geo":{"country_iso_code":"FI"},"ip":"89.167.72.144","mac":["92:00:07:4c:82:70"],"mac-cnt":1,"packets":0,"port":8989},"dstRIR":"RIPE","ethertype":2048,"fileId":[80925],"firstPacket":1787947460763,"ipProtocol":6,"lastPacket":1787947461781,"length":1018,"network":{"bytes":148,"community_id":"1:tHJBDOpX1kBHjGAKOBA2wulRF84=","packets":2},"node":"spark-afae","packetPos":[-80925,276770,356],"packetRange":{"gte":1787947460763,"lte":1787947461781},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS210644 Aeza Group LLC","number":210644,"organization":{"name":"Aeza Group LLC"}},"bytes":148,"geo":{"country_iso_code":"AT"},"ip":"147.45.71.214","mac":["d2:74:7f:6e:37:e3"],"mac-cnt":1,"packets":2,"port":45966},"spoofable":["true"],"spoofableCnt":1,"srcRIR":"ARIN","srcTTL":[54],"srcTTLCnt":1,"tags":["sensor:sponge-01-ts","honeypot","sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["42340_2-4-8-1-3_1320_13"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":3284106598},"totDataBytes":0} +{"@timestamp":1787948441525,"_id":"260828-UrY17Q2_0UtO5bmmirRrom2r","_index":"arkime_sessions3-260828","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Hetzner Online GmbH"],"isp.dstCnt":1,"isp.src":["Aeza International LTD"],"isp.srcCnt":1,"org.dst":["HETZNER-DC"],"org.dstCnt":1,"org.src":["Aeza International LTD"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS24940 Hetzner Online GmbH","number":24940,"organization":{"name":"Hetzner Online GmbH"}},"bytes":0,"geo":{"country_iso_code":"FI"},"ip":"89.167.72.144","mac":["92:00:07:4c:82:70"],"mac-cnt":1,"packets":0,"port":8989},"dstRIR":"RIPE","ethertype":2048,"fileId":[80925],"firstPacket":1787947458763,"ipProtocol":6,"lastPacket":1787947459769,"length":1006,"network":{"bytes":148,"community_id":"1:2AlHKj7p7fZ9qo4UMglst2bxFbU=","packets":2},"node":"spark-afae","packetPos":[-80925,275904,686],"packetRange":{"gte":1787947458763,"lte":1787947459769},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS210644 Aeza Group LLC","number":210644,"organization":{"name":"Aeza Group LLC"}},"bytes":148,"geo":{"country_iso_code":"AT"},"ip":"147.45.71.214","mac":["d2:74:7f:6e:37:e3"],"mac-cnt":1,"packets":2,"port":45952},"spoofable":["true"],"spoofableCnt":1,"srcRIR":"ARIN","srcTTL":[54],"srcTTLCnt":1,"tags":["sensor:sponge-01-ts","honeypot","sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["42340_2-4-8-1-3_1320_13"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":834825272},"totDataBytes":0} +{"@timestamp":1787945129248,"_id":"260828-vB9iT-wRkcNHNbaOqjEC1Rdh","_index":"arkime_sessions3-260828","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Kaopu Cloud HK Limited"],"isp.dstCnt":1,"isp.src":["Aeza International LTD"],"isp.srcCnt":1,"org.dst":["LightNode-BH"],"org.dstCnt":1,"org.src":["Aeza International LTD"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":0,"geo":{"country_iso_code":"BH"},"ip":"38.54.2.209","mac":["52:54:8f:9d:76:48"],"mac-cnt":1,"packets":0,"port":8080},"dstRIR":"ARIN","ethertype":2048,"fileId":[80902],"firstPacket":1787944735848,"ipProtocol":6,"lastPacket":1787944736849,"length":1001,"network":{"bytes":148,"community_id":"1:bnL8R3wLacU1gWW6HlXHG7rvtK0=","packets":2},"node":"spark-afae","packetPos":[-80902,306941,508],"packetRange":{"gte":1787944735848,"lte":1787944736849},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS210644 Aeza Group LLC","number":210644,"organization":{"name":"Aeza Group LLC"}},"bytes":148,"geo":{"country_iso_code":"AT"},"ip":"147.45.71.214","mac":["98:44:ce:60:15:19"],"mac-cnt":1,"packets":2,"port":39866},"spoofable":["true"],"spoofableCnt":1,"srcDscp":[8],"srcDscpCnt":1,"srcOui":["Huawei Technologies Co.,Ltd"],"srcOuiCnt":1,"srcRIR":"ARIN","srcTTL":[54],"srcTTLCnt":1,"tags":["bahrain-sponge-01-ts","honeypot","sensor:bahrain-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["42340_2-4-8-1-3_1320_13"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":1471477435},"totDataBytes":0} +{"@timestamp":1787945129248,"_id":"260828-vB_Cc_BKwI5AhrVHb55VCeW1","_index":"arkime_sessions3-260828","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Kaopu Cloud HK Limited"],"isp.dstCnt":1,"isp.src":["Aeza International LTD"],"isp.srcCnt":1,"org.dst":["LightNode-BH"],"org.dstCnt":1,"org.src":["Aeza International LTD"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":0,"geo":{"country_iso_code":"BH"},"ip":"38.54.2.209","mac":["52:54:8f:9d:76:48"],"mac-cnt":1,"packets":0,"port":8080},"dstRIR":"ARIN","ethertype":2048,"fileId":[80902],"firstPacket":1787944733846,"ipProtocol":6,"lastPacket":1787944734866,"length":1020,"network":{"bytes":148,"community_id":"1:X0vCabPb+wGIY395W5urZWLtS4g=","packets":2},"node":"spark-afae","packetPos":[-80902,305913,172],"packetRange":{"gte":1787944733846,"lte":1787944734866},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS210644 Aeza Group LLC","number":210644,"organization":{"name":"Aeza Group LLC"}},"bytes":148,"geo":{"country_iso_code":"AT"},"ip":"147.45.71.214","mac":["98:44:ce:60:15:19"],"mac-cnt":1,"packets":2,"port":39852},"spoofable":["true"],"spoofableCnt":1,"srcDscp":[8],"srcDscpCnt":1,"srcOui":["Huawei Technologies Co.,Ltd"],"srcOuiCnt":1,"srcRIR":"ARIN","srcTTL":[54],"srcTTLCnt":1,"tags":["bahrain-sponge-01-ts","honeypot","sensor:bahrain-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["42340_2-4-8-1-3_1320_13"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":2112627},"totDataBytes":0} +{"@timestamp":1787930283302,"_id":"260828-DTy4RQeNAUtK34vgIV40wF-t","_index":"arkime_sessions3-260828","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["netcup GmbH"],"isp.dstCnt":1,"isp.src":["Aeza International LTD"],"isp.srcCnt":1,"org.dst":["Netcup KVM"],"org.dstCnt":1,"org.src":["Aeza International LTD"],"org.srcCnt":1,"usertype.dst":["business"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS197540 netcup GmbH","number":197540,"organization":{"name":"netcup GmbH"}},"bytes":0,"geo":{"country_iso_code":"DE"},"ip":"159.195.21.150","mac":["8a:41:d3:b8:0d:d3"],"mac-cnt":1,"packets":0,"port":8081},"dstRIR":"ARIN","ethertype":2048,"fileId":[80803],"firstPacket":1787929585890,"ipProtocol":6,"lastPacket":1787929586892,"length":1002,"network":{"bytes":148,"community_id":"1:1fMUUxQhoDQZ0aQJhZJ7UM2rZio=","packets":2},"node":"spark-afae","packetPos":[-80803,607185,90],"packetRange":{"gte":1787929585890,"lte":1787929586892},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS210644 Aeza Group LLC","number":210644,"organization":{"name":"Aeza Group LLC"}},"bytes":148,"geo":{"country_iso_code":"AT"},"ip":"147.45.71.214","mac":["bc:0f:fe:3d:a3:a7"],"mac-cnt":1,"packets":2,"port":37084},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"ARIN","srcTTL":[53],"srcTTLCnt":1,"tags":["sensor:netcup-ts","netcup-ts","honeypot"],"tagsCnt":3,"tcp":{"ja4t":["42340_2-4-8-1-3_1320_13"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":442352958},"totDataBytes":0} +{"@timestamp":1787930283302,"_id":"260828-DTx9uXB-AtNG-rccUeH-VIOI","_index":"arkime_sessions3-260828","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["netcup GmbH"],"isp.dstCnt":1,"isp.src":["Aeza International LTD"],"isp.srcCnt":1,"org.dst":["Netcup KVM"],"org.dstCnt":1,"org.src":["Aeza International LTD"],"org.srcCnt":1,"usertype.dst":["business"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS197540 netcup GmbH","number":197540,"organization":{"name":"netcup GmbH"}},"bytes":0,"geo":{"country_iso_code":"DE"},"ip":"159.195.21.150","mac":["8a:41:d3:b8:0d:d3"],"mac-cnt":1,"packets":0,"port":8081},"dstRIR":"ARIN","ethertype":2048,"fileId":[80803],"firstPacket":1787929583891,"ipProtocol":6,"lastPacket":1787929584915,"length":1024,"network":{"bytes":148,"community_id":"1:EeFG4OYZM7f/Bs+ojnU9JU+n8cI=","packets":2},"node":"spark-afae","packetPos":[-80803,607005,90],"packetRange":{"gte":1787929583891,"lte":1787929584915},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS210644 Aeza Group LLC","number":210644,"organization":{"name":"Aeza Group LLC"}},"bytes":148,"geo":{"country_iso_code":"AT"},"ip":"147.45.71.214","mac":["bc:0f:fe:3d:a3:a7"],"mac-cnt":1,"packets":2,"port":37080},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"ARIN","srcTTL":[53],"srcTTLCnt":1,"tags":["sensor:netcup-ts","netcup-ts","honeypot"],"tagsCnt":3,"tcp":{"ja4t":["42340_2-4-8-1-3_1320_13"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":3767350429},"totDataBytes":0} +{"@timestamp":1787920601771,"_id":"260828-vrMy0N8K4tZH_79MmgcM6qVm","_index":"arkime_sessions3-260828","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Hetzner Online GmbH"],"isp.dstCnt":1,"isp.src":["Aeza International LTD"],"isp.srcCnt":1,"org.dst":["HETZNER-DC"],"org.dstCnt":1,"org.src":["Aeza International LTD"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS24940 Hetzner Online GmbH","number":24940,"organization":{"name":"Hetzner Online GmbH"}},"bytes":0,"geo":{"country_iso_code":"FI"},"ip":"89.167.72.144","mac":["92:00:07:4c:82:70"],"mac-cnt":1,"packets":0,"port":8085},"dstRIR":"RIPE","ethertype":2048,"fileId":[80728],"firstPacket":1787919625061,"ipProtocol":6,"lastPacket":1787919626069,"length":1008,"network":{"bytes":148,"community_id":"1:mB6kobGqIe5ikPHGnkONs7HsL7Y=","packets":2},"node":"spark-afae","packetPos":[-80728,63510,270],"packetRange":{"gte":1787919625061,"lte":1787919626069},"protocol":["tcp"],"protocolCnt":1,"rootId":"260828-vrMy0N8K4tZH_79MmgcM6qVm","segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS210644 Aeza Group LLC","number":210644,"organization":{"name":"Aeza Group LLC"}},"bytes":148,"geo":{"country_iso_code":"AT"},"ip":"147.45.71.214","mac":["d2:74:7f:6e:37:e3"],"mac-cnt":1,"packets":2,"port":40096},"spoofable":["true"],"spoofableCnt":1,"srcRIR":"ARIN","srcTTL":[54],"srcTTLCnt":1,"tags":["sensor:sponge-01-ts","honeypot","sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["42340_2-4-8-1-3_1320_13"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":2876621414},"totDataBytes":0} +{"@timestamp":1787920601771,"_id":"260828-vrOd-rQA3JxEmrObdbWhGnOP","_index":"arkime_sessions3-260828","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Hetzner Online GmbH"],"isp.dstCnt":1,"isp.src":["Aeza International LTD"],"isp.srcCnt":1,"org.dst":["HETZNER-DC"],"org.dstCnt":1,"org.src":["Aeza International LTD"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS24940 Hetzner Online GmbH","number":24940,"organization":{"name":"Hetzner Online GmbH"}},"bytes":0,"geo":{"country_iso_code":"FI"},"ip":"89.167.72.144","mac":["92:00:07:4c:82:70"],"mac-cnt":1,"packets":0,"port":8085},"dstRIR":"RIPE","ethertype":2048,"fileId":[80728],"firstPacket":1787919623061,"ipProtocol":6,"lastPacket":1787919624088,"length":1027,"network":{"bytes":148,"community_id":"1:VTPJhpZ12a9gTuSSb2Lsj8V8vys=","packets":2},"node":"spark-afae","packetPos":[-80728,63170,180],"packetRange":{"gte":1787919623061,"lte":1787919624088},"protocol":["tcp"],"protocolCnt":1,"rootId":"260828-vrOd-rQA3JxEmrObdbWhGnOP","segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS210644 Aeza Group LLC","number":210644,"organization":{"name":"Aeza Group LLC"}},"bytes":148,"geo":{"country_iso_code":"AT"},"ip":"147.45.71.214","mac":["d2:74:7f:6e:37:e3"],"mac-cnt":1,"packets":2,"port":40082},"spoofable":["true"],"spoofableCnt":1,"srcRIR":"ARIN","srcTTL":[54],"srcTTLCnt":1,"tags":["sensor:sponge-01-ts","honeypot","sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["42340_2-4-8-1-3_1320_13"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":1565545882},"totDataBytes":0} +{"@timestamp":1787920296641,"_id":"260828-JByY6hH-BTFEf5MEyEEkoygO","_index":"arkime_sessions3-260828","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Kaopu Cloud HK Limited"],"isp.dstCnt":1,"isp.src":["Aeza International LTD"],"isp.srcCnt":1,"org.dst":["LightNode-BH"],"org.dstCnt":1,"org.src":["Aeza International LTD"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":0,"geo":{"country_iso_code":"BH"},"ip":"38.54.2.209","mac":["52:54:8f:9d:76:48"],"mac-cnt":1,"packets":0,"port":8081},"dstRIR":"ARIN","ethertype":2048,"fileId":[80727],"firstPacket":1787918913560,"ipProtocol":6,"lastPacket":1787918914564,"length":1004,"network":{"bytes":148,"community_id":"1:O6DsdFeEWAP1jDUi/7qoQpYJpaE=","packets":2},"node":"spark-afae","packetPos":[-80727,1371,348],"packetRange":{"gte":1787918913560,"lte":1787918914564},"protocol":["tcp"],"protocolCnt":1,"rootId":"260828-JByY6hH-BTFEf5MEyEEkoygO","segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS210644 Aeza Group LLC","number":210644,"organization":{"name":"Aeza Group LLC"}},"bytes":148,"geo":{"country_iso_code":"AT"},"ip":"147.45.71.214","mac":["98:44:ce:60:15:19"],"mac-cnt":1,"packets":2,"port":54862},"spoofable":["true"],"spoofableCnt":1,"srcDscp":[8],"srcDscpCnt":1,"srcOui":["Huawei Technologies Co.,Ltd"],"srcOuiCnt":1,"srcRIR":"ARIN","srcTTL":[54],"srcTTLCnt":1,"tags":["honeypot","bahrain-sponge-01-ts","sensor:bahrain-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["42340_2-4-8-1-3_1320_13"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":3612283096},"totDataBytes":0} +{"@timestamp":1787920296641,"_id":"260828-JBzkVxKU3YVD-LPEnWqB30zv","_index":"arkime_sessions3-260828","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Kaopu Cloud HK Limited"],"isp.dstCnt":1,"isp.src":["Aeza International LTD"],"isp.srcCnt":1,"org.dst":["LightNode-BH"],"org.dstCnt":1,"org.src":["Aeza International LTD"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":0,"geo":{"country_iso_code":"BH"},"ip":"38.54.2.209","mac":["52:54:8f:9d:76:48"],"mac-cnt":1,"packets":0,"port":8081},"dstRIR":"ARIN","ethertype":2048,"fileId":[80727],"firstPacket":1787918911559,"ipProtocol":6,"lastPacket":1787918912576,"length":1017,"network":{"bytes":148,"community_id":"1:W/AVvCAKv4aytveq7tYS1i97GzM=","packets":2},"node":"spark-afae","packetPos":[-80727,1109,172],"packetRange":{"gte":1787918911559,"lte":1787918912576},"protocol":["tcp"],"protocolCnt":1,"rootId":"260828-JBzkVxKU3YVD-LPEnWqB30zv","segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS210644 Aeza Group LLC","number":210644,"organization":{"name":"Aeza Group LLC"}},"bytes":148,"geo":{"country_iso_code":"AT"},"ip":"147.45.71.214","mac":["98:44:ce:60:15:19"],"mac-cnt":1,"packets":2,"port":54860},"spoofable":["true"],"spoofableCnt":1,"srcDscp":[8],"srcDscpCnt":1,"srcOui":["Huawei Technologies Co.,Ltd"],"srcOuiCnt":1,"srcRIR":"ARIN","srcTTL":[54],"srcTTLCnt":1,"tags":["honeypot","bahrain-sponge-01-ts","sensor:bahrain-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["42340_2-4-8-1-3_1320_13"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":2035744445},"totDataBytes":0} diff --git a/kevlar/2026-08-31/sponge/ip-sessions/session_search_20260831T113639_67644f88.ndjson b/kevlar/2026-08-31/sponge/ip-sessions/session_search_20260831T113639_67644f88.ndjson new file mode 100644 index 0000000..07c1abb --- /dev/null +++ b/kevlar/2026-08-31/sponge/ip-sessions/session_search_20260831T113639_67644f88.ndjson @@ -0,0 +1,52 @@ +{"@timestamp":1787398665343,"_id":"260822-X4nLaVzv3zJNOLl3p7BHZl0P","_index":"arkime_sessions3-260822","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Kaopu Cloud HK Limited"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Lightnode Limited"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":0,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":0,"port":24031},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[77797],"firstPacket":1787397977573,"ipProtocol":6,"lastPacket":1787397977573,"length":0,"network":{"bytes":66,"community_id":"1:uyfQUu9gAq+Y6XLcT0DheS6CQJo=","packets":1},"node":"spark-afae","packetPos":[-77797,2097061],"packetRange":{"gte":1787397977573,"lte":1787397977573},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":66,"geo":{"country_iso_code":"PH"},"ip":"154.90.37.55","mac":["fc:bd:67:9d:2b:2b"],"mac-cnt":1,"packets":1,"port":54546},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcRIR":"AFRINIC","srcTTL":[121],"srcTTLCnt":1,"tags":["contabo-sponge-01-ts","honeypot","sensor:contabo-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":1,"dstZero":0,"ece":1,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":1706944210},"totDataBytes":0} +{"@timestamp":1787398665159,"_id":"260822-X4nd8srWqnROCLx7W8lIU1z_","_index":"arkime_sessions3-260822","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Kaopu Cloud HK Limited"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Lightnode Limited"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":0,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":0,"port":24030},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[77797],"firstPacket":1787397977555,"ipProtocol":6,"lastPacket":1787397978563,"length":1008,"network":{"bytes":132,"community_id":"1:O6sIB1EGECphqiUfIK51qQTzgUA=","packets":2},"node":"spark-afae","packetPos":[-77797,2094607,116105],"packetRange":{"gte":1787397977555,"lte":1787397978563},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":132,"geo":{"country_iso_code":"PH"},"ip":"154.90.37.55","mac":["fc:bd:67:9d:2b:2b"],"mac-cnt":1,"packets":2,"port":54285},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcRIR":"AFRINIC","srcTTL":[120],"srcTTLCnt":1,"tags":["contabo-sponge-01-ts","honeypot","sensor:contabo-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":1238186765},"totDataBytes":0} +{"@timestamp":1787398665194,"_id":"260822-X4mw8mYbdt1BmKXNaz68E6mR","_index":"arkime_sessions3-260822","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Kaopu Cloud HK Limited"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Lightnode Limited"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":0,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":0,"port":24029},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[77797],"firstPacket":1787397977533,"ipProtocol":6,"lastPacket":1787397978536,"length":1003,"network":{"bytes":132,"community_id":"1:7h3So8ldJYoA6n9nNIJtodk2XMg=","packets":2},"node":"spark-afae","packetPos":[-77797,2091375,118605],"packetRange":{"gte":1787397977533,"lte":1787397978536},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":132,"geo":{"country_iso_code":"PH"},"ip":"154.90.37.55","mac":["fc:bd:67:9d:2b:2b"],"mac-cnt":1,"packets":2,"port":54022},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcRIR":"AFRINIC","srcTTL":[120],"srcTTLCnt":1,"tags":["contabo-sponge-01-ts","honeypot","sensor:contabo-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":2290323738},"totDataBytes":0} +{"@timestamp":1787398665148,"_id":"260822-X4kN0a2_eFZM46SonrPlWXA2","_index":"arkime_sessions3-260822","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Kaopu Cloud HK Limited"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Lightnode Limited"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":0,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":0,"port":24028},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[77797],"firstPacket":1787397977516,"ipProtocol":6,"lastPacket":1787397977516,"length":0,"network":{"bytes":66,"community_id":"1:zZRVm8nnH3TOOtXjyoMBikQzLuE=","packets":1},"node":"spark-afae","packetPos":[-77797,2088605],"packetRange":{"gte":1787397977516,"lte":1787397977516},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":66,"geo":{"country_iso_code":"PH"},"ip":"154.90.37.55","mac":["fc:bd:67:9d:2b:2b"],"mac-cnt":1,"packets":1,"port":53763},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcRIR":"AFRINIC","srcTTL":[120],"srcTTLCnt":1,"tags":["contabo-sponge-01-ts","honeypot","sensor:contabo-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":1,"dstZero":0,"ece":1,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":1083093204},"totDataBytes":0} +{"@timestamp":1787398665208,"_id":"260822-X4n2AVKwFiJObaXqpXnC_61m","_index":"arkime_sessions3-260822","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Kaopu Cloud HK Limited"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Lightnode Limited"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":0,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":0,"port":24027},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[77797],"firstPacket":1787397977494,"ipProtocol":6,"lastPacket":1787397977494,"length":0,"network":{"bytes":66,"community_id":"1:990h68cQiGTChN7KirRm+wed8U8=","packets":1},"node":"spark-afae","packetPos":[-77797,2085355],"packetRange":{"gte":1787397977494,"lte":1787397977494},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":66,"geo":{"country_iso_code":"PH"},"ip":"154.90.37.55","mac":["fc:bd:67:9d:2b:2b"],"mac-cnt":1,"packets":1,"port":53501},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcRIR":"AFRINIC","srcTTL":[121],"srcTTLCnt":1,"tags":["contabo-sponge-01-ts","honeypot","sensor:contabo-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":1,"dstZero":0,"ece":1,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":2642266677},"totDataBytes":0} +{"@timestamp":1787398665183,"_id":"260822-X4n4xbKmUyRGMIOsPR8vENs_","_index":"arkime_sessions3-260822","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Kaopu Cloud HK Limited"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Lightnode Limited"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":0,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":0,"port":24026},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[77797],"firstPacket":1787397977477,"ipProtocol":6,"lastPacket":1787397978486,"length":1009,"network":{"bytes":132,"community_id":"1:AizbHLUae4tyDGxUJ70CM2PsOWY=","packets":2},"node":"spark-afae","packetPos":[-77797,2082001,127007],"packetRange":{"gte":1787397977477,"lte":1787397978486},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":132,"geo":{"country_iso_code":"PH"},"ip":"154.90.37.55","mac":["fc:bd:67:9d:2b:2b"],"mac-cnt":1,"packets":2,"port":53241},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcRIR":"AFRINIC","srcTTL":[121],"srcTTLCnt":1,"tags":["contabo-sponge-01-ts","honeypot","sensor:contabo-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":3641959366},"totDataBytes":0} +{"@timestamp":1787398665184,"_id":"260822-X4mYIIgvZStKpY6WE_YSe4zw","_index":"arkime_sessions3-260822","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Kaopu Cloud HK Limited"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Lightnode Limited"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":0,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":0,"port":24025},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[77797],"firstPacket":1787397977459,"ipProtocol":6,"lastPacket":1787397977459,"length":0,"network":{"bytes":66,"community_id":"1:e/5tDr2xLWC29K5tT+8ni7mG+IQ=","packets":1},"node":"spark-afae","packetPos":[-77797,2077587],"packetRange":{"gte":1787397977459,"lte":1787397977459},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":66,"geo":{"country_iso_code":"PH"},"ip":"154.90.37.55","mac":["fc:bd:67:9d:2b:2b"],"mac-cnt":1,"packets":1,"port":52977},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcRIR":"AFRINIC","srcTTL":[120],"srcTTLCnt":1,"tags":["contabo-sponge-01-ts","honeypot","sensor:contabo-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":1,"dstZero":0,"ece":1,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":974859599},"totDataBytes":0} +{"@timestamp":1787398665543,"_id":"260822-X4kY8d_dt-lPdLHA2Si55NMW","_index":"arkime_sessions3-260822","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Kaopu Cloud HK Limited"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Lightnode Limited"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":0,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":0,"port":24024},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[77797],"firstPacket":1787397977440,"ipProtocol":6,"lastPacket":1787397978454,"length":1014,"network":{"bytes":132,"community_id":"1:TeRseNppQOdihGzDZmB8sIsDCPU=","packets":2},"node":"spark-afae","packetPos":[-77797,2072859,134575],"packetRange":{"gte":1787397977440,"lte":1787397978454},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":132,"geo":{"country_iso_code":"PH"},"ip":"154.90.37.55","mac":["fc:bd:67:9d:2b:2b"],"mac-cnt":1,"packets":2,"port":52714},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcRIR":"AFRINIC","srcTTL":[121],"srcTTLCnt":1,"tags":["contabo-sponge-01-ts","honeypot","sensor:contabo-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":2055315097},"totDataBytes":0} +{"@timestamp":1787398665185,"_id":"260822-X4kxD66oMQdNt4P30FFQH9H2","_index":"arkime_sessions3-260822","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Kaopu Cloud HK Limited"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Lightnode Limited"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":0,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":0,"port":24023},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[77797],"firstPacket":1787397977422,"ipProtocol":6,"lastPacket":1787397978424,"length":1002,"network":{"bytes":132,"community_id":"1:Q49sb7fg0f7P2EM0fvfcnnOP1JA=","packets":2},"node":"spark-afae","packetPos":[-77797,2068391,137169],"packetRange":{"gte":1787397977422,"lte":1787397978424},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":132,"geo":{"country_iso_code":"PH"},"ip":"154.90.37.55","mac":["fc:bd:67:9d:2b:2b"],"mac-cnt":1,"packets":2,"port":52443},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcRIR":"AFRINIC","srcTTL":[121],"srcTTLCnt":1,"tags":["contabo-sponge-01-ts","honeypot","sensor:contabo-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":2750823716},"totDataBytes":0} +{"@timestamp":1787398665206,"_id":"260822-X4lEjQ7FyNlMyq22l8aijtGL","_index":"arkime_sessions3-260822","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Kaopu Cloud HK Limited"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Lightnode Limited"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":0,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":0,"port":24022},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[77797],"firstPacket":1787397977408,"ipProtocol":6,"lastPacket":1787397978410,"length":1002,"network":{"bytes":132,"community_id":"1:fpijL4tokWqauLEQrd1iXwEjt8Y=","packets":2},"node":"spark-afae","packetPos":[-77797,2063543,140711],"packetRange":{"gte":1787397977408,"lte":1787397978410},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":132,"geo":{"country_iso_code":"PH"},"ip":"154.90.37.55","mac":["fc:bd:67:9d:2b:2b"],"mac-cnt":1,"packets":2,"port":52165},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcRIR":"AFRINIC","srcTTL":[120],"srcTTLCnt":1,"tags":["contabo-sponge-01-ts","honeypot","sensor:contabo-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":3512260208},"totDataBytes":0} +{"@timestamp":1787398665543,"_id":"260822-X4n7e3TRO6ZAMLWBQ83sr8qb","_index":"arkime_sessions3-260822","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Kaopu Cloud HK Limited"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Lightnode Limited"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":0,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":0,"port":24021},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[77797],"firstPacket":1787397977386,"ipProtocol":6,"lastPacket":1787397977386,"length":0,"network":{"bytes":66,"community_id":"1:l644tk0x7iSkVzm4AAtOPMzfKIM=","packets":1},"node":"spark-afae","packetPos":[-77797,2056677],"packetRange":{"gte":1787397977386,"lte":1787397977386},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":66,"geo":{"country_iso_code":"PH"},"ip":"154.90.37.55","mac":["fc:bd:67:9d:2b:2b"],"mac-cnt":1,"packets":1,"port":51893},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcRIR":"AFRINIC","srcTTL":[121],"srcTTLCnt":1,"tags":["contabo-sponge-01-ts","honeypot","sensor:contabo-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":1,"dstZero":0,"ece":1,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":2227258719},"totDataBytes":0} +{"@timestamp":1787398665343,"_id":"260822-X4l7TKSifGxGlKu2SQfvQLAb","_index":"arkime_sessions3-260822","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Kaopu Cloud HK Limited"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Lightnode Limited"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":0,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":0,"port":24020},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[77797],"firstPacket":1787397977363,"ipProtocol":6,"lastPacket":1787397978363,"length":1000,"network":{"bytes":132,"community_id":"1:sqX9RGNrfoi4rSiM39dGO5EKIW0=","packets":2},"node":"spark-afae","packetPos":[-77797,2048005,151529],"packetRange":{"gte":1787397977363,"lte":1787397978363},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":132,"geo":{"country_iso_code":"PH"},"ip":"154.90.37.55","mac":["fc:bd:67:9d:2b:2b"],"mac-cnt":1,"packets":2,"port":51621},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcRIR":"AFRINIC","srcTTL":[120],"srcTTLCnt":1,"tags":["contabo-sponge-01-ts","honeypot","sensor:contabo-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":1691784847},"totDataBytes":0} +{"@timestamp":1787398665543,"_id":"260822-X4n6zDVBk3tIsalRNUY-bGYr","_index":"arkime_sessions3-260822","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Kaopu Cloud HK Limited"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Lightnode Limited"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":0,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":0,"port":24019},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[77797],"firstPacket":1787397977345,"ipProtocol":6,"lastPacket":1787397977345,"length":0,"network":{"bytes":66,"community_id":"1:c54CRPHu4j/0IWK1+VlAen0N1hs=","packets":1},"node":"spark-afae","packetPos":[-77797,2038635],"packetRange":{"gte":1787397977345,"lte":1787397977345},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":66,"geo":{"country_iso_code":"PH"},"ip":"154.90.37.55","mac":["fc:bd:67:9d:2b:2b"],"mac-cnt":1,"packets":1,"port":51353},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcRIR":"AFRINIC","srcTTL":[121],"srcTTLCnt":1,"tags":["contabo-sponge-01-ts","honeypot","sensor:contabo-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":1,"dstZero":0,"ece":1,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":3882773355},"totDataBytes":0} +{"@timestamp":1787398665160,"_id":"260822-X4ntziOxl99E8rAf3EWD8NcB","_index":"arkime_sessions3-260822","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Kaopu Cloud HK Limited"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Lightnode Limited"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":0,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":0,"port":24018},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[77797],"firstPacket":1787397977329,"ipProtocol":6,"lastPacket":1787397977329,"length":0,"network":{"bytes":66,"community_id":"1:jV6u8pn6syr3DniiADwUcoO6KAg=","packets":1},"node":"spark-afae","packetPos":[-77797,2029919],"packetRange":{"gte":1787397977329,"lte":1787397977329},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":66,"geo":{"country_iso_code":"PH"},"ip":"154.90.37.55","mac":["fc:bd:67:9d:2b:2b"],"mac-cnt":1,"packets":1,"port":51077},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcRIR":"AFRINIC","srcTTL":[121],"srcTTLCnt":1,"tags":["contabo-sponge-01-ts","honeypot","sensor:contabo-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":1,"dstZero":0,"ece":1,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":950370297},"totDataBytes":0} +{"@timestamp":1787398665186,"_id":"260822-X4kYzpNxB1dNnZV-tpvWifwN","_index":"arkime_sessions3-260822","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Kaopu Cloud HK Limited"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Lightnode Limited"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":0,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":0,"port":24017},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[77797],"firstPacket":1787397977316,"ipProtocol":6,"lastPacket":1787397978316,"length":1000,"network":{"bytes":132,"community_id":"1:kPVwW+VbK06/azywZvJ/Q5TAL6s=","packets":2},"node":"spark-afae","packetPos":[-77797,2023619,170199],"packetRange":{"gte":1787397977316,"lte":1787397978316},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":132,"geo":{"country_iso_code":"PH"},"ip":"154.90.37.55","mac":["fc:bd:67:9d:2b:2b"],"mac-cnt":1,"packets":2,"port":50803},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcRIR":"AFRINIC","srcTTL":[121],"srcTTLCnt":1,"tags":["contabo-sponge-01-ts","honeypot","sensor:contabo-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":3502804748},"totDataBytes":0} +{"@timestamp":1787398665183,"_id":"260822-X4lnWOYXaqhDCK15IS_n8OcG","_index":"arkime_sessions3-260822","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Kaopu Cloud HK Limited"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Lightnode Limited"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":0,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":0,"port":24016},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[77797],"firstPacket":1787397977295,"ipProtocol":6,"lastPacket":1787397978299,"length":1004,"network":{"bytes":132,"community_id":"1:8Mdj3olbcc0yxCwIJq99M6QTti4=","packets":2},"node":"spark-afae","packetPos":[-77797,2011089,180117],"packetRange":{"gte":1787397977295,"lte":1787397978299},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":132,"geo":{"country_iso_code":"PH"},"ip":"154.90.37.55","mac":["fc:bd:67:9d:2b:2b"],"mac-cnt":1,"packets":2,"port":50533},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcRIR":"AFRINIC","srcTTL":[121],"srcTTLCnt":1,"tags":["contabo-sponge-01-ts","honeypot","sensor:contabo-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":78548080},"totDataBytes":0} +{"@timestamp":1787398665169,"_id":"260822-X4lReoiKeblIv5nUCVC8UVJF","_index":"arkime_sessions3-260822","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Kaopu Cloud HK Limited"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Lightnode Limited"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":0,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":0,"port":24015},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[77797],"firstPacket":1787397977276,"ipProtocol":6,"lastPacket":1787397977276,"length":0,"network":{"bytes":66,"community_id":"1:UteZMS6bFtBhJUObRucNuP4nqxQ=","packets":1},"node":"spark-afae","packetPos":[-77797,1998311],"packetRange":{"gte":1787397977276,"lte":1787397977276},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":66,"geo":{"country_iso_code":"PH"},"ip":"154.90.37.55","mac":["fc:bd:67:9d:2b:2b"],"mac-cnt":1,"packets":1,"port":50260},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcRIR":"AFRINIC","srcTTL":[120],"srcTTLCnt":1,"tags":["contabo-sponge-01-ts","honeypot","sensor:contabo-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":1,"dstZero":0,"ece":1,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":2683492483},"totDataBytes":0} +{"@timestamp":1787398665155,"_id":"260822-X4ktteaKUx1O4Ju3O81nGHiC","_index":"arkime_sessions3-260822","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Kaopu Cloud HK Limited"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Lightnode Limited"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":0,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":0,"port":24014},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[77797],"firstPacket":1787397977261,"ipProtocol":6,"lastPacket":1787397977261,"length":0,"network":{"bytes":66,"community_id":"1:QBzjmguGzyUgbiVXzwgaJrXkufM=","packets":1},"node":"spark-afae","packetPos":[-77797,1987353],"packetRange":{"gte":1787397977261,"lte":1787397977261},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":66,"geo":{"country_iso_code":"PH"},"ip":"154.90.37.55","mac":["fc:bd:67:9d:2b:2b"],"mac-cnt":1,"packets":1,"port":49977},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcRIR":"AFRINIC","srcTTL":[121],"srcTTLCnt":1,"tags":["contabo-sponge-01-ts","honeypot","sensor:contabo-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":1,"dstZero":0,"ece":1,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":4209373780},"totDataBytes":0} +{"@timestamp":1787398665171,"_id":"260822-X4kYBumUEJNMxJT1XYMBVlZv","_index":"arkime_sessions3-260822","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Kaopu Cloud HK Limited"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Lightnode Limited"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":0,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":0,"port":24013},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[77797],"firstPacket":1787397977237,"ipProtocol":6,"lastPacket":1787397978251,"length":1014,"network":{"bytes":132,"community_id":"1:ZCUODL8E0HtDJHG6N0o82rnv2ok=","packets":2},"node":"spark-afae","packetPos":[-77797,1969579,213591],"packetRange":{"gte":1787397977237,"lte":1787397978251},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":132,"geo":{"country_iso_code":"PH"},"ip":"154.90.37.55","mac":["fc:bd:67:9d:2b:2b"],"mac-cnt":1,"packets":2,"port":49701},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcRIR":"AFRINIC","srcTTL":[120],"srcTTLCnt":1,"tags":["contabo-sponge-01-ts","honeypot","sensor:contabo-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":1700359251},"totDataBytes":0} +{"@timestamp":1787398665169,"_id":"260822-X4kESF-pxkhE_KTlfI0U1p_p","_index":"arkime_sessions3-260822","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Kaopu Cloud HK Limited"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Lightnode Limited"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":0,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":0,"port":24012},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[77797],"firstPacket":1787397977191,"ipProtocol":6,"lastPacket":1787397977191,"length":0,"network":{"bytes":66,"community_id":"1:uxZC/MZMI6gXSSAp+MfawbzKskc=","packets":1},"node":"spark-afae","packetPos":[-77797,1932007],"packetRange":{"gte":1787397977191,"lte":1787397977191},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":66,"geo":{"country_iso_code":"PH"},"ip":"154.90.37.55","mac":["fc:bd:67:9d:2b:2b"],"mac-cnt":1,"packets":1,"port":49422},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcRIR":"AFRINIC","srcTTL":[121],"srcTTLCnt":1,"tags":["contabo-sponge-01-ts","honeypot","sensor:contabo-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":1,"dstZero":0,"ece":1,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":4166961922},"totDataBytes":0} +{"@timestamp":1787398665343,"_id":"260822-X4lAnsiXnS5L_YEGUQOWQe2R","_index":"arkime_sessions3-260822","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Kaopu Cloud HK Limited"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Lightnode Limited"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":0,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":0,"port":24011},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[77797],"firstPacket":1787397977177,"ipProtocol":6,"lastPacket":1787397978193,"length":1016,"network":{"bytes":132,"community_id":"1:57rsRhbsd8MgSCo4/zLOQNBRCCY=","packets":2},"node":"spark-afae","packetPos":[-77797,1919085,252049],"packetRange":{"gte":1787397977177,"lte":1787397978193},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":132,"geo":{"country_iso_code":"PH"},"ip":"154.90.37.55","mac":["fc:bd:67:9d:2b:2b"],"mac-cnt":1,"packets":2,"port":65528},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcRIR":"AFRINIC","srcTTL":[120],"srcTTLCnt":1,"tags":["contabo-sponge-01-ts","honeypot","sensor:contabo-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":918305215},"totDataBytes":0} +{"@timestamp":1787398665207,"_id":"260822-X4knW85YgYRGTYH5ARv4bU0j","_index":"arkime_sessions3-260822","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Kaopu Cloud HK Limited"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Lightnode Limited"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":0,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":0,"port":24010},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[77797],"firstPacket":1787397977158,"ipProtocol":6,"lastPacket":1787397977158,"length":0,"network":{"bytes":66,"community_id":"1:ljifRjMBa42O7jmqBjftrMfcRvA=","packets":1},"node":"spark-afae","packetPos":[-77797,1897079],"packetRange":{"gte":1787397977158,"lte":1787397977158},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":66,"geo":{"country_iso_code":"PH"},"ip":"154.90.37.55","mac":["fc:bd:67:9d:2b:2b"],"mac-cnt":1,"packets":1,"port":65253},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcRIR":"AFRINIC","srcTTL":[120],"srcTTLCnt":1,"tags":["contabo-sponge-01-ts","honeypot","sensor:contabo-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":1,"dstZero":0,"ece":1,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":519800436},"totDataBytes":0} +{"@timestamp":1787398665206,"_id":"260822-X4nQZIx5ahlJG6c9rSFDlxY_","_index":"arkime_sessions3-260822","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Kaopu Cloud HK Limited"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Lightnode Limited"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":0,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":0,"port":24009},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[77797],"firstPacket":1787397977146,"ipProtocol":6,"lastPacket":1787397977146,"length":0,"network":{"bytes":66,"community_id":"1:Uww6L25Vvf0iIGiJhb3II0qbxoE=","packets":1},"node":"spark-afae","packetPos":[-77797,1882411],"packetRange":{"gte":1787397977146,"lte":1787397977146},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":66,"geo":{"country_iso_code":"PH"},"ip":"154.90.37.55","mac":["fc:bd:67:9d:2b:2b"],"mac-cnt":1,"packets":1,"port":64987},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcRIR":"AFRINIC","srcTTL":[120],"srcTTLCnt":1,"tags":["contabo-sponge-01-ts","honeypot","sensor:contabo-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":1,"dstZero":0,"ece":1,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":2646449100},"totDataBytes":0} +{"@timestamp":1787299489035,"_id":"260821-6cvE9BYbzShI3I93qIx6Z3sH","_index":"arkime_sessions3-260821","client":{"bytes":4},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Kaopu Cloud HK Limited"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Lightnode Limited"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":331,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":4,"port":9025},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstPayload8":"485454502f312e31","dstRIR":"RIPE","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[77245],"firstPacket":1787298703705,"http":{"bodyMagic":["text/plain"],"bodyMagicCnt":1,"responseHeader":["content-type","connection"],"responseHeaderCnt":2,"responseHeaderField":["content-type","connection"],"responseHeaderValue":["text/plain; charset=utf-8","close"],"responseHeaderValueCnt":2,"serverVersion":["1.1"],"serverVersionCnt":1,"statuscode":[400],"statuscodeCnt":1},"initRTT":18,"ipProtocol":6,"lastPacket":1787298708729,"length":5024,"network":{"bytes":697,"community_id":"1:Ie2LUZdJsfzMqjOMqksg6UdOMI8=","packets":10},"node":"spark-afae","packetPos":[-77245,1552857,82,0,76,0,14314,76,173,70,76],"packetRange":{"gte":1787298703705,"lte":1787298708729},"protocol":["http","tcp"],"protocolCnt":2,"rootId":"260821-6cvE9BYbzShI3I93qIx6Z3sH","segmentCnt":1,"server":{"bytes":103},"source":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":366,"geo":{"country_iso_code":"PH"},"ip":"154.90.37.55","mac":["00:c0:1d:c0:ff:ee","fc:bd:67:9d:2b:2b"],"mac-cnt":2,"packets":6,"port":49439},"srcOui":["Arista Networks","Grand Junction Networks, Inc."],"srcOuiCnt":2,"srcPayload8":"05020002","srcRIR":"AFRINIC","srcTTL":[120],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":["Attempted Information Leak"],"categoryCnt":1,"flowId":["2185538806691242"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[2],"severityCnt":1,"signature":["5a66c944-faed-4791-9d94-b44b7bd48352"],"signatureCnt":1,"signatureId":[2000181],"signatureIdCnt":1},"tag":{"block":["false"],"blockCnt":1,"category":["recon"],"categoryCnt":1,"cves":[""],"cvesCnt":1,"description":["socks proxy protocol negotiation"],"intention":["suspicious"],"intentionCnt":1,"name":["socks proxy protocol negotiation"],"nameCnt":1},"tags":["sensor:contabo-sponge-01-ts","honeypot","contabo-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4ls":"67_64_2475171","ja4t":["64240_2-1-3-1-1-4_1460_8"],"ja4tCnt":1,"ja4ts":["64240_2-1-1-4-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":2,"ae":0,"cwr":1,"dstZero":0,"ece":2,"fin":2,"psh":2,"rst":2,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":2362182561},"totDataBytes":107} +{"@timestamp":1787299489000,"_id":"260821-6cv6JD4vXF9LiIoSpKOoVAua","_index":"arkime_sessions3-260821","client":{"bytes":4},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Kaopu Cloud HK Limited"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Lightnode Limited"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":331,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":4,"port":2135},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstPayload8":"485454502f312e31","dstRIR":"RIPE","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[77245],"firstPacket":1787298371502,"http":{"bodyMagic":["text/plain"],"bodyMagicCnt":1,"responseHeader":["content-type","connection"],"responseHeaderCnt":2,"responseHeaderField":["content-type","connection"],"responseHeaderValue":["text/plain; charset=utf-8","close"],"responseHeaderValueCnt":2,"serverVersion":["1.1"],"serverVersionCnt":1,"statuscode":[400],"statuscodeCnt":1},"initRTT":16,"ipProtocol":6,"lastPacket":1787298376529,"length":5027,"network":{"bytes":697,"community_id":"1:bqcna2qyFaPEEndWic7vSIdekYM=","packets":10},"node":"spark-afae","packetPos":[-77245,55475,82,337,76,0,16131,76,173,70,76],"packetRange":{"gte":1787298371502,"lte":1787298376529},"protocol":["http","tcp"],"protocolCnt":2,"rootId":"260821-6cv6JD4vXF9LiIoSpKOoVAua","segmentCnt":1,"server":{"bytes":103},"source":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":366,"geo":{"country_iso_code":"PH"},"ip":"154.90.37.55","mac":["00:c0:1d:c0:ff:ee","fc:bd:67:9d:2b:2b"],"mac-cnt":2,"packets":6,"port":50649},"srcOui":["Arista Networks","Grand Junction Networks, Inc."],"srcOuiCnt":2,"srcPayload8":"05020002","srcRIR":"AFRINIC","srcTTL":[121],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":["Attempted Information Leak"],"categoryCnt":1,"flowId":["1031945960960602"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[2],"severityCnt":1,"signature":["5a66c944-faed-4791-9d94-b44b7bd48352"],"signatureCnt":1,"signatureId":[2000181],"signatureIdCnt":1},"tags":["sensor:contabo-sponge-01-ts","honeypot","contabo-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4ls":"94_64_2479472","ja4t":["64240_2-1-3-1-1-4_1460_8"],"ja4tCnt":1,"ja4ts":["64240_2-1-1-4-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":2,"ae":0,"cwr":1,"dstZero":0,"ece":2,"fin":2,"psh":2,"rst":2,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":177164305},"totDataBytes":107} +{"@timestamp":1787295282368,"_id":"260821-W8tFHV_19yxORrQJlkPfP1Dz","_index":"arkime_sessions3-260821","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Kaopu Cloud HK Limited"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Lightnode Limited"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":0,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":0,"port":8868},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[77221],"firstPacket":1787294686198,"ipProtocol":6,"lastPacket":1787294687188,"length":990,"network":{"bytes":132,"community_id":"1:IA7BHmZO+VVOCtjN2Xnk6H1MCwE=","packets":2},"node":"spark-afae","packetPos":[-77221,3186883,208514],"packetRange":{"gte":1787294686198,"lte":1787294687188},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":132,"geo":{"country_iso_code":"PH"},"ip":"154.90.37.55","mac":["fc:bd:67:9d:2b:2b"],"mac-cnt":1,"packets":2,"port":50672},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcRIR":"AFRINIC","srcTTL":[120],"srcTTLCnt":1,"tags":["sensor:contabo-sponge-01-ts","honeypot","contabo-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":1945144188},"totDataBytes":0} +{"@timestamp":1787295282350,"_id":"260821-W8vUeTKqR3FMTLbvxHOEmx0P","_index":"arkime_sessions3-260821","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Kaopu Cloud HK Limited"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Lightnode Limited"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":0,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":0,"port":8867},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[77221],"firstPacket":1787294686174,"ipProtocol":6,"lastPacket":1787294686174,"length":0,"network":{"bytes":66,"community_id":"1:P+mZnm96l90ULzRD8X5izUsffRg=","packets":1},"node":"spark-afae","packetPos":[-77221,3180907],"packetRange":{"gte":1787294686174,"lte":1787294686174},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":66,"geo":{"country_iso_code":"PH"},"ip":"154.90.37.55","mac":["fc:bd:67:9d:2b:2b"],"mac-cnt":1,"packets":1,"port":50410},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcRIR":"AFRINIC","srcTTL":[120],"srcTTLCnt":1,"tags":["sensor:contabo-sponge-01-ts","honeypot","contabo-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":1,"dstZero":0,"ece":1,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":710168394},"totDataBytes":0} +{"@timestamp":1787295282314,"_id":"260821-W8uVsS0ldmxEq6vYepNhIqey","_index":"arkime_sessions3-260821","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Kaopu Cloud HK Limited"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Lightnode Limited"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":120,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":2,"port":8866},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[77221],"firstPacket":1787294686168,"initRTT":16,"ipProtocol":6,"lastPacket":1787294686236,"length":68,"network":{"bytes":366,"community_id":"1:jeVFkz3ykCaFeUe0+GHp1v2Jq1Q=","packets":6},"node":"spark-afae","packetPos":[-77221,3172913,480,19674,316,228,13406],"packetRange":{"gte":1787294686168,"lte":1787294686236},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":246,"geo":{"country_iso_code":"PH"},"ip":"154.90.37.55","mac":["fc:bd:67:9d:2b:2b","00:c0:1d:c0:ff:ee"],"mac-cnt":2,"packets":4,"port":50144},"srcOui":["Arista Networks","Grand Junction Networks, Inc."],"srcOuiCnt":2,"srcRIR":"AFRINIC","srcTTL":[121],"srcTTLCnt":1,"tags":["sensor:contabo-sponge-01-ts","honeypot","contabo-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-1-3-1-1-4_1460_8"],"ja4tCnt":1,"ja4ts":["64240_2-1-1-4-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":2,"ae":0,"cwr":1,"dstZero":0,"ece":2,"fin":2,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":3125454625},"totDataBytes":0} +{"@timestamp":1787295282329,"_id":"260821-W8sSPyO4QuZC1IuUUmwSS0jq","_index":"arkime_sessions3-260821","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Kaopu Cloud HK Limited"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Lightnode Limited"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":0,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":0,"port":8865},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[77221],"firstPacket":1787294686145,"ipProtocol":6,"lastPacket":1787294687157,"length":1012,"network":{"bytes":132,"community_id":"1:5yWbtuhunbIhjz5+erasnVvumQE=","packets":2},"node":"spark-afae","packetPos":[-77221,3166129,226891],"packetRange":{"gte":1787294686145,"lte":1787294687157},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":132,"geo":{"country_iso_code":"PH"},"ip":"154.90.37.55","mac":["fc:bd:67:9d:2b:2b"],"mac-cnt":1,"packets":2,"port":49881},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcRIR":"AFRINIC","srcTTL":[121],"srcTTLCnt":1,"tags":["sensor:contabo-sponge-01-ts","honeypot","contabo-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":3819536499},"totDataBytes":0} +{"@timestamp":1787295282333,"_id":"260821-W8udM2PdVztCiZT5T1ifZYdV","_index":"arkime_sessions3-260821","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Kaopu Cloud HK Limited"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Lightnode Limited"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":0,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":0,"port":8864},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[77221],"firstPacket":1787294686131,"ipProtocol":6,"lastPacket":1787294687149,"length":1018,"network":{"bytes":132,"community_id":"1:zi6Pte/EDSBL3rym13tO+lFjxFc=","packets":2},"node":"spark-afae","packetPos":[-77221,3158299,233093],"packetRange":{"gte":1787294686131,"lte":1787294687149},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":132,"geo":{"country_iso_code":"PH"},"ip":"154.90.37.55","mac":["fc:bd:67:9d:2b:2b"],"mac-cnt":1,"packets":2,"port":49602},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcRIR":"AFRINIC","srcTTL":[120],"srcTTLCnt":1,"tags":["sensor:contabo-sponge-01-ts","honeypot","contabo-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":707614983},"totDataBytes":0} +{"@timestamp":1787295282400,"_id":"260821-W8tsQjQGVclFrZ8dUDXyMmbo","_index":"arkime_sessions3-260821","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Kaopu Cloud HK Limited"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Lightnode Limited"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":0,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":0,"port":8863},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[77221],"firstPacket":1787294686111,"ipProtocol":6,"lastPacket":1787294686111,"length":0,"network":{"bytes":66,"community_id":"1:ucL0hJ+lM/fnjuaRQCKddo3AN+M=","packets":1},"node":"spark-afae","packetPos":[-77221,3144649],"packetRange":{"gte":1787294686111,"lte":1787294686111},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":66,"geo":{"country_iso_code":"PH"},"ip":"154.90.37.55","mac":["fc:bd:67:9d:2b:2b"],"mac-cnt":1,"packets":1,"port":49335},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcRIR":"AFRINIC","srcTTL":[121],"srcTTLCnt":1,"tags":["sensor:contabo-sponge-01-ts","honeypot","contabo-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":1,"dstZero":0,"ece":1,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":83758623},"totDataBytes":0} +{"@timestamp":1787295282391,"_id":"260821-W8uXpUpbF4FEn6Z2-BRBDN9T","_index":"arkime_sessions3-260821","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Kaopu Cloud HK Limited"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Lightnode Limited"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":0,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":0,"port":8862},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[77221],"firstPacket":1787294686088,"ipProtocol":6,"lastPacket":1787294686088,"length":0,"network":{"bytes":66,"community_id":"1:wldU4BO25vKRSXe8V7CH2ggTiZU=","packets":1},"node":"spark-afae","packetPos":[-77221,3131463],"packetRange":{"gte":1787294686088,"lte":1787294686088},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":66,"geo":{"country_iso_code":"PH"},"ip":"154.90.37.55","mac":["fc:bd:67:9d:2b:2b"],"mac-cnt":1,"packets":1,"port":65454},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcRIR":"AFRINIC","srcTTL":[121],"srcTTLCnt":1,"tags":["sensor:contabo-sponge-01-ts","honeypot","contabo-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":1,"dstZero":0,"ece":1,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":2326875972},"totDataBytes":0} +{"@timestamp":1787295282342,"_id":"260821-W8tNXuTfZIBAJ5LGeLskt4ms","_index":"arkime_sessions3-260821","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Kaopu Cloud HK Limited"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Lightnode Limited"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":0,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":0,"port":8861},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[77221],"firstPacket":1787294686078,"ipProtocol":6,"lastPacket":1787294686078,"length":0,"network":{"bytes":66,"community_id":"1:px3mT4LvJV35xQysImb4FwuKB3s=","packets":1},"node":"spark-afae","packetPos":[-77221,3125967],"packetRange":{"gte":1787294686078,"lte":1787294686078},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":66,"geo":{"country_iso_code":"PH"},"ip":"154.90.37.55","mac":["fc:bd:67:9d:2b:2b"],"mac-cnt":1,"packets":1,"port":65194},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcRIR":"AFRINIC","srcTTL":[120],"srcTTLCnt":1,"tags":["sensor:contabo-sponge-01-ts","honeypot","contabo-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":1,"dstZero":0,"ece":1,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":3479844389},"totDataBytes":0} +{"@timestamp":1787295282351,"_id":"260821-W8vwZYZSKxZNK7F35cLBm2-O","_index":"arkime_sessions3-260821","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Kaopu Cloud HK Limited"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Lightnode Limited"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":0,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":0,"port":8860},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[77221],"firstPacket":1787294686066,"ipProtocol":6,"lastPacket":1787294687074,"length":1008,"network":{"bytes":132,"community_id":"1:TkM92ZmWl9JP/rLrBYaeqdalauQ=","packets":2},"node":"spark-afae","packetPos":[-77221,3112747,270465],"packetRange":{"gte":1787294686066,"lte":1787294687074},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":132,"geo":{"country_iso_code":"PH"},"ip":"154.90.37.55","mac":["fc:bd:67:9d:2b:2b"],"mac-cnt":1,"packets":2,"port":64933},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcRIR":"AFRINIC","srcTTL":[121],"srcTTLCnt":1,"tags":["sensor:contabo-sponge-01-ts","honeypot","contabo-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":3894118945},"totDataBytes":0} +{"@timestamp":1787295282356,"_id":"260821-W8vzhVbrZn1Gia36Ar-iS1m9","_index":"arkime_sessions3-260821","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Kaopu Cloud HK Limited"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Lightnode Limited"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":0,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":0,"port":8859},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[77221],"firstPacket":1787294686053,"ipProtocol":6,"lastPacket":1787294686053,"length":0,"network":{"bytes":66,"community_id":"1:oiwlxAjPyIWZhAlTFZNNTGEIV9s=","packets":1},"node":"spark-afae","packetPos":[-77221,3102425],"packetRange":{"gte":1787294686053,"lte":1787294686053},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":66,"geo":{"country_iso_code":"PH"},"ip":"154.90.37.55","mac":["fc:bd:67:9d:2b:2b"],"mac-cnt":1,"packets":1,"port":64669},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcRIR":"AFRINIC","srcTTL":[120],"srcTTLCnt":1,"tags":["sensor:contabo-sponge-01-ts","honeypot","contabo-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":1,"dstZero":0,"ece":1,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":1532565211},"totDataBytes":0} +{"@timestamp":1787295282365,"_id":"260821-W8uPwTa2z25FR6A3L7Tfa7lP","_index":"arkime_sessions3-260821","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Kaopu Cloud HK Limited"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Lightnode Limited"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":0,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":0,"port":8858},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[77221],"firstPacket":1787294686039,"ipProtocol":6,"lastPacket":1787294687048,"length":1009,"network":{"bytes":132,"community_id":"1:CSKRqG5c/+KM25J7zkuGephZFzM=","packets":2},"node":"spark-afae","packetPos":[-77221,3093161,284010],"packetRange":{"gte":1787294686039,"lte":1787294687048},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":132,"geo":{"country_iso_code":"PH"},"ip":"154.90.37.55","mac":["fc:bd:67:9d:2b:2b"],"mac-cnt":1,"packets":2,"port":64406},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcRIR":"AFRINIC","srcTTL":[120],"srcTTLCnt":1,"tags":["sensor:contabo-sponge-01-ts","honeypot","contabo-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":3504527314},"totDataBytes":0} +{"@timestamp":1787295282317,"_id":"260821-W8vTDr3R_h9EkqmIh5fMBWyu","_index":"arkime_sessions3-260821","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Kaopu Cloud HK Limited"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Lightnode Limited"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":0,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":0,"port":8857},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[77221],"firstPacket":1787294686023,"ipProtocol":6,"lastPacket":1787294686023,"length":0,"network":{"bytes":66,"community_id":"1:jf+L6uus9e240DsOR4JY6DQ1NHM=","packets":1},"node":"spark-afae","packetPos":[-77221,3077953],"packetRange":{"gte":1787294686023,"lte":1787294686023},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":66,"geo":{"country_iso_code":"PH"},"ip":"154.90.37.55","mac":["fc:bd:67:9d:2b:2b"],"mac-cnt":1,"packets":1,"port":64143},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcRIR":"AFRINIC","srcTTL":[120],"srcTTLCnt":1,"tags":["sensor:contabo-sponge-01-ts","honeypot","contabo-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":1,"dstZero":0,"ece":1,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":3736444422},"totDataBytes":0} +{"@timestamp":1787295282393,"_id":"260821-W8u98abx81xIWoVcChQR2N5v","_index":"arkime_sessions3-260821","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Kaopu Cloud HK Limited"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Lightnode Limited"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":0,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":0,"port":8856},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[77221],"firstPacket":1787294686015,"ipProtocol":6,"lastPacket":1787294687015,"length":1000,"network":{"bytes":132,"community_id":"1:obOc3V7pcOuhShBPYFKaJ4TOgbQ=","packets":2},"node":"spark-afae","packetPos":[-77221,3069767,304488],"packetRange":{"gte":1787294686015,"lte":1787294687015},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":132,"geo":{"country_iso_code":"PH"},"ip":"154.90.37.55","mac":["fc:bd:67:9d:2b:2b"],"mac-cnt":1,"packets":2,"port":63873},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcRIR":"AFRINIC","srcTTL":[120],"srcTTLCnt":1,"tags":["sensor:contabo-sponge-01-ts","honeypot","contabo-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":3472757763},"totDataBytes":0} +{"@timestamp":1787295282332,"_id":"260821-W8t_wXLpQQxNy7_ZoNnQNu3y","_index":"arkime_sessions3-260821","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Kaopu Cloud HK Limited"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Lightnode Limited"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":0,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":0,"port":8855},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[77221],"firstPacket":1787294685997,"ipProtocol":6,"lastPacket":1787294687005,"length":1008,"network":{"bytes":132,"community_id":"1:fa8+MxZUu6YaRY+NvDY/HBLEgrA=","packets":2},"node":"spark-afae","packetPos":[-77221,3056525,314390],"packetRange":{"gte":1787294685997,"lte":1787294687005},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":132,"geo":{"country_iso_code":"PH"},"ip":"154.90.37.55","mac":["fc:bd:67:9d:2b:2b"],"mac-cnt":1,"packets":2,"port":63606},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcRIR":"AFRINIC","srcTTL":[121],"srcTTLCnt":1,"tags":["sensor:contabo-sponge-01-ts","honeypot","contabo-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":1290248661},"totDataBytes":0} +{"@timestamp":1787295282382,"_id":"260821-W8s1Ir25kIVBKKM0nNKz8JDf","_index":"arkime_sessions3-260821","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Kaopu Cloud HK Limited"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Lightnode Limited"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":0,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":0,"port":8854},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[77221],"firstPacket":1787294685988,"ipProtocol":6,"lastPacket":1787294686996,"length":1008,"network":{"bytes":132,"community_id":"1:rfW5CCxW+gW4d1XgX0Q5BXxIAzE=","packets":2},"node":"spark-afae","packetPos":[-77221,3042493,326712],"packetRange":{"gte":1787294685988,"lte":1787294686996},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":132,"geo":{"country_iso_code":"PH"},"ip":"154.90.37.55","mac":["fc:bd:67:9d:2b:2b"],"mac-cnt":1,"packets":2,"port":63333},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcRIR":"AFRINIC","srcTTL":[121],"srcTTLCnt":1,"tags":["sensor:contabo-sponge-01-ts","honeypot","contabo-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":3577240244},"totDataBytes":0} +{"@timestamp":1787295282342,"_id":"260821-W8tlKAjZi1ZOMK9_R5sZ46-Z","_index":"arkime_sessions3-260821","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Kaopu Cloud HK Limited"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Lightnode Limited"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":0,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":0,"port":8853},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[77221],"firstPacket":1787294685977,"ipProtocol":6,"lastPacket":1787294685977,"length":0,"network":{"bytes":66,"community_id":"1:sGO6AOSy+AR2qPMUh38BM7cqtKk=","packets":1},"node":"spark-afae","packetPos":[-77221,3027665],"packetRange":{"gte":1787294685977,"lte":1787294685977},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":66,"geo":{"country_iso_code":"PH"},"ip":"154.90.37.55","mac":["fc:bd:67:9d:2b:2b"],"mac-cnt":1,"packets":1,"port":63076},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcRIR":"AFRINIC","srcTTL":[121],"srcTTLCnt":1,"tags":["sensor:contabo-sponge-01-ts","honeypot","contabo-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":1,"dstZero":0,"ece":1,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":1716716909},"totDataBytes":0} +{"@timestamp":1787295282319,"_id":"260821-W8vaOlFYuDRAMLGFXWZvr2Lf","_index":"arkime_sessions3-260821","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Kaopu Cloud HK Limited"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Lightnode Limited"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":0,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":0,"port":8852},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[77221],"firstPacket":1787294685957,"ipProtocol":6,"lastPacket":1787294685957,"length":0,"network":{"bytes":66,"community_id":"1:MXy/dbcibLbyUeI5vzg7GVQPBSw=","packets":1},"node":"spark-afae","packetPos":[-77221,2997723],"packetRange":{"gte":1787294685957,"lte":1787294685957},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":66,"geo":{"country_iso_code":"PH"},"ip":"154.90.37.55","mac":["fc:bd:67:9d:2b:2b"],"mac-cnt":1,"packets":1,"port":62811},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcRIR":"AFRINIC","srcTTL":[120],"srcTTLCnt":1,"tags":["sensor:contabo-sponge-01-ts","honeypot","contabo-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":1,"dstZero":0,"ece":1,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":1130549068},"totDataBytes":0} +{"@timestamp":1787295282380,"_id":"260821-W8vWj0OWvAdCKodim-xIDEs-","_index":"arkime_sessions3-260821","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Kaopu Cloud HK Limited"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Lightnode Limited"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":0,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":0,"port":8851},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[77221],"firstPacket":1787294685932,"ipProtocol":6,"lastPacket":1787294685932,"length":0,"network":{"bytes":66,"community_id":"1:4gwZivz/LHzmbk9VCGAUNJbVidI=","packets":1},"node":"spark-afae","packetPos":[-77221,2957463],"packetRange":{"gte":1787294685932,"lte":1787294685932},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":66,"geo":{"country_iso_code":"PH"},"ip":"154.90.37.55","mac":["fc:bd:67:9d:2b:2b"],"mac-cnt":1,"packets":1,"port":62548},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcRIR":"AFRINIC","srcTTL":[121],"srcTTLCnt":1,"tags":["sensor:contabo-sponge-01-ts","honeypot","contabo-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":1,"dstZero":0,"ece":1,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":1856043160},"totDataBytes":0} +{"@timestamp":1787295282388,"_id":"260821-W8vJQRYUtDdNZ50cUcIktMaV","_index":"arkime_sessions3-260821","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Kaopu Cloud HK Limited"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Lightnode Limited"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":0,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":0,"port":8850},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[77221],"firstPacket":1787294685919,"ipProtocol":6,"lastPacket":1787294686925,"length":1006,"network":{"bytes":132,"community_id":"1:iE95t1gYhLvBo7cBrCUoLv2959o=","packets":2},"node":"spark-afae","packetPos":[-77221,2940327,415984],"packetRange":{"gte":1787294685919,"lte":1787294686925},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":132,"geo":{"country_iso_code":"PH"},"ip":"154.90.37.55","mac":["fc:bd:67:9d:2b:2b"],"mac-cnt":1,"packets":2,"port":62284},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcRIR":"AFRINIC","srcTTL":[121],"srcTTLCnt":1,"tags":["sensor:contabo-sponge-01-ts","honeypot","contabo-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":2266514894},"totDataBytes":0} +{"@timestamp":1787295282329,"_id":"260821-W8uWRH0RRaZFW7V38Hsowg-Z","_index":"arkime_sessions3-260821","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Kaopu Cloud HK Limited"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Lightnode Limited"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":0,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":0,"port":8849},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[77221],"firstPacket":1787294685897,"ipProtocol":6,"lastPacket":1787294685897,"length":0,"network":{"bytes":66,"community_id":"1:u9Qm1TRQrdHzwzFA//dZOWKtY30=","packets":1},"node":"spark-afae","packetPos":[-77221,2914653],"packetRange":{"gte":1787294685897,"lte":1787294685897},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":66,"geo":{"country_iso_code":"PH"},"ip":"154.90.37.55","mac":["fc:bd:67:9d:2b:2b"],"mac-cnt":1,"packets":1,"port":62017},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcRIR":"AFRINIC","srcTTL":[121],"srcTTLCnt":1,"tags":["sensor:contabo-sponge-01-ts","honeypot","contabo-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":1,"dstZero":0,"ece":1,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":2003973733},"totDataBytes":0} +{"@timestamp":1787295282354,"_id":"260821-W8vTga9--79Ch5HXWEuf5N6M","_index":"arkime_sessions3-260821","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Kaopu Cloud HK Limited"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Lightnode Limited"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":0,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":0,"port":8848},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[77221],"firstPacket":1787294685887,"ipProtocol":6,"lastPacket":1787294686890,"length":1003,"network":{"bytes":132,"community_id":"1:H10iVoOJuAsVrH7lb2y0LVi9JWc=","packets":2},"node":"spark-afae","packetPos":[-77221,2890021,458354],"packetRange":{"gte":1787294685887,"lte":1787294686890},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":132,"geo":{"country_iso_code":"PH"},"ip":"154.90.37.55","mac":["fc:bd:67:9d:2b:2b"],"mac-cnt":1,"packets":2,"port":61751},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcRIR":"AFRINIC","srcTTL":[121],"srcTTLCnt":1,"tags":["sensor:contabo-sponge-01-ts","honeypot","contabo-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":3367511455},"totDataBytes":0} +{"@timestamp":1787295282356,"_id":"260821-W8toz655PGpCZ7RnlTw6_Fh8","_index":"arkime_sessions3-260821","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Kaopu Cloud HK Limited"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Lightnode Limited"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":0,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":0,"port":8847},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[77221],"firstPacket":1787294685883,"ipProtocol":6,"lastPacket":1787294686872,"length":989,"network":{"bytes":132,"community_id":"1:zbpHudVmiEBqwvWE+PCw7XOPJvs=","packets":2},"node":"spark-afae","packetPos":[-77221,2864049,479956],"packetRange":{"gte":1787294685883,"lte":1787294686872},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":132,"geo":{"country_iso_code":"PH"},"ip":"154.90.37.55","mac":["fc:bd:67:9d:2b:2b"],"mac-cnt":1,"packets":2,"port":61484},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcRIR":"AFRINIC","srcTTL":[121],"srcTTLCnt":1,"tags":["sensor:contabo-sponge-01-ts","honeypot","contabo-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":1245753742},"totDataBytes":0} +{"@timestamp":1787295282331,"_id":"260821-W8sziO3rAHZBwoZd2MAMwoAK","_index":"arkime_sessions3-260821","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Kaopu Cloud HK Limited"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Lightnode Limited"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":0,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":0,"port":8846},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[77221],"firstPacket":1787294685855,"ipProtocol":6,"lastPacket":1787294685855,"length":0,"network":{"bytes":66,"community_id":"1:xoBVpByDwDE/zOxZGZ1Y9utCcRk=","packets":1},"node":"spark-afae","packetPos":[-77221,2838141],"packetRange":{"gte":1787294685855,"lte":1787294685855},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":66,"geo":{"country_iso_code":"PH"},"ip":"154.90.37.55","mac":["fc:bd:67:9d:2b:2b"],"mac-cnt":1,"packets":1,"port":61219},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcRIR":"AFRINIC","srcTTL":[121],"srcTTLCnt":1,"tags":["sensor:contabo-sponge-01-ts","honeypot","contabo-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":1,"dstZero":0,"ece":1,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":176276568},"totDataBytes":0} +{"@timestamp":1785185629328,"_id":"260727-kjipZuEuiL9Bk5E9TrMcQCe9","_index":"arkime_sessions3-260727","client":{"bytes":9},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Kaopu Cloud HK Limited"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Lightnode Limited"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":331,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":4,"port":123},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstPayload8":"485454502f312e31","dstRIR":"RIPE","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[65530],"firstPacket":1785184326416,"http":{"bodyMagic":["text/plain"],"bodyMagicCnt":1,"responseHeader":["connection","content-type"],"responseHeaderCnt":2,"responseHeaderField":["content-type","connection"],"responseHeaderValue":["text/plain; charset=utf-8","close"],"responseHeaderValueCnt":2,"serverVersion":["1.1"],"serverVersionCnt":1,"statuscode":[400],"statuscodeCnt":1},"initRTT":21,"ipProtocol":6,"lastPacket":1785184331448,"length":5032,"network":{"bytes":700,"community_id":"1:GVbm0WqZD2jXczgeTDk1k/AjKUI=","packets":10},"node":"spark-afae","packetPos":[-65530,399560,82,246,76,79,19039,76,173,866,76],"packetRange":{"gte":1785184326416,"lte":1785184331448},"protocol":["http","tcp"],"protocolCnt":2,"rootId":"260727-kjipZuEuiL9Bk5E9TrMcQCe9","segmentCnt":1,"server":{"bytes":103},"source":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":369,"geo":{"country_iso_code":"PH"},"ip":"154.90.37.55","mac":["fc:bd:67:9d:2b:2b","00:c0:1d:c0:ff:ee"],"mac-cnt":2,"packets":6,"port":51533},"srcOui":["Arista Networks","Grand Junction Networks, Inc."],"srcOuiCnt":2,"srcPayload8":"0401005001010101","srcRIR":"AFRINIC","srcTTL":[121],"srcTTLCnt":1,"tags":["contabo-sponge-01-ts","sensor:contabo-sponge-01-ts","honeypot"],"tagsCnt":3,"tcp":{"ja4ls":"77_64_2478366","ja4t":["64240_2-1-3-1-1-4_1460_8"],"ja4tCnt":1,"ja4ts":["64240_2-1-1-4-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":2,"ae":0,"cwr":1,"dstZero":0,"ece":2,"fin":2,"psh":2,"rst":2,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":639078340},"totDataBytes":112} +{"@timestamp":1784793925673,"_id":"260723-6Qerye6InqFDeoYEQ1ySwMp3","_index":"arkime_sessions3-260723","client":{"bytes":159},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Kaopu Cloud HK Limited"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Lightnode Limited"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":515,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":4,"port":591},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstPayload8":"485454502f312e31","dstRIR":"RIPE","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[63354],"firstPacket":1784793550837,"http":{"bodyMagic":["text/html"],"bodyMagicCnt":1,"clientVersion":["1.1"],"clientVersionCnt":1,"host":["www.google.com:443","www.google.com"],"hostCnt":2,"ja4h":["co11nn020000_818f42cc3fd7_000000000000_000000000000"],"ja4hCnt":1,"ja4h_r":["co11nn020000_Host,User-Agent__"],"ja4h_rCnt":1,"md5":["0f87454a3ea15f0db55ae928dbcd82fc"],"md5Cnt":1,"method":["CONNECT"],"method-CONNECT":1,"methodCnt":1,"path":["www.google.com:443"],"pathCnt":1,"requestHeader":["host","user-agent"],"requestHeaderCnt":2,"response-server":["Apache/2.4.41 (Ubuntu)"],"response-serverCnt":1,"response-x-powered-by":["PHP/7.4.3"],"response-x-powered-byCnt":1,"responseHeader":["connection","server","x-powered-by","content-type","content-length","date"],"responseHeaderCnt":6,"responseHeaderField":["connection","content-type","date","content-length"],"responseHeaderValue":["close","text/plain; charset=utf-8","thu, 23 jul 2026 07:59:10 gmt","94"],"responseHeaderValueCnt":4,"serverVersion":["1.1"],"serverVersionCnt":1,"sha256":["1ca624415b2889dbeb3f969890b848b7bc5eaf96ca5e8fdd7461f943b45d10cb"],"sha256Cnt":1,"statuscode":[200],"statuscodeCnt":1,"uri":["www.google.com:443"],"uriCnt":1,"useragent":["Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:145.0) Gecko/20100101 Firefox/145.0"],"useragentCnt":1},"initRTT":16,"ipProtocol":6,"lastPacket":1784793550906,"length":69,"network":{"bytes":974,"community_id":"1:nHmcKWVAuQsy+nJd0pRP4OKoVzY=","packets":9},"node":"spark-afae","packetPos":[-63354,10427900,82,0,76,229,70,357,70,76],"packetRange":{"gte":1784793550837,"lte":1784793550906},"protocol":["http","tcp"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":287},"source":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":459,"geo":{"country_iso_code":"PH"},"ip":"154.90.37.55","mac":["fc:bd:67:9d:2b:2b","00:c0:1d:c0:ff:ee"],"mac-cnt":2,"packets":5,"port":50402},"srcOui":["Arista Networks","Grand Junction Networks, Inc."],"srcOuiCnt":2,"srcPayload8":"434f4e4e45435420","srcRIR":"AFRINIC","srcTTL":[121],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["1908087464943045"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["869feaa1-dc77-4037-aee2-247b7a39cf7d","23e6932c-e2bd-48cf-80b8-aa98ae9276c4"],"signatureCnt":2,"signatureId":[1031486,1030991],"signatureIdCnt":2},"tag":{"block":["false","true"],"blockCnt":2,"category":["activity","protocol"],"categoryCnt":2,"description":["ip addresses with this tag have been seen crawling http(s) servers around the internet.","ip addresses with this tag have been observed crawling the internet for unauthenticated web proxies and testing if they are functional."],"intention":["malicious","unknown"],"intentionCnt":2,"name":["open proxy scanner","web crawler"],"nameCnt":2},"tags":["sensor:contabo-sponge-01-ts","contabo-sponge-01-ts","honeypot"],"tagsCnt":3,"tcp":{"ja4ls":"47_64_tcp","ja4t":["64240_2-1-3-1-1-4_1460_8"],"ja4tCnt":1,"ja4ts":["64240_2-1-1-4-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":3,"ae":0,"cwr":1,"dstZero":0,"ece":2,"fin":1,"psh":2,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":2097132136},"totDataBytes":446} +{"@timestamp":1784793925634,"_id":"260723-6QdimMeQvpJKcLpaH7RV9lYm","_index":"arkime_sessions3-260723","client":{"bytes":159},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Kaopu Cloud HK Limited"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Lightnode Limited"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":515,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":4,"port":222},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstPayload8":"485454502f312e31","dstRIR":"RIPE","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[63354],"firstPacket":1784792818465,"http":{"bodyMagic":["text/html"],"bodyMagicCnt":1,"clientVersion":["1.1"],"clientVersionCnt":1,"host":["www.google.com:443","www.google.com"],"hostCnt":2,"ja4h":["co11nn020000_818f42cc3fd7_000000000000_000000000000"],"ja4hCnt":1,"ja4h_r":["co11nn020000_Host,User-Agent__"],"ja4h_rCnt":1,"md5":["0f87454a3ea15f0db55ae928dbcd82fc"],"md5Cnt":1,"method":["CONNECT"],"method-CONNECT":1,"methodCnt":1,"path":["www.google.com:443"],"pathCnt":1,"requestHeader":["host","user-agent"],"requestHeaderCnt":2,"response-server":["Apache/2.4.41 (Ubuntu)"],"response-serverCnt":1,"response-x-powered-by":["PHP/7.4.3"],"response-x-powered-byCnt":1,"responseHeader":["connection","server","x-powered-by","content-type","content-length","date"],"responseHeaderCnt":6,"responseHeaderField":["connection","content-type","date","content-length"],"responseHeaderValue":["close","text/plain; charset=utf-8","thu, 23 jul 2026 07:46:58 gmt","94"],"responseHeaderValueCnt":4,"serverVersion":["1.1"],"serverVersionCnt":1,"sha256":["1ca624415b2889dbeb3f969890b848b7bc5eaf96ca5e8fdd7461f943b45d10cb"],"sha256Cnt":1,"statuscode":[200],"statuscodeCnt":1,"uri":["www.google.com:443"],"uriCnt":1,"useragent":["Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:145.0) Gecko/20100101 Firefox/145.0"],"useragentCnt":1},"initRTT":16,"ipProtocol":6,"lastPacket":1784792818534,"length":69,"network":{"bytes":974,"community_id":"1:XrRrGn/otH7cYhvl7YCeljQSHG0=","packets":9},"node":"spark-afae","packetPos":[-63354,746921,164,714,76,229,70,357,70,76],"packetRange":{"gte":1784792818465,"lte":1784792818534},"protocol":["http","tcp"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":287},"source":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":459,"geo":{"country_iso_code":"PH"},"ip":"154.90.37.55","mac":["fc:bd:67:9d:2b:2b","00:c0:1d:c0:ff:ee"],"mac-cnt":2,"packets":5,"port":50364},"srcOui":["Arista Networks","Grand Junction Networks, Inc."],"srcOuiCnt":2,"srcPayload8":"434f4e4e45435420","srcRIR":"AFRINIC","srcTTL":[120],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["591728373511023"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["869feaa1-dc77-4037-aee2-247b7a39cf7d","23e6932c-e2bd-48cf-80b8-aa98ae9276c4"],"signatureCnt":2,"signatureId":[1031486,1030991],"signatureIdCnt":2},"tag":{"block":["false","true"],"blockCnt":2,"category":["activity","protocol"],"categoryCnt":2,"description":["ip addresses with this tag have been seen crawling http(s) servers around the internet.","ip addresses with this tag have been observed crawling the internet for unauthenticated web proxies and testing if they are functional."],"intention":["malicious","unknown"],"intentionCnt":2,"name":["open proxy scanner","web crawler"],"nameCnt":2},"tags":["sensor:contabo-sponge-01-ts","contabo-sponge-01-ts","honeypot"],"tagsCnt":3,"tcp":{"ja4ls":"154_64_tcp","ja4t":["64240_2-1-3-1-1-4_1460_8"],"ja4tCnt":1,"ja4ts":["64240_2-1-1-4-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":3,"ae":0,"cwr":1,"dstZero":0,"ece":2,"fin":1,"psh":2,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":4217937109},"totDataBytes":446} +{"@timestamp":1784714152127,"_id":"260722-ePxaU5a5gldDDIwhk-50R1KN","_index":"arkime_sessions3-260722","client":{"bytes":4},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["Kaopu Cloud HK Limited"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["Lightnode Limited"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":331,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":4,"port":10087},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstPayload8":"485454502f312e31","dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[62909],"firstPacket":1784712875300,"http":{"bodyMagic":["text/plain"],"bodyMagicCnt":1,"responseHeader":["content-type","connection"],"responseHeaderCnt":2,"responseHeaderField":["content-type","connection"],"responseHeaderValue":["text/plain; charset=utf-8","close"],"responseHeaderValueCnt":2,"serverVersion":["1.1"],"serverVersionCnt":1,"statuscode":[400],"statuscodeCnt":1},"initRTT":92,"ipProtocol":6,"lastPacket":1784712880489,"length":5189,"network":{"bytes":671,"community_id":"1:RNDO+y8BaZzkQEX1D9bsBXLg2dw=","packets":10},"node":"spark-afae","packetPos":[-62909,112654,82,1082,70,74,7077,70,173,362,70],"packetRange":{"gte":1784712875300,"lte":1784712880489},"protocol":["http","tcp"],"protocolCnt":2,"rootId":"260722-ePxaU5a5gldDDIwhk-50R1KN","segmentCnt":1,"server":{"bytes":103},"source":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":340,"geo":{"country_iso_code":"PH"},"ip":"154.90.37.55","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":6,"port":53425},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcPayload8":"05020002","srcRIR":"AFRINIC","srcTTL":[113],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":["Attempted Information Leak"],"categoryCnt":1,"flowId":["1007713187855869"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[2],"severityCnt":1,"signature":["5a66c944-faed-4791-9d94-b44b7bd48352"],"signatureCnt":1,"signatureId":[2000181],"signatureIdCnt":1},"tags":["frantech-ts","sensor:frantech-ts","honeypot"],"tagsCnt":3,"tcp":{"ja4ls":"51_64_2409223","ja4t":["64240_2-1-3-1-1-4_1400_8"],"ja4tCnt":1,"ja4ts":["64240_2-1-1-4-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":2,"ae":0,"cwr":1,"dstZero":0,"ece":2,"fin":2,"psh":2,"rst":2,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":1352326926},"totDataBytes":107} diff --git a/kevlar/2026-08-31/sponge/ip-sessions/session_search_20260831T113640_9d421320.ndjson b/kevlar/2026-08-31/sponge/ip-sessions/session_search_20260831T113640_9d421320.ndjson new file mode 100644 index 0000000..4db24f1 --- /dev/null +++ b/kevlar/2026-08-31/sponge/ip-sessions/session_search_20260831T113640_9d421320.ndjson @@ -0,0 +1,100 @@ +{"@timestamp":1788170577237,"_id":"260831--z4qAe9iP1pMm6s0Ig8pvBDr","_index":"arkime_sessions3-260831","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Kaopu Cloud HK Limited"],"isp.dstCnt":1,"isp.src":["Proton66 OOO"],"isp.srcCnt":1,"org.dst":["LightNode-BH"],"org.dstCnt":1,"org.src":["Proton66 OOO"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["business"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":0,"geo":{"country_iso_code":"BH"},"ip":"38.54.2.209","mac":["52:54:8f:9d:76:48"],"mac-cnt":1,"packets":0,"port":6001},"dstRIR":"ARIN","ethertype":2048,"fileId":[82412],"firstPacket":1788170089640,"ipProtocol":6,"lastPacket":1788170098639,"length":8999,"network":{"bytes":194,"community_id":"1:xlsf6/xULuWzNCf0d4duBXlJTYI=","packets":3},"node":"spark-afae","packetPos":[-82412,199891,2476,3592],"packetRange":{"gte":1788170089640,"lte":1788170098639},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS198953 Proton66 OOO","number":198953,"organization":{"name":"Proton66 OOO"}},"bytes":194,"geo":{"country_iso_code":"RU"},"ip":"176.120.22.61","mac":["98:44:ce:60:15:19"],"mac-cnt":1,"packets":3,"port":63311},"spoofable":["true"],"spoofableCnt":1,"srcDscp":[8],"srcDscpCnt":1,"srcOui":["Huawei Technologies Co.,Ltd"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[117],"srcTTLCnt":1,"tags":["honeypot","sensor:bahrain-sponge-01-ts","bahrain-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["200_2-1-1-4_1460_00","200_2-1-3-1-1-4_1460_0"],"ja4tCnt":2},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":3,"syn-ack":0,"urg":0},"tcpseq":{"src":1032924479},"totDataBytes":0} +{"@timestamp":1788170577038,"_id":"260831--z5OdSSjJJ9M6795oxM3M-NC","_index":"arkime_sessions3-260831","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Kaopu Cloud HK Limited"],"isp.dstCnt":1,"isp.src":["Proton66 OOO"],"isp.srcCnt":1,"org.dst":["LightNode-BH"],"org.dstCnt":1,"org.src":["Proton66 OOO"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["business"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":0,"geo":{"country_iso_code":"BH"},"ip":"38.54.2.209","mac":["52:54:8f:9d:76:48"],"mac-cnt":1,"packets":0,"port":8989},"dstRIR":"ARIN","ethertype":2048,"fileId":[82412],"firstPacket":1788170089640,"ipProtocol":6,"lastPacket":1788170098639,"length":8999,"network":{"bytes":194,"community_id":"1:fxUipZZhHUCAeEe5NBVFlGVi5Q4=","packets":3},"node":"spark-afae","packetPos":[-82412,199973,2476,3432],"packetRange":{"gte":1788170089640,"lte":1788170098639},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS198953 Proton66 OOO","number":198953,"organization":{"name":"Proton66 OOO"}},"bytes":194,"geo":{"country_iso_code":"RU"},"ip":"176.120.22.61","mac":["98:44:ce:60:15:19"],"mac-cnt":1,"packets":3,"port":65383},"spoofable":["true"],"spoofableCnt":1,"srcDscp":[8],"srcDscpCnt":1,"srcOui":["Huawei Technologies Co.,Ltd"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[117],"srcTTLCnt":1,"tags":["honeypot","sensor:bahrain-sponge-01-ts","bahrain-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["200_2-1-1-4_1460_00","200_2-1-3-1-1-4_1460_0"],"ja4tCnt":2},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":3,"syn-ack":0,"urg":0},"tcpseq":{"src":682712236},"totDataBytes":0} +{"@timestamp":1788170577237,"_id":"260831--z7wZg8N_UNCxbl726_eyyHw","_index":"arkime_sessions3-260831","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Kaopu Cloud HK Limited"],"isp.dstCnt":1,"isp.src":["Proton66 OOO"],"isp.srcCnt":1,"org.dst":["LightNode-BH"],"org.dstCnt":1,"org.src":["Proton66 OOO"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["business"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":0,"geo":{"country_iso_code":"BH"},"ip":"38.54.2.209","mac":["52:54:8f:9d:76:48"],"mac-cnt":1,"packets":0,"port":4443},"dstRIR":"ARIN","ethertype":2048,"fileId":[82412],"firstPacket":1788170089636,"ipProtocol":6,"lastPacket":1788170098653,"length":9017,"network":{"bytes":194,"community_id":"1:+m1XEWtF1ginaffVGNM27q7XvDA=","packets":3},"node":"spark-afae","packetPos":[-82412,199809,2722,3506],"packetRange":{"gte":1788170089636,"lte":1788170098653},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS198953 Proton66 OOO","number":198953,"organization":{"name":"Proton66 OOO"}},"bytes":194,"geo":{"country_iso_code":"RU"},"ip":"176.120.22.61","mac":["98:44:ce:60:15:19"],"mac-cnt":1,"packets":3,"port":64696},"spoofable":["true"],"spoofableCnt":1,"srcDscp":[8],"srcDscpCnt":1,"srcOui":["Huawei Technologies Co.,Ltd"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[117],"srcTTLCnt":1,"tags":["honeypot","sensor:bahrain-sponge-01-ts","bahrain-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["200_2-1-1-4_1460_00","200_2-1-3-1-1-4_1460_0"],"ja4tCnt":2},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":3,"syn-ack":0,"urg":0},"tcpseq":{"src":918658525},"totDataBytes":0} +{"@timestamp":1788170577037,"_id":"260831--z5wCHCoLftJML5g58nVVbAy","_index":"arkime_sessions3-260831","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Kaopu Cloud HK Limited"],"isp.dstCnt":1,"isp.src":["Proton66 OOO"],"isp.srcCnt":1,"org.dst":["LightNode-BH"],"org.dstCnt":1,"org.src":["Proton66 OOO"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["business"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":0,"geo":{"country_iso_code":"BH"},"ip":"38.54.2.209","mac":["52:54:8f:9d:76:48"],"mac-cnt":1,"packets":0,"port":443},"dstRIR":"ARIN","ethertype":2048,"fileId":[82412],"firstPacket":1788170089634,"ipProtocol":6,"lastPacket":1788170098619,"length":8985,"network":{"bytes":194,"community_id":"1:hj30LPlPi1NUBMWDNVjQXI6IRGE=","packets":3},"node":"spark-afae","packetPos":[-82412,199727,2394,3526],"packetRange":{"gte":1788170089634,"lte":1788170098619},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS198953 Proton66 OOO","number":198953,"organization":{"name":"Proton66 OOO"}},"bytes":194,"geo":{"country_iso_code":"RU"},"ip":"176.120.22.61","mac":["98:44:ce:60:15:19"],"mac-cnt":1,"packets":3,"port":62804},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Huawei Technologies Co.,Ltd"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[117],"srcTTLCnt":1,"tags":["honeypot","sensor:bahrain-sponge-01-ts","bahrain-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["200_2-1-1-4_1460_00","200_2-1-3-1-1-4_1460_0"],"ja4tCnt":2},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":3,"syn-ack":0,"urg":0},"tcpseq":{"src":3243181880},"totDataBytes":0} +{"@timestamp":1788170577037,"_id":"260831--z7p8pu1LshIZalShh9v5JOp","_index":"arkime_sessions3-260831","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Kaopu Cloud HK Limited"],"isp.dstCnt":1,"isp.src":["Proton66 OOO"],"isp.srcCnt":1,"org.dst":["LightNode-BH"],"org.dstCnt":1,"org.src":["Proton66 OOO"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["business"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":0,"geo":{"country_iso_code":"BH"},"ip":"38.54.2.209","mac":["52:54:8f:9d:76:48"],"mac-cnt":1,"packets":0,"port":1501},"dstRIR":"ARIN","ethertype":2048,"fileId":[82412],"firstPacket":1788170089632,"ipProtocol":6,"lastPacket":1788170098621,"length":8989,"network":{"bytes":194,"community_id":"1:OnrKR0kfRQxEenL7tVHBJ+Rd3gY=","packets":3},"node":"spark-afae","packetPos":[-82412,199645,2558,3522],"packetRange":{"gte":1788170089632,"lte":1788170098621},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS198953 Proton66 OOO","number":198953,"organization":{"name":"Proton66 OOO"}},"bytes":194,"geo":{"country_iso_code":"RU"},"ip":"176.120.22.61","mac":["98:44:ce:60:15:19"],"mac-cnt":1,"packets":3,"port":62783},"spoofable":["true"],"spoofableCnt":1,"srcDscp":[8],"srcDscpCnt":1,"srcOui":["Huawei Technologies Co.,Ltd"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[117],"srcTTLCnt":1,"tags":["honeypot","sensor:bahrain-sponge-01-ts","bahrain-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["200_2-1-1-4_1460_00","200_2-1-3-1-1-4_1460_0"],"ja4tCnt":2},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":3,"syn-ack":0,"urg":0},"tcpseq":{"src":2514283198},"totDataBytes":0} +{"@timestamp":1788170577038,"_id":"260831--z6PPili84VGSpjbZ4DMtwKg","_index":"arkime_sessions3-260831","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Kaopu Cloud HK Limited"],"isp.dstCnt":1,"isp.src":["Proton66 OOO"],"isp.srcCnt":1,"org.dst":["LightNode-BH"],"org.dstCnt":1,"org.src":["Proton66 OOO"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["business"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":0,"geo":{"country_iso_code":"BH"},"ip":"38.54.2.209","mac":["52:54:8f:9d:76:48"],"mac-cnt":1,"packets":0,"port":11443},"dstRIR":"ARIN","ethertype":2048,"fileId":[82412],"firstPacket":1788170089628,"ipProtocol":6,"lastPacket":1788170098619,"length":8991,"network":{"bytes":194,"community_id":"1:deJPN7QOBrl2ZuR4Zee7GE7C4j8=","packets":3},"node":"spark-afae","packetPos":[-82412,199563,2476,3530],"packetRange":{"gte":1788170089628,"lte":1788170098619},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS198953 Proton66 OOO","number":198953,"organization":{"name":"Proton66 OOO"}},"bytes":194,"geo":{"country_iso_code":"RU"},"ip":"176.120.22.61","mac":["98:44:ce:60:15:19"],"mac-cnt":1,"packets":3,"port":64685},"spoofable":["true"],"spoofableCnt":1,"srcDscp":[8],"srcDscpCnt":1,"srcOui":["Huawei Technologies Co.,Ltd"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[117],"srcTTLCnt":1,"tags":["honeypot","sensor:bahrain-sponge-01-ts","bahrain-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["200_2-1-1-4_1460_00","200_2-1-3-1-1-4_1460_0"],"ja4tCnt":2},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":3,"syn-ack":0,"urg":0},"tcpseq":{"src":4154981265},"totDataBytes":0} +{"@timestamp":1788170577038,"_id":"260831--z5bsMc0OiNFeYb31gZ4_jLC","_index":"arkime_sessions3-260831","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Kaopu Cloud HK Limited"],"isp.dstCnt":1,"isp.src":["Proton66 OOO"],"isp.srcCnt":1,"org.dst":["LightNode-BH"],"org.dstCnt":1,"org.src":["Proton66 OOO"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["business"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":0,"geo":{"country_iso_code":"BH"},"ip":"38.54.2.209","mac":["52:54:8f:9d:76:48"],"mac-cnt":1,"packets":0,"port":3005},"dstRIR":"ARIN","ethertype":2048,"fileId":[82412],"firstPacket":1788170089618,"ipProtocol":6,"lastPacket":1788170098606,"length":8988,"network":{"bytes":194,"community_id":"1:Dyswvx4WQGwf1a4iXH7proPBmK8=","packets":3},"node":"spark-afae","packetPos":[-82412,199481,1574,3344],"packetRange":{"gte":1788170089618,"lte":1788170098606},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS198953 Proton66 OOO","number":198953,"organization":{"name":"Proton66 OOO"}},"bytes":194,"geo":{"country_iso_code":"RU"},"ip":"176.120.22.61","mac":["98:44:ce:60:15:19"],"mac-cnt":1,"packets":3,"port":64838},"spoofable":["true"],"spoofableCnt":1,"srcDscp":[8],"srcDscpCnt":1,"srcOui":["Huawei Technologies Co.,Ltd"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[117],"srcTTLCnt":1,"tags":["honeypot","sensor:bahrain-sponge-01-ts","bahrain-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["200_2-1-1-4_1460_00","200_2-1-3-1-1-4_1460_0"],"ja4tCnt":2},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":3,"syn-ack":0,"urg":0},"tcpseq":{"src":309108923},"totDataBytes":0} +{"@timestamp":1788170577038,"_id":"260831--z7VIIzbIEhIzafFjZObNr_9","_index":"arkime_sessions3-260831","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Kaopu Cloud HK Limited"],"isp.dstCnt":1,"isp.src":["Proton66 OOO"],"isp.srcCnt":1,"org.dst":["LightNode-BH"],"org.dstCnt":1,"org.src":["Proton66 OOO"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["business"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":0,"geo":{"country_iso_code":"BH"},"ip":"38.54.2.209","mac":["52:54:8f:9d:76:48"],"mac-cnt":1,"packets":0,"port":43},"dstRIR":"ARIN","ethertype":2048,"fileId":[82412],"firstPacket":1788170089616,"ipProtocol":6,"lastPacket":1788170098602,"length":8986,"network":{"bytes":194,"community_id":"1:G8fPeSe6dVcX/R/yWUtvnpivu4M=","packets":3},"node":"spark-afae","packetPos":[-82412,199399,1328,3594],"packetRange":{"gte":1788170089616,"lte":1788170098602},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS198953 Proton66 OOO","number":198953,"organization":{"name":"Proton66 OOO"}},"bytes":194,"geo":{"country_iso_code":"RU"},"ip":"176.120.22.61","mac":["98:44:ce:60:15:19"],"mac-cnt":1,"packets":3,"port":63861},"spoofable":["true"],"spoofableCnt":1,"srcDscp":[8],"srcDscpCnt":1,"srcOui":["Huawei Technologies Co.,Ltd"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[117],"srcTTLCnt":1,"tags":["honeypot","sensor:bahrain-sponge-01-ts","bahrain-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["200_2-1-1-4_1460_00","200_2-1-3-1-1-4_1460_0"],"ja4tCnt":2},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":3,"syn-ack":0,"urg":0},"tcpseq":{"src":1110524428},"totDataBytes":0} +{"@timestamp":1788170577037,"_id":"260831--z7Dsbns-_BDq4dVHtlqbBu7","_index":"arkime_sessions3-260831","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Kaopu Cloud HK Limited"],"isp.dstCnt":1,"isp.src":["Proton66 OOO"],"isp.srcCnt":1,"org.dst":["LightNode-BH"],"org.dstCnt":1,"org.src":["Proton66 OOO"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["business"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":0,"geo":{"country_iso_code":"BH"},"ip":"38.54.2.209","mac":["52:54:8f:9d:76:48"],"mac-cnt":1,"packets":0,"port":9999},"dstRIR":"ARIN","ethertype":2048,"fileId":[82412],"firstPacket":1788170089611,"ipProtocol":6,"lastPacket":1788170098609,"length":8998,"network":{"bytes":194,"community_id":"1:iMUxbWNUc5lsyL5FjH/FaBVbF3g=","packets":3},"node":"spark-afae","packetPos":[-82412,199317,2558,3538],"packetRange":{"gte":1788170089611,"lte":1788170098609},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS198953 Proton66 OOO","number":198953,"organization":{"name":"Proton66 OOO"}},"bytes":194,"geo":{"country_iso_code":"RU"},"ip":"176.120.22.61","mac":["98:44:ce:60:15:19"],"mac-cnt":1,"packets":3,"port":62935},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Huawei Technologies Co.,Ltd"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[118],"srcTTLCnt":1,"tags":["honeypot","sensor:bahrain-sponge-01-ts","bahrain-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["200_2-1-1-4_1460_00","200_2-1-3-1-1-4_1460_0"],"ja4tCnt":2},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":3,"syn-ack":0,"urg":0},"tcpseq":{"src":425714856},"totDataBytes":0} +{"@timestamp":1788170577037,"_id":"260831--z5Witos6q1Gg5JWHg8YrkHB","_index":"arkime_sessions3-260831","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Kaopu Cloud HK Limited"],"isp.dstCnt":1,"isp.src":["Proton66 OOO"],"isp.srcCnt":1,"org.dst":["LightNode-BH"],"org.dstCnt":1,"org.src":["Proton66 OOO"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["business"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":0,"geo":{"country_iso_code":"BH"},"ip":"38.54.2.209","mac":["52:54:8f:9d:76:48"],"mac-cnt":1,"packets":0,"port":7788},"dstRIR":"ARIN","ethertype":2048,"fileId":[82412],"firstPacket":1788170089609,"ipProtocol":6,"lastPacket":1788170098624,"length":9015,"network":{"bytes":194,"community_id":"1:v69ckg2S08BZNPNtVndt0Ll9ljY=","packets":3},"node":"spark-afae","packetPos":[-82412,199071,3214,3518],"packetRange":{"gte":1788170089609,"lte":1788170098624},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS198953 Proton66 OOO","number":198953,"organization":{"name":"Proton66 OOO"}},"bytes":194,"geo":{"country_iso_code":"RU"},"ip":"176.120.22.61","mac":["98:44:ce:60:15:19"],"mac-cnt":1,"packets":3,"port":63098},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Huawei Technologies Co.,Ltd"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[118],"srcTTLCnt":1,"tags":["honeypot","sensor:bahrain-sponge-01-ts","bahrain-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["200_2-1-1-4_1460_00","200_2-1-3-1-1-4_1460_0"],"ja4tCnt":2},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":3,"syn-ack":0,"urg":0},"tcpseq":{"src":2686436917},"totDataBytes":0} +{"@timestamp":1788170577037,"_id":"260831--z4oHs8krl1LeLC_3AFy0GSh","_index":"arkime_sessions3-260831","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Kaopu Cloud HK Limited"],"isp.dstCnt":1,"isp.src":["Proton66 OOO"],"isp.srcCnt":1,"org.dst":["LightNode-BH"],"org.dstCnt":1,"org.src":["Proton66 OOO"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["business"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":0,"geo":{"country_iso_code":"BH"},"ip":"38.54.2.209","mac":["52:54:8f:9d:76:48"],"mac-cnt":1,"packets":0,"port":8001},"dstRIR":"ARIN","ethertype":2048,"fileId":[82412],"firstPacket":1788170089609,"ipProtocol":6,"lastPacket":1788170098608,"length":8999,"network":{"bytes":194,"community_id":"1:2WARFtef0Y1RjUXXIiEdPegjZ5c=","packets":3},"node":"spark-afae","packetPos":[-82412,199235,2394,3550],"packetRange":{"gte":1788170089609,"lte":1788170098608},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS198953 Proton66 OOO","number":198953,"organization":{"name":"Proton66 OOO"}},"bytes":194,"geo":{"country_iso_code":"RU"},"ip":"176.120.22.61","mac":["98:44:ce:60:15:19"],"mac-cnt":1,"packets":3,"port":64503},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Huawei Technologies Co.,Ltd"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[118],"srcTTLCnt":1,"tags":["honeypot","sensor:bahrain-sponge-01-ts","bahrain-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["200_2-1-1-4_1460_00","200_2-1-3-1-1-4_1460_0"],"ja4tCnt":2},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":3,"syn-ack":0,"urg":0},"tcpseq":{"src":1374599238},"totDataBytes":0} +{"@timestamp":1788170577038,"_id":"260831--z4M7ktS86dF96fT-Og3SGOG","_index":"arkime_sessions3-260831","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Kaopu Cloud HK Limited"],"isp.dstCnt":1,"isp.src":["Proton66 OOO"],"isp.srcCnt":1,"org.dst":["LightNode-BH"],"org.dstCnt":1,"org.src":["Proton66 OOO"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["business"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":0,"geo":{"country_iso_code":"BH"},"ip":"38.54.2.209","mac":["52:54:8f:9d:76:48"],"mac-cnt":1,"packets":0,"port":9001},"dstRIR":"ARIN","ethertype":2048,"fileId":[82412],"firstPacket":1788170089609,"ipProtocol":6,"lastPacket":1788170098607,"length":8998,"network":{"bytes":194,"community_id":"1:X/NhmTgFvyp14o6badjLyRgIJOI=","packets":3},"node":"spark-afae","packetPos":[-82412,198989,2476,3480],"packetRange":{"gte":1788170089609,"lte":1788170098607},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS198953 Proton66 OOO","number":198953,"organization":{"name":"Proton66 OOO"}},"bytes":194,"geo":{"country_iso_code":"RU"},"ip":"176.120.22.61","mac":["98:44:ce:60:15:19"],"mac-cnt":1,"packets":3,"port":63762},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Huawei Technologies Co.,Ltd"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[118],"srcTTLCnt":1,"tags":["honeypot","sensor:bahrain-sponge-01-ts","bahrain-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["200_2-1-1-4_1460_00","200_2-1-3-1-1-4_1460_0"],"ja4tCnt":2},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":3,"syn-ack":0,"urg":0},"tcpseq":{"src":962591335},"totDataBytes":0} +{"@timestamp":1788170577038,"_id":"260831--z7rLx2fRYxKPrBcCQeH5_5y","_index":"arkime_sessions3-260831","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Kaopu Cloud HK Limited"],"isp.dstCnt":1,"isp.src":["Proton66 OOO"],"isp.srcCnt":1,"org.dst":["LightNode-BH"],"org.dstCnt":1,"org.src":["Proton66 OOO"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["business"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":0,"geo":{"country_iso_code":"BH"},"ip":"38.54.2.209","mac":["52:54:8f:9d:76:48"],"mac-cnt":1,"packets":0,"port":44443},"dstRIR":"ARIN","ethertype":2048,"fileId":[82412],"firstPacket":1788170089609,"ipProtocol":6,"lastPacket":1788170098608,"length":8999,"network":{"bytes":194,"community_id":"1:BvTPqwMVPKNzHVWI49H9dGGZnYY=","packets":3},"node":"spark-afae","packetPos":[-82412,199153,2558,3546],"packetRange":{"gte":1788170089609,"lte":1788170098608},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS198953 Proton66 OOO","number":198953,"organization":{"name":"Proton66 OOO"}},"bytes":194,"geo":{"country_iso_code":"RU"},"ip":"176.120.22.61","mac":["98:44:ce:60:15:19"],"mac-cnt":1,"packets":3,"port":63442},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Huawei Technologies Co.,Ltd"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[118],"srcTTLCnt":1,"tags":["honeypot","sensor:bahrain-sponge-01-ts","bahrain-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["200_2-1-1-4_1460_00","200_2-1-3-1-1-4_1460_0"],"ja4tCnt":2},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":3,"syn-ack":0,"urg":0},"tcpseq":{"src":132441986},"totDataBytes":0} +{"@timestamp":1788170577237,"_id":"260831--z6OaEN6qsxKBonft8qDBmyJ","_index":"arkime_sessions3-260831","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Kaopu Cloud HK Limited"],"isp.dstCnt":1,"isp.src":["Proton66 OOO"],"isp.srcCnt":1,"org.dst":["LightNode-BH"],"org.dstCnt":1,"org.src":["Proton66 OOO"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["business"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":0,"geo":{"country_iso_code":"BH"},"ip":"38.54.2.209","mac":["52:54:8f:9d:76:48"],"mac-cnt":1,"packets":0,"port":10443},"dstRIR":"ARIN","ethertype":2048,"fileId":[82412],"firstPacket":1788170089608,"ipProtocol":6,"lastPacket":1788170098615,"length":9007,"network":{"bytes":194,"community_id":"1:MrfegbmZeItQ2kft5BL3Fbjr2WE=","packets":3},"node":"spark-afae","packetPos":[-82412,198661,3296,3534],"packetRange":{"gte":1788170089608,"lte":1788170098615},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS198953 Proton66 OOO","number":198953,"organization":{"name":"Proton66 OOO"}},"bytes":194,"geo":{"country_iso_code":"RU"},"ip":"176.120.22.61","mac":["98:44:ce:60:15:19"],"mac-cnt":1,"packets":3,"port":65187},"spoofable":["true"],"spoofableCnt":1,"srcDscp":[8],"srcDscpCnt":1,"srcOui":["Huawei Technologies Co.,Ltd"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[117],"srcTTLCnt":1,"tags":["honeypot","sensor:bahrain-sponge-01-ts","bahrain-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["200_2-1-1-4_1460_00","200_2-1-3-1-1-4_1460_0"],"ja4tCnt":2},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":3,"syn-ack":0,"urg":0},"tcpseq":{"src":961637960},"totDataBytes":0} +{"@timestamp":1788170577037,"_id":"260831--z534Ydc-6ZEVIJBS_vJhyzO","_index":"arkime_sessions3-260831","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Kaopu Cloud HK Limited"],"isp.dstCnt":1,"isp.src":["Proton66 OOO"],"isp.srcCnt":1,"org.dst":["LightNode-BH"],"org.dstCnt":1,"org.src":["Proton66 OOO"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["business"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":0,"geo":{"country_iso_code":"BH"},"ip":"38.54.2.209","mac":["52:54:8f:9d:76:48"],"mac-cnt":1,"packets":0,"port":5005},"dstRIR":"ARIN","ethertype":2048,"fileId":[82412],"firstPacket":1788170089608,"ipProtocol":6,"lastPacket":1788170098606,"length":8998,"network":{"bytes":194,"community_id":"1:CH556LYmmJWZab+MSnVppmEUTKo=","packets":3},"node":"spark-afae","packetPos":[-82412,198825,2476,3410],"packetRange":{"gte":1788170089608,"lte":1788170098606},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS198953 Proton66 OOO","number":198953,"organization":{"name":"Proton66 OOO"}},"bytes":194,"geo":{"country_iso_code":"RU"},"ip":"176.120.22.61","mac":["98:44:ce:60:15:19"],"mac-cnt":1,"packets":3,"port":62906},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Huawei Technologies Co.,Ltd"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[118],"srcTTLCnt":1,"tags":["honeypot","sensor:bahrain-sponge-01-ts","bahrain-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["200_2-1-1-4_1460_00","200_2-1-3-1-1-4_1460_0"],"ja4tCnt":2},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":3,"syn-ack":0,"urg":0},"tcpseq":{"src":1563772734},"totDataBytes":0} +{"@timestamp":1788170577037,"_id":"260831--z4EHD391UhJManSV6KAtQAS","_index":"arkime_sessions3-260831","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Kaopu Cloud HK Limited"],"isp.dstCnt":1,"isp.src":["Proton66 OOO"],"isp.srcCnt":1,"org.dst":["LightNode-BH"],"org.dstCnt":1,"org.src":["Proton66 OOO"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["business"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":0,"geo":{"country_iso_code":"BH"},"ip":"38.54.2.209","mac":["52:54:8f:9d:76:48"],"mac-cnt":1,"packets":0,"port":8899},"dstRIR":"ARIN","ethertype":2048,"fileId":[82412],"firstPacket":1788170089608,"ipProtocol":6,"lastPacket":1788170098606,"length":8998,"network":{"bytes":194,"community_id":"1:ubNMFI0xmekvViGtFmSZIWsL1ZE=","packets":3},"node":"spark-afae","packetPos":[-82412,198907,2312,3570],"packetRange":{"gte":1788170089608,"lte":1788170098606},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS198953 Proton66 OOO","number":198953,"organization":{"name":"Proton66 OOO"}},"bytes":194,"geo":{"country_iso_code":"RU"},"ip":"176.120.22.61","mac":["98:44:ce:60:15:19"],"mac-cnt":1,"packets":3,"port":65351},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Huawei Technologies Co.,Ltd"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[118],"srcTTLCnt":1,"tags":["honeypot","sensor:bahrain-sponge-01-ts","bahrain-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["200_2-1-1-4_1460_00","200_2-1-3-1-1-4_1460_0"],"ja4tCnt":2},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":3,"syn-ack":0,"urg":0},"tcpseq":{"src":515725400},"totDataBytes":0} +{"@timestamp":1788170577037,"_id":"260831--z7mVBJ5CMJPlac-Ku1bPs9o","_index":"arkime_sessions3-260831","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Kaopu Cloud HK Limited"],"isp.dstCnt":1,"isp.src":["Proton66 OOO"],"isp.srcCnt":1,"org.dst":["LightNode-BH"],"org.dstCnt":1,"org.src":["Proton66 OOO"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["business"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":0,"geo":{"country_iso_code":"BH"},"ip":"38.54.2.209","mac":["52:54:8f:9d:76:48"],"mac-cnt":1,"packets":0,"port":5678},"dstRIR":"ARIN","ethertype":2048,"fileId":[82412],"firstPacket":1788170089608,"ipProtocol":6,"lastPacket":1788170098606,"length":8998,"network":{"bytes":194,"community_id":"1:VnXZ4Pr5TMykBtZ344YLCMVsN0o=","packets":3},"node":"spark-afae","packetPos":[-82412,198743,2394,3730],"packetRange":{"gte":1788170089608,"lte":1788170098606},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS198953 Proton66 OOO","number":198953,"organization":{"name":"Proton66 OOO"}},"bytes":194,"geo":{"country_iso_code":"RU"},"ip":"176.120.22.61","mac":["98:44:ce:60:15:19"],"mac-cnt":1,"packets":3,"port":62722},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Huawei Technologies Co.,Ltd"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[118],"srcTTLCnt":1,"tags":["honeypot","sensor:bahrain-sponge-01-ts","bahrain-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["200_2-1-1-4_1460_00","200_2-1-3-1-1-4_1460_0"],"ja4tCnt":2},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":3,"syn-ack":0,"urg":0},"tcpseq":{"src":1937039927},"totDataBytes":0} +{"@timestamp":1788170577037,"_id":"260831--z7oFkzLAvZBvLPM-7Y8v5RG","_index":"arkime_sessions3-260831","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Kaopu Cloud HK Limited"],"isp.dstCnt":1,"isp.src":["Proton66 OOO"],"isp.srcCnt":1,"org.dst":["LightNode-BH"],"org.dstCnt":1,"org.src":["Proton66 OOO"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["business"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":0,"geo":{"country_iso_code":"BH"},"ip":"38.54.2.209","mac":["52:54:8f:9d:76:48"],"mac-cnt":1,"packets":0,"port":5000},"dstRIR":"ARIN","ethertype":2048,"fileId":[82412],"firstPacket":1788170089607,"ipProtocol":6,"lastPacket":1788170098606,"length":8999,"network":{"bytes":194,"community_id":"1:0vYnzS0UAu4YWtat+Fbsl8fgN14=","packets":3},"node":"spark-afae","packetPos":[-82412,198251,2558,3824],"packetRange":{"gte":1788170089607,"lte":1788170098606},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS198953 Proton66 OOO","number":198953,"organization":{"name":"Proton66 OOO"}},"bytes":194,"geo":{"country_iso_code":"RU"},"ip":"176.120.22.61","mac":["98:44:ce:60:15:19"],"mac-cnt":1,"packets":3,"port":62818},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Huawei Technologies Co.,Ltd"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[118],"srcTTLCnt":1,"tags":["honeypot","sensor:bahrain-sponge-01-ts","bahrain-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["200_2-1-1-4_1460_00","200_2-1-3-1-1-4_1460_0"],"ja4tCnt":2},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":3,"syn-ack":0,"urg":0},"tcpseq":{"src":3612898615},"totDataBytes":0} +{"@timestamp":1788170577037,"_id":"260831--z6CoZLSfXdI2JDFpJi-M186","_index":"arkime_sessions3-260831","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Kaopu Cloud HK Limited"],"isp.dstCnt":1,"isp.src":["Proton66 OOO"],"isp.srcCnt":1,"org.dst":["LightNode-BH"],"org.dstCnt":1,"org.src":["Proton66 OOO"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["business"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":0,"geo":{"country_iso_code":"BH"},"ip":"38.54.2.209","mac":["52:54:8f:9d:76:48"],"mac-cnt":1,"packets":0,"port":8888},"dstRIR":"ARIN","ethertype":2048,"fileId":[82412],"firstPacket":1788170089607,"ipProtocol":6,"lastPacket":1788170098606,"length":8999,"network":{"bytes":194,"community_id":"1:BoKZGJagXcKFIXEp4PnVDALqC3c=","packets":3},"node":"spark-afae","packetPos":[-82412,198497,2394,3664],"packetRange":{"gte":1788170089607,"lte":1788170098606},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS198953 Proton66 OOO","number":198953,"organization":{"name":"Proton66 OOO"}},"bytes":194,"geo":{"country_iso_code":"RU"},"ip":"176.120.22.61","mac":["98:44:ce:60:15:19"],"mac-cnt":1,"packets":3,"port":62346},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Huawei Technologies Co.,Ltd"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[118],"srcTTLCnt":1,"tags":["honeypot","sensor:bahrain-sponge-01-ts","bahrain-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["200_2-1-1-4_1460_00","200_2-1-3-1-1-4_1460_0"],"ja4tCnt":2},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":3,"syn-ack":0,"urg":0},"tcpseq":{"src":4137148438},"totDataBytes":0} +{"@timestamp":1788170577037,"_id":"260831--z54eOBrdRJO_4YXy-z8Uzu0","_index":"arkime_sessions3-260831","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Kaopu Cloud HK Limited"],"isp.dstCnt":1,"isp.src":["Proton66 OOO"],"isp.srcCnt":1,"org.dst":["LightNode-BH"],"org.dstCnt":1,"org.src":["Proton66 OOO"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["business"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":0,"geo":{"country_iso_code":"BH"},"ip":"38.54.2.209","mac":["52:54:8f:9d:76:48"],"mac-cnt":1,"packets":0,"port":6000},"dstRIR":"ARIN","ethertype":2048,"fileId":[82412],"firstPacket":1788170089607,"ipProtocol":6,"lastPacket":1788170098606,"length":8999,"network":{"bytes":194,"community_id":"1:wKZ0ryt7JtLMIi9rlHCV0x7s5PU=","packets":3},"node":"spark-afae","packetPos":[-82412,198415,2558,3504],"packetRange":{"gte":1788170089607,"lte":1788170098606},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS198953 Proton66 OOO","number":198953,"organization":{"name":"Proton66 OOO"}},"bytes":194,"geo":{"country_iso_code":"RU"},"ip":"176.120.22.61","mac":["98:44:ce:60:15:19"],"mac-cnt":1,"packets":3,"port":62631},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Huawei Technologies Co.,Ltd"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[118],"srcTTLCnt":1,"tags":["honeypot","sensor:bahrain-sponge-01-ts","bahrain-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["200_2-1-1-4_1460_00","200_2-1-3-1-1-4_1460_0"],"ja4tCnt":2},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":3,"syn-ack":0,"urg":0},"tcpseq":{"src":860346444},"totDataBytes":0} +{"@timestamp":1788170577038,"_id":"260831--z4aMiI9qwlJLLjc-YPxmdxM","_index":"arkime_sessions3-260831","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Kaopu Cloud HK Limited"],"isp.dstCnt":1,"isp.src":["Proton66 OOO"],"isp.srcCnt":1,"org.dst":["LightNode-BH"],"org.dstCnt":1,"org.src":["Proton66 OOO"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["business"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":0,"geo":{"country_iso_code":"BH"},"ip":"38.54.2.209","mac":["52:54:8f:9d:76:48"],"mac-cnt":1,"packets":0,"port":4433},"dstRIR":"ARIN","ethertype":2048,"fileId":[82412],"firstPacket":1788170089607,"ipProtocol":6,"lastPacket":1788170098608,"length":9001,"network":{"bytes":194,"community_id":"1:UcR6xUgA1aQs5iJv+5FqDeR9flY=","packets":3},"node":"spark-afae","packetPos":[-82412,198333,3214,3554],"packetRange":{"gte":1788170089607,"lte":1788170098608},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS198953 Proton66 OOO","number":198953,"organization":{"name":"Proton66 OOO"}},"bytes":194,"geo":{"country_iso_code":"RU"},"ip":"176.120.22.61","mac":["98:44:ce:60:15:19"],"mac-cnt":1,"packets":3,"port":65350},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Huawei Technologies Co.,Ltd"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[118],"srcTTLCnt":1,"tags":["honeypot","sensor:bahrain-sponge-01-ts","bahrain-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["200_2-1-1-4_1460_00","200_2-1-3-1-1-4_1460_0"],"ja4tCnt":2},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":3,"syn-ack":0,"urg":0},"tcpseq":{"src":2643619161},"totDataBytes":0} +{"@timestamp":1788170577038,"_id":"260831--z7o_SmOOhtJxoa48CtN8TlB","_index":"arkime_sessions3-260831","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Kaopu Cloud HK Limited"],"isp.dstCnt":1,"isp.src":["Proton66 OOO"],"isp.srcCnt":1,"org.dst":["LightNode-BH"],"org.dstCnt":1,"org.src":["Proton66 OOO"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["business"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":0,"geo":{"country_iso_code":"BH"},"ip":"38.54.2.209","mac":["52:54:8f:9d:76:48"],"mac-cnt":1,"packets":0,"port":3333},"dstRIR":"ARIN","ethertype":2048,"fileId":[82412],"firstPacket":1788170089607,"ipProtocol":6,"lastPacket":1788170098609,"length":9002,"network":{"bytes":194,"community_id":"1:H+2NtDhzKo0hRZzqLu2x2Jw+qgw=","packets":3},"node":"spark-afae","packetPos":[-82412,198579,3214,3542],"packetRange":{"gte":1788170089607,"lte":1788170098609},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS198953 Proton66 OOO","number":198953,"organization":{"name":"Proton66 OOO"}},"bytes":194,"geo":{"country_iso_code":"RU"},"ip":"176.120.22.61","mac":["98:44:ce:60:15:19"],"mac-cnt":1,"packets":3,"port":63497},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Huawei Technologies Co.,Ltd"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[118],"srcTTLCnt":1,"tags":["honeypot","sensor:bahrain-sponge-01-ts","bahrain-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["200_2-1-1-4_1460_00","200_2-1-3-1-1-4_1460_0"],"ja4tCnt":2},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":3,"syn-ack":0,"urg":0},"tcpseq":{"src":320596176},"totDataBytes":0} +{"@timestamp":1788170577237,"_id":"260831--z4JX_PG_PlNwYcwmiOqHr9y","_index":"arkime_sessions3-260831","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Kaopu Cloud HK Limited"],"isp.dstCnt":1,"isp.src":["Proton66 OOO"],"isp.srcCnt":1,"org.dst":["LightNode-BH"],"org.dstCnt":1,"org.src":["Proton66 OOO"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["business"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":0,"geo":{"country_iso_code":"BH"},"ip":"38.54.2.209","mac":["52:54:8f:9d:76:48"],"mac-cnt":1,"packets":0,"port":2008},"dstRIR":"ARIN","ethertype":2048,"fileId":[82412],"firstPacket":1788170089605,"ipProtocol":6,"lastPacket":1788170098592,"length":8987,"network":{"bytes":194,"community_id":"1:bJnyYJ9JizJJT/icth5lxFqLn7k=","packets":3},"node":"spark-afae","packetPos":[-82412,198169,2312,3684],"packetRange":{"gte":1788170089605,"lte":1788170098592},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS198953 Proton66 OOO","number":198953,"organization":{"name":"Proton66 OOO"}},"bytes":194,"geo":{"country_iso_code":"RU"},"ip":"176.120.22.61","mac":["98:44:ce:60:15:19"],"mac-cnt":1,"packets":3,"port":65361},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Huawei Technologies Co.,Ltd"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[118],"srcTTLCnt":1,"tags":["honeypot","sensor:bahrain-sponge-01-ts","bahrain-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["200_2-1-1-4_1460_00","200_2-1-3-1-1-4_1460_0"],"ja4tCnt":2},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":3,"syn-ack":0,"urg":0},"tcpseq":{"src":2120225160},"totDataBytes":0} +{"@timestamp":1788170577037,"_id":"260831--z7e909iD1RLLavH39j28ucw","_index":"arkime_sessions3-260831","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Kaopu Cloud HK Limited"],"isp.dstCnt":1,"isp.src":["Proton66 OOO"],"isp.srcCnt":1,"org.dst":["LightNode-BH"],"org.dstCnt":1,"org.src":["Proton66 OOO"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["business"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":0,"geo":{"country_iso_code":"BH"},"ip":"38.54.2.209","mac":["52:54:8f:9d:76:48"],"mac-cnt":1,"packets":0,"port":1500},"dstRIR":"ARIN","ethertype":2048,"fileId":[82412],"firstPacket":1788170089604,"ipProtocol":6,"lastPacket":1788170098592,"length":8988,"network":{"bytes":194,"community_id":"1:AocsVOaJMMwAtAT5/jIMsMydW/Y=","packets":3},"node":"spark-afae","packetPos":[-82412,198087,2558,3598],"packetRange":{"gte":1788170089604,"lte":1788170098592},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS198953 Proton66 OOO","number":198953,"organization":{"name":"Proton66 OOO"}},"bytes":194,"geo":{"country_iso_code":"RU"},"ip":"176.120.22.61","mac":["98:44:ce:60:15:19"],"mac-cnt":1,"packets":3,"port":65135},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Huawei Technologies Co.,Ltd"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[118],"srcTTLCnt":1,"tags":["honeypot","sensor:bahrain-sponge-01-ts","bahrain-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["200_2-1-1-4_1460_00","200_2-1-3-1-1-4_1460_0"],"ja4tCnt":2},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":3,"syn-ack":0,"urg":0},"tcpseq":{"src":2003931571},"totDataBytes":0} +{"@timestamp":1788170577238,"_id":"260831--z748Klk3IxNUYacmdDBIw-y","_index":"arkime_sessions3-260831","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Kaopu Cloud HK Limited"],"isp.dstCnt":1,"isp.src":["Proton66 OOO"],"isp.srcCnt":1,"org.dst":["LightNode-BH"],"org.dstCnt":1,"org.src":["Proton66 OOO"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["business"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":0,"geo":{"country_iso_code":"BH"},"ip":"38.54.2.209","mac":["52:54:8f:9d:76:48"],"mac-cnt":1,"packets":0,"port":1800},"dstRIR":"ARIN","ethertype":2048,"fileId":[82412],"firstPacket":1788170089603,"ipProtocol":6,"lastPacket":1788170098592,"length":8989,"network":{"bytes":194,"community_id":"1:AxfxM1wZzjWoufJ6HKj5FLkCZrQ=","packets":3},"node":"spark-afae","packetPos":[-82412,198005,2394,3610],"packetRange":{"gte":1788170089603,"lte":1788170098592},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS198953 Proton66 OOO","number":198953,"organization":{"name":"Proton66 OOO"}},"bytes":194,"geo":{"country_iso_code":"RU"},"ip":"176.120.22.61","mac":["98:44:ce:60:15:19"],"mac-cnt":1,"packets":3,"port":64398},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Huawei Technologies Co.,Ltd"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[118],"srcTTLCnt":1,"tags":["honeypot","sensor:bahrain-sponge-01-ts","bahrain-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["200_2-1-1-4_1460_00","200_2-1-3-1-1-4_1460_0"],"ja4tCnt":2},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":3,"syn-ack":0,"urg":0},"tcpseq":{"src":2809760729},"totDataBytes":0} +{"@timestamp":1788170577038,"_id":"260831--z58UrOcvnNHj5VwHAAVCV3s","_index":"arkime_sessions3-260831","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Kaopu Cloud HK Limited"],"isp.dstCnt":1,"isp.src":["Proton66 OOO"],"isp.srcCnt":1,"org.dst":["LightNode-BH"],"org.dstCnt":1,"org.src":["Proton66 OOO"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["business"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":0,"geo":{"country_iso_code":"BH"},"ip":"38.54.2.209","mac":["52:54:8f:9d:76:48"],"mac-cnt":1,"packets":0,"port":12443},"dstRIR":"ARIN","ethertype":2048,"fileId":[82412],"firstPacket":1788170089602,"ipProtocol":6,"lastPacket":1788170098607,"length":9005,"network":{"bytes":194,"community_id":"1:BS36BzDeN0+0xjYg/smICtS51XI=","packets":3},"node":"spark-afae","packetPos":[-82412,197923,3460,3640],"packetRange":{"gte":1788170089602,"lte":1788170098607},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS198953 Proton66 OOO","number":198953,"organization":{"name":"Proton66 OOO"}},"bytes":194,"geo":{"country_iso_code":"RU"},"ip":"176.120.22.61","mac":["98:44:ce:60:15:19"],"mac-cnt":1,"packets":3,"port":64091},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Huawei Technologies Co.,Ltd"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[118],"srcTTLCnt":1,"tags":["honeypot","sensor:bahrain-sponge-01-ts","bahrain-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["200_2-1-1-4_1460_00","200_2-1-3-1-1-4_1460_0"],"ja4tCnt":2},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":3,"syn-ack":0,"urg":0},"tcpseq":{"src":1640109991},"totDataBytes":0} +{"@timestamp":1788170577037,"_id":"260831--z6egMOKe-NMx7SjB6PXWD_Z","_index":"arkime_sessions3-260831","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Kaopu Cloud HK Limited"],"isp.dstCnt":1,"isp.src":["Proton66 OOO"],"isp.srcCnt":1,"org.dst":["LightNode-BH"],"org.dstCnt":1,"org.src":["Proton66 OOO"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["business"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":0,"geo":{"country_iso_code":"BH"},"ip":"38.54.2.209","mac":["52:54:8f:9d:76:48"],"mac-cnt":1,"packets":0,"port":12345},"dstRIR":"ARIN","ethertype":2048,"fileId":[82412],"firstPacket":1788170089602,"ipProtocol":6,"lastPacket":1788170098592,"length":8990,"network":{"bytes":194,"community_id":"1:WXFpBTeEO8V3qzQnOEl1TFP5D+M=","packets":3},"node":"spark-afae","packetPos":[-82412,197841,2722,3524],"packetRange":{"gte":1788170089602,"lte":1788170098592},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS198953 Proton66 OOO","number":198953,"organization":{"name":"Proton66 OOO"}},"bytes":194,"geo":{"country_iso_code":"RU"},"ip":"176.120.22.61","mac":["98:44:ce:60:15:19"],"mac-cnt":1,"packets":3,"port":64989},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Huawei Technologies Co.,Ltd"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[118],"srcTTLCnt":1,"tags":["honeypot","sensor:bahrain-sponge-01-ts","bahrain-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["200_2-1-1-4_1460_00","200_2-1-3-1-1-4_1460_0"],"ja4tCnt":2},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":3,"syn-ack":0,"urg":0},"tcpseq":{"src":3903503155},"totDataBytes":0} +{"@timestamp":1788170577037,"_id":"260831--z5r8YTZ8l9KV4bhwXA9My7n","_index":"arkime_sessions3-260831","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Kaopu Cloud HK Limited"],"isp.dstCnt":1,"isp.src":["Proton66 OOO"],"isp.srcCnt":1,"org.dst":["LightNode-BH"],"org.dstCnt":1,"org.src":["Proton66 OOO"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["business"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":0,"geo":{"country_iso_code":"BH"},"ip":"38.54.2.209","mac":["52:54:8f:9d:76:48"],"mac-cnt":1,"packets":0,"port":1434},"dstRIR":"ARIN","ethertype":2048,"fileId":[82412],"firstPacket":1788170089601,"ipProtocol":6,"lastPacket":1788170098591,"length":8990,"network":{"bytes":194,"community_id":"1:KvLeXQ65vriWSSMqujoU3o4KS+k=","packets":3},"node":"spark-afae","packetPos":[-82412,197759,2476,3618],"packetRange":{"gte":1788170089601,"lte":1788170098591},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS198953 Proton66 OOO","number":198953,"organization":{"name":"Proton66 OOO"}},"bytes":194,"geo":{"country_iso_code":"RU"},"ip":"176.120.22.61","mac":["98:44:ce:60:15:19"],"mac-cnt":1,"packets":3,"port":64198},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Huawei Technologies Co.,Ltd"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[118],"srcTTLCnt":1,"tags":["honeypot","sensor:bahrain-sponge-01-ts","bahrain-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["200_2-1-1-4_1460_00","200_2-1-3-1-1-4_1460_0"],"ja4tCnt":2},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":3,"syn-ack":0,"urg":0},"tcpseq":{"src":765870725},"totDataBytes":0} +{"@timestamp":1788170577038,"_id":"260831--z4lQ-Hmd-NB0bQenChs3P2l","_index":"arkime_sessions3-260831","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Kaopu Cloud HK Limited"],"isp.dstCnt":1,"isp.src":["Proton66 OOO"],"isp.srcCnt":1,"org.dst":["LightNode-BH"],"org.dstCnt":1,"org.src":["Proton66 OOO"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["business"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":0,"geo":{"country_iso_code":"BH"},"ip":"38.54.2.209","mac":["52:54:8f:9d:76:48"],"mac-cnt":1,"packets":0,"port":1433},"dstRIR":"ARIN","ethertype":2048,"fileId":[82412],"firstPacket":1788170089601,"ipProtocol":6,"lastPacket":1788170098591,"length":8990,"network":{"bytes":194,"community_id":"1:ZeUiRdy2otqvy2cK0FTbLB3QlA4=","packets":3},"node":"spark-afae","packetPos":[-82412,197677,2640,3614],"packetRange":{"gte":1788170089601,"lte":1788170098591},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS198953 Proton66 OOO","number":198953,"organization":{"name":"Proton66 OOO"}},"bytes":194,"geo":{"country_iso_code":"RU"},"ip":"176.120.22.61","mac":["98:44:ce:60:15:19"],"mac-cnt":1,"packets":3,"port":62692},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Huawei Technologies Co.,Ltd"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[118],"srcTTLCnt":1,"tags":["honeypot","sensor:bahrain-sponge-01-ts","bahrain-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["200_2-1-1-4_1460_00","200_2-1-3-1-1-4_1460_0"],"ja4tCnt":2},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":3,"syn-ack":0,"urg":0},"tcpseq":{"src":1151301433},"totDataBytes":0} +{"@timestamp":1788112934719,"_id":"260830-MDdZjJRoI_9O27ASNuRDEjzK","_index":"arkime_sessions3-260830","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Kaopu Cloud HK Limited"],"isp.dstCnt":1,"isp.src":["Proton66 OOO"],"isp.srcCnt":1,"org.dst":["LightNode-BH"],"org.dstCnt":1,"org.src":["Proton66 OOO"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["business"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":0,"geo":{"country_iso_code":"BH"},"ip":"38.54.2.209","mac":["52:54:8f:9d:76:48"],"mac-cnt":1,"packets":0,"port":9999},"dstRIR":"ARIN","ethertype":2048,"fileId":[82029],"firstPacket":1788112159371,"ipProtocol":6,"lastPacket":1788112168367,"length":8996,"network":{"bytes":194,"community_id":"1:QFwP6fvpDFd3q5UX8GaJ+qVfjl8=","packets":3},"node":"spark-afae","packetPos":[-82029,105480,1921,2576],"packetRange":{"gte":1788112159371,"lte":1788112168367},"protocol":["tcp"],"protocolCnt":1,"rootId":"260830-MDdZjJRoI_9O27ASNuRDEjzK","segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS198953 Proton66 OOO","number":198953,"organization":{"name":"Proton66 OOO"}},"bytes":194,"geo":{"country_iso_code":"RU"},"ip":"176.120.22.61","mac":["98:44:ce:60:15:19"],"mac-cnt":1,"packets":3,"port":52689},"spoofable":["true"],"spoofableCnt":1,"srcDscp":[8],"srcDscpCnt":1,"srcOui":["Huawei Technologies Co.,Ltd"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[117],"srcTTLCnt":1,"tags":["honeypot","bahrain-sponge-01-ts","sensor:bahrain-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["8192_2-1-3-1-1-4_1460_8","8192_2-1-1-4_1460_00"],"ja4tCnt":2},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":3,"syn-ack":0,"urg":0},"tcpseq":{"src":3131433924},"totDataBytes":0} +{"@timestamp":1788112934719,"_id":"260830-MDeHogoU3uxDZYLWSEw-bu9S","_index":"arkime_sessions3-260830","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Kaopu Cloud HK Limited"],"isp.dstCnt":1,"isp.src":["Proton66 OOO"],"isp.srcCnt":1,"org.dst":["LightNode-BH"],"org.dstCnt":1,"org.src":["Proton66 OOO"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["business"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":0,"geo":{"country_iso_code":"BH"},"ip":"38.54.2.209","mac":["52:54:8f:9d:76:48"],"mac-cnt":1,"packets":0,"port":9001},"dstRIR":"ARIN","ethertype":2048,"fileId":[82029],"firstPacket":1788112159370,"ipProtocol":6,"lastPacket":1788112168364,"length":8994,"network":{"bytes":194,"community_id":"1:N/8IHGS2ayhVPQZcB/5CRFNMqos=","packets":3},"node":"spark-afae","packetPos":[-82029,105398,1921,2580],"packetRange":{"gte":1788112159370,"lte":1788112168364},"protocol":["tcp"],"protocolCnt":1,"rootId":"260830-MDeHogoU3uxDZYLWSEw-bu9S","segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS198953 Proton66 OOO","number":198953,"organization":{"name":"Proton66 OOO"}},"bytes":194,"geo":{"country_iso_code":"RU"},"ip":"176.120.22.61","mac":["98:44:ce:60:15:19"],"mac-cnt":1,"packets":3,"port":52688},"spoofable":["true"],"spoofableCnt":1,"srcDscp":[8],"srcDscpCnt":1,"srcOui":["Huawei Technologies Co.,Ltd"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[117],"srcTTLCnt":1,"tags":["honeypot","bahrain-sponge-01-ts","sensor:bahrain-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["8192_2-1-3-1-1-4_1460_8","8192_2-1-1-4_1460_00"],"ja4tCnt":2},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":3,"syn-ack":0,"urg":0},"tcpseq":{"src":3514635461},"totDataBytes":0} +{"@timestamp":1788112934719,"_id":"260830-MDegpMyQ36lPyr8TH_QB6b2h","_index":"arkime_sessions3-260830","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Kaopu Cloud HK Limited"],"isp.dstCnt":1,"isp.src":["Proton66 OOO"],"isp.srcCnt":1,"org.dst":["LightNode-BH"],"org.dstCnt":1,"org.src":["Proton66 OOO"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["business"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":0,"geo":{"country_iso_code":"BH"},"ip":"38.54.2.209","mac":["52:54:8f:9d:76:48"],"mac-cnt":1,"packets":0,"port":8888},"dstRIR":"ARIN","ethertype":2048,"fileId":[82029],"firstPacket":1788112159369,"ipProtocol":6,"lastPacket":1788112168372,"length":9003,"network":{"bytes":194,"community_id":"1:UG9nFCNisFxskm1n6hfw9WmUoQY=","packets":3},"node":"spark-afae","packetPos":[-82029,105316,2249,2568],"packetRange":{"gte":1788112159369,"lte":1788112168372},"protocol":["tcp"],"protocolCnt":1,"rootId":"260830-MDegpMyQ36lPyr8TH_QB6b2h","segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS198953 Proton66 OOO","number":198953,"organization":{"name":"Proton66 OOO"}},"bytes":194,"geo":{"country_iso_code":"RU"},"ip":"176.120.22.61","mac":["98:44:ce:60:15:19"],"mac-cnt":1,"packets":3,"port":52664},"spoofable":["true"],"spoofableCnt":1,"srcDscp":[8],"srcDscpCnt":1,"srcOui":["Huawei Technologies Co.,Ltd"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[117],"srcTTLCnt":1,"tags":["honeypot","bahrain-sponge-01-ts","sensor:bahrain-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["8192_2-1-3-1-1-4_1460_8","8192_2-1-1-4_1460_00"],"ja4tCnt":2},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":3,"syn-ack":0,"urg":0},"tcpseq":{"src":195272261},"totDataBytes":0} +{"@timestamp":1788112934719,"_id":"260830-MDfLsrbcK-1IA4O3C1ls-4s_","_index":"arkime_sessions3-260830","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Kaopu Cloud HK Limited"],"isp.dstCnt":1,"isp.src":["Proton66 OOO"],"isp.srcCnt":1,"org.dst":["LightNode-BH"],"org.dstCnt":1,"org.src":["Proton66 OOO"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["business"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":0,"geo":{"country_iso_code":"BH"},"ip":"38.54.2.209","mac":["52:54:8f:9d:76:48"],"mac-cnt":1,"packets":0,"port":6001},"dstRIR":"ARIN","ethertype":2048,"fileId":[82029],"firstPacket":1788112159364,"ipProtocol":6,"lastPacket":1788112168368,"length":9004,"network":{"bytes":194,"community_id":"1:qy9gtdIs+w0hB/U0d4ulPOx2o6Q=","packets":3},"node":"spark-afae","packetPos":[-82029,105234,2249,2572],"packetRange":{"gte":1788112159364,"lte":1788112168368},"protocol":["tcp"],"protocolCnt":1,"rootId":"260830-MDfLsrbcK-1IA4O3C1ls-4s_","segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS198953 Proton66 OOO","number":198953,"organization":{"name":"Proton66 OOO"}},"bytes":194,"geo":{"country_iso_code":"RU"},"ip":"176.120.22.61","mac":["98:44:ce:60:15:19"],"mac-cnt":1,"packets":3,"port":52660},"spoofable":["true"],"spoofableCnt":1,"srcDscp":[8],"srcDscpCnt":1,"srcOui":["Huawei Technologies Co.,Ltd"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[117],"srcTTLCnt":1,"tags":["honeypot","bahrain-sponge-01-ts","sensor:bahrain-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["8192_2-1-3-1-1-4_1460_8","65535_2-1-1-4_1460_00"],"ja4tCnt":2},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":3,"syn-ack":0,"urg":0},"tcpseq":{"src":2606542954},"totDataBytes":0} +{"@timestamp":1788112934722,"_id":"260830-MDdZfu3VK9ZBMoI0afa0sG4k","_index":"arkime_sessions3-260830","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Kaopu Cloud HK Limited"],"isp.dstCnt":1,"isp.src":["Proton66 OOO"],"isp.srcCnt":1,"org.dst":["LightNode-BH"],"org.dstCnt":1,"org.src":["Proton66 OOO"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["business"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":0,"geo":{"country_iso_code":"BH"},"ip":"38.54.2.209","mac":["52:54:8f:9d:76:48"],"mac-cnt":1,"packets":0,"port":7788},"dstRIR":"ARIN","ethertype":2048,"fileId":[82029],"firstPacket":1788112159363,"ipProtocol":6,"lastPacket":1788112168361,"length":8998,"network":{"bytes":194,"community_id":"1:GFojdFqqRXa3ut2a8tnViq6JuEo=","packets":3},"node":"spark-afae","packetPos":[-82029,105152,2085,2584],"packetRange":{"gte":1788112159363,"lte":1788112168361},"protocol":["tcp"],"protocolCnt":1,"rootId":"260830-MDdZfu3VK9ZBMoI0afa0sG4k","segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS198953 Proton66 OOO","number":198953,"organization":{"name":"Proton66 OOO"}},"bytes":194,"geo":{"country_iso_code":"RU"},"ip":"176.120.22.61","mac":["98:44:ce:60:15:19"],"mac-cnt":1,"packets":3,"port":52662},"spoofable":["true"],"spoofableCnt":1,"srcDscp":[8],"srcDscpCnt":1,"srcOui":["Huawei Technologies Co.,Ltd"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[117],"srcTTLCnt":1,"tags":["honeypot","bahrain-sponge-01-ts","sensor:bahrain-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["8192_2-1-3-1-1-4_1460_8","65535_2-1-1-4_1460_00"],"ja4tCnt":2},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":3,"syn-ack":0,"urg":0},"tcpseq":{"src":2758541865},"totDataBytes":0} +{"@timestamp":1788112934719,"_id":"260830-MDcVMz_0iFhLV5zT_iQUhPoq","_index":"arkime_sessions3-260830","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Kaopu Cloud HK Limited"],"isp.dstCnt":1,"isp.src":["Proton66 OOO"],"isp.srcCnt":1,"org.dst":["LightNode-BH"],"org.dstCnt":1,"org.src":["Proton66 OOO"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["business"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":0,"geo":{"country_iso_code":"BH"},"ip":"38.54.2.209","mac":["52:54:8f:9d:76:48"],"mac-cnt":1,"packets":0,"port":5000},"dstRIR":"ARIN","ethertype":2048,"fileId":[82029],"firstPacket":1788112159356,"ipProtocol":6,"lastPacket":1788112168353,"length":8997,"network":{"bytes":194,"community_id":"1:AzWv8VbqvfrRfQ/DhH51Tu4z4sc=","packets":3},"node":"spark-afae","packetPos":[-82029,105070,2085,2588],"packetRange":{"gte":1788112159356,"lte":1788112168353},"protocol":["tcp"],"protocolCnt":1,"rootId":"260830-MDcVMz_0iFhLV5zT_iQUhPoq","segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS198953 Proton66 OOO","number":198953,"organization":{"name":"Proton66 OOO"}},"bytes":194,"geo":{"country_iso_code":"RU"},"ip":"176.120.22.61","mac":["98:44:ce:60:15:19"],"mac-cnt":1,"packets":3,"port":52637},"spoofable":["true"],"spoofableCnt":1,"srcDscp":[8],"srcDscpCnt":1,"srcOui":["Huawei Technologies Co.,Ltd"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[117],"srcTTLCnt":1,"tags":["honeypot","bahrain-sponge-01-ts","sensor:bahrain-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["8192_2-1-3-1-1-4_1460_8","8192_2-1-1-4_1460_00"],"ja4tCnt":2},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":3,"syn-ack":0,"urg":0},"tcpseq":{"src":2941125720},"totDataBytes":0} +{"@timestamp":1788112934719,"_id":"260830-MDdwE_XUV9NFopVEB9kcqIq3","_index":"arkime_sessions3-260830","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Kaopu Cloud HK Limited"],"isp.dstCnt":1,"isp.src":["Proton66 OOO"],"isp.srcCnt":1,"org.dst":["LightNode-BH"],"org.dstCnt":1,"org.src":["Proton66 OOO"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["business"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":0,"geo":{"country_iso_code":"BH"},"ip":"38.54.2.209","mac":["52:54:8f:9d:76:48"],"mac-cnt":1,"packets":0,"port":3005},"dstRIR":"ARIN","ethertype":2048,"fileId":[82029],"firstPacket":1788112159355,"ipProtocol":6,"lastPacket":1788112168351,"length":8996,"network":{"bytes":194,"community_id":"1:xGQSUL3f2V6oWYg208rVyVjmBHc=","packets":3},"node":"spark-afae","packetPos":[-82029,104988,2003,2596],"packetRange":{"gte":1788112159355,"lte":1788112168351},"protocol":["tcp"],"protocolCnt":1,"rootId":"260830-MDdwE_XUV9NFopVEB9kcqIq3","segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS198953 Proton66 OOO","number":198953,"organization":{"name":"Proton66 OOO"}},"bytes":194,"geo":{"country_iso_code":"RU"},"ip":"176.120.22.61","mac":["98:44:ce:60:15:19"],"mac-cnt":1,"packets":3,"port":52633},"spoofable":["true"],"spoofableCnt":1,"srcDscp":[8],"srcDscpCnt":1,"srcOui":["Huawei Technologies Co.,Ltd"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[117],"srcTTLCnt":1,"tags":["honeypot","bahrain-sponge-01-ts","sensor:bahrain-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["8192_2-1-3-1-1-4_1460_8","8192_2-1-1-4_1460_00"],"ja4tCnt":2},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":3,"syn-ack":0,"urg":0},"tcpseq":{"src":1423425643},"totDataBytes":0} +{"@timestamp":1788112934722,"_id":"260830-MDddxJB6wRhP5K86nLazUAhL","_index":"arkime_sessions3-260830","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Kaopu Cloud HK Limited"],"isp.dstCnt":1,"isp.src":["Proton66 OOO"],"isp.srcCnt":1,"org.dst":["LightNode-BH"],"org.dstCnt":1,"org.src":["Proton66 OOO"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["business"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":0,"geo":{"country_iso_code":"BH"},"ip":"38.54.2.209","mac":["52:54:8f:9d:76:48"],"mac-cnt":1,"packets":0,"port":8899},"dstRIR":"ARIN","ethertype":2048,"fileId":[82029],"firstPacket":1788112159351,"ipProtocol":6,"lastPacket":1788112168351,"length":9000,"network":{"bytes":194,"community_id":"1:WjeHPFEjd1JCQGBoESIUqG0JJvM=","packets":3},"node":"spark-afae","packetPos":[-82029,104906,2167,2592],"packetRange":{"gte":1788112159351,"lte":1788112168351},"protocol":["tcp"],"protocolCnt":1,"rootId":"260830-MDddxJB6wRhP5K86nLazUAhL","segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS198953 Proton66 OOO","number":198953,"organization":{"name":"Proton66 OOO"}},"bytes":194,"geo":{"country_iso_code":"RU"},"ip":"176.120.22.61","mac":["98:44:ce:60:15:19"],"mac-cnt":1,"packets":3,"port":52676},"spoofable":["true"],"spoofableCnt":1,"srcDscp":[8],"srcDscpCnt":1,"srcOui":["Huawei Technologies Co.,Ltd"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[117],"srcTTLCnt":1,"tags":["honeypot","bahrain-sponge-01-ts","sensor:bahrain-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["8192_2-1-3-1-1-4_1460_8","8192_2-1-1-4_1460_00"],"ja4tCnt":2},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":3,"syn-ack":0,"urg":0},"tcpseq":{"src":3701044199},"totDataBytes":0} +{"@timestamp":1788112934722,"_id":"260830-MDd5iXpOI7FCH5eah8B7LO4V","_index":"arkime_sessions3-260830","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Kaopu Cloud HK Limited"],"isp.dstCnt":1,"isp.src":["Proton66 OOO"],"isp.srcCnt":1,"org.dst":["LightNode-BH"],"org.dstCnt":1,"org.src":["Proton66 OOO"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["business"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":0,"geo":{"country_iso_code":"BH"},"ip":"38.54.2.209","mac":["52:54:8f:9d:76:48"],"mac-cnt":1,"packets":0,"port":8989},"dstRIR":"ARIN","ethertype":2048,"fileId":[82029],"firstPacket":1788112159345,"ipProtocol":6,"lastPacket":1788112168347,"length":9002,"network":{"bytes":194,"community_id":"1:ShSphBD1AfWweewRqkTMVpwDNd4=","packets":3},"node":"spark-afae","packetPos":[-82029,104824,2085,2600],"packetRange":{"gte":1788112159345,"lte":1788112168347},"protocol":["tcp"],"protocolCnt":1,"rootId":"260830-MDd5iXpOI7FCH5eah8B7LO4V","segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS198953 Proton66 OOO","number":198953,"organization":{"name":"Proton66 OOO"}},"bytes":194,"geo":{"country_iso_code":"RU"},"ip":"176.120.22.61","mac":["98:44:ce:60:15:19"],"mac-cnt":1,"packets":3,"port":52677},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Huawei Technologies Co.,Ltd"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[118],"srcTTLCnt":1,"tags":["honeypot","bahrain-sponge-01-ts","sensor:bahrain-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["8192_2-1-3-1-1-4_1460_8","8192_2-1-1-4_1460_00"],"ja4tCnt":2},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":3,"syn-ack":0,"urg":0},"tcpseq":{"src":4146533757},"totDataBytes":0} +{"@timestamp":1788112934722,"_id":"260830-MDcpN9Kp6X5JqLvHl2Kd-3El","_index":"arkime_sessions3-260830","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Kaopu Cloud HK Limited"],"isp.dstCnt":1,"isp.src":["Proton66 OOO"],"isp.srcCnt":1,"org.dst":["LightNode-BH"],"org.dstCnt":1,"org.src":["Proton66 OOO"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["business"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":0,"geo":{"country_iso_code":"BH"},"ip":"38.54.2.209","mac":["52:54:8f:9d:76:48"],"mac-cnt":1,"packets":0,"port":8001},"dstRIR":"ARIN","ethertype":2048,"fileId":[82029],"firstPacket":1788112159344,"ipProtocol":6,"lastPacket":1788112168342,"length":8998,"network":{"bytes":194,"community_id":"1:iiICHJEKmnyf7JaT3SVPr23Vp5A=","packets":3},"node":"spark-afae","packetPos":[-82029,104742,2085,2604],"packetRange":{"gte":1788112159344,"lte":1788112168342},"protocol":["tcp"],"protocolCnt":1,"rootId":"260830-MDcpN9Kp6X5JqLvHl2Kd-3El","segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS198953 Proton66 OOO","number":198953,"organization":{"name":"Proton66 OOO"}},"bytes":194,"geo":{"country_iso_code":"RU"},"ip":"176.120.22.61","mac":["98:44:ce:60:15:19"],"mac-cnt":1,"packets":3,"port":52663},"spoofable":["true"],"spoofableCnt":1,"srcDscp":[8],"srcDscpCnt":1,"srcOui":["Huawei Technologies Co.,Ltd"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[117],"srcTTLCnt":1,"tags":["honeypot","bahrain-sponge-01-ts","sensor:bahrain-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["8192_2-1-3-1-1-4_1460_8","65535_2-1-1-4_1460_00"],"ja4tCnt":2},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":3,"syn-ack":0,"urg":0},"tcpseq":{"src":2324561050},"totDataBytes":0} +{"@timestamp":1788112934719,"_id":"260830-MDcYfX0nYrlOEbRB7_Bld459","_index":"arkime_sessions3-260830","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Kaopu Cloud HK Limited"],"isp.dstCnt":1,"isp.src":["Proton66 OOO"],"isp.srcCnt":1,"org.dst":["LightNode-BH"],"org.dstCnt":1,"org.src":["Proton66 OOO"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["business"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":0,"geo":{"country_iso_code":"BH"},"ip":"38.54.2.209","mac":["52:54:8f:9d:76:48"],"mac-cnt":1,"packets":0,"port":2008},"dstRIR":"ARIN","ethertype":2048,"fileId":[82029],"firstPacket":1788112159342,"ipProtocol":6,"lastPacket":1788112168338,"length":8996,"network":{"bytes":194,"community_id":"1:QXv5vX3+Y2xqJSnc0xVQC1bsG/0=","packets":3},"node":"spark-afae","packetPos":[-82029,104660,2085,2608],"packetRange":{"gte":1788112159342,"lte":1788112168338},"protocol":["tcp"],"protocolCnt":1,"rootId":"260830-MDcYfX0nYrlOEbRB7_Bld459","segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS198953 Proton66 OOO","number":198953,"organization":{"name":"Proton66 OOO"}},"bytes":194,"geo":{"country_iso_code":"RU"},"ip":"176.120.22.61","mac":["98:44:ce:60:15:19"],"mac-cnt":1,"packets":3,"port":52632},"spoofable":["true"],"spoofableCnt":1,"srcDscp":[8],"srcDscpCnt":1,"srcOui":["Huawei Technologies Co.,Ltd"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[117],"srcTTLCnt":1,"tags":["honeypot","bahrain-sponge-01-ts","sensor:bahrain-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["8192_2-1-3-1-1-4_1460_8","8192_2-1-1-4_1460_00"],"ja4tCnt":2},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":3,"syn-ack":0,"urg":0},"tcpseq":{"src":3310846614},"totDataBytes":0} +{"@timestamp":1788112934722,"_id":"260830-MDciouvsFd5FpabRfT-fCPnt","_index":"arkime_sessions3-260830","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Kaopu Cloud HK Limited"],"isp.dstCnt":1,"isp.src":["Proton66 OOO"],"isp.srcCnt":1,"org.dst":["LightNode-BH"],"org.dstCnt":1,"org.src":["Proton66 OOO"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["business"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":0,"geo":{"country_iso_code":"BH"},"ip":"38.54.2.209","mac":["52:54:8f:9d:76:48"],"mac-cnt":1,"packets":0,"port":1800},"dstRIR":"ARIN","ethertype":2048,"fileId":[82029],"firstPacket":1788112159340,"ipProtocol":6,"lastPacket":1788112168337,"length":8997,"network":{"bytes":194,"community_id":"1:Ai/p0Ku6+ng7ouleypvV2n2w0SY=","packets":3},"node":"spark-afae","packetPos":[-82029,104578,2085,2612],"packetRange":{"gte":1788112159340,"lte":1788112168337},"protocol":["tcp"],"protocolCnt":1,"rootId":"260830-MDciouvsFd5FpabRfT-fCPnt","segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS198953 Proton66 OOO","number":198953,"organization":{"name":"Proton66 OOO"}},"bytes":194,"geo":{"country_iso_code":"RU"},"ip":"176.120.22.61","mac":["98:44:ce:60:15:19"],"mac-cnt":1,"packets":3,"port":52630},"spoofable":["true"],"spoofableCnt":1,"srcDscp":[8],"srcDscpCnt":1,"srcOui":["Huawei Technologies Co.,Ltd"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[117],"srcTTLCnt":1,"tags":["honeypot","bahrain-sponge-01-ts","sensor:bahrain-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["8192_2-1-3-1-1-4_1460_8","8192_2-1-1-4_1460_00"],"ja4tCnt":2},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":3,"syn-ack":0,"urg":0},"tcpseq":{"src":1537337139},"totDataBytes":0} +{"@timestamp":1788112934722,"_id":"260830-MDeo7sWw7PVKN681GITQiHKS","_index":"arkime_sessions3-260830","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Kaopu Cloud HK Limited"],"isp.dstCnt":1,"isp.src":["Proton66 OOO"],"isp.srcCnt":1,"org.dst":["LightNode-BH"],"org.dstCnt":1,"org.src":["Proton66 OOO"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["business"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":0,"geo":{"country_iso_code":"BH"},"ip":"38.54.2.209","mac":["52:54:8f:9d:76:48"],"mac-cnt":1,"packets":0,"port":6000},"dstRIR":"ARIN","ethertype":2048,"fileId":[82029],"firstPacket":1788112159338,"ipProtocol":6,"lastPacket":1788112168332,"length":8994,"network":{"bytes":194,"community_id":"1:UxUlq/QSeEcZSb1FGTl27P/NlPk=","packets":3},"node":"spark-afae","packetPos":[-82029,104496,1757,2632],"packetRange":{"gte":1788112159338,"lte":1788112168332},"protocol":["tcp"],"protocolCnt":1,"rootId":"260830-MDeo7sWw7PVKN681GITQiHKS","segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS198953 Proton66 OOO","number":198953,"organization":{"name":"Proton66 OOO"}},"bytes":194,"geo":{"country_iso_code":"RU"},"ip":"176.120.22.61","mac":["98:44:ce:60:15:19"],"mac-cnt":1,"packets":3,"port":52644},"spoofable":["true"],"spoofableCnt":1,"srcDscp":[8],"srcDscpCnt":1,"srcOui":["Huawei Technologies Co.,Ltd"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[117],"srcTTLCnt":1,"tags":["honeypot","bahrain-sponge-01-ts","sensor:bahrain-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["8192_2-1-3-1-1-4_1460_8","8192_2-1-1-4_1460_00"],"ja4tCnt":2},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":3,"syn-ack":0,"urg":0},"tcpseq":{"src":2079742221},"totDataBytes":0} +{"@timestamp":1788112934719,"_id":"260830-MDf_gXazIBJAcYeycEmG9C2y","_index":"arkime_sessions3-260830","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Kaopu Cloud HK Limited"],"isp.dstCnt":1,"isp.src":["Proton66 OOO"],"isp.srcCnt":1,"org.dst":["LightNode-BH"],"org.dstCnt":1,"org.src":["Proton66 OOO"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["business"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":0,"geo":{"country_iso_code":"BH"},"ip":"38.54.2.209","mac":["52:54:8f:9d:76:48"],"mac-cnt":1,"packets":0,"port":1500},"dstRIR":"ARIN","ethertype":2048,"fileId":[82029],"firstPacket":1788112159335,"ipProtocol":6,"lastPacket":1788112168336,"length":9001,"network":{"bytes":194,"community_id":"1:f/+/r0SXYpX7dy6jrOdJru5oQl0=","packets":3},"node":"spark-afae","packetPos":[-82029,104168,2331,2620],"packetRange":{"gte":1788112159335,"lte":1788112168336},"protocol":["tcp"],"protocolCnt":1,"rootId":"260830-MDf_gXazIBJAcYeycEmG9C2y","segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS198953 Proton66 OOO","number":198953,"organization":{"name":"Proton66 OOO"}},"bytes":194,"geo":{"country_iso_code":"RU"},"ip":"176.120.22.61","mac":["98:44:ce:60:15:19"],"mac-cnt":1,"packets":3,"port":52628},"spoofable":["true"],"spoofableCnt":1,"srcDscp":[8],"srcDscpCnt":1,"srcOui":["Huawei Technologies Co.,Ltd"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[117],"srcTTLCnt":1,"tags":["honeypot","bahrain-sponge-01-ts","sensor:bahrain-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["8192_2-1-3-1-1-4_1460_8","8192_2-1-1-4_1460_00"],"ja4tCnt":2},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":3,"syn-ack":0,"urg":0},"tcpseq":{"src":3109523257},"totDataBytes":0} +{"@timestamp":1788112934719,"_id":"260830-MDeJvnWVZJhOdoXlVrBWZeT0","_index":"arkime_sessions3-260830","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Kaopu Cloud HK Limited"],"isp.dstCnt":1,"isp.src":["Proton66 OOO"],"isp.srcCnt":1,"org.dst":["LightNode-BH"],"org.dstCnt":1,"org.src":["Proton66 OOO"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["business"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":0,"geo":{"country_iso_code":"BH"},"ip":"38.54.2.209","mac":["52:54:8f:9d:76:48"],"mac-cnt":1,"packets":0,"port":1501},"dstRIR":"ARIN","ethertype":2048,"fileId":[82029],"firstPacket":1788112159335,"ipProtocol":6,"lastPacket":1788112168336,"length":9001,"network":{"bytes":194,"community_id":"1:gqdL273BIzaUrKxcbbAjOsrZGRo=","packets":3},"node":"spark-afae","packetPos":[-82029,104250,2331,2616],"packetRange":{"gte":1788112159335,"lte":1788112168336},"protocol":["tcp"],"protocolCnt":1,"rootId":"260830-MDeJvnWVZJhOdoXlVrBWZeT0","segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS198953 Proton66 OOO","number":198953,"organization":{"name":"Proton66 OOO"}},"bytes":194,"geo":{"country_iso_code":"RU"},"ip":"176.120.22.61","mac":["98:44:ce:60:15:19"],"mac-cnt":1,"packets":3,"port":52629},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Huawei Technologies Co.,Ltd"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[118],"srcTTLCnt":1,"tags":["honeypot","bahrain-sponge-01-ts","sensor:bahrain-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["8192_2-1-3-1-1-4_1460_8","8192_2-1-1-4_1460_00"],"ja4tCnt":2},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":3,"syn-ack":0,"urg":0},"tcpseq":{"src":1012425512},"totDataBytes":0} +{"@timestamp":1788112934719,"_id":"260830-MDern2on-4dFFZPJOOb9utM8","_index":"arkime_sessions3-260830","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Kaopu Cloud HK Limited"],"isp.dstCnt":1,"isp.src":["Proton66 OOO"],"isp.srcCnt":1,"org.dst":["LightNode-BH"],"org.dstCnt":1,"org.src":["Proton66 OOO"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["business"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":0,"geo":{"country_iso_code":"BH"},"ip":"38.54.2.209","mac":["52:54:8f:9d:76:48"],"mac-cnt":1,"packets":0,"port":5005},"dstRIR":"ARIN","ethertype":2048,"fileId":[82029],"firstPacket":1788112159335,"ipProtocol":6,"lastPacket":1788112168335,"length":9000,"network":{"bytes":194,"community_id":"1:UM5k6VpBGSXfRFzp8XDvAD/rvg4=","packets":3},"node":"spark-afae","packetPos":[-82029,104414,2003,2624],"packetRange":{"gte":1788112159335,"lte":1788112168335},"protocol":["tcp"],"protocolCnt":1,"rootId":"260830-MDern2on-4dFFZPJOOb9utM8","segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS198953 Proton66 OOO","number":198953,"organization":{"name":"Proton66 OOO"}},"bytes":194,"geo":{"country_iso_code":"RU"},"ip":"176.120.22.61","mac":["98:44:ce:60:15:19"],"mac-cnt":1,"packets":3,"port":52638},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Huawei Technologies Co.,Ltd"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[118],"srcTTLCnt":1,"tags":["honeypot","bahrain-sponge-01-ts","sensor:bahrain-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["8192_2-1-3-1-1-4_1460_8","8192_2-1-1-4_1460_00"],"ja4tCnt":2},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":3,"syn-ack":0,"urg":0},"tcpseq":{"src":3796912439},"totDataBytes":0} +{"@timestamp":1788112934722,"_id":"260830-MDeqrUQ-EEpM35Ixy2OER7NU","_index":"arkime_sessions3-260830","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Kaopu Cloud HK Limited"],"isp.dstCnt":1,"isp.src":["Proton66 OOO"],"isp.srcCnt":1,"org.dst":["LightNode-BH"],"org.dstCnt":1,"org.src":["Proton66 OOO"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["business"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":0,"geo":{"country_iso_code":"BH"},"ip":"38.54.2.209","mac":["52:54:8f:9d:76:48"],"mac-cnt":1,"packets":0,"port":3333},"dstRIR":"ARIN","ethertype":2048,"fileId":[82029],"firstPacket":1788112159335,"ipProtocol":6,"lastPacket":1788112168332,"length":8997,"network":{"bytes":194,"community_id":"1:meR6nJxUBETtfoby7B5aiLfl0Ow=","packets":3},"node":"spark-afae","packetPos":[-82029,104332,1839,2636],"packetRange":{"gte":1788112159335,"lte":1788112168332},"protocol":["tcp"],"protocolCnt":1,"rootId":"260830-MDeqrUQ-EEpM35Ixy2OER7NU","segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS198953 Proton66 OOO","number":198953,"organization":{"name":"Proton66 OOO"}},"bytes":194,"geo":{"country_iso_code":"RU"},"ip":"176.120.22.61","mac":["98:44:ce:60:15:19"],"mac-cnt":1,"packets":3,"port":52634},"spoofable":["true"],"spoofableCnt":1,"srcDscp":[8],"srcDscpCnt":1,"srcOui":["Huawei Technologies Co.,Ltd"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[117],"srcTTLCnt":1,"tags":["honeypot","bahrain-sponge-01-ts","sensor:bahrain-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["8192_2-1-3-1-1-4_1460_8","65535_2-1-1-4_1460_00"],"ja4tCnt":2},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":3,"syn-ack":0,"urg":0},"tcpseq":{"src":1132740616},"totDataBytes":0} +{"@timestamp":1788112934722,"_id":"260830-MDdAg7Nc4BRPSKGfLBFQSGlC","_index":"arkime_sessions3-260830","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Kaopu Cloud HK Limited"],"isp.dstCnt":1,"isp.src":["Proton66 OOO"],"isp.srcCnt":1,"org.dst":["LightNode-BH"],"org.dstCnt":1,"org.src":["Proton66 OOO"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["business"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":0,"geo":{"country_iso_code":"BH"},"ip":"38.54.2.209","mac":["52:54:8f:9d:76:48"],"mac-cnt":1,"packets":0,"port":1433},"dstRIR":"ARIN","ethertype":2048,"fileId":[82029],"firstPacket":1788112159333,"ipProtocol":6,"lastPacket":1788112168329,"length":8996,"network":{"bytes":194,"community_id":"1:KVjSxgSYjXPjJeRT6xXTHrX5qQA=","packets":3},"node":"spark-afae","packetPos":[-82029,104086,1839,2648],"packetRange":{"gte":1788112159333,"lte":1788112168329},"protocol":["tcp"],"protocolCnt":1,"rootId":"260830-MDdAg7Nc4BRPSKGfLBFQSGlC","segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS198953 Proton66 OOO","number":198953,"organization":{"name":"Proton66 OOO"}},"bytes":194,"geo":{"country_iso_code":"RU"},"ip":"176.120.22.61","mac":["98:44:ce:60:15:19"],"mac-cnt":1,"packets":3,"port":52625},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Huawei Technologies Co.,Ltd"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[118],"srcTTLCnt":1,"tags":["honeypot","bahrain-sponge-01-ts","sensor:bahrain-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["8192_2-1-3-1-1-4_1460_8","65535_2-1-1-4_1460_00"],"ja4tCnt":2},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":3,"syn-ack":0,"urg":0},"tcpseq":{"src":2580259990},"totDataBytes":0} +{"@timestamp":1788112934722,"_id":"260830-MDduVNtM0qpEa64UxnLCc-K7","_index":"arkime_sessions3-260830","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Kaopu Cloud HK Limited"],"isp.dstCnt":1,"isp.src":["Proton66 OOO"],"isp.srcCnt":1,"org.dst":["LightNode-BH"],"org.dstCnt":1,"org.src":["Proton66 OOO"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["business"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":0,"geo":{"country_iso_code":"BH"},"ip":"38.54.2.209","mac":["52:54:8f:9d:76:48"],"mac-cnt":1,"packets":0,"port":4433},"dstRIR":"ARIN","ethertype":2048,"fileId":[82029],"firstPacket":1788112159332,"ipProtocol":6,"lastPacket":1788112168333,"length":9001,"network":{"bytes":194,"community_id":"1:dX5UCGqjDowHlkSm2cwgg0y15hg=","packets":3},"node":"spark-afae","packetPos":[-82029,104004,2331,2628],"packetRange":{"gte":1788112159332,"lte":1788112168333},"protocol":["tcp"],"protocolCnt":1,"rootId":"260830-MDduVNtM0qpEa64UxnLCc-K7","segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS198953 Proton66 OOO","number":198953,"organization":{"name":"Proton66 OOO"}},"bytes":194,"geo":{"country_iso_code":"RU"},"ip":"176.120.22.61","mac":["98:44:ce:60:15:19"],"mac-cnt":1,"packets":3,"port":52635},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Huawei Technologies Co.,Ltd"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[118],"srcTTLCnt":1,"tags":["honeypot","bahrain-sponge-01-ts","sensor:bahrain-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["8192_2-1-3-1-1-4_1460_8","8192_2-1-1-4_1460_00"],"ja4tCnt":2},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":3,"syn-ack":0,"urg":0},"tcpseq":{"src":1101358277},"totDataBytes":0} +{"@timestamp":1788112934722,"_id":"260830-MDdf-UA2rWxN0b9PMNA40fM4","_index":"arkime_sessions3-260830","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Kaopu Cloud HK Limited"],"isp.dstCnt":1,"isp.src":["Proton66 OOO"],"isp.srcCnt":1,"org.dst":["LightNode-BH"],"org.dstCnt":1,"org.src":["Proton66 OOO"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["business"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":0,"geo":{"country_iso_code":"BH"},"ip":"38.54.2.209","mac":["52:54:8f:9d:76:48"],"mac-cnt":1,"packets":0,"port":5678},"dstRIR":"ARIN","ethertype":2048,"fileId":[82029],"firstPacket":1788112159331,"ipProtocol":6,"lastPacket":1788112168330,"length":8999,"network":{"bytes":194,"community_id":"1:aCR1SBHf6WcVbsUx/dlXBQJJ2gg=","packets":3},"node":"spark-afae","packetPos":[-82029,103922,2085,2644],"packetRange":{"gte":1788112159331,"lte":1788112168330},"protocol":["tcp"],"protocolCnt":1,"rootId":"260830-MDdf-UA2rWxN0b9PMNA40fM4","segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS198953 Proton66 OOO","number":198953,"organization":{"name":"Proton66 OOO"}},"bytes":194,"geo":{"country_iso_code":"RU"},"ip":"176.120.22.61","mac":["98:44:ce:60:15:19"],"mac-cnt":1,"packets":3,"port":52643},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Huawei Technologies Co.,Ltd"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[118],"srcTTLCnt":1,"tags":["honeypot","bahrain-sponge-01-ts","sensor:bahrain-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["8192_2-1-3-1-1-4_1460_8","8192_2-1-1-4_1460_00"],"ja4tCnt":2},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":3,"syn-ack":0,"urg":0},"tcpseq":{"src":3671712436},"totDataBytes":0} +{"@timestamp":1788112934722,"_id":"260830-MDeR55WiXW5DgJu907NpucyU","_index":"arkime_sessions3-260830","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Kaopu Cloud HK Limited"],"isp.dstCnt":1,"isp.src":["Proton66 OOO"],"isp.srcCnt":1,"org.dst":["LightNode-BH"],"org.dstCnt":1,"org.src":["Proton66 OOO"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["business"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":0,"geo":{"country_iso_code":"BH"},"ip":"38.54.2.209","mac":["52:54:8f:9d:76:48"],"mac-cnt":1,"packets":0,"port":1434},"dstRIR":"ARIN","ethertype":2048,"fileId":[82029],"firstPacket":1788112159330,"ipProtocol":6,"lastPacket":1788112168327,"length":8997,"network":{"bytes":194,"community_id":"1:WDbjdCgYLceFVP+1s4m0DcJkSnA=","packets":3},"node":"spark-afae","packetPos":[-82029,103840,2003,2652],"packetRange":{"gte":1788112159330,"lte":1788112168327},"protocol":["tcp"],"protocolCnt":1,"rootId":"260830-MDeR55WiXW5DgJu907NpucyU","segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS198953 Proton66 OOO","number":198953,"organization":{"name":"Proton66 OOO"}},"bytes":194,"geo":{"country_iso_code":"RU"},"ip":"176.120.22.61","mac":["98:44:ce:60:15:19"],"mac-cnt":1,"packets":3,"port":52626},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Huawei Technologies Co.,Ltd"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[118],"srcTTLCnt":1,"tags":["honeypot","bahrain-sponge-01-ts","sensor:bahrain-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["8192_2-1-3-1-1-4_1460_8","8192_2-1-1-4_1460_00"],"ja4tCnt":2},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":3,"syn-ack":0,"urg":0},"tcpseq":{"src":2210081724},"totDataBytes":0} +{"@timestamp":1788112934722,"_id":"260830-MDd8uqH9cn1C66WZriNLrxCy","_index":"arkime_sessions3-260830","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Kaopu Cloud HK Limited"],"isp.dstCnt":1,"isp.src":["Proton66 OOO"],"isp.srcCnt":1,"org.dst":["LightNode-BH"],"org.dstCnt":1,"org.src":["Proton66 OOO"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["business"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":0,"geo":{"country_iso_code":"BH"},"ip":"38.54.2.209","mac":["52:54:8f:9d:76:48"],"mac-cnt":1,"packets":0,"port":12345},"dstRIR":"ARIN","ethertype":2048,"fileId":[82029],"firstPacket":1788112159329,"ipProtocol":6,"lastPacket":1788112168331,"length":9002,"network":{"bytes":194,"community_id":"1:d1Ra6KYymuRQV8eXRY8++EBPsKE=","packets":3},"node":"spark-afae","packetPos":[-82029,103758,2331,2640],"packetRange":{"gte":1788112159329,"lte":1788112168331},"protocol":["tcp"],"protocolCnt":1,"rootId":"260830-MDd8uqH9cn1C66WZriNLrxCy","segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS198953 Proton66 OOO","number":198953,"organization":{"name":"Proton66 OOO"}},"bytes":194,"geo":{"country_iso_code":"RU"},"ip":"176.120.22.61","mac":["98:44:ce:60:15:19"],"mac-cnt":1,"packets":3,"port":52624},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Huawei Technologies Co.,Ltd"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[118],"srcTTLCnt":1,"tags":["honeypot","bahrain-sponge-01-ts","sensor:bahrain-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["8192_2-1-3-1-1-4_1460_8","8192_2-1-1-4_1460_00"],"ja4tCnt":2},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":3,"syn-ack":0,"urg":0},"tcpseq":{"src":949184783},"totDataBytes":0} +{"@timestamp":1788006152283,"_id":"260829-wby7O_-D0LlMAbmYVg3OQOUq","_index":"arkime_sessions3-260829","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["netcup GmbH"],"isp.dstCnt":1,"isp.src":["Proton66 OOO"],"isp.srcCnt":1,"org.dst":["Netcup KVM"],"org.dstCnt":1,"org.src":["Proton66 OOO"],"org.srcCnt":1,"usertype.dst":["business"],"usertype.dstCnt":1,"usertype.src":["business"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS197540 netcup GmbH","number":197540,"organization":{"name":"netcup GmbH"}},"bytes":0,"geo":{"country_iso_code":"DE"},"ip":"159.195.21.150","mac":["8a:41:d3:b8:0d:d3"],"mac-cnt":1,"packets":0,"port":22222},"dstRIR":"ARIN","ethertype":2048,"fileId":[81316],"firstPacket":1788005478284,"ipProtocol":6,"lastPacket":1788005481284,"length":3000,"network":{"bytes":132,"community_id":"1:xYM8wpoXdQTsLZZZ8b1Q8yRpYik=","packets":2},"node":"spark-afae","packetPos":[-81316,325659,448],"packetRange":{"gte":1788005478284,"lte":1788005481284},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS198953 Proton66 OOO","number":198953,"organization":{"name":"Proton66 OOO"}},"bytes":132,"geo":{"country_iso_code":"RU"},"ip":"176.120.22.61","mac":["bc:0f:fe:38:0b:a3"],"mac-cnt":1,"packets":2,"port":19645},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[121],"srcTTLCnt":1,"tags":["honeypot","netcup-ts","sensor:netcup-ts"],"tagsCnt":3,"tcp":{"ja4t":["8192_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":2264969605},"totDataBytes":0} +{"@timestamp":1788006152281,"_id":"260829-wbxArDzDDR5F3a_APpy4Z3kq","_index":"arkime_sessions3-260829","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["netcup GmbH"],"isp.dstCnt":1,"isp.src":["Proton66 OOO"],"isp.srcCnt":1,"org.dst":["Netcup KVM"],"org.dstCnt":1,"org.src":["Proton66 OOO"],"org.srcCnt":1,"usertype.dst":["business"],"usertype.dstCnt":1,"usertype.src":["business"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS197540 netcup GmbH","number":197540,"organization":{"name":"netcup GmbH"}},"bytes":0,"geo":{"country_iso_code":"DE"},"ip":"159.195.21.150","mac":["8a:41:d3:b8:0d:d3"],"mac-cnt":1,"packets":0,"port":22222},"dstRIR":"ARIN","ethertype":2048,"fileId":[81316],"firstPacket":1788005471291,"ipProtocol":6,"lastPacket":1788005474291,"length":3000,"network":{"bytes":132,"community_id":"1:qLKhKpVWvNheeDoNzRGucLBBaE8=","packets":2},"node":"spark-afae","packetPos":[-81316,325045,442],"packetRange":{"gte":1788005471291,"lte":1788005474291},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS198953 Proton66 OOO","number":198953,"organization":{"name":"Proton66 OOO"}},"bytes":132,"geo":{"country_iso_code":"RU"},"ip":"176.120.22.61","mac":["bc:0f:fe:3d:a3:a7"],"mac-cnt":1,"packets":2,"port":25807},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[119],"srcTTLCnt":1,"tags":["honeypot","netcup-ts","sensor:netcup-ts"],"tagsCnt":3,"tcp":{"ja4t":["8192_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":1543411983},"totDataBytes":0} +{"@timestamp":1788006152279,"_id":"260829-wbyeR6h8f3VAwJH4fJQjFL1C","_index":"arkime_sessions3-260829","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["netcup GmbH"],"isp.dstCnt":1,"isp.src":["Proton66 OOO"],"isp.srcCnt":1,"org.dst":["Netcup KVM"],"org.dstCnt":1,"org.src":["Proton66 OOO"],"org.srcCnt":1,"usertype.dst":["business"],"usertype.dstCnt":1,"usertype.src":["business"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS197540 netcup GmbH","number":197540,"organization":{"name":"netcup GmbH"}},"bytes":0,"geo":{"country_iso_code":"DE"},"ip":"159.195.21.150","mac":["8a:41:d3:b8:0d:d3"],"mac-cnt":1,"packets":0,"port":22222},"dstRIR":"ARIN","ethertype":2048,"fileId":[81316],"firstPacket":1788005464283,"ipProtocol":6,"lastPacket":1788005467280,"length":2997,"network":{"bytes":132,"community_id":"1:qsciZ8YXgCc+Ii5veF5AAr/dBWk=","packets":2},"node":"spark-afae","packetPos":[-81316,323673,334],"packetRange":{"gte":1788005464283,"lte":1788005467280},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS198953 Proton66 OOO","number":198953,"organization":{"name":"Proton66 OOO"}},"bytes":132,"geo":{"country_iso_code":"RU"},"ip":"176.120.22.61","mac":["bc:0f:fe:38:0b:a3"],"mac-cnt":1,"packets":2,"port":2931},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[121],"srcTTLCnt":1,"tags":["honeypot","netcup-ts","sensor:netcup-ts"],"tagsCnt":3,"tcp":{"ja4t":["8192_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":902270654},"totDataBytes":0} +{"@timestamp":1788006152283,"_id":"260829-wbzCBq-pIHtAfpDp3hYdWTFn","_index":"arkime_sessions3-260829","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["netcup GmbH"],"isp.dstCnt":1,"isp.src":["Proton66 OOO"],"isp.srcCnt":1,"org.dst":["Netcup KVM"],"org.dstCnt":1,"org.src":["Proton66 OOO"],"org.srcCnt":1,"usertype.dst":["business"],"usertype.dstCnt":1,"usertype.src":["business"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS197540 netcup GmbH","number":197540,"organization":{"name":"netcup GmbH"}},"bytes":0,"geo":{"country_iso_code":"DE"},"ip":"159.195.21.150","mac":["8a:41:d3:b8:0d:d3"],"mac-cnt":1,"packets":0,"port":22222},"dstRIR":"ARIN","ethertype":2048,"fileId":[81316],"firstPacket":1788005457282,"ipProtocol":6,"lastPacket":1788005460288,"length":3006,"network":{"bytes":132,"community_id":"1:X81R841BVxDo3dacXeCks3B61rc=","packets":2},"node":"spark-afae","packetPos":[-81316,322389,532],"packetRange":{"gte":1788005457282,"lte":1788005460288},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS198953 Proton66 OOO","number":198953,"organization":{"name":"Proton66 OOO"}},"bytes":132,"geo":{"country_iso_code":"RU"},"ip":"176.120.22.61","mac":["bc:0f:fe:38:0b:a3"],"mac-cnt":1,"packets":2,"port":54748},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[121],"srcTTLCnt":1,"tags":["honeypot","netcup-ts","sensor:netcup-ts"],"tagsCnt":3,"tcp":{"ja4t":["8192_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":980989782},"totDataBytes":0} +{"@timestamp":1788006152284,"_id":"260829-wbwzT_tkAQBLWZbjPWY7Nfg8","_index":"arkime_sessions3-260829","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["netcup GmbH"],"isp.dstCnt":1,"isp.src":["Proton66 OOO"],"isp.srcCnt":1,"org.dst":["Netcup KVM"],"org.dstCnt":1,"org.src":["Proton66 OOO"],"org.srcCnt":1,"usertype.dst":["business"],"usertype.dstCnt":1,"usertype.src":["business"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS197540 netcup GmbH","number":197540,"organization":{"name":"netcup GmbH"}},"bytes":0,"geo":{"country_iso_code":"DE"},"ip":"159.195.21.150","mac":["8a:41:d3:b8:0d:d3"],"mac-cnt":1,"packets":0,"port":22222},"dstRIR":"ARIN","ethertype":2048,"fileId":[81316],"firstPacket":1788005450287,"ipProtocol":6,"lastPacket":1788005453292,"length":3005,"network":{"bytes":132,"community_id":"1:aaOdqjqLaZETuZ/O382V4yTjA2U=","packets":2},"node":"spark-afae","packetPos":[-81316,320956,1017],"packetRange":{"gte":1788005450287,"lte":1788005453292},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS198953 Proton66 OOO","number":198953,"organization":{"name":"Proton66 OOO"}},"bytes":132,"geo":{"country_iso_code":"RU"},"ip":"176.120.22.61","mac":["bc:0f:fe:3d:a3:a7"],"mac-cnt":1,"packets":2,"port":44875},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[119],"srcTTLCnt":1,"tags":["honeypot","netcup-ts","sensor:netcup-ts"],"tagsCnt":3,"tcp":{"ja4t":["8192_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":208868613},"totDataBytes":0} +{"@timestamp":1788006152280,"_id":"260829-wbxEJprjw71HgbR4EOftZwEe","_index":"arkime_sessions3-260829","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["netcup GmbH"],"isp.dstCnt":1,"isp.src":["Proton66 OOO"],"isp.srcCnt":1,"org.dst":["Netcup KVM"],"org.dstCnt":1,"org.src":["Proton66 OOO"],"org.srcCnt":1,"usertype.dst":["business"],"usertype.dstCnt":1,"usertype.src":["business"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS197540 netcup GmbH","number":197540,"organization":{"name":"netcup GmbH"}},"bytes":0,"geo":{"country_iso_code":"DE"},"ip":"159.195.21.150","mac":["8a:41:d3:b8:0d:d3"],"mac-cnt":1,"packets":0,"port":2222},"dstRIR":"ARIN","ethertype":2048,"fileId":[81316],"firstPacket":1788005448720,"ipProtocol":6,"lastPacket":1788005451720,"length":3000,"network":{"bytes":132,"community_id":"1:BiSgMwpl93RJjkE+EfUrNJNMRkk=","packets":2},"node":"spark-afae","packetPos":[-81316,320514,982],"packetRange":{"gte":1788005448720,"lte":1788005451720},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS198953 Proton66 OOO","number":198953,"organization":{"name":"Proton66 OOO"}},"bytes":132,"geo":{"country_iso_code":"RU"},"ip":"176.120.22.61","mac":["bc:0f:fe:3d:a3:a7"],"mac-cnt":1,"packets":2,"port":31207},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[119],"srcTTLCnt":1,"tags":["honeypot","netcup-ts","sensor:netcup-ts"],"tagsCnt":3,"tcp":{"ja4t":["8192_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":414791664},"totDataBytes":0} +{"@timestamp":1788006152281,"_id":"260829-wbzWeg0OC5FMu78_USf7o1ly","_index":"arkime_sessions3-260829","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["netcup GmbH"],"isp.dstCnt":1,"isp.src":["Proton66 OOO"],"isp.srcCnt":1,"org.dst":["Netcup KVM"],"org.dstCnt":1,"org.src":["Proton66 OOO"],"org.srcCnt":1,"usertype.dst":["business"],"usertype.dstCnt":1,"usertype.src":["business"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS197540 netcup GmbH","number":197540,"organization":{"name":"netcup GmbH"}},"bytes":0,"geo":{"country_iso_code":"DE"},"ip":"159.195.21.150","mac":["8a:41:d3:b8:0d:d3"],"mac-cnt":1,"packets":0,"port":22222},"dstRIR":"ARIN","ethertype":2048,"fileId":[81316],"firstPacket":1788005443282,"ipProtocol":6,"lastPacket":1788005446282,"length":3000,"network":{"bytes":132,"community_id":"1:QhTVytbHkUimH3NheqP6YYtapSo=","packets":2},"node":"spark-afae","packetPos":[-81316,311761,600],"packetRange":{"gte":1788005443282,"lte":1788005446282},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS198953 Proton66 OOO","number":198953,"organization":{"name":"Proton66 OOO"}},"bytes":132,"geo":{"country_iso_code":"RU"},"ip":"176.120.22.61","mac":["bc:0f:fe:38:0b:a3"],"mac-cnt":1,"packets":2,"port":54692},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[121],"srcTTLCnt":1,"tags":["honeypot","netcup-ts","sensor:netcup-ts"],"tagsCnt":3,"tcp":{"ja4t":["8192_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":2574055230},"totDataBytes":0} +{"@timestamp":1788006152280,"_id":"260829-wbwjMoBMwBtB8b3E-JBF92vv","_index":"arkime_sessions3-260829","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["netcup GmbH"],"isp.dstCnt":1,"isp.src":["Proton66 OOO"],"isp.srcCnt":1,"org.dst":["Netcup KVM"],"org.dstCnt":1,"org.src":["Proton66 OOO"],"org.srcCnt":1,"usertype.dst":["business"],"usertype.dstCnt":1,"usertype.src":["business"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS197540 netcup GmbH","number":197540,"organization":{"name":"netcup GmbH"}},"bytes":0,"geo":{"country_iso_code":"DE"},"ip":"159.195.21.150","mac":["8a:41:d3:b8:0d:d3"],"mac-cnt":1,"packets":0,"port":2222},"dstRIR":"ARIN","ethertype":2048,"fileId":[81316],"firstPacket":1788005441718,"ipProtocol":6,"lastPacket":1788005444718,"length":3000,"network":{"bytes":132,"community_id":"1:aUditjwwmUIWqF8Tf3oaHIhaT0g=","packets":2},"node":"spark-afae","packetPos":[-81316,311679,326],"packetRange":{"gte":1788005441718,"lte":1788005444718},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS198953 Proton66 OOO","number":198953,"organization":{"name":"Proton66 OOO"}},"bytes":132,"geo":{"country_iso_code":"RU"},"ip":"176.120.22.61","mac":["bc:0f:fe:3d:a3:a7"],"mac-cnt":1,"packets":2,"port":28205},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[119],"srcTTLCnt":1,"tags":["honeypot","netcup-ts","sensor:netcup-ts"],"tagsCnt":3,"tcp":{"ja4t":["8192_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":2101126976},"totDataBytes":0} +{"@timestamp":1788006152280,"_id":"260829-wbwrEL3KE2FPOLUND_oyOJqV","_index":"arkime_sessions3-260829","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["netcup GmbH"],"isp.dstCnt":1,"isp.src":["Proton66 OOO"],"isp.srcCnt":1,"org.dst":["Netcup KVM"],"org.dstCnt":1,"org.src":["Proton66 OOO"],"org.srcCnt":1,"usertype.dst":["business"],"usertype.dstCnt":1,"usertype.src":["business"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS197540 netcup GmbH","number":197540,"organization":{"name":"netcup GmbH"}},"bytes":0,"geo":{"country_iso_code":"DE"},"ip":"159.195.21.150","mac":["8a:41:d3:b8:0d:d3"],"mac-cnt":1,"packets":0,"port":22222},"dstRIR":"ARIN","ethertype":2048,"fileId":[81316],"firstPacket":1788005436291,"ipProtocol":6,"lastPacket":1788005439288,"length":2997,"network":{"bytes":132,"community_id":"1:6Pi+9wmX7sNvVYjcVaDB5YB9E5o=","packets":2},"node":"spark-afae","packetPos":[-81316,305089,896],"packetRange":{"gte":1788005436291,"lte":1788005439288},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS198953 Proton66 OOO","number":198953,"organization":{"name":"Proton66 OOO"}},"bytes":132,"geo":{"country_iso_code":"RU"},"ip":"176.120.22.61","mac":["bc:0f:fe:3d:a3:a7"],"mac-cnt":1,"packets":2,"port":29091},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[119],"srcTTLCnt":1,"tags":["honeypot","netcup-ts","sensor:netcup-ts"],"tagsCnt":3,"tcp":{"ja4t":["8192_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":3202895285},"totDataBytes":0} +{"@timestamp":1788006152280,"_id":"260829-wbzMY6A--9tMMrsRG3K9K9rc","_index":"arkime_sessions3-260829","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["netcup GmbH"],"isp.dstCnt":1,"isp.src":["Proton66 OOO"],"isp.srcCnt":1,"org.dst":["Netcup KVM"],"org.dstCnt":1,"org.src":["Proton66 OOO"],"org.srcCnt":1,"usertype.dst":["business"],"usertype.dstCnt":1,"usertype.src":["business"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS197540 netcup GmbH","number":197540,"organization":{"name":"netcup GmbH"}},"bytes":0,"geo":{"country_iso_code":"DE"},"ip":"159.195.21.150","mac":["8a:41:d3:b8:0d:d3"],"mac-cnt":1,"packets":0,"port":2222},"dstRIR":"ARIN","ethertype":2048,"fileId":[81316],"firstPacket":1788005434713,"ipProtocol":6,"lastPacket":1788005437717,"length":3004,"network":{"bytes":132,"community_id":"1:86meJU8fo2BpfvPHJyKNO55m3Io=","packets":2},"node":"spark-afae","packetPos":[-81316,300048,5557],"packetRange":{"gte":1788005434713,"lte":1788005437717},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS198953 Proton66 OOO","number":198953,"organization":{"name":"Proton66 OOO"}},"bytes":132,"geo":{"country_iso_code":"RU"},"ip":"176.120.22.61","mac":["bc:0f:fe:38:0b:a3"],"mac-cnt":1,"packets":2,"port":9647},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[121],"srcTTLCnt":1,"tags":["honeypot","netcup-ts","sensor:netcup-ts"],"tagsCnt":3,"tcp":{"ja4t":["8192_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":3260619754},"totDataBytes":0} +{"@timestamp":1788006152283,"_id":"260829-wbxJPPYP2OdIMqCfuDnpygE0","_index":"arkime_sessions3-260829","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["netcup GmbH"],"isp.dstCnt":1,"isp.src":["Proton66 OOO"],"isp.srcCnt":1,"org.dst":["Netcup KVM"],"org.dstCnt":1,"org.src":["Proton66 OOO"],"org.srcCnt":1,"usertype.dst":["business"],"usertype.dstCnt":1,"usertype.src":["business"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS197540 netcup GmbH","number":197540,"organization":{"name":"netcup GmbH"}},"bytes":0,"geo":{"country_iso_code":"DE"},"ip":"159.195.21.150","mac":["8a:41:d3:b8:0d:d3"],"mac-cnt":1,"packets":0,"port":22222},"dstRIR":"ARIN","ethertype":2048,"fileId":[81316],"firstPacket":1788005429291,"ipProtocol":6,"lastPacket":1788005432297,"length":3006,"network":{"bytes":132,"community_id":"1:gQreJljiy4fGn4cYrMMP68GWKok=","packets":2},"node":"spark-afae","packetPos":[-81316,298362,990],"packetRange":{"gte":1788005429291,"lte":1788005432297},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS198953 Proton66 OOO","number":198953,"organization":{"name":"Proton66 OOO"}},"bytes":132,"geo":{"country_iso_code":"RU"},"ip":"176.120.22.61","mac":["bc:0f:fe:3d:a3:a7"],"mac-cnt":1,"packets":2,"port":45244},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[119],"srcTTLCnt":1,"tags":["honeypot","netcup-ts","sensor:netcup-ts"],"tagsCnt":3,"tcp":{"ja4t":["8192_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":2130577374},"totDataBytes":0} +{"@timestamp":1788006152280,"_id":"260829-wbzZGeLVxMJFTr0ee1b-JJq9","_index":"arkime_sessions3-260829","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["netcup GmbH"],"isp.dstCnt":1,"isp.src":["Proton66 OOO"],"isp.srcCnt":1,"org.dst":["Netcup KVM"],"org.dstCnt":1,"org.src":["Proton66 OOO"],"org.srcCnt":1,"usertype.dst":["business"],"usertype.dstCnt":1,"usertype.src":["business"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS197540 netcup GmbH","number":197540,"organization":{"name":"netcup GmbH"}},"bytes":0,"geo":{"country_iso_code":"DE"},"ip":"159.195.21.150","mac":["8a:41:d3:b8:0d:d3"],"mac-cnt":1,"packets":0,"port":2222},"dstRIR":"ARIN","ethertype":2048,"fileId":[81316],"firstPacket":1788005427708,"ipProtocol":6,"lastPacket":1788005430708,"length":3000,"network":{"bytes":132,"community_id":"1:oHolpRs3wYvXKKrbYAOWfk4kXEE=","packets":2},"node":"spark-afae","packetPos":[-81316,297679,1125],"packetRange":{"gte":1788005427708,"lte":1788005430708},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS198953 Proton66 OOO","number":198953,"organization":{"name":"Proton66 OOO"}},"bytes":132,"geo":{"country_iso_code":"RU"},"ip":"176.120.22.61","mac":["bc:0f:fe:38:0b:a3"],"mac-cnt":1,"packets":2,"port":27052},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[121],"srcTTLCnt":1,"tags":["honeypot","netcup-ts","sensor:netcup-ts"],"tagsCnt":3,"tcp":{"ja4t":["8192_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":1370512258},"totDataBytes":0} +{"@timestamp":1788006152283,"_id":"260829-wbyhBOmiGIZAL4MWruRQrqPL","_index":"arkime_sessions3-260829","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["netcup GmbH"],"isp.dstCnt":1,"isp.src":["Proton66 OOO"],"isp.srcCnt":1,"org.dst":["Netcup KVM"],"org.dstCnt":1,"org.src":["Proton66 OOO"],"org.srcCnt":1,"usertype.dst":["business"],"usertype.dstCnt":1,"usertype.src":["business"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS197540 netcup GmbH","number":197540,"organization":{"name":"netcup GmbH"}},"bytes":0,"geo":{"country_iso_code":"DE"},"ip":"159.195.21.150","mac":["8a:41:d3:b8:0d:d3"],"mac-cnt":1,"packets":0,"port":22222},"dstRIR":"ARIN","ethertype":2048,"fileId":[81316],"firstPacket":1788005422281,"ipProtocol":6,"lastPacket":1788005425288,"length":3007,"network":{"bytes":132,"community_id":"1:j/Yyh8wol16INHj8VBrbbmLKrYk=","packets":2},"node":"spark-afae","packetPos":[-81316,296367,690],"packetRange":{"gte":1788005422281,"lte":1788005425288},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS198953 Proton66 OOO","number":198953,"organization":{"name":"Proton66 OOO"}},"bytes":132,"geo":{"country_iso_code":"RU"},"ip":"176.120.22.61","mac":["bc:0f:fe:38:0b:a3"],"mac-cnt":1,"packets":2,"port":52933},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[121],"srcTTLCnt":1,"tags":["honeypot","netcup-ts","sensor:netcup-ts"],"tagsCnt":3,"tcp":{"ja4t":["8192_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":238384640},"totDataBytes":0} +{"@timestamp":1788006152279,"_id":"260829-wbziY4pTF-JMA4LfPwzOiY3v","_index":"arkime_sessions3-260829","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["netcup GmbH"],"isp.dstCnt":1,"isp.src":["Proton66 OOO"],"isp.srcCnt":1,"org.dst":["Netcup KVM"],"org.dstCnt":1,"org.src":["Proton66 OOO"],"org.srcCnt":1,"usertype.dst":["business"],"usertype.dstCnt":1,"usertype.src":["business"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS197540 netcup GmbH","number":197540,"organization":{"name":"netcup GmbH"}},"bytes":0,"geo":{"country_iso_code":"DE"},"ip":"159.195.21.150","mac":["8a:41:d3:b8:0d:d3"],"mac-cnt":1,"packets":0,"port":2222},"dstRIR":"ARIN","ethertype":2048,"fileId":[81316],"firstPacket":1788005420708,"ipProtocol":6,"lastPacket":1788005423708,"length":3000,"network":{"bytes":132,"community_id":"1:rUVSfXWU4un9lLvPXUDMJM9VZzQ=","packets":2},"node":"spark-afae","packetPos":[-81316,295885,834],"packetRange":{"gte":1788005420708,"lte":1788005423708},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS198953 Proton66 OOO","number":198953,"organization":{"name":"Proton66 OOO"}},"bytes":132,"geo":{"country_iso_code":"RU"},"ip":"176.120.22.61","mac":["bc:0f:fe:38:0b:a3"],"mac-cnt":1,"packets":2,"port":30991},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[121],"srcTTLCnt":1,"tags":["honeypot","netcup-ts","sensor:netcup-ts"],"tagsCnt":3,"tcp":{"ja4t":["8192_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":1085192892},"totDataBytes":0} +{"@timestamp":1788006152279,"_id":"260829-wbyOPs1JeqZJGY4O9AFI3gHl","_index":"arkime_sessions3-260829","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["netcup GmbH"],"isp.dstCnt":1,"isp.src":["Proton66 OOO"],"isp.srcCnt":1,"org.dst":["Netcup KVM"],"org.dstCnt":1,"org.src":["Proton66 OOO"],"org.srcCnt":1,"usertype.dst":["business"],"usertype.dstCnt":1,"usertype.src":["business"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS197540 netcup GmbH","number":197540,"organization":{"name":"netcup GmbH"}},"bytes":0,"geo":{"country_iso_code":"DE"},"ip":"159.195.21.150","mac":["8a:41:d3:b8:0d:d3"],"mac-cnt":1,"packets":0,"port":22222},"dstRIR":"ARIN","ethertype":2048,"fileId":[81316],"firstPacket":1788005415285,"ipProtocol":6,"lastPacket":1788005418285,"length":3000,"network":{"bytes":132,"community_id":"1:kwMjbHrvedXq4qhmRMN82P48KBs=","packets":2},"node":"spark-afae","packetPos":[-81316,295239,368],"packetRange":{"gte":1788005415285,"lte":1788005418285},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS198953 Proton66 OOO","number":198953,"organization":{"name":"Proton66 OOO"}},"bytes":132,"geo":{"country_iso_code":"RU"},"ip":"176.120.22.61","mac":["bc:0f:fe:3d:a3:a7"],"mac-cnt":1,"packets":2,"port":35805},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[119],"srcTTLCnt":1,"tags":["honeypot","netcup-ts","sensor:netcup-ts"],"tagsCnt":3,"tcp":{"ja4t":["8192_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":686292296},"totDataBytes":0} +{"@timestamp":1788006152279,"_id":"260829-wbyhwWtxF8JBO5WiYsfvLdCx","_index":"arkime_sessions3-260829","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["netcup GmbH"],"isp.dstCnt":1,"isp.src":["Proton66 OOO"],"isp.srcCnt":1,"org.dst":["Netcup KVM"],"org.dstCnt":1,"org.src":["Proton66 OOO"],"org.srcCnt":1,"usertype.dst":["business"],"usertype.dstCnt":1,"usertype.src":["business"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS197540 netcup GmbH","number":197540,"organization":{"name":"netcup GmbH"}},"bytes":0,"geo":{"country_iso_code":"DE"},"ip":"159.195.21.150","mac":["8a:41:d3:b8:0d:d3"],"mac-cnt":1,"packets":0,"port":2222},"dstRIR":"ARIN","ethertype":2048,"fileId":[81316],"firstPacket":1788005413719,"ipProtocol":6,"lastPacket":1788005416715,"length":2996,"network":{"bytes":132,"community_id":"1:AWH501FGQyrhVLT1PkzHEfC7T78=","packets":2},"node":"spark-afae","packetPos":[-81316,294961,564],"packetRange":{"gte":1788005413719,"lte":1788005416715},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS198953 Proton66 OOO","number":198953,"organization":{"name":"Proton66 OOO"}},"bytes":132,"geo":{"country_iso_code":"RU"},"ip":"176.120.22.61","mac":["bc:0f:fe:3d:a3:a7"],"mac-cnt":1,"packets":2,"port":21603},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[119],"srcTTLCnt":1,"tags":["honeypot","netcup-ts","sensor:netcup-ts"],"tagsCnt":3,"tcp":{"ja4t":["8192_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":1257081650},"totDataBytes":0} +{"@timestamp":1788006152280,"_id":"260829-wbyQe2W-ZgVKd6baqXt61_fR","_index":"arkime_sessions3-260829","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["netcup GmbH"],"isp.dstCnt":1,"isp.src":["Proton66 OOO"],"isp.srcCnt":1,"org.dst":["Netcup KVM"],"org.dstCnt":1,"org.src":["Proton66 OOO"],"org.srcCnt":1,"usertype.dst":["business"],"usertype.dstCnt":1,"usertype.src":["business"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS197540 netcup GmbH","number":197540,"organization":{"name":"netcup GmbH"}},"bytes":0,"geo":{"country_iso_code":"DE"},"ip":"159.195.21.150","mac":["8a:41:d3:b8:0d:d3"],"mac-cnt":1,"packets":0,"port":22222},"dstRIR":"ARIN","ethertype":2048,"fileId":[81316],"firstPacket":1788005408286,"ipProtocol":6,"lastPacket":1788005411289,"length":3003,"network":{"bytes":132,"community_id":"1:Emo+eq2bsPuEe+jpHMvcXKRmB/0=","packets":2},"node":"spark-afae","packetPos":[-81316,294643,164],"packetRange":{"gte":1788005408286,"lte":1788005411289},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS198953 Proton66 OOO","number":198953,"organization":{"name":"Proton66 OOO"}},"bytes":132,"geo":{"country_iso_code":"RU"},"ip":"176.120.22.61","mac":["bc:0f:fe:3d:a3:a7"],"mac-cnt":1,"packets":2,"port":5230},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[119],"srcTTLCnt":1,"tags":["honeypot","netcup-ts","sensor:netcup-ts"],"tagsCnt":3,"tcp":{"ja4t":["8192_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":2774556211},"totDataBytes":0} +{"@timestamp":1788006152279,"_id":"260829-wbw7gVzKhHpPSL0YsKgAzzp2","_index":"arkime_sessions3-260829","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["netcup GmbH"],"isp.dstCnt":1,"isp.src":["Proton66 OOO"],"isp.srcCnt":1,"org.dst":["Netcup KVM"],"org.dstCnt":1,"org.src":["Proton66 OOO"],"org.srcCnt":1,"usertype.dst":["business"],"usertype.dstCnt":1,"usertype.src":["business"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS197540 netcup GmbH","number":197540,"organization":{"name":"netcup GmbH"}},"bytes":0,"geo":{"country_iso_code":"DE"},"ip":"159.195.21.150","mac":["8a:41:d3:b8:0d:d3"],"mac-cnt":1,"packets":0,"port":2222},"dstRIR":"ARIN","ethertype":2048,"fileId":[81316],"firstPacket":1788005406707,"ipProtocol":6,"lastPacket":1788005409712,"length":3005,"network":{"bytes":132,"community_id":"1:ve75C77cbsZ2fBVHTvoJa0ZMWbM=","packets":2},"node":"spark-afae","packetPos":[-81316,294357,368],"packetRange":{"gte":1788005406707,"lte":1788005409712},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS198953 Proton66 OOO","number":198953,"organization":{"name":"Proton66 OOO"}},"bytes":132,"geo":{"country_iso_code":"RU"},"ip":"176.120.22.61","mac":["bc:0f:fe:38:0b:a3"],"mac-cnt":1,"packets":2,"port":39808},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[121],"srcTTLCnt":1,"tags":["honeypot","netcup-ts","sensor:netcup-ts"],"tagsCnt":3,"tcp":{"ja4t":["8192_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":2282683438},"totDataBytes":0} +{"@timestamp":1788006152284,"_id":"260829-wbxDxunRAAFF0YXiAbBL7oAY","_index":"arkime_sessions3-260829","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["netcup GmbH"],"isp.dstCnt":1,"isp.src":["Proton66 OOO"],"isp.srcCnt":1,"org.dst":["Netcup KVM"],"org.dstCnt":1,"org.src":["Proton66 OOO"],"org.srcCnt":1,"usertype.dst":["business"],"usertype.dstCnt":1,"usertype.src":["business"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS197540 netcup GmbH","number":197540,"organization":{"name":"netcup GmbH"}},"bytes":0,"geo":{"country_iso_code":"DE"},"ip":"159.195.21.150","mac":["8a:41:d3:b8:0d:d3"],"mac-cnt":1,"packets":0,"port":22222},"dstRIR":"ARIN","ethertype":2048,"fileId":[81316],"firstPacket":1788005401285,"ipProtocol":6,"lastPacket":1788005404285,"length":3000,"network":{"bytes":132,"community_id":"1:dFUk9wgRD9GeMYnBIrzUfxpIL7E=","packets":2},"node":"spark-afae","packetPos":[-81316,293327,516],"packetRange":{"gte":1788005401285,"lte":1788005404285},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS198953 Proton66 OOO","number":198953,"organization":{"name":"Proton66 OOO"}},"bytes":132,"geo":{"country_iso_code":"RU"},"ip":"176.120.22.61","mac":["bc:0f:fe:3d:a3:a7"],"mac-cnt":1,"packets":2,"port":37929},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[119],"srcTTLCnt":1,"tags":["honeypot","netcup-ts","sensor:netcup-ts"],"tagsCnt":3,"tcp":{"ja4t":["8192_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":1542265539},"totDataBytes":0} +{"@timestamp":1788006152280,"_id":"260829-wbzBgoLFaDJJK5_rRJe12pDK","_index":"arkime_sessions3-260829","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["netcup GmbH"],"isp.dstCnt":1,"isp.src":["Proton66 OOO"],"isp.srcCnt":1,"org.dst":["Netcup KVM"],"org.dstCnt":1,"org.src":["Proton66 OOO"],"org.srcCnt":1,"usertype.dst":["business"],"usertype.dstCnt":1,"usertype.src":["business"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS197540 netcup GmbH","number":197540,"organization":{"name":"netcup GmbH"}},"bytes":0,"geo":{"country_iso_code":"DE"},"ip":"159.195.21.150","mac":["8a:41:d3:b8:0d:d3"],"mac-cnt":1,"packets":0,"port":2222},"dstRIR":"ARIN","ethertype":2048,"fileId":[81316],"firstPacket":1788005399708,"ipProtocol":6,"lastPacket":1788005402706,"length":2998,"network":{"bytes":132,"community_id":"1:d2C5lW01dTiR0d4SrXkHeIQSmrI=","packets":2},"node":"spark-afae","packetPos":[-81316,292903,596],"packetRange":{"gte":1788005399708,"lte":1788005402706},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS198953 Proton66 OOO","number":198953,"organization":{"name":"Proton66 OOO"}},"bytes":132,"geo":{"country_iso_code":"RU"},"ip":"176.120.22.61","mac":["bc:0f:fe:38:0b:a3"],"mac-cnt":1,"packets":2,"port":20171},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[121],"srcTTLCnt":1,"tags":["honeypot","netcup-ts","sensor:netcup-ts"],"tagsCnt":3,"tcp":{"ja4t":["8192_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":2046569135},"totDataBytes":0} +{"@timestamp":1788006152283,"_id":"260829-wbyfensCmPdKVpssyZxlQB62","_index":"arkime_sessions3-260829","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["netcup GmbH"],"isp.dstCnt":1,"isp.src":["Proton66 OOO"],"isp.srcCnt":1,"org.dst":["Netcup KVM"],"org.dstCnt":1,"org.src":["Proton66 OOO"],"org.srcCnt":1,"usertype.dst":["business"],"usertype.dstCnt":1,"usertype.src":["business"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS197540 netcup GmbH","number":197540,"organization":{"name":"netcup GmbH"}},"bytes":0,"geo":{"country_iso_code":"DE"},"ip":"159.195.21.150","mac":["8a:41:d3:b8:0d:d3"],"mac-cnt":1,"packets":0,"port":22222},"dstRIR":"ARIN","ethertype":2048,"fileId":[81316],"firstPacket":1788005394288,"ipProtocol":6,"lastPacket":1788005397287,"length":2999,"network":{"bytes":132,"community_id":"1:1kP6AigdxSr2cMYkOYezcbOuhw0=","packets":2},"node":"spark-afae","packetPos":[-81316,292314,164],"packetRange":{"gte":1788005394288,"lte":1788005397287},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS198953 Proton66 OOO","number":198953,"organization":{"name":"Proton66 OOO"}},"bytes":132,"geo":{"country_iso_code":"RU"},"ip":"176.120.22.61","mac":["bc:0f:fe:3d:a3:a7"],"mac-cnt":1,"packets":2,"port":49200},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[119],"srcTTLCnt":1,"tags":["honeypot","netcup-ts","sensor:netcup-ts"],"tagsCnt":3,"tcp":{"ja4t":["8192_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":784407058},"totDataBytes":0} +{"@timestamp":1788006152280,"_id":"260829-wbxAZJIZhCRBIr47bPw01l5s","_index":"arkime_sessions3-260829","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["netcup GmbH"],"isp.dstCnt":1,"isp.src":["Proton66 OOO"],"isp.srcCnt":1,"org.dst":["Netcup KVM"],"org.dstCnt":1,"org.src":["Proton66 OOO"],"org.srcCnt":1,"usertype.dst":["business"],"usertype.dstCnt":1,"usertype.src":["business"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS197540 netcup GmbH","number":197540,"organization":{"name":"netcup GmbH"}},"bytes":0,"geo":{"country_iso_code":"DE"},"ip":"159.195.21.150","mac":["8a:41:d3:b8:0d:d3"],"mac-cnt":1,"packets":0,"port":2222},"dstRIR":"ARIN","ethertype":2048,"fileId":[81316],"firstPacket":1788005392725,"ipProtocol":6,"lastPacket":1788005395726,"length":3001,"network":{"bytes":132,"community_id":"1:DipOp0S7VuZ+GuueGhsdGfCIjcw=","packets":2},"node":"spark-afae","packetPos":[-81316,291898,498],"packetRange":{"gte":1788005392725,"lte":1788005395726},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS198953 Proton66 OOO","number":198953,"organization":{"name":"Proton66 OOO"}},"bytes":132,"geo":{"country_iso_code":"RU"},"ip":"176.120.22.61","mac":["bc:0f:fe:3d:a3:a7"],"mac-cnt":1,"packets":2,"port":29396},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[118],"srcTTLCnt":1,"tags":["honeypot","netcup-ts","sensor:netcup-ts"],"tagsCnt":3,"tcp":{"ja4t":["8192_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":2713014452},"totDataBytes":0} +{"@timestamp":1788006152281,"_id":"260829-wbzn3oXGICtNpr-QJeSB31oZ","_index":"arkime_sessions3-260829","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["netcup GmbH"],"isp.dstCnt":1,"isp.src":["Proton66 OOO"],"isp.srcCnt":1,"org.dst":["Netcup KVM"],"org.dstCnt":1,"org.src":["Proton66 OOO"],"org.srcCnt":1,"usertype.dst":["business"],"usertype.dstCnt":1,"usertype.src":["business"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS197540 netcup GmbH","number":197540,"organization":{"name":"netcup GmbH"}},"bytes":0,"geo":{"country_iso_code":"DE"},"ip":"159.195.21.150","mac":["8a:41:d3:b8:0d:d3"],"mac-cnt":1,"packets":0,"port":22222},"dstRIR":"ARIN","ethertype":2048,"fileId":[81316],"firstPacket":1788005387279,"ipProtocol":6,"lastPacket":1788005390282,"length":3003,"network":{"bytes":132,"community_id":"1:AOQs4fhHJi2A688rQH1tKPgyYHY=","packets":2},"node":"spark-afae","packetPos":[-81316,290095,852],"packetRange":{"gte":1788005387279,"lte":1788005390282},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS198953 Proton66 OOO","number":198953,"organization":{"name":"Proton66 OOO"}},"bytes":132,"geo":{"country_iso_code":"RU"},"ip":"176.120.22.61","mac":["bc:0f:fe:38:0b:a3"],"mac-cnt":1,"packets":2,"port":46878},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[121],"srcTTLCnt":1,"tags":["honeypot","netcup-ts","sensor:netcup-ts"],"tagsCnt":3,"tcp":{"ja4t":["8192_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":3464068200},"totDataBytes":0} +{"@timestamp":1788006152281,"_id":"260829-wbzr994XHiBBn5hsynUu1KIS","_index":"arkime_sessions3-260829","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["netcup GmbH"],"isp.dstCnt":1,"isp.src":["Proton66 OOO"],"isp.srcCnt":1,"org.dst":["Netcup KVM"],"org.dstCnt":1,"org.src":["Proton66 OOO"],"org.srcCnt":1,"usertype.dst":["business"],"usertype.dstCnt":1,"usertype.src":["business"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS197540 netcup GmbH","number":197540,"organization":{"name":"netcup GmbH"}},"bytes":0,"geo":{"country_iso_code":"DE"},"ip":"159.195.21.150","mac":["8a:41:d3:b8:0d:d3"],"mac-cnt":1,"packets":0,"port":2222},"dstRIR":"ARIN","ethertype":2048,"fileId":[81316],"firstPacket":1788005385725,"ipProtocol":6,"lastPacket":1788005388732,"length":3007,"network":{"bytes":132,"community_id":"1:7+5Se+d70XiGws7F61lKo4gErew=","packets":2},"node":"spark-afae","packetPos":[-81316,282834,7589],"packetRange":{"gte":1788005385725,"lte":1788005388732},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS198953 Proton66 OOO","number":198953,"organization":{"name":"Proton66 OOO"}},"bytes":132,"geo":{"country_iso_code":"RU"},"ip":"176.120.22.61","mac":["bc:0f:fe:3d:a3:a7"],"mac-cnt":1,"packets":2,"port":40710},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[118],"srcTTLCnt":1,"tags":["honeypot","netcup-ts","sensor:netcup-ts"],"tagsCnt":3,"tcp":{"ja4t":["8192_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":2138971756},"totDataBytes":0} +{"@timestamp":1788006152283,"_id":"260829-wbyfU1uAKa5ANaFCNyARxlM-","_index":"arkime_sessions3-260829","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["netcup GmbH"],"isp.dstCnt":1,"isp.src":["Proton66 OOO"],"isp.srcCnt":1,"org.dst":["Netcup KVM"],"org.dstCnt":1,"org.src":["Proton66 OOO"],"org.srcCnt":1,"usertype.dst":["business"],"usertype.dstCnt":1,"usertype.src":["business"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS197540 netcup GmbH","number":197540,"organization":{"name":"netcup GmbH"}},"bytes":0,"geo":{"country_iso_code":"DE"},"ip":"159.195.21.150","mac":["8a:41:d3:b8:0d:d3"],"mac-cnt":1,"packets":0,"port":22222},"dstRIR":"ARIN","ethertype":2048,"fileId":[81316],"firstPacket":1788005380285,"ipProtocol":6,"lastPacket":1788005383288,"length":3003,"network":{"bytes":132,"community_id":"1:1yi9CXWDlLhUQjP/1zIxeL3lbMQ=","packets":2},"node":"spark-afae","packetPos":[-81316,281263,696],"packetRange":{"gte":1788005380285,"lte":1788005383288},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS198953 Proton66 OOO","number":198953,"organization":{"name":"Proton66 OOO"}},"bytes":132,"geo":{"country_iso_code":"RU"},"ip":"176.120.22.61","mac":["bc:0f:fe:3d:a3:a7"],"mac-cnt":1,"packets":2,"port":27051},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[119],"srcTTLCnt":1,"tags":["honeypot","netcup-ts","sensor:netcup-ts"],"tagsCnt":3,"tcp":{"ja4t":["8192_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":786083214},"totDataBytes":0} +{"@timestamp":1788006152281,"_id":"260829-wbyN-_iDa_pNDoAVQ36yHAR7","_index":"arkime_sessions3-260829","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["netcup GmbH"],"isp.dstCnt":1,"isp.src":["Proton66 OOO"],"isp.srcCnt":1,"org.dst":["Netcup KVM"],"org.dstCnt":1,"org.src":["Proton66 OOO"],"org.srcCnt":1,"usertype.dst":["business"],"usertype.dstCnt":1,"usertype.src":["business"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS197540 netcup GmbH","number":197540,"organization":{"name":"netcup GmbH"}},"bytes":0,"geo":{"country_iso_code":"DE"},"ip":"159.195.21.150","mac":["8a:41:d3:b8:0d:d3"],"mac-cnt":1,"packets":0,"port":2222},"dstRIR":"ARIN","ethertype":2048,"fileId":[81316],"firstPacket":1788005378705,"ipProtocol":6,"lastPacket":1788005381706,"length":3001,"network":{"bytes":132,"community_id":"1:YsXNNXEHpdqy070HmNLU2b7qWFA=","packets":2},"node":"spark-afae","packetPos":[-81316,280719,806],"packetRange":{"gte":1788005378705,"lte":1788005381706},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS198953 Proton66 OOO","number":198953,"organization":{"name":"Proton66 OOO"}},"bytes":132,"geo":{"country_iso_code":"RU"},"ip":"176.120.22.61","mac":["bc:0f:fe:38:0b:a3"],"mac-cnt":1,"packets":2,"port":19838},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[121],"srcTTLCnt":1,"tags":["honeypot","netcup-ts","sensor:netcup-ts"],"tagsCnt":3,"tcp":{"ja4t":["8192_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":913908123},"totDataBytes":0} +{"@timestamp":1788006152279,"_id":"260829-wbzYRBg7khZP-7SyWsAeksDB","_index":"arkime_sessions3-260829","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["netcup GmbH"],"isp.dstCnt":1,"isp.src":["Proton66 OOO"],"isp.srcCnt":1,"org.dst":["Netcup KVM"],"org.dstCnt":1,"org.src":["Proton66 OOO"],"org.srcCnt":1,"usertype.dst":["business"],"usertype.dstCnt":1,"usertype.src":["business"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS197540 netcup GmbH","number":197540,"organization":{"name":"netcup GmbH"}},"bytes":0,"geo":{"country_iso_code":"DE"},"ip":"159.195.21.150","mac":["8a:41:d3:b8:0d:d3"],"mac-cnt":1,"packets":0,"port":22222},"dstRIR":"ARIN","ethertype":2048,"fileId":[81316],"firstPacket":1788005373282,"ipProtocol":6,"lastPacket":1788005376282,"length":3000,"network":{"bytes":132,"community_id":"1:x48LuDEl6NI5pfx/AhJ7y7ikZt0=","packets":2},"node":"spark-afae","packetPos":[-81316,273698,6595],"packetRange":{"gte":1788005373282,"lte":1788005376282},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS198953 Proton66 OOO","number":198953,"organization":{"name":"Proton66 OOO"}},"bytes":132,"geo":{"country_iso_code":"RU"},"ip":"176.120.22.61","mac":["bc:0f:fe:3d:a3:a7"],"mac-cnt":1,"packets":2,"port":44203},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[119],"srcTTLCnt":1,"tags":["honeypot","netcup-ts","sensor:netcup-ts"],"tagsCnt":3,"tcp":{"ja4t":["8192_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":850263268},"totDataBytes":0} +{"@timestamp":1788006152280,"_id":"260829-wbzj1aC501NB35um1UTfyyHB","_index":"arkime_sessions3-260829","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["netcup GmbH"],"isp.dstCnt":1,"isp.src":["Proton66 OOO"],"isp.srcCnt":1,"org.dst":["Netcup KVM"],"org.dstCnt":1,"org.src":["Proton66 OOO"],"org.srcCnt":1,"usertype.dst":["business"],"usertype.dstCnt":1,"usertype.src":["business"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS197540 netcup GmbH","number":197540,"organization":{"name":"netcup GmbH"}},"bytes":0,"geo":{"country_iso_code":"DE"},"ip":"159.195.21.150","mac":["8a:41:d3:b8:0d:d3"],"mac-cnt":1,"packets":0,"port":2222},"dstRIR":"ARIN","ethertype":2048,"fileId":[81316],"firstPacket":1788005371708,"ipProtocol":6,"lastPacket":1788005374708,"length":3000,"network":{"bytes":132,"community_id":"1:trTzA+UHfNsGTtx3Vq2WZ5UztNY=","packets":2},"node":"spark-afae","packetPos":[-81316,273142,1170],"packetRange":{"gte":1788005371708,"lte":1788005374708},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS198953 Proton66 OOO","number":198953,"organization":{"name":"Proton66 OOO"}},"bytes":132,"geo":{"country_iso_code":"RU"},"ip":"176.120.22.61","mac":["bc:0f:fe:38:0b:a3"],"mac-cnt":1,"packets":2,"port":38839},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[121],"srcTTLCnt":1,"tags":["honeypot","netcup-ts","sensor:netcup-ts"],"tagsCnt":3,"tcp":{"ja4t":["8192_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":2877244906},"totDataBytes":0} +{"@timestamp":1788006152284,"_id":"260829-wbzyUHx5OlJMsJp-emkgXOwr","_index":"arkime_sessions3-260829","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["netcup GmbH"],"isp.dstCnt":1,"isp.src":["Proton66 OOO"],"isp.srcCnt":1,"org.dst":["Netcup KVM"],"org.dstCnt":1,"org.src":["Proton66 OOO"],"org.srcCnt":1,"usertype.dst":["business"],"usertype.dstCnt":1,"usertype.src":["business"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS197540 netcup GmbH","number":197540,"organization":{"name":"netcup GmbH"}},"bytes":0,"geo":{"country_iso_code":"DE"},"ip":"159.195.21.150","mac":["8a:41:d3:b8:0d:d3"],"mac-cnt":1,"packets":0,"port":22222},"dstRIR":"ARIN","ethertype":2048,"fileId":[81316],"firstPacket":1788005366291,"ipProtocol":6,"lastPacket":1788005369291,"length":3000,"network":{"bytes":132,"community_id":"1:M9ygShYo9VkK1VMdS4AJ+8ydzF0=","packets":2},"node":"spark-afae","packetPos":[-81316,271580,596],"packetRange":{"gte":1788005366291,"lte":1788005369291},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS198953 Proton66 OOO","number":198953,"organization":{"name":"Proton66 OOO"}},"bytes":132,"geo":{"country_iso_code":"RU"},"ip":"176.120.22.61","mac":["bc:0f:fe:3d:a3:a7"],"mac-cnt":1,"packets":2,"port":35504},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[118],"srcTTLCnt":1,"tags":["honeypot","netcup-ts","sensor:netcup-ts"],"tagsCnt":3,"tcp":{"ja4t":["8192_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":3932485593},"totDataBytes":0} +{"@timestamp":1788006152282,"_id":"260829-wbzm5pfZWXpBDoV_GnG0WLE4","_index":"arkime_sessions3-260829","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["netcup GmbH"],"isp.dstCnt":1,"isp.src":["Proton66 OOO"],"isp.srcCnt":1,"org.dst":["Netcup KVM"],"org.dstCnt":1,"org.src":["Proton66 OOO"],"org.srcCnt":1,"usertype.dst":["business"],"usertype.dstCnt":1,"usertype.src":["business"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS197540 netcup GmbH","number":197540,"organization":{"name":"netcup GmbH"}},"bytes":0,"geo":{"country_iso_code":"DE"},"ip":"159.195.21.150","mac":["8a:41:d3:b8:0d:d3"],"mac-cnt":1,"packets":0,"port":2222},"dstRIR":"ARIN","ethertype":2048,"fileId":[81316],"firstPacket":1788005364717,"ipProtocol":6,"lastPacket":1788005367719,"length":3002,"network":{"bytes":132,"community_id":"1:MlAxOq4RYljMDoSkWocXN+yanBU=","packets":2},"node":"spark-afae","packetPos":[-81316,271228,506],"packetRange":{"gte":1788005364717,"lte":1788005367719},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS198953 Proton66 OOO","number":198953,"organization":{"name":"Proton66 OOO"}},"bytes":132,"geo":{"country_iso_code":"RU"},"ip":"176.120.22.61","mac":["bc:0f:fe:3d:a3:a7"],"mac-cnt":1,"packets":2,"port":29152},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[119],"srcTTLCnt":1,"tags":["honeypot","netcup-ts","sensor:netcup-ts"],"tagsCnt":3,"tcp":{"ja4t":["8192_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":235223978},"totDataBytes":0} +{"@timestamp":1788006152284,"_id":"260829-wbwVzI5DWN1MtLJYvAOOlTAP","_index":"arkime_sessions3-260829","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["netcup GmbH"],"isp.dstCnt":1,"isp.src":["Proton66 OOO"],"isp.srcCnt":1,"org.dst":["Netcup KVM"],"org.dstCnt":1,"org.src":["Proton66 OOO"],"org.srcCnt":1,"usertype.dst":["business"],"usertype.dstCnt":1,"usertype.src":["business"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS197540 netcup GmbH","number":197540,"organization":{"name":"netcup GmbH"}},"bytes":0,"geo":{"country_iso_code":"DE"},"ip":"159.195.21.150","mac":["8a:41:d3:b8:0d:d3"],"mac-cnt":1,"packets":0,"port":22222},"dstRIR":"ARIN","ethertype":2048,"fileId":[81316],"firstPacket":1788005359273,"ipProtocol":6,"lastPacket":1788005362269,"length":2996,"network":{"bytes":132,"community_id":"1:DlGkrGWHU6Conh3/iJTcslIPvPY=","packets":2},"node":"spark-afae","packetPos":[-81316,269358,1080],"packetRange":{"gte":1788005359273,"lte":1788005362269},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS198953 Proton66 OOO","number":198953,"organization":{"name":"Proton66 OOO"}},"bytes":132,"geo":{"country_iso_code":"RU"},"ip":"176.120.22.61","mac":["bc:0f:fe:38:0b:a3"],"mac-cnt":1,"packets":2,"port":59563},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[121],"srcTTLCnt":1,"tags":["honeypot","netcup-ts","sensor:netcup-ts"],"tagsCnt":3,"tcp":{"ja4t":["8192_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":3418561348},"totDataBytes":0} +{"@timestamp":1788006152283,"_id":"260829-wby7GanQ1gtD77Bj6zR-vkMf","_index":"arkime_sessions3-260829","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["netcup GmbH"],"isp.dstCnt":1,"isp.src":["Proton66 OOO"],"isp.srcCnt":1,"org.dst":["Netcup KVM"],"org.dstCnt":1,"org.src":["Proton66 OOO"],"org.srcCnt":1,"usertype.dst":["business"],"usertype.dstCnt":1,"usertype.src":["business"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS197540 netcup GmbH","number":197540,"organization":{"name":"netcup GmbH"}},"bytes":0,"geo":{"country_iso_code":"DE"},"ip":"159.195.21.150","mac":["8a:41:d3:b8:0d:d3"],"mac-cnt":1,"packets":0,"port":2222},"dstRIR":"ARIN","ethertype":2048,"fileId":[81316],"firstPacket":1788005357719,"ipProtocol":6,"lastPacket":1788005360719,"length":3000,"network":{"bytes":132,"community_id":"1:93pDAD+qdGmCU/cmdWd983g7kTo=","packets":2},"node":"spark-afae","packetPos":[-81316,269198,806],"packetRange":{"gte":1788005357719,"lte":1788005360719},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS198953 Proton66 OOO","number":198953,"organization":{"name":"Proton66 OOO"}},"bytes":132,"geo":{"country_iso_code":"RU"},"ip":"176.120.22.61","mac":["bc:0f:fe:3d:a3:a7"],"mac-cnt":1,"packets":2,"port":53462},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[119],"srcTTLCnt":1,"tags":["honeypot","netcup-ts","sensor:netcup-ts"],"tagsCnt":3,"tcp":{"ja4t":["8192_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":2233077227},"totDataBytes":0} +{"@timestamp":1788006152279,"_id":"260829-wbzttJ-udtpJCqPdF0wADB4M","_index":"arkime_sessions3-260829","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["netcup GmbH"],"isp.dstCnt":1,"isp.src":["Proton66 OOO"],"isp.srcCnt":1,"org.dst":["Netcup KVM"],"org.dstCnt":1,"org.src":["Proton66 OOO"],"org.srcCnt":1,"usertype.dst":["business"],"usertype.dstCnt":1,"usertype.src":["business"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS197540 netcup GmbH","number":197540,"organization":{"name":"netcup GmbH"}},"bytes":0,"geo":{"country_iso_code":"DE"},"ip":"159.195.21.150","mac":["8a:41:d3:b8:0d:d3"],"mac-cnt":1,"packets":0,"port":22222},"dstRIR":"ARIN","ethertype":2048,"fileId":[81316],"firstPacket":1788005352286,"ipProtocol":6,"lastPacket":1788005355278,"length":2992,"network":{"bytes":132,"community_id":"1:s9uw9/+rpUWspTXsgKmVEhhUPYE=","packets":2},"node":"spark-afae","packetPos":[-81316,267962,884],"packetRange":{"gte":1788005352286,"lte":1788005355278},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS198953 Proton66 OOO","number":198953,"organization":{"name":"Proton66 OOO"}},"bytes":132,"geo":{"country_iso_code":"RU"},"ip":"176.120.22.61","mac":["bc:0f:fe:3d:a3:a7"],"mac-cnt":1,"packets":2,"port":16737},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[119],"srcTTLCnt":1,"tags":["honeypot","netcup-ts","sensor:netcup-ts"],"tagsCnt":3,"tcp":{"ja4t":["8192_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":902121588},"totDataBytes":0} +{"@timestamp":1788006152284,"_id":"260829-wbwm2OfepCxBbLlnLvdYcFNx","_index":"arkime_sessions3-260829","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["netcup GmbH"],"isp.dstCnt":1,"isp.src":["Proton66 OOO"],"isp.srcCnt":1,"org.dst":["Netcup KVM"],"org.dstCnt":1,"org.src":["Proton66 OOO"],"org.srcCnt":1,"usertype.dst":["business"],"usertype.dstCnt":1,"usertype.src":["business"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS197540 netcup GmbH","number":197540,"organization":{"name":"netcup GmbH"}},"bytes":0,"geo":{"country_iso_code":"DE"},"ip":"159.195.21.150","mac":["8a:41:d3:b8:0d:d3"],"mac-cnt":1,"packets":0,"port":2222},"dstRIR":"ARIN","ethertype":2048,"fileId":[81316],"firstPacket":1788005350719,"ipProtocol":6,"lastPacket":1788005353718,"length":2999,"network":{"bytes":132,"community_id":"1:+3G8NiiSE8oO6qWF34Hl1fRlexY=","packets":2},"node":"spark-afae","packetPos":[-81316,267538,1136],"packetRange":{"gte":1788005350719,"lte":1788005353718},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS198953 Proton66 OOO","number":198953,"organization":{"name":"Proton66 OOO"}},"bytes":132,"geo":{"country_iso_code":"RU"},"ip":"176.120.22.61","mac":["bc:0f:fe:3d:a3:a7"],"mac-cnt":1,"packets":2,"port":53076},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[119],"srcTTLCnt":1,"tags":["honeypot","netcup-ts","sensor:netcup-ts"],"tagsCnt":3,"tcp":{"ja4t":["8192_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":2130920672},"totDataBytes":0} +{"@timestamp":1788006152279,"_id":"260829-wbzYYYAlE_VKJKldn96pzSU_","_index":"arkime_sessions3-260829","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["netcup GmbH"],"isp.dstCnt":1,"isp.src":["Proton66 OOO"],"isp.srcCnt":1,"org.dst":["Netcup KVM"],"org.dstCnt":1,"org.src":["Proton66 OOO"],"org.srcCnt":1,"usertype.dst":["business"],"usertype.dstCnt":1,"usertype.src":["business"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS197540 netcup GmbH","number":197540,"organization":{"name":"netcup GmbH"}},"bytes":0,"geo":{"country_iso_code":"DE"},"ip":"159.195.21.150","mac":["8a:41:d3:b8:0d:d3"],"mac-cnt":1,"packets":0,"port":22222},"dstRIR":"ARIN","ethertype":2048,"fileId":[81316],"firstPacket":1788005345285,"ipProtocol":6,"lastPacket":1788005348280,"length":2995,"network":{"bytes":132,"community_id":"1:ArZy7gU1KcAvuGN8D/YQmeSfBvw=","packets":2},"node":"spark-afae","packetPos":[-81316,265604,794],"packetRange":{"gte":1788005345285,"lte":1788005348280},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS198953 Proton66 OOO","number":198953,"organization":{"name":"Proton66 OOO"}},"bytes":132,"geo":{"country_iso_code":"RU"},"ip":"176.120.22.61","mac":["bc:0f:fe:3d:a3:a7"],"mac-cnt":1,"packets":2,"port":49405},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[119],"srcTTLCnt":1,"tags":["honeypot","netcup-ts","sensor:netcup-ts"],"tagsCnt":3,"tcp":{"ja4t":["8192_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":2571752732},"totDataBytes":0} +{"@timestamp":1788006152281,"_id":"260829-wbwIBMX_St5EeIBs15inSBr4","_index":"arkime_sessions3-260829","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["netcup GmbH"],"isp.dstCnt":1,"isp.src":["Proton66 OOO"],"isp.srcCnt":1,"org.dst":["Netcup KVM"],"org.dstCnt":1,"org.src":["Proton66 OOO"],"org.srcCnt":1,"usertype.dst":["business"],"usertype.dstCnt":1,"usertype.src":["business"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS197540 netcup GmbH","number":197540,"organization":{"name":"netcup GmbH"}},"bytes":0,"geo":{"country_iso_code":"DE"},"ip":"159.195.21.150","mac":["8a:41:d3:b8:0d:d3"],"mac-cnt":1,"packets":0,"port":2222},"dstRIR":"ARIN","ethertype":2048,"fileId":[81316],"firstPacket":1788005343718,"ipProtocol":6,"lastPacket":1788005346712,"length":2994,"network":{"bytes":132,"community_id":"1:85tHpu3IFQGC7gENENhmBbwwDMA=","packets":2},"node":"spark-afae","packetPos":[-81316,264828,1038],"packetRange":{"gte":1788005343718,"lte":1788005346712},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS198953 Proton66 OOO","number":198953,"organization":{"name":"Proton66 OOO"}},"bytes":132,"geo":{"country_iso_code":"RU"},"ip":"176.120.22.61","mac":["bc:0f:fe:3d:a3:a7"],"mac-cnt":1,"packets":2,"port":35843},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[119],"srcTTLCnt":1,"tags":["honeypot","netcup-ts","sensor:netcup-ts"],"tagsCnt":3,"tcp":{"ja4t":["8192_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":2858951524},"totDataBytes":0} +{"@timestamp":1788006152280,"_id":"260829-wbxg9YxIR1lOY6fGwBg2oEsk","_index":"arkime_sessions3-260829","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["netcup GmbH"],"isp.dstCnt":1,"isp.src":["Proton66 OOO"],"isp.srcCnt":1,"org.dst":["Netcup KVM"],"org.dstCnt":1,"org.src":["Proton66 OOO"],"org.srcCnt":1,"usertype.dst":["business"],"usertype.dstCnt":1,"usertype.src":["business"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS197540 netcup GmbH","number":197540,"organization":{"name":"netcup GmbH"}},"bytes":0,"geo":{"country_iso_code":"DE"},"ip":"159.195.21.150","mac":["8a:41:d3:b8:0d:d3"],"mac-cnt":1,"packets":0,"port":22222},"dstRIR":"ARIN","ethertype":2048,"fileId":[81316],"firstPacket":1788005338288,"ipProtocol":6,"lastPacket":1788005341283,"length":2995,"network":{"bytes":132,"community_id":"1:3+H51WHtzcydFe1cNb6yKqrpNGg=","packets":2},"node":"spark-afae","packetPos":[-81316,263868,512],"packetRange":{"gte":1788005338288,"lte":1788005341283},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS198953 Proton66 OOO","number":198953,"organization":{"name":"Proton66 OOO"}},"bytes":132,"geo":{"country_iso_code":"RU"},"ip":"176.120.22.61","mac":["bc:0f:fe:3d:a3:a7"],"mac-cnt":1,"packets":2,"port":37019},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[118],"srcTTLCnt":1,"tags":["honeypot","netcup-ts","sensor:netcup-ts"],"tagsCnt":3,"tcp":{"ja4t":["8192_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":3473581366},"totDataBytes":0} +{"@timestamp":1788006152280,"_id":"260829-wbzREKwCxxBLOraTCFrcewHg","_index":"arkime_sessions3-260829","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["netcup GmbH"],"isp.dstCnt":1,"isp.src":["Proton66 OOO"],"isp.srcCnt":1,"org.dst":["Netcup KVM"],"org.dstCnt":1,"org.src":["Proton66 OOO"],"org.srcCnt":1,"usertype.dst":["business"],"usertype.dstCnt":1,"usertype.src":["business"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS197540 netcup GmbH","number":197540,"organization":{"name":"netcup GmbH"}},"bytes":0,"geo":{"country_iso_code":"DE"},"ip":"159.195.21.150","mac":["8a:41:d3:b8:0d:d3"],"mac-cnt":1,"packets":0,"port":2222},"dstRIR":"ARIN","ethertype":2048,"fileId":[81316],"firstPacket":1788005336717,"ipProtocol":6,"lastPacket":1788005339713,"length":2996,"network":{"bytes":132,"community_id":"1:fWiDNK0EWtq0Kpt4t9IYW5Vq3Bo=","packets":2},"node":"spark-afae","packetPos":[-81316,263614,516],"packetRange":{"gte":1788005336717,"lte":1788005339713},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS198953 Proton66 OOO","number":198953,"organization":{"name":"Proton66 OOO"}},"bytes":132,"geo":{"country_iso_code":"RU"},"ip":"176.120.22.61","mac":["bc:0f:fe:3d:a3:a7"],"mac-cnt":1,"packets":2,"port":12718},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[119],"srcTTLCnt":1,"tags":["honeypot","netcup-ts","sensor:netcup-ts"],"tagsCnt":3,"tcp":{"ja4t":["8192_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":4092884829},"totDataBytes":0} +{"@timestamp":1788006152280,"_id":"260829-wbyn35A4YIVFbLlxcs-rIVZ0","_index":"arkime_sessions3-260829","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["netcup GmbH"],"isp.dstCnt":1,"isp.src":["Proton66 OOO"],"isp.srcCnt":1,"org.dst":["Netcup KVM"],"org.dstCnt":1,"org.src":["Proton66 OOO"],"org.srcCnt":1,"usertype.dst":["business"],"usertype.dstCnt":1,"usertype.src":["business"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS197540 netcup GmbH","number":197540,"organization":{"name":"netcup GmbH"}},"bytes":0,"geo":{"country_iso_code":"DE"},"ip":"159.195.21.150","mac":["8a:41:d3:b8:0d:d3"],"mac-cnt":1,"packets":0,"port":22222},"dstRIR":"ARIN","ethertype":2048,"fileId":[81316],"firstPacket":1788005331275,"ipProtocol":6,"lastPacket":1788005334268,"length":2993,"network":{"bytes":132,"community_id":"1:aCgA74/Y15S15VCtbmyrdIrWyc8=","packets":2},"node":"spark-afae","packetPos":[-81316,261948,872],"packetRange":{"gte":1788005331275,"lte":1788005334268},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS198953 Proton66 OOO","number":198953,"organization":{"name":"Proton66 OOO"}},"bytes":132,"geo":{"country_iso_code":"RU"},"ip":"176.120.22.61","mac":["bc:0f:fe:38:0b:a3"],"mac-cnt":1,"packets":2,"port":13665},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[121],"srcTTLCnt":1,"tags":["honeypot","netcup-ts","sensor:netcup-ts"],"tagsCnt":3,"tcp":{"ja4t":["8192_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":155144595},"totDataBytes":0} +{"@timestamp":1788006152281,"_id":"260829-wbzWWE0zFUBKs5CeK3AM1pHO","_index":"arkime_sessions3-260829","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["netcup GmbH"],"isp.dstCnt":1,"isp.src":["Proton66 OOO"],"isp.srcCnt":1,"org.dst":["Netcup KVM"],"org.dstCnt":1,"org.src":["Proton66 OOO"],"org.srcCnt":1,"usertype.dst":["business"],"usertype.dstCnt":1,"usertype.src":["business"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS197540 netcup GmbH","number":197540,"organization":{"name":"netcup GmbH"}},"bytes":0,"geo":{"country_iso_code":"DE"},"ip":"159.195.21.150","mac":["8a:41:d3:b8:0d:d3"],"mac-cnt":1,"packets":0,"port":2222},"dstRIR":"ARIN","ethertype":2048,"fileId":[81316],"firstPacket":1788005329706,"ipProtocol":6,"lastPacket":1788005332698,"length":2992,"network":{"bytes":132,"community_id":"1:uu6wWiNP3bhPCsA557pLxCg44/U=","packets":2},"node":"spark-afae","packetPos":[-81316,260387,2093],"packetRange":{"gte":1788005329706,"lte":1788005332698},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS198953 Proton66 OOO","number":198953,"organization":{"name":"Proton66 OOO"}},"bytes":132,"geo":{"country_iso_code":"RU"},"ip":"176.120.22.61","mac":["bc:0f:fe:38:0b:a3"],"mac-cnt":1,"packets":2,"port":51015},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[121],"srcTTLCnt":1,"tags":["honeypot","netcup-ts","sensor:netcup-ts"],"tagsCnt":3,"tcp":{"ja4t":["8192_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":1977522491},"totDataBytes":0} +{"@timestamp":1788006152279,"_id":"260829-wbwy19SWeLRLQY3glNd_40pt","_index":"arkime_sessions3-260829","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["netcup GmbH"],"isp.dstCnt":1,"isp.src":["Proton66 OOO"],"isp.srcCnt":1,"org.dst":["Netcup KVM"],"org.dstCnt":1,"org.src":["Proton66 OOO"],"org.srcCnt":1,"usertype.dst":["business"],"usertype.dstCnt":1,"usertype.src":["business"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS197540 netcup GmbH","number":197540,"organization":{"name":"netcup GmbH"}},"bytes":0,"geo":{"country_iso_code":"DE"},"ip":"159.195.21.150","mac":["8a:41:d3:b8:0d:d3"],"mac-cnt":1,"packets":0,"port":22222},"dstRIR":"ARIN","ethertype":2048,"fileId":[81316],"firstPacket":1788005324283,"ipProtocol":6,"lastPacket":1788005327281,"length":2998,"network":{"bytes":132,"community_id":"1:bEkU5cLeVSg9pA2VdxW91Qe4kDQ=","packets":2},"node":"spark-afae","packetPos":[-81316,247328,8081],"packetRange":{"gte":1788005324283,"lte":1788005327281},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS198953 Proton66 OOO","number":198953,"organization":{"name":"Proton66 OOO"}},"bytes":132,"geo":{"country_iso_code":"RU"},"ip":"176.120.22.61","mac":["bc:0f:fe:3d:a3:a7"],"mac-cnt":1,"packets":2,"port":42706},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[119],"srcTTLCnt":1,"tags":["honeypot","netcup-ts","sensor:netcup-ts"],"tagsCnt":3,"tcp":{"ja4t":["8192_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":3273353994},"totDataBytes":0} +{"@timestamp":1788006152279,"_id":"260829-wby3U9n_VDhDFIpbynIlSVMR","_index":"arkime_sessions3-260829","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["netcup GmbH"],"isp.dstCnt":1,"isp.src":["Proton66 OOO"],"isp.srcCnt":1,"org.dst":["Netcup KVM"],"org.dstCnt":1,"org.src":["Proton66 OOO"],"org.srcCnt":1,"usertype.dst":["business"],"usertype.dstCnt":1,"usertype.src":["business"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS197540 netcup GmbH","number":197540,"organization":{"name":"netcup GmbH"}},"bytes":0,"geo":{"country_iso_code":"DE"},"ip":"159.195.21.150","mac":["8a:41:d3:b8:0d:d3"],"mac-cnt":1,"packets":0,"port":2222},"dstRIR":"ARIN","ethertype":2048,"fileId":[81316],"firstPacket":1788005322712,"ipProtocol":6,"lastPacket":1788005325705,"length":2993,"network":{"bytes":132,"community_id":"1:T4Aw3+tzcFncJ1RPQvBvp2CIXgI=","packets":2},"node":"spark-afae","packetPos":[-81316,247164,426],"packetRange":{"gte":1788005322712,"lte":1788005325705},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS198953 Proton66 OOO","number":198953,"organization":{"name":"Proton66 OOO"}},"bytes":132,"geo":{"country_iso_code":"RU"},"ip":"176.120.22.61","mac":["bc:0f:fe:3d:a3:a7"],"mac-cnt":1,"packets":2,"port":26485},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[119],"srcTTLCnt":1,"tags":["honeypot","netcup-ts","sensor:netcup-ts"],"tagsCnt":3,"tcp":{"ja4t":["8192_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":1399368929},"totDataBytes":0} +{"@timestamp":1788006152281,"_id":"260829-wbw_mib9KdFGWJHd0MVJhlFN","_index":"arkime_sessions3-260829","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["netcup GmbH"],"isp.dstCnt":1,"isp.src":["Proton66 OOO"],"isp.srcCnt":1,"org.dst":["Netcup KVM"],"org.dstCnt":1,"org.src":["Proton66 OOO"],"org.srcCnt":1,"usertype.dst":["business"],"usertype.dstCnt":1,"usertype.src":["business"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS197540 netcup GmbH","number":197540,"organization":{"name":"netcup GmbH"}},"bytes":0,"geo":{"country_iso_code":"DE"},"ip":"159.195.21.150","mac":["8a:41:d3:b8:0d:d3"],"mac-cnt":1,"packets":0,"port":22222},"dstRIR":"ARIN","ethertype":2048,"fileId":[81316],"firstPacket":1788005317280,"ipProtocol":6,"lastPacket":1788005320278,"length":2998,"network":{"bytes":132,"community_id":"1:ukNnhyNRI7Y+qdEeklmX3EryT84=","packets":2},"node":"spark-afae","packetPos":[-81316,246198,704],"packetRange":{"gte":1788005317280,"lte":1788005320278},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS198953 Proton66 OOO","number":198953,"organization":{"name":"Proton66 OOO"}},"bytes":132,"geo":{"country_iso_code":"RU"},"ip":"176.120.22.61","mac":["bc:0f:fe:3d:a3:a7"],"mac-cnt":1,"packets":2,"port":41989},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[119],"srcTTLCnt":1,"tags":["honeypot","netcup-ts","sensor:netcup-ts"],"tagsCnt":3,"tcp":{"ja4t":["8192_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":3740669437},"totDataBytes":0} +{"@timestamp":1788006152279,"_id":"260829-wbzlkthsrchGKa5c6zL1e2HP","_index":"arkime_sessions3-260829","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["netcup GmbH"],"isp.dstCnt":1,"isp.src":["Proton66 OOO"],"isp.srcCnt":1,"org.dst":["Netcup KVM"],"org.dstCnt":1,"org.src":["Proton66 OOO"],"org.srcCnt":1,"usertype.dst":["business"],"usertype.dstCnt":1,"usertype.src":["business"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS197540 netcup GmbH","number":197540,"organization":{"name":"netcup GmbH"}},"bytes":0,"geo":{"country_iso_code":"DE"},"ip":"159.195.21.150","mac":["8a:41:d3:b8:0d:d3"],"mac-cnt":1,"packets":0,"port":2222},"dstRIR":"ARIN","ethertype":2048,"fileId":[81316],"firstPacket":1788005315701,"ipProtocol":6,"lastPacket":1788005318698,"length":2997,"network":{"bytes":132,"community_id":"1:mBZMMpYwfMwZx1Pzgs94Ui8LRWw=","packets":2},"node":"spark-afae","packetPos":[-81316,245846,794],"packetRange":{"gte":1788005315701,"lte":1788005318698},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS198953 Proton66 OOO","number":198953,"organization":{"name":"Proton66 OOO"}},"bytes":132,"geo":{"country_iso_code":"RU"},"ip":"176.120.22.61","mac":["bc:0f:fe:38:0b:a3"],"mac-cnt":1,"packets":2,"port":23777},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[121],"srcTTLCnt":1,"tags":["honeypot","netcup-ts","sensor:netcup-ts"],"tagsCnt":3,"tcp":{"ja4t":["8192_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":555141042},"totDataBytes":0} +{"@timestamp":1788006152282,"_id":"260829-wbwMFwSi6SxGFpRNl1aKYMPm","_index":"arkime_sessions3-260829","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["netcup GmbH"],"isp.dstCnt":1,"isp.src":["Proton66 OOO"],"isp.srcCnt":1,"org.dst":["Netcup KVM"],"org.dstCnt":1,"org.src":["Proton66 OOO"],"org.srcCnt":1,"usertype.dst":["business"],"usertype.dstCnt":1,"usertype.src":["business"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS197540 netcup GmbH","number":197540,"organization":{"name":"netcup GmbH"}},"bytes":0,"geo":{"country_iso_code":"DE"},"ip":"159.195.21.150","mac":["8a:41:d3:b8:0d:d3"],"mac-cnt":1,"packets":0,"port":22222},"dstRIR":"ARIN","ethertype":2048,"fileId":[81316],"firstPacket":1788005310285,"ipProtocol":6,"lastPacket":1788005313283,"length":2998,"network":{"bytes":132,"community_id":"1:9x8cOXWWaVBXiC8Se6GD9VWKw3o=","packets":2},"node":"spark-afae","packetPos":[-81316,240223,5459],"packetRange":{"gte":1788005310285,"lte":1788005313283},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS198953 Proton66 OOO","number":198953,"organization":{"name":"Proton66 OOO"}},"bytes":132,"geo":{"country_iso_code":"RU"},"ip":"176.120.22.61","mac":["bc:0f:fe:3d:a3:a7"],"mac-cnt":1,"packets":2,"port":15345},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[119],"srcTTLCnt":1,"tags":["honeypot","netcup-ts","sensor:netcup-ts"],"tagsCnt":3,"tcp":{"ja4t":["8192_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":3204280097},"totDataBytes":0} +{"@timestamp":1788006152279,"_id":"260829-wbxmklEhVidPwrBFLpSSALZs","_index":"arkime_sessions3-260829","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["netcup GmbH"],"isp.dstCnt":1,"isp.src":["Proton66 OOO"],"isp.srcCnt":1,"org.dst":["Netcup KVM"],"org.dstCnt":1,"org.src":["Proton66 OOO"],"org.srcCnt":1,"usertype.dst":["business"],"usertype.dstCnt":1,"usertype.src":["business"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS197540 netcup GmbH","number":197540,"organization":{"name":"netcup GmbH"}},"bytes":0,"geo":{"country_iso_code":"DE"},"ip":"159.195.21.150","mac":["8a:41:d3:b8:0d:d3"],"mac-cnt":1,"packets":0,"port":2222},"dstRIR":"ARIN","ethertype":2048,"fileId":[81316],"firstPacket":1788005308700,"ipProtocol":6,"lastPacket":1788005311699,"length":2999,"network":{"bytes":132,"community_id":"1:LCaFeqTDNN0N9Llu43i2bRhHcDs=","packets":2},"node":"spark-afae","packetPos":[-81316,240051,5165],"packetRange":{"gte":1788005308700,"lte":1788005311699},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS198953 Proton66 OOO","number":198953,"organization":{"name":"Proton66 OOO"}},"bytes":132,"geo":{"country_iso_code":"RU"},"ip":"176.120.22.61","mac":["bc:0f:fe:38:0b:a3"],"mac-cnt":1,"packets":2,"port":1422},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[121],"srcTTLCnt":1,"tags":["honeypot","netcup-ts","sensor:netcup-ts"],"tagsCnt":3,"tcp":{"ja4t":["8192_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":3728919024},"totDataBytes":0} +{"@timestamp":1788006152280,"_id":"260829-wbzriv9iTWhEdKUIy2R5T5oP","_index":"arkime_sessions3-260829","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["netcup GmbH"],"isp.dstCnt":1,"isp.src":["Proton66 OOO"],"isp.srcCnt":1,"org.dst":["Netcup KVM"],"org.dstCnt":1,"org.src":["Proton66 OOO"],"org.srcCnt":1,"usertype.dst":["business"],"usertype.dstCnt":1,"usertype.src":["business"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS197540 netcup GmbH","number":197540,"organization":{"name":"netcup GmbH"}},"bytes":0,"geo":{"country_iso_code":"DE"},"ip":"159.195.21.150","mac":["8a:41:d3:b8:0d:d3"],"mac-cnt":1,"packets":0,"port":22222},"dstRIR":"ARIN","ethertype":2048,"fileId":[81316],"firstPacket":1788005303271,"ipProtocol":6,"lastPacket":1788005306273,"length":3002,"network":{"bytes":132,"community_id":"1:ZWtCjmUIOcgtZNA9vnKCuiptJ/c=","packets":2},"node":"spark-afae","packetPos":[-81316,239601,164],"packetRange":{"gte":1788005303271,"lte":1788005306273},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS198953 Proton66 OOO","number":198953,"organization":{"name":"Proton66 OOO"}},"bytes":132,"geo":{"country_iso_code":"RU"},"ip":"176.120.22.61","mac":["bc:0f:fe:38:0b:a3"],"mac-cnt":1,"packets":2,"port":6783},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[121],"srcTTLCnt":1,"tags":["honeypot","netcup-ts","sensor:netcup-ts"],"tagsCnt":3,"tcp":{"ja4t":["8192_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":3421019936},"totDataBytes":0} +{"@timestamp":1788006152279,"_id":"260829-wbzW9n0n4TRPnpW38f5ZVPXq","_index":"arkime_sessions3-260829","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["netcup GmbH"],"isp.dstCnt":1,"isp.src":["Proton66 OOO"],"isp.srcCnt":1,"org.dst":["Netcup KVM"],"org.dstCnt":1,"org.src":["Proton66 OOO"],"org.srcCnt":1,"usertype.dst":["business"],"usertype.dstCnt":1,"usertype.src":["business"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS197540 netcup GmbH","number":197540,"organization":{"name":"netcup GmbH"}},"bytes":0,"geo":{"country_iso_code":"DE"},"ip":"159.195.21.150","mac":["8a:41:d3:b8:0d:d3"],"mac-cnt":1,"packets":0,"port":2222},"dstRIR":"ARIN","ethertype":2048,"fileId":[81316],"firstPacket":1788005301699,"ipProtocol":6,"lastPacket":1788005304698,"length":2999,"network":{"bytes":132,"community_id":"1:vt2b2QvnbZjUJUZKYatsCfbyh6Y=","packets":2},"node":"spark-afae","packetPos":[-81316,239519,164],"packetRange":{"gte":1788005301699,"lte":1788005304698},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS198953 Proton66 OOO","number":198953,"organization":{"name":"Proton66 OOO"}},"bytes":132,"geo":{"country_iso_code":"RU"},"ip":"176.120.22.61","mac":["bc:0f:fe:38:0b:a3"],"mac-cnt":1,"packets":2,"port":36994},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[121],"srcTTLCnt":1,"tags":["honeypot","netcup-ts","sensor:netcup-ts"],"tagsCnt":3,"tcp":{"ja4t":["8192_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":4210692492},"totDataBytes":0} +{"@timestamp":1788006152279,"_id":"260829-wbzq6GH_8UJO4aeh4Ci46Xem","_index":"arkime_sessions3-260829","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["netcup GmbH"],"isp.dstCnt":1,"isp.src":["Proton66 OOO"],"isp.srcCnt":1,"org.dst":["Netcup KVM"],"org.dstCnt":1,"org.src":["Proton66 OOO"],"org.srcCnt":1,"usertype.dst":["business"],"usertype.dstCnt":1,"usertype.src":["business"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS197540 netcup GmbH","number":197540,"organization":{"name":"netcup GmbH"}},"bytes":0,"geo":{"country_iso_code":"DE"},"ip":"159.195.21.150","mac":["8a:41:d3:b8:0d:d3"],"mac-cnt":1,"packets":0,"port":22222},"dstRIR":"ARIN","ethertype":2048,"fileId":[81316],"firstPacket":1788005296269,"ipProtocol":6,"lastPacket":1788005299273,"length":3004,"network":{"bytes":132,"community_id":"1:d7wN8ziClHFkCL0PZxsFW7WSbTY=","packets":2},"node":"spark-afae","packetPos":[-81316,239069,368],"packetRange":{"gte":1788005296269,"lte":1788005299273},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS198953 Proton66 OOO","number":198953,"organization":{"name":"Proton66 OOO"}},"bytes":132,"geo":{"country_iso_code":"RU"},"ip":"176.120.22.61","mac":["bc:0f:fe:38:0b:a3"],"mac-cnt":1,"packets":2,"port":38097},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[121],"srcTTLCnt":1,"tags":["honeypot","netcup-ts","sensor:netcup-ts"],"tagsCnt":3,"tcp":{"ja4t":["8192_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":2,"dstZero":0,"ece":2,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":2,"syn-ack":0,"urg":0},"tcpseq":{"src":3364488069},"totDataBytes":0} diff --git a/kevlar/2026-08-31/sponge/ip-sessions/session_search_20260831T113640_b7c6793a.ndjson b/kevlar/2026-08-31/sponge/ip-sessions/session_search_20260831T113640_b7c6793a.ndjson new file mode 100644 index 0000000..b0510e2 --- /dev/null +++ b/kevlar/2026-08-31/sponge/ip-sessions/session_search_20260831T113640_b7c6793a.ndjson @@ -0,0 +1,100 @@ +{"@timestamp":1788092079945,"_id":"260830-rEL6jP3j04NAjKOk2QvKznha","_index":"arkime_sessions3-260830","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["Private Layer INC"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["Private Layer Inc"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":74,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":1,"port":5060},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[81891],"firstPacket":1788090988281,"ipProtocol":6,"lastPacket":1788090988434,"length":153,"network":{"bytes":202,"community_id":"1:C25nZuxndBoj2eGvperlrFJFu5o=","packets":3},"node":"spark-afae","packetPos":[-81891,2025237,90,1624],"packetRange":{"gte":1788090988281,"lte":1788090988434},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51852 Private Layer INC","number":51852,"organization":{"name":"Private Layer INC"}},"bytes":128,"geo":{"country_iso_code":"CH"},"ip":"179.43.167.2","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":2,"port":26528},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"LACNIC","srcTTL":[50],"srcTTLCnt":1,"tags":["frantech-ts","sensor:frantech-ts","honeypot"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-4-8-1-3_1400_13"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":2217684389},"totDataBytes":0} +{"@timestamp":1788089969724,"_id":"260830--jO-xycDotdLLIm-FCiqZtbJ","_index":"arkime_sessions3-260830","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["Private Layer INC"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["Private Layer Inc"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":74,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":1,"port":5060},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[81876],"firstPacket":1788089260983,"ipProtocol":6,"lastPacket":1788089261137,"length":154,"network":{"bytes":202,"community_id":"1:BsPKwV2uy2oaC9Z5yFvGA3c5Tz0=","packets":3},"node":"spark-afae","packetPos":[-81876,2521932,90,460],"packetRange":{"gte":1788089260983,"lte":1788089261137},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51852 Private Layer INC","number":51852,"organization":{"name":"Private Layer INC"}},"bytes":128,"geo":{"country_iso_code":"CH"},"ip":"179.43.167.2","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":2,"port":60876},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"LACNIC","srcTTL":[50],"srcTTLCnt":1,"tags":["frantech-ts","honeypot","sensor:frantech-ts"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-4-8-1-3_1400_13"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":1986661145},"totDataBytes":0} +{"@timestamp":1788088464484,"_id":"260830-88RhpNJqctBAtY8RDR8_0_sz","_index":"arkime_sessions3-260830","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["Private Layer INC"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["Private Layer Inc"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":74,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":1,"port":5060},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[81866],"firstPacket":1788087533755,"ipProtocol":6,"lastPacket":1788087533906,"length":151,"network":{"bytes":202,"community_id":"1:JhCvk3bc1XTjzCKAfsEwYmbYVeU=","packets":3},"node":"spark-afae","packetPos":[-81866,13605763,90,5490],"packetRange":{"gte":1788087533755,"lte":1788087533906},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51852 Private Layer INC","number":51852,"organization":{"name":"Private Layer INC"}},"bytes":128,"geo":{"country_iso_code":"CH"},"ip":"179.43.167.2","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":2,"port":60292},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"LACNIC","srcTTL":[50],"srcTTLCnt":1,"tags":["honeypot","frantech-ts","sensor:frantech-ts"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-4-8-1-3_1400_13"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":825899392},"totDataBytes":0} +{"@timestamp":1788086367135,"_id":"260830-djPulWmcrjZNM55gBgz5i637","_index":"arkime_sessions3-260830","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["Private Layer INC"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["Private Layer Inc"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":74,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":1,"port":5060},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[81852],"firstPacket":1788085806096,"ipProtocol":6,"lastPacket":1788085806248,"length":152,"network":{"bytes":202,"community_id":"1:BnJYWEAbEJMh57PREx8sHZBdCO0=","packets":3},"node":"spark-afae","packetPos":[-81852,8030353,90,1334],"packetRange":{"gte":1788085806096,"lte":1788085806248},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51852 Private Layer INC","number":51852,"organization":{"name":"Private Layer INC"}},"bytes":128,"geo":{"country_iso_code":"CH"},"ip":"179.43.167.2","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":2,"port":52140},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"LACNIC","srcTTL":[50],"srcTTLCnt":1,"tags":["sensor:frantech-ts","frantech-ts","honeypot"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-4-8-1-3_1400_13"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":334869575},"totDataBytes":0} +{"@timestamp":1788084534164,"_id":"260830-NDP5zPmQh2lBSJHUUUZ9EMoM","_index":"arkime_sessions3-260830","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["Private Layer INC"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["Private Layer Inc"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":74,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":1,"port":5060},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[81840],"firstPacket":1788084078688,"ipProtocol":6,"lastPacket":1788084078841,"length":153,"network":{"bytes":202,"community_id":"1:x4offKgYu6zj5KCZbPsOMLw+pBk=","packets":3},"node":"spark-afae","packetPos":[-81840,3784244,90,1202],"packetRange":{"gte":1788084078688,"lte":1788084078841},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51852 Private Layer INC","number":51852,"organization":{"name":"Private Layer INC"}},"bytes":128,"geo":{"country_iso_code":"CH"},"ip":"179.43.167.2","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":2,"port":2456},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"LACNIC","srcTTL":[50],"srcTTLCnt":1,"tags":["honeypot","sensor:frantech-ts","frantech-ts"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-4-8-1-3_1400_13"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":2051460165},"totDataBytes":0} +{"@timestamp":1788083040841,"_id":"260830-_TJPLsm2RzVDeLTSpQO9Rp0n","_index":"arkime_sessions3-260830","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["Private Layer INC"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["Private Layer Inc"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":74,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":1,"port":5060},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[81829],"firstPacket":1788082351436,"ipProtocol":6,"lastPacket":1788082351588,"length":152,"network":{"bytes":202,"community_id":"1:h6TGd75CCI9GXZM6DJFXUi4Rj00=","packets":3},"node":"spark-afae","packetPos":[-81829,6470321,90,376],"packetRange":{"gte":1788082351436,"lte":1788082351588},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51852 Private Layer INC","number":51852,"organization":{"name":"Private Layer INC"}},"bytes":128,"geo":{"country_iso_code":"CH"},"ip":"179.43.167.2","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":2,"port":1194},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"LACNIC","srcTTL":[50],"srcTTLCnt":1,"tags":["sensor:frantech-ts","frantech-ts","honeypot"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-4-8-1-3_1400_13"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":690467344},"totDataBytes":0} +{"@timestamp":1788081232011,"_id":"260830-RcToI5dEiLpJ15r1-dC75X0g","_index":"arkime_sessions3-260830","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["Private Layer INC"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["Private Layer Inc"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":74,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":1,"port":5060},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[81818],"firstPacket":1788080624370,"ipProtocol":6,"lastPacket":1788080624524,"length":154,"network":{"bytes":202,"community_id":"1:qBTgwmO8HyeSUHw4eN0JdVIx86k=","packets":3},"node":"spark-afae","packetPos":[-81818,14870285,90,753],"packetRange":{"gte":1788080624370,"lte":1788080624524},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51852 Private Layer INC","number":51852,"organization":{"name":"Private Layer INC"}},"bytes":128,"geo":{"country_iso_code":"CH"},"ip":"179.43.167.2","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":2,"port":48516},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"LACNIC","srcTTL":[50],"srcTTLCnt":1,"tags":["frantech-ts","honeypot","sensor:frantech-ts"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-4-8-1-3_1400_13"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":1184018540},"totDataBytes":0} +{"@timestamp":1788079121203,"_id":"260830-eTISM0bs5j9PubJ6IsXIwzz1","_index":"arkime_sessions3-260830","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["Private Layer INC"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["Private Layer Inc"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":74,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":1,"port":5060},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[81804],"firstPacket":1788078896878,"ipProtocol":6,"lastPacket":1788078897030,"length":152,"network":{"bytes":202,"community_id":"1:2+XbnlJr2rAPyaAs3LLgj2CSGE4=","packets":3},"node":"spark-afae","packetPos":[-81804,10615861,90,4253],"packetRange":{"gte":1788078896878,"lte":1788078897030},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51852 Private Layer INC","number":51852,"organization":{"name":"Private Layer INC"}},"bytes":128,"geo":{"country_iso_code":"CH"},"ip":"179.43.167.2","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":2,"port":26126},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"LACNIC","srcTTL":[50],"srcTTLCnt":1,"tags":["sensor:frantech-ts","frantech-ts","honeypot"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-4-8-1-3_1400_13"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":4174125225},"totDataBytes":0} +{"@timestamp":1788078520434,"_id":"260830-7cMSk7qhTz9AGJyyzpWRWFO4","_index":"arkime_sessions3-260830","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["Private Layer INC"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["Private Layer Inc"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":74,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":1,"port":5060},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[81800],"firstPacket":1788077169245,"ipProtocol":6,"lastPacket":1788077169398,"length":153,"network":{"bytes":202,"community_id":"1:UtyPgwBFEBi98QABQsGQ1H5rs9Y=","packets":3},"node":"spark-afae","packetPos":[-81800,85387,90,0],"packetRange":{"gte":1788077169245,"lte":1788077169398},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51852 Private Layer INC","number":51852,"organization":{"name":"Private Layer INC"}},"bytes":128,"geo":{"country_iso_code":"CH"},"ip":"179.43.167.2","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":2,"port":22020},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"LACNIC","srcTTL":[50],"srcTTLCnt":1,"tags":["frantech-ts","honeypot","sensor:frantech-ts"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-4-8-1-3_1400_13"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":215530772},"totDataBytes":0} +{"@timestamp":1788076418406,"_id":"260830-wcO31Aw7AmdLtasIr1OZwNT-","_index":"arkime_sessions3-260830","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["Private Layer INC"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["Private Layer Inc"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":74,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":1,"port":5060},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[81786],"firstPacket":1788075441533,"ipProtocol":6,"lastPacket":1788075441686,"length":153,"network":{"bytes":202,"community_id":"1:byKkU7BMHgTUnfHnOtH9YlL4Nvc=","packets":3},"node":"spark-afae","packetPos":[-81786,4180348,90,338],"packetRange":{"gte":1788075441533,"lte":1788075441686},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51852 Private Layer INC","number":51852,"organization":{"name":"Private Layer INC"}},"bytes":128,"geo":{"country_iso_code":"CH"},"ip":"179.43.167.2","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":2,"port":28440},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"LACNIC","srcTTL":[50],"srcTTLCnt":1,"tags":["frantech-ts","sensor:frantech-ts","honeypot"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-4-8-1-3_1400_13"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":1404748692},"totDataBytes":0} +{"@timestamp":1788074605196,"_id":"260830-1zGLPWJXGChDx4L9sUtRS3Q6","_index":"arkime_sessions3-260830","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["Private Layer INC"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["Private Layer Inc"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":74,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":1,"port":5060},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[81774],"firstPacket":1788073713681,"ipProtocol":6,"lastPacket":1788073713834,"length":153,"network":{"bytes":202,"community_id":"1:hDvYV0H1En43MlIuemew2lkFPlw=","packets":3},"node":"spark-afae","packetPos":[-81774,260525,90,0],"packetRange":{"gte":1788073713681,"lte":1788073713834},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51852 Private Layer INC","number":51852,"organization":{"name":"Private Layer INC"}},"bytes":128,"geo":{"country_iso_code":"CH"},"ip":"179.43.167.2","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":2,"port":1766},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"LACNIC","srcTTL":[50],"srcTTLCnt":1,"tags":["honeypot","sensor:frantech-ts","frantech-ts"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-4-8-1-3_1400_13"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":2638384215},"totDataBytes":0} +{"@timestamp":1788073102098,"_id":"260830-oTF0Wi0M4XpIaatfZR1KtBpd","_index":"arkime_sessions3-260830","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["Private Layer INC"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["Private Layer Inc"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":74,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":1,"port":5060},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[81763],"firstPacket":1788071986047,"ipProtocol":6,"lastPacket":1788071986200,"length":153,"network":{"bytes":202,"community_id":"1:+iadrOyg3KLetxMhm/Nm43QqOVY=","packets":3},"node":"spark-afae","packetPos":[-81763,6970472,90,0],"packetRange":{"gte":1788071986047,"lte":1788071986200},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51852 Private Layer INC","number":51852,"organization":{"name":"Private Layer INC"}},"bytes":128,"geo":{"country_iso_code":"CH"},"ip":"179.43.167.2","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":2,"port":18042},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"LACNIC","srcTTL":[50],"srcTTLCnt":1,"tags":["sensor:frantech-ts","frantech-ts","honeypot"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-4-8-1-3_1400_13"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":3916329058},"totDataBytes":0} +{"@timestamp":1788071292046,"_id":"260830-ScMm7ScUfCRHqY8z1i0lbjfY","_index":"arkime_sessions3-260830","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["Private Layer INC"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["Private Layer Inc"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":74,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":1,"port":5060},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[81752],"firstPacket":1788070258663,"ipProtocol":6,"lastPacket":1788070258816,"length":153,"network":{"bytes":202,"community_id":"1:vxxrgw0yMD8/JJRb/cz2mBUEomk=","packets":3},"node":"spark-afae","packetPos":[-81752,11757955,90,534],"packetRange":{"gte":1788070258663,"lte":1788070258816},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51852 Private Layer INC","number":51852,"organization":{"name":"Private Layer INC"}},"bytes":128,"geo":{"country_iso_code":"CH"},"ip":"179.43.167.2","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":2,"port":42748},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"LACNIC","srcTTL":[50],"srcTTLCnt":1,"tags":["frantech-ts","sensor:frantech-ts","honeypot"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-4-8-1-3_1400_13"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":4033903414},"totDataBytes":0} +{"@timestamp":1788069178277,"_id":"260830-EsNKLXV_Hh9NfZQQ7-7bVEbQ","_index":"arkime_sessions3-260830","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["Private Layer INC"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["Private Layer Inc"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":74,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":1,"port":5060},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[81738],"firstPacket":1788068531028,"ipProtocol":6,"lastPacket":1788068531180,"length":152,"network":{"bytes":202,"community_id":"1:ZIcBsRz/JxCeTdNZ787K8G1z5HI=","packets":3},"node":"spark-afae","packetPos":[-81738,9775885,90,0],"packetRange":{"gte":1788068531028,"lte":1788068531180},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51852 Private Layer INC","number":51852,"organization":{"name":"Private Layer INC"}},"bytes":128,"geo":{"country_iso_code":"CH"},"ip":"179.43.167.2","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":2,"port":50744},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"LACNIC","srcTTL":[50],"srcTTLCnt":1,"tags":["frantech-ts","sensor:frantech-ts","honeypot"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-4-8-1-3_1400_13"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":777090955},"totDataBytes":0} +{"@timestamp":1788067680128,"_id":"260830-8cKTfAppNqlF54Dy-DyL0kXe","_index":"arkime_sessions3-260830","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["Private Layer INC"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["Private Layer Inc"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":74,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":1,"port":5060},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[81727],"firstPacket":1788066803032,"ipProtocol":6,"lastPacket":1788066803184,"length":152,"network":{"bytes":202,"community_id":"1:W/HABediltgy0/OKXcol1kMLA1g=","packets":3},"node":"spark-afae","packetPos":[-81727,6084153,90,590],"packetRange":{"gte":1788066803032,"lte":1788066803184},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51852 Private Layer INC","number":51852,"organization":{"name":"Private Layer INC"}},"bytes":128,"geo":{"country_iso_code":"CH"},"ip":"179.43.167.2","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":2,"port":19264},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"LACNIC","srcTTL":[50],"srcTTLCnt":1,"tags":["sensor:frantech-ts","frantech-ts","honeypot"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-4-8-1-3_1400_13"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":3925690388},"totDataBytes":0} +{"@timestamp":1788065575448,"_id":"260830-xcIcqeD_drxMU4xAnLggQSP3","_index":"arkime_sessions3-260830","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["Private Layer INC"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["Private Layer Inc"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":74,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":1,"port":5060},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[81714],"firstPacket":1788065074416,"ipProtocol":6,"lastPacket":1788065074569,"length":153,"network":{"bytes":202,"community_id":"1:VfIvtq8tS4rhIZNYlPAPHg8Js1I=","packets":3},"node":"spark-afae","packetPos":[-81714,12121362,90,1378],"packetRange":{"gte":1788065074416,"lte":1788065074569},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51852 Private Layer INC","number":51852,"organization":{"name":"Private Layer INC"}},"bytes":128,"geo":{"country_iso_code":"CH"},"ip":"179.43.167.2","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":2,"port":54488},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"LACNIC","srcTTL":[50],"srcTTLCnt":1,"tags":["sensor:frantech-ts","frantech-ts","honeypot"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-4-8-1-3_1400_13"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":2142164314},"totDataBytes":0} +{"@timestamp":1788064052076,"_id":"260830-bzBc0jkpKZJIApiO1SOATGDy","_index":"arkime_sessions3-260830","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["Private Layer INC"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["Private Layer Inc"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":74,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":1,"port":5060},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[81703],"firstPacket":1788063346192,"ipProtocol":6,"lastPacket":1788063346344,"length":152,"network":{"bytes":202,"community_id":"1:WvionPxT0G+Yd+TmDq42TAaWrxo=","packets":3},"node":"spark-afae","packetPos":[-81703,12191005,90,0],"packetRange":{"gte":1788063346192,"lte":1788063346344},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51852 Private Layer INC","number":51852,"organization":{"name":"Private Layer INC"}},"bytes":128,"geo":{"country_iso_code":"CH"},"ip":"179.43.167.2","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":2,"port":8642},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"LACNIC","srcTTL":[50],"srcTTLCnt":1,"tags":["sensor:frantech-ts","frantech-ts","honeypot"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-4-8-1-3_1400_13"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":599019000},"totDataBytes":0} +{"@timestamp":1788061940754,"_id":"260830-YsJ70LECCfFNyLZVJsyA99_v","_index":"arkime_sessions3-260830","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["Private Layer INC"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["Private Layer Inc"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":74,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":1,"port":5060},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[81690],"firstPacket":1788061617608,"ipProtocol":6,"lastPacket":1788061617760,"length":152,"network":{"bytes":202,"community_id":"1:GBdF3wWdfiBdC33lOqLSbcokJrw=","packets":3},"node":"spark-afae","packetPos":[-81690,10249286,90,1278],"packetRange":{"gte":1788061617608,"lte":1788061617760},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51852 Private Layer INC","number":51852,"organization":{"name":"Private Layer INC"}},"bytes":128,"geo":{"country_iso_code":"CH"},"ip":"179.43.167.2","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":2,"port":19098},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"LACNIC","srcTTL":[50],"srcTTLCnt":1,"tags":["sensor:frantech-ts","frantech-ts","honeypot"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-4-8-1-3_1400_13"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":2663502667},"totDataBytes":0} +{"@timestamp":1788053802757,"_id":"260830-m8FqOBtHcKlGJ6FlKfcq7SRz","_index":"arkime_sessions3-260830","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["Private Layer INC"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["Private Layer Inc"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":74,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":1,"port":5060},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[81636],"firstPacket":1788053213577,"ipProtocol":6,"lastPacket":1788053213729,"length":152,"network":{"bytes":202,"community_id":"1:Fs6h5KOYMsjQGdKNId/9sXeLKsM=","packets":3},"node":"spark-afae","packetPos":[-81636,6065419,90,242],"packetRange":{"gte":1788053213577,"lte":1788053213729},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51852 Private Layer INC","number":51852,"organization":{"name":"Private Layer INC"}},"bytes":128,"geo":{"country_iso_code":"CH"},"ip":"179.43.167.2","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":2,"port":44020},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"LACNIC","srcTTL":[50],"srcTTLCnt":1,"tags":["honeypot","sensor:frantech-ts","frantech-ts"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-4-8-1-3_1400_13"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":1059631486},"totDataBytes":0} +{"@timestamp":1788053203073,"_id":"260830-5S7rCS_0UhlD171o9VeCO-jv","_index":"arkime_sessions3-260830","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["Private Layer INC"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["Private Layer Inc"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":74,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":1,"port":5060},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[81631],"firstPacket":1788052195147,"ipProtocol":6,"lastPacket":1788052195298,"length":151,"network":{"bytes":202,"community_id":"1:V4mftgeEDQllbvas2Cr73Dx5NW4=","packets":3},"node":"spark-afae","packetPos":[-81631,4261197,90,160],"packetRange":{"gte":1788052195147,"lte":1788052195298},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51852 Private Layer INC","number":51852,"organization":{"name":"Private Layer INC"}},"bytes":128,"geo":{"country_iso_code":"CH"},"ip":"179.43.167.2","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":2,"port":11474},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"LACNIC","srcTTL":[50],"srcTTLCnt":1,"tags":["sensor:frantech-ts","frantech-ts","honeypot"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-4-8-1-3_1400_13"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":1069536578},"totDataBytes":0} +{"@timestamp":1788052289018,"_id":"260830-xC6ifYcWVjxFxYnU9ReP99w4","_index":"arkime_sessions3-260830","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["Private Layer INC"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["Private Layer Inc"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":74,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":1,"port":5060},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[81625],"firstPacket":1788051174385,"ipProtocol":6,"lastPacket":1788051174537,"length":152,"network":{"bytes":202,"community_id":"1:KLhJFMyJ55gr+Yo5kqp9LEjoduA=","packets":3},"node":"spark-afae","packetPos":[-81625,1113442,90,978],"packetRange":{"gte":1788051174385,"lte":1788051174537},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51852 Private Layer INC","number":51852,"organization":{"name":"Private Layer INC"}},"bytes":128,"geo":{"country_iso_code":"CH"},"ip":"179.43.167.2","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":2,"port":12294},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"LACNIC","srcTTL":[50],"srcTTLCnt":1,"tags":["frantech-ts","sensor:frantech-ts","honeypot"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-4-8-1-3_1400_13"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":3759827990},"totDataBytes":0} +{"@timestamp":1788051080546,"_id":"260830-0UCETV8aQCJLIZe1h7iUM23x","_index":"arkime_sessions3-260830","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["Private Layer INC"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["Private Layer Inc"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":74,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":1,"port":5060},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[81618],"firstPacket":1788050150599,"ipProtocol":6,"lastPacket":1788050150752,"length":153,"network":{"bytes":202,"community_id":"1:JL3Z5rVcvl99IDk6eXICGraibx4=","packets":3},"node":"spark-afae","packetPos":[-81618,402066,90,3103],"packetRange":{"gte":1788050150599,"lte":1788050150752},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51852 Private Layer INC","number":51852,"organization":{"name":"Private Layer INC"}},"bytes":128,"geo":{"country_iso_code":"CH"},"ip":"179.43.167.2","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":2,"port":40186},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"LACNIC","srcTTL":[50],"srcTTLCnt":1,"tags":["sensor:frantech-ts","honeypot","frantech-ts"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-4-8-1-3_1400_13"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":1045210964},"totDataBytes":0} +{"@timestamp":1788049563201,"_id":"260830-Yi6xhGWSC0JACpU3NRtix8HU","_index":"arkime_sessions3-260830","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["Private Layer INC"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["Private Layer Inc"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":74,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":1,"port":5060},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[81606],"firstPacket":1788049125164,"ipProtocol":6,"lastPacket":1788049125317,"length":153,"network":{"bytes":202,"community_id":"1:w6lDqFPN0xY66N1Yfqx3wzKFS7c=","packets":3},"node":"spark-afae","packetPos":[-81606,3628798,90,648],"packetRange":{"gte":1788049125164,"lte":1788049125317},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51852 Private Layer INC","number":51852,"organization":{"name":"Private Layer INC"}},"bytes":128,"geo":{"country_iso_code":"CH"},"ip":"179.43.167.2","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":2,"port":5056},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"LACNIC","srcTTL":[50],"srcTTLCnt":1,"tags":["honeypot","frantech-ts","sensor:frantech-ts"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-4-8-1-3_1400_13"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":52786298},"totDataBytes":0} +{"@timestamp":1788048678211,"_id":"260830-F8HHkGg4l91GKY27hGrT_dJ5","_index":"arkime_sessions3-260830","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["Private Layer INC"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["Private Layer Inc"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":74,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":1,"port":5060},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[81601],"firstPacket":1788048098920,"ipProtocol":6,"lastPacket":1788048099072,"length":152,"network":{"bytes":202,"community_id":"1:JdAr8RoWeHpM/QK+I7v/Vetaa54=","packets":3},"node":"spark-afae","packetPos":[-81601,2972395,90,0],"packetRange":{"gte":1788048098920,"lte":1788048099072},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51852 Private Layer INC","number":51852,"organization":{"name":"Private Layer INC"}},"bytes":128,"geo":{"country_iso_code":"CH"},"ip":"179.43.167.2","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":2,"port":1360},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"LACNIC","srcTTL":[50],"srcTTLCnt":1,"tags":["honeypot","frantech-ts","sensor:frantech-ts"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-4-8-1-3_1400_13"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":1841884800},"totDataBytes":0} +{"@timestamp":1788047769116,"_id":"260829-IC4dNx37N5lKPZ3LeIadnh8-","_index":"arkime_sessions3-260829","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["Private Layer INC"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["Private Layer Inc"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":74,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":1,"port":5060},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[81595],"firstPacket":1788047070783,"ipProtocol":6,"lastPacket":1788047070936,"length":153,"network":{"bytes":202,"community_id":"1:vlVbCPWaRUPUwBxObSpySFEKCBU=","packets":3},"node":"spark-afae","packetPos":[-81595,13555544,90,340],"packetRange":{"gte":1788047070783,"lte":1788047070936},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51852 Private Layer INC","number":51852,"organization":{"name":"Private Layer INC"}},"bytes":128,"geo":{"country_iso_code":"CH"},"ip":"179.43.167.2","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":2,"port":24854},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"LACNIC","srcTTL":[50],"srcTTLCnt":1,"tags":["sensor:frantech-ts","honeypot","frantech-ts"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-4-8-1-3_1400_13"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":3441531624},"totDataBytes":0} +{"@timestamp":1788046560355,"_id":"260829-m0BdL_jtJANLoplQ64_ylyqR","_index":"arkime_sessions3-260829","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["Private Layer INC"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["Private Layer Inc"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":74,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":1,"port":5060},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[81588],"firstPacket":1788046040277,"ipProtocol":6,"lastPacket":1788046040430,"length":153,"network":{"bytes":202,"community_id":"1:d6lXf4aQK3i/MXTEyN0bnOi/MnQ=","packets":3},"node":"spark-afae","packetPos":[-81588,9530243,90,270],"packetRange":{"gte":1788046040277,"lte":1788046040430},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51852 Private Layer INC","number":51852,"organization":{"name":"Private Layer INC"}},"bytes":128,"geo":{"country_iso_code":"CH"},"ip":"179.43.167.2","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":2,"port":8288},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"LACNIC","srcTTL":[50],"srcTTLCnt":1,"tags":["honeypot","sensor:frantech-ts","frantech-ts"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-4-8-1-3_1400_13"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":1399286988},"totDataBytes":0} +{"@timestamp":1788045944300,"_id":"260829-6S2ioIGrVsRAzYTv-sV-eJaf","_index":"arkime_sessions3-260829","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["Private Layer INC"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["Private Layer Inc"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":74,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":1,"port":5060},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[81582],"firstPacket":1788045009772,"ipProtocol":6,"lastPacket":1788045009924,"length":152,"network":{"bytes":202,"community_id":"1:uT0PaCYWfy9fuvBGBA6MVoO8UKU=","packets":3},"node":"spark-afae","packetPos":[-81582,17263285,90,398],"packetRange":{"gte":1788045009772,"lte":1788045009924},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51852 Private Layer INC","number":51852,"organization":{"name":"Private Layer INC"}},"bytes":128,"geo":{"country_iso_code":"CH"},"ip":"179.43.167.2","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":2,"port":42182},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"LACNIC","srcTTL":[50],"srcTTLCnt":1,"tags":["sensor:frantech-ts","honeypot","frantech-ts"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-4-8-1-3_1400_13"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":3761630476},"totDataBytes":0} +{"@timestamp":1788045044402,"_id":"260829-hUDGzLBkoStPc6i0o8-E0UU6","_index":"arkime_sessions3-260829","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["Private Layer INC"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["Private Layer Inc"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":74,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":1,"port":5060},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[81577],"firstPacket":1788043977596,"ipProtocol":6,"lastPacket":1788043977748,"length":152,"network":{"bytes":202,"community_id":"1:8hMjqReKp50R/KXLAYSqb2OfAkM=","packets":3},"node":"spark-afae","packetPos":[-81577,13958254,90,0],"packetRange":{"gte":1788043977596,"lte":1788043977748},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51852 Private Layer INC","number":51852,"organization":{"name":"Private Layer INC"}},"bytes":128,"geo":{"country_iso_code":"CH"},"ip":"179.43.167.2","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":2,"port":15344},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"LACNIC","srcTTL":[50],"srcTTLCnt":1,"tags":["frantech-ts","sensor:frantech-ts","honeypot"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-4-8-1-3_1400_13"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":1446188082},"totDataBytes":0} +{"@timestamp":1788044141302,"_id":"260829-py1mdXleXztIFIkHlSfbDi-H","_index":"arkime_sessions3-260829","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["Private Layer INC"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["Private Layer Inc"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":74,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":1,"port":5060},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[81571],"firstPacket":1788042943349,"ipProtocol":6,"lastPacket":1788042943501,"length":152,"network":{"bytes":202,"community_id":"1:gs/MCXA5cMvOjJ+cNSMtF6X4q5o=","packets":3},"node":"spark-afae","packetPos":[-81571,289665,90,1296],"packetRange":{"gte":1788042943349,"lte":1788042943501},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51852 Private Layer INC","number":51852,"organization":{"name":"Private Layer INC"}},"bytes":128,"geo":{"country_iso_code":"CH"},"ip":"179.43.167.2","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":2,"port":22132},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"LACNIC","srcTTL":[50],"srcTTLCnt":1,"tags":["frantech-ts","sensor:frantech-ts","honeypot"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-4-8-1-3_1400_13"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":739345912},"totDataBytes":0} +{"@timestamp":1788042334054,"_id":"260829-ZS176jD1Ku9NfK5APi8zz4gb","_index":"arkime_sessions3-260829","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["Private Layer INC"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["Private Layer Inc"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":74,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":1,"port":5060},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[81559],"firstPacket":1788041911147,"ipProtocol":6,"lastPacket":1788041911300,"length":153,"network":{"bytes":202,"community_id":"1:FxGVKTPFxciBDKA2beZPAISOqSY=","packets":3},"node":"spark-afae","packetPos":[-81559,15121354,90,300],"packetRange":{"gte":1788041911147,"lte":1788041911300},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51852 Private Layer INC","number":51852,"organization":{"name":"Private Layer INC"}},"bytes":128,"geo":{"country_iso_code":"CH"},"ip":"179.43.167.2","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":2,"port":29248},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"LACNIC","srcTTL":[50],"srcTTLCnt":1,"tags":["sensor:frantech-ts","honeypot","frantech-ts"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-4-8-1-3_1400_13"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":2128892515},"totDataBytes":0} +{"@timestamp":1788041432970,"_id":"260829-RC3bnf__DkRL3aYXx1zs4ccV","_index":"arkime_sessions3-260829","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["Private Layer INC"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["Private Layer Inc"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":74,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":1,"port":5060},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[81553],"firstPacket":1788040878730,"ipProtocol":6,"lastPacket":1788040878882,"length":152,"network":{"bytes":202,"community_id":"1:W8lD4VXwVMK9z9F0HRqJW98nTEk=","packets":3},"node":"spark-afae","packetPos":[-81553,12616576,90,1938],"packetRange":{"gte":1788040878730,"lte":1788040878882},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51852 Private Layer INC","number":51852,"organization":{"name":"Private Layer INC"}},"bytes":128,"geo":{"country_iso_code":"CH"},"ip":"179.43.167.2","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":2,"port":34554},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"LACNIC","srcTTL":[50],"srcTTLCnt":1,"tags":["sensor:frantech-ts","honeypot","frantech-ts"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-4-8-1-3_1400_13"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":2250673041},"totDataBytes":0} +{"@timestamp":1788040532223,"_id":"260829-RcDozSabHF1Kf6dPMcTd2ibp","_index":"arkime_sessions3-260829","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["Private Layer INC"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["Private Layer Inc"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":74,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":1,"port":5060},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[81546],"firstPacket":1788039846333,"ipProtocol":6,"lastPacket":1788039846485,"length":152,"network":{"bytes":202,"community_id":"1:SmQ6ZrseVzfEpp0lI/RNoO55S00=","packets":3},"node":"spark-afae","packetPos":[-81546,8465058,90,1016],"packetRange":{"gte":1788039846333,"lte":1788039846485},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51852 Private Layer INC","number":51852,"organization":{"name":"Private Layer INC"}},"bytes":128,"geo":{"country_iso_code":"CH"},"ip":"179.43.167.2","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":2,"port":49128},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"LACNIC","srcTTL":[50],"srcTTLCnt":1,"tags":["sensor:frantech-ts","honeypot","frantech-ts"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-4-8-1-3_1400_13"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":3392562308},"totDataBytes":0} +{"@timestamp":1788039621870,"_id":"260829-Ay0qnyNBULNO8K7zUO2hLmf2","_index":"arkime_sessions3-260829","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["Private Layer INC"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["Private Layer Inc"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":74,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":1,"port":5060},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[81540],"firstPacket":1788038812570,"ipProtocol":6,"lastPacket":1788038812722,"length":152,"network":{"bytes":202,"community_id":"1:wnc9mAOFnslnLRB3RM5SlHTfTos=","packets":3},"node":"spark-afae","packetPos":[-81540,5784489,90,0],"packetRange":{"gte":1788038812570,"lte":1788038812722},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51852 Private Layer INC","number":51852,"organization":{"name":"Private Layer INC"}},"bytes":128,"geo":{"country_iso_code":"CH"},"ip":"179.43.167.2","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":2,"port":21290},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"LACNIC","srcTTL":[50],"srcTTLCnt":1,"tags":["honeypot","sensor:frantech-ts","frantech-ts"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-4-8-1-3_1400_13"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":2509515529},"totDataBytes":0} +{"@timestamp":1788038696048,"_id":"260829-4izuicNqyBlPlpaOxvb0I8vV","_index":"arkime_sessions3-260829","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["Private Layer INC"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["Private Layer Inc"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":74,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":1,"port":5060},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[81534],"firstPacket":1788037777085,"ipProtocol":6,"lastPacket":1788037777237,"length":152,"network":{"bytes":202,"community_id":"1:n9QWhK6cTj+fjhk7/2BzCaqywaA=","packets":3},"node":"spark-afae","packetPos":[-81534,4945928,90,1470],"packetRange":{"gte":1788037777085,"lte":1788037777237},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51852 Private Layer INC","number":51852,"organization":{"name":"Private Layer INC"}},"bytes":128,"geo":{"country_iso_code":"CH"},"ip":"179.43.167.2","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":2,"port":19026},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"LACNIC","srcTTL":[50],"srcTTLCnt":1,"tags":["frantech-ts","honeypot","sensor:frantech-ts"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-4-8-1-3_1400_13"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":1833271266},"totDataBytes":0} +{"@timestamp":1788037794908,"_id":"260829-wSxPxFwZVmJNhqfWoElRFypQ","_index":"arkime_sessions3-260829","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["Private Layer INC"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["Private Layer Inc"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":74,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":1,"port":5060},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[81528],"firstPacket":1788036742213,"ipProtocol":6,"lastPacket":1788036742366,"length":153,"network":{"bytes":202,"community_id":"1:bzSBTMIhcr/rtYi4uZpkB5JaRS8=","packets":3},"node":"spark-afae","packetPos":[-81528,2505609,90,160],"packetRange":{"gte":1788036742213,"lte":1788036742366},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51852 Private Layer INC","number":51852,"organization":{"name":"Private Layer INC"}},"bytes":128,"geo":{"country_iso_code":"CH"},"ip":"179.43.167.2","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":2,"port":31552},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"LACNIC","srcTTL":[50],"srcTTLCnt":1,"tags":["frantech-ts","sensor:frantech-ts","honeypot"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-4-8-1-3_1400_13"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":3382166870},"totDataBytes":0} +{"@timestamp":1788035996083,"_id":"260829-zL8axxyl_ntJMK0VarkJsznD","_index":"arkime_sessions3-260829","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["Private Layer INC"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["Private Layer Inc"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":74,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":1,"port":5060},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[81515],"firstPacket":1788035705356,"ipProtocol":6,"lastPacket":1788035705508,"length":152,"network":{"bytes":202,"community_id":"1:oLlDsV301I+fMLnRSpULFukxP5I=","packets":3},"node":"spark-afae","packetPos":[-81515,4555417,90,940],"packetRange":{"gte":1788035705356,"lte":1788035705508},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51852 Private Layer INC","number":51852,"organization":{"name":"Private Layer INC"}},"bytes":128,"geo":{"country_iso_code":"CH"},"ip":"179.43.167.2","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":2,"port":45666},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"LACNIC","srcTTL":[50],"srcTTLCnt":1,"tags":["sensor:frantech-ts","honeypot","frantech-ts"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-4-8-1-3_1400_13"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":1502402126},"totDataBytes":0} +{"@timestamp":1788032086822,"_id":"260829-8Std4LVu-ApMBK9zmM0yp2k3","_index":"arkime_sessions3-260829","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Kaopu Cloud HK Limited"],"isp.dstCnt":1,"isp.src":["Private Layer INC"],"isp.srcCnt":1,"org.dst":["LightNode-BH"],"org.dstCnt":1,"org.src":["Private Layer Inc"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":0,"geo":{"country_iso_code":"BH"},"ip":"38.54.2.209","mac":["52:54:8f:9d:76:48"],"mac-cnt":1,"packets":0,"port":5060},"dstRIR":"ARIN","ethertype":2048,"fileId":[81491],"firstPacket":1788031039926,"ipProtocol":6,"lastPacket":1788031039926,"length":0,"network":{"bytes":58,"community_id":"1:HFsTF6b8XWkjn6Vdv8SnJyEI9YM=","packets":1},"node":"spark-afae","packetPos":[-81491,427064],"packetRange":{"gte":1788031039926,"lte":1788031039926},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51852 Private Layer INC","number":51852,"organization":{"name":"Private Layer INC"}},"bytes":58,"geo":{"country_iso_code":"CH"},"ip":"179.43.167.2","mac":["98:44:ce:60:15:19"],"mac-cnt":1,"packets":1,"port":42529},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Huawei Technologies Co.,Ltd"],"srcOuiCnt":1,"srcRIR":"LACNIC","srcTTL":[240],"srcTTLCnt":1,"tags":["bahrain-sponge-01-ts","honeypot","sensor:bahrain-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["1025_2_1460_00"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":3658342513},"totDataBytes":0} +{"@timestamp":1788032086730,"_id":"260829-9z9bA7qUvhdO9LogqR6zmzPt","_index":"arkime_sessions3-260829","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["netcup GmbH"],"isp.dstCnt":1,"isp.src":["Private Layer INC"],"isp.srcCnt":1,"org.dst":["Netcup KVM"],"org.dstCnt":1,"org.src":["Private Layer Inc"],"org.srcCnt":1,"usertype.dst":["business"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS197540 netcup GmbH","number":197540,"organization":{"name":"netcup GmbH"}},"bytes":0,"geo":{"country_iso_code":"DE"},"ip":"159.195.21.150","mac":["8a:41:d3:b8:0d:d3"],"mac-cnt":1,"packets":0,"port":5060},"dstRIR":"ARIN","ethertype":2048,"fileId":[81489],"firstPacket":1788030982173,"ipProtocol":6,"lastPacket":1788030982173,"length":0,"network":{"bytes":58,"community_id":"1:F7sRfecPRlV9kMYWHbIe0Gk4gq4=","packets":1},"node":"spark-afae","packetPos":[-81489,43467],"packetRange":{"gte":1788030982173,"lte":1788030982173},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51852 Private Layer INC","number":51852,"organization":{"name":"Private Layer INC"}},"bytes":58,"geo":{"country_iso_code":"CH"},"ip":"179.43.167.2","mac":["bc:0f:fe:38:0b:a3"],"mac-cnt":1,"packets":1,"port":42545},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"LACNIC","srcTTL":[245],"srcTTLCnt":1,"tags":["sensor:netcup-ts","netcup-ts","honeypot"],"tagsCnt":3,"tcp":{"ja4t":["1025_2_1460_00"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":3619368882},"totDataBytes":0} +{"@timestamp":1788031784389,"_id":"260829-ar-KnS_4uk5GZKeZyhNSVaDE","_index":"arkime_sessions3-260829","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Hetzner Online GmbH"],"isp.dstCnt":1,"isp.src":["Private Layer INC"],"isp.srcCnt":1,"org.dst":["HETZNER-DC"],"org.dstCnt":1,"org.src":["Private Layer Inc"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS24940 Hetzner Online GmbH","number":24940,"organization":{"name":"Hetzner Online GmbH"}},"bytes":0,"geo":{"country_iso_code":"FI"},"ip":"89.167.72.144","mac":["92:00:07:4c:82:70"],"mac-cnt":1,"packets":0,"port":5060},"dstRIR":"RIPE","ethertype":2048,"fileId":[81487],"firstPacket":1788030726110,"ipProtocol":6,"lastPacket":1788030726110,"length":0,"network":{"bytes":58,"community_id":"1:HIR58sl/8FJAa8XuMBeNw/c3++M=","packets":1},"node":"spark-afae","packetPos":[-81487,244875],"packetRange":{"gte":1788030726110,"lte":1788030726110},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51852 Private Layer INC","number":51852,"organization":{"name":"Private Layer INC"}},"bytes":58,"geo":{"country_iso_code":"CH"},"ip":"179.43.167.2","mac":["d2:74:7f:6e:37:e3"],"mac-cnt":1,"packets":1,"port":42529},"spoofable":["true"],"spoofableCnt":1,"srcRIR":"LACNIC","srcTTL":[242],"srcTTLCnt":1,"tags":["sensor:sponge-01-ts","sponge-01-ts","honeypot"],"tagsCnt":3,"tcp":{"ja4t":["1025_2_1460_00"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":3731721594},"totDataBytes":0} +{"@timestamp":1788027269466,"_id":"260829-Qis8Ig-gMCVMDIv0WKnnQKMa","_index":"arkime_sessions3-260829","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Private Layer INC"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Private Layer Inc"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":0,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":0,"port":5060},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[81458],"firstPacket":1788026610307,"ipProtocol":6,"lastPacket":1788026610307,"length":0,"network":{"bytes":60,"community_id":"1:dkrF4B7furyXw1jMjAz/jhrYgak=","packets":1},"node":"spark-afae","packetPos":[-81458,1193271],"packetRange":{"gte":1788026610307,"lte":1788026610307},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51852 Private Layer INC","number":51852,"organization":{"name":"Private Layer INC"}},"bytes":60,"geo":{"country_iso_code":"CH"},"ip":"179.43.167.2","mac":["fc:bd:67:9d:2b:2b"],"mac-cnt":1,"packets":1,"port":42529},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcRIR":"LACNIC","srcTTL":[243],"srcTTLCnt":1,"tags":["sensor:contabo-sponge-01-ts","contabo-sponge-01-ts","honeypot"],"tagsCnt":3,"tcp":{"ja4t":["1025_2_1460_00"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":2914157596},"totDataBytes":0} +{"@timestamp":1788024246581,"_id":"260829-1CqvypkrMbJDypjjaEzjiTnE","_index":"arkime_sessions3-260829","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["Private Layer INC"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["Private Layer Inc"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":58,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":1,"port":5060},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[81438],"firstPacket":1788023175653,"ipProtocol":6,"lastPacket":1788023175811,"length":158,"network":{"bytes":228,"community_id":"1:N1tNIAlTU0cnEXhiIao1RDYQ8g0=","packets":4},"node":"spark-afae","packetPos":[-81438,201512,74,658,70],"packetRange":{"gte":1788023175653,"lte":1788023175811},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51852 Private Layer INC","number":51852,"organization":{"name":"Private Layer INC"}},"bytes":170,"geo":{"country_iso_code":"CH"},"ip":"179.43.167.2","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":3,"port":42545},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"LACNIC","srcTTL":[50,241],"srcTTLCnt":2,"tags":["honeypot","frantech-ts","sensor:frantech-ts"],"tagsCnt":3,"tcp":{"ja4t":["1025_2_1400_00"],"ja4tCnt":1,"ja4ts":["64240_2_1460_00"],"ja4tsCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":2,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":804529315},"totDataBytes":0} +{"@timestamp":1788023946002,"_id":"260829-mr5jPuIo22pMC4A1HVljILJI","_index":"arkime_sessions3-260829","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo GmbH"],"isp.dstCnt":1,"isp.src":["Private Layer INC"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Private Layer Inc"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS51167 Contabo GmbH","number":51167,"organization":{"name":"Contabo GmbH"}},"bytes":0,"geo":{"country_iso_code":"FR"},"ip":"109.123.246.142","mac":["00:50:56:63:46:a6"],"mac-cnt":1,"packets":0,"port":5060},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[81435],"firstPacket":1788022912114,"ipProtocol":6,"lastPacket":1788022912114,"length":0,"network":{"bytes":60,"community_id":"1:4kMZE6pGewJJ4HoInJUFY5j2cY0=","packets":1},"node":"spark-afae","packetPos":[-81435,739308],"packetRange":{"gte":1788022912114,"lte":1788022912114},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51852 Private Layer INC","number":51852,"organization":{"name":"Private Layer INC"}},"bytes":60,"geo":{"country_iso_code":"CH"},"ip":"179.43.167.2","mac":["c0:69:11:cd:1f:19"],"mac-cnt":1,"packets":1,"port":42545},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcRIR":"LACNIC","srcTTL":[246],"srcTTLCnt":1,"tags":["sensor:contabo-sponge-02-ts","proxy","contabo-sponge-02-ts"],"tagsCnt":3,"tcp":{"ja4t":["1025_2_1460_00"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":4205690105},"totDataBytes":0} +{"@timestamp":1787686412368,"_id":"260825-f6CEUHmJTmdJlqBriAESBogb","_index":"arkime_sessions3-260825","client":{"bytes":1016},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["netcup GmbH"],"isp.dstCnt":1,"isp.src":["Private Layer INC"],"isp.srcCnt":1,"org.dst":["Netcup KVM"],"org.dstCnt":1,"org.src":["Private Layer Inc"],"org.srcCnt":1,"usertype.dst":["business"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS197540 netcup GmbH","number":197540,"organization":{"name":"netcup GmbH"}},"bytes":0,"geo":{"country_iso_code":"DE"},"ip":"159.195.21.150","mac":["8a:41:d3:b8:0d:d3"],"mac-cnt":1,"packets":0,"port":5060},"dstRIR":"ARIN","ethertype":2048,"fileId":[79395],"firstPacket":1787686017959,"ipProtocol":17,"lastPacket":1787686017959,"length":0,"network":{"bytes":1058,"community_id":"1:7AnH0XAaTyE661Wc1yEaM/9JHbk=","packets":1},"node":"spark-afae","packetPos":[-79395,1480971],"packetRange":{"gte":1787686017959,"lte":1787686017959},"protocol":["udp","sip"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":0},"sip":{"callid":["Un6Y04y67FIR4bMMXJtfJc.."],"callidCnt":1,"contact":["\u003csip:17168465496@179.43.167.2:26631\u003e"],"contactCnt":1,"from":["\u003csip:17168465496@179.43.167.2\u003e;tag=4920fd1d"],"fromCnt":1,"method":["INVITE"],"methodCnt":1,"to":["\u003csip:8103908351673002@159.195.21.150:5060\u003e"],"toCnt":1,"user":["8103908351673002","17168465496"],"userCnt":2,"useragent":["OpenVox"],"useragentCnt":1,"via":["SIP/2.0/UDP 179.43.167.2:26631;branch=z9hG4bK-524287-1---bfa9515ffed485b6"],"viaCnt":1},"source":{"as":{"full":"AS51852 Private Layer INC","number":51852,"organization":{"name":"Private Layer INC"}},"bytes":1058,"geo":{"country_iso_code":"CH"},"ip":"179.43.167.2","mac":["bc:0f:fe:38:0b:a3"],"mac-cnt":1,"packets":1,"port":26631},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcPayload8":"494e564954452073","srcRIR":"LACNIC","srcTTL":[54],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["461308078748594"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["b05640bd-eb2a-4d9d-8d73-d14d7cbeb44a"],"signatureCnt":1,"signatureId":[1071802],"signatureIdCnt":1},"tag":{"block":["false"],"blockCnt":1,"category":["protocol"],"categoryCnt":1,"description":["ip addresses with this tag have been observed sending sip traffic."],"intention":["unknown"],"intentionCnt":1,"name":["sip protocol"],"nameCnt":1},"tags":["netcup-ts","honeypot","sensor:netcup-ts"],"tagsCnt":3,"totDataBytes":1016} +{"@timestamp":1787683061865,"_id":"260825-MqCCGejTU3xNrbDLJEgw1Gif","_index":"arkime_sessions3-260825","client":{"bytes":1019},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Private Layer INC"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Private Layer Inc"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":0,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":0,"port":5060},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[79376],"firstPacket":1787682213182,"ipProtocol":17,"lastPacket":1787682213182,"length":0,"network":{"bytes":1061,"community_id":"1:XLxiiDmLvds/E3gfRZpspuILYvg=","packets":1},"node":"spark-afae","packetPos":[-79376,2762257],"packetRange":{"gte":1787682213182,"lte":1787682213182},"protocol":["udp","sip"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":0},"sip":{"callid":["l4bDAGQK8PFQTqL9Rh5TJe.."],"callidCnt":1,"contact":["\u003csip:16724692132@179.43.167.2:26631\u003e"],"contactCnt":1,"from":["\u003csip:16724692132@179.43.167.2\u003e;tag=b79c5cb3"],"fromCnt":1,"method":["INVITE"],"methodCnt":1,"to":["\u003csip:8103908351673002@217.15.163.226:5060\u003e"],"toCnt":1,"user":["8103908351673002","16724692132"],"userCnt":2,"useragent":["Yate/6.0.0"],"useragentCnt":1,"via":["SIP/2.0/UDP 179.43.167.2:26631;branch=z9hG4bK-524287-1---58ed9910de873b15"],"viaCnt":1},"source":{"as":{"full":"AS51852 Private Layer INC","number":51852,"organization":{"name":"Private Layer INC"}},"bytes":1061,"geo":{"country_iso_code":"CH"},"ip":"179.43.167.2","mac":["fc:bd:67:9d:2b:2b"],"mac-cnt":1,"packets":1,"port":26631},"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcPayload8":"494e564954452073","srcRIR":"LACNIC","srcTTL":[52],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["1626403712497842"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["b05640bd-eb2a-4d9d-8d73-d14d7cbeb44a"],"signatureCnt":1,"signatureId":[1071802],"signatureIdCnt":1},"tag":{"block":["false"],"blockCnt":1,"category":["protocol"],"categoryCnt":1,"description":["ip addresses with this tag have been observed sending sip traffic."],"intention":["unknown"],"intentionCnt":1,"name":["sip protocol"],"nameCnt":1},"tags":["contabo-sponge-01-ts","honeypot","sensor:contabo-sponge-01-ts"],"tagsCnt":3,"totDataBytes":1019} +{"@timestamp":1787681534713,"_id":"260825-pP30EittxndMfKD9QPQqaJ_W","_index":"arkime_sessions3-260825","client":{"bytes":1019},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Kaopu Cloud HK Limited"],"isp.dstCnt":1,"isp.src":["Private Layer INC"],"isp.srcCnt":1,"org.dst":["LightNode-BH"],"org.dstCnt":1,"org.src":["Private Layer Inc"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":0,"geo":{"country_iso_code":"BH"},"ip":"38.54.2.209","mac":["52:54:8f:9d:76:48"],"mac-cnt":1,"packets":0,"port":5060},"dstRIR":"ARIN","ethertype":2048,"fileId":[79368],"firstPacket":1787680831708,"ipProtocol":17,"lastPacket":1787680831708,"length":0,"network":{"bytes":1061,"community_id":"1:oNeQPu1kcxGQVW2VNpGuaftbOSU=","packets":1},"node":"spark-afae","packetPos":[-79368,1042653],"packetRange":{"gte":1787680831708,"lte":1787680831708},"protocol":["udp","sip"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":0},"sip":{"callid":["Anv0jvM3Aop8bQYEF4E5mL.."],"callidCnt":1,"contact":["\u003csip:16563628947@179.43.167.2:26631\u003e"],"contactCnt":1,"from":["\u003csip:16563628947@179.43.167.2\u003e;tag=cfc9d284"],"fromCnt":1,"method":["INVITE"],"methodCnt":1,"to":["\u003csip:8103908351673002@38.54.2.209:5060\u003e"],"toCnt":1,"user":["16563628947","8103908351673002"],"userCnt":2,"useragent":["Yealink SIP-T46S"],"useragentCnt":1,"via":["SIP/2.0/UDP 179.43.167.2:26631;branch=z9hG4bK-524287-1---ee81ac434e4f1950"],"viaCnt":1},"source":{"as":{"full":"AS51852 Private Layer INC","number":51852,"organization":{"name":"Private Layer INC"}},"bytes":1061,"geo":{"country_iso_code":"CH"},"ip":"179.43.167.2","mac":["98:44:ce:60:15:19"],"mac-cnt":1,"packets":1,"port":26631},"srcOui":["Huawei Technologies Co.,Ltd"],"srcOuiCnt":1,"srcPayload8":"494e564954452073","srcRIR":"LACNIC","srcTTL":[50],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["2197338749859177"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["b05640bd-eb2a-4d9d-8d73-d14d7cbeb44a"],"signatureCnt":1,"signatureId":[1071802],"signatureIdCnt":1},"tag":{"block":["false"],"blockCnt":1,"category":["protocol"],"categoryCnt":1,"description":["ip addresses with this tag have been observed sending sip traffic."],"intention":["unknown"],"intentionCnt":1,"name":["sip protocol"],"nameCnt":1},"tags":["bahrain-sponge-01-ts","honeypot","sensor:bahrain-sponge-01-ts"],"tagsCnt":3,"totDataBytes":1019} +{"@timestamp":1787679126204,"_id":"260825-Tf1mSKKefE1KJLLO7phjF-js","_index":"arkime_sessions3-260825","client":{"bytes":1024},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo GmbH"],"isp.dstCnt":1,"isp.src":["Private Layer INC"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Private Layer Inc"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS51167 Contabo GmbH","number":51167,"organization":{"name":"Contabo GmbH"}},"bytes":0,"geo":{"country_iso_code":"FR"},"ip":"109.123.246.142","mac":["00:50:56:63:46:a6"],"mac-cnt":1,"packets":0,"port":5060},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[79354],"firstPacket":1787678581809,"ipProtocol":17,"lastPacket":1787678581809,"length":0,"network":{"bytes":1066,"community_id":"1:kIUR+WIfgssGLHaTY30dt1EUHYg=","packets":1},"node":"spark-afae","packetPos":[-79354,839113],"packetRange":{"gte":1787678581809,"lte":1787678581809},"protocol":["udp","sip"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":0},"sip":{"callid":["dGcKTlc1xzFVXpqmUS6gTf.."],"callidCnt":1,"contact":["\u003csip:16299777872@179.43.167.2:26631\u003e"],"contactCnt":1,"from":["\u003csip:16299777872@179.43.167.2\u003e;tag=b5ac4942"],"fromCnt":1,"method":["INVITE"],"methodCnt":1,"to":["\u003csip:8103908351673002@109.123.246.142:5060\u003e"],"toCnt":1,"user":["16299777872","8103908351673002"],"userCnt":2,"useragent":["Cisco CP-8851"],"useragentCnt":1,"via":["SIP/2.0/UDP 179.43.167.2:26631;branch=z9hG4bK-524287-1---092ff1a5456d4623"],"viaCnt":1},"source":{"as":{"full":"AS51852 Private Layer INC","number":51852,"organization":{"name":"Private Layer INC"}},"bytes":1066,"geo":{"country_iso_code":"CH"},"ip":"179.43.167.2","mac":["c0:69:11:cd:1f:19"],"mac-cnt":1,"packets":1,"port":26631},"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcPayload8":"494e564954452073","srcRIR":"LACNIC","srcTTL":[55],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["1504380979877684"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["b05640bd-eb2a-4d9d-8d73-d14d7cbeb44a"],"signatureCnt":1,"signatureId":[1071802],"signatureIdCnt":1},"tag":{"block":["false"],"blockCnt":1,"category":["protocol"],"categoryCnt":1,"description":["ip addresses with this tag have been observed sending sip traffic."],"intention":["unknown"],"intentionCnt":1,"name":["sip protocol"],"nameCnt":1},"tags":["proxy","sensor:contabo-sponge-02-ts","contabo-sponge-02-ts"],"tagsCnt":3,"totDataBytes":1024} +{"@timestamp":1787668582818,"_id":"260825-2PsXyilkaZRE5Z8-Ue7o7R0i","_index":"arkime_sessions3-260825","client":{"bytes":1022},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Private Layer INC"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Private Layer Inc"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":0,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":0,"port":5060},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[79296],"firstPacket":1787667676755,"ipProtocol":17,"lastPacket":1787667676755,"length":0,"network":{"bytes":1064,"community_id":"1:VA2NQG8IWuJpg/T5ANqGaR2x4hc=","packets":1},"node":"spark-afae","packetPos":[-79296,1078746],"packetRange":{"gte":1787667676755,"lte":1787667676755},"protocol":["sip","udp"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":0},"sip":{"callid":["NZsVxF9hT68IVliffpKmyZ.."],"callidCnt":1,"contact":["\u003csip:16724692132@179.43.167.2:22342\u003e"],"contactCnt":1,"from":["\u003csip:16724692132@179.43.167.2\u003e;tag=28d48438"],"fromCnt":1,"method":["INVITE"],"methodCnt":1,"to":["\u003csip:0003908351673002@217.15.163.226:5060\u003e"],"toCnt":1,"user":["16724692132","0003908351673002"],"userCnt":2,"useragent":["Cisco-CUCM6.1"],"useragentCnt":1,"via":["SIP/2.0/UDP 179.43.167.2:22342;branch=z9hG4bK-524287-1---2327a6c48bb49559"],"viaCnt":1},"source":{"as":{"full":"AS51852 Private Layer INC","number":51852,"organization":{"name":"Private Layer INC"}},"bytes":1064,"geo":{"country_iso_code":"CH"},"ip":"179.43.167.2","mac":["fc:bd:67:9d:2b:2b"],"mac-cnt":1,"packets":1,"port":22342},"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcPayload8":"494e564954452073","srcRIR":"LACNIC","srcTTL":[52],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["1273157764429593"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["b05640bd-eb2a-4d9d-8d73-d14d7cbeb44a"],"signatureCnt":1,"signatureId":[1071802],"signatureIdCnt":1},"tag":{"block":["false"],"blockCnt":1,"category":["protocol"],"categoryCnt":1,"description":["ip addresses with this tag have been observed sending sip traffic."],"intention":["unknown"],"intentionCnt":1,"name":["sip protocol"],"nameCnt":1},"tags":["honeypot","contabo-sponge-01-ts","sensor:contabo-sponge-01-ts"],"tagsCnt":3,"totDataBytes":1022} +{"@timestamp":1787664645730,"_id":"260825-Vft5npeBZjxN-L4Q7bt1DSI7","_index":"arkime_sessions3-260825","client":{"bytes":1018},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo GmbH"],"isp.dstCnt":1,"isp.src":["Private Layer INC"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Private Layer Inc"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS51167 Contabo GmbH","number":51167,"organization":{"name":"Contabo GmbH"}},"bytes":0,"geo":{"country_iso_code":"FR"},"ip":"109.123.246.142","mac":["00:50:56:63:46:a6"],"mac-cnt":1,"packets":0,"port":5060},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[79274],"firstPacket":1787664055527,"ipProtocol":17,"lastPacket":1787664055527,"length":0,"network":{"bytes":1060,"community_id":"1:5XFrow/68Qf0a1HBsLWoaE1iNZQ=","packets":1},"node":"spark-afae","packetPos":[-79274,175784],"packetRange":{"gte":1787664055527,"lte":1787664055527},"protocol":["udp","sip"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":0},"sip":{"callid":["MdRNnng9MVgSNsEYSLKsbo.."],"callidCnt":1,"contact":["\u003csip:16299777872@179.43.167.2:22342\u003e"],"contactCnt":1,"from":["\u003csip:16299777872@179.43.167.2\u003e;tag=e032d4da"],"fromCnt":1,"method":["INVITE"],"methodCnt":1,"to":["\u003csip:0003908351673002@109.123.246.142:5060\u003e"],"toCnt":1,"user":["16299777872","0003908351673002"],"userCnt":2,"useragent":["Dinstar"],"useragentCnt":1,"via":["SIP/2.0/UDP 179.43.167.2:22342;branch=z9hG4bK-524287-1---9f49d53a9e72d640"],"viaCnt":1},"source":{"as":{"full":"AS51852 Private Layer INC","number":51852,"organization":{"name":"Private Layer INC"}},"bytes":1060,"geo":{"country_iso_code":"CH"},"ip":"179.43.167.2","mac":["c0:69:11:cd:1f:19"],"mac-cnt":1,"packets":1,"port":22342},"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcPayload8":"494e564954452073","srcRIR":"LACNIC","srcTTL":[55],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["1985221277801659"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["b05640bd-eb2a-4d9d-8d73-d14d7cbeb44a"],"signatureCnt":1,"signatureId":[1071802],"signatureIdCnt":1},"tag":{"block":["false"],"blockCnt":1,"category":["protocol"],"categoryCnt":1,"description":["ip addresses with this tag have been observed sending sip traffic."],"intention":["unknown"],"intentionCnt":1,"name":["sip protocol"],"nameCnt":1},"tags":["contabo-sponge-02-ts","sensor:contabo-sponge-02-ts","proxy"],"tagsCnt":3,"totDataBytes":1018} +{"@timestamp":1787654074113,"_id":"260825-7PkcUwl7o0lAjqrnCGAQcLWF","_index":"arkime_sessions3-260825","client":{"bytes":1024},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Private Layer INC"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Private Layer Inc"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":0,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":0,"port":5060},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[79216],"firstPacket":1787653173403,"ipProtocol":17,"lastPacket":1787653173403,"length":0,"network":{"bytes":1066,"community_id":"1:T1lPzT/6FLkaIY+89LYsRMkOaEU=","packets":1},"node":"spark-afae","packetPos":[-79216,520213],"packetRange":{"gte":1787653173403,"lte":1787653173403},"protocol":["udp","sip"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":0},"sip":{"callid":["VRwlIzi9tOCLMtZzRYj9LN.."],"callidCnt":1,"contact":["\u003csip:16724692132@179.43.167.2:27009\u003e"],"contactCnt":1,"from":["\u003csip:16724692132@179.43.167.2\u003e;tag=5f0012e8"],"fromCnt":1,"method":["INVITE"],"methodCnt":1,"to":["\u003csip:98103908351673002@217.15.163.226:5060\u003e"],"toCnt":1,"user":["98103908351673002","16724692132"],"userCnt":2,"useragent":["baresip/2.9.0"],"useragentCnt":1,"via":["SIP/2.0/UDP 179.43.167.2:27009;branch=z9hG4bK-524287-1---7f649933386f4508"],"viaCnt":1},"source":{"as":{"full":"AS51852 Private Layer INC","number":51852,"organization":{"name":"Private Layer INC"}},"bytes":1066,"geo":{"country_iso_code":"CH"},"ip":"179.43.167.2","mac":["fc:bd:67:9d:2b:2b"],"mac-cnt":1,"packets":1,"port":27009},"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcPayload8":"494e564954452073","srcRIR":"LACNIC","srcTTL":[52],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["1450429409333683"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["b05640bd-eb2a-4d9d-8d73-d14d7cbeb44a"],"signatureCnt":1,"signatureId":[1071802],"signatureIdCnt":1},"tag":{"block":["false"],"blockCnt":1,"category":["protocol"],"categoryCnt":1,"description":["ip addresses with this tag have been observed sending sip traffic."],"intention":["unknown"],"intentionCnt":1,"name":["sip protocol"],"nameCnt":1},"tags":["contabo-sponge-01-ts","sensor:contabo-sponge-01-ts","honeypot"],"tagsCnt":3,"totDataBytes":1024} +{"@timestamp":1787652576260,"_id":"260825-wPljv3iTVYdFJY9u-1L7RHiY","_index":"arkime_sessions3-260825","client":{"bytes":1021},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Kaopu Cloud HK Limited"],"isp.dstCnt":1,"isp.src":["Private Layer INC"],"isp.srcCnt":1,"org.dst":["LightNode-BH"],"org.dstCnt":1,"org.src":["Private Layer Inc"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":0,"geo":{"country_iso_code":"BH"},"ip":"38.54.2.209","mac":["52:54:8f:9d:76:48"],"mac-cnt":1,"packets":0,"port":5060},"dstRIR":"ARIN","ethertype":2048,"fileId":[79206],"firstPacket":1787651800338,"ipProtocol":17,"lastPacket":1787651800338,"length":0,"network":{"bytes":1063,"community_id":"1:Y54d1/cN/aHvKm1Mavi130Yp0AI=","packets":1},"node":"spark-afae","packetPos":[-79206,323760],"packetRange":{"gte":1787651800338,"lte":1787651800338},"protocol":["udp","sip"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":0},"sip":{"callid":["RH0Op2lcBynMEHHCd3Hrfr.."],"callidCnt":1,"contact":["\u003csip:16563628947@179.43.167.2:27009\u003e"],"contactCnt":1,"from":["\u003csip:16563628947@179.43.167.2\u003e;tag=4ee4d0d2"],"fromCnt":1,"method":["INVITE"],"methodCnt":1,"to":["\u003csip:98103908351673002@38.54.2.209:5060\u003e"],"toCnt":1,"user":["16563628947","98103908351673002"],"userCnt":2,"useragent":["snom320/8.7.5.32"],"useragentCnt":1,"via":["SIP/2.0/UDP 179.43.167.2:27009;branch=z9hG4bK-524287-1---18c7c75da3aa4e9b"],"viaCnt":1},"source":{"as":{"full":"AS51852 Private Layer INC","number":51852,"organization":{"name":"Private Layer INC"}},"bytes":1063,"geo":{"country_iso_code":"CH"},"ip":"179.43.167.2","mac":["98:44:ce:60:15:19"],"mac-cnt":1,"packets":1,"port":27009},"srcOui":["Huawei Technologies Co.,Ltd"],"srcOuiCnt":1,"srcPayload8":"494e564954452073","srcRIR":"LACNIC","srcTTL":[50],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["45429645017569"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["b05640bd-eb2a-4d9d-8d73-d14d7cbeb44a"],"signatureCnt":1,"signatureId":[1071802],"signatureIdCnt":1},"tag":{"block":["false"],"blockCnt":1,"category":["protocol"],"categoryCnt":1,"description":["ip addresses with this tag have been observed sending sip traffic."],"intention":["unknown"],"intentionCnt":1,"name":["sip protocol"],"nameCnt":1},"tags":["sensor:bahrain-sponge-01-ts","bahrain-sponge-01-ts","honeypot"],"tagsCnt":3,"totDataBytes":1021} +{"@timestamp":1787643208093,"_id":"260825-w5w68F5IFyhKB7Ez96g6x6n9","_index":"arkime_sessions3-260825","client":{"bytes":1019},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["netcup GmbH"],"isp.dstCnt":1,"isp.src":["Private Layer INC"],"isp.srcCnt":1,"org.dst":["Netcup KVM"],"org.dstCnt":1,"org.src":["Private Layer Inc"],"org.srcCnt":1,"usertype.dst":["business"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS197540 netcup GmbH","number":197540,"organization":{"name":"netcup GmbH"}},"bytes":0,"geo":{"country_iso_code":"DE"},"ip":"159.195.21.150","mac":["8a:41:d3:b8:0d:d3"],"mac-cnt":1,"packets":0,"port":5060},"dstRIR":"ARIN","ethertype":2048,"fileId":[79155],"firstPacket":1787642434634,"ipProtocol":17,"lastPacket":1787642434634,"length":0,"network":{"bytes":1061,"community_id":"1:WtKyizZHZ4zpLVtGDkyBazRc/K4=","packets":1},"node":"spark-afae","packetPos":[-79155,5131404],"packetRange":{"gte":1787642434634,"lte":1787642434634},"protocol":["udp","sip"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":0},"sip":{"callid":["wC6WgAl35T2xuvXd2tLffM.."],"callidCnt":1,"contact":["\u003csip:17168465496@179.43.167.2:29703\u003e"],"contactCnt":1,"from":["\u003csip:17168465496@179.43.167.2\u003e;tag=1ac78660"],"fromCnt":1,"method":["INVITE"],"methodCnt":1,"to":["\u003csip:9003908351673002@159.195.21.150:5060\u003e"],"toCnt":1,"user":["9003908351673002","17168465496"],"userCnt":2,"useragent":["SIPp/3.6.2"],"useragentCnt":1,"via":["SIP/2.0/UDP 179.43.167.2:29703;branch=z9hG4bK-524287-1---af8e82e7be30803b"],"viaCnt":1},"source":{"as":{"full":"AS51852 Private Layer INC","number":51852,"organization":{"name":"Private Layer INC"}},"bytes":1061,"geo":{"country_iso_code":"CH"},"ip":"179.43.167.2","mac":["bc:0f:fe:38:0b:a3"],"mac-cnt":1,"packets":1,"port":29703},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcPayload8":"494e564954452073","srcRIR":"LACNIC","srcTTL":[54],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["756163361513940"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["b05640bd-eb2a-4d9d-8d73-d14d7cbeb44a"],"signatureCnt":1,"signatureId":[1071802],"signatureIdCnt":1},"tag":{"block":["false"],"blockCnt":1,"category":["protocol"],"categoryCnt":1,"description":["ip addresses with this tag have been observed sending sip traffic."],"intention":["unknown"],"intentionCnt":1,"name":["sip protocol"],"nameCnt":1},"tags":["honeypot","netcup-ts","sensor:netcup-ts"],"tagsCnt":3,"totDataBytes":1019} +{"@timestamp":1787639865684,"_id":"260825-IPilGpQ-7rlFdpavEsgVFOoz","_index":"arkime_sessions3-260825","client":{"bytes":1026},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Private Layer INC"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Private Layer Inc"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":0,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":0,"port":5060},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[79136],"firstPacket":1787638651882,"ipProtocol":17,"lastPacket":1787638651882,"length":0,"network":{"bytes":1068,"community_id":"1:naWCNG1wdY5ChytDQ+Bdl4077dM=","packets":1},"node":"spark-afae","packetPos":[-79136,147290],"packetRange":{"gte":1787638651882,"lte":1787638651882},"protocol":["sip","udp"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":0},"sip":{"callid":["I7MpDlDgZEQ0m0DOMBotBH.."],"callidCnt":1,"contact":["\u003csip:16724692132@179.43.167.2:29703\u003e"],"contactCnt":1,"from":["\u003csip:16724692132@179.43.167.2\u003e;tag=8925d99b"],"fromCnt":1,"method":["INVITE"],"methodCnt":1,"to":["\u003csip:9003908351673002@217.15.163.226:5060\u003e"],"toCnt":1,"user":["9003908351673002","16724692132"],"userCnt":2,"useragent":["Grandstream HT812"],"useragentCnt":1,"via":["SIP/2.0/UDP 179.43.167.2:29703;branch=z9hG4bK-524287-1---10c86719d2a50de6"],"viaCnt":1},"source":{"as":{"full":"AS51852 Private Layer INC","number":51852,"organization":{"name":"Private Layer INC"}},"bytes":1068,"geo":{"country_iso_code":"CH"},"ip":"179.43.167.2","mac":["fc:bd:67:9d:2b:2b"],"mac-cnt":1,"packets":1,"port":29703},"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcPayload8":"494e564954452073","srcRIR":"LACNIC","srcTTL":[52],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["977102229462202"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["b05640bd-eb2a-4d9d-8d73-d14d7cbeb44a"],"signatureCnt":1,"signatureId":[1071802],"signatureIdCnt":1},"tag":{"block":["false"],"blockCnt":1,"category":["protocol"],"categoryCnt":1,"description":["ip addresses with this tag have been observed sending sip traffic."],"intention":["unknown"],"intentionCnt":1,"name":["sip protocol"],"nameCnt":1},"tags":["sensor:contabo-sponge-01-ts","contabo-sponge-01-ts","honeypot"],"tagsCnt":3,"totDataBytes":1026} +{"@timestamp":1787638354594,"_id":"260825-6ff2vgY7L_NNaLW1OZ85Cy9K","_index":"arkime_sessions3-260825","client":{"bytes":1013},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Kaopu Cloud HK Limited"],"isp.dstCnt":1,"isp.src":["Private Layer INC"],"isp.srcCnt":1,"org.dst":["LightNode-BH"],"org.dstCnt":1,"org.src":["Private Layer Inc"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":0,"geo":{"country_iso_code":"BH"},"ip":"38.54.2.209","mac":["52:54:8f:9d:76:48"],"mac-cnt":1,"packets":0,"port":5060},"dstRIR":"ARIN","ethertype":2048,"fileId":[79127],"firstPacket":1787637275120,"ipProtocol":17,"lastPacket":1787637275120,"length":0,"network":{"bytes":1055,"community_id":"1:EgTQnlL86zSDKubpSij7KJwnsg4=","packets":1},"node":"spark-afae","packetPos":[-79127,99705],"packetRange":{"gte":1787637275120,"lte":1787637275120},"protocol":["udp","sip"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":0},"sip":{"callid":["9Cuv7ALOkCTb40SCT4EmvL.."],"callidCnt":1,"contact":["\u003csip:16563628947@179.43.167.2:29703\u003e"],"contactCnt":1,"from":["\u003csip:16563628947@179.43.167.2\u003e;tag=bd351b98"],"fromCnt":1,"method":["INVITE"],"methodCnt":1,"to":["\u003csip:9003908351673002@38.54.2.209:5060\u003e"],"toCnt":1,"user":["16563628947","9003908351673002"],"userCnt":2,"useragent":["Mitel 6863"],"useragentCnt":1,"via":["SIP/2.0/UDP 179.43.167.2:29703;branch=z9hG4bK-524287-1---1e597a12dfc945a1"],"viaCnt":1},"source":{"as":{"full":"AS51852 Private Layer INC","number":51852,"organization":{"name":"Private Layer INC"}},"bytes":1055,"geo":{"country_iso_code":"CH"},"ip":"179.43.167.2","mac":["98:44:ce:60:15:19"],"mac-cnt":1,"packets":1,"port":29703},"srcOui":["Huawei Technologies Co.,Ltd"],"srcOuiCnt":1,"srcPayload8":"494e564954452073","srcRIR":"LACNIC","srcTTL":[50],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["1082509063213718"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["b05640bd-eb2a-4d9d-8d73-d14d7cbeb44a"],"signatureCnt":1,"signatureId":[1071802],"signatureIdCnt":1},"tag":{"block":["false"],"blockCnt":1,"category":["protocol"],"categoryCnt":1,"description":["ip addresses with this tag have been observed sending sip traffic."],"intention":["unknown"],"intentionCnt":1,"name":["sip protocol"],"nameCnt":1},"tags":["bahrain-sponge-01-ts","honeypot","sensor:bahrain-sponge-01-ts"],"tagsCnt":3,"totDataBytes":1013} +{"@timestamp":1787635951734,"_id":"260825-nvf-MxIv26VFIoEdeK9UrnuA","_index":"arkime_sessions3-260825","client":{"bytes":1039},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo GmbH"],"isp.dstCnt":1,"isp.src":["Private Layer INC"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Private Layer Inc"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS51167 Contabo GmbH","number":51167,"organization":{"name":"Contabo GmbH"}},"bytes":0,"geo":{"country_iso_code":"FR"},"ip":"109.123.246.142","mac":["00:50:56:63:46:a6"],"mac-cnt":1,"packets":0,"port":5060},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[79114],"firstPacket":1787635029332,"ipProtocol":17,"lastPacket":1787635029332,"length":0,"network":{"bytes":1081,"community_id":"1:4a2i9SItj7P3JcAOaD70px365Pc=","packets":1},"node":"spark-afae","packetPos":[-79114,144473],"packetRange":{"gte":1787635029332,"lte":1787635029332},"protocol":["udp","sip"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":0},"sip":{"callid":["3PlnREfpHce1iqOssmqDBh.."],"callidCnt":1,"contact":["\u003csip:16299777872@179.43.167.2:29703\u003e"],"contactCnt":1,"from":["\u003csip:16299777872@179.43.167.2\u003e;tag=a7b50e59"],"fromCnt":1,"method":["INVITE"],"methodCnt":1,"to":["\u003csip:9003908351673002@109.123.246.142:5060\u003e"],"toCnt":1,"user":["16299777872","9003908351673002"],"userCnt":2,"useragent":["Yealink SIP-CP960 73.86.0.15"],"useragentCnt":1,"via":["SIP/2.0/UDP 179.43.167.2:29703;branch=z9hG4bK-524287-1---de4c716ae43168eb"],"viaCnt":1},"source":{"as":{"full":"AS51852 Private Layer INC","number":51852,"organization":{"name":"Private Layer INC"}},"bytes":1081,"geo":{"country_iso_code":"CH"},"ip":"179.43.167.2","mac":["c0:69:11:cd:1f:19"],"mac-cnt":1,"packets":1,"port":29703},"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcPayload8":"494e564954452073","srcRIR":"LACNIC","srcTTL":[55],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["1429248137461094"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["b05640bd-eb2a-4d9d-8d73-d14d7cbeb44a"],"signatureCnt":1,"signatureId":[1071802],"signatureIdCnt":1},"tag":{"block":["false"],"blockCnt":1,"category":["protocol"],"categoryCnt":1,"description":["ip addresses with this tag have been observed sending sip traffic."],"intention":["unknown"],"intentionCnt":1,"name":["sip protocol"],"nameCnt":1},"tags":["proxy","sensor:contabo-sponge-02-ts","contabo-sponge-02-ts"],"tagsCnt":3,"totDataBytes":1039} +{"@timestamp":1787628731838,"_id":"260825-mpsdnYcRXLBO_JvVvGNS_NRq","_index":"arkime_sessions3-260825","client":{"bytes":1018},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["netcup GmbH"],"isp.dstCnt":1,"isp.src":["Private Layer INC"],"isp.srcCnt":1,"org.dst":["Netcup KVM"],"org.dstCnt":1,"org.src":["Private Layer Inc"],"org.srcCnt":1,"usertype.dst":["business"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS197540 netcup GmbH","number":197540,"organization":{"name":"netcup GmbH"}},"bytes":0,"geo":{"country_iso_code":"DE"},"ip":"159.195.21.150","mac":["8a:41:d3:b8:0d:d3"],"mac-cnt":1,"packets":0,"port":5060},"dstRIR":"ARIN","ethertype":2048,"fileId":[79075],"firstPacket":1787627923703,"ipProtocol":17,"lastPacket":1787627923703,"length":0,"network":{"bytes":1060,"community_id":"1:+EsuGOwWNzyeImNpBBNZb+ME/Co=","packets":1},"node":"spark-afae","packetPos":[-79075,927411],"packetRange":{"gte":1787627923703,"lte":1787627923703},"protocol":["udp","sip"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":0},"sip":{"callid":["ft5G1r0rEk67NNY0Xrx37h.."],"callidCnt":1,"contact":["\u003csip:17168465496@179.43.167.2:25698\u003e"],"contactCnt":1,"from":["\u003csip:17168465496@179.43.167.2\u003e;tag=a4f73cd2"],"fromCnt":1,"method":["INVITE"],"methodCnt":1,"to":["\u003csip:3908351673002@159.195.21.150:5060\u003e"],"toCnt":1,"user":["3908351673002","17168465496"],"userCnt":2,"useragent":["MicroSIP/3.20.2"],"useragentCnt":1,"via":["SIP/2.0/UDP 179.43.167.2:25698;branch=z9hG4bK-524287-1---877fa2d26de392ae"],"viaCnt":1},"source":{"as":{"full":"AS51852 Private Layer INC","number":51852,"organization":{"name":"Private Layer INC"}},"bytes":1060,"geo":{"country_iso_code":"CH"},"ip":"179.43.167.2","mac":["bc:0f:fe:38:0b:a3"],"mac-cnt":1,"packets":1,"port":25698},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcPayload8":"494e564954452073","srcRIR":"LACNIC","srcTTL":[54],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["1049533492814731"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["b05640bd-eb2a-4d9d-8d73-d14d7cbeb44a"],"signatureCnt":1,"signatureId":[1071802],"signatureIdCnt":1},"tag":{"block":["false"],"blockCnt":1,"category":["protocol"],"categoryCnt":1,"description":["ip addresses with this tag have been observed sending sip traffic."],"intention":["unknown"],"intentionCnt":1,"name":["sip protocol"],"nameCnt":1},"tags":["honeypot","sensor:netcup-ts","netcup-ts"],"tagsCnt":3,"totDataBytes":1018} +{"@timestamp":1787624803903,"_id":"260825-Qpv8pX2-tO5ERImBZZBgNZZ6","_index":"arkime_sessions3-260825","client":{"bytes":1010},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Private Layer INC"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Private Layer Inc"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":0,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":0,"port":5060},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[79051],"firstPacket":1787624147114,"ipProtocol":17,"lastPacket":1787624147114,"length":0,"network":{"bytes":1052,"community_id":"1:ZgNPhBdNR00QVU6SA9mqrUMb2g0=","packets":1},"node":"spark-afae","packetPos":[-79051,4477420],"packetRange":{"gte":1787624147114,"lte":1787624147114},"protocol":["udp","sip"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":0},"sip":{"callid":["MmZXFcj69uGTXUCnMxwVoH.."],"callidCnt":1,"contact":["\u003csip:16724692132@179.43.167.2:25698\u003e"],"contactCnt":1,"from":["\u003csip:16724692132@179.43.167.2\u003e;tag=57c035a6"],"fromCnt":1,"method":["INVITE"],"methodCnt":1,"to":["\u003csip:3908351673002@217.15.163.226:5060\u003e"],"toCnt":1,"user":["3908351673002","16724692132"],"userCnt":2,"useragent":["snom710"],"useragentCnt":1,"via":["SIP/2.0/UDP 179.43.167.2:25698;branch=z9hG4bK-524287-1---b33237f274f4d9bb"],"viaCnt":1},"source":{"as":{"full":"AS51852 Private Layer INC","number":51852,"organization":{"name":"Private Layer INC"}},"bytes":1052,"geo":{"country_iso_code":"CH"},"ip":"179.43.167.2","mac":["fc:bd:67:9d:2b:2b"],"mac-cnt":1,"packets":1,"port":25698},"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcPayload8":"494e564954452073","srcRIR":"LACNIC","srcTTL":[52],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["1053568210456383"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["b05640bd-eb2a-4d9d-8d73-d14d7cbeb44a"],"signatureCnt":1,"signatureId":[1071802],"signatureIdCnt":1},"tag":{"block":["false"],"blockCnt":1,"category":["protocol"],"categoryCnt":1,"description":["ip addresses with this tag have been observed sending sip traffic."],"intention":["unknown"],"intentionCnt":1,"name":["sip protocol"],"nameCnt":1},"tags":["honeypot","contabo-sponge-01-ts","sensor:contabo-sponge-01-ts"],"tagsCnt":3,"totDataBytes":1010} +{"@timestamp":1787621452764,"_id":"260825-AJtez9UrHAtESKYjEFfM2Ti9","_index":"arkime_sessions3-260825","client":{"bytes":1014},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo GmbH"],"isp.dstCnt":1,"isp.src":["Private Layer INC"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Private Layer Inc"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS51167 Contabo GmbH","number":51167,"organization":{"name":"Contabo GmbH"}},"bytes":0,"geo":{"country_iso_code":"FR"},"ip":"109.123.246.142","mac":["00:50:56:63:46:a6"],"mac-cnt":1,"packets":0,"port":5060},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[79033],"firstPacket":1787620534349,"ipProtocol":17,"lastPacket":1787620534349,"length":0,"network":{"bytes":1056,"community_id":"1:f4UxVR2L7HuXmiO0Sbuo/R0bIRM=","packets":1},"node":"spark-afae","packetPos":[-79033,29651],"packetRange":{"gte":1787620534349,"lte":1787620534349},"protocol":["udp","sip"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":0},"sip":{"callid":["LNrLj45nNZoYd2TjoEQ29j.."],"callidCnt":1,"contact":["\u003csip:16299777872@179.43.167.2:25698\u003e"],"contactCnt":1,"from":["\u003csip:16299777872@179.43.167.2\u003e;tag=a5821cd3"],"fromCnt":1,"method":["INVITE"],"methodCnt":1,"to":["\u003csip:3908351673002@109.123.246.142:5060\u003e"],"toCnt":1,"user":["16299777872","3908351673002"],"userCnt":2,"useragent":["Fanvil X6"],"useragentCnt":1,"via":["SIP/2.0/UDP 179.43.167.2:25698;branch=z9hG4bK-524287-1---c932ca6439fadb76"],"viaCnt":1},"source":{"as":{"full":"AS51852 Private Layer INC","number":51852,"organization":{"name":"Private Layer INC"}},"bytes":1056,"geo":{"country_iso_code":"CH"},"ip":"179.43.167.2","mac":["c0:69:11:cd:1f:19"],"mac-cnt":1,"packets":1,"port":25698},"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcPayload8":"494e564954452073","srcRIR":"LACNIC","srcTTL":[55],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["1783967469148490"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["b05640bd-eb2a-4d9d-8d73-d14d7cbeb44a"],"signatureCnt":1,"signatureId":[1071802],"signatureIdCnt":1},"tag":{"block":["false"],"blockCnt":1,"category":["protocol"],"categoryCnt":1,"description":["ip addresses with this tag have been observed sending sip traffic."],"intention":["unknown"],"intentionCnt":1,"name":["sip protocol"],"nameCnt":1},"tags":["sensor:contabo-sponge-02-ts","contabo-sponge-02-ts","proxy"],"tagsCnt":3,"totDataBytes":1014} +{"@timestamp":1787614493546,"_id":"260824-IjPfaUZGbGtAMbGVhFjCpmlM","_index":"arkime_sessions3-260824","client":{"bytes":1011},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["netcup GmbH"],"isp.dstCnt":1,"isp.src":["Private Layer INC"],"isp.srcCnt":1,"org.dst":["Netcup KVM"],"org.dstCnt":1,"org.src":["Private Layer Inc"],"org.srcCnt":1,"usertype.dst":["business"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS197540 netcup GmbH","number":197540,"organization":{"name":"netcup GmbH"}},"bytes":0,"geo":{"country_iso_code":"DE"},"ip":"159.195.21.150","mac":["8a:41:d3:b8:0d:d3"],"mac-cnt":1,"packets":0,"port":5060},"dstRIR":"ARIN","ethertype":2048,"fileId":[78995],"firstPacket":1787613415133,"ipProtocol":17,"lastPacket":1787613415133,"length":0,"network":{"bytes":1053,"community_id":"1:BaAA7HbtIgwO7B8Rme8eTatx0dQ=","packets":1},"node":"spark-afae","packetPos":[-78995,384875],"packetRange":{"gte":1787613415133,"lte":1787613415133},"protocol":["udp","sip"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":0},"sip":{"callid":["9Un0Tkw4QoONykTbvfnZ9x.."],"callidCnt":1,"contact":["\u003csip:17168465496@179.43.167.2:32992\u003e"],"contactCnt":1,"from":["\u003csip:17168465496@179.43.167.2\u003e;tag=59692108"],"fromCnt":1,"method":["INVITE"],"methodCnt":1,"to":["\u003csip:003908351673002@159.195.21.150:5060\u003e"],"toCnt":1,"user":["17168465496","003908351673002"],"userCnt":2,"useragent":["Algo"],"useragentCnt":1,"via":["SIP/2.0/UDP 179.43.167.2:32992;branch=z9hG4bK-524287-1---3b1319fbd5e9895e"],"viaCnt":1},"source":{"as":{"full":"AS51852 Private Layer INC","number":51852,"organization":{"name":"Private Layer INC"}},"bytes":1053,"geo":{"country_iso_code":"CH"},"ip":"179.43.167.2","mac":["bc:0f:fe:38:0b:a3"],"mac-cnt":1,"packets":1,"port":32992},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcPayload8":"494e564954452073","srcRIR":"LACNIC","srcTTL":[54],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["1980870534876109"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["b05640bd-eb2a-4d9d-8d73-d14d7cbeb44a"],"signatureCnt":1,"signatureId":[1071802],"signatureIdCnt":1},"tag":{"block":["false"],"blockCnt":1,"category":["protocol"],"categoryCnt":1,"description":["ip addresses with this tag have been observed sending sip traffic."],"intention":["unknown"],"intentionCnt":1,"name":["sip protocol"],"nameCnt":1},"tags":["honeypot","netcup-ts","sensor:netcup-ts"],"tagsCnt":3,"totDataBytes":1011} +{"@timestamp":1787609985494,"_id":"260824-EPSnxNUsEaBKeK_3-naCpHRv","_index":"arkime_sessions3-260824","client":{"bytes":1017},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Private Layer INC"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Private Layer Inc"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":0,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":0,"port":5060},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[78970],"firstPacket":1787609626007,"ipProtocol":17,"lastPacket":1787609626007,"length":0,"network":{"bytes":1059,"community_id":"1:9D4PwpViJdHOhBPrB8Q9xb/dj/Q=","packets":1},"node":"spark-afae","packetPos":[-78970,3433325],"packetRange":{"gte":1787609626007,"lte":1787609626007},"protocol":["udp","sip"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":0},"sip":{"callid":["OBr7JwPdlak7g70liqWkRv.."],"callidCnt":1,"contact":["\u003csip:16724692132@179.43.167.2:32992\u003e"],"contactCnt":1,"from":["\u003csip:16724692132@179.43.167.2\u003e;tag=3ad70497"],"fromCnt":1,"method":["INVITE"],"methodCnt":1,"to":["\u003csip:003908351673002@217.15.163.226:5060\u003e"],"toCnt":1,"user":["16724692132","003908351673002"],"userCnt":2,"useragent":["FreeSWITCH"],"useragentCnt":1,"via":["SIP/2.0/UDP 179.43.167.2:32992;branch=z9hG4bK-524287-1---09a45d0ab49150ad"],"viaCnt":1},"source":{"as":{"full":"AS51852 Private Layer INC","number":51852,"organization":{"name":"Private Layer INC"}},"bytes":1059,"geo":{"country_iso_code":"CH"},"ip":"179.43.167.2","mac":["fc:bd:67:9d:2b:2b"],"mac-cnt":1,"packets":1,"port":32992},"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcPayload8":"494e564954452073","srcRIR":"LACNIC","srcTTL":[52],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["597098679017244"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["b05640bd-eb2a-4d9d-8d73-d14d7cbeb44a"],"signatureCnt":1,"signatureId":[1071802],"signatureIdCnt":1},"tag":{"block":["false"],"blockCnt":1,"category":["protocol"],"categoryCnt":1,"description":["ip addresses with this tag have been observed sending sip traffic."],"intention":["unknown"],"intentionCnt":1,"name":["sip protocol"],"nameCnt":1},"tags":["contabo-sponge-01-ts","sensor:contabo-sponge-01-ts","honeypot"],"tagsCnt":3,"totDataBytes":1017} +{"@timestamp":1787608481975,"_id":"260824-5PMMOBqwuAJMprFKxGV1ydHY","_index":"arkime_sessions3-260824","client":{"bytes":1018},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Kaopu Cloud HK Limited"],"isp.dstCnt":1,"isp.src":["Private Layer INC"],"isp.srcCnt":1,"org.dst":["LightNode-BH"],"org.dstCnt":1,"org.src":["Private Layer Inc"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":0,"geo":{"country_iso_code":"BH"},"ip":"38.54.2.209","mac":["52:54:8f:9d:76:48"],"mac-cnt":1,"packets":0,"port":5060},"dstRIR":"ARIN","ethertype":2048,"fileId":[78962],"firstPacket":1787608248172,"ipProtocol":17,"lastPacket":1787608248172,"length":0,"network":{"bytes":1060,"community_id":"1:F8izqP1Yp3/1xikXHMM/YU3kWMo=","packets":1},"node":"spark-afae","packetPos":[-78962,1528616],"packetRange":{"gte":1787608248172,"lte":1787608248172},"protocol":["udp","sip"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":0},"sip":{"callid":["m7SJYZ7E0DsnI7BRVHbrgM.."],"callidCnt":1,"contact":["\u003csip:16563628947@179.43.167.2:32992\u003e"],"contactCnt":1,"from":["\u003csip:16563628947@179.43.167.2\u003e;tag=a3c06f32"],"fromCnt":1,"method":["INVITE"],"methodCnt":1,"to":["\u003csip:003908351673002@38.54.2.209:5060\u003e"],"toCnt":1,"user":["16563628947","003908351673002"],"userCnt":2,"useragent":["Cisco-CP7940G/8.0"],"useragentCnt":1,"via":["SIP/2.0/UDP 179.43.167.2:32992;branch=z9hG4bK-524287-1---2b6b7902bdd970fa"],"viaCnt":1},"source":{"as":{"full":"AS51852 Private Layer INC","number":51852,"organization":{"name":"Private Layer INC"}},"bytes":1060,"geo":{"country_iso_code":"CH"},"ip":"179.43.167.2","mac":["98:44:ce:60:15:19"],"mac-cnt":1,"packets":1,"port":32992},"srcOui":["Huawei Technologies Co.,Ltd"],"srcOuiCnt":1,"srcPayload8":"494e564954452073","srcRIR":"LACNIC","srcTTL":[50],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["178052737022826"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["b05640bd-eb2a-4d9d-8d73-d14d7cbeb44a"],"signatureCnt":1,"signatureId":[1071802],"signatureIdCnt":1},"tag":{"block":["false"],"blockCnt":1,"category":["protocol"],"categoryCnt":1,"description":["ip addresses with this tag have been observed sending sip traffic."],"intention":["unknown"],"intentionCnt":1,"name":["sip protocol"],"nameCnt":1},"tags":["sensor:bahrain-sponge-01-ts","bahrain-sponge-01-ts","honeypot"],"tagsCnt":3,"totDataBytes":1018} +{"@timestamp":1787607279733,"_id":"260824-45kdHNq1EVtDQr4qN-bulDyl","_index":"arkime_sessions3-260824","client":{"bytes":1040},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo GmbH"],"isp.dstCnt":1,"isp.src":["Private Layer INC"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Private Layer Inc"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS51167 Contabo GmbH","number":51167,"organization":{"name":"Contabo GmbH"}},"bytes":0,"geo":{"country_iso_code":"FR"},"ip":"109.123.246.142","mac":["00:50:56:63:46:a6"],"mac-cnt":1,"packets":0,"port":5060},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[78954],"firstPacket":1787605998407,"ipProtocol":17,"lastPacket":1787605998407,"length":0,"network":{"bytes":1082,"community_id":"1:v+cGN5qLos/fmwh/HXJhptZpF6E=","packets":1},"node":"spark-afae","packetPos":[-78954,12206],"packetRange":{"gte":1787605998407,"lte":1787605998407},"protocol":["udp","sip"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":0},"sip":{"callid":["IivvkRIjNb7PVlVTAxNuf5.."],"callidCnt":1,"contact":["\u003csip:16299777872@179.43.167.2:32992\u003e"],"contactCnt":1,"from":["\u003csip:16299777872@179.43.167.2\u003e;tag=8ee36063"],"fromCnt":1,"method":["INVITE"],"methodCnt":1,"to":["\u003csip:003908351673002@109.123.246.142:5060\u003e"],"toCnt":1,"user":["16299777872","003908351673002"],"userCnt":2,"useragent":["Kamailio (5.6.3 (x86_64/linux))"],"useragentCnt":1,"via":["SIP/2.0/UDP 179.43.167.2:32992;branch=z9hG4bK-524287-1---901ea7b2e4b2c81d"],"viaCnt":1},"source":{"as":{"full":"AS51852 Private Layer INC","number":51852,"organization":{"name":"Private Layer INC"}},"bytes":1082,"geo":{"country_iso_code":"CH"},"ip":"179.43.167.2","mac":["c0:69:11:cd:1f:19"],"mac-cnt":1,"packets":1,"port":32992},"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcPayload8":"494e564954452073","srcRIR":"LACNIC","srcTTL":[55],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["1750202066730461"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["b05640bd-eb2a-4d9d-8d73-d14d7cbeb44a"],"signatureCnt":1,"signatureId":[1071802],"signatureIdCnt":1},"tag":{"block":["false"],"blockCnt":1,"category":["protocol"],"categoryCnt":1,"description":["ip addresses with this tag have been observed sending sip traffic."],"intention":["unknown"],"intentionCnt":1,"name":["sip protocol"],"nameCnt":1},"tags":["contabo-sponge-02-ts","sensor:contabo-sponge-02-ts","proxy"],"tagsCnt":3,"totDataBytes":1040} +{"@timestamp":1787600341693,"_id":"260824-SZmRp2wg3wpBKYCtJfCDW2MV","_index":"arkime_sessions3-260824","client":{"bytes":1021},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["netcup GmbH"],"isp.dstCnt":1,"isp.src":["Private Layer INC"],"isp.srcCnt":1,"org.dst":["Netcup KVM"],"org.dstCnt":1,"org.src":["Private Layer Inc"],"org.srcCnt":1,"usertype.dst":["business"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS197540 netcup GmbH","number":197540,"organization":{"name":"netcup GmbH"}},"bytes":0,"geo":{"country_iso_code":"DE"},"ip":"159.195.21.150","mac":["8a:41:d3:b8:0d:d3"],"mac-cnt":1,"packets":0,"port":5060},"dstRIR":"ARIN","ethertype":2048,"fileId":[78916],"firstPacket":1787598882087,"ipProtocol":17,"lastPacket":1787598882087,"length":0,"network":{"bytes":1063,"community_id":"1:54Vjmhh0oFrffPddPiZgxhg8/b0=","packets":1},"node":"spark-afae","packetPos":[-78916,39658],"packetRange":{"gte":1787598882087,"lte":1787598882087},"protocol":["udp","sip"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":0},"sip":{"callid":["MkKT2YwQwTZ4RLjdF6Fbfy.."],"callidCnt":1,"contact":["\u003csip:17168465496@179.43.167.2:31423\u003e"],"contactCnt":1,"from":["\u003csip:17168465496@179.43.167.2\u003e;tag=c8626475"],"fromCnt":1,"method":["INVITE"],"methodCnt":1,"to":["\u003csip:90113908351673002@159.195.21.150:5060\u003e"],"toCnt":1,"user":["90113908351673002","17168465496"],"userCnt":2,"useragent":["SIPp/3.6.2"],"useragentCnt":1,"via":["SIP/2.0/UDP 179.43.167.2:31423;branch=z9hG4bK-524287-1---26c1a6997450c1b8"],"viaCnt":1},"source":{"as":{"full":"AS51852 Private Layer INC","number":51852,"organization":{"name":"Private Layer INC"}},"bytes":1063,"geo":{"country_iso_code":"CH"},"ip":"179.43.167.2","mac":["bc:0f:fe:38:0b:a3"],"mac-cnt":1,"packets":1,"port":31423},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcPayload8":"494e564954452073","srcRIR":"LACNIC","srcTTL":[54],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["659034900133398"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["b05640bd-eb2a-4d9d-8d73-d14d7cbeb44a"],"signatureCnt":1,"signatureId":[1071802],"signatureIdCnt":1},"tag":{"block":["false"],"blockCnt":1,"category":["protocol"],"categoryCnt":1,"description":["ip addresses with this tag have been observed sending sip traffic."],"intention":["unknown"],"intentionCnt":1,"name":["sip protocol"],"nameCnt":1},"tags":["sensor:netcup-ts","honeypot","netcup-ts"],"tagsCnt":3,"totDataBytes":1021} +{"@timestamp":1787595833108,"_id":"260824-NvLbMWZvr6FHl7ymBnYt0SQX","_index":"arkime_sessions3-260824","client":{"bytes":1020},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Private Layer INC"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Private Layer Inc"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":0,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":0,"port":5060},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[78891],"firstPacket":1787595114001,"ipProtocol":17,"lastPacket":1787595114001,"length":0,"network":{"bytes":1062,"community_id":"1:gKWQMzlo31InDewapnZKYrLPDEU=","packets":1},"node":"spark-afae","packetPos":[-78891,3067669],"packetRange":{"gte":1787595114001,"lte":1787595114001},"protocol":["udp","sip"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":0},"sip":{"callid":["YQGXjVWCp2Rs3CS70LaiJ1.."],"callidCnt":1,"contact":["\u003csip:16724692132@179.43.167.2:31423\u003e"],"contactCnt":1,"from":["\u003csip:16724692132@179.43.167.2\u003e;tag=db81321a"],"fromCnt":1,"method":["INVITE"],"methodCnt":1,"to":["\u003csip:90113908351673002@217.15.163.226:5060\u003e"],"toCnt":1,"user":["90113908351673002","16724692132"],"userCnt":2,"useragent":["Sonus SBC"],"useragentCnt":1,"via":["SIP/2.0/UDP 179.43.167.2:31423;branch=z9hG4bK-524287-1---c13b5ec35615ebba"],"viaCnt":1},"source":{"as":{"full":"AS51852 Private Layer INC","number":51852,"organization":{"name":"Private Layer INC"}},"bytes":1062,"geo":{"country_iso_code":"CH"},"ip":"179.43.167.2","mac":["fc:bd:67:9d:2b:2b"],"mac-cnt":1,"packets":1,"port":31423},"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcPayload8":"494e564954452073","srcRIR":"LACNIC","srcTTL":[52],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["567976400945703"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["b05640bd-eb2a-4d9d-8d73-d14d7cbeb44a"],"signatureCnt":1,"signatureId":[1071802],"signatureIdCnt":1},"tag":{"block":["false"],"blockCnt":1,"category":["protocol"],"categoryCnt":1,"description":["ip addresses with this tag have been observed sending sip traffic."],"intention":["unknown"],"intentionCnt":1,"name":["sip protocol"],"nameCnt":1},"tags":["honeypot","contabo-sponge-01-ts","sensor:contabo-sponge-01-ts"],"tagsCnt":3,"totDataBytes":1020} +{"@timestamp":1787594323574,"_id":"260824-API6FCGjFtxD2LCz_WHF6N8y","_index":"arkime_sessions3-260824","client":{"bytes":1015},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Kaopu Cloud HK Limited"],"isp.dstCnt":1,"isp.src":["Private Layer INC"],"isp.srcCnt":1,"org.dst":["LightNode-BH"],"org.dstCnt":1,"org.src":["Private Layer Inc"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":0,"geo":{"country_iso_code":"BH"},"ip":"38.54.2.209","mac":["52:54:8f:9d:76:48"],"mac-cnt":1,"packets":0,"port":5060},"dstRIR":"ARIN","ethertype":2048,"fileId":[78884],"firstPacket":1787593746869,"ipProtocol":17,"lastPacket":1787593746869,"length":0,"network":{"bytes":1057,"community_id":"1:YQMf+R6ejuJNYoYYO9sO8HSVjBo=","packets":1},"node":"spark-afae","packetPos":[-78884,1718479],"packetRange":{"gte":1787593746869,"lte":1787593746869},"protocol":["udp","sip"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":0},"sip":{"callid":["1XxPItsuni3DaR3Xo52sEl.."],"callidCnt":1,"contact":["\u003csip:16563628947@179.43.167.2:31423\u003e"],"contactCnt":1,"from":["\u003csip:16563628947@179.43.167.2\u003e;tag=3fbc0cbc"],"fromCnt":1,"method":["INVITE"],"methodCnt":1,"to":["\u003csip:90113908351673002@38.54.2.209:5060\u003e"],"toCnt":1,"user":["16563628947","90113908351673002"],"userCnt":2,"useragent":["Yate/6.0.0"],"useragentCnt":1,"via":["SIP/2.0/UDP 179.43.167.2:31423;branch=z9hG4bK-524287-1---7571e2d19587e16b"],"viaCnt":1},"source":{"as":{"full":"AS51852 Private Layer INC","number":51852,"organization":{"name":"Private Layer INC"}},"bytes":1057,"geo":{"country_iso_code":"CH"},"ip":"179.43.167.2","mac":["98:44:ce:60:15:19"],"mac-cnt":1,"packets":1,"port":31423},"srcOui":["Huawei Technologies Co.,Ltd"],"srcOuiCnt":1,"srcPayload8":"494e564954452073","srcRIR":"LACNIC","srcTTL":[50],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["638541589972429"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["b05640bd-eb2a-4d9d-8d73-d14d7cbeb44a"],"signatureCnt":1,"signatureId":[1071802],"signatureIdCnt":1},"tag":{"block":["false"],"blockCnt":1,"category":["protocol"],"categoryCnt":1,"description":["ip addresses with this tag have been observed sending sip traffic."],"intention":["unknown"],"intentionCnt":1,"name":["sip protocol"],"nameCnt":1},"tags":["sensor:bahrain-sponge-01-ts","honeypot","bahrain-sponge-01-ts"],"tagsCnt":3,"totDataBytes":1015} +{"@timestamp":1787592822735,"_id":"260824-pZg1YPaZmlRBTIa1Puf8i-Gs","_index":"arkime_sessions3-260824","client":{"bytes":1034},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo GmbH"],"isp.dstCnt":1,"isp.src":["Private Layer INC"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Private Layer Inc"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS51167 Contabo GmbH","number":51167,"organization":{"name":"Contabo GmbH"}},"bytes":0,"geo":{"country_iso_code":"FR"},"ip":"109.123.246.142","mac":["00:50:56:63:46:a6"],"mac-cnt":1,"packets":0,"port":5060},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[78873],"firstPacket":1787591505949,"ipProtocol":17,"lastPacket":1787591505949,"length":0,"network":{"bytes":1076,"community_id":"1:xEwN2TNWVeajG8sbYQpmPxZdL4M=","packets":1},"node":"spark-afae","packetPos":[-78873,1817],"packetRange":{"gte":1787591505949,"lte":1787591505949},"protocol":["udp","sip"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":0},"sip":{"callid":["uyskoFzcUHFw3JP5qk8UaW.."],"callidCnt":1,"contact":["\u003csip:16299777872@179.43.167.2:31423\u003e"],"contactCnt":1,"from":["\u003csip:16299777872@179.43.167.2\u003e;tag=b279b7cb"],"fromCnt":1,"method":["INVITE"],"methodCnt":1,"to":["\u003csip:90113908351673002@109.123.246.142:5060\u003e"],"toCnt":1,"user":["16299777872","90113908351673002"],"userCnt":2,"useragent":["Linksys/SPA942-5.1.10"],"useragentCnt":1,"via":["SIP/2.0/UDP 179.43.167.2:31423;branch=z9hG4bK-524287-1---a790ee7a03233448"],"viaCnt":1},"source":{"as":{"full":"AS51852 Private Layer INC","number":51852,"organization":{"name":"Private Layer INC"}},"bytes":1076,"geo":{"country_iso_code":"CH"},"ip":"179.43.167.2","mac":["c0:69:11:cd:1f:19"],"mac-cnt":1,"packets":1,"port":31423},"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcPayload8":"494e564954452073","srcRIR":"LACNIC","srcTTL":[55],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["420974140947385"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["b05640bd-eb2a-4d9d-8d73-d14d7cbeb44a"],"signatureCnt":1,"signatureId":[1071802],"signatureIdCnt":1},"tag":{"block":["false"],"blockCnt":1,"category":["protocol"],"categoryCnt":1,"description":["ip addresses with this tag have been observed sending sip traffic."],"intention":["unknown"],"intentionCnt":1,"name":["sip protocol"],"nameCnt":1},"tags":["sensor:contabo-sponge-02-ts","proxy","contabo-sponge-02-ts"],"tagsCnt":3,"totDataBytes":1034} +{"@timestamp":1787581352933,"_id":"260824-VfAI0F6soG1CyaDDQLsMdUh4","_index":"arkime_sessions3-260824","client":{"bytes":1028},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Private Layer INC"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Private Layer Inc"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":0,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":0,"port":5060},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[78811],"firstPacket":1787580606417,"ipProtocol":17,"lastPacket":1787580606417,"length":0,"network":{"bytes":1070,"community_id":"1:z0qEHwg7IpvFU4z++gMKaVw9NAw=","packets":1},"node":"spark-afae","packetPos":[-78811,2558094],"packetRange":{"gte":1787580606417,"lte":1787580606417},"protocol":["sip","udp"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":0},"sip":{"callid":["Fm9EuQlwYKQCN6zN9yyscm.."],"callidCnt":1,"contact":["\u003csip:16724692132@179.43.167.2:23377\u003e"],"contactCnt":1,"from":["\u003csip:16724692132@179.43.167.2\u003e;tag=602313d0"],"fromCnt":1,"method":["INVITE"],"methodCnt":1,"to":["\u003csip:0113908351673002@217.15.163.226:5060\u003e"],"toCnt":1,"user":["0113908351673002","16724692132"],"userCnt":2,"useragent":["Asterisk PBX 18.9.0"],"useragentCnt":1,"via":["SIP/2.0/UDP 179.43.167.2:23377;branch=z9hG4bK-524287-1---59dfaba515e48073"],"viaCnt":1},"source":{"as":{"full":"AS51852 Private Layer INC","number":51852,"organization":{"name":"Private Layer INC"}},"bytes":1070,"geo":{"country_iso_code":"CH"},"ip":"179.43.167.2","mac":["fc:bd:67:9d:2b:2b"],"mac-cnt":1,"packets":1,"port":23377},"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcPayload8":"494e564954452073","srcRIR":"LACNIC","srcTTL":[52],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["1791547634671365"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["b05640bd-eb2a-4d9d-8d73-d14d7cbeb44a"],"signatureCnt":1,"signatureId":[1071802],"signatureIdCnt":1},"tag":{"block":["false"],"blockCnt":1,"category":["protocol"],"categoryCnt":1,"description":["ip addresses with this tag have been observed sending sip traffic."],"intention":["unknown"],"intentionCnt":1,"name":["sip protocol"],"nameCnt":1},"tags":["honeypot","sensor:contabo-sponge-01-ts","contabo-sponge-01-ts"],"tagsCnt":3,"totDataBytes":1028} +{"@timestamp":1787577438610,"_id":"260824-UZfHEX0D9KJID5BQ7LFWGdFy","_index":"arkime_sessions3-260824","client":{"bytes":1020},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo GmbH"],"isp.dstCnt":1,"isp.src":["Private Layer INC"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Private Layer Inc"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS51167 Contabo GmbH","number":51167,"organization":{"name":"Contabo GmbH"}},"bytes":0,"geo":{"country_iso_code":"FR"},"ip":"109.123.246.142","mac":["00:50:56:63:46:a6"],"mac-cnt":1,"packets":0,"port":5060},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[78788],"firstPacket":1787576983511,"ipProtocol":17,"lastPacket":1787576983511,"length":0,"network":{"bytes":1062,"community_id":"1:sI0CwOu5F2CEkyx/BgPqpuPEr8g=","packets":1},"node":"spark-afae","packetPos":[-78788,826508],"packetRange":{"gte":1787576983511,"lte":1787576983511},"protocol":["udp","sip"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":0},"sip":{"callid":["ing7dDodSB62gQyCZttknW.."],"callidCnt":1,"contact":["\u003csip:16299777872@179.43.167.2:23377\u003e"],"contactCnt":1,"from":["\u003csip:16299777872@179.43.167.2\u003e;tag=069b055f"],"fromCnt":1,"method":["INVITE"],"methodCnt":1,"to":["\u003csip:0113908351673002@109.123.246.142:5060\u003e"],"toCnt":1,"user":["0113908351673002","16299777872"],"userCnt":2,"useragent":["NEC DT800"],"useragentCnt":1,"via":["SIP/2.0/UDP 179.43.167.2:23377;branch=z9hG4bK-524287-1---b6d50b7828f7bd98"],"viaCnt":1},"source":{"as":{"full":"AS51852 Private Layer INC","number":51852,"organization":{"name":"Private Layer INC"}},"bytes":1062,"geo":{"country_iso_code":"CH"},"ip":"179.43.167.2","mac":["c0:69:11:cd:1f:19"],"mac-cnt":1,"packets":1,"port":23377},"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcPayload8":"494e564954452073","srcRIR":"LACNIC","srcTTL":[55],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["2197865105138760"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["b05640bd-eb2a-4d9d-8d73-d14d7cbeb44a"],"signatureCnt":1,"signatureId":[1071802],"signatureIdCnt":1},"tag":{"block":["false"],"blockCnt":1,"category":["protocol"],"categoryCnt":1,"description":["ip addresses with this tag have been observed sending sip traffic."],"intention":["unknown"],"intentionCnt":1,"name":["sip protocol"],"nameCnt":1},"tags":["proxy","sensor:contabo-sponge-02-ts","contabo-sponge-02-ts"],"tagsCnt":3,"totDataBytes":1020} +{"@timestamp":1787570184147,"_id":"260824-rZZc-GNX69hKF65RsJicqE1L","_index":"arkime_sessions3-260824","client":{"bytes":1021},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["netcup GmbH"],"isp.dstCnt":1,"isp.src":["Private Layer INC"],"isp.srcCnt":1,"org.dst":["Netcup KVM"],"org.dstCnt":1,"org.src":["Private Layer Inc"],"org.srcCnt":1,"usertype.dst":["business"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS197540 netcup GmbH","number":197540,"organization":{"name":"netcup GmbH"}},"bytes":0,"geo":{"country_iso_code":"DE"},"ip":"159.195.21.150","mac":["8a:41:d3:b8:0d:d3"],"mac-cnt":1,"packets":0,"port":5060},"dstRIR":"ARIN","ethertype":2048,"fileId":[78748],"firstPacket":1787569886282,"ipProtocol":17,"lastPacket":1787569886282,"length":0,"network":{"bytes":1063,"community_id":"1:VKffe4oH3kXJxTUfVQvAkERN6Mc=","packets":1},"node":"spark-afae","packetPos":[-78748,4077008],"packetRange":{"gte":1787569886282,"lte":1787569886282},"protocol":["udp","sip"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":0},"sip":{"callid":["afjZDEbfnuGShnk7btWjjv.."],"callidCnt":1,"contact":["\u003csip:17168465496@179.43.167.2:32545\u003e"],"contactCnt":1,"from":["\u003csip:17168465496@179.43.167.2\u003e;tag=8551011e"],"fromCnt":1,"method":["INVITE"],"methodCnt":1,"to":["\u003csip:+3908351673002@159.195.21.150:5060\u003e"],"toCnt":1,"user":["+3908351673002","17168465496"],"userCnt":2,"useragent":["Yealink SIP-T40P"],"useragentCnt":1,"via":["SIP/2.0/UDP 179.43.167.2:32545;branch=z9hG4bK-524287-1---cc82fc1ef8693600"],"viaCnt":1},"source":{"as":{"full":"AS51852 Private Layer INC","number":51852,"organization":{"name":"Private Layer INC"}},"bytes":1063,"geo":{"country_iso_code":"CH"},"ip":"179.43.167.2","mac":["bc:0f:fe:38:0b:a3"],"mac-cnt":1,"packets":1,"port":32545},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcPayload8":"494e564954452073","srcRIR":"LACNIC","srcTTL":[54],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["1775198638540024"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["b05640bd-eb2a-4d9d-8d73-d14d7cbeb44a"],"signatureCnt":1,"signatureId":[1071802],"signatureIdCnt":1},"tag":{"block":["false"],"blockCnt":1,"category":["protocol"],"categoryCnt":1,"description":["ip addresses with this tag have been observed sending sip traffic."],"intention":["unknown"],"intentionCnt":1,"name":["sip protocol"],"nameCnt":1},"tags":["netcup-ts","honeypot","sensor:netcup-ts"],"tagsCnt":3,"totDataBytes":1021} +{"@timestamp":1787566863956,"_id":"260824-k-6YwaqYfd9PKIy9gKJTeCQp","_index":"arkime_sessions3-260824","client":{"bytes":1033},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Private Layer INC"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Private Layer Inc"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":0,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":0,"port":5060},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[78731],"firstPacket":1787566112776,"ipProtocol":17,"lastPacket":1787566112776,"length":0,"network":{"bytes":1075,"community_id":"1:zxFaY3a7Vnl6muc7sT98zqv03+s=","packets":1},"node":"spark-afae","packetPos":[-78731,1687627],"packetRange":{"gte":1787566112776,"lte":1787566112776},"protocol":["udp","sip"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":0},"sip":{"callid":["gk3N68Y28J1IRpqIqHl6y1.."],"callidCnt":1,"contact":["\u003csip:16724692132@179.43.167.2:32545\u003e"],"contactCnt":1,"from":["\u003csip:16724692132@179.43.167.2\u003e;tag=56270a1c"],"fromCnt":1,"method":["INVITE"],"methodCnt":1,"to":["\u003csip:+3908351673002@217.15.163.226:5060\u003e"],"toCnt":1,"user":["16724692132","+3908351673002"],"userCnt":2,"useragent":["Grandstream GRP2615 1.0.5.93"],"useragentCnt":1,"via":["SIP/2.0/UDP 179.43.167.2:32545;branch=z9hG4bK-524287-1---087d436f774deef2"],"viaCnt":1},"source":{"as":{"full":"AS51852 Private Layer INC","number":51852,"organization":{"name":"Private Layer INC"}},"bytes":1075,"geo":{"country_iso_code":"CH"},"ip":"179.43.167.2","mac":["fc:bd:67:9d:2b:2b"],"mac-cnt":1,"packets":1,"port":32545},"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcPayload8":"494e564954452073","srcRIR":"LACNIC","srcTTL":[52],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["237549536327387"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["b05640bd-eb2a-4d9d-8d73-d14d7cbeb44a"],"signatureCnt":1,"signatureId":[1071802],"signatureIdCnt":1},"tag":{"block":["false"],"blockCnt":1,"category":["protocol"],"categoryCnt":1,"description":["ip addresses with this tag have been observed sending sip traffic."],"intention":["unknown"],"intentionCnt":1,"name":["sip protocol"],"nameCnt":1},"tags":["honeypot","contabo-sponge-01-ts","sensor:contabo-sponge-01-ts"],"tagsCnt":3,"totDataBytes":1033} +{"@timestamp":1787562933248,"_id":"260824-Hpb7psvtn3lJX4HhoBU6Ude2","_index":"arkime_sessions3-260824","client":{"bytes":1036},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo GmbH"],"isp.dstCnt":1,"isp.src":["Private Layer INC"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Private Layer Inc"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS51167 Contabo GmbH","number":51167,"organization":{"name":"Contabo GmbH"}},"bytes":0,"geo":{"country_iso_code":"FR"},"ip":"109.123.246.142","mac":["00:50:56:63:46:a6"],"mac-cnt":1,"packets":0,"port":5060},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[78708],"firstPacket":1787562501224,"ipProtocol":17,"lastPacket":1787562501224,"length":0,"network":{"bytes":1078,"community_id":"1:usbZBmotc9CtAmMX+AcHilAODgI=","packets":1},"node":"spark-afae","packetPos":[-78708,4235899],"packetRange":{"gte":1787562501224,"lte":1787562501224},"protocol":["udp","sip"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":0},"sip":{"callid":["WtJPzMqLNS80oTKunaslH4.."],"callidCnt":1,"contact":["\u003csip:16299777872@179.43.167.2:32545\u003e"],"contactCnt":1,"from":["\u003csip:16299777872@179.43.167.2\u003e;tag=1c60feb7"],"fromCnt":1,"method":["INVITE"],"methodCnt":1,"to":["\u003csip:+3908351673002@109.123.246.142:5060\u003e"],"toCnt":1,"user":["16299777872","+3908351673002"],"userCnt":2,"useragent":["Grandstream GXP2170 1.0.11.57"],"useragentCnt":1,"via":["SIP/2.0/UDP 179.43.167.2:32545;branch=z9hG4bK-524287-1---65cb7343dd00a383"],"viaCnt":1},"source":{"as":{"full":"AS51852 Private Layer INC","number":51852,"organization":{"name":"Private Layer INC"}},"bytes":1078,"geo":{"country_iso_code":"CH"},"ip":"179.43.167.2","mac":["c0:69:11:cd:1f:19"],"mac-cnt":1,"packets":1,"port":32545},"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcPayload8":"494e564954452073","srcRIR":"LACNIC","srcTTL":[55],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["1526226263178284"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["b05640bd-eb2a-4d9d-8d73-d14d7cbeb44a"],"signatureCnt":1,"signatureId":[1071802],"signatureIdCnt":1},"tag":{"block":["false"],"blockCnt":1,"category":["protocol"],"categoryCnt":1,"description":["ip addresses with this tag have been observed sending sip traffic."],"intention":["unknown"],"intentionCnt":1,"name":["sip protocol"],"nameCnt":1},"tags":["sensor:contabo-sponge-02-ts","proxy","contabo-sponge-02-ts"],"tagsCnt":3,"totDataBytes":1036} +{"@timestamp":1787561093203,"_id":"260824-1-3AroIx2yRE_5G1TUoiG4y-","_index":"arkime_sessions3-260824","client":{"bytes":1009},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Kaopu Cloud HK Limited"],"isp.dstCnt":1,"isp.src":["Private Layer INC"],"isp.srcCnt":1,"org.dst":["LightNode-BH"],"org.dstCnt":1,"org.src":["Private Layer Inc"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":0,"geo":{"country_iso_code":"BH"},"ip":"38.54.2.209","mac":["52:54:8f:9d:76:48"],"mac-cnt":1,"packets":0,"port":5060},"dstRIR":"ARIN","ethertype":2048,"fileId":[78699],"firstPacket":1787560164467,"ipProtocol":17,"lastPacket":1787560164467,"length":0,"network":{"bytes":1051,"community_id":"1:6Rq3Vq4S6IscFgrflxiYV1/sPVc=","packets":1},"node":"spark-afae","packetPos":[-78699,2073631],"packetRange":{"gte":1787560164467,"lte":1787560164467},"protocol":["sip","udp"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":0},"sip":{"callid":["BmT3GxOWzOoB8CqHXqvtKT.."],"callidCnt":1,"contact":["\u003csip:16563628947@179.43.167.2:22456\u003e"],"contactCnt":1,"from":["\u003csip:16563628947@179.43.167.2\u003e;tag=24993a77"],"fromCnt":1,"method":["INVITE"],"methodCnt":1,"to":["\u003csip:0013908351673002@38.54.2.209:5060\u003e"],"toCnt":1,"user":["16563628947","0013908351673002"],"userCnt":2,"useragent":["X-Lite"],"useragentCnt":1,"via":["SIP/2.0/UDP 179.43.167.2:22456;branch=z9hG4bK-524287-1---e518bcb681f32451"],"viaCnt":1},"source":{"as":{"full":"AS51852 Private Layer INC","number":51852,"organization":{"name":"Private Layer INC"}},"bytes":1051,"geo":{"country_iso_code":"CH"},"ip":"179.43.167.2","mac":["98:44:ce:60:15:19"],"mac-cnt":1,"packets":1,"port":22456},"srcOui":["Huawei Technologies Co.,Ltd"],"srcOuiCnt":1,"srcPayload8":"494e564954452073","srcRIR":"LACNIC","srcTTL":[50],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["1164876226023445"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["b05640bd-eb2a-4d9d-8d73-d14d7cbeb44a"],"signatureCnt":1,"signatureId":[1071802],"signatureIdCnt":1},"tag":{"block":["false"],"blockCnt":1,"category":["protocol"],"categoryCnt":1,"description":["ip addresses with this tag have been observed sending sip traffic."],"intention":["unknown"],"intentionCnt":1,"name":["sip protocol"],"nameCnt":1},"tags":["sensor:bahrain-sponge-01-ts","honeypot","bahrain-sponge-01-ts"],"tagsCnt":3,"totDataBytes":1009} +{"@timestamp":1787558678493,"_id":"260824-xpXNj0-ZRk1IbrYhrCn3J2yF","_index":"arkime_sessions3-260824","client":{"bytes":1027},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo GmbH"],"isp.dstCnt":1,"isp.src":["Private Layer INC"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Private Layer Inc"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS51167 Contabo GmbH","number":51167,"organization":{"name":"Contabo GmbH"}},"bytes":0,"geo":{"country_iso_code":"FR"},"ip":"109.123.246.142","mac":["00:50:56:63:46:a6"],"mac-cnt":1,"packets":0,"port":5060},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[78684],"firstPacket":1787557923115,"ipProtocol":17,"lastPacket":1787557923115,"length":0,"network":{"bytes":1069,"community_id":"1:LBaJ4lMIifNevEkMaa9TEo5dwJg=","packets":1},"node":"spark-afae","packetPos":[-78684,975913],"packetRange":{"gte":1787557923115,"lte":1787557923115},"protocol":["udp","sip"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":0},"sip":{"callid":["dY4D2aidAtkHaLcsjynYyD.."],"callidCnt":1,"contact":["\u003csip:16299777872@179.43.167.2:22456\u003e"],"contactCnt":1,"from":["\u003csip:16299777872@179.43.167.2\u003e;tag=d78aa1bd"],"fromCnt":1,"method":["INVITE"],"methodCnt":1,"to":["\u003csip:0013908351673002@109.123.246.142:5060\u003e"],"toCnt":1,"user":["16299777872","0013908351673002"],"userCnt":2,"useragent":["Yealink SIP-T48G"],"useragentCnt":1,"via":["SIP/2.0/UDP 179.43.167.2:22456;branch=z9hG4bK-524287-1---71fe388e6fd0a273"],"viaCnt":1},"source":{"as":{"full":"AS51852 Private Layer INC","number":51852,"organization":{"name":"Private Layer INC"}},"bytes":1069,"geo":{"country_iso_code":"CH"},"ip":"179.43.167.2","mac":["c0:69:11:cd:1f:19"],"mac-cnt":1,"packets":1,"port":22456},"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcPayload8":"494e564954452073","srcRIR":"LACNIC","srcTTL":[55],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["1057153776352758"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["b05640bd-eb2a-4d9d-8d73-d14d7cbeb44a"],"signatureCnt":1,"signatureId":[1071802],"signatureIdCnt":1},"tag":{"block":["false"],"blockCnt":1,"category":["protocol"],"categoryCnt":1,"description":["ip addresses with this tag have been observed sending sip traffic."],"intention":["unknown"],"intentionCnt":1,"name":["sip protocol"],"nameCnt":1},"tags":["proxy","sensor:contabo-sponge-02-ts","contabo-sponge-02-ts"],"tagsCnt":3,"totDataBytes":1027} +{"@timestamp":1787551404736,"_id":"260824-jDGnQBUAJYpDAKoP-N9EruFT","_index":"arkime_sessions3-260824","client":{"bytes":1028},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["netcup GmbH"],"isp.dstCnt":1,"isp.src":["Private Layer INC"],"isp.srcCnt":1,"org.dst":["Netcup KVM"],"org.dstCnt":1,"org.src":["Private Layer Inc"],"org.srcCnt":1,"usertype.dst":["business"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS197540 netcup GmbH","number":197540,"organization":{"name":"netcup GmbH"}},"bytes":0,"geo":{"country_iso_code":"DE"},"ip":"159.195.21.150","mac":["8a:41:d3:b8:0d:d3"],"mac-cnt":1,"packets":0,"port":5060},"dstRIR":"ARIN","ethertype":2048,"fileId":[78646],"firstPacket":1787550835395,"ipProtocol":17,"lastPacket":1787550835395,"length":0,"network":{"bytes":1070,"community_id":"1:hsOrhKAKPYnJULQ7rnk+2UzPcN8=","packets":1},"node":"spark-afae","packetPos":[-78646,11594494],"packetRange":{"gte":1787550835395,"lte":1787550835395},"protocol":["udp","sip"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":0},"sip":{"callid":["uFxHOxZy76t3UXd3pcZrsV.."],"callidCnt":1,"contact":["\u003csip:17168465496@179.43.167.2:32781\u003e"],"contactCnt":1,"from":["\u003csip:17168465496@179.43.167.2\u003e;tag=7109eb40"],"fromCnt":1,"method":["INVITE"],"methodCnt":1,"to":["\u003csip:0123908351673002@159.195.21.150:5060\u003e"],"toCnt":1,"user":["0123908351673002","17168465496"],"userCnt":2,"useragent":["Panasonic KX-HDV230"],"useragentCnt":1,"via":["SIP/2.0/UDP 179.43.167.2:32781;branch=z9hG4bK-524287-1---23f478c736af478c"],"viaCnt":1},"source":{"as":{"full":"AS51852 Private Layer INC","number":51852,"organization":{"name":"Private Layer INC"}},"bytes":1070,"geo":{"country_iso_code":"CH"},"ip":"179.43.167.2","mac":["bc:0f:fe:38:0b:a3"],"mac-cnt":1,"packets":1,"port":32781},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcPayload8":"494e564954452073","srcRIR":"LACNIC","srcTTL":[54],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["854299085445119"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["b05640bd-eb2a-4d9d-8d73-d14d7cbeb44a"],"signatureCnt":1,"signatureId":[1071802],"signatureIdCnt":1},"tag":{"block":["false"],"blockCnt":1,"category":["protocol"],"categoryCnt":1,"description":["ip addresses with this tag have been observed sending sip traffic."],"intention":["unknown"],"intentionCnt":1,"name":["sip protocol"],"nameCnt":1},"tags":["honeypot","netcup-ts","sensor:netcup-ts"],"tagsCnt":3,"totDataBytes":1028} +{"@timestamp":1787547789200,"_id":"260824-GezaKUeRDdBO8Z8jXCckY5dg","_index":"arkime_sessions3-260824","client":{"bytes":1035},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Private Layer INC"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Private Layer Inc"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":0,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":0,"port":5060},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[78625],"firstPacket":1787547059257,"ipProtocol":17,"lastPacket":1787547059257,"length":0,"network":{"bytes":1077,"community_id":"1:VpYdLBt8znNEMiavM0YqfXxsgxs=","packets":1},"node":"spark-afae","packetPos":[-78625,1173708],"packetRange":{"gte":1787547059257,"lte":1787547059257},"protocol":["udp","sip"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":0},"sip":{"callid":["289u45Lm1u7ajNPgUgafKX.."],"callidCnt":1,"contact":["\u003csip:16724692132@179.43.167.2:32781\u003e"],"contactCnt":1,"from":["\u003csip:16724692132@179.43.167.2\u003e;tag=8012ca01"],"fromCnt":1,"method":["INVITE"],"methodCnt":1,"to":["\u003csip:0123908351673002@217.15.163.226:5060\u003e"],"toCnt":1,"user":["0123908351673002","16724692132"],"userCnt":2,"useragent":["Yealink SIP-T46S 66.86.0.5"],"useragentCnt":1,"via":["SIP/2.0/UDP 179.43.167.2:32781;branch=z9hG4bK-524287-1---17877d0905eef029"],"viaCnt":1},"source":{"as":{"full":"AS51852 Private Layer INC","number":51852,"organization":{"name":"Private Layer INC"}},"bytes":1077,"geo":{"country_iso_code":"CH"},"ip":"179.43.167.2","mac":["fc:bd:67:9d:2b:2b"],"mac-cnt":1,"packets":1,"port":32781},"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcPayload8":"494e564954452073","srcRIR":"LACNIC","srcTTL":[52],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["1106193010171113"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["b05640bd-eb2a-4d9d-8d73-d14d7cbeb44a"],"signatureCnt":1,"signatureId":[1071802],"signatureIdCnt":1},"tag":{"block":["false"],"blockCnt":1,"category":["protocol"],"categoryCnt":1,"description":["ip addresses with this tag have been observed sending sip traffic."],"intention":["unknown"],"intentionCnt":1,"name":["sip protocol"],"nameCnt":1},"tags":["honeypot","contabo-sponge-01-ts","sensor:contabo-sponge-01-ts"],"tagsCnt":3,"totDataBytes":1035} +{"@timestamp":1787544184808,"_id":"260824-q-vP144cR4dPEaCuIY6dNVht","_index":"arkime_sessions3-260824","client":{"bytes":1037},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo GmbH"],"isp.dstCnt":1,"isp.src":["Private Layer INC"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Private Layer Inc"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS51167 Contabo GmbH","number":51167,"organization":{"name":"Contabo GmbH"}},"bytes":0,"geo":{"country_iso_code":"FR"},"ip":"109.123.246.142","mac":["00:50:56:63:46:a6"],"mac-cnt":1,"packets":0,"port":5060},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[78604],"firstPacket":1787543451666,"ipProtocol":17,"lastPacket":1787543451666,"length":0,"network":{"bytes":1079,"community_id":"1:+YrUICl5cySasOFohh9jHN14r1Q=","packets":1},"node":"spark-afae","packetPos":[-78604,88673],"packetRange":{"gte":1787543451666,"lte":1787543451666},"protocol":["udp","sip"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":0},"sip":{"callid":["yNLLiNXVcPIv9k3TCqI0vJ.."],"callidCnt":1,"contact":["\u003csip:16299777872@179.43.167.2:32781\u003e"],"contactCnt":1,"from":["\u003csip:16299777872@179.43.167.2\u003e;tag=0b57dc04"],"fromCnt":1,"method":["INVITE"],"methodCnt":1,"to":["\u003csip:0123908351673002@109.123.246.142:5060\u003e"],"toCnt":1,"user":["0123908351673002","16299777872"],"userCnt":2,"useragent":["Avaya-IP-Phone-9608 S6.6.4"],"useragentCnt":1,"via":["SIP/2.0/UDP 179.43.167.2:32781;branch=z9hG4bK-524287-1---e4a234c1cd766836"],"viaCnt":1},"source":{"as":{"full":"AS51852 Private Layer INC","number":51852,"organization":{"name":"Private Layer INC"}},"bytes":1079,"geo":{"country_iso_code":"CH"},"ip":"179.43.167.2","mac":["c0:69:11:cd:1f:19"],"mac-cnt":1,"packets":1,"port":32781},"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcPayload8":"494e564954452073","srcRIR":"LACNIC","srcTTL":[55],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["890235784963217"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["b05640bd-eb2a-4d9d-8d73-d14d7cbeb44a"],"signatureCnt":1,"signatureId":[1071802],"signatureIdCnt":1},"tag":{"block":["false"],"blockCnt":1,"category":["protocol"],"categoryCnt":1,"description":["ip addresses with this tag have been observed sending sip traffic."],"intention":["unknown"],"intentionCnt":1,"name":["sip protocol"],"nameCnt":1},"tags":["contabo-sponge-02-ts","sensor:contabo-sponge-02-ts","proxy"],"tagsCnt":3,"totDataBytes":1037} +{"@timestamp":1787537234099,"_id":"260824-HTHKObzT-gJPtrBjF6fZ09LB","_index":"arkime_sessions3-260824","client":{"bytes":1026},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["netcup GmbH"],"isp.dstCnt":1,"isp.src":["Private Layer INC"],"isp.srcCnt":1,"org.dst":["Netcup KVM"],"org.dstCnt":1,"org.src":["Private Layer Inc"],"org.srcCnt":1,"usertype.dst":["business"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS197540 netcup GmbH","number":197540,"organization":{"name":"netcup GmbH"}},"bytes":0,"geo":{"country_iso_code":"DE"},"ip":"159.195.21.150","mac":["8a:41:d3:b8:0d:d3"],"mac-cnt":1,"packets":0,"port":5060},"dstRIR":"ARIN","ethertype":2048,"fileId":[78565],"firstPacket":1787536351309,"ipProtocol":17,"lastPacket":1787536351309,"length":0,"network":{"bytes":1068,"community_id":"1:/Rg8sNfnZ5dP+RhHguWIzguM05Q=","packets":1},"node":"spark-afae","packetPos":[-78565,2097753],"packetRange":{"gte":1787536351309,"lte":1787536351309},"protocol":["udp","sip"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":0},"sip":{"callid":["PdvG9KpY5QBYbUAg36aiUj.."],"callidCnt":1,"contact":["\u003csip:17168465496@179.43.167.2:29343\u003e"],"contactCnt":1,"from":["\u003csip:17168465496@179.43.167.2\u003e;tag=52ecfd6f"],"fromCnt":1,"method":["INVITE"],"methodCnt":1,"to":["\u003csip:0103908351673002@159.195.21.150:5060\u003e"],"toCnt":1,"user":["0103908351673002","17168465496"],"userCnt":2,"useragent":["Grandstream HT802"],"useragentCnt":1,"via":["SIP/2.0/UDP 179.43.167.2:29343;branch=z9hG4bK-524287-1---0c8c2c6f8085a997"],"viaCnt":1},"source":{"as":{"full":"AS51852 Private Layer INC","number":51852,"organization":{"name":"Private Layer INC"}},"bytes":1068,"geo":{"country_iso_code":"CH"},"ip":"179.43.167.2","mac":["bc:0f:fe:38:0b:a3"],"mac-cnt":1,"packets":1,"port":29343},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcPayload8":"494e564954452073","srcRIR":"LACNIC","srcTTL":[54],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["2174047328236938"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["b05640bd-eb2a-4d9d-8d73-d14d7cbeb44a"],"signatureCnt":1,"signatureId":[1071802],"signatureIdCnt":1},"tag":{"block":["false"],"blockCnt":1,"category":["protocol"],"categoryCnt":1,"description":["ip addresses with this tag have been observed sending sip traffic."],"intention":["unknown"],"intentionCnt":1,"name":["sip protocol"],"nameCnt":1},"tags":["sensor:netcup-ts","honeypot","netcup-ts"],"tagsCnt":3,"totDataBytes":1026} +{"@timestamp":1787533624118,"_id":"260824-VOpYd5JWpjBEnpQO2dtdJKpW","_index":"arkime_sessions3-260824","client":{"bytes":1041},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Private Layer INC"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Private Layer Inc"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":0,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":0,"port":5060},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[78547],"firstPacket":1787532583908,"ipProtocol":17,"lastPacket":1787532583908,"length":0,"network":{"bytes":1083,"community_id":"1:vjITv3q1bLBYJ3V2Qbw9zNjcD70=","packets":1},"node":"spark-afae","packetPos":[-78547,7631992],"packetRange":{"gte":1787532583908,"lte":1787532583908},"protocol":["sip","udp"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":0},"sip":{"callid":["0Kx6bf1mNHFYs1JiYHTf2E.."],"callidCnt":1,"contact":["\u003csip:16724692132@179.43.167.2:29343\u003e"],"contactCnt":1,"from":["\u003csip:16724692132@179.43.167.2\u003e;tag=1a05cfdb"],"fromCnt":1,"method":["INVITE"],"methodCnt":1,"to":["\u003csip:0103908351673002@217.15.163.226:5060\u003e"],"toCnt":1,"user":["16724692132","0103908351673002"],"userCnt":2,"useragent":["Avaya Aura Communication Manager"],"useragentCnt":1,"via":["SIP/2.0/UDP 179.43.167.2:29343;branch=z9hG4bK-524287-1---847787544c5aaa25"],"viaCnt":1},"source":{"as":{"full":"AS51852 Private Layer INC","number":51852,"organization":{"name":"Private Layer INC"}},"bytes":1083,"geo":{"country_iso_code":"CH"},"ip":"179.43.167.2","mac":["fc:bd:67:9d:2b:2b"],"mac-cnt":1,"packets":1,"port":29343},"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcPayload8":"494e564954452073","srcRIR":"LACNIC","srcTTL":[52],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["2213163786049354"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["b05640bd-eb2a-4d9d-8d73-d14d7cbeb44a"],"signatureCnt":1,"signatureId":[1071802],"signatureIdCnt":1},"tag":{"block":["false"],"blockCnt":1,"category":["protocol"],"categoryCnt":1,"description":["ip addresses with this tag have been observed sending sip traffic."],"intention":["unknown"],"intentionCnt":1,"name":["sip protocol"],"nameCnt":1},"tags":["sensor:contabo-sponge-01-ts","contabo-sponge-01-ts","honeypot"],"tagsCnt":3,"totDataBytes":1041} +{"@timestamp":1787532422263,"_id":"260824-KOrqz35_CClPca5Bvd8Pg_eV","_index":"arkime_sessions3-260824","client":{"bytes":1017},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Kaopu Cloud HK Limited"],"isp.dstCnt":1,"isp.src":["Private Layer INC"],"isp.srcCnt":1,"org.dst":["LightNode-BH"],"org.dstCnt":1,"org.src":["Private Layer Inc"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":0,"geo":{"country_iso_code":"BH"},"ip":"38.54.2.209","mac":["52:54:8f:9d:76:48"],"mac-cnt":1,"packets":0,"port":5060},"dstRIR":"ARIN","ethertype":2048,"fileId":[78540],"firstPacket":1787531214646,"ipProtocol":17,"lastPacket":1787531214646,"length":0,"network":{"bytes":1059,"community_id":"1:reK2V4uAx79R0cYn0CgYf2UzkGc=","packets":1},"node":"spark-afae","packetPos":[-78540,1824664],"packetRange":{"gte":1787531214646,"lte":1787531214646},"protocol":["udp","sip"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":0},"sip":{"callid":["keLd4wk6oH5jupP0vFG9un.."],"callidCnt":1,"contact":["\u003csip:16563628947@179.43.167.2:29343\u003e"],"contactCnt":1,"from":["\u003csip:16563628947@179.43.167.2\u003e;tag=b7c0ae1f"],"fromCnt":1,"method":["INVITE"],"methodCnt":1,"to":["\u003csip:0103908351673002@38.54.2.209:5060\u003e"],"toCnt":1,"user":["16563628947","0103908351673002"],"userCnt":2,"useragent":["Vodia PBX 65.0"],"useragentCnt":1,"via":["SIP/2.0/UDP 179.43.167.2:29343;branch=z9hG4bK-524287-1---c89bc8c8ed8699d7"],"viaCnt":1},"source":{"as":{"full":"AS51852 Private Layer INC","number":51852,"organization":{"name":"Private Layer INC"}},"bytes":1059,"geo":{"country_iso_code":"CH"},"ip":"179.43.167.2","mac":["98:44:ce:60:15:19"],"mac-cnt":1,"packets":1,"port":29343},"srcOui":["Huawei Technologies Co.,Ltd"],"srcOuiCnt":1,"srcPayload8":"494e564954452073","srcRIR":"LACNIC","srcTTL":[50],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["1932763830375370"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["b05640bd-eb2a-4d9d-8d73-d14d7cbeb44a"],"signatureCnt":1,"signatureId":[1071802],"signatureIdCnt":1},"tag":{"block":["false"],"blockCnt":1,"category":["protocol"],"categoryCnt":1,"description":["ip addresses with this tag have been observed sending sip traffic."],"intention":["unknown"],"intentionCnt":1,"name":["sip protocol"],"nameCnt":1},"tags":["bahrain-sponge-01-ts","honeypot","sensor:bahrain-sponge-01-ts"],"tagsCnt":3,"totDataBytes":1017} +{"@timestamp":1787529702287,"_id":"260823-x-kDF6vDrA9Fn5ehMTsj9whI","_index":"arkime_sessions3-260823","client":{"bytes":1025},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo GmbH"],"isp.dstCnt":1,"isp.src":["Private Layer INC"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Private Layer Inc"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS51167 Contabo GmbH","number":51167,"organization":{"name":"Contabo GmbH"}},"bytes":0,"geo":{"country_iso_code":"FR"},"ip":"109.123.246.142","mac":["00:50:56:63:46:a6"],"mac-cnt":1,"packets":0,"port":5060},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[78524],"firstPacket":1787528976763,"ipProtocol":17,"lastPacket":1787528976763,"length":0,"network":{"bytes":1067,"community_id":"1:RmkKf+oNgDNLSi3kOMHCbjmEmr4=","packets":1},"node":"spark-afae","packetPos":[-78524,503509],"packetRange":{"gte":1787528976763,"lte":1787528976763},"protocol":["udp","sip"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":0},"sip":{"callid":["wjNDbMIlm0aHoe3vZSVXBk.."],"callidCnt":1,"contact":["\u003csip:16299777872@179.43.167.2:29343\u003e"],"contactCnt":1,"from":["\u003csip:16299777872@179.43.167.2\u003e;tag=f1d4165c"],"fromCnt":1,"method":["INVITE"],"methodCnt":1,"to":["\u003csip:0103908351673002@109.123.246.142:5060\u003e"],"toCnt":1,"user":["16299777872","0103908351673002"],"userCnt":2,"useragent":["Avaya IP Phone"],"useragentCnt":1,"via":["SIP/2.0/UDP 179.43.167.2:29343;branch=z9hG4bK-524287-1---b11fa0fbeb104e4f"],"viaCnt":1},"source":{"as":{"full":"AS51852 Private Layer INC","number":51852,"organization":{"name":"Private Layer INC"}},"bytes":1067,"geo":{"country_iso_code":"CH"},"ip":"179.43.167.2","mac":["c0:69:11:cd:1f:19"],"mac-cnt":1,"packets":1,"port":29343},"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcPayload8":"494e564954452073","srcRIR":"LACNIC","srcTTL":[55],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["184371763504474"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["b05640bd-eb2a-4d9d-8d73-d14d7cbeb44a"],"signatureCnt":1,"signatureId":[1071802],"signatureIdCnt":1},"tag":{"block":["false"],"blockCnt":1,"category":["protocol"],"categoryCnt":1,"description":["ip addresses with this tag have been observed sending sip traffic."],"intention":["unknown"],"intentionCnt":1,"name":["sip protocol"],"nameCnt":1},"tags":["contabo-sponge-02-ts","sensor:contabo-sponge-02-ts","proxy"],"tagsCnt":3,"totDataBytes":1025} +{"@timestamp":1787522752404,"_id":"260823--5KD-Ib_Gp9AK5dNrmV_ieXM","_index":"arkime_sessions3-260823","client":{"bytes":1024},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["netcup GmbH"],"isp.dstCnt":1,"isp.src":["Private Layer INC"],"isp.srcCnt":1,"org.dst":["Netcup KVM"],"org.dstCnt":1,"org.src":["Private Layer Inc"],"org.srcCnt":1,"usertype.dst":["business"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS197540 netcup GmbH","number":197540,"organization":{"name":"netcup GmbH"}},"bytes":0,"geo":{"country_iso_code":"DE"},"ip":"159.195.21.150","mac":["8a:41:d3:b8:0d:d3"],"mac-cnt":1,"packets":0,"port":5060},"dstRIR":"ARIN","ethertype":2048,"fileId":[78485],"firstPacket":1787521858614,"ipProtocol":17,"lastPacket":1787521858614,"length":0,"network":{"bytes":1066,"community_id":"1:fTaOVpmKNGrUAM7ypCaYKI4OpKE=","packets":1},"node":"spark-afae","packetPos":[-78485,4252587],"packetRange":{"gte":1787521858614,"lte":1787521858614},"protocol":["udp","sip"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":0},"sip":{"callid":["eFvy9PfYaL8rPv8uPbDBvB.."],"callidCnt":1,"contact":["\u003csip:17168465496@179.43.167.2:25405\u003e"],"contactCnt":1,"from":["\u003csip:17168465496@179.43.167.2\u003e;tag=124eff89"],"fromCnt":1,"method":["INVITE"],"methodCnt":1,"to":["\u003csip:00113908351673002@159.195.21.150:5060\u003e"],"toCnt":1,"user":["00113908351673002","17168465496"],"userCnt":2,"useragent":["Linksys PAP2T"],"useragentCnt":1,"via":["SIP/2.0/UDP 179.43.167.2:25405;branch=z9hG4bK-524287-1---6c4dfdc751063d6b"],"viaCnt":1},"source":{"as":{"full":"AS51852 Private Layer INC","number":51852,"organization":{"name":"Private Layer INC"}},"bytes":1066,"geo":{"country_iso_code":"CH"},"ip":"179.43.167.2","mac":["bc:0f:fe:38:0b:a3"],"mac-cnt":1,"packets":1,"port":25405},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcPayload8":"494e564954452073","srcRIR":"LACNIC","srcTTL":[54],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["668011170023988"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["b05640bd-eb2a-4d9d-8d73-d14d7cbeb44a"],"signatureCnt":1,"signatureId":[1071802],"signatureIdCnt":1},"tag":{"block":["false"],"blockCnt":1,"category":["protocol"],"categoryCnt":1,"description":["ip addresses with this tag have been observed sending sip traffic."],"intention":["unknown"],"intentionCnt":1,"name":["sip protocol"],"nameCnt":1},"tags":["sensor:netcup-ts","honeypot","netcup-ts"],"tagsCnt":3,"totDataBytes":1024} +{"@timestamp":1787519441082,"_id":"260823-cuiYJlmHIXBOkrSFOE3YvIU3","_index":"arkime_sessions3-260823","client":{"bytes":1026},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Private Layer INC"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Private Layer Inc"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":0,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":0,"port":5060},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[78467],"firstPacket":1787518080720,"ipProtocol":17,"lastPacket":1787518080720,"length":0,"network":{"bytes":1068,"community_id":"1:dONUx83apcheOFKzG5cAqcTvUrQ=","packets":1},"node":"spark-afae","packetPos":[-78467,543210],"packetRange":{"gte":1787518080720,"lte":1787518080720},"protocol":["sip","udp"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":0},"sip":{"callid":["0NpsSqYgPP51E8gmqXT2Rv.."],"callidCnt":1,"contact":["\u003csip:16724692132@179.43.167.2:25405\u003e"],"contactCnt":1,"from":["\u003csip:16724692132@179.43.167.2\u003e;tag=bfedd890"],"fromCnt":1,"method":["INVITE"],"methodCnt":1,"to":["\u003csip:00113908351673002@217.15.163.226:5060\u003e"],"toCnt":1,"user":["16724692132","00113908351673002"],"userCnt":2,"useragent":["MicroSIP/3.20.2"],"useragentCnt":1,"via":["SIP/2.0/UDP 179.43.167.2:25405;branch=z9hG4bK-524287-1---404b5ad4fb9d2d7c"],"viaCnt":1},"source":{"as":{"full":"AS51852 Private Layer INC","number":51852,"organization":{"name":"Private Layer INC"}},"bytes":1068,"geo":{"country_iso_code":"CH"},"ip":"179.43.167.2","mac":["fc:bd:67:9d:2b:2b"],"mac-cnt":1,"packets":1,"port":25405},"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcPayload8":"494e564954452073","srcRIR":"LACNIC","srcTTL":[52],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["278214572270679"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["b05640bd-eb2a-4d9d-8d73-d14d7cbeb44a"],"signatureCnt":1,"signatureId":[1071802],"signatureIdCnt":1},"tag":{"block":["false"],"blockCnt":1,"category":["protocol"],"categoryCnt":1,"description":["ip addresses with this tag have been observed sending sip traffic."],"intention":["unknown"],"intentionCnt":1,"name":["sip protocol"],"nameCnt":1},"tags":["honeypot","sensor:contabo-sponge-01-ts","contabo-sponge-01-ts"],"tagsCnt":3,"totDataBytes":1026} +{"@timestamp":1787517938799,"_id":"260823-R-jAmSPVf6RJqKjWOUNU00EC","_index":"arkime_sessions3-260823","client":{"bytes":1016},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Kaopu Cloud HK Limited"],"isp.dstCnt":1,"isp.src":["Private Layer INC"],"isp.srcCnt":1,"org.dst":["LightNode-BH"],"org.dstCnt":1,"org.src":["Private Layer Inc"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":0,"geo":{"country_iso_code":"BH"},"ip":"38.54.2.209","mac":["52:54:8f:9d:76:48"],"mac-cnt":1,"packets":0,"port":5060},"dstRIR":"ARIN","ethertype":2048,"fileId":[78459],"firstPacket":1787516710246,"ipProtocol":17,"lastPacket":1787516710246,"length":0,"network":{"bytes":1058,"community_id":"1:aNSby1NisA6fdtsHjeBTqQDWKhs=","packets":1},"node":"spark-afae","packetPos":[-78459,503563],"packetRange":{"gte":1787516710246,"lte":1787516710246},"protocol":["udp","sip"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":0},"sip":{"callid":["xCgWKu0P5ZymnRD2UnDDfa.."],"callidCnt":1,"contact":["\u003csip:16563628947@179.43.167.2:25405\u003e"],"contactCnt":1,"from":["\u003csip:16563628947@179.43.167.2\u003e;tag=e96bff4c"],"fromCnt":1,"method":["INVITE"],"methodCnt":1,"to":["\u003csip:00113908351673002@38.54.2.209:5060\u003e"],"toCnt":1,"user":["16563628947","00113908351673002"],"userCnt":2,"useragent":["KPhone/3.13"],"useragentCnt":1,"via":["SIP/2.0/UDP 179.43.167.2:25405;branch=z9hG4bK-524287-1---d7d002cf449d0162"],"viaCnt":1},"source":{"as":{"full":"AS51852 Private Layer INC","number":51852,"organization":{"name":"Private Layer INC"}},"bytes":1058,"geo":{"country_iso_code":"CH"},"ip":"179.43.167.2","mac":["98:44:ce:60:15:19"],"mac-cnt":1,"packets":1,"port":25405},"srcOui":["Huawei Technologies Co.,Ltd"],"srcOuiCnt":1,"srcPayload8":"494e564954452073","srcRIR":"LACNIC","srcTTL":[50],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["1901997835078302"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["b05640bd-eb2a-4d9d-8d73-d14d7cbeb44a"],"signatureCnt":1,"signatureId":[1071802],"signatureIdCnt":1},"tag":{"block":["false"],"blockCnt":1,"category":["protocol"],"categoryCnt":1,"description":["ip addresses with this tag have been observed sending sip traffic."],"intention":["unknown"],"intentionCnt":1,"name":["sip protocol"],"nameCnt":1},"tags":["bahrain-sponge-01-ts","honeypot","sensor:bahrain-sponge-01-ts"],"tagsCnt":3,"totDataBytes":1016} +{"@timestamp":1787515228017,"_id":"260823-VpKXNdz1k_NGDIa9gi_7suB0","_index":"arkime_sessions3-260823","client":{"bytes":1039},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo GmbH"],"isp.dstCnt":1,"isp.src":["Private Layer INC"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Private Layer Inc"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS51167 Contabo GmbH","number":51167,"organization":{"name":"Contabo GmbH"}},"bytes":0,"geo":{"country_iso_code":"FR"},"ip":"109.123.246.142","mac":["00:50:56:63:46:a6"],"mac-cnt":1,"packets":0,"port":5060},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[78443],"firstPacket":1787514472162,"ipProtocol":17,"lastPacket":1787514472162,"length":0,"network":{"bytes":1081,"community_id":"1:3AyKjFCGQcDj41e4STiPjt5Qo7s=","packets":1},"node":"spark-afae","packetPos":[-78443,237519],"packetRange":{"gte":1787514472162,"lte":1787514472162},"protocol":["udp","sip"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":0},"sip":{"callid":["TAO6a8Tlq0dtK2NoomuvzK.."],"callidCnt":1,"contact":["\u003csip:16299777872@179.43.167.2:25405\u003e"],"contactCnt":1,"from":["\u003csip:16299777872@179.43.167.2\u003e;tag=6d0f6446"],"fromCnt":1,"method":["INVITE"],"methodCnt":1,"to":["\u003csip:00113908351673002@109.123.246.142:5060\u003e"],"toCnt":1,"user":["16299777872","00113908351673002"],"userCnt":2,"useragent":["Grandstream HT813 1.0.17.5"],"useragentCnt":1,"via":["SIP/2.0/UDP 179.43.167.2:25405;branch=z9hG4bK-524287-1---c7f68184d7acacd0"],"viaCnt":1},"source":{"as":{"full":"AS51852 Private Layer INC","number":51852,"organization":{"name":"Private Layer INC"}},"bytes":1081,"geo":{"country_iso_code":"CH"},"ip":"179.43.167.2","mac":["c0:69:11:cd:1f:19"],"mac-cnt":1,"packets":1,"port":25405},"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcPayload8":"494e564954452073","srcRIR":"LACNIC","srcTTL":[55],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["134470214295364"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["b05640bd-eb2a-4d9d-8d73-d14d7cbeb44a"],"signatureCnt":1,"signatureId":[1071802],"signatureIdCnt":1},"tag":{"block":["false"],"blockCnt":1,"category":["protocol"],"categoryCnt":1,"description":["ip addresses with this tag have been observed sending sip traffic."],"intention":["unknown"],"intentionCnt":1,"name":["sip protocol"],"nameCnt":1},"tags":["proxy","contabo-sponge-02-ts","sensor:contabo-sponge-02-ts"],"tagsCnt":3,"totDataBytes":1039} +{"@timestamp":1787508246281,"_id":"260823-nQchAOrn4aVN67DFVxNePyKe","_index":"arkime_sessions3-260823","client":{"bytes":1025},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["netcup GmbH"],"isp.dstCnt":1,"isp.src":["Private Layer INC"],"isp.srcCnt":1,"org.dst":["Netcup KVM"],"org.dstCnt":1,"org.src":["Private Layer Inc"],"org.srcCnt":1,"usertype.dst":["business"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS197540 netcup GmbH","number":197540,"organization":{"name":"netcup GmbH"}},"bytes":0,"geo":{"country_iso_code":"DE"},"ip":"159.195.21.150","mac":["8a:41:d3:b8:0d:d3"],"mac-cnt":1,"packets":0,"port":5060},"dstRIR":"ARIN","ethertype":2048,"fileId":[78404],"firstPacket":1787507358595,"ipProtocol":17,"lastPacket":1787507358595,"length":0,"network":{"bytes":1067,"community_id":"1:yqyIFnqsQM5ifzJ8zHqealfk0rg=","packets":1},"node":"spark-afae","packetPos":[-78404,4697579],"packetRange":{"gte":1787507358595,"lte":1787507358595},"protocol":["udp","sip"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":0},"sip":{"callid":["eqEKestYhleciUySKcjhIc.."],"callidCnt":1,"contact":["\u003csip:17168465496@179.43.167.2:28637\u003e"],"contactCnt":1,"from":["\u003csip:17168465496@179.43.167.2\u003e;tag=d108fb1b"],"fromCnt":1,"method":["INVITE"],"methodCnt":1,"to":["\u003csip:8103908351673002@159.195.21.150:5060\u003e"],"toCnt":1,"user":["8103908351673002","17168465496"],"userCnt":2,"useragent":["Yealink SIP-T54W"],"useragentCnt":1,"via":["SIP/2.0/UDP 179.43.167.2:28637;branch=z9hG4bK-524287-1---b508379401809c95"],"viaCnt":1},"source":{"as":{"full":"AS51852 Private Layer INC","number":51852,"organization":{"name":"Private Layer INC"}},"bytes":1067,"geo":{"country_iso_code":"CH"},"ip":"179.43.167.2","mac":["bc:0f:fe:38:0b:a3"],"mac-cnt":1,"packets":1,"port":28637},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcPayload8":"494e564954452073","srcRIR":"LACNIC","srcTTL":[54],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["1711267206632658"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["b05640bd-eb2a-4d9d-8d73-d14d7cbeb44a"],"signatureCnt":1,"signatureId":[1071802],"signatureIdCnt":1},"tag":{"block":["false"],"blockCnt":1,"category":["protocol"],"categoryCnt":1,"description":["ip addresses with this tag have been observed sending sip traffic."],"intention":["unknown"],"intentionCnt":1,"name":["sip protocol"],"nameCnt":1},"tags":["honeypot","netcup-ts","sensor:netcup-ts"],"tagsCnt":3,"totDataBytes":1025} +{"@timestamp":1787504936135,"_id":"260823-kZGrdCjf4ktAZY4L48D6RqwY","_index":"arkime_sessions3-260823","client":{"bytes":1015},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Private Layer INC"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Private Layer Inc"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":0,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":0,"port":5060},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[78386],"firstPacket":1787503581027,"ipProtocol":17,"lastPacket":1787503581027,"length":0,"network":{"bytes":1057,"community_id":"1:/WOpgMppCn5LZCZKSIK2SIP1i3U=","packets":1},"node":"spark-afae","packetPos":[-78386,24],"packetRange":{"gte":1787503581027,"lte":1787503581027},"protocol":["udp","sip"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":0},"sip":{"callid":["taxpAUKcV9HX8qt84E3CcS.."],"callidCnt":1,"contact":["\u003csip:16724692132@179.43.167.2:28637\u003e"],"contactCnt":1,"from":["\u003csip:16724692132@179.43.167.2\u003e;tag=3147bcc2"],"fromCnt":1,"method":["INVITE"],"methodCnt":1,"to":["\u003csip:8103908351673002@217.15.163.226:5060\u003e"],"toCnt":1,"user":["8103908351673002","16724692132"],"userCnt":2,"useragent":["Vonage"],"useragentCnt":1,"via":["SIP/2.0/UDP 179.43.167.2:28637;branch=z9hG4bK-524287-1---f8c6f3436fd76b5c"],"viaCnt":1},"source":{"as":{"full":"AS51852 Private Layer INC","number":51852,"organization":{"name":"Private Layer INC"}},"bytes":1057,"geo":{"country_iso_code":"CH"},"ip":"179.43.167.2","mac":["fc:bd:67:9d:2b:2b"],"mac-cnt":1,"packets":1,"port":28637},"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcPayload8":"494e564954452073","srcRIR":"LACNIC","srcTTL":[52],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["1525534115980502"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["b05640bd-eb2a-4d9d-8d73-d14d7cbeb44a"],"signatureCnt":1,"signatureId":[1071802],"signatureIdCnt":1},"tag":{"block":["false"],"blockCnt":1,"category":["protocol"],"categoryCnt":1,"description":["ip addresses with this tag have been observed sending sip traffic."],"intention":["unknown"],"intentionCnt":1,"name":["sip protocol"],"nameCnt":1},"tags":["sensor:contabo-sponge-01-ts","honeypot","contabo-sponge-01-ts"],"tagsCnt":3,"totDataBytes":1015} +{"@timestamp":1787502822843,"_id":"260823-WObC-m7A6olB1Ziy4YUk4IOs","_index":"arkime_sessions3-260823","client":{"bytes":1015},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Kaopu Cloud HK Limited"],"isp.dstCnt":1,"isp.src":["Private Layer INC"],"isp.srcCnt":1,"org.dst":["LightNode-BH"],"org.dstCnt":1,"org.src":["Private Layer Inc"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":0,"geo":{"country_iso_code":"BH"},"ip":"38.54.2.209","mac":["52:54:8f:9d:76:48"],"mac-cnt":1,"packets":0,"port":5060},"dstRIR":"ARIN","ethertype":2048,"fileId":[78375],"firstPacket":1787502209014,"ipProtocol":17,"lastPacket":1787502209014,"length":0,"network":{"bytes":1057,"community_id":"1:3cDlAY2HSa+E3wnze1iR/5DiPtc=","packets":1},"node":"spark-afae","packetPos":[-78375,2077209],"packetRange":{"gte":1787502209014,"lte":1787502209014},"protocol":["udp","sip"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":0},"sip":{"callid":["PpPXQcCdyopR0Jd34OlSst.."],"callidCnt":1,"contact":["\u003csip:16563628947@179.43.167.2:28637\u003e"],"contactCnt":1,"from":["\u003csip:16563628947@179.43.167.2\u003e;tag=6ca8e228"],"fromCnt":1,"method":["INVITE"],"methodCnt":1,"to":["\u003csip:8103908351673002@38.54.2.209:5060\u003e"],"toCnt":1,"user":["16563628947","8103908351673002"],"userCnt":2,"useragent":["Yealink W52P"],"useragentCnt":1,"via":["SIP/2.0/UDP 179.43.167.2:28637;branch=z9hG4bK-524287-1---aeed3cb4733f9d58"],"viaCnt":1},"source":{"as":{"full":"AS51852 Private Layer INC","number":51852,"organization":{"name":"Private Layer INC"}},"bytes":1057,"geo":{"country_iso_code":"CH"},"ip":"179.43.167.2","mac":["98:44:ce:60:15:19"],"mac-cnt":1,"packets":1,"port":28637},"srcOui":["Huawei Technologies Co.,Ltd"],"srcOuiCnt":1,"srcPayload8":"494e564954452073","srcRIR":"LACNIC","srcTTL":[50],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["343201292703974"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["b05640bd-eb2a-4d9d-8d73-d14d7cbeb44a"],"signatureCnt":1,"signatureId":[1071802],"signatureIdCnt":1},"tag":{"block":["false"],"blockCnt":1,"category":["protocol"],"categoryCnt":1,"description":["ip addresses with this tag have been observed sending sip traffic."],"intention":["unknown"],"intentionCnt":1,"name":["sip protocol"],"nameCnt":1},"tags":["sensor:bahrain-sponge-01-ts","bahrain-sponge-01-ts","honeypot"],"tagsCnt":3,"totDataBytes":1015} +{"@timestamp":1787500710733,"_id":"260823-FuYKRxSmHCVIFYahc1KEDHZG","_index":"arkime_sessions3-260823","client":{"bytes":1018},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo GmbH"],"isp.dstCnt":1,"isp.src":["Private Layer INC"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Private Layer Inc"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS51167 Contabo GmbH","number":51167,"organization":{"name":"Contabo GmbH"}},"bytes":0,"geo":{"country_iso_code":"FR"},"ip":"109.123.246.142","mac":["00:50:56:63:46:a6"],"mac-cnt":1,"packets":0,"port":5060},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[78363],"firstPacket":1787499965279,"ipProtocol":17,"lastPacket":1787499965279,"length":0,"network":{"bytes":1060,"community_id":"1:MTPEHW+wiEs6r4hlqmkXQljuJkc=","packets":1},"node":"spark-afae","packetPos":[-78363,831596],"packetRange":{"gte":1787499965279,"lte":1787499965279},"protocol":["udp","sip"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":0},"sip":{"callid":["boP4dhKKS9jLmaPgskvPF3.."],"callidCnt":1,"contact":["\u003csip:16299777872@179.43.167.2:28637\u003e"],"contactCnt":1,"from":["\u003csip:16299777872@179.43.167.2\u003e;tag=2e06e824"],"fromCnt":1,"method":["INVITE"],"methodCnt":1,"to":["\u003csip:8103908351673002@109.123.246.142:5060\u003e"],"toCnt":1,"user":["16299777872","8103908351673002"],"userCnt":2,"useragent":["FreePBX"],"useragentCnt":1,"via":["SIP/2.0/UDP 179.43.167.2:28637;branch=z9hG4bK-524287-1---09807af7ab6cf441"],"viaCnt":1},"source":{"as":{"full":"AS51852 Private Layer INC","number":51852,"organization":{"name":"Private Layer INC"}},"bytes":1060,"geo":{"country_iso_code":"CH"},"ip":"179.43.167.2","mac":["c0:69:11:cd:1f:19"],"mac-cnt":1,"packets":1,"port":28637},"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcPayload8":"494e564954452073","srcRIR":"LACNIC","srcTTL":[55],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["1483025503420473"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["b05640bd-eb2a-4d9d-8d73-d14d7cbeb44a"],"signatureCnt":1,"signatureId":[1071802],"signatureIdCnt":1},"tag":{"block":["false"],"blockCnt":1,"category":["protocol"],"categoryCnt":1,"description":["ip addresses with this tag have been observed sending sip traffic."],"intention":["unknown"],"intentionCnt":1,"name":["sip protocol"],"nameCnt":1},"tags":["sensor:contabo-sponge-02-ts","proxy","contabo-sponge-02-ts"],"tagsCnt":3,"totDataBytes":1018} +{"@timestamp":1787493788928,"_id":"260823-hwdxexUrZbJH9bhwRrvwVC6z","_index":"arkime_sessions3-260823","client":{"bytes":1017},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["netcup GmbH"],"isp.dstCnt":1,"isp.src":["Private Layer INC"],"isp.srcCnt":1,"org.dst":["Netcup KVM"],"org.dstCnt":1,"org.src":["Private Layer Inc"],"org.srcCnt":1,"usertype.dst":["business"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS197540 netcup GmbH","number":197540,"organization":{"name":"netcup GmbH"}},"bytes":0,"geo":{"country_iso_code":"DE"},"ip":"159.195.21.150","mac":["8a:41:d3:b8:0d:d3"],"mac-cnt":1,"packets":0,"port":5060},"dstRIR":"ARIN","ethertype":2048,"fileId":[78326],"firstPacket":1787492864625,"ipProtocol":17,"lastPacket":1787492864625,"length":0,"network":{"bytes":1059,"community_id":"1:jrUsKTKgSil/KMENbtyZEHhMXBQ=","packets":1},"node":"spark-afae","packetPos":[-78326,2994486],"packetRange":{"gte":1787492864625,"lte":1787492864625},"protocol":["udp","sip"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":0},"sip":{"callid":["alKf9MXenRhv0rofBcj6ux.."],"callidCnt":1,"contact":["\u003csip:17168465496@179.43.167.2:27272\u003e"],"contactCnt":1,"from":["\u003csip:17168465496@179.43.167.2\u003e;tag=1bb09932"],"fromCnt":1,"method":["INVITE"],"methodCnt":1,"to":["\u003csip:0003908351673002@159.195.21.150:5060\u003e"],"toCnt":1,"user":["17168465496","0003908351673002"],"userCnt":2,"useragent":["snomD765"],"useragentCnt":1,"via":["SIP/2.0/UDP 179.43.167.2:27272;branch=z9hG4bK-524287-1---d6f59ed437fdd003"],"viaCnt":1},"source":{"as":{"full":"AS51852 Private Layer INC","number":51852,"organization":{"name":"Private Layer INC"}},"bytes":1059,"geo":{"country_iso_code":"CH"},"ip":"179.43.167.2","mac":["bc:0f:fe:38:0b:a3"],"mac-cnt":1,"packets":1,"port":27272},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcPayload8":"494e564954452073","srcRIR":"LACNIC","srcTTL":[54],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["153592705797692"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["b05640bd-eb2a-4d9d-8d73-d14d7cbeb44a"],"signatureCnt":1,"signatureId":[1071802],"signatureIdCnt":1},"tag":{"block":["false"],"blockCnt":1,"category":["protocol"],"categoryCnt":1,"description":["ip addresses with this tag have been observed sending sip traffic."],"intention":["unknown"],"intentionCnt":1,"name":["sip protocol"],"nameCnt":1},"tags":["sensor:netcup-ts","netcup-ts","honeypot"],"tagsCnt":3,"totDataBytes":1017} +{"@timestamp":1787488371717,"_id":"260823-n-R7dSXjpH1C_6AvvLZ9HqVl","_index":"arkime_sessions3-260823","client":{"bytes":1021},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Kaopu Cloud HK Limited"],"isp.dstCnt":1,"isp.src":["Private Layer INC"],"isp.srcCnt":1,"org.dst":["LightNode-BH"],"org.dstCnt":1,"org.src":["Private Layer Inc"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":0,"geo":{"country_iso_code":"BH"},"ip":"38.54.2.209","mac":["52:54:8f:9d:76:48"],"mac-cnt":1,"packets":0,"port":5060},"dstRIR":"ARIN","ethertype":2048,"fileId":[78294],"firstPacket":1787487718645,"ipProtocol":17,"lastPacket":1787487718645,"length":0,"network":{"bytes":1063,"community_id":"1:fkJdTHj2U975DaBf1Um0R7B4dCU=","packets":1},"node":"spark-afae","packetPos":[-78294,1103135],"packetRange":{"gte":1787487718645,"lte":1787487718645},"protocol":["udp","sip"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":0},"sip":{"callid":["4UqGAZJF2I2o8Y0DxzKLI0.."],"callidCnt":1,"contact":["\u003csip:16563628947@179.43.167.2:27272\u003e"],"contactCnt":1,"from":["\u003csip:16563628947@179.43.167.2\u003e;tag=5d6340ee"],"fromCnt":1,"method":["INVITE"],"methodCnt":1,"to":["\u003csip:0003908351673002@38.54.2.209:5060\u003e"],"toCnt":1,"user":["16563628947","0003908351673002"],"userCnt":2,"useragent":["Cisco/SPA303-7.6.2"],"useragentCnt":1,"via":["SIP/2.0/UDP 179.43.167.2:27272;branch=z9hG4bK-524287-1---76fd40570ba2c61f"],"viaCnt":1},"source":{"as":{"full":"AS51852 Private Layer INC","number":51852,"organization":{"name":"Private Layer INC"}},"bytes":1063,"geo":{"country_iso_code":"CH"},"ip":"179.43.167.2","mac":["98:44:ce:60:15:19"],"mac-cnt":1,"packets":1,"port":27272},"srcOui":["Huawei Technologies Co.,Ltd"],"srcOuiCnt":1,"srcPayload8":"494e564954452073","srcRIR":"LACNIC","srcTTL":[50],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["1926574189609429"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["b05640bd-eb2a-4d9d-8d73-d14d7cbeb44a"],"signatureCnt":1,"signatureId":[1071802],"signatureIdCnt":1},"tag":{"block":["false"],"blockCnt":1,"category":["protocol"],"categoryCnt":1,"description":["ip addresses with this tag have been observed sending sip traffic."],"intention":["unknown"],"intentionCnt":1,"name":["sip protocol"],"nameCnt":1},"tags":["bahrain-sponge-01-ts","honeypot","sensor:bahrain-sponge-01-ts"],"tagsCnt":3,"totDataBytes":1021} +{"@timestamp":1787486568760,"_id":"260823--4984p4xGnNNtr-vLC1wBKwd","_index":"arkime_sessions3-260823","client":{"bytes":1025},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo GmbH"],"isp.dstCnt":1,"isp.src":["Private Layer INC"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Private Layer Inc"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS51167 Contabo GmbH","number":51167,"organization":{"name":"Contabo GmbH"}},"bytes":0,"geo":{"country_iso_code":"FR"},"ip":"109.123.246.142","mac":["00:50:56:63:46:a6"],"mac-cnt":1,"packets":0,"port":5060},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[78283],"firstPacket":1787485479786,"ipProtocol":17,"lastPacket":1787485479786,"length":0,"network":{"bytes":1067,"community_id":"1:cFPme/WCtCgQXbE5bKPznTcQ1GE=","packets":1},"node":"spark-afae","packetPos":[-78283,225288],"packetRange":{"gte":1787485479786,"lte":1787485479786},"protocol":["udp","sip"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":0},"sip":{"callid":["gYIEI1qOqZWRVKAtkuwLYs.."],"callidCnt":1,"contact":["\u003csip:16299777872@179.43.167.2:27272\u003e"],"contactCnt":1,"from":["\u003csip:16299777872@179.43.167.2\u003e;tag=058f579f"],"fromCnt":1,"method":["INVITE"],"methodCnt":1,"to":["\u003csip:0003908351673002@109.123.246.142:5060\u003e"],"toCnt":1,"user":["16299777872","0003908351673002"],"userCnt":2,"useragent":["Linksys SPA942"],"useragentCnt":1,"via":["SIP/2.0/UDP 179.43.167.2:27272;branch=z9hG4bK-524287-1---65776144ca88d929"],"viaCnt":1},"source":{"as":{"full":"AS51852 Private Layer INC","number":51852,"organization":{"name":"Private Layer INC"}},"bytes":1067,"geo":{"country_iso_code":"CH"},"ip":"179.43.167.2","mac":["c0:69:11:cd:1f:19"],"mac-cnt":1,"packets":1,"port":27272},"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcPayload8":"494e564954452073","srcRIR":"LACNIC","srcTTL":[55],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["2251761002148449"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["b05640bd-eb2a-4d9d-8d73-d14d7cbeb44a"],"signatureCnt":1,"signatureId":[1071802],"signatureIdCnt":1},"tag":{"block":["false"],"blockCnt":1,"category":["protocol"],"categoryCnt":1,"description":["ip addresses with this tag have been observed sending sip traffic."],"intention":["unknown"],"intentionCnt":1,"name":["sip protocol"],"nameCnt":1},"tags":["proxy","sensor:contabo-sponge-02-ts","contabo-sponge-02-ts"],"tagsCnt":3,"totDataBytes":1025} +{"@timestamp":1787479602023,"_id":"260823-fAcbDRRh9hpJUbHF8fukNzj8","_index":"arkime_sessions3-260823","client":{"bytes":1024},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["netcup GmbH"],"isp.dstCnt":1,"isp.src":["Private Layer INC"],"isp.srcCnt":1,"org.dst":["Netcup KVM"],"org.dstCnt":1,"org.src":["Private Layer Inc"],"org.srcCnt":1,"usertype.dst":["business"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS197540 netcup GmbH","number":197540,"organization":{"name":"netcup GmbH"}},"bytes":0,"geo":{"country_iso_code":"DE"},"ip":"159.195.21.150","mac":["8a:41:d3:b8:0d:d3"],"mac-cnt":1,"packets":0,"port":5060},"dstRIR":"ARIN","ethertype":2048,"fileId":[78246],"firstPacket":1787478371147,"ipProtocol":17,"lastPacket":1787478371147,"length":0,"network":{"bytes":1066,"community_id":"1:sG63/uE5yP7ylYgBE4ze382KAyA=","packets":1},"node":"spark-afae","packetPos":[-78246,378001],"packetRange":{"gte":1787478371147,"lte":1787478371147},"protocol":["udp","sip"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":0},"sip":{"callid":["sW5djJIfZKufWvtpWA0AeQ.."],"callidCnt":1,"contact":["\u003csip:17168465496@179.43.167.2:20344\u003e"],"contactCnt":1,"from":["\u003csip:17168465496@179.43.167.2\u003e;tag=fc030f58"],"fromCnt":1,"method":["INVITE"],"methodCnt":1,"to":["\u003csip:98103908351673002@159.195.21.150:5060\u003e"],"toCnt":1,"user":["98103908351673002","17168465496"],"userCnt":2,"useragent":["Cisco CP-8841"],"useragentCnt":1,"via":["SIP/2.0/UDP 179.43.167.2:20344;branch=z9hG4bK-524287-1---d14cb21ea4b45081"],"viaCnt":1},"source":{"as":{"full":"AS51852 Private Layer INC","number":51852,"organization":{"name":"Private Layer INC"}},"bytes":1066,"geo":{"country_iso_code":"CH"},"ip":"179.43.167.2","mac":["bc:0f:fe:38:0b:a3"],"mac-cnt":1,"packets":1,"port":20344},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcPayload8":"494e564954452073","srcRIR":"LACNIC","srcTTL":[54],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["916483871438286"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["b05640bd-eb2a-4d9d-8d73-d14d7cbeb44a"],"signatureCnt":1,"signatureId":[1071802],"signatureIdCnt":1},"tag":{"block":["false"],"blockCnt":1,"category":["protocol"],"categoryCnt":1,"description":["ip addresses with this tag have been observed sending sip traffic."],"intention":["unknown"],"intentionCnt":1,"name":["sip protocol"],"nameCnt":1},"tags":["netcup-ts","honeypot","sensor:netcup-ts"],"tagsCnt":3,"totDataBytes":1024} +{"@timestamp":1787475362805,"_id":"260823-_uK-ih-YJBpNBaLkJ9YuYPOr","_index":"arkime_sessions3-260823","client":{"bytes":1020},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Private Layer INC"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Private Layer Inc"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":0,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":0,"port":5060},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[78222],"firstPacket":1787474598635,"ipProtocol":17,"lastPacket":1787474598635,"length":0,"network":{"bytes":1062,"community_id":"1:hX9PDah5LpycplLjbBWZZ0i9dFE=","packets":1},"node":"spark-afae","packetPos":[-78222,18756504],"packetRange":{"gte":1787474598635,"lte":1787474598635},"protocol":["udp","sip"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":0},"sip":{"callid":["QgdpxkURuefV0hMWu9vDBw.."],"callidCnt":1,"contact":["\u003csip:16724692132@179.43.167.2:20344\u003e"],"contactCnt":1,"from":["\u003csip:16724692132@179.43.167.2\u003e;tag=af350d5d"],"fromCnt":1,"method":["INVITE"],"methodCnt":1,"to":["\u003csip:98103908351673002@217.15.163.226:5060\u003e"],"toCnt":1,"user":["98103908351673002","16724692132"],"userCnt":2,"useragent":["Fanvil X6"],"useragentCnt":1,"via":["SIP/2.0/UDP 179.43.167.2:20344;branch=z9hG4bK-524287-1---90bde41471b7cd2f"],"viaCnt":1},"source":{"as":{"full":"AS51852 Private Layer INC","number":51852,"organization":{"name":"Private Layer INC"}},"bytes":1062,"geo":{"country_iso_code":"CH"},"ip":"179.43.167.2","mac":["fc:bd:67:9d:2b:2b"],"mac-cnt":1,"packets":1,"port":20344},"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcPayload8":"494e564954452073","srcRIR":"LACNIC","srcTTL":[52],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["1883145559022551"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["b05640bd-eb2a-4d9d-8d73-d14d7cbeb44a"],"signatureCnt":1,"signatureId":[1071802],"signatureIdCnt":1},"tag":{"block":["false"],"blockCnt":1,"category":["protocol"],"categoryCnt":1,"description":["ip addresses with this tag have been observed sending sip traffic."],"intention":["unknown"],"intentionCnt":1,"name":["sip protocol"],"nameCnt":1},"tags":["sensor:contabo-sponge-01-ts","contabo-sponge-01-ts","honeypot"],"tagsCnt":3,"totDataBytes":1020} +{"@timestamp":1787472045263,"_id":"260823-544I6izZB7BOa4rETLTuRPvK","_index":"arkime_sessions3-260823","client":{"bytes":1019},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo GmbH"],"isp.dstCnt":1,"isp.src":["Private Layer INC"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Private Layer Inc"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS51167 Contabo GmbH","number":51167,"organization":{"name":"Contabo GmbH"}},"bytes":0,"geo":{"country_iso_code":"FR"},"ip":"109.123.246.142","mac":["00:50:56:63:46:a6"],"mac-cnt":1,"packets":0,"port":5060},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[78203],"firstPacket":1787470975441,"ipProtocol":17,"lastPacket":1787470975441,"length":0,"network":{"bytes":1061,"community_id":"1:4Of7+8tStB24jI+NnJJCPmm6qEk=","packets":1},"node":"spark-afae","packetPos":[-78203,14223],"packetRange":{"gte":1787470975441,"lte":1787470975441},"protocol":["udp","sip"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":0},"sip":{"callid":["avvga2l9AINvlRZLTt2Bt4.."],"callidCnt":1,"contact":["\u003csip:16299777872@179.43.167.2:20344\u003e"],"contactCnt":1,"from":["\u003csip:16299777872@179.43.167.2\u003e;tag=f825e816"],"fromCnt":1,"method":["INVITE"],"methodCnt":1,"to":["\u003csip:98103908351673002@109.123.246.142:5060\u003e"],"toCnt":1,"user":["16299777872","98103908351673002"],"userCnt":2,"useragent":["Twilio"],"useragentCnt":1,"via":["SIP/2.0/UDP 179.43.167.2:20344;branch=z9hG4bK-524287-1---186b6fc4f11b6b20"],"viaCnt":1},"source":{"as":{"full":"AS51852 Private Layer INC","number":51852,"organization":{"name":"Private Layer INC"}},"bytes":1061,"geo":{"country_iso_code":"CH"},"ip":"179.43.167.2","mac":["c0:69:11:cd:1f:19"],"mac-cnt":1,"packets":1,"port":20344},"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcPayload8":"494e564954452073","srcRIR":"LACNIC","srcTTL":[55],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["2176268649652169"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["b05640bd-eb2a-4d9d-8d73-d14d7cbeb44a"],"signatureCnt":1,"signatureId":[1071802],"signatureIdCnt":1},"tag":{"block":["false"],"blockCnt":1,"category":["protocol"],"categoryCnt":1,"description":["ip addresses with this tag have been observed sending sip traffic."],"intention":["unknown"],"intentionCnt":1,"name":["sip protocol"],"nameCnt":1},"tags":["sensor:contabo-sponge-02-ts","proxy","contabo-sponge-02-ts"],"tagsCnt":3,"totDataBytes":1019} +{"@timestamp":1787465095947,"_id":"260823-b45VpzKtKr5A8pIsgBACR7cZ","_index":"arkime_sessions3-260823","client":{"bytes":1021},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["netcup GmbH"],"isp.dstCnt":1,"isp.src":["Private Layer INC"],"isp.srcCnt":1,"org.dst":["Netcup KVM"],"org.dstCnt":1,"org.src":["Private Layer Inc"],"org.srcCnt":1,"usertype.dst":["business"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS197540 netcup GmbH","number":197540,"organization":{"name":"netcup GmbH"}},"bytes":0,"geo":{"country_iso_code":"DE"},"ip":"159.195.21.150","mac":["8a:41:d3:b8:0d:d3"],"mac-cnt":1,"packets":0,"port":5060},"dstRIR":"ARIN","ethertype":2048,"fileId":[78166],"firstPacket":1787463863429,"ipProtocol":17,"lastPacket":1787463863429,"length":0,"network":{"bytes":1063,"community_id":"1:bkMThsF4Csn959SRyhArO4dnjCA=","packets":1},"node":"spark-afae","packetPos":[-78166,78693],"packetRange":{"gte":1787463863429,"lte":1787463863429},"protocol":["udp","sip"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":0},"sip":{"callid":["vyYAiMFKBeFX6gbq8oUY5G.."],"callidCnt":1,"contact":["\u003csip:17168465496@179.43.167.2:23387\u003e"],"contactCnt":1,"from":["\u003csip:17168465496@179.43.167.2\u003e;tag=b07d775c"],"fromCnt":1,"method":["INVITE"],"methodCnt":1,"to":["\u003csip:9003908351673002@159.195.21.150:5060\u003e"],"toCnt":1,"user":["9003908351673002","17168465496"],"userCnt":2,"useragent":["Yealink W52P"],"useragentCnt":1,"via":["SIP/2.0/UDP 179.43.167.2:23387;branch=z9hG4bK-524287-1---534b11b03a4c28b2"],"viaCnt":1},"source":{"as":{"full":"AS51852 Private Layer INC","number":51852,"organization":{"name":"Private Layer INC"}},"bytes":1063,"geo":{"country_iso_code":"CH"},"ip":"179.43.167.2","mac":["bc:0f:fe:38:0b:a3"],"mac-cnt":1,"packets":1,"port":23387},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcPayload8":"494e564954452073","srcRIR":"LACNIC","srcTTL":[54],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["2125787743185204"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["b05640bd-eb2a-4d9d-8d73-d14d7cbeb44a"],"signatureCnt":1,"signatureId":[1071802],"signatureIdCnt":1},"tag":{"block":["false"],"blockCnt":1,"category":["protocol"],"categoryCnt":1,"description":["ip addresses with this tag have been observed sending sip traffic."],"intention":["unknown"],"intentionCnt":1,"name":["sip protocol"],"nameCnt":1},"tags":["sensor:netcup-ts","netcup-ts","honeypot"],"tagsCnt":3,"totDataBytes":1021} +{"@timestamp":1787460885374,"_id":"260823-JeGYMbNLqSJAyJ0eh127NPtX","_index":"arkime_sessions3-260823","client":{"bytes":1034},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Private Layer INC"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Private Layer Inc"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":0,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":0,"port":5060},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[78142],"firstPacket":1787460093004,"ipProtocol":17,"lastPacket":1787460093004,"length":0,"network":{"bytes":1076,"community_id":"1:gxtf09a+SSVghf7JwD7qZBu7deQ=","packets":1},"node":"spark-afae","packetPos":[-78142,3458590],"packetRange":{"gte":1787460093004,"lte":1787460093004},"protocol":["udp","sip"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":0},"sip":{"callid":["jGFtrr9ueIjIrUfoX98OEq.."],"callidCnt":1,"contact":["\u003csip:16724692132@179.43.167.2:23387\u003e"],"contactCnt":1,"from":["\u003csip:16724692132@179.43.167.2\u003e;tag=fe868f86"],"fromCnt":1,"method":["INVITE"],"methodCnt":1,"to":["\u003csip:9003908351673002@217.15.163.226:5060\u003e"],"toCnt":1,"user":["9003908351673002","16724692132"],"userCnt":2,"useragent":["Groundwire/4.1.1 (iPhone)"],"useragentCnt":1,"via":["SIP/2.0/UDP 179.43.167.2:23387;branch=z9hG4bK-524287-1---202f5d24e7cf3904"],"viaCnt":1},"source":{"as":{"full":"AS51852 Private Layer INC","number":51852,"organization":{"name":"Private Layer INC"}},"bytes":1076,"geo":{"country_iso_code":"CH"},"ip":"179.43.167.2","mac":["fc:bd:67:9d:2b:2b"],"mac-cnt":1,"packets":1,"port":23387},"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcPayload8":"494e564954452073","srcRIR":"LACNIC","srcTTL":[52],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["1427364544492463"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["b05640bd-eb2a-4d9d-8d73-d14d7cbeb44a"],"signatureCnt":1,"signatureId":[1071802],"signatureIdCnt":1},"tag":{"block":["false"],"blockCnt":1,"category":["protocol"],"categoryCnt":1,"description":["ip addresses with this tag have been observed sending sip traffic."],"intention":["unknown"],"intentionCnt":1,"name":["sip protocol"],"nameCnt":1},"tags":["honeypot","sensor:contabo-sponge-01-ts","contabo-sponge-01-ts"],"tagsCnt":3,"totDataBytes":1034} +{"@timestamp":1787459381801,"_id":"260823-7-BmVSdErC9B7aGPzPLMTFSp","_index":"arkime_sessions3-260823","client":{"bytes":1013},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Kaopu Cloud HK Limited"],"isp.dstCnt":1,"isp.src":["Private Layer INC"],"isp.srcCnt":1,"org.dst":["LightNode-BH"],"org.dstCnt":1,"org.src":["Private Layer Inc"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":0,"geo":{"country_iso_code":"BH"},"ip":"38.54.2.209","mac":["52:54:8f:9d:76:48"],"mac-cnt":1,"packets":0,"port":5060},"dstRIR":"ARIN","ethertype":2048,"fileId":[78134],"firstPacket":1787458716094,"ipProtocol":17,"lastPacket":1787458716094,"length":0,"network":{"bytes":1055,"community_id":"1:BPPB6He510dg1MD0v8fJXCdeePA=","packets":1},"node":"spark-afae","packetPos":[-78134,630370],"packetRange":{"gte":1787458716094,"lte":1787458716094},"protocol":["udp","sip"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":0},"sip":{"callid":["a1Ck3xrk1jz0S4ai5ycgii.."],"callidCnt":1,"contact":["\u003csip:16563628947@179.43.167.2:23387\u003e"],"contactCnt":1,"from":["\u003csip:16563628947@179.43.167.2\u003e;tag=af25a6b2"],"fromCnt":1,"method":["INVITE"],"methodCnt":1,"to":["\u003csip:9003908351673002@38.54.2.209:5060\u003e"],"toCnt":1,"user":["16563628947","9003908351673002"],"userCnt":2,"useragent":["Avaya J169"],"useragentCnt":1,"via":["SIP/2.0/UDP 179.43.167.2:23387;branch=z9hG4bK-524287-1---bd1de1904466e8d6"],"viaCnt":1},"source":{"as":{"full":"AS51852 Private Layer INC","number":51852,"organization":{"name":"Private Layer INC"}},"bytes":1055,"geo":{"country_iso_code":"CH"},"ip":"179.43.167.2","mac":["98:44:ce:60:15:19"],"mac-cnt":1,"packets":1,"port":23387},"srcOui":["Huawei Technologies Co.,Ltd"],"srcOuiCnt":1,"srcPayload8":"494e564954452073","srcRIR":"LACNIC","srcTTL":[50],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["1251584431864523"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["b05640bd-eb2a-4d9d-8d73-d14d7cbeb44a"],"signatureCnt":1,"signatureId":[1071802],"signatureIdCnt":1},"tag":{"block":["false"],"blockCnt":1,"category":["protocol"],"categoryCnt":1,"description":["ip addresses with this tag have been observed sending sip traffic."],"intention":["unknown"],"intentionCnt":1,"name":["sip protocol"],"nameCnt":1},"tags":["honeypot","bahrain-sponge-01-ts","sensor:bahrain-sponge-01-ts"],"tagsCnt":3,"totDataBytes":1013} +{"@timestamp":1787457569346,"_id":"260823-7I076Rl65YVGa5A3gckBNSU5","_index":"arkime_sessions3-260823","client":{"bytes":1021},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo GmbH"],"isp.dstCnt":1,"isp.src":["Private Layer INC"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Private Layer Inc"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS51167 Contabo GmbH","number":51167,"organization":{"name":"Contabo GmbH"}},"bytes":0,"geo":{"country_iso_code":"FR"},"ip":"109.123.246.142","mac":["00:50:56:63:46:a6"],"mac-cnt":1,"packets":0,"port":5060},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[78123],"firstPacket":1787456473372,"ipProtocol":17,"lastPacket":1787456473372,"length":0,"network":{"bytes":1063,"community_id":"1:8URTeV8ZORkSKhIqHgpBLT41ky8=","packets":1},"node":"spark-afae","packetPos":[-78123,28429],"packetRange":{"gte":1787456473372,"lte":1787456473372},"protocol":["udp","sip"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":0},"sip":{"callid":["DjfrVZjmxZsBKGmF3XO1lZ.."],"callidCnt":1,"contact":["\u003csip:16299777872@179.43.167.2:23387\u003e"],"contactCnt":1,"from":["\u003csip:16299777872@179.43.167.2\u003e;tag=4defa540"],"fromCnt":1,"method":["INVITE"],"methodCnt":1,"to":["\u003csip:9003908351673002@109.123.246.142:5060\u003e"],"toCnt":1,"user":["16299777872","9003908351673002"],"userCnt":2,"useragent":["Telnyx SIP"],"useragentCnt":1,"via":["SIP/2.0/UDP 179.43.167.2:23387;branch=z9hG4bK-524287-1---7b73ac2585004751"],"viaCnt":1},"source":{"as":{"full":"AS51852 Private Layer INC","number":51852,"organization":{"name":"Private Layer INC"}},"bytes":1063,"geo":{"country_iso_code":"CH"},"ip":"179.43.167.2","mac":["c0:69:11:cd:1f:19"],"mac-cnt":1,"packets":1,"port":23387},"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcPayload8":"494e564954452073","srcRIR":"LACNIC","srcTTL":[55],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["474541173497043"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["b05640bd-eb2a-4d9d-8d73-d14d7cbeb44a"],"signatureCnt":1,"signatureId":[1071802],"signatureIdCnt":1},"tag":{"block":["false"],"blockCnt":1,"category":["protocol"],"categoryCnt":1,"description":["ip addresses with this tag have been observed sending sip traffic."],"intention":["unknown"],"intentionCnt":1,"name":["sip protocol"],"nameCnt":1},"tags":["proxy","sensor:contabo-sponge-02-ts","contabo-sponge-02-ts"],"tagsCnt":3,"totDataBytes":1021} +{"@timestamp":1787449717113,"_id":"260823-qS7tg89oMetGY4fiWqt7Mz74","_index":"arkime_sessions3-260823","client":{"bytes":1018},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["netcup GmbH"],"isp.dstCnt":1,"isp.src":["Private Layer INC"],"isp.srcCnt":1,"org.dst":["Netcup KVM"],"org.dstCnt":1,"org.src":["Private Layer Inc"],"org.srcCnt":1,"usertype.dst":["business"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS197540 netcup GmbH","number":197540,"organization":{"name":"netcup GmbH"}},"bytes":0,"geo":{"country_iso_code":"DE"},"ip":"159.195.21.150","mac":["8a:41:d3:b8:0d:d3"],"mac-cnt":1,"packets":0,"port":5060},"dstRIR":"ARIN","ethertype":2048,"fileId":[78080],"firstPacket":1787449373649,"ipProtocol":17,"lastPacket":1787449373649,"length":0,"network":{"bytes":1060,"community_id":"1:COm1GLENSoaTSgjSSPOx7ZT4Zss=","packets":1},"node":"spark-afae","packetPos":[-78080,3519315],"packetRange":{"gte":1787449373649,"lte":1787449373649},"protocol":["udp","sip"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":0},"sip":{"callid":["5MG3Q6fL113agGy6U7voJL.."],"callidCnt":1,"contact":["\u003csip:17168465496@179.43.167.2:27778\u003e"],"contactCnt":1,"from":["\u003csip:17168465496@179.43.167.2\u003e;tag=9ff7c0c8"],"fromCnt":1,"method":["INVITE"],"methodCnt":1,"to":["\u003csip:3908351673002@159.195.21.150:5060\u003e"],"toCnt":1,"user":["3908351673002","17168465496"],"userCnt":2,"useragent":["Polycom VVX 301"],"useragentCnt":1,"via":["SIP/2.0/UDP 179.43.167.2:27778;branch=z9hG4bK-524287-1---2714313eaf3ae0f9"],"viaCnt":1},"source":{"as":{"full":"AS51852 Private Layer INC","number":51852,"organization":{"name":"Private Layer INC"}},"bytes":1060,"geo":{"country_iso_code":"CH"},"ip":"179.43.167.2","mac":["bc:0f:fe:38:0b:a3"],"mac-cnt":1,"packets":1,"port":27778},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcPayload8":"494e564954452073","srcRIR":"LACNIC","srcTTL":[54],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["1663626691475017"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["b05640bd-eb2a-4d9d-8d73-d14d7cbeb44a"],"signatureCnt":1,"signatureId":[1071802],"signatureIdCnt":1},"tag":{"block":["false"],"blockCnt":1,"category":["protocol"],"categoryCnt":1,"description":["ip addresses with this tag have been observed sending sip traffic."],"intention":["unknown"],"intentionCnt":1,"name":["sip protocol"],"nameCnt":1},"tags":["sensor:netcup-ts","netcup-ts","honeypot"],"tagsCnt":3,"totDataBytes":1018} +{"@timestamp":1787446403040,"_id":"260823-S9-UOFHc-EZE15kDpF_y2zV4","_index":"arkime_sessions3-260823","client":{"bytes":1009},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Private Layer INC"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Private Layer Inc"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":0,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":0,"port":5060},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[78061],"firstPacket":1787445613723,"ipProtocol":17,"lastPacket":1787445613723,"length":0,"network":{"bytes":1051,"community_id":"1:K2V2Jy3ubrKxxI/vMhRVO0Okqps=","packets":1},"node":"spark-afae","packetPos":[-78061,1614970],"packetRange":{"gte":1787445613723,"lte":1787445613723},"protocol":["udp","sip"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":0},"sip":{"callid":["7WFsOkjzytkWnzYcD2qNRJ.."],"callidCnt":1,"contact":["\u003csip:16724692132@179.43.167.2:27778\u003e"],"contactCnt":1,"from":["\u003csip:16724692132@179.43.167.2\u003e;tag=28461ecf"],"fromCnt":1,"method":["INVITE"],"methodCnt":1,"to":["\u003csip:3908351673002@217.15.163.226:5060\u003e"],"toCnt":1,"user":["3908351673002","16724692132"],"userCnt":2,"useragent":["Fanvil"],"useragentCnt":1,"via":["SIP/2.0/UDP 179.43.167.2:27778;branch=z9hG4bK-524287-1---891c1154cad95c36"],"viaCnt":1},"source":{"as":{"full":"AS51852 Private Layer INC","number":51852,"organization":{"name":"Private Layer INC"}},"bytes":1051,"geo":{"country_iso_code":"CH"},"ip":"179.43.167.2","mac":["fc:bd:67:9d:2b:2b"],"mac-cnt":1,"packets":1,"port":27778},"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcPayload8":"494e564954452073","srcRIR":"LACNIC","srcTTL":[52],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["1417368209197506"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["b05640bd-eb2a-4d9d-8d73-d14d7cbeb44a"],"signatureCnt":1,"signatureId":[1071802],"signatureIdCnt":1},"tag":{"block":["false"],"blockCnt":1,"category":["protocol"],"categoryCnt":1,"description":["ip addresses with this tag have been observed sending sip traffic."],"intention":["unknown"],"intentionCnt":1,"name":["sip protocol"],"nameCnt":1},"tags":["honeypot","sensor:contabo-sponge-01-ts","contabo-sponge-01-ts"],"tagsCnt":3,"totDataBytes":1009} +{"@timestamp":1787445192746,"_id":"260823-H99YhR3T6KFHyLZGoHqty9_O","_index":"arkime_sessions3-260823","client":{"bytes":1004},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Kaopu Cloud HK Limited"],"isp.dstCnt":1,"isp.src":["Private Layer INC"],"isp.srcCnt":1,"org.dst":["LightNode-BH"],"org.dstCnt":1,"org.src":["Private Layer Inc"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":0,"geo":{"country_iso_code":"BH"},"ip":"38.54.2.209","mac":["52:54:8f:9d:76:48"],"mac-cnt":1,"packets":0,"port":5060},"dstRIR":"ARIN","ethertype":2048,"fileId":[78054],"firstPacket":1787444245506,"ipProtocol":17,"lastPacket":1787444245506,"length":0,"network":{"bytes":1046,"community_id":"1:QcnPP3ffY75E7/ViClnFAo4CExw=","packets":1},"node":"spark-afae","packetPos":[-78054,702547],"packetRange":{"gte":1787444245506,"lte":1787444245506},"protocol":["udp","sip"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":0},"sip":{"callid":["l5PRcCaAOpe2UsnKW7osbW.."],"callidCnt":1,"contact":["\u003csip:16563628947@179.43.167.2:27778\u003e"],"contactCnt":1,"from":["\u003csip:16563628947@179.43.167.2\u003e;tag=e2da7078"],"fromCnt":1,"method":["INVITE"],"methodCnt":1,"to":["\u003csip:3908351673002@38.54.2.209:5060\u003e"],"toCnt":1,"user":["16563628947","3908351673002"],"userCnt":2,"useragent":["snom360"],"useragentCnt":1,"via":["SIP/2.0/UDP 179.43.167.2:27778;branch=z9hG4bK-524287-1---8fd27433178a685c"],"viaCnt":1},"source":{"as":{"full":"AS51852 Private Layer INC","number":51852,"organization":{"name":"Private Layer INC"}},"bytes":1046,"geo":{"country_iso_code":"CH"},"ip":"179.43.167.2","mac":["98:44:ce:60:15:19"],"mac-cnt":1,"packets":1,"port":27778},"srcOui":["Huawei Technologies Co.,Ltd"],"srcOuiCnt":1,"srcPayload8":"494e564954452073","srcRIR":"LACNIC","srcTTL":[50],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["1613407203178507"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["b05640bd-eb2a-4d9d-8d73-d14d7cbeb44a"],"signatureCnt":1,"signatureId":[1071802],"signatureIdCnt":1},"tag":{"block":["false"],"blockCnt":1,"category":["protocol"],"categoryCnt":1,"description":["ip addresses with this tag have been observed sending sip traffic."],"intention":["unknown"],"intentionCnt":1,"name":["sip protocol"],"nameCnt":1},"tags":["bahrain-sponge-01-ts","honeypot","sensor:bahrain-sponge-01-ts"],"tagsCnt":3,"totDataBytes":1004} diff --git a/kevlar/2026-08-31/sponge/ip-sessions/session_search_20260831T113641_4a246a7f.ndjson b/kevlar/2026-08-31/sponge/ip-sessions/session_search_20260831T113641_4a246a7f.ndjson new file mode 100644 index 0000000..5ae0c98 --- /dev/null +++ b/kevlar/2026-08-31/sponge/ip-sessions/session_search_20260831T113641_4a246a7f.ndjson @@ -0,0 +1,100 @@ +{"@timestamp":1788151895083,"_id":"260831-b8sos4_6_XJMjo9le_g3pm3q","_index":"arkime_sessions3-260831","client":{"bytes":261},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo GmbH"],"isp.dstCnt":1,"isp.src":["FlokiNET Ltd"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["FlokiNET Ltd"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS51167 Contabo GmbH","number":51167,"organization":{"name":"Contabo GmbH"}},"bytes":345,"geo":{"country_iso_code":"FR"},"ip":"109.123.246.142","mac":["00:50:56:63:46:a6"],"mac-cnt":1,"packets":5,"port":443},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstPayload8":"15030300020250","dstRIR":"RIPE","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[82288],"firstPacket":1788150641138,"initRTT":517,"ipProtocol":6,"lastPacket":1788150642298,"length":1160,"network":{"bytes":1010,"community_id":"1:/8pF2jwPkFPZBe1/ZMhuqU+QIB4=","packets":11},"node":"spark-afae","packetPos":[-82288,90774,90,180,82,343,82,89,82,0,0,0],"packetRange":{"gte":1788150641138,"lte":1788150642298},"protocol":["tcp","tls"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":7},"source":{"as":{"full":"AS200651 FlokiNET ehf","number":200651,"organization":{"name":"FlokiNET ehf"}},"bytes":665,"geo":{"country_iso_code":"RO"},"ip":"185.100.87.136","mac":["c0:69:11:cd:1f:19","00:c0:1d:c0:ff:ee"],"mac-cnt":2,"packets":6,"port":59462},"srcOui":["Arista Networks","Grand Junction Networks, Inc."],"srcOuiCnt":2,"srcPayload8":"1603010100010000","srcRIR":"RIPE","srcTTL":[49],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["311926472371616"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["ac32bdeb-b49d-4079-9e6b-8fbca5e0addf"],"signatureCnt":1,"signatureId":[1031336],"signatureIdCnt":1},"tag":{"block":["false"],"blockCnt":1,"category":["protocol"],"categoryCnt":1,"description":["ip addresses with this tag have been observed attempting to opportunistically crawl the internet and establish tls/ssl connections."],"intention":["unknown"],"intentionCnt":1,"name":["tls/ssl crawler"],"nameCnt":1},"tags":["contabo-sponge-02-ts","sensor:contabo-sponge-02-ts","proxy"],"tagsCnt":3,"tcp":{"ja4ls":"70_64_451","ja4t":["64240_2-4-8-1-3_1460_7"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":5,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":2,"psh":2,"rst":0,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":669497660},"tls":{"ja3":["7c1e207beb00684bbbe144f1b0abe1d5"],"ja3Cnt":1,"ja3string":["771,52392-52393-49199-49200-49195-49196-49171-49161-49172-49162-156-157-47-53-49170-10-4867-4865-4866,5-10-11-13-65281-16-18-43-51,29-23-24-25,0"],"ja3stringCnt":1,"ja4":["t13i1909h2_9dc949149365_97f8aa674fd9"],"ja4Cnt":1,"ja4_r":["t13i1909h2_000a,002f,0035,009c,009d,1301,1302,1303,c009,c00a,c012,c013,c014,c02b,c02c,c02f,c030,cca8,cca9_0005,000a,000b,000d,0012,002b,0033,ff01_0804,0403,0807,0805,0806,0401,0501,0601,0503,0603,0201,0203"],"ja4_rCnt":1,"srcSessionId":["5d8f6e3e84ecb3102756cc8e260f76ba5268fc5df692da9e548a2e3c0ec46765"]},"totDataBytes":268} +{"@timestamp":1788147983883,"_id":"260831-8juBStNpGqdDiK1XQCOzdUNp","_index":"arkime_sessions3-260831","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Kaopu Cloud HK Limited"],"isp.dstCnt":1,"isp.src":["FlokiNET Ltd"],"isp.srcCnt":1,"org.dst":["LightNode-BH"],"org.dstCnt":1,"org.src":["FlokiNET Ltd"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":0,"geo":{"country_iso_code":"BH"},"ip":"38.54.2.209","mac":["52:54:8f:9d:76:48"],"mac-cnt":1,"packets":0,"port":443},"dstRIR":"ARIN","ethertype":2048,"fileId":[82263],"firstPacket":1788147741756,"ipProtocol":6,"lastPacket":1788147741756,"length":0,"network":{"bytes":66,"community_id":"1:r0RGyh+rNI0g5vZSkAY7j6uxPDA=","packets":1},"node":"spark-afae","packetPos":[-82263,513221],"packetRange":{"gte":1788147741756,"lte":1788147741756},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS200651 FlokiNET ehf","number":200651,"organization":{"name":"FlokiNET ehf"}},"bytes":66,"geo":{"country_iso_code":"RO"},"ip":"185.100.87.136","mac":["98:44:ce:60:15:19"],"mac-cnt":1,"packets":1,"port":55362},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Huawei Technologies Co.,Ltd"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[52],"srcTTLCnt":1,"tags":["bahrain-sponge-01-ts","sensor:bahrain-sponge-01-ts","honeypot"],"tagsCnt":3,"tcp":{"ja4t":["65535_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":3438602577},"totDataBytes":0} +{"@timestamp":1788147976304,"_id":"260831-GMvU6zBkWOpJaaC0LrlLYIwH","_index":"arkime_sessions3-260831","client":{"bytes":261},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["FlokiNET Ltd"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["FlokiNET Ltd"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":345,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":5,"port":443},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstPayload8":"15030300020250","dstRIR":"RIPE","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[82264],"firstPacket":1788146893336,"initRTT":589,"ipProtocol":6,"lastPacket":1788146894852,"length":1516,"network":{"bytes":1084,"community_id":"1:S7cYxStXzLMVEZWmLXqg3+wNs9o=","packets":12},"node":"spark-afae","packetPos":[-82264,289955,90,2554,1772,82,343,82,89,82,0,0,0],"packetRange":{"gte":1788146893336,"lte":1788146894852},"protocol":["tls","tcp"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":7},"source":{"as":{"full":"AS200651 FlokiNET ehf","number":200651,"organization":{"name":"FlokiNET ehf"}},"bytes":739,"geo":{"country_iso_code":"RO"},"ip":"185.100.87.136","mac":["fc:bd:67:9d:2b:2b","00:c0:1d:c0:ff:ee"],"mac-cnt":2,"packets":7,"port":48942},"srcOui":["Arista Networks","Grand Junction Networks, Inc."],"srcOuiCnt":2,"srcPayload8":"1603010100010000","srcRIR":"RIPE","srcTTL":[55],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["1443912164571305"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["ac32bdeb-b49d-4079-9e6b-8fbca5e0addf"],"signatureCnt":1,"signatureId":[1031336],"signatureIdCnt":1},"tag":{"block":["false"],"blockCnt":1,"category":["protocol"],"categoryCnt":1,"description":["ip addresses with this tag have been observed attempting to opportunistically crawl the internet and establish tls/ssl connections."],"intention":["unknown"],"intentionCnt":1,"name":["tls/ssl crawler"],"nameCnt":1},"tags":["contabo-sponge-01-ts","sensor:contabo-sponge-01-ts","honeypot"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-4-8-1-3_1460_7"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":5,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":2,"psh":2,"rst":0,"srcZero":0,"syn":2,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":2999751579},"tls":{"ja3":["7c1e207beb00684bbbe144f1b0abe1d5"],"ja3Cnt":1,"ja3string":["771,52392-52393-49199-49200-49195-49196-49171-49161-49172-49162-156-157-47-53-49170-10-4867-4865-4866,5-10-11-13-65281-16-18-43-51,29-23-24-25,0"],"ja3stringCnt":1,"ja4":["t13i1909h2_9dc949149365_97f8aa674fd9"],"ja4Cnt":1,"ja4_r":["t13i1909h2_000a,002f,0035,009c,009d,1301,1302,1303,c009,c00a,c012,c013,c014,c02b,c02c,c02f,c030,cca8,cca9_0005,000a,000b,000d,0012,002b,0033,ff01_0804,0403,0807,0805,0806,0401,0501,0601,0503,0603,0201,0203"],"ja4_rCnt":1,"srcSessionId":["116fdd23cdc2eabe26270380a5ca59a24f9fc8aac1decdff8c569c0970418f83"]},"totDataBytes":268} +{"@timestamp":1788145253446,"_id":"260831-wMqgNi8v_5dAvYtvcBQ64bbK","_index":"arkime_sessions3-260831","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Hetzner Online GmbH"],"isp.dstCnt":1,"isp.src":["FlokiNET Ltd"],"isp.srcCnt":1,"org.dst":["HETZNER-DC"],"org.dstCnt":1,"org.src":["FlokiNET Ltd"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS24940 Hetzner Online GmbH","number":24940,"organization":{"name":"Hetzner Online GmbH"}},"bytes":0,"geo":{"country_iso_code":"FI"},"ip":"89.167.72.144","mac":["92:00:07:4c:82:70"],"mac-cnt":1,"packets":0,"port":443},"dstRIR":"RIPE","ethertype":2048,"fileId":[82243],"firstPacket":1788144557944,"ipProtocol":6,"lastPacket":1788144557944,"length":0,"network":{"bytes":66,"community_id":"1:WstRldGNl/Tses71qOYJq/i5Msc=","packets":1},"node":"spark-afae","packetPos":[-82243,221487],"packetRange":{"gte":1788144557944,"lte":1788144557944},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS200651 FlokiNET ehf","number":200651,"organization":{"name":"FlokiNET ehf"}},"bytes":66,"geo":{"country_iso_code":"RO"},"ip":"185.100.87.136","mac":["d2:74:7f:6e:37:e3"],"mac-cnt":1,"packets":1,"port":57465},"spoofable":["true"],"spoofableCnt":1,"srcRIR":"RIPE","srcTTL":[56],"srcTTLCnt":1,"tags":["sensor:sponge-01-ts","sponge-01-ts","honeypot"],"tagsCnt":3,"tcp":{"ja4t":["65535_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":645996698},"totDataBytes":0} +{"@timestamp":1788143740278,"_id":"260831-n8odzpCyrqxDYIE5KuKGUsmn","_index":"arkime_sessions3-260831","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo GmbH"],"isp.dstCnt":1,"isp.src":["FlokiNET Ltd"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["FlokiNET Ltd"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS51167 Contabo GmbH","number":51167,"organization":{"name":"Contabo GmbH"}},"bytes":66,"geo":{"country_iso_code":"FR"},"ip":"109.123.246.142","mac":["00:50:56:63:46:a6"],"mac-cnt":1,"packets":1,"port":443},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[82233],"firstPacket":1788143085566,"ipProtocol":6,"lastPacket":1788143086653,"length":1087,"network":{"bytes":192,"community_id":"1:EfS2EPHz57ioflRkIRbQeONlP9w=","packets":3},"node":"spark-afae","packetPos":[-82233,173103,82,164],"packetRange":{"gte":1788143085566,"lte":1788143086653},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS200651 FlokiNET ehf","number":200651,"organization":{"name":"FlokiNET ehf"}},"bytes":126,"geo":{"country_iso_code":"RO"},"ip":"185.100.87.136","mac":["c0:69:11:cd:1f:19","00:c0:1d:c0:ff:ee"],"mac-cnt":2,"packets":2,"port":34967},"srcOui":["Grand Junction Networks, Inc.","Arista Networks"],"srcOuiCnt":2,"srcRIR":"RIPE","srcTTL":[49],"srcTTLCnt":1,"tags":["proxy","sensor:contabo-sponge-02-ts","contabo-sponge-02-ts"],"tagsCnt":3,"tcp":{"ja4t":["65535_2-1-3-1-1-4_1460_8"],"ja4tCnt":1,"ja4ts":["64240_2-1-1-4-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":672423617},"totDataBytes":0} +{"@timestamp":1788142532846,"_id":"260831-LDtVIBO8Jr1Bmo8tRUqqfmhE","_index":"arkime_sessions3-260831","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["FlokiNET Ltd"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["FlokiNET Ltd"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":66,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":1,"port":443},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[82226],"firstPacket":1788141346664,"ipProtocol":6,"lastPacket":1788141347842,"length":1178,"network":{"bytes":192,"community_id":"1:X05Jfot6WybiZGSlXeYgetYpniM=","packets":3},"node":"spark-afae","packetPos":[-82226,133709,82,1798],"packetRange":{"gte":1788141346664,"lte":1788141347842},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS200651 FlokiNET ehf","number":200651,"organization":{"name":"FlokiNET ehf"}},"bytes":126,"geo":{"country_iso_code":"RO"},"ip":"185.100.87.136","mac":["fc:bd:67:9d:2b:2b","00:c0:1d:c0:ff:ee"],"mac-cnt":2,"packets":2,"port":33464},"srcOui":["Arista Networks","Grand Junction Networks, Inc."],"srcOuiCnt":2,"srcRIR":"RIPE","srcTTL":[56],"srcTTLCnt":1,"tags":["sensor:contabo-sponge-01-ts","honeypot","contabo-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["65535_2-1-3-1-1-4_1460_8"],"ja4tCnt":1,"ja4ts":["64240_2-1-1-4-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":1698696913},"totDataBytes":0} +{"@timestamp":1788140393682,"_id":"260831-Usp8AoYm2ZdHqaPNhcCdp8rI","_index":"arkime_sessions3-260831","client":{"bytes":261},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["FlokiNET Ltd"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["FlokiNET Ltd"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":441,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":5,"port":443},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstPayload8":"485454502f312e31","dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[82212],"firstPacket":1788139583711,"http":{"bodyMagic":["text/plain"],"bodyMagicCnt":1,"md5":["6196dba52703776af2e6593f772ed7ce"],"md5Cnt":1,"responseHeader":["content-type","connection"],"responseHeaderCnt":2,"responseHeaderField":["content-type","connection"],"responseHeaderValue":["text/plain; charset=utf-8","close"],"responseHeaderValueCnt":2,"serverVersion":["1.1"],"serverVersionCnt":1,"sha256":["19b843cc92cb12aa314bb3c3913b2feeb852e85969bf06cb9d096931bfda34ba"],"sha256Cnt":1,"statuscode":[400],"statuscodeCnt":1},"initRTT":607,"ipProtocol":6,"lastPacket":1788139585206,"length":1495,"network":{"bytes":1180,"community_id":"1:iUpkP9W5aHLyOWKLKP18rExpW7c=","packets":12},"node":"spark-afae","packetPos":[-82212,3740410,90,860,320,82,343,82,185,82,0,0,0],"packetRange":{"gte":1788139583711,"lte":1788139585206},"protocol":["tcp","tls","http"],"protocolCnt":3,"segmentCnt":1,"server":{"bytes":103},"source":{"as":{"full":"AS200651 FlokiNET ehf","number":200651,"organization":{"name":"FlokiNET ehf"}},"bytes":739,"geo":{"country_iso_code":"RO"},"ip":"185.100.87.136","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":7,"port":50320},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcPayload8":"1603010100010000","srcRIR":"RIPE","srcTTL":[53],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["2211464182965309"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["ac32bdeb-b49d-4079-9e6b-8fbca5e0addf"],"signatureCnt":1,"signatureId":[1031336],"signatureIdCnt":1},"tag":{"block":["false"],"blockCnt":1,"category":["protocol"],"categoryCnt":1,"description":["ip addresses with this tag have been observed attempting to opportunistically crawl the internet and establish tls/ssl connections."],"intention":["unknown"],"intentionCnt":1,"name":["tls/ssl crawler"],"nameCnt":1},"tags":["honeypot","frantech-ts","sensor:frantech-ts"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-4-8-1-3_1400_7"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":5,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":2,"psh":2,"rst":0,"srcZero":0,"syn":2,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":3120997093},"tls":{"ja3":["7c1e207beb00684bbbe144f1b0abe1d5"],"ja3Cnt":1,"ja3string":["771,52392-52393-49199-49200-49195-49196-49171-49161-49172-49162-156-157-47-53-49170-10-4867-4865-4866,5-10-11-13-65281-16-18-43-51,29-23-24-25,0"],"ja3stringCnt":1,"ja4":["t13i1909h2_9dc949149365_97f8aa674fd9"],"ja4Cnt":1,"ja4_r":["t13i1909h2_000a,002f,0035,009c,009d,1301,1302,1303,c009,c00a,c012,c013,c014,c02b,c02c,c02f,c030,cca8,cca9_0005,000a,000b,000d,0012,002b,0033,ff01_0804,0403,0807,0805,0806,0401,0501,0601,0503,0603,0201,0203"],"ja4_rCnt":1,"srcSessionId":["72da08838773043261ad10b1b9ef56a58a81a174dc7d4f3e6019feda8d545d90"]},"totDataBytes":364} +{"@timestamp":1788138586359,"_id":"260831-qDrPUkEGsN5C4pu3PHdifEV_","_index":"arkime_sessions3-260831","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["FlokiNET Ltd"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["FlokiNET Ltd"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":66,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":1,"port":443},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[82200],"firstPacket":1788137940617,"ipProtocol":6,"lastPacket":1788137941790,"length":1173,"network":{"bytes":186,"community_id":"1:lT8//AtXQuciWqv23BUfR+/3tsY=","packets":3},"node":"spark-afae","packetPos":[-82200,2311967,82,584],"packetRange":{"gte":1788137940617,"lte":1788137941790},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS200651 FlokiNET ehf","number":200651,"organization":{"name":"FlokiNET ehf"}},"bytes":120,"geo":{"country_iso_code":"RO"},"ip":"185.100.87.136","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":2,"port":37392},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[53],"srcTTLCnt":1,"tags":["honeypot","sensor:frantech-ts","frantech-ts"],"tagsCnt":3,"tcp":{"ja4t":["65535_2-1-3-1-1-4_1400_8"],"ja4tCnt":1,"ja4ts":["64240_2-1-1-4-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":2216535769},"totDataBytes":0} +{"@timestamp":1788137386515,"_id":"260831-j0RdJyVQQ9NI7pD-QNYEnlOo","_index":"arkime_sessions3-260831","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["netcup GmbH"],"isp.dstCnt":1,"isp.src":["FlokiNET Ltd"],"isp.srcCnt":1,"org.dst":["Netcup KVM"],"org.dstCnt":1,"org.src":["FlokiNET Ltd"],"org.srcCnt":1,"usertype.dst":["business"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS197540 netcup GmbH","number":197540,"organization":{"name":"netcup GmbH"}},"bytes":0,"geo":{"country_iso_code":"DE"},"ip":"159.195.21.150","mac":["8a:41:d3:b8:0d:d3"],"mac-cnt":1,"packets":0,"port":443},"dstRIR":"ARIN","ethertype":2048,"fileId":[82192],"firstPacket":1788137014257,"ipProtocol":6,"lastPacket":1788137014257,"length":0,"network":{"bytes":66,"community_id":"1:6JXV7nO2M8+Xr+nbGq9jCmhtSIw=","packets":1},"node":"spark-afae","packetPos":[-82192,415772],"packetRange":{"gte":1788137014257,"lte":1788137014257},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS200651 FlokiNET ehf","number":200651,"organization":{"name":"FlokiNET ehf"}},"bytes":66,"geo":{"country_iso_code":"RO"},"ip":"185.100.87.136","mac":["bc:0f:fe:3d:a3:a7"],"mac-cnt":1,"packets":1,"port":46854},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[53],"srcTTLCnt":1,"tags":["sensor:netcup-ts","honeypot","netcup-ts"],"tagsCnt":3,"tcp":{"ja4t":["65535_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":1824310592},"totDataBytes":0} +{"@timestamp":1787932705566,"_id":"260828-LjxoBwhXIYpBBa00Umu--72T","_index":"arkime_sessions3-260828","client":{"bytes":261},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["FlokiNET Ltd"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["FlokiNET Ltd"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":441,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":5,"port":443},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstPayload8":"485454502f312e31","dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[80820],"firstPacket":1787931973293,"http":{"bodyMagic":["text/plain"],"bodyMagicCnt":1,"md5":["6196dba52703776af2e6593f772ed7ce"],"md5Cnt":1,"responseHeader":["connection","content-type"],"responseHeaderCnt":2,"responseHeaderField":["content-type","connection"],"responseHeaderValue":["text/plain; charset=utf-8","close"],"responseHeaderValueCnt":2,"serverVersion":["1.1"],"serverVersionCnt":1,"sha256":["19b843cc92cb12aa314bb3c3913b2feeb852e85969bf06cb9d096931bfda34ba"],"sha256Cnt":1,"statuscode":[400],"statuscodeCnt":1},"initRTT":599,"ipProtocol":6,"lastPacket":1787931974771,"length":1478,"network":{"bytes":1192,"community_id":"1:XjgJKmaQcyj1xcPNijj+MO1byg8=","packets":12},"node":"spark-afae","packetPos":[-80820,5574804,90,13691,3737,82,343,82,185,4680,94,418,82],"packetRange":{"gte":1787931973293,"lte":1787931974771},"protocol":["http","tls","tcp"],"protocolCnt":3,"segmentCnt":1,"server":{"bytes":103},"source":{"as":{"full":"AS200651 FlokiNET ehf","number":200651,"organization":{"name":"FlokiNET ehf"}},"bytes":751,"geo":{"country_iso_code":"RO"},"ip":"185.100.87.136","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":7,"port":53378},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcPayload8":"1603010100010000","srcRIR":"RIPE","srcTTL":[53],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["1541417280453656"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["ac32bdeb-b49d-4079-9e6b-8fbca5e0addf"],"signatureCnt":1,"signatureId":[1031336],"signatureIdCnt":1},"tag":{"block":["false"],"blockCnt":1,"category":["protocol"],"categoryCnt":1,"description":["ip addresses with this tag have been observed attempting to opportunistically crawl the internet and establish tls/ssl connections."],"intention":["unknown"],"intentionCnt":1,"name":["tls/ssl crawler"],"nameCnt":1},"tags":["sensor:frantech-ts","honeypot","frantech-ts"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-4-8-1-3_1400_7"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":5,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":2,"psh":2,"rst":0,"srcZero":0,"syn":2,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":3878915599},"tls":{"ja3":["7c1e207beb00684bbbe144f1b0abe1d5"],"ja3Cnt":1,"ja3string":["771,52392-52393-49199-49200-49195-49196-49171-49161-49172-49162-156-157-47-53-49170-10-4867-4865-4866,5-10-11-13-65281-16-18-43-51,29-23-24-25,0"],"ja3stringCnt":1,"ja4":["t13i1909h2_9dc949149365_97f8aa674fd9"],"ja4Cnt":1,"ja4_r":["t13i1909h2_000a,002f,0035,009c,009d,1301,1302,1303,c009,c00a,c012,c013,c014,c02b,c02c,c02f,c030,cca8,cca9_0005,000a,000b,000d,0012,002b,0033,ff01_0804,0403,0807,0805,0806,0401,0501,0601,0503,0603,0201,0203"],"ja4_rCnt":1,"srcSessionId":["fd8bd6da22de1932d574a7f59752bc8fbe5090533f8b1faf31e8eb24693bc13f"]},"totDataBytes":364} +{"@timestamp":1787928466724,"_id":"260828-ebTw46KTDMxKmqhFb39CaBmA","_index":"arkime_sessions3-260828","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo GmbH"],"isp.dstCnt":1,"isp.src":["FlokiNET Ltd"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["FlokiNET Ltd"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS51167 Contabo GmbH","number":51167,"organization":{"name":"Contabo GmbH"}},"bytes":0,"geo":{"country_iso_code":"FR"},"ip":"109.123.246.142","mac":["00:50:56:63:46:a6"],"mac-cnt":1,"packets":0,"port":443},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[80790],"firstPacket":1787927815005,"ipProtocol":6,"lastPacket":1787927815005,"length":0,"network":{"bytes":66,"community_id":"1:MBWf9lyNxx5pOf7DPvj475cedEI=","packets":1},"node":"spark-afae","packetPos":[-80790,1441017],"packetRange":{"gte":1787927815005,"lte":1787927815005},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS200651 FlokiNET ehf","number":200651,"organization":{"name":"FlokiNET ehf"}},"bytes":66,"geo":{"country_iso_code":"RO"},"ip":"185.100.87.136","mac":["c0:69:11:cd:1f:19"],"mac-cnt":1,"packets":1,"port":46158},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[49],"srcTTLCnt":1,"tags":["proxy","sensor:contabo-sponge-02-ts","contabo-sponge-02-ts"],"tagsCnt":3,"tcp":{"ja4t":["65535_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":85030270},"totDataBytes":0} +{"@timestamp":1787926033629,"_id":"260828-9Bzylnv8AkNIJqDxfoRaXhZ6","_index":"arkime_sessions3-260828","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["FlokiNET Ltd"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["FlokiNET Ltd"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":66,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":1,"port":443},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[80763],"firstPacket":1787925657873,"ipProtocol":6,"lastPacket":1787925659100,"length":1227,"network":{"bytes":186,"community_id":"1:78ahmVAFioDCNMVhKEHZpmuLRoE=","packets":3},"node":"spark-afae","packetPos":[-80763,3652799,82,16489],"packetRange":{"gte":1787925657873,"lte":1787925659100},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS200651 FlokiNET ehf","number":200651,"organization":{"name":"FlokiNET ehf"}},"bytes":120,"geo":{"country_iso_code":"RO"},"ip":"185.100.87.136","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":2,"port":46668},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[52],"srcTTLCnt":1,"tags":["honeypot","frantech-ts","sensor:frantech-ts"],"tagsCnt":3,"tcp":{"ja4t":["65535_2-1-3-1-1-4_1400_8"],"ja4tCnt":1,"ja4ts":["64240_2-1-1-4-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":3068274095},"totDataBytes":0} +{"@timestamp":1787926033920,"_id":"260828-IbQR78oQM1hNtrd-Ee7glrt7","_index":"arkime_sessions3-260828","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Hetzner Online GmbH"],"isp.dstCnt":1,"isp.src":["FlokiNET Ltd"],"isp.srcCnt":1,"org.dst":["HETZNER-DC"],"org.dstCnt":1,"org.src":["FlokiNET Ltd"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS24940 Hetzner Online GmbH","number":24940,"organization":{"name":"Hetzner Online GmbH"}},"bytes":0,"geo":{"country_iso_code":"FI"},"ip":"89.167.72.144","mac":["92:00:07:4c:82:70"],"mac-cnt":1,"packets":0,"port":443},"dstRIR":"RIPE","ethertype":2048,"fileId":[80762],"firstPacket":1787925567945,"ipProtocol":6,"lastPacket":1787925567945,"length":0,"network":{"bytes":66,"community_id":"1:tcN43CdySNJ3w7+i20tfhzxBacY=","packets":1},"node":"spark-afae","packetPos":[-80762,480296],"packetRange":{"gte":1787925567945,"lte":1787925567945},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS200651 FlokiNET ehf","number":200651,"organization":{"name":"FlokiNET ehf"}},"bytes":66,"geo":{"country_iso_code":"RO"},"ip":"185.100.87.136","mac":["d2:74:7f:6e:37:e3"],"mac-cnt":1,"packets":1,"port":59742},"spoofable":["true"],"spoofableCnt":1,"srcRIR":"RIPE","srcTTL":[56],"srcTTLCnt":1,"tags":["sensor:sponge-01-ts","honeypot","sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["65535_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":1136315664},"totDataBytes":0} +{"@timestamp":1787927609778,"_id":"260828-4Tui9Oom8yxGAKkyV_HYT-od","_index":"arkime_sessions3-260828","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["netcup GmbH"],"isp.dstCnt":1,"isp.src":["FlokiNET Ltd"],"isp.srcCnt":1,"org.dst":["Netcup KVM"],"org.dstCnt":1,"org.src":["FlokiNET Ltd"],"org.srcCnt":1,"usertype.dst":["business"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS197540 netcup GmbH","number":197540,"organization":{"name":"netcup GmbH"}},"bytes":0,"geo":{"country_iso_code":"DE"},"ip":"159.195.21.150","mac":["8a:41:d3:b8:0d:d3"],"mac-cnt":1,"packets":0,"port":443},"dstRIR":"ARIN","ethertype":2048,"fileId":[80781],"firstPacket":1787922391017,"ipProtocol":6,"lastPacket":1787922391017,"length":0,"network":{"bytes":66,"community_id":"1:++nXVRJLE1LovamCNcL3lVuwGWY=","packets":1},"node":"spark-afae","packetPos":[-80781,1350518634],"packetRange":{"gte":1787922391017,"lte":1787922391017},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS200651 FlokiNET ehf","number":200651,"organization":{"name":"FlokiNET ehf"}},"bytes":66,"geo":{"country_iso_code":"RO"},"ip":"185.100.87.136","mac":["bc:0f:fe:3d:a3:a7"],"mac-cnt":1,"packets":1,"port":37179},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[53],"srcTTLCnt":1,"tags":["sensor:netcup-ts","netcup-ts","honeypot"],"tagsCnt":3,"tcp":{"ja4t":["65535_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":3906101889},"totDataBytes":0} +{"@timestamp":1787920296924,"_id":"260828-JBxxZpaJUgRLF4v9yvNca1Mu","_index":"arkime_sessions3-260828","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Kaopu Cloud HK Limited"],"isp.dstCnt":1,"isp.src":["FlokiNET Ltd"],"isp.srcCnt":1,"org.dst":["LightNode-BH"],"org.dstCnt":1,"org.src":["FlokiNET Ltd"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":0,"geo":{"country_iso_code":"BH"},"ip":"38.54.2.209","mac":["52:54:8f:9d:76:48"],"mac-cnt":1,"packets":0,"port":443},"dstRIR":"ARIN","ethertype":2048,"fileId":[80727],"firstPacket":1787919343199,"ipProtocol":6,"lastPacket":1787919343199,"length":0,"network":{"bytes":66,"community_id":"1:YZVrI3J3fu0kNTHAiXdHvCLibTw=","packets":1},"node":"spark-afae","packetPos":[-80727,510024],"packetRange":{"gte":1787919343199,"lte":1787919343199},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS200651 FlokiNET ehf","number":200651,"organization":{"name":"FlokiNET ehf"}},"bytes":66,"geo":{"country_iso_code":"RO"},"ip":"185.100.87.136","mac":["98:44:ce:60:15:19"],"mac-cnt":1,"packets":1,"port":54462},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Huawei Technologies Co.,Ltd"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[52],"srcTTLCnt":1,"tags":["honeypot","bahrain-sponge-01-ts","sensor:bahrain-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["65535_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":843146114},"totDataBytes":0} +{"@timestamp":1787920296653,"_id":"260828-s7PDi8Gr0vlOEpnzfHF9GwIr","_index":"arkime_sessions3-260828","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["FlokiNET Ltd"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["FlokiNET Ltd"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":0,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":0,"port":443},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[80726],"firstPacket":1787919154493,"ipProtocol":6,"lastPacket":1787919154493,"length":0,"network":{"bytes":66,"community_id":"1:okc/hQIMZRKfQ21H9d2676u5QAU=","packets":1},"node":"spark-afae","packetPos":[-80726,489660],"packetRange":{"gte":1787919154493,"lte":1787919154493},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS200651 FlokiNET ehf","number":200651,"organization":{"name":"FlokiNET ehf"}},"bytes":66,"geo":{"country_iso_code":"RO"},"ip":"185.100.87.136","mac":["fc:bd:67:9d:2b:2b"],"mac-cnt":1,"packets":1,"port":60420},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[55],"srcTTLCnt":1,"tags":["contabo-sponge-01-ts","honeypot","sensor:contabo-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["65535_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":4119850335},"totDataBytes":0} +{"@timestamp":1787696078629,"_id":"260825-OaGLMUoFZd5AubrWZr0lyyxy","_index":"arkime_sessions3-260825","client":{"bytes":1046},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo GmbH"],"isp.dstCnt":1,"isp.src":["FlokiNET Ltd"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["FlokiNET Ltd"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS51167 Contabo GmbH","number":51167,"organization":{"name":"Contabo GmbH"}},"bytes":1440,"geo":{"country_iso_code":"FR"},"ip":"109.123.246.142","mac":["00:50:56:63:46:a6"],"mac-cnt":1,"packets":10,"port":22},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstPayload8":"5353482d312e3939","dstRIR":"RIPE","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[79448],"firstPacket":1787695597495,"initRTT":15,"ipProtocol":6,"lastPacket":1787695597744,"length":249,"network":{"bytes":3088,"community_id":"1:1YQK630+aS5olPbDHRwUIT9Lcq8=","packets":19},"node":"spark-afae","packetPos":[-79448,948569,90,0,82,104,82,102,370,82,946,82,226,82,530,98,0,82,0,0],"packetRange":{"gte":1787695597495,"lte":1787695597744},"protocol":["tcp","ssh"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":772},"source":{"as":{"full":"AS200651 FlokiNET ehf","number":200651,"organization":{"name":"FlokiNET ehf"}},"bytes":1648,"geo":{"country_iso_code":"RO"},"ip":"185.100.87.136","mac":["c0:69:11:cd:1f:19","00:c0:1d:c0:ff:ee"],"mac-cnt":2,"packets":9,"port":41202},"srcOui":["Arista Networks","Grand Junction Networks, Inc."],"srcOuiCnt":2,"srcPayload8":"5353482d322e302d","srcRIR":"RIPE","srcTTL":[49],"srcTTLCnt":1,"ssh":{"hassh":["e54ef3ec27fe1fea7ab64d3fa05359fd"],"hasshCnt":1,"hasshServer":["e24f4545013804fcb86089ffc93a0539"],"hasshServerCnt":1,"ja4ssh":["c16s16_c4s4_c3s4"],"ja4sshCnt":1,"version":["ssh-2.0-openssh_10.1","ssh-1.99-cisco-1.25"],"versionCnt":2},"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["1565936703231496"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["537cee16-c4a9-45cd-baf1-75963ab7bdd2","GPL ATTACK SSH Connection Attempt"],"signatureCnt":2,"signatureId":[1080086,1000010],"signatureIdCnt":2},"tag":{"block":["true"],"blockCnt":1,"category":["activity"],"categoryCnt":1,"description":["ip addresses with this tag have been observed attempting to negotiate an ssh session."],"intention":["suspicious"],"intentionCnt":1,"name":["ssh connection attempt"],"nameCnt":1},"tags":["sensor:contabo-sponge-02-ts","proxy","contabo-sponge-02-ts"],"tagsCnt":3,"tcp":{"ja4l":"15749_49_15616","ja4ls":"186_64_36168","ja4t":["64240_2-4-8-1-3_1460_7"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":7,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":2,"psh":8,"rst":0,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":421439747},"totDataBytes":1818} +{"@timestamp":1787677323195,"_id":"260825-C_1RLXUyipRPx45cpb-d-Pae","_index":"arkime_sessions3-260825","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo GmbH"],"isp.dstCnt":1,"isp.src":["FlokiNET Ltd"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["FlokiNET Ltd"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS51167 Contabo GmbH","number":51167,"organization":{"name":"Contabo GmbH"}},"bytes":66,"geo":{"country_iso_code":"FR"},"ip":"109.123.246.142","mac":["00:50:56:63:46:a6"],"mac-cnt":1,"packets":1,"port":22},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[79344],"firstPacket":1787676981065,"ipProtocol":6,"lastPacket":1787676981100,"length":35,"network":{"bytes":192,"community_id":"1:aJHm3UA7W0Q1ztigOK682r0wVek=","packets":3},"node":"spark-afae","packetPos":[-79344,994931,82,0],"packetRange":{"gte":1787676981065,"lte":1787676981100},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS200651 FlokiNET ehf","number":200651,"organization":{"name":"FlokiNET ehf"}},"bytes":126,"geo":{"country_iso_code":"RO"},"ip":"185.100.87.136","mac":["c0:69:11:cd:1f:19","00:c0:1d:c0:ff:ee"],"mac-cnt":2,"packets":2,"port":53802},"srcOui":["Arista Networks","Grand Junction Networks, Inc."],"srcOuiCnt":2,"srcRIR":"RIPE","srcTTL":[49],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["1407704947676888"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["GPL ATTACK SSH Connection Attempt"],"signatureCnt":1,"signatureId":[1000010],"signatureIdCnt":1},"tags":["proxy","sensor:contabo-sponge-02-ts","contabo-sponge-02-ts"],"tagsCnt":3,"tcp":{"ja4t":["65535_2-1-3-1-1-4_1460_8"],"ja4tCnt":1,"ja4ts":["64240_2-1-1-4-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":4107802518},"totDataBytes":0} +{"@timestamp":1787675214885,"_id":"260825-yfysvTQ2XI5Lz4UnAM7eEvgx","_index":"arkime_sessions3-260825","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Kaopu Cloud HK Limited"],"isp.dstCnt":1,"isp.src":["FlokiNET Ltd"],"isp.srcCnt":1,"org.dst":["LightNode-BH"],"org.dstCnt":1,"org.src":["FlokiNET Ltd"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":74,"geo":{"country_iso_code":"BH"},"ip":"38.54.2.209","mac":["52:54:8f:9d:76:48"],"mac-cnt":1,"packets":1,"port":22},"dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[79333],"firstPacket":1787674706967,"ipProtocol":6,"lastPacket":1787674714059,"length":7092,"network":{"bytes":370,"community_id":"1:m0AGzx10e/qkD6BPsgMOohYc8WE=","packets":5},"node":"spark-afae","packetPos":[-79333,3430013,90,983,2779,2092],"packetRange":{"gte":1787674706967,"lte":1787674714059},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS200651 FlokiNET ehf","number":200651,"organization":{"name":"FlokiNET ehf"}},"bytes":296,"geo":{"country_iso_code":"RO"},"ip":"185.100.87.136","mac":["98:44:ce:60:15:19"],"mac-cnt":1,"packets":4,"port":39992},"srcOui":["Huawei Technologies Co.,Ltd"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[51],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["778178320338725"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["GPL ATTACK SSH Connection Attempt"],"signatureCnt":1,"signatureId":[1000010],"signatureIdCnt":1},"tags":["honeypot","bahrain-sponge-01-ts","sensor:bahrain-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-4-8-1-3_1460_7"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":4,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":3779311209},"totDataBytes":0} +{"@timestamp":1787674915836,"_id":"260825-gp9ppIRphh9FWZpA3YeFw3gu","_index":"arkime_sessions3-260825","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["FlokiNET Ltd"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["FlokiNET Ltd"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":66,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":1,"port":22},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[79331],"firstPacket":1787674195889,"ipProtocol":6,"lastPacket":1787674195889,"length":0,"network":{"bytes":132,"community_id":"1:LXa6hGgP/DV4+wbrSZdqk5lVDWE=","packets":2},"node":"spark-afae","packetPos":[-79331,977508,82],"packetRange":{"gte":1787674195889,"lte":1787674195889},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS200651 FlokiNET ehf","number":200651,"organization":{"name":"FlokiNET ehf"}},"bytes":66,"geo":{"country_iso_code":"RO"},"ip":"185.100.87.136","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":1,"port":53684},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[53],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["1007192092678105"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["GPL ATTACK SSH Connection Attempt"],"signatureCnt":1,"signatureId":[1000010],"signatureIdCnt":1},"tags":["frantech-ts","honeypot","sensor:frantech-ts"],"tagsCnt":3,"tcp":{"ja4t":["65535_2-1-3-1-1-4_1400_8"],"ja4tCnt":1,"ja4ts":["64240_2-1-1-4-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":2718085108},"totDataBytes":0} +{"@timestamp":1787673111262,"_id":"260825-Vp-bg_K2pLNPJ4oX0ObmlcTt","_index":"arkime_sessions3-260825","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["netcup GmbH"],"isp.dstCnt":1,"isp.src":["FlokiNET Ltd"],"isp.srcCnt":1,"org.dst":["Netcup KVM"],"org.dstCnt":1,"org.src":["FlokiNET Ltd"],"org.srcCnt":1,"usertype.dst":["business"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS197540 netcup GmbH","number":197540,"organization":{"name":"netcup GmbH"}},"bytes":74,"geo":{"country_iso_code":"DE"},"ip":"159.195.21.150","mac":["8a:41:d3:b8:0d:d3"],"mac-cnt":1,"packets":1,"port":22},"dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[79320],"firstPacket":1787671987786,"ipProtocol":6,"lastPacket":1787671994901,"length":7115,"network":{"bytes":370,"community_id":"1:JwyCkQPYEPRFlzIkhH3mj6KmjHY=","packets":5},"node":"spark-afae","packetPos":[-79320,5703487,90,1732,2144,3832],"packetRange":{"gte":1787671987786,"lte":1787671994901},"protocol":["tcp"],"protocolCnt":1,"rootId":"260825-Vp-bg_K2pLNPJ4oX0ObmlcTt","segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS200651 FlokiNET ehf","number":200651,"organization":{"name":"FlokiNET ehf"}},"bytes":296,"geo":{"country_iso_code":"RO"},"ip":"185.100.87.136","mac":["bc:0f:fe:3d:a3:a7","00:00:5e:00:01:96"],"mac-cnt":2,"packets":4,"port":46918},"srcOui":["ICANN, IANA Department","Juniper Networks"],"srcOuiCnt":2,"srcRIR":"RIPE","srcTTL":[53],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["846235979792841"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["GPL ATTACK SSH Connection Attempt"],"signatureCnt":1,"signatureId":[1000010],"signatureIdCnt":1},"tags":["honeypot","sensor:netcup-ts","netcup-ts"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-4-8-1-3_1460_7"],"ja4tCnt":1,"ja4ts":["43440_2-4-8-1-3_1460_11"],"ja4tsCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":4,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":3800702334},"totDataBytes":0} +{"@timestamp":1787672211441,"_id":"260825-W_xnHMJGGodNGqbUIcQJGwUf","_index":"arkime_sessions3-260825","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["FlokiNET Ltd"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["FlokiNET Ltd"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":66,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":1,"port":22},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[79316],"firstPacket":1787671517658,"ipProtocol":6,"lastPacket":1787671517658,"length":0,"network":{"bytes":132,"community_id":"1:CfMj85SspCJY0ZSxoAVZMUsRyGM=","packets":2},"node":"spark-afae","packetPos":[-79316,1519613,82],"packetRange":{"gte":1787671517658,"lte":1787671517658},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS200651 FlokiNET ehf","number":200651,"organization":{"name":"FlokiNET ehf"}},"bytes":66,"geo":{"country_iso_code":"RO"},"ip":"185.100.87.136","mac":["fc:bd:67:9d:2b:2b","00:c0:1d:c0:ff:ee"],"mac-cnt":2,"packets":1,"port":42788},"srcOui":["Arista Networks","Grand Junction Networks, Inc."],"srcOuiCnt":2,"srcRIR":"RIPE","srcTTL":[55],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["1422430686929253"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["GPL ATTACK SSH Connection Attempt"],"signatureCnt":1,"signatureId":[1000010],"signatureIdCnt":1},"tags":["sensor:contabo-sponge-01-ts","contabo-sponge-01-ts","honeypot"],"tagsCnt":3,"tcp":{"ja4t":["65535_2-1-3-1-1-4_1460_8"],"ja4tCnt":1,"ja4ts":["64240_2-1-1-4-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":3122990401},"totDataBytes":0} +{"@timestamp":1787671002118,"_id":"260825-L_wsU-Zk8jxAJYaQC0no8kVn","_index":"arkime_sessions3-260825","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Kaopu Cloud HK Limited"],"isp.dstCnt":1,"isp.src":["FlokiNET Ltd"],"isp.srcCnt":1,"org.dst":["LightNode-BH"],"org.dstCnt":1,"org.src":["FlokiNET Ltd"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":66,"geo":{"country_iso_code":"BH"},"ip":"38.54.2.209","mac":["52:54:8f:9d:76:48"],"mac-cnt":1,"packets":1,"port":22},"dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[79310],"firstPacket":1787669811788,"ipProtocol":6,"lastPacket":1787669812908,"length":1120,"network":{"bytes":186,"community_id":"1:8NEncjtqmEcJv0e6zSFz2swKiJg=","packets":3},"node":"spark-afae","packetPos":[-79310,312785,82,1908],"packetRange":{"gte":1787669811788,"lte":1787669812908},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS200651 FlokiNET ehf","number":200651,"organization":{"name":"FlokiNET ehf"}},"bytes":120,"geo":{"country_iso_code":"RO"},"ip":"185.100.87.136","mac":["98:44:ce:60:15:19"],"mac-cnt":1,"packets":2,"port":33232},"srcOui":["Huawei Technologies Co.,Ltd"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[51],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["853099268669534"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["GPL ATTACK SSH Connection Attempt"],"signatureCnt":1,"signatureId":[1000010],"signatureIdCnt":1},"tags":["honeypot","bahrain-sponge-01-ts","sensor:bahrain-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["65535_2-1-3-1-1-4_1460_8"],"ja4tCnt":1,"ja4ts":["64240_2-1-1-4-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":3072372477},"totDataBytes":0} +{"@timestamp":1787669483647,"_id":"260825-CZ-pI-vAQeRAxoCRrAYqykg0","_index":"arkime_sessions3-260825","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["netcup GmbH"],"isp.dstCnt":1,"isp.src":["FlokiNET Ltd"],"isp.srcCnt":1,"org.dst":["Netcup KVM"],"org.dstCnt":1,"org.src":["FlokiNET Ltd"],"org.srcCnt":1,"usertype.dst":["business"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS197540 netcup GmbH","number":197540,"organization":{"name":"netcup GmbH"}},"bytes":66,"geo":{"country_iso_code":"DE"},"ip":"159.195.21.150","mac":["8a:41:d3:b8:0d:d3"],"mac-cnt":1,"packets":1,"port":22},"dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[79300],"firstPacket":1787668814565,"ipProtocol":6,"lastPacket":1787668815626,"length":1061,"network":{"bytes":188,"community_id":"1:7sKsVqykPA/Vp8FW/p0bQzKZseQ=","packets":3},"node":"spark-afae","packetPos":[-79300,2673103,82,672],"packetRange":{"gte":1787668814565,"lte":1787668815626},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS200651 FlokiNET ehf","number":200651,"organization":{"name":"FlokiNET ehf"}},"bytes":122,"geo":{"country_iso_code":"RO"},"ip":"185.100.87.136","mac":["00:00:5e:00:01:96","bc:0f:fe:3d:a3:a7"],"mac-cnt":2,"packets":2,"port":58431},"srcOui":["ICANN, IANA Department","Juniper Networks"],"srcOuiCnt":2,"srcRIR":"RIPE","srcTTL":[53],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["1865678559926482"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["GPL ATTACK SSH Connection Attempt"],"signatureCnt":1,"signatureId":[1000010],"signatureIdCnt":1},"tags":["netcup-ts","honeypot","sensor:netcup-ts"],"tagsCnt":3,"tcp":{"ja4t":["65535_2-1-3-1-1-4_1460_8"],"ja4tCnt":1,"ja4ts":["42340_2-1-1-4-1-3_1460_11"],"ja4tsCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":3184888463},"totDataBytes":0} +{"@timestamp":1787657089993,"_id":"260825-Wvpnx4-_HehF77NR8p5n5s2q","_index":"arkime_sessions3-260825","client":{"bytes":215},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["FlokiNET Ltd"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["FlokiNET Ltd"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":625,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":5,"port":8443},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstPayload8":"485454502f312e31","dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[79232],"firstPacket":1787655967394,"http":{"bodyMagic":["application/json","text/html"],"bodyMagicCnt":2,"clientVersion":["1.1"],"clientVersionCnt":1,"host":["209.141.62.110","209.141.62.110:8443"],"hostCnt":2,"ja4h":["po11nn050000_928c23def140_000000000000_000000000000"],"ja4hCnt":1,"ja4h_r":["po11nn050000_Host,User-Agent,Content-Length,Cache-Control,Content-Type__"],"ja4h_rCnt":1,"md5":["7defa9fa40b1688dbb6420272b7aed25","0f87454a3ea15f0db55ae928dbcd82fc"],"md5Cnt":2,"method":["POST"],"method-POST":1,"methodCnt":1,"path":["/api/checkin"],"pathCnt":1,"request-cache-control":["no-cache"],"request-cache-controlCnt":1,"requestBody":["{\"hostname\":\"WIN-DESKTOP\"}"],"requestHeader":["cache-control","content-type","user-agent","content-length","host"],"requestHeaderCnt":5,"requestHeaderField":["content-length","content-type"],"requestHeaderValue":["26","application/json"],"requestHeaderValueCnt":2,"response-server":["Apache/2.4.41 (Ubuntu)"],"response-serverCnt":1,"response-x-powered-by":["PHP/7.4.3"],"response-x-powered-byCnt":1,"responseHeader":["server","connection","content-type","x-powered-by","date","content-length"],"responseHeaderCnt":6,"responseHeaderField":["connection","content-type","date","content-length"],"responseHeaderValue":["close","text/plain; charset=utf-8","tue, 25 aug 2026 11:06:09 gmt","94"],"responseHeaderValueCnt":4,"serverVersion":["1.1"],"serverVersionCnt":1,"sha256":["1ca624415b2889dbeb3f969890b848b7bc5eaf96ca5e8fdd7461f943b45d10cb","f95e5c5b12e743a1aa81c56d21d0886d82cec995621db3d71070a63f3d1c19bf"],"sha256Cnt":2,"statuscode":[200],"statuscodeCnt":1,"uri":["209.141.62.110:8443/api/checkin"],"uriCnt":1,"useragent":["Mozilla/5.0 (Windows NT 10.0; Win64; x64)"],"useragentCnt":1},"initRTT":1115,"ipProtocol":6,"lastPacket":1787655969789,"length":2395,"network":{"bytes":1252,"community_id":"1:qMcEl09YqoMbj4cByv8j4vCRj9A=","packets":11},"node":"spark-afae","packetPos":[-79232,238632,90,446,884,82,297,82,369,82,0,0],"packetRange":{"gte":1787655967394,"lte":1787655969789},"protocol":["tcp","http"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":287},"source":{"as":{"full":"AS200651 FlokiNET ehf","number":200651,"organization":{"name":"FlokiNET ehf"}},"bytes":627,"geo":{"country_iso_code":"RO"},"ip":"185.100.87.136","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":6,"port":55424},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcPayload8":"504f5354202f6170","srcRIR":"RIPE","srcTTL":[52],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["1973814252816668"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["869feaa1-dc77-4037-aee2-247b7a39cf7d","f00e21c3-4bf0-42eb-947f-491086bc0093"],"signatureCnt":2,"signatureId":[1031486,1083150],"signatureIdCnt":2},"tag":{"block":["false","true"],"blockCnt":2,"category":["protocol","activity"],"categoryCnt":2,"description":["ip addresses with this tag have been seen crawling http(s) servers around the internet.","ip addresses with this tag have been observed attempting to send linux commands commonly seen in exploits and proofs of concept (such as whoami, nohup, netcat, etc.)."],"intention":["unknown","suspicious"],"intentionCnt":2,"name":["web crawler","generic suspicious linux command in request"],"nameCnt":2},"tags":["honeypot","frantech-ts","sensor:frantech-ts"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-4-8-1-3_1400_7"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":4,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":2,"psh":2,"rst":0,"srcZero":0,"syn":2,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":1653504548},"totDataBytes":502} +{"@timestamp":1787657089992,"_id":"260825-Wvqo54YLiMpH4ZRTZCy378BB","_index":"arkime_sessions3-260825","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["FlokiNET Ltd"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["FlokiNET Ltd"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":66,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":1,"port":8443},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[79232],"firstPacket":1787655966201,"ipProtocol":6,"lastPacket":1787655967384,"length":1183,"network":{"bytes":186,"community_id":"1:ULbRXanUY+yZxWb9g1oZjFe/kSA=","packets":3},"node":"spark-afae","packetPos":[-79232,237236,82,1244],"packetRange":{"gte":1787655966201,"lte":1787655967384},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS200651 FlokiNET ehf","number":200651,"organization":{"name":"FlokiNET ehf"}},"bytes":120,"geo":{"country_iso_code":"RO"},"ip":"185.100.87.136","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":2,"port":55350},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[53],"srcTTLCnt":1,"tags":["honeypot","frantech-ts","sensor:frantech-ts"],"tagsCnt":3,"tcp":{"ja4t":["65535_2-1-3-1-1-4_1400_8"],"ja4tCnt":1,"ja4ts":["64240_2-1-1-4-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":986111929},"totDataBytes":0} +{"@timestamp":1787655580434,"_id":"260825-4Z2JzXnStttDMKX7OcJ3aVqD","_index":"arkime_sessions3-260825","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo GmbH"],"isp.dstCnt":1,"isp.src":["FlokiNET Ltd"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["FlokiNET Ltd"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS51167 Contabo GmbH","number":51167,"organization":{"name":"Contabo GmbH"}},"bytes":0,"geo":{"country_iso_code":"FR"},"ip":"109.123.246.142","mac":["00:50:56:63:46:a6"],"mac-cnt":1,"packets":0,"port":8443},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[79223],"firstPacket":1787655108643,"ipProtocol":6,"lastPacket":1787655108643,"length":0,"network":{"bytes":66,"community_id":"1:ZD6mqkIKN6Dtt9QMHBZ1pnwu4qE=","packets":1},"node":"spark-afae","packetPos":[-79223,1035056],"packetRange":{"gte":1787655108643,"lte":1787655108643},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS200651 FlokiNET ehf","number":200651,"organization":{"name":"FlokiNET ehf"}},"bytes":66,"geo":{"country_iso_code":"RO"},"ip":"185.100.87.136","mac":["c0:69:11:cd:1f:19"],"mac-cnt":1,"packets":1,"port":57690},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[49],"srcTTLCnt":1,"tags":["proxy","contabo-sponge-02-ts","sensor:contabo-sponge-02-ts"],"tagsCnt":3,"tcp":{"ja4t":["65535_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":707054047},"totDataBytes":0} +{"@timestamp":1787654974653,"_id":"260825-Dfq5Qn_emjpO7aMnZ_yhmLPn","_index":"arkime_sessions3-260825","client":{"bytes":215},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["FlokiNET Ltd"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["FlokiNET Ltd"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":625,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":5,"port":8443},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstPayload8":"485454502f312e31","dstRIR":"RIPE","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[79221],"firstPacket":1787653904451,"http":{"bodyMagic":["application/json","text/html"],"bodyMagicCnt":2,"clientVersion":["1.1"],"clientVersionCnt":1,"host":["217.15.163.226","217.15.163.226:8443"],"hostCnt":2,"ja4h":["po11nn050000_928c23def140_000000000000_000000000000"],"ja4hCnt":1,"ja4h_r":["po11nn050000_Host,User-Agent,Content-Length,Cache-Control,Content-Type__"],"ja4h_rCnt":1,"md5":["0f87454a3ea15f0db55ae928dbcd82fc","7defa9fa40b1688dbb6420272b7aed25"],"md5Cnt":2,"method":["POST"],"method-POST":1,"methodCnt":1,"path":["/api/checkin"],"pathCnt":1,"request-cache-control":["no-cache"],"request-cache-controlCnt":1,"requestBody":["{\"hostname\":\"WIN-DESKTOP\"}"],"requestHeader":["content-type","user-agent","content-length","cache-control","host"],"requestHeaderCnt":5,"requestHeaderField":["content-length","content-type"],"requestHeaderValue":["26","application/json"],"requestHeaderValueCnt":2,"response-server":["Apache/2.4.41 (Ubuntu)"],"response-serverCnt":1,"response-x-powered-by":["PHP/7.4.3"],"response-x-powered-byCnt":1,"responseHeader":["content-type","server","x-powered-by","content-length","connection","date"],"responseHeaderCnt":6,"responseHeaderField":["connection","content-type","date","content-length"],"responseHeaderValue":["close","text/plain; charset=utf-8","tue, 25 aug 2026 10:31:45 gmt","94"],"responseHeaderValueCnt":4,"serverVersion":["1.1"],"serverVersionCnt":1,"sha256":["f95e5c5b12e743a1aa81c56d21d0886d82cec995621db3d71070a63f3d1c19bf","1ca624415b2889dbeb3f969890b848b7bc5eaf96ca5e8fdd7461f943b45d10cb"],"sha256Cnt":2,"statuscode":[200],"statuscodeCnt":1,"uri":["217.15.163.226:8443/api/checkin"],"uriCnt":1,"useragent":["Mozilla/5.0 (Windows NT 10.0; Win64; x64)"],"useragentCnt":1},"initRTT":610,"ipProtocol":6,"lastPacket":1787653905849,"length":1398,"network":{"bytes":1252,"community_id":"1:KrXzKo4RSRliTXYv91Ms2FQgOfE=","packets":11},"node":"spark-afae","packetPos":[-79221,2753,90,4000,416,82,297,82,369,434,82,0],"packetRange":{"gte":1787653904451,"lte":1787653905849},"protocol":["tcp","http"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":287},"source":{"as":{"full":"AS200651 FlokiNET ehf","number":200651,"organization":{"name":"FlokiNET ehf"}},"bytes":627,"geo":{"country_iso_code":"RO"},"ip":"185.100.87.136","mac":["fc:bd:67:9d:2b:2b","00:c0:1d:c0:ff:ee"],"mac-cnt":2,"packets":6,"port":45726},"srcOui":["Arista Networks","Grand Junction Networks, Inc."],"srcOuiCnt":2,"srcPayload8":"504f5354202f6170","srcRIR":"RIPE","srcTTL":[56],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["250698275706549"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["869feaa1-dc77-4037-aee2-247b7a39cf7d","f00e21c3-4bf0-42eb-947f-491086bc0093"],"signatureCnt":2,"signatureId":[1031486,1083150],"signatureIdCnt":2},"tag":{"block":["false","true"],"blockCnt":2,"category":["protocol","activity"],"categoryCnt":2,"description":["ip addresses with this tag have been observed attempting to send linux commands commonly seen in exploits and proofs of concept (such as whoami, nohup, netcat, etc.).","ip addresses with this tag have been seen crawling http(s) servers around the internet."],"intention":["suspicious","unknown"],"intentionCnt":2,"name":["web crawler","generic suspicious linux command in request"],"nameCnt":2},"tags":["contabo-sponge-01-ts","sensor:contabo-sponge-01-ts","honeypot"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-4-8-1-3_1460_7"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":4,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":2,"psh":2,"rst":0,"srcZero":0,"syn":2,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":4226106946},"totDataBytes":502} +{"@timestamp":1787654974652,"_id":"260825-Dfpv6iyWZp5O8qi0Ed3No75H","_index":"arkime_sessions3-260825","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["FlokiNET Ltd"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["FlokiNET Ltd"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":66,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":1,"port":8443},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[79221],"firstPacket":1787653904224,"ipProtocol":6,"lastPacket":1787653904400,"length":176,"network":{"bytes":126,"community_id":"1:84Kmpwyq1t0Y3JvA9SDE79AjIII=","packets":2},"node":"spark-afae","packetPos":[-79221,2263,324],"packetRange":{"gte":1787653904224,"lte":1787653904400},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS200651 FlokiNET ehf","number":200651,"organization":{"name":"FlokiNET ehf"}},"bytes":60,"geo":{"country_iso_code":"RO"},"ip":"185.100.87.136","mac":["fc:bd:67:9d:2b:2b","00:c0:1d:c0:ff:ee"],"mac-cnt":2,"packets":1,"port":55239},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Arista Networks","Grand Junction Networks, Inc."],"srcOuiCnt":2,"srcRIR":"RIPE","srcTTL":[55],"srcTTLCnt":1,"tags":["contabo-sponge-01-ts","sensor:contabo-sponge-01-ts","honeypot"],"tagsCnt":3,"tcp":{"ja4ts":["64240_2-1-1-4-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":1,"srcZero":0,"syn":0,"syn-ack":1,"urg":0},"tcpseq":{"dst":2218113135},"totDataBytes":0} +{"@timestamp":1787654075733,"_id":"260825-7Pl597OpLr9JNpRJ60a7-fBV","_index":"arkime_sessions3-260825","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["FlokiNET Ltd"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["FlokiNET Ltd"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":66,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":1,"port":8443},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[79216],"firstPacket":1787653901149,"ipProtocol":6,"lastPacket":1787653901149,"length":0,"network":{"bytes":132,"community_id":"1:84Kmpwyq1t0Y3JvA9SDE79AjIII=","packets":2},"node":"spark-afae","packetPos":[-79216,3621344,82],"packetRange":{"gte":1787653901149,"lte":1787653901149},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS200651 FlokiNET ehf","number":200651,"organization":{"name":"FlokiNET ehf"}},"bytes":66,"geo":{"country_iso_code":"RO"},"ip":"185.100.87.136","mac":["fc:bd:67:9d:2b:2b","00:c0:1d:c0:ff:ee"],"mac-cnt":2,"packets":1,"port":55239},"srcOui":["Arista Networks","Grand Junction Networks, Inc."],"srcOuiCnt":2,"srcRIR":"RIPE","srcTTL":[55],"srcTTLCnt":1,"tags":["contabo-sponge-01-ts","sensor:contabo-sponge-01-ts","honeypot"],"tagsCnt":3,"tcp":{"ja4t":["65535_2-1-3-1-1-4_1460_8"],"ja4tCnt":1,"ja4ts":["64240_2-1-1-4-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":2317390842},"totDataBytes":0} +{"@timestamp":1787652271589,"_id":"260825-iZ3i7uoRtLBIObngSRYAxrOs","_index":"arkime_sessions3-260825","client":{"bytes":215},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["netcup GmbH"],"isp.dstCnt":1,"isp.src":["FlokiNET Ltd"],"isp.srcCnt":1,"org.dst":["Netcup KVM"],"org.dstCnt":1,"org.src":["FlokiNET Ltd"],"org.srcCnt":1,"usertype.dst":["business"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS197540 netcup GmbH","number":197540,"organization":{"name":"netcup GmbH"}},"bytes":384,"geo":{"country_iso_code":"DE"},"ip":"159.195.21.150","mac":["8a:41:d3:b8:0d:d3"],"mac-cnt":1,"packets":4,"port":8443},"dstPayload8":"485454502f312e31","dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[79205],"firstPacket":1787651164917,"http":{"bodyMagic":["application/json"],"bodyMagicCnt":1,"clientVersion":["1.1"],"clientVersionCnt":1,"host":["159.195.21.150:8443","159.195.21.150"],"hostCnt":2,"ja4h":["po11nn050000_928c23def140_000000000000_000000000000"],"ja4hCnt":1,"ja4h_r":["po11nn050000_Host,User-Agent,Content-Length,Cache-Control,Content-Type__"],"ja4h_rCnt":1,"md5":["7defa9fa40b1688dbb6420272b7aed25"],"md5Cnt":1,"method":["POST"],"method-POST":1,"methodCnt":1,"path":["/api/checkin"],"pathCnt":1,"request-cache-control":["no-cache"],"request-cache-controlCnt":1,"requestBody":["{\"hostname\":\"WIN-DESKTOP\"}"],"requestHeader":["host","content-type","content-length","cache-control","user-agent"],"requestHeaderCnt":5,"requestHeaderField":["content-length","content-type"],"requestHeaderValue":["26","application/json"],"requestHeaderValueCnt":2,"response-server":["SonicWall SMA 10.2.0.9-12sv"],"response-serverCnt":1,"responseHeader":["content-length","server","date"],"responseHeaderCnt":3,"responseHeaderField":["date","content-length"],"responseHeaderValue":["tue, 25 aug 2026 09:46:05 gmt","0"],"responseHeaderValueCnt":2,"serverVersion":["1.1"],"serverVersionCnt":1,"sha256":["f95e5c5b12e743a1aa81c56d21d0886d82cec995621db3d71070a63f3d1c19bf"],"sha256Cnt":1,"statuscode":[200],"statuscodeCnt":1,"uri":["159.195.21.150:8443/api/checkin"],"uriCnt":1,"useragent":["Mozilla/5.0 (Windows NT 10.0; Win64; x64)"],"useragentCnt":1},"initRTT":522,"ipProtocol":6,"lastPacket":1787651166025,"length":1108,"network":{"bytes":1003,"community_id":"1:8JuKPUzI1CbcY8av2qWyzx2RU74=","packets":10},"node":"spark-afae","packetPos":[-79205,154307,90,736,82,297,82,194,82,0,0],"packetRange":{"gte":1787651164917,"lte":1787651166025},"protocol":["tcp","http"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":112},"source":{"as":{"full":"AS200651 FlokiNET ehf","number":200651,"organization":{"name":"FlokiNET ehf"}},"bytes":619,"geo":{"country_iso_code":"RO"},"ip":"185.100.87.136","mac":["bc:0f:fe:3d:a3:a7","00:00:5e:00:01:96"],"mac-cnt":2,"packets":6,"port":53554},"srcOui":["Juniper Networks","ICANN, IANA Department"],"srcOuiCnt":2,"srcPayload8":"504f5354202f6170","srcRIR":"RIPE","srcTTL":[53],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["1127900911151644"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["869feaa1-dc77-4037-aee2-247b7a39cf7d","f00e21c3-4bf0-42eb-947f-491086bc0093"],"signatureCnt":2,"signatureId":[1031486,1083150],"signatureIdCnt":2},"tag":{"block":["false","true"],"blockCnt":2,"category":["activity","protocol"],"categoryCnt":2,"description":["ip addresses with this tag have been seen crawling http(s) servers around the internet.","ip addresses with this tag have been observed attempting to send linux commands commonly seen in exploits and proofs of concept (such as whoami, nohup, netcat, etc.)."],"intention":["suspicious","unknown"],"intentionCnt":2,"name":["web crawler","generic suspicious linux command in request"],"nameCnt":2},"tags":["sensor:netcup-ts","honeypot","netcup-ts"],"tagsCnt":3,"tcp":{"ja4ls":"42_64_tcp","ja4t":["64240_2-4-8-1-3_1460_7"],"ja4tCnt":1,"ja4ts":["43440_2-4-8-1-3_1460_11"],"ja4tsCnt":1},"tcpflags":{"ack":4,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":2,"psh":2,"rst":0,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":1617113931},"totDataBytes":327} +{"@timestamp":1787652271589,"_id":"260825-iZ1UIlff3U1DpJCXr4pPgU6y","_index":"arkime_sessions3-260825","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["netcup GmbH"],"isp.dstCnt":1,"isp.src":["FlokiNET Ltd"],"isp.srcCnt":1,"org.dst":["Netcup KVM"],"org.dstCnt":1,"org.src":["FlokiNET Ltd"],"org.srcCnt":1,"usertype.dst":["business"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS197540 netcup GmbH","number":197540,"organization":{"name":"netcup GmbH"}},"bytes":66,"geo":{"country_iso_code":"DE"},"ip":"159.195.21.150","mac":["8a:41:d3:b8:0d:d3"],"mac-cnt":1,"packets":1,"port":8443},"dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[79205],"firstPacket":1787651163819,"ipProtocol":6,"lastPacket":1787651164874,"length":1055,"network":{"bytes":188,"community_id":"1:f0XidMZ4pfa6EI6sN0hPIIurCzI=","packets":3},"node":"spark-afae","packetPos":[-79205,152771,82,1204],"packetRange":{"gte":1787651163819,"lte":1787651164874},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS200651 FlokiNET ehf","number":200651,"organization":{"name":"FlokiNET ehf"}},"bytes":122,"geo":{"country_iso_code":"RO"},"ip":"185.100.87.136","mac":["bc:0f:fe:3d:a3:a7","00:00:5e:00:01:96"],"mac-cnt":2,"packets":2,"port":50411},"srcOui":["Juniper Networks","ICANN, IANA Department"],"srcOuiCnt":2,"srcRIR":"RIPE","srcTTL":[53],"srcTTLCnt":1,"tags":["sensor:netcup-ts","honeypot","netcup-ts"],"tagsCnt":3,"tcp":{"ja4t":["65535_2-1-3-1-1-4_1460_8"],"ja4tCnt":1,"ja4ts":["42340_2-1-1-4-1-3_1460_11"],"ja4tsCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":3804982830},"totDataBytes":0} +{"@timestamp":1787648932644,"_id":"260825-PflS7Ya9GrNLAYf34-H3E-31","_index":"arkime_sessions3-260825","client":{"bytes":212},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Kaopu Cloud HK Limited"],"isp.dstCnt":1,"isp.src":["FlokiNET Ltd"],"isp.srcCnt":1,"org.dst":["LightNode-BH"],"org.dstCnt":1,"org.src":["FlokiNET Ltd"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":625,"geo":{"country_iso_code":"BH"},"ip":"38.54.2.209","mac":["52:54:8f:9d:76:48"],"mac-cnt":1,"packets":5,"port":8443},"dstPayload8":"485454502f312e31","dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[79185],"firstPacket":1787648581924,"http":{"bodyMagic":["text/html","application/json"],"bodyMagicCnt":2,"clientVersion":["1.1"],"clientVersionCnt":1,"host":["38.54.2.209:8443","38.54.2.209"],"hostCnt":2,"ja4h":["po11nn050000_928c23def140_000000000000_000000000000"],"ja4hCnt":1,"ja4h_r":["po11nn050000_Host,User-Agent,Content-Length,Cache-Control,Content-Type__"],"ja4h_rCnt":1,"md5":["7defa9fa40b1688dbb6420272b7aed25","0f87454a3ea15f0db55ae928dbcd82fc"],"md5Cnt":2,"method":["POST"],"method-POST":1,"methodCnt":1,"path":["/api/checkin"],"pathCnt":1,"request-cache-control":["no-cache"],"request-cache-controlCnt":1,"requestBody":["{\"hostname\":\"WIN-DESKTOP\"}"],"requestHeader":["content-type","content-length","user-agent","cache-control","host"],"requestHeaderCnt":5,"requestHeaderField":["content-length","content-type"],"requestHeaderValue":["26","application/json"],"requestHeaderValueCnt":2,"response-server":["Apache/2.4.41 (Ubuntu)"],"response-serverCnt":1,"response-x-powered-by":["PHP/7.4.3"],"response-x-powered-byCnt":1,"responseHeader":["content-type","server","content-length","x-powered-by","connection","date"],"responseHeaderCnt":6,"responseHeaderField":["connection","content-type","date","content-length"],"responseHeaderValue":["close","text/plain; charset=utf-8","tue, 25 aug 2026 09:03:03 gmt","94"],"responseHeaderValueCnt":4,"serverVersion":["1.1"],"serverVersionCnt":1,"sha256":["f95e5c5b12e743a1aa81c56d21d0886d82cec995621db3d71070a63f3d1c19bf","1ca624415b2889dbeb3f969890b848b7bc5eaf96ca5e8fdd7461f943b45d10cb"],"sha256Cnt":2,"statuscode":[200],"statuscodeCnt":1,"uri":["38.54.2.209:8443/api/checkin"],"uriCnt":1,"useragent":["Mozilla/5.0 (Windows NT 10.0; Win64; x64)"],"useragentCnt":1},"initRTT":564,"ipProtocol":6,"lastPacket":1787648583170,"length":1246,"network":{"bytes":1249,"community_id":"1:AAPagcaEkWSpEIcNwsQTHJTPMCc=","packets":11},"node":"spark-afae","packetPos":[-79185,1258356,90,1518,262,82,294,82,369,262,82,0],"packetRange":{"gte":1787648581924,"lte":1787648583170},"protocol":["tcp","http"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":287},"source":{"as":{"full":"AS200651 FlokiNET ehf","number":200651,"organization":{"name":"FlokiNET ehf"}},"bytes":624,"geo":{"country_iso_code":"RO"},"ip":"185.100.87.136","mac":["98:44:ce:60:15:19"],"mac-cnt":1,"packets":6,"port":52780},"srcOui":["Huawei Technologies Co.,Ltd"],"srcOuiCnt":1,"srcPayload8":"504f5354202f6170","srcRIR":"RIPE","srcTTL":[52],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["1438186099111504"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["869feaa1-dc77-4037-aee2-247b7a39cf7d","f00e21c3-4bf0-42eb-947f-491086bc0093"],"signatureCnt":2,"signatureId":[1031486,1083150],"signatureIdCnt":2},"tag":{"block":["false","true"],"blockCnt":2,"category":["activity","protocol"],"categoryCnt":2,"description":["ip addresses with this tag have been seen crawling http(s) servers around the internet.","ip addresses with this tag have been observed attempting to send linux commands commonly seen in exploits and proofs of concept (such as whoami, nohup, netcat, etc.)."],"intention":["suspicious","unknown"],"intentionCnt":2,"name":["web crawler","generic suspicious linux command in request"],"nameCnt":2},"tags":["bahrain-sponge-01-ts","honeypot","sensor:bahrain-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-4-8-1-3_1460_7"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":4,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":2,"psh":2,"rst":0,"srcZero":0,"syn":2,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":998693233},"totDataBytes":499} +{"@timestamp":1787648932590,"_id":"260825-Pfnt89xsnAtN4Lk6wvqTBowg","_index":"arkime_sessions3-260825","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Kaopu Cloud HK Limited"],"isp.dstCnt":1,"isp.src":["FlokiNET Ltd"],"isp.srcCnt":1,"org.dst":["LightNode-BH"],"org.dstCnt":1,"org.src":["FlokiNET Ltd"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":66,"geo":{"country_iso_code":"BH"},"ip":"38.54.2.209","mac":["52:54:8f:9d:76:48"],"mac-cnt":1,"packets":1,"port":8443},"dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[79185],"firstPacket":1787648580759,"ipProtocol":6,"lastPacket":1787648581900,"length":1141,"network":{"bytes":186,"community_id":"1:Iuk2j2LQGB+8WOMCGDNO/F9LVlw=","packets":3},"node":"spark-afae","packetPos":[-79185,1253709,82,4495],"packetRange":{"gte":1787648580759,"lte":1787648581900},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS200651 FlokiNET ehf","number":200651,"organization":{"name":"FlokiNET ehf"}},"bytes":120,"geo":{"country_iso_code":"RO"},"ip":"185.100.87.136","mac":["98:44:ce:60:15:19"],"mac-cnt":1,"packets":2,"port":39434},"srcOui":["Huawei Technologies Co.,Ltd"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[52],"srcTTLCnt":1,"tags":["bahrain-sponge-01-ts","honeypot","sensor:bahrain-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["65535_2-1-3-1-1-4_1460_8"],"ja4tCnt":1,"ja4ts":["64240_2-1-1-4-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":843891774},"totDataBytes":0} +{"@timestamp":1787601549150,"_id":"260824-8_ITWyVj_7JLyY2eumAsL3Ks","_index":"arkime_sessions3-260824","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo GmbH"],"isp.dstCnt":1,"isp.src":["FlokiNET Ltd"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["FlokiNET Ltd"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS51167 Contabo GmbH","number":51167,"organization":{"name":"Contabo GmbH"}},"bytes":0,"geo":{"country_iso_code":"FR"},"ip":"109.123.246.142","mac":["00:50:56:63:46:a6"],"mac-cnt":1,"packets":0,"port":2222},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[78923],"firstPacket":1787600976915,"ipProtocol":6,"lastPacket":1787600976915,"length":0,"network":{"bytes":66,"community_id":"1:mjuIGJO2TZ41pCmY7obUFWHPxjs=","packets":1},"node":"spark-afae","packetPos":[-78923,445441],"packetRange":{"gte":1787600976915,"lte":1787600976915},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS200651 FlokiNET ehf","number":200651,"organization":{"name":"FlokiNET ehf"}},"bytes":66,"geo":{"country_iso_code":"RO"},"ip":"185.100.87.136","mac":["c0:69:11:cd:1f:19"],"mac-cnt":1,"packets":1,"port":33685},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[49],"srcTTLCnt":1,"tags":["sensor:contabo-sponge-02-ts","proxy","contabo-sponge-02-ts"],"tagsCnt":3,"tcp":{"ja4t":["65535_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":1808621043},"totDataBytes":0} +{"@timestamp":1787595532994,"_id":"260824-3JhxSPusil1JcrsweK91cMZr","_index":"arkime_sessions3-260824","client":{"bytes":952},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["netcup GmbH"],"isp.dstCnt":1,"isp.src":["FlokiNET Ltd"],"isp.srcCnt":1,"org.dst":["Netcup KVM"],"org.dstCnt":1,"org.src":["FlokiNET Ltd"],"org.srcCnt":1,"usertype.dst":["business"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS197540 netcup GmbH","number":197540,"organization":{"name":"netcup GmbH"}},"bytes":1572,"geo":{"country_iso_code":"DE"},"ip":"159.195.21.150","mac":["8a:41:d3:b8:0d:d3"],"mac-cnt":1,"packets":9,"port":2222},"dstPayload8":"5353482d322e302d","dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[78889],"firstPacket":1787595237087,"initRTT":517,"ipProtocol":6,"lastPacket":1787595238450,"length":1363,"network":{"bytes":3200,"community_id":"1:wBZv3rx47s98sY1TSNvcL4TBu6M=","packets":19},"node":"spark-afae","packetPos":[-78889,4021067,90,2648,764,82,106,2925,296,82,802,946,82,130,82,274,278,98,82,164],"packetRange":{"gte":1787595237087,"lte":1787595238450},"protocol":["ssh","tcp"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":970},"source":{"as":{"full":"AS200651 FlokiNET ehf","number":200651,"organization":{"name":"FlokiNET ehf"}},"bytes":1628,"geo":{"country_iso_code":"RO"},"ip":"185.100.87.136","mac":["bc:0f:fe:3d:a3:a7","00:00:5e:00:01:96"],"mac-cnt":2,"packets":10,"port":51608},"srcOui":["ICANN, IANA Department","Juniper Networks"],"srcOuiCnt":2,"srcPayload8":"5353482d322e302d","srcRIR":"RIPE","srcTTL":[53],"srcTTLCnt":1,"ssh":{"hassh":["e54ef3ec27fe1fea7ab64d3fa05359fd"],"hasshCnt":1,"hasshServer":["41a85c886a9e9b845f0e69d68994492a"],"hasshServerCnt":1,"ja4ssh":["c16s16_c4s4_c3s3"],"ja4sshCnt":1,"version":["ssh-2.0-openssh_9.6p1 ubuntu-3ubuntu13.5","ssh-2.0-openssh_10.2p1"],"versionCnt":2},"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["1501560102561150"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["537cee16-c4a9-45cd-baf1-75963ab7bdd2","b1859b91-92d5-48d2-b43d-bbfd09db964d"],"signatureCnt":2,"signatureId":[1080086,1031283],"signatureIdCnt":2},"tag":{"block":["true"],"blockCnt":1,"category":["activity"],"categoryCnt":1,"description":["ip addresses with this tag have been observed crawling the internet for ssh servers running on ports other than 22/tcp.","ip addresses with this tag have been observed attempting to negotiate an ssh session."],"intention":["suspicious"],"intentionCnt":1,"name":["ssh alternative port crawler","ssh connection attempt"],"nameCnt":2},"tags":["honeypot","netcup-ts","sensor:netcup-ts"],"tagsCnt":3,"tcp":{"ja4l":"517770_53_15742","ja4t":["64240_2-4-8-1-3_1460_7"],"ja4tCnt":1,"ja4ts":["43440_2-4-8-1-3_1460_11"],"ja4tsCnt":1},"tcpflags":{"ack":6,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":2,"psh":8,"rst":0,"srcZero":0,"syn":2,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":1930145605},"totDataBytes":1922} +{"@timestamp":1787595532965,"_id":"260824-3JhHdXkRRdVDIpKGYPHCDzEY","_index":"arkime_sessions3-260824","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["netcup GmbH"],"isp.dstCnt":1,"isp.src":["FlokiNET Ltd"],"isp.srcCnt":1,"org.dst":["Netcup KVM"],"org.dstCnt":1,"org.src":["FlokiNET Ltd"],"org.srcCnt":1,"usertype.dst":["business"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS197540 netcup GmbH","number":197540,"organization":{"name":"netcup GmbH"}},"bytes":66,"geo":{"country_iso_code":"DE"},"ip":"159.195.21.150","mac":["8a:41:d3:b8:0d:d3"],"mac-cnt":1,"packets":1,"port":2222},"dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[78889],"firstPacket":1787595235949,"ipProtocol":6,"lastPacket":1787595237002,"length":1053,"network":{"bytes":188,"community_id":"1:Av/gcha36ZmwdMvAaWrTXqEKwoY=","packets":3},"node":"spark-afae","packetPos":[-78889,4017659,82,3164],"packetRange":{"gte":1787595235949,"lte":1787595237002},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS200651 FlokiNET ehf","number":200651,"organization":{"name":"FlokiNET ehf"}},"bytes":122,"geo":{"country_iso_code":"RO"},"ip":"185.100.87.136","mac":["bc:0f:fe:3d:a3:a7","00:00:5e:00:01:96"],"mac-cnt":2,"packets":2,"port":43624},"srcOui":["ICANN, IANA Department","Juniper Networks"],"srcOuiCnt":2,"srcRIR":"RIPE","srcTTL":[53],"srcTTLCnt":1,"tags":["honeypot","netcup-ts","sensor:netcup-ts"],"tagsCnt":3,"tcp":{"ja4t":["65535_2-1-3-1-1-4_1460_8"],"ja4tCnt":1,"ja4ts":["42340_2-1-1-4-1-3_1460_11"],"ja4tsCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":3975408297},"totDataBytes":0} +{"@timestamp":1787595833040,"_id":"260824-NvJVJzxbvsNAELyYXDmreZkk","_index":"arkime_sessions3-260824","client":{"bytes":952},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["FlokiNET Ltd"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["FlokiNET Ltd"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":1572,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":9,"port":2222},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstPayload8":"5353482d322e302d","dstRIR":"RIPE","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[78891],"firstPacket":1787594536933,"initRTT":599,"ipProtocol":6,"lastPacket":1787594538843,"length":1910,"network":{"bytes":3200,"community_id":"1:lCiOeVpAWHktteIxk6FlopYyyo8=","packets":19},"node":"spark-afae","packetPos":[-78891,316720,90,2262,1418,82,106,1665,206,82,802,946,172,130,82,274,506,98,82,164],"packetRange":{"gte":1787594536933,"lte":1787594538843},"protocol":["ssh","tcp"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":970},"source":{"as":{"full":"AS200651 FlokiNET ehf","number":200651,"organization":{"name":"FlokiNET ehf"}},"bytes":1628,"geo":{"country_iso_code":"RO"},"ip":"185.100.87.136","mac":["fc:bd:67:9d:2b:2b","00:c0:1d:c0:ff:ee"],"mac-cnt":2,"packets":10,"port":40412},"srcOui":["Grand Junction Networks, Inc.","Arista Networks"],"srcOuiCnt":2,"srcPayload8":"5353482d322e302d","srcRIR":"RIPE","srcTTL":[55],"srcTTLCnt":1,"ssh":{"hassh":["e54ef3ec27fe1fea7ab64d3fa05359fd"],"hasshCnt":1,"hasshServer":["41a85c886a9e9b845f0e69d68994492a"],"hasshServerCnt":1,"ja4ssh":["c16s16_c4s4_c3s3"],"ja4sshCnt":1,"version":["ssh-2.0-openssh_9.6p1 ubuntu-3ubuntu13.5","ssh-2.0-openssh_10.2p1"],"versionCnt":2},"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["67425741031979"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["537cee16-c4a9-45cd-baf1-75963ab7bdd2","b1859b91-92d5-48d2-b43d-bbfd09db964d"],"signatureCnt":2,"signatureId":[1080086,1031283],"signatureIdCnt":2},"tag":{"block":["true"],"blockCnt":1,"category":["activity"],"categoryCnt":1,"description":["ip addresses with this tag have been observed attempting to negotiate an ssh session.","ip addresses with this tag have been observed crawling the internet for ssh servers running on ports other than 22/tcp."],"intention":["suspicious"],"intentionCnt":1,"name":["ssh alternative port crawler","ssh connection attempt"],"nameCnt":2},"tags":["honeypot","contabo-sponge-01-ts","sensor:contabo-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4l":"598637_55_87399","ja4t":["64240_2-4-8-1-3_1460_7"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":6,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":2,"psh":8,"rst":0,"srcZero":0,"syn":2,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":491842575},"totDataBytes":1922} +{"@timestamp":1787595833040,"_id":"260824-NvLF1fabgXxJb4EDvEqIxawJ","_index":"arkime_sessions3-260824","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["FlokiNET Ltd"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["FlokiNET Ltd"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":66,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":1,"port":2222},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[78891],"firstPacket":1787594535735,"ipProtocol":6,"lastPacket":1787594536910,"length":1175,"network":{"bytes":192,"community_id":"1:7+qrkEfJeMXtxN1xQUOkKdSO3HE=","packets":3},"node":"spark-afae","packetPos":[-78891,310692,82,5870],"packetRange":{"gte":1787594535735,"lte":1787594536910},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS200651 FlokiNET ehf","number":200651,"organization":{"name":"FlokiNET ehf"}},"bytes":126,"geo":{"country_iso_code":"RO"},"ip":"185.100.87.136","mac":["fc:bd:67:9d:2b:2b","00:c0:1d:c0:ff:ee"],"mac-cnt":2,"packets":2,"port":60298},"srcOui":["Grand Junction Networks, Inc.","Arista Networks"],"srcOuiCnt":2,"srcRIR":"RIPE","srcTTL":[55],"srcTTLCnt":1,"tags":["honeypot","contabo-sponge-01-ts","sensor:contabo-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["65535_2-1-3-1-1-4_1460_8"],"ja4tCnt":1,"ja4ts":["64240_2-1-1-4-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":2340123840},"totDataBytes":0} +{"@timestamp":1787594933256,"_id":"260824-0ZiSW7oXgNlEcLAbPy9Xn4AA","_index":"arkime_sessions3-260824","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["FlokiNET Ltd"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["FlokiNET Ltd"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":66,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":1,"port":2222},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[78886],"firstPacket":1787594447960,"ipProtocol":6,"lastPacket":1787594447960,"length":0,"network":{"bytes":132,"community_id":"1:wnyOwbqyEnmnrJojTtO7nEXeUV0=","packets":2},"node":"spark-afae","packetPos":[-78886,6727312,82],"packetRange":{"gte":1787594447960,"lte":1787594447960},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS200651 FlokiNET ehf","number":200651,"organization":{"name":"FlokiNET ehf"}},"bytes":66,"geo":{"country_iso_code":"RO"},"ip":"185.100.87.136","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":1,"port":52900},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[52],"srcTTLCnt":1,"tags":["frantech-ts","honeypot","sensor:frantech-ts"],"tagsCnt":3,"tcp":{"ja4t":["65535_2-1-3-1-1-4_1400_8"],"ja4tCnt":1,"ja4ts":["64240_2-1-1-4-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":2086775818},"totDataBytes":0} +{"@timestamp":1787584972718,"_id":"260824-zvDgn2cLAkdP148xysBnOrhn","_index":"arkime_sessions3-260824","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["FlokiNET Ltd"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["FlokiNET Ltd"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":74,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":1,"port":443},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[78831],"firstPacket":1787584079567,"ipProtocol":6,"lastPacket":1787584082661,"length":3094,"network":{"bytes":296,"community_id":"1:K30lE/P6p7sAcHktouxYQIRctfo=","packets":4},"node":"spark-afae","packetPos":[-78831,1500815,90,5042,6539],"packetRange":{"gte":1787584079567,"lte":1787584082661},"protocol":["tcp"],"protocolCnt":1,"rootId":"260824-zvDgn2cLAkdP148xysBnOrhn","segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS200651 FlokiNET ehf","number":200651,"organization":{"name":"FlokiNET ehf"}},"bytes":222,"geo":{"country_iso_code":"RO"},"ip":"185.100.87.136","mac":["fc:bd:67:9d:2b:2b","00:c0:1d:c0:ff:ee"],"mac-cnt":2,"packets":3,"port":53472},"srcOui":["Arista Networks","Grand Junction Networks, Inc."],"srcOuiCnt":2,"srcRIR":"RIPE","srcTTL":[55],"srcTTLCnt":1,"tags":["sensor:contabo-sponge-01-ts","honeypot","contabo-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-4-8-1-3_1460_7"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":3,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":3613994254},"totDataBytes":0} +{"@timestamp":1787584972718,"_id":"260824-zvCXnfYm6fJF0aWgRuAfAtQ2","_index":"arkime_sessions3-260824","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["FlokiNET Ltd"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["FlokiNET Ltd"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":74,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":1,"port":443},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[78831],"firstPacket":1787584074567,"ipProtocol":6,"lastPacket":1787584077668,"length":3101,"network":{"bytes":296,"community_id":"1:+d/m0Wv+Aiq5ZO3MeMO+by6nEDY=","packets":4},"node":"spark-afae","packetPos":[-78831,1482765,90,6474,3918],"packetRange":{"gte":1787584074567,"lte":1787584077668},"protocol":["tcp"],"protocolCnt":1,"rootId":"260824-zvCXnfYm6fJF0aWgRuAfAtQ2","segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS200651 FlokiNET ehf","number":200651,"organization":{"name":"FlokiNET ehf"}},"bytes":222,"geo":{"country_iso_code":"RO"},"ip":"185.100.87.136","mac":["fc:bd:67:9d:2b:2b","00:c0:1d:c0:ff:ee"],"mac-cnt":2,"packets":3,"port":53458},"srcOui":["Arista Networks","Grand Junction Networks, Inc."],"srcOuiCnt":2,"srcRIR":"RIPE","srcTTL":[55],"srcTTLCnt":1,"tags":["sensor:contabo-sponge-01-ts","honeypot","contabo-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-4-8-1-3_1460_7"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":3,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":2884413915},"totDataBytes":0} +{"@timestamp":1787582557952,"_id":"260824-gfCoKsBqXkNP1qN6Vl-pOYWE","_index":"arkime_sessions3-260824","client":{"bytes":743},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo GmbH"],"isp.dstCnt":1,"isp.src":["FlokiNET Ltd"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["FlokiNET Ltd"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS51167 Contabo GmbH","number":51167,"organization":{"name":"Contabo GmbH"}},"bytes":206,"geo":{"country_iso_code":"FR"},"ip":"109.123.246.142","mac":["00:50:56:63:46:a6"],"mac-cnt":1,"packets":3,"port":443},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[78818],"firstPacket":1787582227016,"http":{"bodyMagic":["application/octet-stream"],"bodyMagicCnt":1,"clientVersion":["1.1"],"clientVersionCnt":1,"host":["109.123.246.142","109.123.246.142:443"],"hostCnt":2,"ja4h":["po11nn060000_f70d2564bd2a_000000000000_000000000000"],"ja4hCnt":1,"ja4h_r":["po11nn060000_Host,User-Agent,Content-Length,Accept-Encoding,Content-Type,Secret__"],"ja4h_rCnt":1,"key":["os","commit","arch"],"keyCnt":3,"md5":["7b9b6ff541e18bccaa9f5b44d2d1cd9b"],"md5Cnt":1,"method":["POST"],"method-POST":1,"methodCnt":1,"path":["/api/client/update"],"pathCnt":1,"requestBody":[""],"requestHeader":["user-agent","accept-encoding","host","content-type","content-length","secret"],"requestHeaderCnt":6,"requestHeaderField":["content-length","accept-encoding","content-type","secret"],"requestHeaderValue":["384","gzip","application/octet-stream","3de172c65c5204dbce4c985d6616ca6fbbf337be4ddd40746307af802fa510a2"],"requestHeaderValueCnt":4,"sha256":["d475150d580c13632457dd7b3ccc53cf2aaa612e50629ba31d15b0a825bd1c36"],"sha256Cnt":1,"uri":["109.123.246.142:443/api/client/update?arch=amd64\u0026commit=08059e95dacafe0bf6e5782f8e2c8ec9cd8c5a17\u0026os=windows"],"uriCnt":1,"useragent":["SPARK COMMIT: 08059e95dacafe0bf6e5782f8e2c8ec9cd8c5a17"],"useragentCnt":1,"value":["windows","amd64","08059e95dacafe0bf6e5782f8e2c8ec9cd8c5a17"],"valueCnt":3},"initRTT":538,"ipProtocol":6,"lastPacket":1787582228201,"length":1185,"network":{"bytes":1229,"community_id":"1:uVUi5q0QdWVBQmVkerDBe/l2IuQ=","packets":7},"node":"spark-afae","packetPos":[-78818,882998,90,500,180,82,825,246],"packetRange":{"gte":1787582227016,"lte":1787582228201},"protocol":["http","tcp"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS200651 FlokiNET ehf","number":200651,"organization":{"name":"FlokiNET ehf"}},"bytes":1023,"geo":{"country_iso_code":"RO"},"ip":"185.100.87.136","mac":["c0:69:11:cd:1f:19","00:c0:1d:c0:ff:ee"],"mac-cnt":2,"packets":4,"port":56926},"srcOui":["Arista Networks","Grand Junction Networks, Inc."],"srcOuiCnt":2,"srcPayload8":"504f5354202f6170","srcRIR":"RIPE","srcTTL":[49],"srcTTLCnt":1,"tags":["contabo-sponge-02-ts","proxy","sensor:contabo-sponge-02-ts"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-4-8-1-3_1460_7"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":2,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":1,"rst":1,"srcZero":0,"syn":2,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":3686187698},"totDataBytes":743} +{"@timestamp":1787582557952,"_id":"260824-gfAbRSNTJ55GnYdB7VkW0IUD","_index":"arkime_sessions3-260824","cert":[{"curve":"prime256v1","hash":"09:70:ea:39:86:69:5a:f1:83:45:93:40:ee:12:e7:1c:53:c7:21:a5","issuerCN":["asa temporary self signed certificate"],"ja4x":"7022c563de38_7022c563de38_000000000000","ja4x_r":"550403_550403_","notAfter":2092893639000,"notBefore":1777533639000,"publicAlgorithm":"id-ecPublicKey","remainingDays":3533,"remainingSeconds":305311414,"serial":"c802f369","subjectCN":["asa temporary self signed certificate"],"validDays":3650,"validSeconds":315360000}],"certCnt":1,"client":{"bytes":599},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo GmbH"],"isp.dstCnt":1,"isp.src":["FlokiNET Ltd"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["FlokiNET Ltd"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS51167 Contabo GmbH","number":51167,"organization":{"name":"Contabo GmbH"}},"bytes":2598,"geo":{"country_iso_code":"FR"},"ip":"109.123.246.142","mac":["00:50:56:63:46:a6"],"mac-cnt":1,"packets":8,"port":443},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstPayload8":"1603030059020000","dstRIR":"RIPE","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[78818],"firstPacket":1787582225716,"initRTT":516,"ipProtocol":6,"lastPacket":1787582227049,"length":1333,"network":{"bytes":3873,"community_id":"1:1hM2w+iwtbRt6tZS3EEqWOpXI7w=","packets":18},"node":"spark-afae","packetPos":[-78818,878544,90,457,180,82,343,82,692,82,208,82,133,294,1097,468,82,262,82],"packetRange":{"gte":1787582225716,"lte":1787582227049},"protocol":["tls","tcp"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":2062},"source":{"as":{"full":"AS200651 FlokiNET ehf","number":200651,"organization":{"name":"FlokiNET ehf"}},"bytes":1275,"geo":{"country_iso_code":"RO"},"ip":"185.100.87.136","mac":["c0:69:11:cd:1f:19","00:c0:1d:c0:ff:ee"],"mac-cnt":2,"packets":10,"port":56912},"srcOui":["Arista Networks","Grand Junction Networks, Inc."],"srcOuiCnt":2,"srcPayload8":"1603010100010000","srcRIR":"RIPE","srcTTL":[49],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["542047982741268"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["ac32bdeb-b49d-4079-9e6b-8fbca5e0addf"],"signatureCnt":1,"signatureId":[1031336],"signatureIdCnt":1},"tag":{"block":["false"],"blockCnt":1,"category":["protocol"],"categoryCnt":1,"description":["ip addresses with this tag have been observed attempting to opportunistically crawl the internet and establish tls/ssl connections."],"intention":["unknown"],"intentionCnt":1,"name":["tls/ssl crawler"],"nameCnt":1},"tags":["contabo-sponge-02-ts","proxy","cert:self-signed","sensor:contabo-sponge-02-ts"],"tagsCnt":4,"tcp":{"ja4l":"516564_49_23932","ja4t":["64240_2-4-8-1-3_1460_7"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":6,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":2,"psh":7,"rst":0,"srcZero":0,"syn":2,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":2723882605},"tls":{"cipher":["TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384"],"cipherCnt":1,"dstSessionId":["7b44f07292e1c3bb838645415c2fae69c9678a886eb3ecefd7a232257c0c8b9f"],"ja3":["7c1e207beb00684bbbe144f1b0abe1d5"],"ja3Cnt":1,"ja3s":["e58f0b3c1e9eefb8ee4f92aeceee5858"],"ja3sCnt":1,"ja3sstring":["771,49196,65281-11"],"ja3sstringCnt":1,"ja3string":["771,52392-52393-49199-49200-49195-49196-49171-49161-49172-49162-156-157-47-53-49170-10-4867-4865-4866,5-10-11-13-65281-16-18-43-51,29-23-24-25,0"],"ja3stringCnt":1,"ja4":["t13i1909h2_9dc949149365_97f8aa674fd9"],"ja4Cnt":1,"ja4_r":["t13i1909h2_000a,002f,0035,009c,009d,1301,1302,1303,c009,c00a,c012,c013,c014,c02b,c02c,c02f,c030,cca8,cca9_0005,000a,000b,000d,0012,002b,0033,ff01_0804,0403,0807,0805,0806,0401,0501,0601,0503,0603,0201,0203"],"ja4_rCnt":1,"ja4s":["t120200_c02c_344b4dce5a52"],"ja4sCnt":1,"ja4s_r":["t120200_c02c_ff01,000b"],"ja4s_rCnt":1,"srcSessionId":["d23f5dd80722a36bd7b468a3c211de10c7a7d1a940fd2519fe08caa4eba33945"],"version":["TLSv1.2"],"versionCnt":1},"totDataBytes":2661} +{"@timestamp":1787572321169,"_id":"260824-Q--WG83eM2dF5YT4XDO57RwQ","_index":"arkime_sessions3-260824","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["FlokiNET Ltd"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["FlokiNET Ltd"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":66,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":1,"port":443},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[78762],"firstPacket":1787571566606,"ipProtocol":6,"lastPacket":1787571567820,"length":1214,"network":{"bytes":192,"community_id":"1:g27gIaBCwBQj25axLWWA9SZwRrY=","packets":3},"node":"spark-afae","packetPos":[-78762,2141934,82,3788],"packetRange":{"gte":1787571566606,"lte":1787571567820},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS200651 FlokiNET ehf","number":200651,"organization":{"name":"FlokiNET ehf"}},"bytes":126,"geo":{"country_iso_code":"RO"},"ip":"185.100.87.136","mac":["fc:bd:67:9d:2b:2b","00:c0:1d:c0:ff:ee"],"mac-cnt":2,"packets":2,"port":40380},"srcOui":["Arista Networks","Grand Junction Networks, Inc."],"srcOuiCnt":2,"srcRIR":"RIPE","srcTTL":[55],"srcTTLCnt":1,"tags":["contabo-sponge-01-ts","sensor:contabo-sponge-01-ts","honeypot"],"tagsCnt":3,"tcp":{"ja4t":["65535_2-1-3-1-1-4_1460_8"],"ja4tCnt":1,"ja4ts":["64240_2-1-1-4-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":3242376466},"totDataBytes":0} +{"@timestamp":1787572012162,"_id":"260824-2Zbsz6f3-oJIbZXCQXLLUn-1","_index":"arkime_sessions3-260824","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo GmbH"],"isp.dstCnt":1,"isp.src":["FlokiNET Ltd"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["FlokiNET Ltd"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS51167 Contabo GmbH","number":51167,"organization":{"name":"Contabo GmbH"}},"bytes":66,"geo":{"country_iso_code":"FR"},"ip":"109.123.246.142","mac":["00:50:56:63:46:a6"],"mac-cnt":1,"packets":1,"port":443},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[78758],"firstPacket":1787570824981,"ipProtocol":6,"lastPacket":1787570828093,"length":3112,"network":{"bytes":192,"community_id":"1:6UXKWbT65zmAfPkGjXn0SbEzIA0=","packets":3},"node":"spark-afae","packetPos":[-78758,344277,82,3203],"packetRange":{"gte":1787570824981,"lte":1787570828093},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS200651 FlokiNET ehf","number":200651,"organization":{"name":"FlokiNET ehf"}},"bytes":126,"geo":{"country_iso_code":"RO"},"ip":"185.100.87.136","mac":["c0:69:11:cd:1f:19","00:c0:1d:c0:ff:ee"],"mac-cnt":2,"packets":2,"port":53894},"srcOui":["Arista Networks","Grand Junction Networks, Inc."],"srcOuiCnt":2,"srcRIR":"RIPE","srcTTL":[49],"srcTTLCnt":1,"tags":["contabo-sponge-02-ts","sensor:contabo-sponge-02-ts","proxy"],"tagsCnt":3,"tcp":{"ja4t":["65535_2-1-3-1-1-4_1460_8"],"ja4tCnt":1,"ja4ts":["64240_2-1-1-4-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":1903896232},"totDataBytes":0} +{"@timestamp":1787570802851,"_id":"260824-w5Z0fXIB2WtOYrDP6GnfOQIu","_index":"arkime_sessions3-260824","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["FlokiNET Ltd"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["FlokiNET Ltd"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":66,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":1,"port":443},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[78753],"firstPacket":1787570250250,"ipProtocol":6,"lastPacket":1787570250250,"length":0,"network":{"bytes":132,"community_id":"1:b2GLHaF4Uht48EcOXF4KS9j550k=","packets":2},"node":"spark-afae","packetPos":[-78753,2614640,82],"packetRange":{"gte":1787570250250,"lte":1787570250250},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS200651 FlokiNET ehf","number":200651,"organization":{"name":"FlokiNET ehf"}},"bytes":66,"geo":{"country_iso_code":"RO"},"ip":"185.100.87.136","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":1,"port":58730},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[52],"srcTTLCnt":1,"tags":["sensor:frantech-ts","frantech-ts","honeypot"],"tagsCnt":3,"tcp":{"ja4t":["65535_2-1-3-1-1-4_1400_8"],"ja4tCnt":1,"ja4ts":["64240_2-1-1-4-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":3452192720},"totDataBytes":0} +{"@timestamp":1787565663731,"_id":"260824-Z-4d-bsiRDZMXITAPQMX6_bi","_index":"arkime_sessions3-260824","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Kaopu Cloud HK Limited"],"isp.dstCnt":1,"isp.src":["FlokiNET Ltd"],"isp.srcCnt":1,"org.dst":["LightNode-BH"],"org.dstCnt":1,"org.src":["FlokiNET Ltd"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":66,"geo":{"country_iso_code":"BH"},"ip":"38.54.2.209","mac":["52:54:8f:9d:76:48"],"mac-cnt":1,"packets":1,"port":443},"dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[78725],"firstPacket":1787564906001,"ipProtocol":6,"lastPacket":1787564906001,"length":0,"network":{"bytes":132,"community_id":"1:U0C5rhqQxhmlrFKb441HIr3iuTY=","packets":2},"node":"spark-afae","packetPos":[-78725,3562752,82],"packetRange":{"gte":1787564906001,"lte":1787564906001},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS200651 FlokiNET ehf","number":200651,"organization":{"name":"FlokiNET ehf"}},"bytes":66,"geo":{"country_iso_code":"RO"},"ip":"185.100.87.136","mac":["98:44:ce:60:15:19"],"mac-cnt":1,"packets":1,"port":38342},"srcOui":["Huawei Technologies Co.,Ltd"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[52],"srcTTLCnt":1,"tags":["honeypot","sensor:bahrain-sponge-01-ts","bahrain-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["65535_2-1-3-1-1-4_1460_8"],"ja4tCnt":1,"ja4ts":["64240_2-1-1-4-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":3366229933},"totDataBytes":0} +{"@timestamp":1787564152808,"_id":"260824-7zHLXxZz44RJ8apZHv7pMk1y","_index":"arkime_sessions3-260824","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["netcup GmbH"],"isp.dstCnt":1,"isp.src":["FlokiNET Ltd"],"isp.srcCnt":1,"org.dst":["Netcup KVM"],"org.dstCnt":1,"org.src":["FlokiNET Ltd"],"org.srcCnt":1,"usertype.dst":["business"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS197540 netcup GmbH","number":197540,"organization":{"name":"netcup GmbH"}},"bytes":66,"geo":{"country_iso_code":"DE"},"ip":"159.195.21.150","mac":["8a:41:d3:b8:0d:d3"],"mac-cnt":1,"packets":1,"port":443},"dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[78715],"firstPacket":1787562978248,"ipProtocol":6,"lastPacket":1787562978248,"length":0,"network":{"bytes":132,"community_id":"1:qfi2cephLFfpf6XSDFeRRbeYXHQ=","packets":2},"node":"spark-afae","packetPos":[-78715,555465,82],"packetRange":{"gte":1787562978248,"lte":1787562978248},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS200651 FlokiNET ehf","number":200651,"organization":{"name":"FlokiNET ehf"}},"bytes":66,"geo":{"country_iso_code":"RO"},"ip":"185.100.87.136","mac":["bc:0f:fe:3d:a3:a7","00:00:5e:00:01:96"],"mac-cnt":2,"packets":1,"port":51302},"srcOui":["ICANN, IANA Department","Juniper Networks"],"srcOuiCnt":2,"srcRIR":"RIPE","srcTTL":[53],"srcTTLCnt":1,"tags":["honeypot","sensor:netcup-ts","netcup-ts"],"tagsCnt":3,"tcp":{"ja4t":["65535_2-1-3-1-1-4_1460_8"],"ja4tCnt":1,"ja4ts":["42340_2-1-1-4-1-3_1460_11"],"ja4tsCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":3253473039},"totDataBytes":0} +{"@timestamp":1787555351979,"_id":"260824-hZUsN_losp9O_qky2cTn1_Ip","_index":"arkime_sessions3-260824","client":{"bytes":52},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["netcup GmbH"],"isp.dstCnt":1,"isp.src":["FlokiNET Ltd"],"isp.srcCnt":1,"org.dst":["Netcup KVM"],"org.dstCnt":1,"org.src":["FlokiNET Ltd"],"org.srcCnt":1,"usertype.dst":["business"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS197540 netcup GmbH","number":197540,"organization":{"name":"netcup GmbH"}},"bytes":0,"geo":{"country_iso_code":"DE"},"ip":"159.195.21.150","mac":["8a:41:d3:b8:0d:d3"],"mac-cnt":1,"packets":0,"port":443},"dstRIR":"ARIN","ethertype":2048,"fileId":[78667],"firstPacket":1787554313284,"ipProtocol":17,"lastPacket":1787554313284,"length":0,"network":{"bytes":94,"community_id":"1:DOLo1ipOS55A++96wB3zZ4VB2yM=","packets":1},"node":"spark-afae","packetPos":[-78667,4835560],"packetRange":{"gte":1787554313284,"lte":1787554313284},"protocol":["udp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS200651 FlokiNET ehf","number":200651,"organization":{"name":"FlokiNET ehf"}},"bytes":94,"geo":{"country_iso_code":"RO"},"ip":"185.100.87.136","mac":["bc:0f:fe:3d:a3:a7"],"mac-cnt":1,"packets":1,"port":55266},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcPayload8":"08ef002600000000","srcRIR":"RIPE","srcTTL":[53],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["379633829626034"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["f30d8a4b-8331-4517-8035-34b2a818e4fe"],"signatureCnt":1,"signatureId":[1071783],"signatureIdCnt":1},"tag":{"block":["false"],"blockCnt":1,"category":["protocol"],"categoryCnt":1,"description":["ip addresses with this tag have been observed sending quic traffic."],"intention":["unknown"],"intentionCnt":1,"name":["quic protocol"],"nameCnt":1},"tags":["sensor:netcup-ts","netcup-ts","honeypot"],"tagsCnt":3,"totDataBytes":52} +{"@timestamp":1787554149835,"_id":"260824-6Oxo-6rO2hdDZbTVIfPcmkU6","_index":"arkime_sessions3-260824","client":{"bytes":52},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Kaopu Cloud HK Limited"],"isp.dstCnt":1,"isp.src":["FlokiNET Ltd"],"isp.srcCnt":1,"org.dst":["LightNode-BH"],"org.dstCnt":1,"org.src":["FlokiNET Ltd"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":0,"geo":{"country_iso_code":"BH"},"ip":"38.54.2.209","mac":["52:54:8f:9d:76:48"],"mac-cnt":1,"packets":0,"port":443},"dstRIR":"ARIN","ethertype":2048,"fileId":[78661],"firstPacket":1787552731747,"ipProtocol":17,"lastPacket":1787552731747,"length":0,"network":{"bytes":94,"community_id":"1:67oLdK72MDbmv+/bllrx++kdmEU=","packets":1},"node":"spark-afae","packetPos":[-78661,429420],"packetRange":{"gte":1787552731747,"lte":1787552731747},"protocol":["udp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS200651 FlokiNET ehf","number":200651,"organization":{"name":"FlokiNET ehf"}},"bytes":94,"geo":{"country_iso_code":"RO"},"ip":"185.100.87.136","mac":["98:44:ce:60:15:19"],"mac-cnt":1,"packets":1,"port":43211},"srcOui":["Huawei Technologies Co.,Ltd"],"srcOuiCnt":1,"srcPayload8":"08ef002600000000","srcRIR":"RIPE","srcTTL":[52],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["959525489704739"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["f30d8a4b-8331-4517-8035-34b2a818e4fe"],"signatureCnt":1,"signatureId":[1071783],"signatureIdCnt":1},"tag":{"block":["false"],"blockCnt":1,"category":["protocol"],"categoryCnt":1,"description":["ip addresses with this tag have been observed sending quic traffic."],"intention":["unknown"],"intentionCnt":1,"name":["quic protocol"],"nameCnt":1},"tags":["bahrain-sponge-01-ts","honeypot","sensor:bahrain-sponge-01-ts"],"tagsCnt":3,"totDataBytes":52} +{"@timestamp":1787547789176,"_id":"260824-AJWClDJVzCdIAqAHHpbTIQDc","_index":"arkime_sessions3-260824","client":{"bytes":52},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo GmbH"],"isp.dstCnt":1,"isp.src":["FlokiNET Ltd"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["FlokiNET Ltd"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS51167 Contabo GmbH","number":51167,"organization":{"name":"Contabo GmbH"}},"bytes":0,"geo":{"country_iso_code":"FR"},"ip":"109.123.246.142","mac":["00:50:56:63:46:a6"],"mac-cnt":1,"packets":0,"port":443},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[78624],"firstPacket":1787546523231,"ipProtocol":17,"lastPacket":1787546523231,"length":0,"network":{"bytes":94,"community_id":"1:4fw0CFB8eUO8cLrcG2vC2Ufc0nk=","packets":1},"node":"spark-afae","packetPos":[-78624,4984],"packetRange":{"gte":1787546523231,"lte":1787546523231},"protocol":["udp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS200651 FlokiNET ehf","number":200651,"organization":{"name":"FlokiNET ehf"}},"bytes":94,"geo":{"country_iso_code":"RO"},"ip":"185.100.87.136","mac":["c0:69:11:cd:1f:19"],"mac-cnt":1,"packets":1,"port":60820},"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcPayload8":"08ef002600000000","srcRIR":"RIPE","srcTTL":[49],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["993005445591417"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["f30d8a4b-8331-4517-8035-34b2a818e4fe"],"signatureCnt":1,"signatureId":[1071783],"signatureIdCnt":1},"tag":{"block":["false"],"blockCnt":1,"category":["protocol"],"categoryCnt":1,"description":["ip addresses with this tag have been observed sending quic traffic."],"intention":["unknown"],"intentionCnt":1,"name":["quic protocol"],"nameCnt":1},"tags":["contabo-sponge-02-ts","sensor:contabo-sponge-02-ts","proxy"],"tagsCnt":3,"totDataBytes":52} +{"@timestamp":1787540572385,"_id":"260824-PjGzJYA1pCpPupsjQ5HpZiIX","_index":"arkime_sessions3-260824","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["netcup GmbH"],"isp.dstCnt":1,"isp.src":["FlokiNET Ltd"],"isp.srcCnt":1,"org.dst":["Netcup KVM"],"org.dstCnt":1,"org.src":["FlokiNET Ltd"],"org.srcCnt":1,"usertype.dst":["business"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS197540 netcup GmbH","number":197540,"organization":{"name":"netcup GmbH"}},"bytes":66,"geo":{"country_iso_code":"DE"},"ip":"159.195.21.150","mac":["8a:41:d3:b8:0d:d3"],"mac-cnt":1,"packets":1,"port":443},"dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[78585],"firstPacket":1787540324159,"ipProtocol":6,"lastPacket":1787540325194,"length":1035,"network":{"bytes":188,"community_id":"1:VWKKpnG45wVvZzeZTmrHU5G9Fkg=","packets":3},"node":"spark-afae","packetPos":[-78585,4670986,82,2532],"packetRange":{"gte":1787540324159,"lte":1787540325194},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS200651 FlokiNET ehf","number":200651,"organization":{"name":"FlokiNET ehf"}},"bytes":122,"geo":{"country_iso_code":"RO"},"ip":"185.100.87.136","mac":["bc:0f:fe:3d:a3:a7","00:00:5e:00:01:96"],"mac-cnt":2,"packets":2,"port":42068},"srcOui":["Juniper Networks","ICANN, IANA Department"],"srcOuiCnt":2,"srcRIR":"RIPE","srcTTL":[53],"srcTTLCnt":1,"tags":["sensor:netcup-ts","netcup-ts","honeypot"],"tagsCnt":3,"tcp":{"ja4t":["65535_2-1-3-1-1-4_1460_8"],"ja4tCnt":1,"ja4ts":["42340_2-1-1-4-1-3_1460_11"],"ja4tsCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":792133220},"totDataBytes":0} +{"@timestamp":1787540572492,"_id":"260824-MeuMCmcQLF1EeKxZXaqVLABW","_index":"arkime_sessions3-260824","client":{"bytes":52},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["FlokiNET Ltd"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["FlokiNET Ltd"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":0,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":0,"port":443},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[78586],"firstPacket":1787539937612,"ipProtocol":17,"lastPacket":1787539937612,"length":0,"network":{"bytes":94,"community_id":"1:dD1V1mIX+64NLnlVBgBZ6z56LA0=","packets":1},"node":"spark-afae","packetPos":[-78586,29003843],"packetRange":{"gte":1787539937612,"lte":1787539937612},"protocol":["udp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS200651 FlokiNET ehf","number":200651,"organization":{"name":"FlokiNET ehf"}},"bytes":94,"geo":{"country_iso_code":"RO"},"ip":"185.100.87.136","mac":["fc:bd:67:9d:2b:2b"],"mac-cnt":1,"packets":1,"port":55851},"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcPayload8":"08ef002600000000","srcRIR":"RIPE","srcTTL":[55],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["378720375845194"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["f30d8a4b-8331-4517-8035-34b2a818e4fe"],"signatureCnt":1,"signatureId":[1071783],"signatureIdCnt":1},"tag":{"block":["false"],"blockCnt":1,"category":["protocol"],"categoryCnt":1,"description":["ip addresses with this tag have been observed sending quic traffic."],"intention":["unknown"],"intentionCnt":1,"name":["quic protocol"],"nameCnt":1},"tags":["sensor:contabo-sponge-01-ts","contabo-sponge-01-ts","honeypot"],"tagsCnt":3,"totDataBytes":52} +{"@timestamp":1787540252035,"_id":"260824-Juv7TugryQVJe6XGq1BWrpRl","_index":"arkime_sessions3-260824","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Kaopu Cloud HK Limited"],"isp.dstCnt":1,"isp.src":["FlokiNET Ltd"],"isp.srcCnt":1,"org.dst":["LightNode-BH"],"org.dstCnt":1,"org.src":["FlokiNET Ltd"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":66,"geo":{"country_iso_code":"BH"},"ip":"38.54.2.209","mac":["52:54:8f:9d:76:48"],"mac-cnt":1,"packets":1,"port":443},"dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[78583],"firstPacket":1787539721366,"ipProtocol":6,"lastPacket":1787539722510,"length":1144,"network":{"bytes":186,"community_id":"1:IlFOs/Aj3u0I4VIa8EqHz/PEwbU=","packets":3},"node":"spark-afae","packetPos":[-78583,1619664,82,2072],"packetRange":{"gte":1787539721366,"lte":1787539722510},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS200651 FlokiNET ehf","number":200651,"organization":{"name":"FlokiNET ehf"}},"bytes":120,"geo":{"country_iso_code":"RO"},"ip":"185.100.87.136","mac":["98:44:ce:60:15:19"],"mac-cnt":1,"packets":2,"port":48670},"srcOui":["Huawei Technologies Co.,Ltd"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[51],"srcTTLCnt":1,"tags":["bahrain-sponge-01-ts","sensor:bahrain-sponge-01-ts","honeypot"],"tagsCnt":3,"tcp":{"ja4t":["65535_2-1-3-1-1-4_1460_8"],"ja4tCnt":1,"ja4ts":["64240_2-1-1-4-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":1311290946},"totDataBytes":0} +{"@timestamp":1787537835283,"_id":"260824-OpRj1q0zqKtM5IrIGj1GEHNp","_index":"arkime_sessions3-260824","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo GmbH"],"isp.dstCnt":1,"isp.src":["FlokiNET Ltd"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["FlokiNET Ltd"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS51167 Contabo GmbH","number":51167,"organization":{"name":"Contabo GmbH"}},"bytes":66,"geo":{"country_iso_code":"FR"},"ip":"109.123.246.142","mac":["00:50:56:63:46:a6"],"mac-cnt":1,"packets":1,"port":443},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[78568],"firstPacket":1787537350021,"ipProtocol":6,"lastPacket":1787537350052,"length":31,"network":{"bytes":192,"community_id":"1:jgyjUkMNVqLRW0reWrLM+aCE+EY=","packets":3},"node":"spark-afae","packetPos":[-78568,218071,82,0],"packetRange":{"gte":1787537350021,"lte":1787537350052},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS200651 FlokiNET ehf","number":200651,"organization":{"name":"FlokiNET ehf"}},"bytes":126,"geo":{"country_iso_code":"RO"},"ip":"185.100.87.136","mac":["c0:69:11:cd:1f:19","00:c0:1d:c0:ff:ee"],"mac-cnt":2,"packets":2,"port":50831},"srcOui":["Arista Networks","Grand Junction Networks, Inc."],"srcOuiCnt":2,"srcRIR":"RIPE","srcTTL":[49],"srcTTLCnt":1,"tags":["proxy","contabo-sponge-02-ts","sensor:contabo-sponge-02-ts"],"tagsCnt":3,"tcp":{"ja4t":["65535_2-1-3-1-1-4_1460_8"],"ja4tCnt":1,"ja4ts":["64240_2-1-1-4-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":2864800397},"totDataBytes":0} +{"@timestamp":1787535425575,"_id":"260824-iuppUb6c6gNG-rQzLrWgnhI7","_index":"arkime_sessions3-260824","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["FlokiNET Ltd"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["FlokiNET Ltd"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":66,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":1,"port":443},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[78556],"firstPacket":1787534854123,"ipProtocol":6,"lastPacket":1787534857363,"length":3240,"network":{"bytes":192,"community_id":"1:y9yNBRczI/FwrDX1h3mIKARusaY=","packets":3},"node":"spark-afae","packetPos":[-78556,12252757,82,8328],"packetRange":{"gte":1787534854123,"lte":1787534857363},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS200651 FlokiNET ehf","number":200651,"organization":{"name":"FlokiNET ehf"}},"bytes":126,"geo":{"country_iso_code":"RO"},"ip":"185.100.87.136","mac":["fc:bd:67:9d:2b:2b","00:c0:1d:c0:ff:ee"],"mac-cnt":2,"packets":2,"port":59915},"srcOui":["Arista Networks","Grand Junction Networks, Inc."],"srcOuiCnt":2,"srcRIR":"RIPE","srcTTL":[56],"srcTTLCnt":1,"tags":["contabo-sponge-01-ts","honeypot","sensor:contabo-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["65535_2-1-3-1-1-4_1460_8"],"ja4tCnt":1,"ja4ts":["64240_2-1-1-4-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":1441215478},"totDataBytes":0} +{"@timestamp":1787534825215,"_id":"260824-A5Tbu3LBCOFBD6UQgxCHBR91","_index":"arkime_sessions3-260824","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["FlokiNET Ltd"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["FlokiNET Ltd"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":66,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":1,"port":443},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[78552],"firstPacket":1787533652698,"ipProtocol":6,"lastPacket":1787533652698,"length":0,"network":{"bytes":132,"community_id":"1:Aou8xxuhI2jEuQcFKrqUdCZqEo0=","packets":2},"node":"spark-afae","packetPos":[-78552,646933,82],"packetRange":{"gte":1787533652698,"lte":1787533652698},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS200651 FlokiNET ehf","number":200651,"organization":{"name":"FlokiNET ehf"}},"bytes":66,"geo":{"country_iso_code":"RO"},"ip":"185.100.87.136","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":1,"port":41747},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[53],"srcTTLCnt":1,"tags":["sensor:frantech-ts","honeypot","frantech-ts"],"tagsCnt":3,"tcp":{"ja4t":["65535_2-1-3-1-1-4_1400_8"],"ja4tCnt":1,"ja4ts":["64240_2-1-1-4-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":4231691570},"totDataBytes":0} +{"@timestamp":1787525783347,"_id":"260823-PZNknT6kW7lAmKqrIL9IPA7W","_index":"arkime_sessions3-260823","client":{"bytes":261},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["FlokiNET Ltd"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["FlokiNET Ltd"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":441,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":5,"port":443},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstPayload8":"485454502f312e31","dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[78503],"firstPacket":1787524457028,"http":{"bodyMagic":["text/plain"],"bodyMagicCnt":1,"md5":["6196dba52703776af2e6593f772ed7ce"],"md5Cnt":1,"responseHeader":["connection","content-type"],"responseHeaderCnt":2,"responseHeaderField":["content-type","connection"],"responseHeaderValue":["text/plain; charset=utf-8","close"],"responseHeaderValueCnt":2,"serverVersion":["1.1"],"serverVersionCnt":1,"sha256":["19b843cc92cb12aa314bb3c3913b2feeb852e85969bf06cb9d096931bfda34ba"],"sha256Cnt":1,"statuscode":[400],"statuscodeCnt":1},"initRTT":586,"ipProtocol":6,"lastPacket":1787524458433,"length":1405,"network":{"bytes":1180,"community_id":"1:FiSLSMiOWCySQh9UGlv1gQe9Csg=","packets":12},"node":"spark-afae","packetPos":[-78503,13555,90,4014,360,82,343,82,185,2332,164,200,82],"packetRange":{"gte":1787524457028,"lte":1787524458433},"protocol":["tcp","http","tls"],"protocolCnt":3,"segmentCnt":1,"server":{"bytes":103},"source":{"as":{"full":"AS200651 FlokiNET ehf","number":200651,"organization":{"name":"FlokiNET ehf"}},"bytes":739,"geo":{"country_iso_code":"RO"},"ip":"185.100.87.136","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":7,"port":49234},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcPayload8":"1603010100010000","srcRIR":"RIPE","srcTTL":[52],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["403596705154025"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["ac32bdeb-b49d-4079-9e6b-8fbca5e0addf"],"signatureCnt":1,"signatureId":[1031336],"signatureIdCnt":1},"tag":{"block":["false"],"blockCnt":1,"category":["protocol"],"categoryCnt":1,"description":["ip addresses with this tag have been observed attempting to opportunistically crawl the internet and establish tls/ssl connections."],"intention":["unknown"],"intentionCnt":1,"name":["tls/ssl crawler"],"nameCnt":1},"tags":["honeypot","frantech-ts","sensor:frantech-ts"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-4-8-1-3_1400_7"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":5,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":2,"psh":2,"rst":0,"srcZero":0,"syn":2,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":2502411850},"tls":{"ja3":["7c1e207beb00684bbbe144f1b0abe1d5"],"ja3Cnt":1,"ja3string":["771,52392-52393-49199-49200-49195-49196-49171-49161-49172-49162-156-157-47-53-49170-10-4867-4865-4866,5-10-11-13-65281-16-18-43-51,29-23-24-25,0"],"ja3stringCnt":1,"ja4":["t13i1909h2_9dc949149365_97f8aa674fd9"],"ja4Cnt":1,"ja4_r":["t13i1909h2_000a,002f,0035,009c,009d,1301,1302,1303,c009,c00a,c012,c013,c014,c02b,c02c,c02f,c030,cca8,cca9_0005,000a,000b,000d,0012,002b,0033,ff01_0804,0403,0807,0805,0806,0401,0501,0601,0503,0603,0201,0203"],"ja4_rCnt":1,"srcSessionId":["1ecea5d953a4cbdf6e688233bc484bce91b64b72a0b1ffa03770ec14b044a1e8"]},"totDataBytes":364} +{"@timestamp":1787522451504,"_id":"260823-1uiltFKYh_lGH5aKRTLFBNHl","_index":"arkime_sessions3-260823","client":{"bytes":261},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Kaopu Cloud HK Limited"],"isp.dstCnt":1,"isp.src":["FlokiNET Ltd"],"isp.srcCnt":1,"org.dst":["LightNode-BH"],"org.dstCnt":1,"org.src":["FlokiNET Ltd"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":441,"geo":{"country_iso_code":"BH"},"ip":"38.54.2.209","mac":["52:54:8f:9d:76:48"],"mac-cnt":1,"packets":5,"port":443},"dstPayload8":"485454502f312e31","dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[78484],"firstPacket":1787521447632,"http":{"bodyMagic":["text/plain"],"bodyMagicCnt":1,"md5":["6196dba52703776af2e6593f772ed7ce"],"md5Cnt":1,"responseHeader":["connection","content-type"],"responseHeaderCnt":2,"responseHeaderField":["content-type","connection"],"responseHeaderValue":["text/plain; charset=utf-8","close"],"responseHeaderValueCnt":2,"serverVersion":["1.1"],"serverVersionCnt":1,"sha256":["19b843cc92cb12aa314bb3c3913b2feeb852e85969bf06cb9d096931bfda34ba"],"sha256Cnt":1,"statuscode":[400],"statuscodeCnt":1},"initRTT":1071,"ipProtocol":6,"lastPacket":1787521449984,"length":2352,"network":{"bytes":1180,"community_id":"1:hm9S1Qkv1kxBIQrNrjoNUTtYo6E=","packets":12},"node":"spark-afae","packetPos":[-78484,3546420,90,16803,13554,82,343,82,185,1984,82,164,82],"packetRange":{"gte":1787521447632,"lte":1787521449984},"protocol":["tls","tcp","http"],"protocolCnt":3,"segmentCnt":1,"server":{"bytes":103},"source":{"as":{"full":"AS200651 FlokiNET ehf","number":200651,"organization":{"name":"FlokiNET ehf"}},"bytes":739,"geo":{"country_iso_code":"RO"},"ip":"185.100.87.136","mac":["98:44:ce:60:15:19"],"mac-cnt":1,"packets":7,"port":45046},"srcOui":["Huawei Technologies Co.,Ltd"],"srcOuiCnt":1,"srcPayload8":"1603010100010000","srcRIR":"RIPE","srcTTL":[51],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["2151550337763443"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["ac32bdeb-b49d-4079-9e6b-8fbca5e0addf"],"signatureCnt":1,"signatureId":[1031336],"signatureIdCnt":1},"tag":{"block":["false"],"blockCnt":1,"category":["protocol"],"categoryCnt":1,"description":["ip addresses with this tag have been observed attempting to opportunistically crawl the internet and establish tls/ssl connections."],"intention":["unknown"],"intentionCnt":1,"name":["tls/ssl crawler"],"nameCnt":1},"tags":["bahrain-sponge-01-ts","honeypot","sensor:bahrain-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-4-8-1-3_1460_7"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":5,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":2,"psh":2,"rst":0,"srcZero":0,"syn":2,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":1566349163},"tls":{"ja3":["7c1e207beb00684bbbe144f1b0abe1d5"],"ja3Cnt":1,"ja3string":["771,52392-52393-49199-49200-49195-49196-49171-49161-49172-49162-156-157-47-53-49170-10-4867-4865-4866,5-10-11-13-65281-16-18-43-51,29-23-24-25,0"],"ja3stringCnt":1,"ja4":["t13i1909h2_9dc949149365_97f8aa674fd9"],"ja4Cnt":1,"ja4_r":["t13i1909h2_000a,002f,0035,009c,009d,1301,1302,1303,c009,c00a,c012,c013,c014,c02b,c02c,c02f,c030,cca8,cca9_0005,000a,000b,000d,0012,002b,0033,ff01_0804,0403,0807,0805,0806,0401,0501,0601,0503,0603,0201,0203"],"ja4_rCnt":1,"srcSessionId":["85c5abba8071e58e8c69b4050d3eb9a5a89c41b4e004c9c8de1f4dac55f0105b"]},"totDataBytes":364} +{"@timestamp":1787520650297,"_id":"260823-uTDOBqM8NrJMK6oW1wJrj1mz","_index":"arkime_sessions3-260823","client":{"bytes":261},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["netcup GmbH"],"isp.dstCnt":1,"isp.src":["FlokiNET Ltd"],"isp.srcCnt":1,"org.dst":["Netcup KVM"],"org.dstCnt":1,"org.src":["FlokiNET Ltd"],"org.srcCnt":1,"usertype.dst":["business"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS197540 netcup GmbH","number":197540,"organization":{"name":"netcup GmbH"}},"bytes":441,"geo":{"country_iso_code":"DE"},"ip":"159.195.21.150","mac":["8a:41:d3:b8:0d:d3"],"mac-cnt":1,"packets":5,"port":443},"dstPayload8":"485454502f312e31","dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[78474],"firstPacket":1787520229835,"http":{"bodyMagic":["text/plain"],"bodyMagicCnt":1,"md5":["6196dba52703776af2e6593f772ed7ce"],"md5Cnt":1,"responseHeader":["content-type","connection"],"responseHeaderCnt":2,"responseHeaderField":["content-type","connection"],"responseHeaderValue":["text/plain; charset=utf-8","close"],"responseHeaderValueCnt":2,"serverVersion":["1.1"],"serverVersionCnt":1,"sha256":["19b843cc92cb12aa314bb3c3913b2feeb852e85969bf06cb9d096931bfda34ba"],"sha256Cnt":1,"statuscode":[400],"statuscodeCnt":1},"initRTT":527,"ipProtocol":6,"lastPacket":1787520231065,"length":1230,"network":{"bytes":1180,"community_id":"1:E4NnOq9IIqsN4hW7xxKBCljk+lY=","packets":12},"node":"spark-afae","packetPos":[-78474,3289030,90,11867,180,82,343,82,357,82,468,246,82],"packetRange":{"gte":1787520229835,"lte":1787520231065},"protocol":["http","tcp","tls"],"protocolCnt":3,"segmentCnt":1,"server":{"bytes":103},"source":{"as":{"full":"AS200651 FlokiNET ehf","number":200651,"organization":{"name":"FlokiNET ehf"}},"bytes":739,"geo":{"country_iso_code":"RO"},"ip":"185.100.87.136","mac":["bc:0f:fe:3d:a3:a7","00:00:5e:00:01:96"],"mac-cnt":2,"packets":7,"port":55990},"srcOui":["Juniper Networks","ICANN, IANA Department"],"srcOuiCnt":2,"srcPayload8":"1603010100010000","srcRIR":"RIPE","srcTTL":[53],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["1618301817732171"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["ac32bdeb-b49d-4079-9e6b-8fbca5e0addf"],"signatureCnt":1,"signatureId":[1031336],"signatureIdCnt":1},"tag":{"block":["false"],"blockCnt":1,"category":["protocol"],"categoryCnt":1,"description":["ip addresses with this tag have been observed attempting to opportunistically crawl the internet and establish tls/ssl connections."],"intention":["unknown"],"intentionCnt":1,"name":["tls/ssl crawler"],"nameCnt":1},"tags":["sensor:netcup-ts","netcup-ts","honeypot"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-4-8-1-3_1460_7"],"ja4tCnt":1,"ja4ts":["43440_2-4-8-1-3_1460_11"],"ja4tsCnt":1},"tcpflags":{"ack":5,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":2,"psh":2,"rst":0,"srcZero":0,"syn":2,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":2180145472},"tls":{"ja3":["7c1e207beb00684bbbe144f1b0abe1d5"],"ja3Cnt":1,"ja3string":["771,52392-52393-49199-49200-49195-49196-49171-49161-49172-49162-156-157-47-53-49170-10-4867-4865-4866,5-10-11-13-65281-16-18-43-51,29-23-24-25,0"],"ja3stringCnt":1,"ja4":["t13i1909h2_9dc949149365_97f8aa674fd9"],"ja4Cnt":1,"ja4_r":["t13i1909h2_000a,002f,0035,009c,009d,1301,1302,1303,c009,c00a,c012,c013,c014,c02b,c02c,c02f,c030,cca8,cca9_0005,000a,000b,000d,0012,002b,0033,ff01_0804,0403,0807,0805,0806,0401,0501,0601,0503,0603,0201,0203"],"ja4_rCnt":1,"srcSessionId":["9e2c016464ce9b84a13303cb92cae7642dba864074f9a10f9f3f3c2a1f23c8ec"]},"totDataBytes":364} +{"@timestamp":1787519743590,"_id":"260823-uZLbGewjbZxJk7i4JMxmDKzL","_index":"arkime_sessions3-260823","cert":[{"curve":"prime256v1","hash":"09:70:ea:39:86:69:5a:f1:83:45:93:40:ee:12:e7:1c:53:c7:21:a5","issuerCN":["asa temporary self signed certificate"],"ja4x":"7022c563de38_7022c563de38_000000000000","ja4x_r":"550403_550403_","notAfter":2092893639000,"notBefore":1777533639000,"publicAlgorithm":"id-ecPublicKey","remainingDays":3534,"remainingSeconds":305374215,"serial":"c802f369","subjectCN":["asa temporary self signed certificate"],"validDays":3650,"validSeconds":315360000}],"certCnt":1,"client":{"bytes":661},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo GmbH"],"isp.dstCnt":1,"isp.src":["FlokiNET Ltd"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["FlokiNET Ltd"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS51167 Contabo GmbH","number":51167,"organization":{"name":"Contabo GmbH"}},"bytes":1382,"geo":{"country_iso_code":"FR"},"ip":"109.123.246.142","mac":["00:50:56:63:46:a6"],"mac-cnt":1,"packets":8,"port":443},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstPayload8":"1603030059020000","dstRIR":"RIPE","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[78468],"firstPacket":1787519424609,"initRTT":21,"ipProtocol":6,"lastPacket":1787519424918,"length":309,"network":{"bytes":2579,"community_id":"1:6QzR2kIfTDkZmDhyDdXTY5EEy04=","packets":16},"node":"spark-afae","packetPos":[-78468,93117,90,0,82,343,82,693,82,208,82,133,356,266,82,0,0],"packetRange":{"gte":1787519424609,"lte":1787519424918},"protocol":["tls","tcp"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":846},"source":{"as":{"full":"AS200651 FlokiNET ehf","number":200651,"organization":{"name":"FlokiNET ehf"}},"bytes":1197,"geo":{"country_iso_code":"RO"},"ip":"185.100.87.136","mac":["c0:69:11:cd:1f:19","00:c0:1d:c0:ff:ee"],"mac-cnt":2,"packets":8,"port":36482},"srcOui":["Arista Networks","Grand Junction Networks, Inc."],"srcOuiCnt":2,"srcPayload8":"1603010100010000","srcRIR":"RIPE","srcTTL":[49],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["82781552280416"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["ac32bdeb-b49d-4079-9e6b-8fbca5e0addf"],"signatureCnt":1,"signatureId":[1031336],"signatureIdCnt":1},"tag":{"block":["false"],"blockCnt":1,"category":["protocol"],"categoryCnt":1,"description":["ip addresses with this tag have been observed attempting to opportunistically crawl the internet and establish tls/ssl connections."],"intention":["unknown"],"intentionCnt":1,"name":["tls/ssl crawler"],"nameCnt":1},"tags":["contabo-sponge-02-ts","sensor:contabo-sponge-02-ts","proxy","cert:self-signed"],"tagsCnt":4,"tcp":{"ja4l":"20677_49_20941","ja4ls":"620_64_34416","ja4t":["64240_2-4-8-1-3_1460_7"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":6,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":2,"psh":6,"rst":0,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":3871778238},"tls":{"cipher":["TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384"],"cipherCnt":1,"dstSessionId":["754de26acd480e7c71e7cb064014faa41f1cd798331a8c9dcc8a2a678abcbee0"],"ja3":["7c1e207beb00684bbbe144f1b0abe1d5"],"ja3Cnt":1,"ja3s":["e58f0b3c1e9eefb8ee4f92aeceee5858"],"ja3sCnt":1,"ja3sstring":["771,49196,65281-11"],"ja3sstringCnt":1,"ja3string":["771,52392-52393-49199-49200-49195-49196-49171-49161-49172-49162-156-157-47-53-49170-10-4867-4865-4866,5-10-11-13-65281-16-18-43-51,29-23-24-25,0"],"ja3stringCnt":1,"ja4":["t13i1909h2_9dc949149365_97f8aa674fd9"],"ja4Cnt":1,"ja4_r":["t13i1909h2_000a,002f,0035,009c,009d,1301,1302,1303,c009,c00a,c012,c013,c014,c02b,c02c,c02f,c030,cca8,cca9_0005,000a,000b,000d,0012,002b,0033,ff01_0804,0403,0807,0805,0806,0401,0501,0601,0503,0603,0201,0203"],"ja4_rCnt":1,"ja4s":["t120200_c02c_344b4dce5a52"],"ja4sCnt":1,"ja4s_r":["t120200_c02c_ff01,000b"],"ja4s_rCnt":1,"srcSessionId":["c267cae1a2815c1ec843229e55ae9bef0f47306b2d2f0b292273b96b26633ea7"],"version":["TLSv1.2"],"versionCnt":1},"totDataBytes":1507} +{"@timestamp":1787519441003,"_id":"260823-rpJdrXLME-pFx6T0SY97YlTc","_index":"arkime_sessions3-260823","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["FlokiNET Ltd"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["FlokiNET Ltd"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":66,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":1,"port":443},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[78466],"firstPacket":1787518226531,"ipProtocol":6,"lastPacket":1787518229784,"length":3253,"network":{"bytes":186,"community_id":"1:blgIs05Da5uuX4rEypXrciWyC7w=","packets":3},"node":"spark-afae","packetPos":[-78466,275746,82,12279],"packetRange":{"gte":1787518226531,"lte":1787518229784},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS200651 FlokiNET ehf","number":200651,"organization":{"name":"FlokiNET ehf"}},"bytes":120,"geo":{"country_iso_code":"RO"},"ip":"185.100.87.136","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":2,"port":43370},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[52],"srcTTLCnt":1,"tags":["honeypot","frantech-ts","sensor:frantech-ts"],"tagsCnt":3,"tcp":{"ja4t":["65535_2-1-3-1-1-4_1400_8"],"ja4tCnt":1,"ja4ts":["64240_2-1-1-4-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":22429966},"totDataBytes":0} +{"@timestamp":1787517938796,"_id":"260823-R-hV5JOuJCJAJ7AETHrHzOjw","_index":"arkime_sessions3-260823","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Kaopu Cloud HK Limited"],"isp.dstCnt":1,"isp.src":["FlokiNET Ltd"],"isp.srcCnt":1,"org.dst":["LightNode-BH"],"org.dstCnt":1,"org.src":["FlokiNET Ltd"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":66,"geo":{"country_iso_code":"BH"},"ip":"38.54.2.209","mac":["52:54:8f:9d:76:48"],"mac-cnt":1,"packets":1,"port":443},"dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[78459],"firstPacket":1787516590902,"ipProtocol":6,"lastPacket":1787516594061,"length":3159,"network":{"bytes":186,"community_id":"1:lmPHVZIdxizAso+20SH4ieHmA8Q=","packets":3},"node":"spark-afae","packetPos":[-78459,39414,82,5933],"packetRange":{"gte":1787516590902,"lte":1787516594061},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS200651 FlokiNET ehf","number":200651,"organization":{"name":"FlokiNET ehf"}},"bytes":120,"geo":{"country_iso_code":"RO"},"ip":"185.100.87.136","mac":["98:44:ce:60:15:19"],"mac-cnt":1,"packets":2,"port":48216},"srcOui":["Huawei Technologies Co.,Ltd"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[52],"srcTTLCnt":1,"tags":["bahrain-sponge-01-ts","honeypot","sensor:bahrain-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["65535_2-1-3-1-1-4_1460_8"],"ja4tCnt":1,"ja4ts":["64240_2-1-1-4-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":1652704063},"totDataBytes":0} +{"@timestamp":1787516437529,"_id":"260823-d5LTIzt5C_lCwo57TVwJ9pFl","_index":"arkime_sessions3-260823","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["netcup GmbH"],"isp.dstCnt":1,"isp.src":["FlokiNET Ltd"],"isp.srcCnt":1,"org.dst":["Netcup KVM"],"org.dstCnt":1,"org.src":["FlokiNET Ltd"],"org.srcCnt":1,"usertype.dst":["business"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS197540 netcup GmbH","number":197540,"organization":{"name":"netcup GmbH"}},"bytes":66,"geo":{"country_iso_code":"DE"},"ip":"159.195.21.150","mac":["8a:41:d3:b8:0d:d3"],"mac-cnt":1,"packets":1,"port":443},"dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[78450],"firstPacket":1787515931085,"ipProtocol":6,"lastPacket":1787515932138,"length":1053,"network":{"bytes":188,"community_id":"1:eZCAb0QsK/Okal8wKTbX7HXyB2k=","packets":3},"node":"spark-afae","packetPos":[-78450,4114750,82,3489],"packetRange":{"gte":1787515931085,"lte":1787515932138},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS200651 FlokiNET ehf","number":200651,"organization":{"name":"FlokiNET ehf"}},"bytes":122,"geo":{"country_iso_code":"RO"},"ip":"185.100.87.136","mac":["bc:0f:fe:3d:a3:a7","00:00:5e:00:01:96"],"mac-cnt":2,"packets":2,"port":41368},"srcOui":["ICANN, IANA Department","Juniper Networks"],"srcOuiCnt":2,"srcRIR":"RIPE","srcTTL":[53],"srcTTLCnt":1,"tags":["sensor:netcup-ts","netcup-ts","honeypot"],"tagsCnt":3,"tcp":{"ja4t":["65535_2-1-3-1-1-4_1460_8"],"ja4tCnt":1,"ja4ts":["42340_2-1-1-4-1-3_1460_11"],"ja4tsCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":3147991667},"totDataBytes":0} +{"@timestamp":1787516437782,"_id":"260823-G-hgQ04SsDlEYq8OMs2L2E1T","_index":"arkime_sessions3-260823","client":{"bytes":261},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["FlokiNET Ltd"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["FlokiNET Ltd"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":441,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":5,"port":443},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstPayload8":"485454502f312e31","dstRIR":"RIPE","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[78451],"firstPacket":1787515571202,"http":{"bodyMagic":["text/plain"],"bodyMagicCnt":1,"md5":["6196dba52703776af2e6593f772ed7ce"],"md5Cnt":1,"responseHeader":["connection","content-type"],"responseHeaderCnt":2,"responseHeaderField":["content-type","connection"],"responseHeaderValue":["text/plain; charset=utf-8","close"],"responseHeaderValueCnt":2,"serverVersion":["1.1"],"serverVersionCnt":1,"sha256":["19b843cc92cb12aa314bb3c3913b2feeb852e85969bf06cb9d096931bfda34ba"],"sha256Cnt":1,"statuscode":[400],"statuscodeCnt":1},"initRTT":613,"ipProtocol":6,"lastPacket":1787515572681,"length":1479,"network":{"bytes":1180,"community_id":"1:jtxKR2NXqiNXOxeKn75K2DPh8jc=","packets":12},"node":"spark-afae","packetPos":[-78451,5771659,90,19060,2449,82,343,82,185,2564,216,82,0],"packetRange":{"gte":1787515571202,"lte":1787515572681},"protocol":["tls","tcp","http"],"protocolCnt":3,"segmentCnt":1,"server":{"bytes":103},"source":{"as":{"full":"AS200651 FlokiNET ehf","number":200651,"organization":{"name":"FlokiNET ehf"}},"bytes":739,"geo":{"country_iso_code":"RO"},"ip":"185.100.87.136","mac":["fc:bd:67:9d:2b:2b","00:c0:1d:c0:ff:ee"],"mac-cnt":2,"packets":7,"port":52228},"srcOui":["Arista Networks","Grand Junction Networks, Inc."],"srcOuiCnt":2,"srcPayload8":"1603010100010000","srcRIR":"RIPE","srcTTL":[56],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["869139772845556"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["ac32bdeb-b49d-4079-9e6b-8fbca5e0addf"],"signatureCnt":1,"signatureId":[1031336],"signatureIdCnt":1},"tag":{"block":["false"],"blockCnt":1,"category":["protocol"],"categoryCnt":1,"description":["ip addresses with this tag have been observed attempting to opportunistically crawl the internet and establish tls/ssl connections."],"intention":["unknown"],"intentionCnt":1,"name":["tls/ssl crawler"],"nameCnt":1},"tags":["sensor:contabo-sponge-01-ts","contabo-sponge-01-ts","honeypot"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-4-8-1-3_1460_7"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":5,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":2,"psh":2,"rst":0,"srcZero":0,"syn":2,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":1435215093},"tls":{"ja3":["7c1e207beb00684bbbe144f1b0abe1d5"],"ja3Cnt":1,"ja3string":["771,52392-52393-49199-49200-49195-49196-49171-49161-49172-49162-156-157-47-53-49170-10-4867-4865-4866,5-10-11-13-65281-16-18-43-51,29-23-24-25,0"],"ja3stringCnt":1,"ja4":["t13i1909h2_9dc949149365_97f8aa674fd9"],"ja4Cnt":1,"ja4_r":["t13i1909h2_000a,002f,0035,009c,009d,1301,1302,1303,c009,c00a,c012,c013,c014,c02b,c02c,c02f,c030,cca8,cca9_0005,000a,000b,000d,0012,002b,0033,ff01_0804,0403,0807,0805,0806,0401,0501,0601,0503,0603,0201,0203"],"ja4_rCnt":1,"srcSessionId":["b37cc194dff05aee07ca27f61d8668cc9917d3bccd81954e21dbba433985135e"]},"totDataBytes":364} +{"@timestamp":1787516134237,"_id":"260823-bJJ8RBOiM6dOgaS2At7YKeQV","_index":"arkime_sessions3-260823","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo GmbH"],"isp.dstCnt":1,"isp.src":["FlokiNET Ltd"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["FlokiNET Ltd"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS51167 Contabo GmbH","number":51167,"organization":{"name":"Contabo GmbH"}},"bytes":66,"geo":{"country_iso_code":"FR"},"ip":"109.123.246.142","mac":["00:50:56:63:46:a6"],"mac-cnt":1,"packets":1,"port":443},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[78448],"firstPacket":1787515498615,"ipProtocol":6,"lastPacket":1787515499709,"length":1094,"network":{"bytes":192,"community_id":"1:5U1pMkNXiEHluw0RK+q21rYw6Es=","packets":3},"node":"spark-afae","packetPos":[-78448,108316,82,410],"packetRange":{"gte":1787515498615,"lte":1787515499709},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS200651 FlokiNET ehf","number":200651,"organization":{"name":"FlokiNET ehf"}},"bytes":126,"geo":{"country_iso_code":"RO"},"ip":"185.100.87.136","mac":["c0:69:11:cd:1f:19","00:c0:1d:c0:ff:ee"],"mac-cnt":2,"packets":2,"port":55463},"srcOui":["Arista Networks","Grand Junction Networks, Inc."],"srcOuiCnt":2,"srcRIR":"RIPE","srcTTL":[49],"srcTTLCnt":1,"tags":["contabo-sponge-02-ts","sensor:contabo-sponge-02-ts","proxy"],"tagsCnt":3,"tcp":{"ja4t":["65535_2-1-3-1-1-4_1460_8"],"ja4tCnt":1,"ja4ts":["64240_2-1-1-4-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":2798259832},"totDataBytes":0} +{"@timestamp":1787513686657,"_id":"260823-uOfw0Fmtr7NIaLzBT4oxK6Mx","_index":"arkime_sessions3-260823","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["FlokiNET Ltd"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["FlokiNET Ltd"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":66,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":1,"port":443},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[78436],"firstPacket":1787513413587,"ipProtocol":6,"lastPacket":1787513414798,"length":1211,"network":{"bytes":192,"community_id":"1:MxQoED+dG9wA8UkrhFqz2pPUcoc=","packets":3},"node":"spark-afae","packetPos":[-78436,17810709,82,26088],"packetRange":{"gte":1787513413587,"lte":1787513414798},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS200651 FlokiNET ehf","number":200651,"organization":{"name":"FlokiNET ehf"}},"bytes":126,"geo":{"country_iso_code":"RO"},"ip":"185.100.87.136","mac":["00:c0:1d:c0:ff:ee","fc:bd:67:9d:2b:2b"],"mac-cnt":2,"packets":2,"port":60827},"srcOui":["Grand Junction Networks, Inc.","Arista Networks"],"srcOuiCnt":2,"srcRIR":"RIPE","srcTTL":[56],"srcTTLCnt":1,"tags":["sensor:contabo-sponge-01-ts","contabo-sponge-01-ts","honeypot"],"tagsCnt":3,"tcp":{"ja4t":["65535_2-1-3-1-1-4_1460_8"],"ja4tCnt":1,"ja4ts":["64240_2-1-1-4-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":4004336566},"totDataBytes":0} +{"@timestamp":1787413782641,"_id":"260822-DtuwglYLkVhOeZ3kwmq67OIW","_index":"arkime_sessions3-260822","client":{"bytes":174},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["netcup GmbH"],"isp.dstCnt":1,"isp.src":["FlokiNET Ltd"],"isp.srcCnt":1,"org.dst":["Netcup KVM"],"org.dstCnt":1,"org.src":["FlokiNET Ltd"],"org.srcCnt":1,"usertype.dst":["business"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS197540 netcup GmbH","number":197540,"organization":{"name":"netcup GmbH"}},"bytes":384,"geo":{"country_iso_code":"DE"},"ip":"159.195.21.150","mac":["8a:41:d3:b8:0d:d3"],"mac-cnt":1,"packets":4,"port":444},"dstPayload8":"485454502f312e31","dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[77879],"firstPacket":1787412678665,"http":{"clientVersion":["1.1"],"clientVersionCnt":1,"host":["159.195.21.150:444","159.195.21.150"],"hostCnt":2,"ja4h":["ge11nn040000_e1d2031bdfea_000000000000_000000000000"],"ja4hCnt":1,"ja4h_r":["ge11nn040000_Host,User-Agent,Accept,Accept-Encoding__"],"ja4h_rCnt":1,"method":["GET"],"method-GET":1,"methodCnt":1,"path":["/"],"pathCnt":1,"requestHeader":["host","user-agent","accept-encoding","accept"],"requestHeaderCnt":4,"requestHeaderField":["accept","accept-encoding"],"requestHeaderValue":["*/*","gzip"],"requestHeaderValueCnt":2,"response-server":["SonicWall SMA 10.2.0.9-12sv"],"response-serverCnt":1,"responseHeader":["content-length","date","server"],"responseHeaderCnt":3,"responseHeaderField":["date","content-length"],"responseHeaderValue":["sat, 22 aug 2026 15:31:18 gmt","0"],"responseHeaderValueCnt":2,"serverVersion":["1.1"],"serverVersionCnt":1,"statuscode":[200],"statuscodeCnt":1,"uri":["159.195.21.150:444/"],"uriCnt":1,"useragent":["Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:144.0) Gecko/20100101 Firefox/144.0"],"useragentCnt":1},"initRTT":15,"ipProtocol":6,"lastPacket":1787412678809,"length":144,"network":{"bytes":962,"community_id":"1:cXksXWWqv96qzSSFPVrKC7eoGZ0=","packets":10},"node":"spark-afae","packetPos":[-77879,609216,90,0,82,256,288,449,82,0,1060],"packetRange":{"gte":1787412678665,"lte":1787412678809},"protocol":["tcp","http"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":112},"source":{"as":{"full":"AS200651 FlokiNET ehf","number":200651,"organization":{"name":"FlokiNET ehf"}},"bytes":578,"geo":{"country_iso_code":"RO"},"ip":"185.100.87.136","mac":["bc:0f:fe:3d:a3:a7","00:00:5e:00:01:96"],"mac-cnt":2,"packets":6,"port":50324},"srcOui":["ICANN, IANA Department","Juniper Networks"],"srcOuiCnt":2,"srcPayload8":"474554202f204854","srcRIR":"RIPE","srcTTL":[53],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["1730525701401659"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["869feaa1-dc77-4037-aee2-247b7a39cf7d","ee583a2e-d308-4c53-b8e2-a1cd45cd1bb7","ce8622a8-6d2f-4fe3-ab81-0cc86e19363e"],"signatureCnt":3,"signatureId":[2000166,1031486,2000008],"signatureIdCnt":3},"tag":{"block":["true","false"],"blockCnt":2,"category":["attack","protocol","recon"],"categoryCnt":3,"cves":[""],"cvesCnt":1,"description":["ip addresses with this tag have been seen crawling http(s) servers around the internet.","cloud credential scanning probe detected. requests for sensitive configuration files and credentials indicate automated scanning for exposed secrets and api keys.","generic web crawler traffic detected. the simple pattern of get requests without specific exploitation indicators suggests automated crawling activity, possibly for search indexing or vulnerability scanning."],"intention":["unknown","suspicious"],"intentionCnt":2,"name":["root path scanner","web crawler"],"nameCnt":2},"tags":["honeypot","sensor:netcup-ts","netcup-ts"],"tagsCnt":3,"tcp":{"ja4ls":"36_64_tcp","ja4t":["64240_2-4-8-1-3_1460_7"],"ja4tCnt":1,"ja4ts":["43440_2-4-8-1-3_1460_11"],"ja4tsCnt":1},"tcpflags":{"ack":4,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":2,"psh":2,"rst":0,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":2386129455},"totDataBytes":286} +{"@timestamp":1787413782641,"_id":"260822-DtvpEWCixvlLA6EsFmD3-pXn","_index":"arkime_sessions3-260822","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["netcup GmbH"],"isp.dstCnt":1,"isp.src":["FlokiNET Ltd"],"isp.srcCnt":1,"org.dst":["Netcup KVM"],"org.dstCnt":1,"org.src":["FlokiNET Ltd"],"org.srcCnt":1,"usertype.dst":["business"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS197540 netcup GmbH","number":197540,"organization":{"name":"netcup GmbH"}},"bytes":66,"geo":{"country_iso_code":"DE"},"ip":"159.195.21.150","mac":["8a:41:d3:b8:0d:d3"],"mac-cnt":1,"packets":1,"port":444},"dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[77879],"firstPacket":1787412678601,"ipProtocol":6,"lastPacket":1787412678632,"length":31,"network":{"bytes":188,"community_id":"1:eFu3f0LcW40Qx6vUZWhEiKpcwTA=","packets":3},"node":"spark-afae","packetPos":[-77879,608816,82,246],"packetRange":{"gte":1787412678601,"lte":1787412678632},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS200651 FlokiNET ehf","number":200651,"organization":{"name":"FlokiNET ehf"}},"bytes":122,"geo":{"country_iso_code":"RO"},"ip":"185.100.87.136","mac":["bc:0f:fe:3d:a3:a7","00:00:5e:00:01:96"],"mac-cnt":2,"packets":2,"port":59076},"srcOui":["ICANN, IANA Department","Juniper Networks"],"srcOuiCnt":2,"srcRIR":"RIPE","srcTTL":[53],"srcTTLCnt":1,"tags":["honeypot","sensor:netcup-ts","netcup-ts"],"tagsCnt":3,"tcp":{"ja4t":["65535_2-1-3-1-1-4_1460_8"],"ja4tCnt":1,"ja4ts":["42340_2-1-1-4-1-3_1460_11"],"ja4tsCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":2558387445},"totDataBytes":0} +{"@timestamp":1787411962847,"_id":"260822-19o7fyKihstGxJVgmZENXHbD","_index":"arkime_sessions3-260822","client":{"bytes":174},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["FlokiNET Ltd"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["FlokiNET Ltd"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":625,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":5,"port":444},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstPayload8":"485454502f312e31","dstRIR":"RIPE","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[77869],"firstPacket":1787411695522,"http":{"bodyMagic":["text/html"],"bodyMagicCnt":1,"clientVersion":["1.1"],"clientVersionCnt":1,"host":["217.15.163.226:444","217.15.163.226"],"hostCnt":2,"ja4h":["ge11nn040000_e1d2031bdfea_000000000000_000000000000"],"ja4hCnt":1,"ja4h_r":["ge11nn040000_Host,User-Agent,Accept,Accept-Encoding__"],"ja4h_rCnt":1,"md5":["0f87454a3ea15f0db55ae928dbcd82fc"],"md5Cnt":1,"method":["GET"],"method-GET":1,"methodCnt":1,"path":["/"],"pathCnt":1,"requestHeader":["accept","accept-encoding","host","user-agent"],"requestHeaderCnt":4,"requestHeaderField":["accept","accept-encoding"],"requestHeaderValue":["*/*","gzip"],"requestHeaderValueCnt":2,"response-server":["Apache/2.4.41 (Ubuntu)"],"response-serverCnt":1,"response-x-powered-by":["PHP/7.4.3"],"response-x-powered-byCnt":1,"responseHeader":["date","connection","content-type","server","content-length","x-powered-by"],"responseHeaderCnt":6,"responseHeaderField":["connection","content-type","date","content-length"],"responseHeaderValue":["close","text/plain; charset=utf-8","sat, 22 aug 2026 15:14:55 gmt","94"],"responseHeaderValueCnt":4,"serverVersion":["1.1"],"serverVersionCnt":1,"sha256":["1ca624415b2889dbeb3f969890b848b7bc5eaf96ca5e8fdd7461f943b45d10cb"],"sha256Cnt":1,"statuscode":[200],"statuscodeCnt":1,"uri":["217.15.163.226:444/"],"uriCnt":1,"useragent":["Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:144.0) Gecko/20100101 Firefox/144.0"],"useragentCnt":1},"initRTT":87,"ipProtocol":6,"lastPacket":1787411695873,"length":351,"network":{"bytes":1137,"community_id":"1:hL/pjg8l0bTVp1C8y7osuCN9tnM=","packets":10},"node":"spark-afae","packetPos":[-77869,3756016,90,180,82,256,82,369,338,82,0],"packetRange":{"gte":1787411695522,"lte":1787411695873},"protocol":["http","tcp"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":287},"source":{"as":{"full":"AS200651 FlokiNET ehf","number":200651,"organization":{"name":"FlokiNET ehf"}},"bytes":512,"geo":{"country_iso_code":"RO"},"ip":"185.100.87.136","mac":["fc:bd:67:9d:2b:2b","00:c0:1d:c0:ff:ee"],"mac-cnt":2,"packets":5,"port":48774},"srcOui":["Arista Networks","Grand Junction Networks, Inc."],"srcOuiCnt":2,"srcPayload8":"474554202f204854","srcRIR":"RIPE","srcTTL":[55],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["2246034578528399"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["869feaa1-dc77-4037-aee2-247b7a39cf7d","ee583a2e-d308-4c53-b8e2-a1cd45cd1bb7","ce8622a8-6d2f-4fe3-ab81-0cc86e19363e"],"signatureCnt":3,"signatureId":[2000166,1031486,2000008],"signatureIdCnt":3},"tag":{"block":["false","true"],"blockCnt":2,"category":["protocol","attack","recon"],"categoryCnt":3,"cves":[""],"cvesCnt":1,"description":["cloud credential scanning probe detected. requests for sensitive configuration files and credentials indicate automated scanning for exposed secrets and api keys.","ip addresses with this tag have been seen crawling http(s) servers around the internet.","generic web crawler traffic detected. the simple pattern of get requests without specific exploitation indicators suggests automated crawling activity, possibly for search indexing or vulnerability scanning."],"intention":["unknown","suspicious"],"intentionCnt":2,"name":["web crawler","root path scanner"],"nameCnt":2},"tags":["contabo-sponge-01-ts","sensor:contabo-sponge-01-ts","honeypot"],"tagsCnt":3,"tcp":{"ja4ls":"64_64_tcp","ja4t":["64240_2-4-8-1-3_1460_7"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":4,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":2,"psh":2,"rst":0,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":3038142346},"totDataBytes":461} +{"@timestamp":1787411962847,"_id":"260822-19ohbc4Xrz5H3qYZ52pXa3Br","_index":"arkime_sessions3-260822","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["FlokiNET Ltd"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["FlokiNET Ltd"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":66,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":1,"port":444},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[77869],"firstPacket":1787411695276,"ipProtocol":6,"lastPacket":1787411695452,"length":176,"network":{"bytes":192,"community_id":"1:Xc604tgQQ4ofZ1woYq2ggEmJI38=","packets":3},"node":"spark-afae","packetPos":[-77869,3754094,82,172],"packetRange":{"gte":1787411695276,"lte":1787411695452},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS200651 FlokiNET ehf","number":200651,"organization":{"name":"FlokiNET ehf"}},"bytes":126,"geo":{"country_iso_code":"RO"},"ip":"185.100.87.136","mac":["fc:bd:67:9d:2b:2b","00:c0:1d:c0:ff:ee"],"mac-cnt":2,"packets":2,"port":52826},"srcOui":["Arista Networks","Grand Junction Networks, Inc."],"srcOuiCnt":2,"srcRIR":"RIPE","srcTTL":[55],"srcTTLCnt":1,"tags":["contabo-sponge-01-ts","sensor:contabo-sponge-01-ts","honeypot"],"tagsCnt":3,"tcp":{"ja4t":["65535_2-1-3-1-1-4_1460_8"],"ja4tCnt":1,"ja4ts":["64240_2-1-1-4-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":4233806052},"totDataBytes":0} +{"@timestamp":1787411355732,"_id":"260822-wdo6PONiQ9lAJ6IYfYpTmkeD","_index":"arkime_sessions3-260822","client":{"bytes":174},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["FlokiNET Ltd"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["FlokiNET Ltd"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":625,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":5,"port":444},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstPayload8":"485454502f312e31","dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[77866],"firstPacket":1787411022842,"http":{"bodyMagic":["text/html"],"bodyMagicCnt":1,"clientVersion":["1.1"],"clientVersionCnt":1,"host":["209.141.62.110","209.141.62.110:444"],"hostCnt":2,"ja4h":["ge11nn040000_e1d2031bdfea_000000000000_000000000000"],"ja4hCnt":1,"ja4h_r":["ge11nn040000_Host,User-Agent,Accept,Accept-Encoding__"],"ja4h_rCnt":1,"md5":["0f87454a3ea15f0db55ae928dbcd82fc"],"md5Cnt":1,"method":["GET"],"method-GET":1,"methodCnt":1,"path":["/"],"pathCnt":1,"requestHeader":["user-agent","accept-encoding","accept","host"],"requestHeaderCnt":4,"requestHeaderField":["accept","accept-encoding"],"requestHeaderValue":["*/*","gzip"],"requestHeaderValueCnt":2,"response-server":["Apache/2.4.41 (Ubuntu)"],"response-serverCnt":1,"response-x-powered-by":["PHP/7.4.3"],"response-x-powered-byCnt":1,"responseHeader":["content-type","content-length","x-powered-by","date","connection","server"],"responseHeaderCnt":6,"responseHeaderField":["connection","content-type","date","content-length"],"responseHeaderValue":["close","text/plain; charset=utf-8","sat, 22 aug 2026 15:03:43 gmt","94"],"responseHeaderValueCnt":4,"serverVersion":["1.1"],"serverVersionCnt":1,"sha256":["1ca624415b2889dbeb3f969890b848b7bc5eaf96ca5e8fdd7461f943b45d10cb"],"sha256Cnt":1,"statuscode":[200],"statuscodeCnt":1,"uri":["209.141.62.110:444/"],"uriCnt":1,"useragent":["Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:144.0) Gecko/20100101 Firefox/144.0"],"useragentCnt":1},"initRTT":84,"ipProtocol":6,"lastPacket":1787411023180,"length":338,"network":{"bytes":1137,"community_id":"1:ucHFu2fjlmijd6xZ+7PhVrSTgnI=","packets":10},"node":"spark-afae","packetPos":[-77866,5353630,90,207,82,256,82,369,82,0,0],"packetRange":{"gte":1787411022842,"lte":1787411023180},"protocol":["tcp","http"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":287},"source":{"as":{"full":"AS200651 FlokiNET ehf","number":200651,"organization":{"name":"FlokiNET ehf"}},"bytes":512,"geo":{"country_iso_code":"RO"},"ip":"185.100.87.136","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":5,"port":44924},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcPayload8":"474554202f204854","srcRIR":"RIPE","srcTTL":[53],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["1928987515723688"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["ce8622a8-6d2f-4fe3-ab81-0cc86e19363e","ee583a2e-d308-4c53-b8e2-a1cd45cd1bb7","869feaa1-dc77-4037-aee2-247b7a39cf7d"],"signatureCnt":3,"signatureId":[2000166,1031486,2000008],"signatureIdCnt":3},"tag":{"block":["false","true"],"blockCnt":2,"category":["recon","attack","protocol"],"categoryCnt":3,"cves":[""],"cvesCnt":1,"description":["ip addresses with this tag have been seen crawling http(s) servers around the internet.","generic web crawler traffic detected. the simple pattern of get requests without specific exploitation indicators suggests automated crawling activity, possibly for search indexing or vulnerability scanning.","cloud credential scanning probe detected. requests for sensitive configuration files and credentials indicate automated scanning for exposed secrets and api keys."],"intention":["suspicious","unknown"],"intentionCnt":2,"name":["web crawler","root path scanner"],"nameCnt":2},"tags":["sensor:frantech-ts","honeypot","frantech-ts"],"tagsCnt":3,"tcp":{"ja4ls":"43_64_tcp","ja4t":["64240_2-4-8-1-3_1400_7"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":4,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":2,"psh":2,"rst":0,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":4015740977},"totDataBytes":461} +{"@timestamp":1787411355732,"_id":"260822-wdo3tZsdc8VIL4BJzI9SaStc","_index":"arkime_sessions3-260822","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["FlokiNET Ltd"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["FlokiNET Ltd"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":66,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":1,"port":444},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[77866],"firstPacket":1787411022626,"ipProtocol":6,"lastPacket":1787411022795,"length":169,"network":{"bytes":186,"community_id":"1:JMALIMKMZDG11QAp4+HG4Gpiiuo=","packets":3},"node":"spark-afae","packetPos":[-77866,5352868,82,542],"packetRange":{"gte":1787411022626,"lte":1787411022795},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS200651 FlokiNET ehf","number":200651,"organization":{"name":"FlokiNET ehf"}},"bytes":120,"geo":{"country_iso_code":"RO"},"ip":"185.100.87.136","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":2,"port":35447},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[53],"srcTTLCnt":1,"tags":["sensor:frantech-ts","honeypot","frantech-ts"],"tagsCnt":3,"tcp":{"ja4t":["65535_2-1-3-1-1-4_1400_8"],"ja4tCnt":1,"ja4ts":["64240_2-1-1-4-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":358145103},"totDataBytes":0} +{"@timestamp":1787410453242,"_id":"260822-oNp7TWiV281CF51K9Wm6dXsb","_index":"arkime_sessions3-260822","client":{"bytes":171},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Kaopu Cloud HK Limited"],"isp.dstCnt":1,"isp.src":["FlokiNET Ltd"],"isp.srcCnt":1,"org.dst":["LightNode-BH"],"org.dstCnt":1,"org.src":["FlokiNET Ltd"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":625,"geo":{"country_iso_code":"BH"},"ip":"38.54.2.209","mac":["52:54:8f:9d:76:48"],"mac-cnt":1,"packets":5,"port":444},"dstPayload8":"485454502f312e31","dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[77862],"firstPacket":1787409789905,"http":{"bodyMagic":["text/html"],"bodyMagicCnt":1,"clientVersion":["1.1"],"clientVersionCnt":1,"host":["38.54.2.209:444","38.54.2.209"],"hostCnt":2,"ja4h":["ge11nn040000_e1d2031bdfea_000000000000_000000000000"],"ja4hCnt":1,"ja4h_r":["ge11nn040000_Host,User-Agent,Accept,Accept-Encoding__"],"ja4h_rCnt":1,"md5":["0f87454a3ea15f0db55ae928dbcd82fc"],"md5Cnt":1,"method":["GET"],"method-GET":1,"methodCnt":1,"path":["/"],"pathCnt":1,"requestHeader":["accept","accept-encoding","host","user-agent"],"requestHeaderCnt":4,"requestHeaderField":["accept","accept-encoding"],"requestHeaderValue":["*/*","gzip"],"requestHeaderValueCnt":2,"response-server":["Apache/2.4.41 (Ubuntu)"],"response-serverCnt":1,"response-x-powered-by":["PHP/7.4.3"],"response-x-powered-byCnt":1,"responseHeader":["content-type","connection","date","x-powered-by","content-length","server"],"responseHeaderCnt":6,"responseHeaderField":["connection","content-type","date","content-length"],"responseHeaderValue":["close","text/plain; charset=utf-8","sat, 22 aug 2026 14:43:10 gmt","94"],"responseHeaderValueCnt":4,"serverVersion":["1.1"],"serverVersionCnt":1,"sha256":["1ca624415b2889dbeb3f969890b848b7bc5eaf96ca5e8fdd7461f943b45d10cb"],"sha256Cnt":1,"statuscode":[200],"statuscodeCnt":1,"uri":["38.54.2.209:444/"],"uriCnt":1,"useragent":["Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:144.0) Gecko/20100101 Firefox/144.0"],"useragentCnt":1},"initRTT":61,"ipProtocol":6,"lastPacket":1787409790148,"length":243,"network":{"bytes":1134,"community_id":"1:oeWSjJO2sgU9gOF15P7INXoPx7Y=","packets":10},"node":"spark-afae","packetPos":[-77862,1117488,90,160,82,253,82,369,234,82,0],"packetRange":{"gte":1787409789905,"lte":1787409790148},"protocol":["http","tcp"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":287},"source":{"as":{"full":"AS200651 FlokiNET ehf","number":200651,"organization":{"name":"FlokiNET ehf"}},"bytes":509,"geo":{"country_iso_code":"RO"},"ip":"185.100.87.136","mac":["98:44:ce:60:15:19"],"mac-cnt":1,"packets":5,"port":42186},"srcOui":["Huawei Technologies Co.,Ltd"],"srcOuiCnt":1,"srcPayload8":"474554202f204854","srcRIR":"RIPE","srcTTL":[51],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["1638464076028204"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["ce8622a8-6d2f-4fe3-ab81-0cc86e19363e","869feaa1-dc77-4037-aee2-247b7a39cf7d","ee583a2e-d308-4c53-b8e2-a1cd45cd1bb7"],"signatureCnt":3,"signatureId":[2000166,1031486,2000008],"signatureIdCnt":3},"tag":{"block":["false","true"],"blockCnt":2,"category":["protocol","recon","attack"],"categoryCnt":3,"cves":[""],"cvesCnt":1,"description":["generic web crawler traffic detected. the simple pattern of get requests without specific exploitation indicators suggests automated crawling activity, possibly for search indexing or vulnerability scanning.","cloud credential scanning probe detected. requests for sensitive configuration files and credentials indicate automated scanning for exposed secrets and api keys.","ip addresses with this tag have been seen crawling http(s) servers around the internet."],"intention":["unknown","suspicious"],"intentionCnt":2,"name":["web crawler","root path scanner"],"nameCnt":2},"tags":["honeypot","sensor:bahrain-sponge-01-ts","bahrain-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4ls":"55_64_tcp","ja4t":["64240_2-4-8-1-3_1460_7"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":4,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":2,"psh":2,"rst":0,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":1132809182},"totDataBytes":458} +{"@timestamp":1787410453217,"_id":"260822-oNrh_JmTFKxFB6Qee74jILUJ","_index":"arkime_sessions3-260822","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Kaopu Cloud HK Limited"],"isp.dstCnt":1,"isp.src":["FlokiNET Ltd"],"isp.srcCnt":1,"org.dst":["LightNode-BH"],"org.dstCnt":1,"org.src":["FlokiNET Ltd"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":66,"geo":{"country_iso_code":"BH"},"ip":"38.54.2.209","mac":["52:54:8f:9d:76:48"],"mac-cnt":1,"packets":1,"port":444},"dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[77862],"firstPacket":1787409789691,"ipProtocol":6,"lastPacket":1787409789811,"length":120,"network":{"bytes":186,"community_id":"1:sXRWEdVCTSBMp+3qj07FZn5ijA0=","packets":3},"node":"spark-afae","packetPos":[-77862,1117184,82,152],"packetRange":{"gte":1787409789691,"lte":1787409789811},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS200651 FlokiNET ehf","number":200651,"organization":{"name":"FlokiNET ehf"}},"bytes":120,"geo":{"country_iso_code":"RO"},"ip":"185.100.87.136","mac":["98:44:ce:60:15:19"],"mac-cnt":1,"packets":2,"port":55809},"srcOui":["Huawei Technologies Co.,Ltd"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[52],"srcTTLCnt":1,"tags":["honeypot","sensor:bahrain-sponge-01-ts","bahrain-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["65535_2-1-3-1-1-4_1460_8"],"ja4tCnt":1,"ja4ts":["64240_2-1-1-4-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":511279777},"totDataBytes":0} +{"@timestamp":1787408945075,"_id":"260822-adpykUxRSUZKAq0RFaZRD2TM","_index":"arkime_sessions3-260822","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo GmbH"],"isp.dstCnt":1,"isp.src":["FlokiNET Ltd"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["FlokiNET Ltd"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS51167 Contabo GmbH","number":51167,"organization":{"name":"Contabo GmbH"}},"bytes":0,"geo":{"country_iso_code":"FR"},"ip":"109.123.246.142","mac":["00:50:56:63:46:a6"],"mac-cnt":1,"packets":0,"port":444},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[77853],"firstPacket":1787407935304,"ipProtocol":6,"lastPacket":1787407935304,"length":0,"network":{"bytes":66,"community_id":"1:rZRjVzbqc1bE4RK7yu+Lootkkcs=","packets":1},"node":"spark-afae","packetPos":[-77853,7591],"packetRange":{"gte":1787407935304,"lte":1787407935304},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS200651 FlokiNET ehf","number":200651,"organization":{"name":"FlokiNET ehf"}},"bytes":66,"geo":{"country_iso_code":"RO"},"ip":"185.100.87.136","mac":["c0:69:11:cd:1f:19"],"mac-cnt":1,"packets":1,"port":48333},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[49],"srcTTLCnt":1,"tags":["contabo-sponge-02-ts","sensor:contabo-sponge-02-ts","proxy"],"tagsCnt":3,"tcp":{"ja4t":["65535_2-1-3-1-1-4_1460_8"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":2274244197},"totDataBytes":0} +{"@timestamp":1787282291741,"_id":"260821-rX8VP1oGUylBX7thi2ekOjwK","_index":"arkime_sessions3-260821","client":{"bytes":30},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["netcup GmbH"],"isp.dstCnt":1,"isp.src":["FlokiNET Ltd"],"isp.srcCnt":1,"org.dst":["Netcup KVM"],"org.dstCnt":1,"org.src":["FlokiNET Ltd"],"org.srcCnt":1,"usertype.dst":["business"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS197540 netcup GmbH","number":197540,"organization":{"name":"netcup GmbH"}},"bytes":0,"geo":{"country_iso_code":"DE"},"ip":"159.195.21.150","mac":["8a:41:d3:b8:0d:d3"],"mac-cnt":1,"packets":0,"port":53},"dns":[{"host":["version.bind"],"hostCnt":1,"opcode":"QUERY","qc":"CH","qt":"TXT","queryHost":"version.bind"}],"dnsCnt":1,"dstRIR":"ARIN","ethertype":2048,"fileId":[77149],"firstPacket":1787281486958,"ipProtocol":17,"lastPacket":1787281486958,"length":0,"network":{"bytes":72,"community_id":"1:rS+rUnaBdcn6viYerADFmMYTfqc=","packets":1},"node":"spark-afae","packetPos":[-77149,894788],"packetRange":{"gte":1787281486958,"lte":1787281486958},"protocol":["dns","udp"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS200651 FlokiNET ehf","number":200651,"organization":{"name":"FlokiNET ehf"}},"bytes":72,"geo":{"country_iso_code":"RO"},"ip":"185.100.87.136","mac":["bc:0f:fe:3d:a3:a7"],"mac-cnt":1,"packets":1,"port":33004},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcPayload8":"34ef010000010000","srcRIR":"RIPE","srcTTL":[53],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["1863383062483447"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["bfd5c1ca-a1b3-418c-8643-5e916ad156e4"],"signatureCnt":1,"signatureId":[1071781],"signatureIdCnt":1},"tag":{"block":["false"],"blockCnt":1,"category":["protocol"],"categoryCnt":1,"description":["ip addresses with this tag have been observed sending dns traffic."],"intention":["unknown"],"intentionCnt":1,"name":["dns protocol"],"nameCnt":1},"tags":["sensor:netcup-ts","netcup-ts","honeypot"],"tagsCnt":3,"totDataBytes":30} +{"@timestamp":1787278676513,"_id":"260821-IcnZ6ZuxsJBES4VTNA0SwVSN","_index":"arkime_sessions3-260821","client":{"bytes":30},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["FlokiNET Ltd"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["FlokiNET Ltd"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":0,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":0,"port":53},"dns":[{"host":["version.bind"],"hostCnt":1,"opcode":"QUERY","qc":"CH","qt":"TXT","queryHost":"version.bind"}],"dnsCnt":1,"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[77130],"firstPacket":1787278287291,"ipProtocol":17,"lastPacket":1787278287291,"length":0,"network":{"bytes":72,"community_id":"1:LeWvFXAKYxjUt+Hy1PId1fEZVVk=","packets":1},"node":"spark-afae","packetPos":[-77130,2438946],"packetRange":{"gte":1787278287291,"lte":1787278287291},"protocol":["udp","dns"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS200651 FlokiNET ehf","number":200651,"organization":{"name":"FlokiNET ehf"}},"bytes":72,"geo":{"country_iso_code":"RO"},"ip":"185.100.87.136","mac":["fc:bd:67:9d:2b:2b"],"mac-cnt":1,"packets":1,"port":49281},"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcPayload8":"34ef010000010000","srcRIR":"RIPE","srcTTL":[55],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["2095101400722955"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["bfd5c1ca-a1b3-418c-8643-5e916ad156e4"],"signatureCnt":1,"signatureId":[1071781],"signatureIdCnt":1},"tag":{"block":["false"],"blockCnt":1,"category":["protocol"],"categoryCnt":1,"description":["ip addresses with this tag have been observed sending dns traffic."],"intention":["unknown"],"intentionCnt":1,"name":["dns protocol"],"nameCnt":1},"tags":["contabo-sponge-01-ts","honeypot","sensor:contabo-sponge-01-ts"],"tagsCnt":3,"totDataBytes":30} +{"@timestamp":1787278976591,"_id":"260821-LMkYKnGzJEtGSIw2c5kT_pFe","_index":"arkime_sessions3-260821","client":{"bytes":30},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["FlokiNET Ltd"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["FlokiNET Ltd"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":0,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":0,"port":53},"dns":[{"host":["version.bind"],"hostCnt":1,"opcode":"QUERY","qc":"CH","qt":"TXT","queryHost":"version.bind"}],"dnsCnt":1,"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstRIR":"ARIN","ethertype":2048,"fileId":[77131],"firstPacket":1787278250285,"ipProtocol":17,"lastPacket":1787278250285,"length":0,"network":{"bytes":72,"community_id":"1:JzAMfn7ioIhQA7mMSH0/8FdhnWI=","packets":1},"node":"spark-afae","packetPos":[-77131,5518684],"packetRange":{"gte":1787278250285,"lte":1787278250285},"protocol":["dns","udp"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS200651 FlokiNET ehf","number":200651,"organization":{"name":"FlokiNET ehf"}},"bytes":72,"geo":{"country_iso_code":"RO"},"ip":"185.100.87.136","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":1,"port":57933},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcPayload8":"34ef010000010000","srcRIR":"RIPE","srcTTL":[52],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["662156494680445"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["bfd5c1ca-a1b3-418c-8643-5e916ad156e4"],"signatureCnt":1,"signatureId":[1071781],"signatureIdCnt":1},"tag":{"block":["false"],"blockCnt":1,"category":["protocol"],"categoryCnt":1,"description":["ip addresses with this tag have been observed sending dns traffic."],"intention":["unknown"],"intentionCnt":1,"name":["dns protocol"],"nameCnt":1},"tags":["honeypot","sensor:frantech-ts","frantech-ts"],"tagsCnt":3,"totDataBytes":30} +{"@timestamp":1787278385899,"_id":"260821-YH-veAzdeANH4LMXR1Ui4hiO","_index":"arkime_sessions3-260821","client":{"bytes":30},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo GmbH"],"isp.dstCnt":1,"isp.src":["FlokiNET Ltd"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["FlokiNET Ltd"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS51167 Contabo GmbH","number":51167,"organization":{"name":"Contabo GmbH"}},"bytes":0,"geo":{"country_iso_code":"FR"},"ip":"109.123.246.142","mac":["00:50:56:63:46:a6"],"mac-cnt":1,"packets":0,"port":53},"dns":[{"host":["version.bind"],"hostCnt":1,"opcode":"QUERY","qc":"CH","qt":"TXT","queryHost":"version.bind"}],"dnsCnt":1,"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[77128],"firstPacket":1787277934755,"ipProtocol":17,"lastPacket":1787277934755,"length":0,"network":{"bytes":72,"community_id":"1:VOOaT5cW8GCZOc/oAZslxVRiIhw=","packets":1},"node":"spark-afae","packetPos":[-77128,19420043],"packetRange":{"gte":1787277934755,"lte":1787277934755},"protocol":["dns","udp"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS200651 FlokiNET ehf","number":200651,"organization":{"name":"FlokiNET ehf"}},"bytes":72,"geo":{"country_iso_code":"RO"},"ip":"185.100.87.136","mac":["c0:69:11:cd:1f:19"],"mac-cnt":1,"packets":1,"port":34160},"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcPayload8":"34ef010000010000","srcRIR":"RIPE","srcTTL":[49],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["1836329107529297"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["bfd5c1ca-a1b3-418c-8643-5e916ad156e4"],"signatureCnt":1,"signatureId":[1071781],"signatureIdCnt":1},"tag":{"block":["false"],"blockCnt":1,"category":["protocol"],"categoryCnt":1,"description":["ip addresses with this tag have been observed sending dns traffic."],"intention":["unknown"],"intentionCnt":1,"name":["dns protocol"],"nameCnt":1},"tags":["sensor:contabo-sponge-02-ts","contabo-sponge-02-ts","proxy"],"tagsCnt":3,"totDataBytes":30} +{"@timestamp":1787276573924,"_id":"260821-1Mi-SYKM8E9EVaKoW1BDnxIj","_index":"arkime_sessions3-260821","client":{"bytes":30},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Kaopu Cloud HK Limited"],"isp.dstCnt":1,"isp.src":["FlokiNET Ltd"],"isp.srcCnt":1,"org.dst":["LightNode-BH"],"org.dstCnt":1,"org.src":["FlokiNET Ltd"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":0,"geo":{"country_iso_code":"BH"},"ip":"38.54.2.209","mac":["52:54:8f:9d:76:48"],"mac-cnt":1,"packets":0,"port":53},"dns":[{"host":["version.bind"],"hostCnt":1,"opcode":"QUERY","qc":"CH","qt":"TXT","queryHost":"version.bind"}],"dnsCnt":1,"dstRIR":"ARIN","ethertype":2048,"fileId":[77117],"firstPacket":1787275566698,"ipProtocol":17,"lastPacket":1787275566698,"length":0,"network":{"bytes":72,"community_id":"1:7ysETYXyRDZx3rFbIlMUt6Zyehg=","packets":1},"node":"spark-afae","packetPos":[-77117,851305],"packetRange":{"gte":1787275566698,"lte":1787275566698},"protocol":["udp","dns"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS200651 FlokiNET ehf","number":200651,"organization":{"name":"FlokiNET ehf"}},"bytes":72,"geo":{"country_iso_code":"RO"},"ip":"185.100.87.136","mac":["98:44:ce:60:15:19"],"mac-cnt":1,"packets":1,"port":37721},"srcOui":["Huawei Technologies Co.,Ltd"],"srcOuiCnt":1,"srcPayload8":"34ef010000010000","srcRIR":"RIPE","srcTTL":[52],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["1873085448933687"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["bfd5c1ca-a1b3-418c-8643-5e916ad156e4"],"signatureCnt":1,"signatureId":[1071781],"signatureIdCnt":1},"tag":{"block":["false"],"blockCnt":1,"category":["protocol"],"categoryCnt":1,"description":["ip addresses with this tag have been observed sending dns traffic."],"intention":["unknown"],"intentionCnt":1,"name":["dns protocol"],"nameCnt":1},"tags":["bahrain-sponge-01-ts","honeypot","sensor:bahrain-sponge-01-ts"],"tagsCnt":3,"totDataBytes":30} +{"@timestamp":1787235184868,"_id":"260820-P8OnJDJJXi9HwZ4VrjeAB1ei","_index":"arkime_sessions3-260820","client":{"bytes":13},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Kaopu Cloud HK Limited"],"isp.dstCnt":1,"isp.src":["FlokiNET Ltd"],"isp.srcCnt":1,"org.dst":["LightNode-BH"],"org.dstCnt":1,"org.src":["FlokiNET Ltd"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":375,"geo":{"country_iso_code":"BH"},"ip":"38.54.2.209","mac":["52:54:8f:9d:76:48"],"mac-cnt":1,"packets":4,"port":443},"dstPayload8":"485454502f312e31","dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[76886],"firstPacket":1787234689247,"http":{"bodyMagic":["text/plain"],"bodyMagicCnt":1,"md5":["6196dba52703776af2e6593f772ed7ce"],"md5Cnt":1,"responseHeader":["connection","content-type"],"responseHeaderCnt":2,"responseHeaderField":["content-type","connection"],"responseHeaderValue":["text/plain; charset=utf-8","close"],"responseHeaderValueCnt":2,"serverVersion":["1.1"],"serverVersionCnt":1,"sha256":["19b843cc92cb12aa314bb3c3913b2feeb852e85969bf06cb9d096931bfda34ba"],"sha256Cnt":1,"statuscode":[400],"statuscodeCnt":1},"initRTT":60,"ipProtocol":6,"lastPacket":1787234699369,"length":10122,"network":{"bytes":714,"community_id":"1:vsgU/eXwN+hTyyBLDT68cgxudyU=","packets":9},"node":"spark-afae","packetPos":[-76886,1350181,90,357,82,95,2348,82,185,82],"packetRange":{"gte":1787234689247,"lte":1787234699369},"protocol":["tcp","http","tls"],"protocolCnt":3,"segmentCnt":1,"server":{"bytes":103},"source":{"as":{"full":"AS200651 FlokiNET ehf","number":200651,"organization":{"name":"FlokiNET ehf"}},"bytes":339,"geo":{"country_iso_code":"RO"},"ip":"185.100.87.136","mac":["98:44:ce:60:15:19"],"mac-cnt":1,"packets":5,"port":49380},"srcOui":["Huawei Technologies Co.,Ltd"],"srcOuiCnt":1,"srcPayload8":"1603000008010101","srcRIR":"RIPE","srcTTL":[51],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["499311212942682"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["ac32bdeb-b49d-4079-9e6b-8fbca5e0addf"],"signatureCnt":1,"signatureId":[1031336],"signatureIdCnt":1},"tag":{"block":["false"],"blockCnt":1,"category":["protocol"],"categoryCnt":1,"description":["ip addresses with this tag have been observed attempting to opportunistically crawl the internet and establish tls/ssl connections."],"intention":["unknown"],"intentionCnt":1,"name":["tls/ssl crawler"],"nameCnt":1},"tags":["bahrain-sponge-01-ts","honeypot","sensor:bahrain-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4ls":"49_64_4939768","ja4t":["64240_2-4-8-1-3_1460_7"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":2,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":2,"psh":2,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":3479985102},"tls":{"ja3":["65e083060901bd26e31a66556ae6396b"],"ja3Cnt":1,"ja3string":["257,,,"],"ja3stringCnt":1,"ja4":["t00i000000_000000000000_000000000000"],"ja4Cnt":1,"ja4_r":["t00i000000__"],"ja4_rCnt":1},"totDataBytes":116} +{"@timestamp":1787235184868,"_id":"260820-P8N89ka3ZyNO7YjM1I7gaVfA","_index":"arkime_sessions3-260820","client":{"bytes":16},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Kaopu Cloud HK Limited"],"isp.dstCnt":1,"isp.src":["FlokiNET Ltd"],"isp.srcCnt":1,"org.dst":["LightNode-BH"],"org.dstCnt":1,"org.src":["FlokiNET Ltd"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":375,"geo":{"country_iso_code":"BH"},"ip":"38.54.2.209","mac":["52:54:8f:9d:76:48"],"mac-cnt":1,"packets":4,"port":443},"dstPayload8":"485454502f312e31","dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[76886],"firstPacket":1787234680246,"http":{"bodyMagic":["text/plain"],"bodyMagicCnt":1,"md5":["6196dba52703776af2e6593f772ed7ce"],"md5Cnt":1,"responseHeader":["connection","content-type"],"responseHeaderCnt":2,"responseHeaderField":["content-type","connection"],"responseHeaderValue":["text/plain; charset=utf-8","close"],"responseHeaderValueCnt":2,"serverVersion":["1.1"],"serverVersionCnt":1,"sha256":["19b843cc92cb12aa314bb3c3913b2feeb852e85969bf06cb9d096931bfda34ba"],"sha256Cnt":1,"statuscode":[400],"statuscodeCnt":1},"initRTT":60,"ipProtocol":6,"lastPacket":1787234689368,"length":9122,"network":{"bytes":717,"community_id":"1:zwPXy8sQSlIDWhOW+WGMfCgNjAk=","packets":9},"node":"spark-afae","packetPos":[-76886,1348709,90,0,82,98,1030,262,185,341],"packetRange":{"gte":1787234680246,"lte":1787234689368},"protocol":["tcp","http"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":103},"source":{"as":{"full":"AS200651 FlokiNET ehf","number":200651,"organization":{"name":"FlokiNET ehf"}},"bytes":342,"geo":{"country_iso_code":"RO"},"ip":"185.100.87.136","mac":["98:44:ce:60:15:19"],"mac-cnt":1,"packets":5,"port":47096},"srcOui":["Huawei Technologies Co.,Ltd"],"srcOuiCnt":1,"srcPayload8":"1020000042424242","srcRIR":"RIPE","srcTTL":[51],"srcTTLCnt":1,"tags":["bahrain-sponge-01-ts","honeypot","sensor:bahrain-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4ls":"43_64_4439963","ja4t":["64240_2-4-8-1-3_1460_7"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":2,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":2,"psh":2,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":1160713571},"totDataBytes":119} +{"@timestamp":1787229473063,"_id":"260820-WXt1p9OJYIlDk79-NF33whS-","_index":"arkime_sessions3-260820","client":{"bytes":13},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["netcup GmbH"],"isp.dstCnt":1,"isp.src":["FlokiNET Ltd"],"isp.srcCnt":1,"org.dst":["Netcup KVM"],"org.dstCnt":1,"org.src":["FlokiNET Ltd"],"org.srcCnt":1,"usertype.dst":["business"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS197540 netcup GmbH","number":197540,"organization":{"name":"netcup GmbH"}},"bytes":375,"geo":{"country_iso_code":"DE"},"ip":"159.195.21.150","mac":["8a:41:d3:b8:0d:d3"],"mac-cnt":1,"packets":4,"port":443},"dstPayload8":"485454502f312e31","dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[76855],"firstPacket":1787228550688,"http":{"bodyMagic":["text/plain"],"bodyMagicCnt":1,"md5":["6196dba52703776af2e6593f772ed7ce"],"md5Cnt":1,"responseHeader":["content-type","connection"],"responseHeaderCnt":2,"responseHeaderField":["content-type","connection"],"responseHeaderValue":["text/plain; charset=utf-8","close"],"responseHeaderValueCnt":2,"serverVersion":["1.1"],"serverVersionCnt":1,"sha256":["19b843cc92cb12aa314bb3c3913b2feeb852e85969bf06cb9d096931bfda34ba"],"sha256Cnt":1,"statuscode":[400],"statuscodeCnt":1},"initRTT":15,"ipProtocol":6,"lastPacket":1787228560719,"length":10031,"network":{"bytes":716,"community_id":"1:m5RRUje544bSCNhfzXF8WNahz6M=","packets":9},"node":"spark-afae","packetPos":[-76855,3229378,90,357,226,95,22883,82,185,82],"packetRange":{"gte":1787228550688,"lte":1787228560719},"protocol":["tls","tcp","http"],"protocolCnt":3,"segmentCnt":1,"server":{"bytes":103},"source":{"as":{"full":"AS200651 FlokiNET ehf","number":200651,"organization":{"name":"FlokiNET ehf"}},"bytes":341,"geo":{"country_iso_code":"RO"},"ip":"185.100.87.136","mac":["bc:0f:fe:3d:a3:a7","00:00:5e:00:01:96"],"mac-cnt":2,"packets":5,"port":32882},"srcOui":["Juniper Networks","ICANN, IANA Department"],"srcOuiCnt":2,"srcPayload8":"1603000008010101","srcRIR":"RIPE","srcTTL":[53],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["1830589063226795"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["ac32bdeb-b49d-4079-9e6b-8fbca5e0addf"],"signatureCnt":1,"signatureId":[1031336],"signatureIdCnt":1},"tag":{"block":["false"],"blockCnt":1,"category":["protocol"],"categoryCnt":1,"description":["ip addresses with this tag have been observed attempting to opportunistically crawl the internet and establish tls/ssl connections."],"intention":["unknown"],"intentionCnt":1,"name":["tls/ssl crawler"],"nameCnt":1},"tags":["sensor:netcup-ts","netcup-ts","honeypot"],"tagsCnt":3,"tcp":{"ja4ls":"66_64_4984466","ja4t":["64240_2-4-8-1-3_1460_7"],"ja4tCnt":1,"ja4ts":["43440_2-4-8-1-3_1460_11"],"ja4tsCnt":1},"tcpflags":{"ack":2,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":2,"psh":2,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":2788429998},"tls":{"ja3":["65e083060901bd26e31a66556ae6396b"],"ja3Cnt":1,"ja3string":["257,,,"],"ja3stringCnt":1,"ja4":["t00i000000_000000000000_000000000000"],"ja4Cnt":1,"ja4_r":["t00i000000__"],"ja4_rCnt":1},"totDataBytes":116} +{"@timestamp":1787229472732,"_id":"260820-WXvQ7Bl9g-BKfrJA_QaFlNX2","_index":"arkime_sessions3-260820","client":{"bytes":16},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["netcup GmbH"],"isp.dstCnt":1,"isp.src":["FlokiNET Ltd"],"isp.srcCnt":1,"org.dst":["Netcup KVM"],"org.dstCnt":1,"org.src":["FlokiNET Ltd"],"org.srcCnt":1,"usertype.dst":["business"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS197540 netcup GmbH","number":197540,"organization":{"name":"netcup GmbH"}},"bytes":375,"geo":{"country_iso_code":"DE"},"ip":"159.195.21.150","mac":["8a:41:d3:b8:0d:d3"],"mac-cnt":1,"packets":4,"port":443},"dstPayload8":"485454502f312e31","dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[76855],"firstPacket":1787228541688,"http":{"bodyMagic":["text/plain"],"bodyMagicCnt":1,"md5":["6196dba52703776af2e6593f772ed7ce"],"md5Cnt":1,"responseHeader":["content-type","connection"],"responseHeaderCnt":2,"responseHeaderField":["content-type","connection"],"responseHeaderValue":["text/plain; charset=utf-8","close"],"responseHeaderValueCnt":2,"serverVersion":["1.1"],"serverVersionCnt":1,"sha256":["19b843cc92cb12aa314bb3c3913b2feeb852e85969bf06cb9d096931bfda34ba"],"sha256Cnt":1,"statuscode":[400],"statuscodeCnt":1},"initRTT":15,"ipProtocol":6,"lastPacket":1787228550719,"length":9031,"network":{"bytes":719,"community_id":"1:jVmlSLv1TyRvS16BwTH47suDmQQ=","packets":9},"node":"spark-afae","packetPos":[-76855,3218517,90,0,82,98,10419,262,185,164],"packetRange":{"gte":1787228541688,"lte":1787228550719},"protocol":["tcp","http"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":103},"source":{"as":{"full":"AS200651 FlokiNET ehf","number":200651,"organization":{"name":"FlokiNET ehf"}},"bytes":344,"geo":{"country_iso_code":"RO"},"ip":"185.100.87.136","mac":["bc:0f:fe:3d:a3:a7","00:00:5e:00:01:96"],"mac-cnt":2,"packets":5,"port":32880},"srcOui":["Juniper Networks","ICANN, IANA Department"],"srcOuiCnt":2,"srcPayload8":"1020000042424242","srcRIR":"RIPE","srcTTL":[53],"srcTTLCnt":1,"tags":["sensor:netcup-ts","netcup-ts","honeypot"],"tagsCnt":3,"tcp":{"ja4ls":"51_64_4484639","ja4t":["64240_2-4-8-1-3_1460_7"],"ja4tCnt":1,"ja4ts":["43440_2-4-8-1-3_1460_11"],"ja4tsCnt":1},"tcpflags":{"ack":2,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":2,"psh":2,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":2867468320},"totDataBytes":119} +{"@timestamp":1787224362608,"_id":"260820-4Ho6deXLPG1NIa0k5E4AQsQw","_index":"arkime_sessions3-260820","client":{"bytes":13},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["FlokiNET Ltd"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["FlokiNET Ltd"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":375,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":4,"port":443},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstPayload8":"485454502f312e31","dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[76825],"firstPacket":1787223314504,"http":{"bodyMagic":["text/plain"],"bodyMagicCnt":1,"responseHeader":["connection","content-type"],"responseHeaderCnt":2,"responseHeaderField":["content-type","connection"],"responseHeaderValue":["text/plain; charset=utf-8","close"],"responseHeaderValueCnt":2,"serverVersion":["1.1"],"serverVersionCnt":1,"statuscode":[400],"statuscodeCnt":1},"initRTT":84,"ipProtocol":6,"lastPacket":1787223324669,"length":10165,"network":{"bytes":714,"community_id":"1:Amn+jqdWrpgCfhpE45EezIjYwco=","packets":9},"node":"spark-afae","packetPos":[-76825,1280066,172,357,82,95,12323,82,185,254],"packetRange":{"gte":1787223314504,"lte":1787223324669},"protocol":["tls","http","tcp"],"protocolCnt":3,"rootId":"260820-4Ho6deXLPG1NIa0k5E4AQsQw","segmentCnt":1,"server":{"bytes":103},"source":{"as":{"full":"AS200651 FlokiNET ehf","number":200651,"organization":{"name":"FlokiNET ehf"}},"bytes":339,"geo":{"country_iso_code":"RO"},"ip":"185.100.87.136","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":5,"port":46316},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcPayload8":"1603000008010101","srcRIR":"RIPE","srcTTL":[52],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["758511907217017"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["ac32bdeb-b49d-4079-9e6b-8fbca5e0addf"],"signatureCnt":1,"signatureId":[1031336],"signatureIdCnt":1},"tag":{"block":["false"],"blockCnt":1,"category":["protocol"],"categoryCnt":1,"description":["ip addresses with this tag have been observed attempting to opportunistically crawl the internet and establish tls/ssl connections."],"intention":["unknown"],"intentionCnt":1,"name":["tls/ssl crawler"],"nameCnt":1},"tags":["sensor:frantech-ts","honeypot","frantech-ts"],"tagsCnt":3,"tcp":{"ja4ls":"101_64_4914686","ja4t":["64240_2-4-8-1-3_1400_7"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":2,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":2,"psh":2,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":1448835148},"tls":{"ja3":["65e083060901bd26e31a66556ae6396b"],"ja3Cnt":1,"ja3string":["257,,,"],"ja3stringCnt":1,"ja4":["t00i000000_000000000000_000000000000"],"ja4Cnt":1,"ja4_r":["t00i000000__"],"ja4_rCnt":1},"totDataBytes":116} +{"@timestamp":1787224362620,"_id":"260820-4HpCODEYsX9Ex6xVaHEh4Qb7","_index":"arkime_sessions3-260820","client":{"bytes":16},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["FlokiNET Ltd"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["FlokiNET Ltd"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":375,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":4,"port":443},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstPayload8":"485454502f312e31","dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[76825],"firstPacket":1787223305501,"http":{"bodyMagic":["text/plain"],"bodyMagicCnt":1,"responseHeader":["connection","content-type"],"responseHeaderCnt":2,"responseHeaderField":["content-type","connection"],"responseHeaderValue":["text/plain; charset=utf-8","close"],"responseHeaderValueCnt":2,"serverVersion":["1.1"],"serverVersionCnt":1,"statuscode":[400],"statuscodeCnt":1},"initRTT":84,"ipProtocol":6,"lastPacket":1787223314674,"length":9173,"network":{"bytes":717,"community_id":"1:vueUa5dLFAb30HGdAALnHvon00A=","packets":9},"node":"spark-afae","packetPos":[-76825,1269606,90,160,82,98,10120,172,185,341],"packetRange":{"gte":1787223305501,"lte":1787223314674},"protocol":["http","tcp"],"protocolCnt":2,"rootId":"260820-4HpCODEYsX9Ex6xVaHEh4Qb7","segmentCnt":1,"server":{"bytes":103},"source":{"as":{"full":"AS200651 FlokiNET ehf","number":200651,"organization":{"name":"FlokiNET ehf"}},"bytes":342,"geo":{"country_iso_code":"RO"},"ip":"185.100.87.136","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":5,"port":49576},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcPayload8":"1020000042424242","srcRIR":"RIPE","srcTTL":[53],"srcTTLCnt":1,"tags":["sensor:frantech-ts","honeypot","frantech-ts"],"tagsCnt":3,"tcp":{"ja4ls":"43_64_4417939","ja4t":["64240_2-4-8-1-3_1400_7"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":2,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":2,"psh":2,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":3702674257},"totDataBytes":119} +{"@timestamp":1787208433883,"_id":"260820-dHluWOUbrN9L0IKz_91Vvp1N","_index":"arkime_sessions3-260820","client":{"bytes":13},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo GmbH"],"isp.dstCnt":1,"isp.src":["FlokiNET Ltd"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["FlokiNET Ltd"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS51167 Contabo GmbH","number":51167,"organization":{"name":"Contabo GmbH"}},"bytes":272,"geo":{"country_iso_code":"FR"},"ip":"109.123.246.142","mac":["00:50:56:63:46:a6"],"mac-cnt":1,"packets":4,"port":443},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[76739],"firstPacket":1787207885164,"initRTT":15,"ipProtocol":6,"lastPacket":1787207885331,"length":167,"network":{"bytes":557,"community_id":"1:tg4z6gXSaz5bcefo1vgoKr+k3LY=","packets":8},"node":"spark-afae","packetPos":[-76739,70206357,90,1197,82,95,12771,328,82],"packetRange":{"gte":1787207885164,"lte":1787207885331},"protocol":["tcp","tls"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS200651 FlokiNET ehf","number":200651,"organization":{"name":"FlokiNET ehf"}},"bytes":285,"geo":{"country_iso_code":"RO"},"ip":"185.100.87.136","mac":["c0:69:11:cd:1f:19","00:c0:1d:c0:ff:ee"],"mac-cnt":2,"packets":4,"port":44000},"srcOui":["Arista Networks","Grand Junction Networks, Inc."],"srcOuiCnt":2,"srcPayload8":"1603000008010101","srcRIR":"RIPE","srcTTL":[49],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["1549605034496052"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["ac32bdeb-b49d-4079-9e6b-8fbca5e0addf"],"signatureCnt":1,"signatureId":[1031336],"signatureIdCnt":1},"tag":{"block":["false"],"blockCnt":1,"category":["protocol"],"categoryCnt":1,"description":["ip addresses with this tag have been observed attempting to opportunistically crawl the internet and establish tls/ssl connections."],"intention":["unknown"],"intentionCnt":1,"name":["tls/ssl crawler"],"nameCnt":1},"tags":["contabo-sponge-02-ts","proxy","sensor:contabo-sponge-02-ts"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-4-8-1-3_1460_7"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":3,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":2,"psh":1,"rst":0,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":3700629673},"tls":{"ja3":["65e083060901bd26e31a66556ae6396b"],"ja3Cnt":1,"ja3string":["257,,,"],"ja3stringCnt":1,"ja4":["t00i000000_000000000000_000000000000"],"ja4Cnt":1,"ja4_r":["t00i000000__"],"ja4_rCnt":1},"totDataBytes":13} +{"@timestamp":1787208433883,"_id":"260820-dHkJbbm6UtVJsI1sN5P2RS5b","_index":"arkime_sessions3-260820","client":{"bytes":16},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo GmbH"],"isp.dstCnt":1,"isp.src":["FlokiNET Ltd"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["FlokiNET Ltd"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS51167 Contabo GmbH","number":51167,"organization":{"name":"Contabo GmbH"}},"bytes":206,"geo":{"country_iso_code":"FR"},"ip":"109.123.246.142","mac":["00:50:56:63:46:a6"],"mac-cnt":1,"packets":3,"port":443},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[76739],"firstPacket":1787207884992,"initRTT":17,"ipProtocol":6,"lastPacket":1787207885133,"length":141,"network":{"bytes":428,"community_id":"1:BC1yARCPP1xfuZGWDu2zm1d+OzU=","packets":6},"node":"spark-afae","packetPos":[-76739,70201429,90,776,82,98,3108],"packetRange":{"gte":1787207884992,"lte":1787207885133},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS200651 FlokiNET ehf","number":200651,"organization":{"name":"FlokiNET ehf"}},"bytes":222,"geo":{"country_iso_code":"RO"},"ip":"185.100.87.136","mac":["c0:69:11:cd:1f:19","00:c0:1d:c0:ff:ee"],"mac-cnt":2,"packets":3,"port":43986},"srcOui":["Arista Networks","Grand Junction Networks, Inc."],"srcOuiCnt":2,"srcPayload8":"1020000042424242","srcRIR":"RIPE","srcTTL":[49],"srcTTLCnt":1,"tags":["contabo-sponge-02-ts","proxy","sensor:contabo-sponge-02-ts"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-4-8-1-3_1460_7"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":2,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":1,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":3426482614},"totDataBytes":16} +{"@timestamp":1787200872326,"_id":"260820-hr4zpoSeoCNJ5bKrLZFEdxO2","_index":"arkime_sessions3-260820","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Kaopu Cloud HK Limited"],"isp.dstCnt":1,"isp.src":["FlokiNET Ltd"],"isp.srcCnt":1,"org.dst":["LightNode-BH"],"org.dstCnt":1,"org.src":["FlokiNET Ltd"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":66,"geo":{"country_iso_code":"BH"},"ip":"38.54.2.209","mac":["52:54:8f:9d:76:48"],"mac-cnt":1,"packets":1,"port":443},"dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[76696],"firstPacket":1787199717787,"ipProtocol":6,"lastPacket":1787199717906,"length":119,"network":{"bytes":186,"community_id":"1:dyxTFvk1ACU1Aq+KugSi8nmw+OY=","packets":3},"node":"spark-afae","packetPos":[-76696,258836,82,0],"packetRange":{"gte":1787199717787,"lte":1787199717906},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS200651 FlokiNET ehf","number":200651,"organization":{"name":"FlokiNET ehf"}},"bytes":120,"geo":{"country_iso_code":"RO"},"ip":"185.100.87.136","mac":["98:44:ce:60:15:19"],"mac-cnt":1,"packets":2,"port":52446},"srcOui":["Huawei Technologies Co.,Ltd"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[52],"srcTTLCnt":1,"tags":["bahrain-sponge-01-ts","honeypot","sensor:bahrain-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["65535_2-1-3-1-1-4_1460_8"],"ja4tCnt":1,"ja4ts":["64240_2-1-1-4-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":770117761},"totDataBytes":0} +{"@timestamp":1787198753843,"_id":"260820-rngmiGaAZo9Oy7Ma6-uKNL4P","_index":"arkime_sessions3-260820","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["netcup GmbH"],"isp.dstCnt":1,"isp.src":["FlokiNET Ltd"],"isp.srcCnt":1,"org.dst":["Netcup KVM"],"org.dstCnt":1,"org.src":["FlokiNET Ltd"],"org.srcCnt":1,"usertype.dst":["business"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS197540 netcup GmbH","number":197540,"organization":{"name":"netcup GmbH"}},"bytes":66,"geo":{"country_iso_code":"DE"},"ip":"159.195.21.150","mac":["8a:41:d3:b8:0d:d3"],"mac-cnt":1,"packets":1,"port":443},"dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[76684],"firstPacket":1787198179101,"ipProtocol":6,"lastPacket":1787198179132,"length":31,"network":{"bytes":188,"community_id":"1:wvHOdDwqIsJsLdd1Ev/gmVdSR2s=","packets":3},"node":"spark-afae","packetPos":[-76684,18268576,82,1070],"packetRange":{"gte":1787198179101,"lte":1787198179132},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS200651 FlokiNET ehf","number":200651,"organization":{"name":"FlokiNET ehf"}},"bytes":122,"geo":{"country_iso_code":"RO"},"ip":"185.100.87.136","mac":["00:00:5e:00:01:96","bc:0f:fe:3d:a3:a7"],"mac-cnt":2,"packets":2,"port":45427},"srcOui":["Juniper Networks","ICANN, IANA Department"],"srcOuiCnt":2,"srcRIR":"RIPE","srcTTL":[53],"srcTTLCnt":1,"tags":["netcup-ts","honeypot","sensor:netcup-ts"],"tagsCnt":3,"tcp":{"ja4t":["65535_2-1-3-1-1-4_1460_8"],"ja4tCnt":1,"ja4ts":["42340_2-1-1-4-1-3_1460_11"],"ja4tsCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":2024229875},"totDataBytes":0} +{"@timestamp":1787197850933,"_id":"260820-mHjQ7WpKMoJCbZ6QswKD6li5","_index":"arkime_sessions3-260820","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["FlokiNET Ltd"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["FlokiNET Ltd"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":66,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":1,"port":443},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[76679],"firstPacket":1787196865955,"ipProtocol":6,"lastPacket":1787196866123,"length":168,"network":{"bytes":186,"community_id":"1:vyWZ+1w/4Lgb7w/tZPmtpkVMgxk=","packets":3},"node":"spark-afae","packetPos":[-76679,8940748,82,0],"packetRange":{"gte":1787196865955,"lte":1787196866123},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS200651 FlokiNET ehf","number":200651,"organization":{"name":"FlokiNET ehf"}},"bytes":120,"geo":{"country_iso_code":"RO"},"ip":"185.100.87.136","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":2,"port":52278},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[53],"srcTTLCnt":1,"tags":["sensor:frantech-ts","honeypot","frantech-ts"],"tagsCnt":3,"tcp":{"ja4t":["65535_2-1-3-1-1-4_1400_8"],"ja4tCnt":1,"ja4ts":["64240_2-1-1-4-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":317170716},"totDataBytes":0} +{"@timestamp":1787196035455,"_id":"260820-4b0MLWlqdO5J9LxJr9TTZS6l","_index":"arkime_sessions3-260820","client":{"bytes":13},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["FlokiNET Ltd"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["FlokiNET Ltd"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":375,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":4,"port":443},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstPayload8":"485454502f312e31","dstRIR":"RIPE","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[76669],"firstPacket":1787195490437,"http":{"bodyMagic":["text/plain"],"bodyMagicCnt":1,"md5":["6196dba52703776af2e6593f772ed7ce"],"md5Cnt":1,"responseHeader":["content-type","connection"],"responseHeaderCnt":2,"responseHeaderField":["content-type","connection"],"responseHeaderValue":["text/plain; charset=utf-8","close"],"responseHeaderValueCnt":2,"serverVersion":["1.1"],"serverVersionCnt":1,"sha256":["19b843cc92cb12aa314bb3c3913b2feeb852e85969bf06cb9d096931bfda34ba"],"sha256Cnt":1,"statuscode":[400],"statuscodeCnt":1},"initRTT":92,"ipProtocol":6,"lastPacket":1787195500612,"length":10175,"network":{"bytes":720,"community_id":"1:zvEA6D08XCA68OC65Ip0Sj9wJ0o=","packets":9},"node":"spark-afae","packetPos":[-76669,3400860,172,717,82,95,29155,82,185,164],"packetRange":{"gte":1787195490437,"lte":1787195500612},"protocol":["tls","tcp","http"],"protocolCnt":3,"segmentCnt":1,"server":{"bytes":103},"source":{"as":{"full":"AS200651 FlokiNET ehf","number":200651,"organization":{"name":"FlokiNET ehf"}},"bytes":345,"geo":{"country_iso_code":"RO"},"ip":"185.100.87.136","mac":["fc:bd:67:9d:2b:2b","00:c0:1d:c0:ff:ee"],"mac-cnt":2,"packets":5,"port":58842},"srcOui":["Grand Junction Networks, Inc.","Arista Networks"],"srcOuiCnt":2,"srcPayload8":"1603000008010101","srcRIR":"RIPE","srcTTL":[55],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["754031476976321"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["ac32bdeb-b49d-4079-9e6b-8fbca5e0addf"],"signatureCnt":1,"signatureId":[1031336],"signatureIdCnt":1},"tag":{"block":["false"],"blockCnt":1,"category":["protocol"],"categoryCnt":1,"description":["ip addresses with this tag have been observed attempting to opportunistically crawl the internet and establish tls/ssl connections."],"intention":["unknown"],"intentionCnt":1,"name":["tls/ssl crawler"],"nameCnt":1},"tags":["honeypot","contabo-sponge-01-ts","sensor:contabo-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4ls":"73_64_4907451","ja4t":["64240_2-4-8-1-3_1460_7"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":2,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":2,"psh":2,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":3415927730},"tls":{"ja3":["65e083060901bd26e31a66556ae6396b"],"ja3Cnt":1,"ja3string":["257,,,"],"ja3stringCnt":1,"ja4":["t00i000000_000000000000_000000000000"],"ja4Cnt":1,"ja4_r":["t00i000000__"],"ja4_rCnt":1},"totDataBytes":116} +{"@timestamp":1787196035455,"_id":"260820-4b2WWQbM_11JU4kYRO1Rsjkf","_index":"arkime_sessions3-260820","client":{"bytes":16},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["FlokiNET Ltd"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["FlokiNET Ltd"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":375,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":4,"port":443},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstPayload8":"485454502f312e31","dstRIR":"RIPE","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[76669],"firstPacket":1787195481436,"http":{"bodyMagic":["text/plain"],"bodyMagicCnt":1,"md5":["6196dba52703776af2e6593f772ed7ce"],"md5Cnt":1,"responseHeader":["content-type","connection"],"responseHeaderCnt":2,"responseHeaderField":["content-type","connection"],"responseHeaderValue":["text/plain; charset=utf-8","close"],"responseHeaderValueCnt":2,"serverVersion":["1.1"],"serverVersionCnt":1,"sha256":["19b843cc92cb12aa314bb3c3913b2feeb852e85969bf06cb9d096931bfda34ba"],"sha256Cnt":1,"statuscode":[400],"statuscodeCnt":1},"initRTT":87,"ipProtocol":6,"lastPacket":1787195490651,"length":9215,"network":{"bytes":723,"community_id":"1:glLSYxaGBdYSK+cQEkPMCGCeP3M=","packets":9},"node":"spark-afae","packetPos":[-76669,3365041,90,0,82,98,35549,172,185,881],"packetRange":{"gte":1787195481436,"lte":1787195490651},"protocol":["tcp","http"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":103},"source":{"as":{"full":"AS200651 FlokiNET ehf","number":200651,"organization":{"name":"FlokiNET ehf"}},"bytes":348,"geo":{"country_iso_code":"RO"},"ip":"185.100.87.136","mac":["fc:bd:67:9d:2b:2b","00:c0:1d:c0:ff:ee"],"mac-cnt":2,"packets":5,"port":46994},"srcOui":["Grand Junction Networks, Inc.","Arista Networks"],"srcOuiCnt":2,"srcPayload8":"1020000042424242","srcRIR":"RIPE","srcTTL":[56],"srcTTLCnt":1,"tags":["honeypot","contabo-sponge-01-ts","sensor:contabo-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4ls":"68_64_4421773","ja4t":["64240_2-4-8-1-3_1460_7"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":2,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":2,"psh":2,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":1587130527},"totDataBytes":119} +{"@timestamp":1787193933093,"_id":"260820-lL3XuyTeu7JDf5vNlcRoXdE1","_index":"arkime_sessions3-260820","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo GmbH"],"isp.dstCnt":1,"isp.src":["FlokiNET Ltd"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["FlokiNET Ltd"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS51167 Contabo GmbH","number":51167,"organization":{"name":"Contabo GmbH"}},"bytes":66,"geo":{"country_iso_code":"FR"},"ip":"109.123.246.142","mac":["00:50:56:63:46:a6"],"mac-cnt":1,"packets":1,"port":443},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[76657],"firstPacket":1787192998057,"ipProtocol":6,"lastPacket":1787192998088,"length":31,"network":{"bytes":192,"community_id":"1:aRdppeL+uo36ElQETqoOljQ6lZc=","packets":3},"node":"spark-afae","packetPos":[-76657,3547768,82,0],"packetRange":{"gte":1787192998057,"lte":1787192998088},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS200651 FlokiNET ehf","number":200651,"organization":{"name":"FlokiNET ehf"}},"bytes":126,"geo":{"country_iso_code":"RO"},"ip":"185.100.87.136","mac":["c0:69:11:cd:1f:19","00:c0:1d:c0:ff:ee"],"mac-cnt":2,"packets":2,"port":35203},"srcOui":["Arista Networks","Grand Junction Networks, Inc."],"srcOuiCnt":2,"srcRIR":"RIPE","srcTTL":[49],"srcTTLCnt":1,"tags":["contabo-sponge-02-ts","proxy","sensor:contabo-sponge-02-ts"],"tagsCnt":3,"tcp":{"ja4t":["65535_2-1-3-1-1-4_1460_8"],"ja4tCnt":1,"ja4ts":["64240_2-1-1-4-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":400216613},"totDataBytes":0} +{"@timestamp":1787190626876,"_id":"260820-G72icNFw1RtHoKRdVFhUZOQd","_index":"arkime_sessions3-260820","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["FlokiNET Ltd"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["FlokiNET Ltd"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":66,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":1,"port":443},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[76639],"firstPacket":1787189890941,"ipProtocol":6,"lastPacket":1787189891107,"length":166,"network":{"bytes":192,"community_id":"1:bEpUHtaprJnpBB6WmlqqOpgMVlI=","packets":3},"node":"spark-afae","packetPos":[-76639,1203845,82,442],"packetRange":{"gte":1787189890941,"lte":1787189891107},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS200651 FlokiNET ehf","number":200651,"organization":{"name":"FlokiNET ehf"}},"bytes":126,"geo":{"country_iso_code":"RO"},"ip":"185.100.87.136","mac":["fc:bd:67:9d:2b:2b","00:c0:1d:c0:ff:ee"],"mac-cnt":2,"packets":2,"port":45752},"srcOui":["Grand Junction Networks, Inc.","Arista Networks"],"srcOuiCnt":2,"srcRIR":"RIPE","srcTTL":[56],"srcTTLCnt":1,"tags":["sensor:contabo-sponge-01-ts","honeypot","contabo-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["65535_2-1-3-1-1-4_1460_8"],"ja4tCnt":1,"ja4ts":["64240_2-1-1-4-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":3613841877},"totDataBytes":0} +{"@timestamp":1787138181763,"_id":"260819-ynMokQOBTfdEkINoz657vgO7","_index":"arkime_sessions3-260819","client":{"bytes":52},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["netcup GmbH"],"isp.dstCnt":1,"isp.src":["FlokiNET Ltd"],"isp.srcCnt":1,"org.dst":["Netcup KVM"],"org.dstCnt":1,"org.src":["FlokiNET Ltd"],"org.srcCnt":1,"usertype.dst":["business"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS197540 netcup GmbH","number":197540,"organization":{"name":"netcup GmbH"}},"bytes":0,"geo":{"country_iso_code":"DE"},"ip":"159.195.21.150","mac":["8a:41:d3:b8:0d:d3"],"mac-cnt":1,"packets":0,"port":8080},"dstRIR":"ARIN","ethertype":2048,"fileId":[76348],"firstPacket":1787137675911,"ipProtocol":17,"lastPacket":1787137675911,"length":0,"network":{"bytes":94,"community_id":"1:/kl5CkMJrhi5F8pPpv/uMGonez8=","packets":1},"node":"spark-afae","packetPos":[-76348,1032228],"packetRange":{"gte":1787137675911,"lte":1787137675911},"protocol":["udp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS200651 FlokiNET ehf","number":200651,"organization":{"name":"FlokiNET ehf"}},"bytes":94,"geo":{"country_iso_code":"RO"},"ip":"185.100.87.136","mac":["bc:0f:fe:3d:a3:a7"],"mac-cnt":1,"packets":1,"port":46687},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcPayload8":"08ef002600000000","srcRIR":"RIPE","srcTTL":[53],"srcTTLCnt":1,"tags":["netcup-ts","honeypot","sensor:netcup-ts"],"tagsCnt":3,"totDataBytes":52} +{"@timestamp":1787138181719,"_id":"260819-ynMZxGQwMyJIqY10TIt_i8Jz","_index":"arkime_sessions3-260819","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["netcup GmbH"],"isp.dstCnt":1,"isp.src":["FlokiNET Ltd"],"isp.srcCnt":1,"org.dst":["Netcup KVM"],"org.dstCnt":1,"org.src":["FlokiNET Ltd"],"org.srcCnt":1,"usertype.dst":["business"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS197540 netcup GmbH","number":197540,"organization":{"name":"netcup GmbH"}},"bytes":66,"geo":{"country_iso_code":"DE"},"ip":"159.195.21.150","mac":["8a:41:d3:b8:0d:d3"],"mac-cnt":1,"packets":1,"port":8080},"dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[76348],"firstPacket":1787137674763,"ipProtocol":6,"lastPacket":1787137675818,"length":1055,"network":{"bytes":188,"community_id":"1:vd0/xSh7dx91WLHiy74y0xi/+rw=","packets":3},"node":"spark-afae","packetPos":[-76348,1031910,82,164],"packetRange":{"gte":1787137674763,"lte":1787137675818},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS200651 FlokiNET ehf","number":200651,"organization":{"name":"FlokiNET ehf"}},"bytes":122,"geo":{"country_iso_code":"RO"},"ip":"185.100.87.136","mac":["bc:0f:fe:3d:a3:a7","00:00:5e:00:01:96"],"mac-cnt":2,"packets":2,"port":51404},"srcOui":["Juniper Networks","ICANN, IANA Department"],"srcOuiCnt":2,"srcRIR":"RIPE","srcTTL":[53],"srcTTLCnt":1,"tags":["netcup-ts","honeypot","sensor:netcup-ts"],"tagsCnt":3,"tcp":{"ja4t":["65535_2-1-3-1-1-4_1460_8"],"ja4tCnt":1,"ja4ts":["42340_2-1-1-4-1-3_1460_11"],"ja4tsCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":2137311022},"totDataBytes":0} +{"@timestamp":1787137572282,"_id":"260819-v3ODATQBU9FDGLBAIHQ00sFl","_index":"arkime_sessions3-260819","client":{"bytes":52},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["FlokiNET Ltd"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["FlokiNET Ltd"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":0,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":0,"port":8080},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstRIR":"ARIN","ethertype":2048,"fileId":[76345],"firstPacket":1787136728849,"ipProtocol":17,"lastPacket":1787136728849,"length":0,"network":{"bytes":94,"community_id":"1:sSwdWHSwH/nd4hzYxNGGEXq3jJ8=","packets":1},"node":"spark-afae","packetPos":[-76345,5887851],"packetRange":{"gte":1787136728849,"lte":1787136728849},"protocol":["udp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS200651 FlokiNET ehf","number":200651,"organization":{"name":"FlokiNET ehf"}},"bytes":94,"geo":{"country_iso_code":"RO"},"ip":"185.100.87.136","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":1,"port":58502},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcPayload8":"08ef002600000000","srcRIR":"RIPE","srcTTL":[53],"srcTTLCnt":1,"tags":["frantech-ts","sensor:frantech-ts","honeypot"],"tagsCnt":3,"totDataBytes":52} diff --git a/kevlar/2026-08-31/sponge/ip-sessions/session_search_20260831T113642_412bf26b.ndjson b/kevlar/2026-08-31/sponge/ip-sessions/session_search_20260831T113642_412bf26b.ndjson new file mode 100644 index 0000000..e0db603 --- /dev/null +++ b/kevlar/2026-08-31/sponge/ip-sessions/session_search_20260831T113642_412bf26b.ndjson @@ -0,0 +1,100 @@ +{"@timestamp":1788176013243,"_id":"260831-U0YGeVTNYg9ECof_mSgynVjt","_index":"arkime_sessions3-260831","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["netcup GmbH"],"isp.dstCnt":1,"isp.src":["Pfcloud UG"],"isp.srcCnt":1,"org.dst":["Netcup KVM"],"org.dstCnt":1,"org.src":["Intelligence Hosting LLC"],"org.srcCnt":1,"usertype.dst":["business"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS197540 netcup GmbH","number":197540,"organization":{"name":"netcup GmbH"}},"bytes":0,"geo":{"country_iso_code":"DE"},"ip":"159.195.21.150","mac":["8a:41:d3:b8:0d:d3"],"mac-cnt":1,"packets":0,"port":25565},"dstRIR":"ARIN","ethertype":2048,"fileId":[82449],"firstPacket":1788175456838,"ipProtocol":6,"lastPacket":1788175456838,"length":0,"network":{"bytes":56,"community_id":"1:K1eKO0mfdJz4H9oell2FXbkapKg=","packets":1},"node":"spark-afae","packetPos":[-82449,171223],"packetRange":{"gte":1788175456838,"lte":1788175456838},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51396 Pfcloud UG (haftungsbeschrankt)","number":51396,"organization":{"name":"Pfcloud UG (haftungsbeschrankt)"}},"bytes":56,"geo":{"country_iso_code":"NL"},"ip":"204.76.203.7","mac":["bc:0f:fe:38:0b:a3"],"mac-cnt":1,"packets":1,"port":38756},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"ARIN","srcTTL":[248],"srcTTLCnt":1,"tags":["sensor:netcup-ts","netcup-ts","honeypot"],"tagsCnt":3,"tcp":{"ja4t":["65535_00_00_00"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":3801039780},"totDataBytes":0} +{"@timestamp":1788175716280,"_id":"260831-tD8KTUMJguJCDbrcwxiAEtrx","_index":"arkime_sessions3-260831","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Pfcloud UG"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Intelligence Hosting LLC"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":0,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":0,"port":25565},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[82447],"firstPacket":1788174723786,"ipProtocol":6,"lastPacket":1788174723786,"length":0,"network":{"bytes":60,"community_id":"1:2s/FTWbhM9ZuMvy0YR39w15+T1o=","packets":1},"node":"spark-afae","packetPos":[-82447,312313],"packetRange":{"gte":1788174723786,"lte":1788174723786},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51396 Pfcloud UG (haftungsbeschrankt)","number":51396,"organization":{"name":"Pfcloud UG (haftungsbeschrankt)"}},"bytes":60,"geo":{"country_iso_code":"NL"},"ip":"204.76.203.7","mac":["fc:bd:67:9d:2b:2b"],"mac-cnt":1,"packets":1,"port":48594},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcRIR":"ARIN","srcTTL":[244],"srcTTLCnt":1,"tags":["sensor:contabo-sponge-01-ts","honeypot","contabo-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["65535_00_00_00"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":2292216167},"totDataBytes":0} +{"@timestamp":1788174195736,"_id":"260831-t83gB6y2lRFE8LWSIy-YzjPa","_index":"arkime_sessions3-260831","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo GmbH"],"isp.dstCnt":1,"isp.src":["Pfcloud UG"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Intelligence Hosting LLC"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS51167 Contabo GmbH","number":51167,"organization":{"name":"Contabo GmbH"}},"bytes":0,"geo":{"country_iso_code":"FR"},"ip":"109.123.246.142","mac":["00:50:56:63:46:a6"],"mac-cnt":1,"packets":0,"port":26312},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[82438],"firstPacket":1788173699463,"ipProtocol":6,"lastPacket":1788173699463,"length":0,"network":{"bytes":60,"community_id":"1:ptBAoz4goaP6fn2yUQUIOZtB3Po=","packets":1},"node":"spark-afae","packetPos":[-82438,7045857],"packetRange":{"gte":1788173699463,"lte":1788173699463},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51396 Pfcloud UG (haftungsbeschrankt)","number":51396,"organization":{"name":"Pfcloud UG (haftungsbeschrankt)"}},"bytes":60,"geo":{"country_iso_code":"NL"},"ip":"204.76.203.7","mac":["c0:69:11:cd:1f:19"],"mac-cnt":1,"packets":1,"port":44956},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcRIR":"ARIN","srcTTL":[244],"srcTTLCnt":1,"tags":["proxy","sensor:contabo-sponge-02-ts","contabo-sponge-02-ts"],"tagsCnt":3,"tcp":{"ja4t":["65535_00_00_00"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":3555019893},"totDataBytes":0} +{"@timestamp":1788173895701,"_id":"260831-MkZ9pZjZK8VCHbX3_E8SvPm3","_index":"arkime_sessions3-260831","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Hetzner Online GmbH"],"isp.dstCnt":1,"isp.src":["Pfcloud UG"],"isp.srcCnt":1,"org.dst":["HETZNER-DC"],"org.dstCnt":1,"org.src":["Intelligence Hosting LLC"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS24940 Hetzner Online GmbH","number":24940,"organization":{"name":"Hetzner Online GmbH"}},"bytes":0,"geo":{"country_iso_code":"FI"},"ip":"89.167.72.144","mac":["92:00:07:4c:82:70"],"mac-cnt":1,"packets":0,"port":26312},"dstRIR":"RIPE","ethertype":2048,"fileId":[82434],"firstPacket":1788173141762,"ipProtocol":6,"lastPacket":1788173141762,"length":0,"network":{"bytes":54,"community_id":"1:Aga4NvKaIX11W37vehv+w5uKmo8=","packets":1},"node":"spark-afae","packetPos":[-82434,173372],"packetRange":{"gte":1788173141762,"lte":1788173141762},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51396 Pfcloud UG (haftungsbeschrankt)","number":51396,"organization":{"name":"Pfcloud UG (haftungsbeschrankt)"}},"bytes":54,"geo":{"country_iso_code":"NL"},"ip":"204.76.203.7","mac":["d2:74:7f:6e:37:e3"],"mac-cnt":1,"packets":1,"port":48440},"spoofable":["true"],"spoofableCnt":1,"srcRIR":"ARIN","srcTTL":[245],"srcTTLCnt":1,"tags":["sponge-01-ts","sensor:sponge-01-ts","honeypot"],"tagsCnt":3,"tcp":{"ja4t":["65535_00_00_00"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":2579894765},"totDataBytes":0} +{"@timestamp":1788173594044,"_id":"260831-aT_gTIWe9ApCFqRAfJrcxe1y","_index":"arkime_sessions3-260831","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["netcup GmbH"],"isp.dstCnt":1,"isp.src":["Pfcloud UG"],"isp.srcCnt":1,"org.dst":["Netcup KVM"],"org.dstCnt":1,"org.src":["Intelligence Hosting LLC"],"org.srcCnt":1,"usertype.dst":["business"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS197540 netcup GmbH","number":197540,"organization":{"name":"netcup GmbH"}},"bytes":0,"geo":{"country_iso_code":"DE"},"ip":"159.195.21.150","mac":["8a:41:d3:b8:0d:d3"],"mac-cnt":1,"packets":0,"port":26312},"dstRIR":"ARIN","ethertype":2048,"fileId":[82433],"firstPacket":1788173088664,"ipProtocol":6,"lastPacket":1788173088664,"length":0,"network":{"bytes":56,"community_id":"1:9qCh6hPNFLLzM6P6vCUvQnJiauM=","packets":1},"node":"spark-afae","packetPos":[-82433,321486],"packetRange":{"gte":1788173088664,"lte":1788173088664},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51396 Pfcloud UG (haftungsbeschrankt)","number":51396,"organization":{"name":"Pfcloud UG (haftungsbeschrankt)"}},"bytes":56,"geo":{"country_iso_code":"NL"},"ip":"204.76.203.7","mac":["bc:0f:fe:38:0b:a3"],"mac-cnt":1,"packets":1,"port":45337},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"ARIN","srcTTL":[248],"srcTTLCnt":1,"tags":["sensor:netcup-ts","netcup-ts","honeypot"],"tagsCnt":3,"tcp":{"ja4t":["65535_00_00_00"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":870090501},"totDataBytes":0} +{"@timestamp":1788173292912,"_id":"260831-Xj9c45ckoGtBkZzjcQI_DXsk","_index":"arkime_sessions3-260831","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Kaopu Cloud HK Limited"],"isp.dstCnt":1,"isp.src":["Pfcloud UG"],"isp.srcCnt":1,"org.dst":["LightNode-BH"],"org.dstCnt":1,"org.src":["Intelligence Hosting LLC"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":0,"geo":{"country_iso_code":"BH"},"ip":"38.54.2.209","mac":["52:54:8f:9d:76:48"],"mac-cnt":1,"packets":0,"port":26312},"dstRIR":"ARIN","ethertype":2048,"fileId":[82431],"firstPacket":1788172631586,"ipProtocol":6,"lastPacket":1788172631586,"length":0,"network":{"bytes":54,"community_id":"1:i3r5vYvBOR4hL7NkUUVimsWQWyM=","packets":1},"node":"spark-afae","packetPos":[-82431,168111],"packetRange":{"gte":1788172631586,"lte":1788172631586},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51396 Pfcloud UG (haftungsbeschrankt)","number":51396,"organization":{"name":"Pfcloud UG (haftungsbeschrankt)"}},"bytes":54,"geo":{"country_iso_code":"NL"},"ip":"204.76.203.7","mac":["98:44:ce:60:15:19"],"mac-cnt":1,"packets":1,"port":36096},"spoofable":["true"],"spoofableCnt":1,"srcDscp":[18],"srcDscpCnt":1,"srcOui":["Huawei Technologies Co.,Ltd"],"srcOuiCnt":1,"srcRIR":"ARIN","srcTTL":[240],"srcTTLCnt":1,"tags":["bahrain-sponge-01-ts","honeypot","sensor:bahrain-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["65535_00_00_00"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":3844232795},"totDataBytes":0} +{"@timestamp":1788172995850,"_id":"260831-ls0zWfU3fVpBuoQhm6PbxU0U","_index":"arkime_sessions3-260831","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["Pfcloud UG"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["Intelligence Hosting LLC"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":0,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":0,"port":26312},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstRIR":"ARIN","ethertype":2048,"fileId":[82430],"firstPacket":1788172136296,"ipProtocol":6,"lastPacket":1788172136296,"length":0,"network":{"bytes":58,"community_id":"1:86YmlKbh2Ifd7hclPkSmKy7stUA=","packets":1},"node":"spark-afae","packetPos":[-82430,217681332],"packetRange":{"gte":1788172136296,"lte":1788172136296},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51396 Pfcloud UG (haftungsbeschrankt)","number":51396,"organization":{"name":"Pfcloud UG (haftungsbeschrankt)"}},"bytes":58,"geo":{"country_iso_code":"NL"},"ip":"204.76.203.7","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":1,"port":39513},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"ARIN","srcTTL":[240],"srcTTLCnt":1,"tags":["sensor:frantech-ts","honeypot","frantech-ts"],"tagsCnt":3,"tcp":{"ja4t":["65535_2_536_00"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":164081633},"totDataBytes":0} +{"@timestamp":1788172384134,"_id":"260831-Pj9_iWxrIPFGKrDQnIlJonaC","_index":"arkime_sessions3-260831","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Pfcloud UG"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Intelligence Hosting LLC"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":0,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":0,"port":26312},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[82425],"firstPacket":1788171477878,"ipProtocol":6,"lastPacket":1788171477878,"length":0,"network":{"bytes":60,"community_id":"1:xwCH3uQhvvcHnmjY5J1BoFFI9vk=","packets":1},"node":"spark-afae","packetPos":[-82425,754614],"packetRange":{"gte":1788171477878,"lte":1788171477878},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51396 Pfcloud UG (haftungsbeschrankt)","number":51396,"organization":{"name":"Pfcloud UG (haftungsbeschrankt)"}},"bytes":60,"geo":{"country_iso_code":"NL"},"ip":"204.76.203.7","mac":["fc:bd:67:9d:2b:2b"],"mac-cnt":1,"packets":1,"port":45191},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcRIR":"ARIN","srcTTL":[244],"srcTTLCnt":1,"tags":["contabo-sponge-01-ts","sensor:contabo-sponge-01-ts","honeypot"],"tagsCnt":3,"tcp":{"ja4t":["65535_00_00_00"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":3807853290},"totDataBytes":0} +{"@timestamp":1788171180976,"_id":"260831-ET-AushPQadGKLA7_Q03wfLa","_index":"arkime_sessions3-260831","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["Pfcloud UG"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["Intelligence Hosting LLC"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":0,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":0,"port":27202},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstRIR":"ARIN","ethertype":2048,"fileId":[82417],"firstPacket":1788170646784,"ipProtocol":6,"lastPacket":1788170646784,"length":0,"network":{"bytes":58,"community_id":"1:xMMrbPohMuZGAXcfGSbeuY92Oj8=","packets":1},"node":"spark-afae","packetPos":[-82417,171858841],"packetRange":{"gte":1788170646784,"lte":1788170646784},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51396 Pfcloud UG (haftungsbeschrankt)","number":51396,"organization":{"name":"Pfcloud UG (haftungsbeschrankt)"}},"bytes":58,"geo":{"country_iso_code":"NL"},"ip":"204.76.203.7","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":1,"port":41926},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"ARIN","srcTTL":[241],"srcTTLCnt":1,"tags":["sensor:frantech-ts","frantech-ts","honeypot"],"tagsCnt":3,"tcp":{"ja4t":["65535_2_536_00"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":2364798792},"totDataBytes":0} +{"@timestamp":1788170877036,"_id":"260831-Bj_9N3_KnsNFhINFVIrI6wGd","_index":"arkime_sessions3-260831","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["netcup GmbH"],"isp.dstCnt":1,"isp.src":["Pfcloud UG"],"isp.srcCnt":1,"org.dst":["Netcup KVM"],"org.dstCnt":1,"org.src":["Intelligence Hosting LLC"],"org.srcCnt":1,"usertype.dst":["business"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS197540 netcup GmbH","number":197540,"organization":{"name":"netcup GmbH"}},"bytes":0,"geo":{"country_iso_code":"DE"},"ip":"159.195.21.150","mac":["8a:41:d3:b8:0d:d3"],"mac-cnt":1,"packets":0,"port":27202},"dstRIR":"ARIN","ethertype":2048,"fileId":[82415],"firstPacket":1788170369824,"ipProtocol":6,"lastPacket":1788170369824,"length":0,"network":{"bytes":56,"community_id":"1:0Bg/mcxKSl+PfBqpF2R0GUWQNQE=","packets":1},"node":"spark-afae","packetPos":[-82415,1163553],"packetRange":{"gte":1788170369824,"lte":1788170369824},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51396 Pfcloud UG (haftungsbeschrankt)","number":51396,"organization":{"name":"Pfcloud UG (haftungsbeschrankt)"}},"bytes":56,"geo":{"country_iso_code":"NL"},"ip":"204.76.203.7","mac":["bc:0f:fe:38:0b:a3"],"mac-cnt":1,"packets":1,"port":45839},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"ARIN","srcTTL":[248],"srcTTLCnt":1,"tags":["sensor:netcup-ts","netcup-ts","honeypot"],"tagsCnt":3,"tcp":{"ja4t":["65535_00_00_00"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":3233530105},"totDataBytes":0} +{"@timestamp":1788170577652,"_id":"260831-EUYjw1U5LS5GiYlcgMcz6K2w","_index":"arkime_sessions3-260831","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo GmbH"],"isp.dstCnt":1,"isp.src":["Pfcloud UG"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Intelligence Hosting LLC"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS51167 Contabo GmbH","number":51167,"organization":{"name":"Contabo GmbH"}},"bytes":0,"geo":{"country_iso_code":"FR"},"ip":"109.123.246.142","mac":["00:50:56:63:46:a6"],"mac-cnt":1,"packets":0,"port":27202},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[82413],"firstPacket":1788169974816,"ipProtocol":6,"lastPacket":1788169974816,"length":0,"network":{"bytes":60,"community_id":"1:9J6HJM+PaaV4oM4V40oCfs0i+Po=","packets":1},"node":"spark-afae","packetPos":[-82413,2731520],"packetRange":{"gte":1788169974816,"lte":1788169974816},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51396 Pfcloud UG (haftungsbeschrankt)","number":51396,"organization":{"name":"Pfcloud UG (haftungsbeschrankt)"}},"bytes":60,"geo":{"country_iso_code":"NL"},"ip":"204.76.203.7","mac":["c0:69:11:cd:1f:19"],"mac-cnt":1,"packets":1,"port":37388},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcRIR":"ARIN","srcTTL":[243],"srcTTLCnt":1,"tags":["contabo-sponge-02-ts","proxy","sensor:contabo-sponge-02-ts"],"tagsCnt":3,"tcp":{"ja4t":["65535_00_00_00"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":1546808543},"totDataBytes":0} +{"@timestamp":1788170576706,"_id":"260831-U83I7JSWuEBFrJqyimfgB3jt","_index":"arkime_sessions3-260831","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Pfcloud UG"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Intelligence Hosting LLC"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":0,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":0,"port":27202},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[82414],"firstPacket":1788169505171,"ipProtocol":6,"lastPacket":1788169505171,"length":0,"network":{"bytes":60,"community_id":"1:ZC8sv3ZxoTaSFjsxkKZ9idA8NM0=","packets":1},"node":"spark-afae","packetPos":[-82414,417228],"packetRange":{"gte":1788169505171,"lte":1788169505171},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51396 Pfcloud UG (haftungsbeschrankt)","number":51396,"organization":{"name":"Pfcloud UG (haftungsbeschrankt)"}},"bytes":60,"geo":{"country_iso_code":"NL"},"ip":"204.76.203.7","mac":["fc:bd:67:9d:2b:2b"],"mac-cnt":1,"packets":1,"port":59593},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcRIR":"ARIN","srcTTL":[245],"srcTTLCnt":1,"tags":["honeypot","sensor:contabo-sponge-01-ts","contabo-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["65535_00_00_00"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":3514063929},"totDataBytes":0} +{"@timestamp":1788169676732,"_id":"260831-2j4z35Eo_N9AyqXGzxFeE0uN","_index":"arkime_sessions3-260831","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Kaopu Cloud HK Limited"],"isp.dstCnt":1,"isp.src":["Pfcloud UG"],"isp.srcCnt":1,"org.dst":["LightNode-BH"],"org.dstCnt":1,"org.src":["Intelligence Hosting LLC"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":0,"geo":{"country_iso_code":"BH"},"ip":"38.54.2.209","mac":["52:54:8f:9d:76:48"],"mac-cnt":1,"packets":0,"port":27202},"dstRIR":"ARIN","ethertype":2048,"fileId":[82408],"firstPacket":1788169095728,"ipProtocol":6,"lastPacket":1788169095728,"length":0,"network":{"bytes":54,"community_id":"1:BHvl/9lHu3a5/N4aRsmUxEiPagQ=","packets":1},"node":"spark-afae","packetPos":[-82408,128686],"packetRange":{"gte":1788169095728,"lte":1788169095728},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51396 Pfcloud UG (haftungsbeschrankt)","number":51396,"organization":{"name":"Pfcloud UG (haftungsbeschrankt)"}},"bytes":54,"geo":{"country_iso_code":"NL"},"ip":"204.76.203.7","mac":["98:44:ce:60:15:19"],"mac-cnt":1,"packets":1,"port":40762},"spoofable":["true"],"spoofableCnt":1,"srcDscp":[18],"srcDscpCnt":1,"srcOui":["Huawei Technologies Co.,Ltd"],"srcOuiCnt":1,"srcRIR":"ARIN","srcTTL":[240],"srcTTLCnt":1,"tags":["honeypot","sensor:bahrain-sponge-01-ts","bahrain-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["65535_00_00_00"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":927917281},"totDataBytes":0} +{"@timestamp":1788169377269,"_id":"260831-BUYqOCLNl0RP_ZY7QGJgsLEp","_index":"arkime_sessions3-260831","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Hetzner Online GmbH"],"isp.dstCnt":1,"isp.src":["Pfcloud UG"],"isp.srcCnt":1,"org.dst":["HETZNER-DC"],"org.dstCnt":1,"org.src":["Intelligence Hosting LLC"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS24940 Hetzner Online GmbH","number":24940,"organization":{"name":"Hetzner Online GmbH"}},"bytes":0,"geo":{"country_iso_code":"FI"},"ip":"89.167.72.144","mac":["92:00:07:4c:82:70"],"mac-cnt":1,"packets":0,"port":27202},"dstRIR":"RIPE","ethertype":2048,"fileId":[82404],"firstPacket":1788168909574,"ipProtocol":6,"lastPacket":1788168909574,"length":0,"network":{"bytes":54,"community_id":"1:9dwf4tFSTUYC0o+ezs30KjqjSDs=","packets":1},"node":"spark-afae","packetPos":[-82404,301186],"packetRange":{"gte":1788168909574,"lte":1788168909574},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51396 Pfcloud UG (haftungsbeschrankt)","number":51396,"organization":{"name":"Pfcloud UG (haftungsbeschrankt)"}},"bytes":54,"geo":{"country_iso_code":"NL"},"ip":"204.76.203.7","mac":["d2:74:7f:6e:37:e3"],"mac-cnt":1,"packets":1,"port":45884},"spoofable":["true"],"spoofableCnt":1,"srcRIR":"ARIN","srcTTL":[244],"srcTTLCnt":1,"tags":["honeypot","sponge-01-ts","sensor:sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["65535_00_00_00"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":180168500},"totDataBytes":0} +{"@timestamp":1788168169443,"_id":"260831-rj4cgF2r3WFD160TXYTyN85a","_index":"arkime_sessions3-260831","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Kaopu Cloud HK Limited"],"isp.dstCnt":1,"isp.src":["Pfcloud UG"],"isp.srcCnt":1,"org.dst":["LightNode-BH"],"org.dstCnt":1,"org.src":["Intelligence Hosting LLC"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":0,"geo":{"country_iso_code":"BH"},"ip":"38.54.2.209","mac":["52:54:8f:9d:76:48"],"mac-cnt":1,"packets":0,"port":27391},"dstRIR":"ARIN","ethertype":2048,"fileId":[82397],"firstPacket":1788166955989,"ipProtocol":6,"lastPacket":1788166955989,"length":0,"network":{"bytes":54,"community_id":"1:Zu4GNJQarsRbNcp9eproLilrLWg=","packets":1},"node":"spark-afae","packetPos":[-82397,37416],"packetRange":{"gte":1788166955989,"lte":1788166955989},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51396 Pfcloud UG (haftungsbeschrankt)","number":51396,"organization":{"name":"Pfcloud UG (haftungsbeschrankt)"}},"bytes":54,"geo":{"country_iso_code":"NL"},"ip":"204.76.203.7","mac":["98:44:ce:60:15:19"],"mac-cnt":1,"packets":1,"port":57407},"spoofable":["true"],"spoofableCnt":1,"srcDscp":[18],"srcDscpCnt":1,"srcOui":["Huawei Technologies Co.,Ltd"],"srcOuiCnt":1,"srcRIR":"ARIN","srcTTL":[241],"srcTTLCnt":1,"tags":["honeypot","bahrain-sponge-01-ts","sensor:bahrain-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["65535_00_00_00"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":186435688},"totDataBytes":0} +{"@timestamp":1788167868115,"_id":"260831-oz4Qh38QxnFGmJJIYT_Mbljp","_index":"arkime_sessions3-260831","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo GmbH"],"isp.dstCnt":1,"isp.src":["Pfcloud UG"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Intelligence Hosting LLC"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS51167 Contabo GmbH","number":51167,"organization":{"name":"Contabo GmbH"}},"bytes":0,"geo":{"country_iso_code":"FR"},"ip":"109.123.246.142","mac":["00:50:56:63:46:a6"],"mac-cnt":1,"packets":0,"port":27391},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[82396],"firstPacket":1788166727760,"ipProtocol":6,"lastPacket":1788166727760,"length":0,"network":{"bytes":60,"community_id":"1:IT6nXnOCvS+Ny2fDj6WrB41HHjU=","packets":1},"node":"spark-afae","packetPos":[-82396,71286],"packetRange":{"gte":1788166727760,"lte":1788166727760},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51396 Pfcloud UG (haftungsbeschrankt)","number":51396,"organization":{"name":"Pfcloud UG (haftungsbeschrankt)"}},"bytes":60,"geo":{"country_iso_code":"NL"},"ip":"204.76.203.7","mac":["c0:69:11:cd:1f:19"],"mac-cnt":1,"packets":1,"port":59996},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcRIR":"ARIN","srcTTL":[244],"srcTTLCnt":1,"tags":["proxy","sensor:contabo-sponge-02-ts","contabo-sponge-02-ts"],"tagsCnt":3,"tcp":{"ja4t":["65535_00_00_00"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":2596432280},"totDataBytes":0} +{"@timestamp":1788167268554,"_id":"260831-Bs3_yR31eOhG8JZ7gKhyAK7q","_index":"arkime_sessions3-260831","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["netcup GmbH"],"isp.dstCnt":1,"isp.src":["Pfcloud UG"],"isp.srcCnt":1,"org.dst":["Netcup KVM"],"org.dstCnt":1,"org.src":["Intelligence Hosting LLC"],"org.srcCnt":1,"usertype.dst":["business"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS197540 netcup GmbH","number":197540,"organization":{"name":"netcup GmbH"}},"bytes":0,"geo":{"country_iso_code":"DE"},"ip":"159.195.21.150","mac":["8a:41:d3:b8:0d:d3"],"mac-cnt":1,"packets":0,"port":27391},"dstRIR":"ARIN","ethertype":2048,"fileId":[82390],"firstPacket":1788166386297,"ipProtocol":6,"lastPacket":1788166386297,"length":0,"network":{"bytes":56,"community_id":"1:WcBuHJ6gJQj4OIoSDmq8g2M6gsk=","packets":1},"node":"spark-afae","packetPos":[-82390,112841],"packetRange":{"gte":1788166386297,"lte":1788166386297},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51396 Pfcloud UG (haftungsbeschrankt)","number":51396,"organization":{"name":"Pfcloud UG (haftungsbeschrankt)"}},"bytes":56,"geo":{"country_iso_code":"NL"},"ip":"204.76.203.7","mac":["bc:0f:fe:38:0b:a3"],"mac-cnt":1,"packets":1,"port":49302},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"ARIN","srcTTL":[248],"srcTTLCnt":1,"tags":["netcup-ts","sensor:netcup-ts","honeypot"],"tagsCnt":3,"tcp":{"ja4t":["65535_00_00_00"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":451799016},"totDataBytes":0} +{"@timestamp":1788166368883,"_id":"260831-bD6XT76qm1ZPkKwMtPDfEu2A","_index":"arkime_sessions3-260831","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["Pfcloud UG"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["Intelligence Hosting LLC"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":0,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":0,"port":27391},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstRIR":"ARIN","ethertype":2048,"fileId":[82386],"firstPacket":1788165706610,"ipProtocol":6,"lastPacket":1788165706610,"length":0,"network":{"bytes":58,"community_id":"1:EaUZYzQ5XP/tS1dln4j94kh2f3E=","packets":1},"node":"spark-afae","packetPos":[-82386,88514679],"packetRange":{"gte":1788165706610,"lte":1788165706610},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51396 Pfcloud UG (haftungsbeschrankt)","number":51396,"organization":{"name":"Pfcloud UG (haftungsbeschrankt)"}},"bytes":58,"geo":{"country_iso_code":"NL"},"ip":"204.76.203.7","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":1,"port":45487},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"ARIN","srcTTL":[242],"srcTTLCnt":1,"tags":["honeypot","sensor:frantech-ts","frantech-ts"],"tagsCnt":3,"tcp":{"ja4t":["65535_2_536_00"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":3038448671},"totDataBytes":0} +{"@timestamp":1788164866506,"_id":"260831-usyiyY9MZTRE_Kq6TsHsutNA","_index":"arkime_sessions3-260831","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Hetzner Online GmbH"],"isp.dstCnt":1,"isp.src":["Pfcloud UG"],"isp.srcCnt":1,"org.dst":["HETZNER-DC"],"org.dstCnt":1,"org.src":["Intelligence Hosting LLC"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS24940 Hetzner Online GmbH","number":24940,"organization":{"name":"Hetzner Online GmbH"}},"bytes":0,"geo":{"country_iso_code":"FI"},"ip":"89.167.72.144","mac":["92:00:07:4c:82:70"],"mac-cnt":1,"packets":0,"port":27391},"dstRIR":"RIPE","ethertype":2048,"fileId":[82374],"firstPacket":1788164423100,"ipProtocol":6,"lastPacket":1788164423100,"length":0,"network":{"bytes":54,"community_id":"1:PwRB9K75Q4LjPN+jvIjhktZtBqY=","packets":1},"node":"spark-afae","packetPos":[-82374,190210],"packetRange":{"gte":1788164423100,"lte":1788164423100},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51396 Pfcloud UG (haftungsbeschrankt)","number":51396,"organization":{"name":"Pfcloud UG (haftungsbeschrankt)"}},"bytes":54,"geo":{"country_iso_code":"NL"},"ip":"204.76.203.7","mac":["d2:74:7f:6e:37:e3"],"mac-cnt":1,"packets":1,"port":60698},"spoofable":["true"],"spoofableCnt":1,"srcRIR":"ARIN","srcTTL":[245],"srcTTLCnt":1,"tags":["sponge-01-ts","honeypot","sensor:sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["65535_00_00_00"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":1453692158},"totDataBytes":0} +{"@timestamp":1788165167059,"_id":"260831-xcxe8_mUcDRA-b4kOXmWEmBc","_index":"arkime_sessions3-260831","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Pfcloud UG"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Intelligence Hosting LLC"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":0,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":0,"port":27391},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[82378],"firstPacket":1788164376529,"ipProtocol":6,"lastPacket":1788164376529,"length":0,"network":{"bytes":60,"community_id":"1:/ptVIc75xFEMMTvIBJK7FvspEto=","packets":1},"node":"spark-afae","packetPos":[-82378,1144340],"packetRange":{"gte":1788164376529,"lte":1788164376529},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51396 Pfcloud UG (haftungsbeschrankt)","number":51396,"organization":{"name":"Pfcloud UG (haftungsbeschrankt)"}},"bytes":60,"geo":{"country_iso_code":"NL"},"ip":"204.76.203.7","mac":["fc:bd:67:9d:2b:2b"],"mac-cnt":1,"packets":1,"port":57987},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcRIR":"ARIN","srcTTL":[244],"srcTTLCnt":1,"tags":["honeypot","sensor:contabo-sponge-01-ts","contabo-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["65535_00_00_00"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":246221713},"totDataBytes":0} +{"@timestamp":1788164565266,"_id":"260831-LD4g2b7XLHBOuIKz-69lZL_n","_index":"arkime_sessions3-260831","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Kaopu Cloud HK Limited"],"isp.dstCnt":1,"isp.src":["Pfcloud UG"],"isp.srcCnt":1,"org.dst":["LightNode-BH"],"org.dstCnt":1,"org.src":["Intelligence Hosting LLC"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":0,"geo":{"country_iso_code":"BH"},"ip":"38.54.2.209","mac":["52:54:8f:9d:76:48"],"mac-cnt":1,"packets":0,"port":27866},"dstRIR":"ARIN","ethertype":2048,"fileId":[82373],"firstPacket":1788163810736,"ipProtocol":6,"lastPacket":1788163810736,"length":0,"network":{"bytes":54,"community_id":"1:F/gVjJe3B98pxBuSzs+xJovbK+g=","packets":1},"node":"spark-afae","packetPos":[-82373,152659],"packetRange":{"gte":1788163810736,"lte":1788163810736},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51396 Pfcloud UG (haftungsbeschrankt)","number":51396,"organization":{"name":"Pfcloud UG (haftungsbeschrankt)"}},"bytes":54,"geo":{"country_iso_code":"NL"},"ip":"204.76.203.7","mac":["98:44:ce:60:15:19"],"mac-cnt":1,"packets":1,"port":49242},"spoofable":["true"],"spoofableCnt":1,"srcDscp":[18],"srcDscpCnt":1,"srcOui":["Huawei Technologies Co.,Ltd"],"srcOuiCnt":1,"srcRIR":"ARIN","srcTTL":[240],"srcTTLCnt":1,"tags":["sensor:bahrain-sponge-01-ts","bahrain-sponge-01-ts","honeypot"],"tagsCnt":3,"tcp":{"ja4t":["65535_00_00_00"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":834825411},"totDataBytes":0} +{"@timestamp":1788164564732,"_id":"260831-r8yi-03aTcVK6Z8w-HYDoj1E","_index":"arkime_sessions3-260831","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo GmbH"],"isp.dstCnt":1,"isp.src":["Pfcloud UG"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Intelligence Hosting LLC"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS51167 Contabo GmbH","number":51167,"organization":{"name":"Contabo GmbH"}},"bytes":0,"geo":{"country_iso_code":"FR"},"ip":"109.123.246.142","mac":["00:50:56:63:46:a6"],"mac-cnt":1,"packets":0,"port":27866},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[82371],"firstPacket":1788163741124,"ipProtocol":6,"lastPacket":1788163741124,"length":0,"network":{"bytes":60,"community_id":"1:Qhzd0wDYw2LIOcfmbYe368E+Fy4=","packets":1},"node":"spark-afae","packetPos":[-82371,657754],"packetRange":{"gte":1788163741124,"lte":1788163741124},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51396 Pfcloud UG (haftungsbeschrankt)","number":51396,"organization":{"name":"Pfcloud UG (haftungsbeschrankt)"}},"bytes":60,"geo":{"country_iso_code":"NL"},"ip":"204.76.203.7","mac":["c0:69:11:cd:1f:19"],"mac-cnt":1,"packets":1,"port":55883},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcRIR":"ARIN","srcTTL":[244],"srcTTLCnt":1,"tags":["sensor:contabo-sponge-02-ts","contabo-sponge-02-ts","proxy"],"tagsCnt":3,"tcp":{"ja4t":["65535_00_00_00"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":585156629},"totDataBytes":0} +{"@timestamp":1788163664236,"_id":"260831-w0UoaFkXT6FHBJUz4UcAoL2Y","_index":"arkime_sessions3-260831","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["netcup GmbH"],"isp.dstCnt":1,"isp.src":["Pfcloud UG"],"isp.srcCnt":1,"org.dst":["Netcup KVM"],"org.dstCnt":1,"org.src":["Intelligence Hosting LLC"],"org.srcCnt":1,"usertype.dst":["business"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS197540 netcup GmbH","number":197540,"organization":{"name":"netcup GmbH"}},"bytes":0,"geo":{"country_iso_code":"DE"},"ip":"159.195.21.150","mac":["8a:41:d3:b8:0d:d3"],"mac-cnt":1,"packets":0,"port":27866},"dstRIR":"ARIN","ethertype":2048,"fileId":[82366],"firstPacket":1788163009871,"ipProtocol":6,"lastPacket":1788163009871,"length":0,"network":{"bytes":56,"community_id":"1:kh9znHAO2BYaS58FDCxaMSaiYcs=","packets":1},"node":"spark-afae","packetPos":[-82366,288795],"packetRange":{"gte":1788163009871,"lte":1788163009871},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51396 Pfcloud UG (haftungsbeschrankt)","number":51396,"organization":{"name":"Pfcloud UG (haftungsbeschrankt)"}},"bytes":56,"geo":{"country_iso_code":"NL"},"ip":"204.76.203.7","mac":["bc:0f:fe:38:0b:a3"],"mac-cnt":1,"packets":1,"port":34087},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"ARIN","srcTTL":[248],"srcTTLCnt":1,"tags":["netcup-ts","honeypot","sensor:netcup-ts"],"tagsCnt":3,"tcp":{"ja4t":["65535_00_00_00"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":84688865},"totDataBytes":0} +{"@timestamp":1788162762634,"_id":"260831-9j0UO9ebeV5NGZDy8K-S_jEl","_index":"arkime_sessions3-260831","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["Pfcloud UG"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["Intelligence Hosting LLC"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":0,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":0,"port":27866},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstRIR":"ARIN","ethertype":2048,"fileId":[82362],"firstPacket":1788161789816,"ipProtocol":6,"lastPacket":1788161789816,"length":0,"network":{"bytes":58,"community_id":"1:wAOI0/brZlBzBpSBbRPM5d/Oo8A=","packets":1},"node":"spark-afae","packetPos":[-82362,143257],"packetRange":{"gte":1788161789816,"lte":1788161789816},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51396 Pfcloud UG (haftungsbeschrankt)","number":51396,"organization":{"name":"Pfcloud UG (haftungsbeschrankt)"}},"bytes":58,"geo":{"country_iso_code":"NL"},"ip":"204.76.203.7","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":1,"port":36998},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"ARIN","srcTTL":[241],"srcTTLCnt":1,"tags":["honeypot","sensor:frantech-ts","frantech-ts"],"tagsCnt":3,"tcp":{"ja4t":["65535_2_536_00"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":4156764267},"totDataBytes":0} +{"@timestamp":1788162159659,"_id":"260831-bcwvBHxsvX9LE5-CD0tiFV4W","_index":"arkime_sessions3-260831","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Hetzner Online GmbH"],"isp.dstCnt":1,"isp.src":["Pfcloud UG"],"isp.srcCnt":1,"org.dst":["HETZNER-DC"],"org.dstCnt":1,"org.src":["Intelligence Hosting LLC"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS24940 Hetzner Online GmbH","number":24940,"organization":{"name":"Hetzner Online GmbH"}},"bytes":0,"geo":{"country_iso_code":"FI"},"ip":"89.167.72.144","mac":["92:00:07:4c:82:70"],"mac-cnt":1,"packets":0,"port":27866},"dstRIR":"RIPE","ethertype":2048,"fileId":[82356],"firstPacket":1788161605202,"ipProtocol":6,"lastPacket":1788161605202,"length":0,"network":{"bytes":54,"community_id":"1:cBL6rQkolGJtENKqWCmeZXwzSDU=","packets":1},"node":"spark-afae","packetPos":[-82356,241950],"packetRange":{"gte":1788161605202,"lte":1788161605202},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51396 Pfcloud UG (haftungsbeschrankt)","number":51396,"organization":{"name":"Pfcloud UG (haftungsbeschrankt)"}},"bytes":54,"geo":{"country_iso_code":"NL"},"ip":"204.76.203.7","mac":["d2:74:7f:6e:37:e3"],"mac-cnt":1,"packets":1,"port":40273},"spoofable":["true"],"spoofableCnt":1,"srcRIR":"ARIN","srcTTL":[244],"srcTTLCnt":1,"tags":["honeypot","sponge-01-ts","sensor:sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["65535_00_00_00"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":3621212588},"totDataBytes":0} +{"@timestamp":1788162458010,"_id":"260831-eMzcwE7CuERPC5JBvmPf90Cp","_index":"arkime_sessions3-260831","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Pfcloud UG"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Intelligence Hosting LLC"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":0,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":0,"port":27866},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[82360],"firstPacket":1788161199150,"ipProtocol":6,"lastPacket":1788161199150,"length":0,"network":{"bytes":60,"community_id":"1:SVwBPK20EKT1rqdfQyh+CU6YYbM=","packets":1},"node":"spark-afae","packetPos":[-82360,171757],"packetRange":{"gte":1788161199150,"lte":1788161199150},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51396 Pfcloud UG (haftungsbeschrankt)","number":51396,"organization":{"name":"Pfcloud UG (haftungsbeschrankt)"}},"bytes":60,"geo":{"country_iso_code":"NL"},"ip":"204.76.203.7","mac":["fc:bd:67:9d:2b:2b"],"mac-cnt":1,"packets":1,"port":40535},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcRIR":"ARIN","srcTTL":[245],"srcTTLCnt":1,"tags":["sensor:contabo-sponge-01-ts","honeypot","contabo-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["65535_00_00_00"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":332935837},"totDataBytes":0} +{"@timestamp":1788162157974,"_id":"260831-4D2-6vIhFApJAYYV-QxOD9CO","_index":"arkime_sessions3-260831","client":{"bytes":3},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["Pfcloud UG"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["Intelligence Hosting LLC"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":639,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":8,"port":28015},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstPayload8":"485454502f312e31","dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[82357],"firstPacket":1788160960343,"http":{"bodyMagic":["text/plain"],"bodyMagicCnt":1,"responseHeader":["content-type","connection"],"responseHeaderCnt":2,"responseHeaderField":["content-type","connection"],"responseHeaderValue":["text/plain; charset=utf-8","close"],"responseHeaderValueCnt":2,"serverVersion":["1.1"],"serverVersionCnt":1,"statuscode":[400],"statuscodeCnt":1},"initRTT":65,"ipProtocol":6,"lastPacket":1788161002949,"length":42606,"network":{"bytes":1232,"community_id":"1:U3fw5/G6XgBVrlF88oNETfTpJuM=","packets":17},"node":"spark-afae","packetPos":[-82357,641726,90,160,82,85,34509,82,0,152,38247,82,152,82,49096,82,185,222],"packetRange":{"gte":1788160960343,"lte":1788161002949},"protocol":["http","tcp"],"protocolCnt":2,"rootId":"260831-4D2-6vIhFApJAYYV-QxOD9CO","segmentCnt":1,"server":{"bytes":103},"source":{"as":{"full":"AS51396 Pfcloud UG (haftungsbeschrankt)","number":51396,"organization":{"name":"Pfcloud UG (haftungsbeschrankt)"}},"bytes":593,"geo":{"country_iso_code":"NL"},"ip":"204.76.203.7","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":9,"port":41424},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcPayload8":"050100","srcRIR":"ARIN","srcTTL":[49],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":["","Attempted Information Leak"],"categoryCnt":2,"flowId":["65970072085693"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[2,3],"severityCnt":2,"signature":["553b5765-6241-4e9a-9982-0ca113796134","5a66c944-faed-4791-9d94-b44b7bd48352"],"signatureCnt":2,"signatureId":[1031235,2000181],"signatureIdCnt":2},"tags":["honeypot","sensor:frantech-ts","frantech-ts"],"tagsCnt":3,"tcp":{"ja4ls":"41_64_21172091","ja4t":["64240_2-4-8-1-3_1400_7"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":10,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":2,"psh":2,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":2420588357},"totDataBytes":106} +{"@timestamp":1788161236341,"_id":"260831-yj2qvKFi40RFUJ6u0SFtPUc8","_index":"arkime_sessions3-260831","client":{"bytes":125},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["Pfcloud UG"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["Intelligence Hosting LLC"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":625,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":5,"port":28015},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstPayload8":"485454502f312e31","dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[82351],"firstPacket":1788160821896,"http":{"bodyMagic":["text/html"],"bodyMagicCnt":1,"clientVersion":["1.1"],"clientVersionCnt":1,"host":["azenv.net"],"hostCnt":1,"ja4h":["ge11nn040000_8391bea91fb6_000000000000_000000000000"],"ja4hCnt":1,"ja4h_r":["ge11nn040000_Host,User-Agent,Accept-Encoding,Connection__"],"ja4h_rCnt":1,"md5":["0f87454a3ea15f0db55ae928dbcd82fc"],"md5Cnt":1,"method":["GET"],"method-GET":1,"methodCnt":1,"path":["http://azenv.net/"],"pathCnt":1,"requestHeader":["user-agent","accept-encoding","connection","host"],"requestHeaderCnt":4,"requestHeaderField":["accept-encoding","connection"],"requestHeaderValue":["gzip","close"],"requestHeaderValueCnt":2,"response-server":["Apache/2.4.41 (Ubuntu)"],"response-serverCnt":1,"response-x-powered-by":["PHP/7.4.3"],"response-x-powered-byCnt":1,"responseHeader":["content-length","x-powered-by","date","connection","content-type","server"],"responseHeaderCnt":6,"responseHeaderField":["connection","content-type","date","content-length"],"responseHeaderValue":["close","text/plain; charset=utf-8","mon, 31 aug 2026 07:20:22 gmt","94"],"responseHeaderValueCnt":4,"serverVersion":["1.1"],"serverVersionCnt":1,"sha256":["1ca624415b2889dbeb3f969890b848b7bc5eaf96ca5e8fdd7461f943b45d10cb"],"sha256Cnt":1,"statuscode":[200],"statuscodeCnt":1,"uri":["http://azenv.net/"],"uriCnt":1,"useragent":["Go-http-client/1.1"],"useragentCnt":1},"initRTT":65,"ipProtocol":6,"lastPacket":1788160822286,"length":390,"network":{"bytes":1208,"community_id":"1:z1SpC0UDIJ8PVBYhuQWpSZe3PQ4=","packets":12},"node":"spark-afae","packetPos":[-82351,39532737,90,402,82,207,82,369,1014,82,0,0,520],"packetRange":{"gte":1788160821896,"lte":1788160822286},"protocol":["http","tcp"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":287},"source":{"as":{"full":"AS51396 Pfcloud UG (haftungsbeschrankt)","number":51396,"organization":{"name":"Pfcloud UG (haftungsbeschrankt)"}},"bytes":583,"geo":{"country_iso_code":"NL"},"ip":"204.76.203.7","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":7,"port":38116},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcPayload8":"4745542068747470","srcRIR":"ARIN","srcTTL":[50],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["1599239500691698"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["ce8622a8-6d2f-4fe3-ab81-0cc86e19363e","3d144850-efcc-436a-9008-c5d28ac581ae","869feaa1-dc77-4037-aee2-247b7a39cf7d","23e6932c-e2bd-48cf-80b8-aa98ae9276c4","ee583a2e-d308-4c53-b8e2-a1cd45cd1bb7"],"signatureCnt":5,"signatureId":[2000166,1070034,1030619,1031486,2000008],"signatureIdCnt":5},"tag":{"block":["true","false"],"blockCnt":2,"category":["protocol","activity","attack","recon","tool"],"categoryCnt":5,"cves":[""],"cvesCnt":1,"description":["ip addresses with this tag have been seen crawling http(s) servers around the internet.","generic web crawler traffic detected. the simple pattern of get requests without specific exploitation indicators suggests automated crawling activity, possibly for search indexing or vulnerability scanning.","ip addresses with this tag have been observed crawling the internet for unauthenticated web proxies and testing if they are functional.","ip addresses with this tag have been observed scanning the internet using the golang http client.","cloud credential scanning probe detected. requests for sensitive configuration files and credentials indicate automated scanning for exposed secrets and api keys."],"intention":["unknown","suspicious","malicious"],"intentionCnt":3,"name":["root path scanner","open proxy scanner","go http client","web crawler"],"nameCnt":4},"tags":["frantech-ts","sensor:frantech-ts","honeypot"],"tagsCnt":3,"tcp":{"ja4ls":"42_64_tcp","ja4t":["64240_2-4-8-1-3_1400_7"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":4,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":2,"psh":2,"rst":2,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":913703813},"totDataBytes":412} +{"@timestamp":1788160622526,"_id":"260831-tD0Iyg5tsS1IqrC6rq3bgTmc","_index":"arkime_sessions3-260831","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Kaopu Cloud HK Limited"],"isp.dstCnt":1,"isp.src":["Pfcloud UG"],"isp.srcCnt":1,"org.dst":["LightNode-BH"],"org.dstCnt":1,"org.src":["Intelligence Hosting LLC"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":0,"geo":{"country_iso_code":"BH"},"ip":"38.54.2.209","mac":["52:54:8f:9d:76:48"],"mac-cnt":1,"packets":0,"port":28015},"dstRIR":"ARIN","ethertype":2048,"fileId":[82348],"firstPacket":1788159914622,"ipProtocol":6,"lastPacket":1788159914622,"length":0,"network":{"bytes":54,"community_id":"1:t/94xYFngDg172dS+qYZuNEzrMY=","packets":1},"node":"spark-afae","packetPos":[-82348,326256],"packetRange":{"gte":1788159914622,"lte":1788159914622},"protocol":["tcp"],"protocolCnt":1,"rootId":"260831-tD0Iyg5tsS1IqrC6rq3bgTmc","segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51396 Pfcloud UG (haftungsbeschrankt)","number":51396,"organization":{"name":"Pfcloud UG (haftungsbeschrankt)"}},"bytes":54,"geo":{"country_iso_code":"NL"},"ip":"204.76.203.7","mac":["98:44:ce:60:15:19"],"mac-cnt":1,"packets":1,"port":48842},"spoofable":["true"],"spoofableCnt":1,"srcDscp":[18],"srcDscpCnt":1,"srcOui":["Huawei Technologies Co.,Ltd"],"srcOuiCnt":1,"srcRIR":"ARIN","srcTTL":[240],"srcTTLCnt":1,"tags":["bahrain-sponge-01-ts","honeypot","sensor:bahrain-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["65535_00_00_00"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":1094539491},"totDataBytes":0} +{"@timestamp":1788160320732,"_id":"260831-qT1tSdLTMrhGJ5pjYP6A_XId","_index":"arkime_sessions3-260831","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["Pfcloud UG"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["Intelligence Hosting LLC"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":58,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":1,"port":28015},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[82345],"firstPacket":1788159812625,"ipProtocol":6,"lastPacket":1788159812757,"length":132,"network":{"bytes":170,"community_id":"1:reARVY05wSYil94Q4GfsVMBml5w=","packets":3},"node":"spark-afae","packetPos":[-82345,37860552,74,544],"packetRange":{"gte":1788159812625,"lte":1788159812757},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51396 Pfcloud UG (haftungsbeschrankt)","number":51396,"organization":{"name":"Pfcloud UG (haftungsbeschrankt)"}},"bytes":112,"geo":{"country_iso_code":"NL"},"ip":"204.76.203.7","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":2,"port":46143},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"ARIN","srcTTL":[50,241],"srcTTLCnt":2,"tags":["sensor:frantech-ts","frantech-ts","honeypot"],"tagsCnt":3,"tcp":{"ja4t":["65535_2_536_00"],"ja4tCnt":1,"ja4ts":["64240_2_1460_00"],"ja4tsCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":1181953047},"totDataBytes":0} +{"@timestamp":1788160019308,"_id":"260831-NsxvQAN6pLJCZrqJuVvW-Mla","_index":"arkime_sessions3-260831","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["netcup GmbH"],"isp.dstCnt":1,"isp.src":["Pfcloud UG"],"isp.srcCnt":1,"org.dst":["Netcup KVM"],"org.dstCnt":1,"org.src":["Intelligence Hosting LLC"],"org.srcCnt":1,"usertype.dst":["business"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS197540 netcup GmbH","number":197540,"organization":{"name":"netcup GmbH"}},"bytes":0,"geo":{"country_iso_code":"DE"},"ip":"159.195.21.150","mac":["8a:41:d3:b8:0d:d3"],"mac-cnt":1,"packets":0,"port":28015},"dstRIR":"ARIN","ethertype":2048,"fileId":[82342],"firstPacket":1788158942663,"ipProtocol":6,"lastPacket":1788158942663,"length":0,"network":{"bytes":56,"community_id":"1:WiJLWwhTDHlxnLyJtc2EeYw3ge4=","packets":1},"node":"spark-afae","packetPos":[-82342,247587],"packetRange":{"gte":1788158942663,"lte":1788158942663},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51396 Pfcloud UG (haftungsbeschrankt)","number":51396,"organization":{"name":"Pfcloud UG (haftungsbeschrankt)"}},"bytes":56,"geo":{"country_iso_code":"NL"},"ip":"204.76.203.7","mac":["bc:0f:fe:38:0b:a3"],"mac-cnt":1,"packets":1,"port":36460},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"ARIN","srcTTL":[248],"srcTTLCnt":1,"tags":["sensor:netcup-ts","honeypot","netcup-ts"],"tagsCnt":3,"tcp":{"ja4t":["65535_00_00_00"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":2396114459},"totDataBytes":0} +{"@timestamp":1788159419967,"_id":"260831-iD1byUANLWFMpIJ8KBKx7FyZ","_index":"arkime_sessions3-260831","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Hetzner Online GmbH"],"isp.dstCnt":1,"isp.src":["Pfcloud UG"],"isp.srcCnt":1,"org.dst":["HETZNER-DC"],"org.dstCnt":1,"org.src":["Intelligence Hosting LLC"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS24940 Hetzner Online GmbH","number":24940,"organization":{"name":"Hetzner Online GmbH"}},"bytes":0,"geo":{"country_iso_code":"FI"},"ip":"89.167.72.144","mac":["92:00:07:4c:82:70"],"mac-cnt":1,"packets":0,"port":28015},"dstRIR":"RIPE","ethertype":2048,"fileId":[82339],"firstPacket":1788158624621,"ipProtocol":6,"lastPacket":1788158624621,"length":0,"network":{"bytes":54,"community_id":"1:POCOqOtk6P4trg6THxEQ2uUkyks=","packets":1},"node":"spark-afae","packetPos":[-82339,472175],"packetRange":{"gte":1788158624621,"lte":1788158624621},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51396 Pfcloud UG (haftungsbeschrankt)","number":51396,"organization":{"name":"Pfcloud UG (haftungsbeschrankt)"}},"bytes":54,"geo":{"country_iso_code":"NL"},"ip":"204.76.203.7","mac":["d2:74:7f:6e:37:e3"],"mac-cnt":1,"packets":1,"port":37556},"spoofable":["true"],"spoofableCnt":1,"srcRIR":"ARIN","srcTTL":[244],"srcTTLCnt":1,"tags":["sensor:sponge-01-ts","honeypot","sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["65535_00_00_00"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":1944178273},"totDataBytes":0} +{"@timestamp":1788158814684,"_id":"260831-cj16RYBZhZNP-5fLPSHd45ON","_index":"arkime_sessions3-260831","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo GmbH"],"isp.dstCnt":1,"isp.src":["Pfcloud UG"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Intelligence Hosting LLC"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS51167 Contabo GmbH","number":51167,"organization":{"name":"Contabo GmbH"}},"bytes":0,"geo":{"country_iso_code":"FR"},"ip":"109.123.246.142","mac":["00:50:56:63:46:a6"],"mac-cnt":1,"packets":0,"port":28015},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[82335],"firstPacket":1788158388584,"ipProtocol":6,"lastPacket":1788158388584,"length":0,"network":{"bytes":60,"community_id":"1:epXaZhpZTbif2w1Y2cTUGQm/dpw=","packets":1},"node":"spark-afae","packetPos":[-82335,2358569],"packetRange":{"gte":1788158388584,"lte":1788158388584},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51396 Pfcloud UG (haftungsbeschrankt)","number":51396,"organization":{"name":"Pfcloud UG (haftungsbeschrankt)"}},"bytes":60,"geo":{"country_iso_code":"NL"},"ip":"204.76.203.7","mac":["c0:69:11:cd:1f:19"],"mac-cnt":1,"packets":1,"port":48562},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcRIR":"ARIN","srcTTL":[243],"srcTTLCnt":1,"tags":["proxy","sensor:contabo-sponge-02-ts","contabo-sponge-02-ts"],"tagsCnt":3,"tcp":{"ja4t":["65535_00_00_00"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":4078511119},"totDataBytes":0} +{"@timestamp":1788158515452,"_id":"260831-Zz2-hi3DiTRMALC8dPuGYGwR","_index":"arkime_sessions3-260831","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Pfcloud UG"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Intelligence Hosting LLC"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":0,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":0,"port":28015},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[82333],"firstPacket":1788157760619,"ipProtocol":6,"lastPacket":1788157760619,"length":0,"network":{"bytes":60,"community_id":"1:k2tPeFGA2c3ReLm9GQ7q0zp7r6I=","packets":1},"node":"spark-afae","packetPos":[-82333,385941],"packetRange":{"gte":1788157760619,"lte":1788157760619},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51396 Pfcloud UG (haftungsbeschrankt)","number":51396,"organization":{"name":"Pfcloud UG (haftungsbeschrankt)"}},"bytes":60,"geo":{"country_iso_code":"NL"},"ip":"204.76.203.7","mac":["fc:bd:67:9d:2b:2b"],"mac-cnt":1,"packets":1,"port":58872},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcRIR":"ARIN","srcTTL":[244],"srcTTLCnt":1,"tags":["sensor:contabo-sponge-01-ts","honeypot","contabo-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["65535_00_00_00"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":1885830942},"totDataBytes":0} +{"@timestamp":1788157604274,"_id":"260831-_svXXFgMrvNAO4-IW8UPh9iM","_index":"arkime_sessions3-260831","client":{"bytes":3},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["Pfcloud UG"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["Intelligence Hosting LLC"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":1064,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":16,"port":28017},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[82328],"firstPacket":1788156753987,"initRTT":66,"ipProtocol":6,"lastPacket":1788156876586,"length":122599,"network":{"bytes":2329,"community_id":"1:cpVmdRlBNMRt4+gzPwOeyEftsFA=","packets":35},"node":"spark-afae","packetPos":[-82328,19212267,90,160,82,85,25970,500,234,82,19621,222,316,82,19314,432,332,82,61539,1360,1799,82,16299,362,82,0,15029,222,82,0,27367,1350,164,82,21254,82],"packetRange":{"gte":1788156753987,"lte":1788156876586},"protocol":["tcp"],"protocolCnt":1,"rootId":"260831-_svXXFgMrvNAO4-IW8UPh9iM","segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51396 Pfcloud UG (haftungsbeschrankt)","number":51396,"organization":{"name":"Pfcloud UG (haftungsbeschrankt)"}},"bytes":1265,"geo":{"country_iso_code":"NL"},"ip":"204.76.203.7","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":19,"port":34700},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcPayload8":"050100","srcRIR":"ARIN","srcTTL":[50],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":["Attempted Information Leak",""],"categoryCnt":2,"flowId":["302656256062005"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[2,3],"severityCnt":2,"signature":["553b5765-6241-4e9a-9982-0ca113796134","5a66c944-faed-4791-9d94-b44b7bd48352"],"signatureCnt":2,"signatureId":[1031235,2000181],"signatureIdCnt":2},"tag":{"block":["false","true"],"blockCnt":2,"category":["recon","activity"],"categoryCnt":2,"cves":[""],"cvesCnt":1,"description":["ip addresses with this tag have been observed attempting to discover socks5 proxies that do not require authentication.","socks proxy protocol negotiation"],"intention":["suspicious"],"intentionCnt":1,"name":["socks proxy protocol negotiation","socks5 proxy scanner"],"nameCnt":2},"tags":["honeypot","sensor:frantech-ts","frantech-ts"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-4-8-1-3_1400_7"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":30,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":1,"psh":1,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":2091935025},"totDataBytes":3} +{"@timestamp":1788157604260,"_id":"260831-_sueR_V46XxCfIiYaX82uD0C","_index":"arkime_sessions3-260831","client":{"bytes":125},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["Pfcloud UG"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["Intelligence Hosting LLC"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":625,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":5,"port":28017},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstPayload8":"485454502f312e31","dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[82328],"firstPacket":1788156618619,"http":{"bodyMagic":["text/html"],"bodyMagicCnt":1,"clientVersion":["1.1"],"clientVersionCnt":1,"host":["azenv.net"],"hostCnt":1,"ja4h":["ge11nn040000_8391bea91fb6_000000000000_000000000000"],"ja4hCnt":1,"ja4h_r":["ge11nn040000_Host,User-Agent,Accept-Encoding,Connection__"],"ja4h_rCnt":1,"md5":["0f87454a3ea15f0db55ae928dbcd82fc"],"md5Cnt":1,"method":["GET"],"method-GET":1,"methodCnt":1,"path":["http://azenv.net/"],"pathCnt":1,"requestHeader":["accept-encoding","connection","user-agent","host"],"requestHeaderCnt":4,"requestHeaderField":["accept-encoding","connection"],"requestHeaderValue":["gzip","close"],"requestHeaderValueCnt":2,"response-server":["Apache/2.4.41 (Ubuntu)"],"response-serverCnt":1,"response-x-powered-by":["PHP/7.4.3"],"response-x-powered-byCnt":1,"responseHeader":["server","connection","content-type","date","x-powered-by","content-length"],"responseHeaderCnt":6,"responseHeaderField":["connection","content-type","date","content-length"],"responseHeaderValue":["close","text/plain; charset=utf-8","mon, 31 aug 2026 06:10:18 gmt","94"],"responseHeaderValueCnt":4,"serverVersion":["1.1"],"serverVersionCnt":1,"sha256":["1ca624415b2889dbeb3f969890b848b7bc5eaf96ca5e8fdd7461f943b45d10cb"],"sha256Cnt":1,"statuscode":[200],"statuscodeCnt":1,"uri":["http://azenv.net/"],"uriCnt":1,"useragent":["Go-http-client/1.1"],"useragentCnt":1},"initRTT":64,"ipProtocol":6,"lastPacket":1788156618876,"length":257,"network":{"bytes":1088,"community_id":"1:W1MyX6bhAsiAidvgV52u8DFga1c=","packets":10},"node":"spark-afae","packetPos":[-82328,18623350,90,3247,82,207,82,369,82,0,0],"packetRange":{"gte":1788156618619,"lte":1788156618876},"protocol":["http","tcp"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":287},"source":{"as":{"full":"AS51396 Pfcloud UG (haftungsbeschrankt)","number":51396,"organization":{"name":"Pfcloud UG (haftungsbeschrankt)"}},"bytes":463,"geo":{"country_iso_code":"NL"},"ip":"204.76.203.7","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":5,"port":38856},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcPayload8":"4745542068747470","srcRIR":"ARIN","srcTTL":[50],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["690282550530438"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["ce8622a8-6d2f-4fe3-ab81-0cc86e19363e","3d144850-efcc-436a-9008-c5d28ac581ae","869feaa1-dc77-4037-aee2-247b7a39cf7d","23e6932c-e2bd-48cf-80b8-aa98ae9276c4","ee583a2e-d308-4c53-b8e2-a1cd45cd1bb7"],"signatureCnt":5,"signatureId":[2000166,1070034,1030619,1031486,2000008],"signatureIdCnt":5},"tag":{"block":["false","true"],"blockCnt":2,"category":["protocol","tool","recon","activity","attack"],"categoryCnt":5,"cves":[""],"cvesCnt":1,"description":["generic web crawler traffic detected. the simple pattern of get requests without specific exploitation indicators suggests automated crawling activity, possibly for search indexing or vulnerability scanning.","ip addresses with this tag have been observed crawling the internet for unauthenticated web proxies and testing if they are functional.","ip addresses with this tag have been observed scanning the internet using the golang http client.","cloud credential scanning probe detected. requests for sensitive configuration files and credentials indicate automated scanning for exposed secrets and api keys.","ip addresses with this tag have been seen crawling http(s) servers around the internet."],"intention":["unknown","suspicious","malicious"],"intentionCnt":3,"name":["root path scanner","web crawler","open proxy scanner","go http client"],"nameCnt":4},"tags":["honeypot","sensor:frantech-ts","frantech-ts"],"tagsCnt":3,"tcp":{"ja4ls":"42_64_tcp","ja4t":["64240_2-4-8-1-3_1400_7"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":4,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":2,"psh":2,"rst":0,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":2487249366},"totDataBytes":412} +{"@timestamp":1788157305970,"_id":"260831-Rj1NfZJKdtRAHp6rBy4wM895","_index":"arkime_sessions3-260831","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["netcup GmbH"],"isp.dstCnt":1,"isp.src":["Pfcloud UG"],"isp.srcCnt":1,"org.dst":["Netcup KVM"],"org.dstCnt":1,"org.src":["Intelligence Hosting LLC"],"org.srcCnt":1,"usertype.dst":["business"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS197540 netcup GmbH","number":197540,"organization":{"name":"netcup GmbH"}},"bytes":0,"geo":{"country_iso_code":"DE"},"ip":"159.195.21.150","mac":["8a:41:d3:b8:0d:d3"],"mac-cnt":1,"packets":0,"port":28017},"dstRIR":"ARIN","ethertype":2048,"fileId":[82325],"firstPacket":1788156195863,"ipProtocol":6,"lastPacket":1788156195863,"length":0,"network":{"bytes":56,"community_id":"1:blLGs8ikJ4kMnziz3Vo4pWSxhig=","packets":1},"node":"spark-afae","packetPos":[-82325,77319],"packetRange":{"gte":1788156195863,"lte":1788156195863},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51396 Pfcloud UG (haftungsbeschrankt)","number":51396,"organization":{"name":"Pfcloud UG (haftungsbeschrankt)"}},"bytes":56,"geo":{"country_iso_code":"NL"},"ip":"204.76.203.7","mac":["bc:0f:fe:38:0b:a3"],"mac-cnt":1,"packets":1,"port":60300},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"ARIN","srcTTL":[248],"srcTTLCnt":1,"tags":["sensor:netcup-ts","honeypot","netcup-ts"],"tagsCnt":3,"tcp":{"ja4t":["65535_00_00_00"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":2836442277},"totDataBytes":0} +{"@timestamp":1788156403472,"_id":"260831-JT2aMXZx9lRH1KmG2oAg_9g-","_index":"arkime_sessions3-260831","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Kaopu Cloud HK Limited"],"isp.dstCnt":1,"isp.src":["Pfcloud UG"],"isp.srcCnt":1,"org.dst":["LightNode-BH"],"org.dstCnt":1,"org.src":["Intelligence Hosting LLC"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":0,"geo":{"country_iso_code":"BH"},"ip":"38.54.2.209","mac":["52:54:8f:9d:76:48"],"mac-cnt":1,"packets":0,"port":28017},"dstRIR":"ARIN","ethertype":2048,"fileId":[82318],"firstPacket":1788155333816,"ipProtocol":6,"lastPacket":1788155333816,"length":0,"network":{"bytes":54,"community_id":"1:dsRN+M1c8Y/0iZhm3m4Ay1Wiwd4=","packets":1},"node":"spark-afae","packetPos":[-82318,89098],"packetRange":{"gte":1788155333816,"lte":1788155333816},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51396 Pfcloud UG (haftungsbeschrankt)","number":51396,"organization":{"name":"Pfcloud UG (haftungsbeschrankt)"}},"bytes":54,"geo":{"country_iso_code":"NL"},"ip":"204.76.203.7","mac":["98:44:ce:60:15:19"],"mac-cnt":1,"packets":1,"port":53928},"spoofable":["true"],"spoofableCnt":1,"srcDscp":[18],"srcDscpCnt":1,"srcOui":["Huawei Technologies Co.,Ltd"],"srcOuiCnt":1,"srcRIR":"ARIN","srcTTL":[241],"srcTTLCnt":1,"tags":["bahrain-sponge-01-ts","sensor:bahrain-sponge-01-ts","honeypot"],"tagsCnt":3,"tcp":{"ja4t":["65535_00_00_00"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":3958585134},"totDataBytes":0} +{"@timestamp":1788155804434,"_id":"260831-Dj25Ws3qOrJCKKvnkvX8jOw_","_index":"arkime_sessions3-260831","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Hetzner Online GmbH"],"isp.dstCnt":1,"isp.src":["Pfcloud UG"],"isp.srcCnt":1,"org.dst":["HETZNER-DC"],"org.dstCnt":1,"org.src":["Intelligence Hosting LLC"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS24940 Hetzner Online GmbH","number":24940,"organization":{"name":"Hetzner Online GmbH"}},"bytes":0,"geo":{"country_iso_code":"FI"},"ip":"89.167.72.144","mac":["92:00:07:4c:82:70"],"mac-cnt":1,"packets":0,"port":28017},"dstRIR":"RIPE","ethertype":2048,"fileId":[82315],"firstPacket":1788155067610,"ipProtocol":6,"lastPacket":1788155067610,"length":0,"network":{"bytes":54,"community_id":"1:Nd07AzIenaZOsB0E/XVRBsIgk4M=","packets":1},"node":"spark-afae","packetPos":[-82315,47087],"packetRange":{"gte":1788155067610,"lte":1788155067610},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51396 Pfcloud UG (haftungsbeschrankt)","number":51396,"organization":{"name":"Pfcloud UG (haftungsbeschrankt)"}},"bytes":54,"geo":{"country_iso_code":"NL"},"ip":"204.76.203.7","mac":["d2:74:7f:6e:37:e3"],"mac-cnt":1,"packets":1,"port":49926},"spoofable":["true"],"spoofableCnt":1,"srcRIR":"ARIN","srcTTL":[245],"srcTTLCnt":1,"tags":["honeypot","sensor:sponge-01-ts","sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["65535_00_00_00"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":316079462},"totDataBytes":0} +{"@timestamp":1788156104253,"_id":"260831-Gj0KM6dboupPrZTBsVo6-Z-k","_index":"arkime_sessions3-260831","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Pfcloud UG"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Intelligence Hosting LLC"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":0,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":0,"port":28017},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[82317],"firstPacket":1788155008308,"ipProtocol":6,"lastPacket":1788155008308,"length":0,"network":{"bytes":60,"community_id":"1:xnIFp9qqyPBK8RtylDWIZLXj89Y=","packets":1},"node":"spark-afae","packetPos":[-82317,304083],"packetRange":{"gte":1788155008308,"lte":1788155008308},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51396 Pfcloud UG (haftungsbeschrankt)","number":51396,"organization":{"name":"Pfcloud UG (haftungsbeschrankt)"}},"bytes":60,"geo":{"country_iso_code":"NL"},"ip":"204.76.203.7","mac":["fc:bd:67:9d:2b:2b"],"mac-cnt":1,"packets":1,"port":57806},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcRIR":"ARIN","srcTTL":[245],"srcTTLCnt":1,"tags":["honeypot","sensor:contabo-sponge-01-ts","contabo-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["65535_00_00_00"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":4280062025},"totDataBytes":0} +{"@timestamp":1788155205108,"_id":"260831-vMu-pL5TUb5AToACpZc_fz3L","_index":"arkime_sessions3-260831","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo GmbH"],"isp.dstCnt":1,"isp.src":["Pfcloud UG"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Intelligence Hosting LLC"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS51167 Contabo GmbH","number":51167,"organization":{"name":"Contabo GmbH"}},"bytes":0,"geo":{"country_iso_code":"FR"},"ip":"109.123.246.142","mac":["00:50:56:63:46:a6"],"mac-cnt":1,"packets":0,"port":28017},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[82309],"firstPacket":1788154890057,"ipProtocol":6,"lastPacket":1788154890057,"length":0,"network":{"bytes":60,"community_id":"1:4FzACNXR5zKSPzhly7itfeJYWQQ=","packets":1},"node":"spark-afae","packetPos":[-82309,947127],"packetRange":{"gte":1788154890057,"lte":1788154890057},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51396 Pfcloud UG (haftungsbeschrankt)","number":51396,"organization":{"name":"Pfcloud UG (haftungsbeschrankt)"}},"bytes":60,"geo":{"country_iso_code":"NL"},"ip":"204.76.203.7","mac":["c0:69:11:cd:1f:19"],"mac-cnt":1,"packets":1,"port":48157},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcRIR":"ARIN","srcTTL":[243],"srcTTLCnt":1,"tags":["proxy","contabo-sponge-02-ts","sensor:contabo-sponge-02-ts"],"tagsCnt":3,"tcp":{"ja4t":["65535_00_00_00"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":3518917786},"totDataBytes":0} +{"@timestamp":1788154899774,"_id":"260831-7jyvldIS-7VAF7M644IBaH1h","_index":"arkime_sessions3-260831","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["Pfcloud UG"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["Intelligence Hosting LLC"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":58,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":1,"port":28017},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[82308],"firstPacket":1788153761366,"ipProtocol":6,"lastPacket":1788153761508,"length":142,"network":{"bytes":170,"community_id":"1:OIN4BzKnsfvFWPpiTUetm6+XkAQ=","packets":3},"node":"spark-afae","packetPos":[-82308,331611,74,2105],"packetRange":{"gte":1788153761366,"lte":1788153761508},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51396 Pfcloud UG (haftungsbeschrankt)","number":51396,"organization":{"name":"Pfcloud UG (haftungsbeschrankt)"}},"bytes":112,"geo":{"country_iso_code":"NL"},"ip":"204.76.203.7","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":2,"port":40253},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"ARIN","srcTTL":[51,242],"srcTTLCnt":2,"tags":["sensor:frantech-ts","honeypot","frantech-ts"],"tagsCnt":3,"tcp":{"ja4t":["65535_2_536_00"],"ja4tCnt":1,"ja4ts":["64240_2_1460_00"],"ja4tsCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":3283011293},"totDataBytes":0} +{"@timestamp":1788153999147,"_id":"260831-zTxhOGiC-p5FN4dqxGvtE4Jw","_index":"arkime_sessions3-260831","client":{"bytes":3},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["Pfcloud UG"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["Intelligence Hosting LLC"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":1328,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":20,"port":28080},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[82303],"firstPacket":1788152945202,"initRTT":64,"ipProtocol":6,"lastPacket":1788153084499,"length":139297,"network":{"bytes":2857,"community_id":"1:/YtsECNoke0nsi4pXc3MnToQsyg=","packets":43},"node":"spark-afae","packetPos":[-82303,8793555,90,1098,82,85,123867,502,1468,82,96890,82,755,82,38896,222,0,82,26813,246,222,82,29821,564,552,82,54123,328,1598,82,25158,222,471,82,26041,82,394,82,60381,222,0,82,646,82],"packetRange":{"gte":1788152945202,"lte":1788153084499},"protocol":["tcp"],"protocolCnt":1,"rootId":"260831-zTxhOGiC-p5FN4dqxGvtE4Jw","segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51396 Pfcloud UG (haftungsbeschrankt)","number":51396,"organization":{"name":"Pfcloud UG (haftungsbeschrankt)"}},"bytes":1529,"geo":{"country_iso_code":"NL"},"ip":"204.76.203.7","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":23,"port":53318},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcPayload8":"050100","srcRIR":"ARIN","srcTTL":[49],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":["","Attempted Information Leak"],"categoryCnt":2,"flowId":["308113840161104"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[2,3],"severityCnt":2,"signature":["553b5765-6241-4e9a-9982-0ca113796134","5a66c944-faed-4791-9d94-b44b7bd48352"],"signatureCnt":2,"signatureId":[1031235,2000181],"signatureIdCnt":2},"tags":["honeypot","sensor:frantech-ts","frantech-ts"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-4-8-1-3_1400_7"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":38,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":1,"psh":1,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":928563089},"totDataBytes":3} +{"@timestamp":1788153999117,"_id":"260831-zTwkHAsqx1dGsp5uz79uGGSj","_index":"arkime_sessions3-260831","client":{"bytes":125},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["Pfcloud UG"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["Intelligence Hosting LLC"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":625,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":5,"port":28080},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstPayload8":"485454502f312e31","dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[82303],"firstPacket":1788152809960,"http":{"bodyMagic":["text/html"],"bodyMagicCnt":1,"clientVersion":["1.1"],"clientVersionCnt":1,"host":["azenv.net"],"hostCnt":1,"ja4h":["ge11nn040000_8391bea91fb6_000000000000_000000000000"],"ja4hCnt":1,"ja4h_r":["ge11nn040000_Host,User-Agent,Accept-Encoding,Connection__"],"ja4h_rCnt":1,"md5":["0f87454a3ea15f0db55ae928dbcd82fc"],"md5Cnt":1,"method":["GET"],"method-GET":1,"methodCnt":1,"path":["http://azenv.net/"],"pathCnt":1,"requestHeader":["user-agent","host","accept-encoding","connection"],"requestHeaderCnt":4,"requestHeaderField":["accept-encoding","connection"],"requestHeaderValue":["gzip","close"],"requestHeaderValueCnt":2,"response-server":["Apache/2.4.41 (Ubuntu)"],"response-serverCnt":1,"response-x-powered-by":["PHP/7.4.3"],"response-x-powered-byCnt":1,"responseHeader":["server","date","content-type","content-length","connection","x-powered-by"],"responseHeaderCnt":6,"responseHeaderField":["connection","content-type","date","content-length"],"responseHeaderValue":["close","text/plain; charset=utf-8","mon, 31 aug 2026 05:06:50 gmt","94"],"responseHeaderValueCnt":4,"serverVersion":["1.1"],"serverVersionCnt":1,"sha256":["1ca624415b2889dbeb3f969890b848b7bc5eaf96ca5e8fdd7461f943b45d10cb"],"sha256Cnt":1,"statuscode":[200],"statuscodeCnt":1,"uri":["http://azenv.net/"],"uriCnt":1,"useragent":["Go-http-client/1.1"],"useragentCnt":1},"initRTT":65,"ipProtocol":6,"lastPacket":1788152810220,"length":260,"network":{"bytes":1088,"community_id":"1:7CP9qA9ANxp0lcF2OuhjaI3x7tk=","packets":10},"node":"spark-afae","packetPos":[-82303,117154,90,0,82,207,82,369,82,0,0],"packetRange":{"gte":1788152809960,"lte":1788152810220},"protocol":["http","tcp"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":287},"source":{"as":{"full":"AS51396 Pfcloud UG (haftungsbeschrankt)","number":51396,"organization":{"name":"Pfcloud UG (haftungsbeschrankt)"}},"bytes":463,"geo":{"country_iso_code":"NL"},"ip":"204.76.203.7","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":5,"port":34658},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcPayload8":"4745542068747470","srcRIR":"ARIN","srcTTL":[50],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["467245330024162"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["869feaa1-dc77-4037-aee2-247b7a39cf7d","3d144850-efcc-436a-9008-c5d28ac581ae","23e6932c-e2bd-48cf-80b8-aa98ae9276c4","ee583a2e-d308-4c53-b8e2-a1cd45cd1bb7","ce8622a8-6d2f-4fe3-ab81-0cc86e19363e"],"signatureCnt":5,"signatureId":[2000166,1070034,1030619,1031486,2000008],"signatureIdCnt":5},"tag":{"block":["false","true"],"blockCnt":2,"category":["attack","recon","protocol","tool","activity"],"categoryCnt":5,"cves":[""],"cvesCnt":1,"description":["ip addresses with this tag have been seen crawling http(s) servers around the internet.","cloud credential scanning probe detected. requests for sensitive configuration files and credentials indicate automated scanning for exposed secrets and api keys.","generic web crawler traffic detected. the simple pattern of get requests without specific exploitation indicators suggests automated crawling activity, possibly for search indexing or vulnerability scanning.","ip addresses with this tag have been observed crawling the internet for unauthenticated web proxies and testing if they are functional.","ip addresses with this tag have been observed scanning the internet using the golang http client."],"intention":["suspicious","malicious","unknown"],"intentionCnt":3,"name":["go http client","web crawler","open proxy scanner","root path scanner"],"nameCnt":4},"tags":["honeypot","sensor:frantech-ts","frantech-ts"],"tagsCnt":3,"tcp":{"ja4ls":"48_64_tcp","ja4t":["64240_2-4-8-1-3_1400_7"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":4,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":2,"psh":2,"rst":0,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":2297734709},"totDataBytes":412} +{"@timestamp":1788153397489,"_id":"260831-tzyawe7AS5lP44eGUfrC9VXe","_index":"arkime_sessions3-260831","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Pfcloud UG"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Intelligence Hosting LLC"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":0,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":0,"port":28080},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[82298],"firstPacket":1788152724456,"ipProtocol":6,"lastPacket":1788152724456,"length":0,"network":{"bytes":60,"community_id":"1:lS75XMRMx5IqGiNLB37LzAqfKw4=","packets":1},"node":"spark-afae","packetPos":[-82298,819003],"packetRange":{"gte":1788152724456,"lte":1788152724456},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51396 Pfcloud UG (haftungsbeschrankt)","number":51396,"organization":{"name":"Pfcloud UG (haftungsbeschrankt)"}},"bytes":60,"geo":{"country_iso_code":"NL"},"ip":"204.76.203.7","mac":["fc:bd:67:9d:2b:2b"],"mac-cnt":1,"packets":1,"port":33330},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcRIR":"ARIN","srcTTL":[244],"srcTTLCnt":1,"tags":["contabo-sponge-01-ts","sensor:contabo-sponge-01-ts","honeypot"],"tagsCnt":3,"tcp":{"ja4t":["65535_00_00_00"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":853389461},"totDataBytes":0} +{"@timestamp":1788153097282,"_id":"260831-kMtkKoEGN7hCOp7XSEc4bCk6","_index":"arkime_sessions3-260831","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Hetzner Online GmbH"],"isp.dstCnt":1,"isp.src":["Pfcloud UG"],"isp.srcCnt":1,"org.dst":["HETZNER-DC"],"org.dstCnt":1,"org.src":["Intelligence Hosting LLC"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS24940 Hetzner Online GmbH","number":24940,"organization":{"name":"Hetzner Online GmbH"}},"bytes":0,"geo":{"country_iso_code":"FI"},"ip":"89.167.72.144","mac":["92:00:07:4c:82:70"],"mac-cnt":1,"packets":0,"port":28080},"dstRIR":"RIPE","ethertype":2048,"fileId":[82296],"firstPacket":1788152418370,"ipProtocol":6,"lastPacket":1788152418370,"length":0,"network":{"bytes":54,"community_id":"1:prCSpfDJW59smPLKwU3rJDA9j5U=","packets":1},"node":"spark-afae","packetPos":[-82296,45854],"packetRange":{"gte":1788152418370,"lte":1788152418370},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51396 Pfcloud UG (haftungsbeschrankt)","number":51396,"organization":{"name":"Pfcloud UG (haftungsbeschrankt)"}},"bytes":54,"geo":{"country_iso_code":"NL"},"ip":"204.76.203.7","mac":["d2:74:7f:6e:37:e3"],"mac-cnt":1,"packets":1,"port":51401},"spoofable":["true"],"spoofableCnt":1,"srcRIR":"ARIN","srcTTL":[245],"srcTTLCnt":1,"tags":["sponge-01-ts","honeypot","sensor:sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["65535_00_00_00"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":1822439004},"totDataBytes":0} +{"@timestamp":1788152797506,"_id":"260831-oTz7c9pF7m9ApoMZvCxFpyMC","_index":"arkime_sessions3-260831","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo GmbH"],"isp.dstCnt":1,"isp.src":["Pfcloud UG"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Intelligence Hosting LLC"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS51167 Contabo GmbH","number":51167,"organization":{"name":"Contabo GmbH"}},"bytes":0,"geo":{"country_iso_code":"FR"},"ip":"109.123.246.142","mac":["00:50:56:63:46:a6"],"mac-cnt":1,"packets":0,"port":28080},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[82294],"firstPacket":1788151465725,"ipProtocol":6,"lastPacket":1788151465725,"length":0,"network":{"bytes":60,"community_id":"1:59700E9qutjBVMWDrkR/miIv1bg=","packets":1},"node":"spark-afae","packetPos":[-82294,15818],"packetRange":{"gte":1788151465725,"lte":1788151465725},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51396 Pfcloud UG (haftungsbeschrankt)","number":51396,"organization":{"name":"Pfcloud UG (haftungsbeschrankt)"}},"bytes":60,"geo":{"country_iso_code":"NL"},"ip":"204.76.203.7","mac":["c0:69:11:cd:1f:19"],"mac-cnt":1,"packets":1,"port":33210},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcRIR":"ARIN","srcTTL":[243],"srcTTLCnt":1,"tags":["proxy","sensor:contabo-sponge-02-ts","contabo-sponge-02-ts"],"tagsCnt":3,"tcp":{"ja4t":["65535_00_00_00"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":2387440218},"totDataBytes":0} +{"@timestamp":1788151894732,"_id":"260831-gDwf7sRcRQBNnKcrs2Ob038j","_index":"arkime_sessions3-260831","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Kaopu Cloud HK Limited"],"isp.dstCnt":1,"isp.src":["Pfcloud UG"],"isp.srcCnt":1,"org.dst":["LightNode-BH"],"org.dstCnt":1,"org.src":["Intelligence Hosting LLC"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":0,"geo":{"country_iso_code":"BH"},"ip":"38.54.2.209","mac":["52:54:8f:9d:76:48"],"mac-cnt":1,"packets":0,"port":28080},"dstRIR":"ARIN","ethertype":2048,"fileId":[82289],"firstPacket":1788151174815,"ipProtocol":6,"lastPacket":1788151174815,"length":0,"network":{"bytes":54,"community_id":"1:Rh4dpCzAQfqH1zlIDBSeN/V2PQw=","packets":1},"node":"spark-afae","packetPos":[-82289,158764],"packetRange":{"gte":1788151174815,"lte":1788151174815},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51396 Pfcloud UG (haftungsbeschrankt)","number":51396,"organization":{"name":"Pfcloud UG (haftungsbeschrankt)"}},"bytes":54,"geo":{"country_iso_code":"NL"},"ip":"204.76.203.7","mac":["98:44:ce:60:15:19"],"mac-cnt":1,"packets":1,"port":39113},"spoofable":["true"],"spoofableCnt":1,"srcDscp":[18],"srcDscpCnt":1,"srcOui":["Huawei Technologies Co.,Ltd"],"srcOuiCnt":1,"srcRIR":"ARIN","srcTTL":[240],"srcTTLCnt":1,"tags":["honeypot","bahrain-sponge-01-ts","sensor:bahrain-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["65535_00_00_00"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":1823935315},"totDataBytes":0} +{"@timestamp":1788150384299,"_id":"260831-STwkcTWFkstDjLb2bntHkaGF","_index":"arkime_sessions3-260831","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["Pfcloud UG"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["Intelligence Hosting LLC"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":58,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":1,"port":28080},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[82278],"firstPacket":1788149844724,"ipProtocol":6,"lastPacket":1788149844854,"length":130,"network":{"bytes":170,"community_id":"1:lh0uqsfPJRDgfHD/Q8yCROG5tzU=","packets":3},"node":"spark-afae","packetPos":[-82278,5186663,74,0],"packetRange":{"gte":1788149844724,"lte":1788149844854},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51396 Pfcloud UG (haftungsbeschrankt)","number":51396,"organization":{"name":"Pfcloud UG (haftungsbeschrankt)"}},"bytes":112,"geo":{"country_iso_code":"NL"},"ip":"204.76.203.7","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":2,"port":37745},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"ARIN","srcTTL":[49,240],"srcTTLCnt":2,"tags":["honeypot","frantech-ts","sensor:frantech-ts"],"tagsCnt":3,"tcp":{"ja4t":["65535_2_536_00"],"ja4tCnt":1,"ja4ts":["64240_2_1460_00"],"ja4tsCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":2306315447},"totDataBytes":0} +{"@timestamp":1788150388869,"_id":"260831-Q8sOfN8uvAdBAqOxeqWuxjhP","_index":"arkime_sessions3-260831","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["netcup GmbH"],"isp.dstCnt":1,"isp.src":["Pfcloud UG"],"isp.srcCnt":1,"org.dst":["Netcup KVM"],"org.dstCnt":1,"org.src":["Intelligence Hosting LLC"],"org.srcCnt":1,"usertype.dst":["business"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS197540 netcup GmbH","number":197540,"organization":{"name":"netcup GmbH"}},"bytes":0,"geo":{"country_iso_code":"DE"},"ip":"159.195.21.150","mac":["8a:41:d3:b8:0d:d3"],"mac-cnt":1,"packets":0,"port":28080},"dstRIR":"ARIN","ethertype":2048,"fileId":[82277],"firstPacket":1788149668008,"ipProtocol":6,"lastPacket":1788149668008,"length":0,"network":{"bytes":56,"community_id":"1:vO5aS/SzhcFKrBe3a6CIJ4ReQkI=","packets":1},"node":"spark-afae","packetPos":[-82277,2100788],"packetRange":{"gte":1788149668008,"lte":1788149668008},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51396 Pfcloud UG (haftungsbeschrankt)","number":51396,"organization":{"name":"Pfcloud UG (haftungsbeschrankt)"}},"bytes":56,"geo":{"country_iso_code":"NL"},"ip":"204.76.203.7","mac":["bc:0f:fe:38:0b:a3"],"mac-cnt":1,"packets":1,"port":38641},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"ARIN","srcTTL":[248],"srcTTLCnt":1,"tags":["netcup-ts","sensor:netcup-ts","honeypot"],"tagsCnt":3,"tcp":{"ja4t":["65535_00_00_00"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":2929491905},"totDataBytes":0} +{"@timestamp":1788148884280,"_id":"260831-HkWiNPsXqj9PnYcRKuNxNnCP","_index":"arkime_sessions3-260831","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo GmbH"],"isp.dstCnt":1,"isp.src":["Pfcloud UG"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Intelligence Hosting LLC"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS51167 Contabo GmbH","number":51167,"organization":{"name":"Contabo GmbH"}},"bytes":0,"geo":{"country_iso_code":"FR"},"ip":"109.123.246.142","mac":["00:50:56:63:46:a6"],"mac-cnt":1,"packets":0,"port":28081},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[82267],"firstPacket":1788148325826,"ipProtocol":6,"lastPacket":1788148325826,"length":0,"network":{"bytes":60,"community_id":"1:mwYPoJjYFuHyRODvng5gvp8GTvE=","packets":1},"node":"spark-afae","packetPos":[-82267,917359],"packetRange":{"gte":1788148325826,"lte":1788148325826},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51396 Pfcloud UG (haftungsbeschrankt)","number":51396,"organization":{"name":"Pfcloud UG (haftungsbeschrankt)"}},"bytes":60,"geo":{"country_iso_code":"NL"},"ip":"204.76.203.7","mac":["c0:69:11:cd:1f:19"],"mac-cnt":1,"packets":1,"port":44225},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcRIR":"ARIN","srcTTL":[244],"srcTTLCnt":1,"tags":["sensor:contabo-sponge-02-ts","contabo-sponge-02-ts","proxy"],"tagsCnt":3,"tcp":{"ja4t":["65535_00_00_00"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":2644219308},"totDataBytes":0} +{"@timestamp":1788148883894,"_id":"260831-NArZm4l_BSpBfoSxb024BLsj","_index":"arkime_sessions3-260831","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["Pfcloud UG"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["Intelligence Hosting LLC"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":0,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":0,"port":28081},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstRIR":"ARIN","ethertype":2048,"fileId":[82270],"firstPacket":1788148171366,"ipProtocol":6,"lastPacket":1788148171366,"length":0,"network":{"bytes":58,"community_id":"1:E82dzCknwDVTkx84Sfrmk99Nyas=","packets":1},"node":"spark-afae","packetPos":[-82270,2486455],"packetRange":{"gte":1788148171366,"lte":1788148171366},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51396 Pfcloud UG (haftungsbeschrankt)","number":51396,"organization":{"name":"Pfcloud UG (haftungsbeschrankt)"}},"bytes":58,"geo":{"country_iso_code":"NL"},"ip":"204.76.203.7","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":1,"port":48840},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"ARIN","srcTTL":[241],"srcTTLCnt":1,"tags":["frantech-ts","sensor:frantech-ts","honeypot"],"tagsCnt":3,"tcp":{"ja4t":["65535_2_536_00"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":3587117729},"totDataBytes":0} +{"@timestamp":1788148276257,"_id":"260831-_DvL80UGvDNFvJlt-IljaGNO","_index":"arkime_sessions3-260831","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["netcup GmbH"],"isp.dstCnt":1,"isp.src":["Pfcloud UG"],"isp.srcCnt":1,"org.dst":["Netcup KVM"],"org.dstCnt":1,"org.src":["Intelligence Hosting LLC"],"org.srcCnt":1,"usertype.dst":["business"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS197540 netcup GmbH","number":197540,"organization":{"name":"netcup GmbH"}},"bytes":0,"geo":{"country_iso_code":"DE"},"ip":"159.195.21.150","mac":["8a:41:d3:b8:0d:d3"],"mac-cnt":1,"packets":0,"port":28081},"dstRIR":"ARIN","ethertype":2048,"fileId":[82265],"firstPacket":1788147606642,"ipProtocol":6,"lastPacket":1788147606642,"length":0,"network":{"bytes":56,"community_id":"1:dbRSX2QqNsNP8rVPZFCe9EHwW98=","packets":1},"node":"spark-afae","packetPos":[-82265,1035301],"packetRange":{"gte":1788147606642,"lte":1788147606642},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51396 Pfcloud UG (haftungsbeschrankt)","number":51396,"organization":{"name":"Pfcloud UG (haftungsbeschrankt)"}},"bytes":56,"geo":{"country_iso_code":"NL"},"ip":"204.76.203.7","mac":["bc:0f:fe:38:0b:a3"],"mac-cnt":1,"packets":1,"port":48125},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"ARIN","srcTTL":[248],"srcTTLCnt":1,"tags":["sensor:netcup-ts","honeypot","netcup-ts"],"tagsCnt":3,"tcp":{"ja4t":["65535_00_00_00"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":3811087836},"totDataBytes":0} +{"@timestamp":1788148883937,"_id":"260831-I8sgWvskEvlO7oJiFu-t9c5r","_index":"arkime_sessions3-260831","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Pfcloud UG"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Intelligence Hosting LLC"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":0,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":0,"port":28081},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[82269],"firstPacket":1788147577359,"ipProtocol":6,"lastPacket":1788147577359,"length":0,"network":{"bytes":60,"community_id":"1:B0yrxm8bDXu6ToGSSt1iInp/Vz4=","packets":1},"node":"spark-afae","packetPos":[-82269,13856],"packetRange":{"gte":1788147577359,"lte":1788147577359},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51396 Pfcloud UG (haftungsbeschrankt)","number":51396,"organization":{"name":"Pfcloud UG (haftungsbeschrankt)"}},"bytes":60,"geo":{"country_iso_code":"NL"},"ip":"204.76.203.7","mac":["fc:bd:67:9d:2b:2b"],"mac-cnt":1,"packets":1,"port":36954},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcRIR":"ARIN","srcTTL":[244],"srcTTLCnt":1,"tags":["sensor:contabo-sponge-01-ts","honeypot","contabo-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["65535_00_00_00"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":2670894509},"totDataBytes":0} +{"@timestamp":1788147676391,"_id":"260831-Dcs5zKPV2XRG97YLmKK_7Uce","_index":"arkime_sessions3-260831","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Hetzner Online GmbH"],"isp.dstCnt":1,"isp.src":["Pfcloud UG"],"isp.srcCnt":1,"org.dst":["HETZNER-DC"],"org.dstCnt":1,"org.src":["Intelligence Hosting LLC"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS24940 Hetzner Online GmbH","number":24940,"organization":{"name":"Hetzner Online GmbH"}},"bytes":0,"geo":{"country_iso_code":"FI"},"ip":"89.167.72.144","mac":["92:00:07:4c:82:70"],"mac-cnt":1,"packets":0,"port":28081},"dstRIR":"RIPE","ethertype":2048,"fileId":[82260],"firstPacket":1788147460044,"ipProtocol":6,"lastPacket":1788147460044,"length":0,"network":{"bytes":54,"community_id":"1:8OzU4mEUJetGAdBY5Rr/O9PiV3k=","packets":1},"node":"spark-afae","packetPos":[-82260,117011],"packetRange":{"gte":1788147460044,"lte":1788147460044},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51396 Pfcloud UG (haftungsbeschrankt)","number":51396,"organization":{"name":"Pfcloud UG (haftungsbeschrankt)"}},"bytes":54,"geo":{"country_iso_code":"NL"},"ip":"204.76.203.7","mac":["d2:74:7f:6e:37:e3"],"mac-cnt":1,"packets":1,"port":54038},"spoofable":["true"],"spoofableCnt":1,"srcRIR":"ARIN","srcTTL":[244],"srcTTLCnt":1,"tags":["honeypot","sensor:sponge-01-ts","sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["65535_00_00_00"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":2401517767},"totDataBytes":0} +{"@timestamp":1788147083529,"_id":"260831-0TsJp3sQkDhDpbcOlWVTa-YT","_index":"arkime_sessions3-260831","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Kaopu Cloud HK Limited"],"isp.dstCnt":1,"isp.src":["Pfcloud UG"],"isp.srcCnt":1,"org.dst":["LightNode-BH"],"org.dstCnt":1,"org.src":["Intelligence Hosting LLC"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":0,"geo":{"country_iso_code":"BH"},"ip":"38.54.2.209","mac":["52:54:8f:9d:76:48"],"mac-cnt":1,"packets":0,"port":28081},"dstRIR":"ARIN","ethertype":2048,"fileId":[82257],"firstPacket":1788146846245,"ipProtocol":6,"lastPacket":1788146846245,"length":0,"network":{"bytes":54,"community_id":"1:MSgLJCXG1I2ewz18NJ9m65JI5Bg=","packets":1},"node":"spark-afae","packetPos":[-82257,560596],"packetRange":{"gte":1788146846245,"lte":1788146846245},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51396 Pfcloud UG (haftungsbeschrankt)","number":51396,"organization":{"name":"Pfcloud UG (haftungsbeschrankt)"}},"bytes":54,"geo":{"country_iso_code":"NL"},"ip":"204.76.203.7","mac":["98:44:ce:60:15:19"],"mac-cnt":1,"packets":1,"port":35781},"spoofable":["true"],"spoofableCnt":1,"srcDscp":[18],"srcDscpCnt":1,"srcOui":["Huawei Technologies Co.,Ltd"],"srcOuiCnt":1,"srcRIR":"ARIN","srcTTL":[241],"srcTTLCnt":1,"tags":["honeypot","sensor:bahrain-sponge-01-ts","bahrain-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["65535_00_00_00"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":1044021387},"totDataBytes":0} +{"@timestamp":1788147374914,"_id":"260831-AsunotNlsyNCAojI1Az-mJNn","_index":"arkime_sessions3-260831","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["netcup GmbH"],"isp.dstCnt":1,"isp.src":["Pfcloud UG"],"isp.srcCnt":1,"org.dst":["Netcup KVM"],"org.dstCnt":1,"org.src":["Intelligence Hosting LLC"],"org.srcCnt":1,"usertype.dst":["business"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS197540 netcup GmbH","number":197540,"organization":{"name":"netcup GmbH"}},"bytes":0,"geo":{"country_iso_code":"DE"},"ip":"159.195.21.150","mac":["8a:41:d3:b8:0d:d3"],"mac-cnt":1,"packets":0,"port":28737},"dstRIR":"ARIN","ethertype":2048,"fileId":[82258],"firstPacket":1788146230620,"ipProtocol":6,"lastPacket":1788146230620,"length":0,"network":{"bytes":56,"community_id":"1:CkjeLKr8x3GF1nYMSiLLUoJNEsk=","packets":1},"node":"spark-afae","packetPos":[-82258,36123],"packetRange":{"gte":1788146230620,"lte":1788146230620},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51396 Pfcloud UG (haftungsbeschrankt)","number":51396,"organization":{"name":"Pfcloud UG (haftungsbeschrankt)"}},"bytes":56,"geo":{"country_iso_code":"NL"},"ip":"204.76.203.7","mac":["bc:0f:fe:38:0b:a3"],"mac-cnt":1,"packets":1,"port":46344},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"ARIN","srcTTL":[248],"srcTTLCnt":1,"tags":["sensor:netcup-ts","honeypot","netcup-ts"],"tagsCnt":3,"tcp":{"ja4t":["65535_00_00_00"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":2074613938},"totDataBytes":0} +{"@timestamp":1788147074909,"_id":"260831-CEX_ANKS7ilPO5HokAv1udc6","_index":"arkime_sessions3-260831","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Hetzner Online GmbH"],"isp.dstCnt":1,"isp.src":["Pfcloud UG"],"isp.srcCnt":1,"org.dst":["HETZNER-DC"],"org.dstCnt":1,"org.src":["Intelligence Hosting LLC"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS24940 Hetzner Online GmbH","number":24940,"organization":{"name":"Hetzner Online GmbH"}},"bytes":0,"geo":{"country_iso_code":"FI"},"ip":"89.167.72.144","mac":["92:00:07:4c:82:70"],"mac-cnt":1,"packets":0,"port":28737},"dstRIR":"RIPE","ethertype":2048,"fileId":[82255],"firstPacket":1788145746196,"ipProtocol":6,"lastPacket":1788145746196,"length":0,"network":{"bytes":54,"community_id":"1:fgL2nSmHUtdJi/BfWQb9KJT8tQE=","packets":1},"node":"spark-afae","packetPos":[-82255,14642],"packetRange":{"gte":1788145746196,"lte":1788145746196},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51396 Pfcloud UG (haftungsbeschrankt)","number":51396,"organization":{"name":"Pfcloud UG (haftungsbeschrankt)"}},"bytes":54,"geo":{"country_iso_code":"NL"},"ip":"204.76.203.7","mac":["d2:74:7f:6e:37:e3"],"mac-cnt":1,"packets":1,"port":39967},"spoofable":["true"],"spoofableCnt":1,"srcRIR":"ARIN","srcTTL":[244],"srcTTLCnt":1,"tags":["honeypot","sponge-01-ts","sensor:sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["65535_00_00_00"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":1982015715},"totDataBytes":0} +{"@timestamp":1788146494854,"_id":"260831-uzvs6uAfekpNy7DK5-h80W9J","_index":"arkime_sessions3-260831","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Kaopu Cloud HK Limited"],"isp.dstCnt":1,"isp.src":["Pfcloud UG"],"isp.srcCnt":1,"org.dst":["LightNode-BH"],"org.dstCnt":1,"org.src":["Intelligence Hosting LLC"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":0,"geo":{"country_iso_code":"BH"},"ip":"38.54.2.209","mac":["52:54:8f:9d:76:48"],"mac-cnt":1,"packets":0,"port":28737},"dstRIR":"ARIN","ethertype":2048,"fileId":[82252],"firstPacket":1788145716945,"ipProtocol":6,"lastPacket":1788145716945,"length":0,"network":{"bytes":54,"community_id":"1:wrg3sI3SRFoviQNeC8spveR/WH8=","packets":1},"node":"spark-afae","packetPos":[-82252,884308],"packetRange":{"gte":1788145716945,"lte":1788145716945},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51396 Pfcloud UG (haftungsbeschrankt)","number":51396,"organization":{"name":"Pfcloud UG (haftungsbeschrankt)"}},"bytes":54,"geo":{"country_iso_code":"NL"},"ip":"204.76.203.7","mac":["98:44:ce:60:15:19"],"mac-cnt":1,"packets":1,"port":36430},"spoofable":["true"],"spoofableCnt":1,"srcDscp":[18],"srcDscpCnt":1,"srcOui":["Huawei Technologies Co.,Ltd"],"srcOuiCnt":1,"srcRIR":"ARIN","srcTTL":[240],"srcTTLCnt":1,"tags":["sensor:bahrain-sponge-01-ts","honeypot","bahrain-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["65535_00_00_00"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":3520137893},"totDataBytes":0} +{"@timestamp":1788146174260,"_id":"260831-sDtvkzMUcgVCEqrX1gnb-1_n","_index":"arkime_sessions3-260831","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Pfcloud UG"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Intelligence Hosting LLC"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":0,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":0,"port":28737},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[82250],"firstPacket":1788145222326,"ipProtocol":6,"lastPacket":1788145222326,"length":0,"network":{"bytes":60,"community_id":"1:4Uu49h5N8ckBmkBIWAhiutHG4mw=","packets":1},"node":"spark-afae","packetPos":[-82250,831221],"packetRange":{"gte":1788145222326,"lte":1788145222326},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51396 Pfcloud UG (haftungsbeschrankt)","number":51396,"organization":{"name":"Pfcloud UG (haftungsbeschrankt)"}},"bytes":60,"geo":{"country_iso_code":"NL"},"ip":"204.76.203.7","mac":["fc:bd:67:9d:2b:2b"],"mac-cnt":1,"packets":1,"port":51006},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcRIR":"ARIN","srcTTL":[245],"srcTTLCnt":1,"tags":["contabo-sponge-01-ts","honeypot","sensor:contabo-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["65535_00_00_00"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":633549532},"totDataBytes":0} +{"@timestamp":1788144952910,"_id":"260831-hDvRgsA5U_NF7ZNZjHIun7wL","_index":"arkime_sessions3-260831","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["Pfcloud UG"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["Intelligence Hosting LLC"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":0,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":0,"port":28737},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstRIR":"ARIN","ethertype":2048,"fileId":[82242],"firstPacket":1788144137339,"ipProtocol":6,"lastPacket":1788144137339,"length":0,"network":{"bytes":58,"community_id":"1:186GAncU/3vHGppCQQHejNgFoF8=","packets":1},"node":"spark-afae","packetPos":[-82242,1944185],"packetRange":{"gte":1788144137339,"lte":1788144137339},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51396 Pfcloud UG (haftungsbeschrankt)","number":51396,"organization":{"name":"Pfcloud UG (haftungsbeschrankt)"}},"bytes":58,"geo":{"country_iso_code":"NL"},"ip":"204.76.203.7","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":1,"port":41855},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"ARIN","srcTTL":[240],"srcTTLCnt":1,"tags":["frantech-ts","sensor:frantech-ts","honeypot"],"tagsCnt":3,"tcp":{"ja4t":["65535_2_536_00"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":1994800064},"totDataBytes":0} +{"@timestamp":1788144649090,"_id":"260831-tcopAwZ2Eb1HRr9NUNuMIAVJ","_index":"arkime_sessions3-260831","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo GmbH"],"isp.dstCnt":1,"isp.src":["Pfcloud UG"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Intelligence Hosting LLC"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS51167 Contabo GmbH","number":51167,"organization":{"name":"Contabo GmbH"}},"bytes":0,"geo":{"country_iso_code":"FR"},"ip":"109.123.246.142","mac":["00:50:56:63:46:a6"],"mac-cnt":1,"packets":0,"port":28737},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[82240],"firstPacket":1788143407617,"ipProtocol":6,"lastPacket":1788143407617,"length":0,"network":{"bytes":60,"community_id":"1:NNS8pRAu8ATPKTm0FaKX/whrB+E=","packets":1},"node":"spark-afae","packetPos":[-82240,40841],"packetRange":{"gte":1788143407617,"lte":1788143407617},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51396 Pfcloud UG (haftungsbeschrankt)","number":51396,"organization":{"name":"Pfcloud UG (haftungsbeschrankt)"}},"bytes":60,"geo":{"country_iso_code":"NL"},"ip":"204.76.203.7","mac":["c0:69:11:cd:1f:19"],"mac-cnt":1,"packets":1,"port":34948},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcRIR":"ARIN","srcTTL":[244],"srcTTLCnt":1,"tags":["sensor:contabo-sponge-02-ts","proxy","contabo-sponge-02-ts"],"tagsCnt":3,"tcp":{"ja4t":["65535_00_00_00"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":2733053383},"totDataBytes":0} +{"@timestamp":1788143141039,"_id":"260831-QjtCWYAeLaBCj6uyfg52qblO","_index":"arkime_sessions3-260831","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["Pfcloud UG"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["Intelligence Hosting LLC"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":0,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":0,"port":28888},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstRIR":"ARIN","ethertype":2048,"fileId":[82231],"firstPacket":1788142670917,"ipProtocol":6,"lastPacket":1788142670917,"length":0,"network":{"bytes":58,"community_id":"1:iyM6UTyYMdH+UTYck38wEKjLnhk=","packets":1},"node":"spark-afae","packetPos":[-82231,5164303],"packetRange":{"gte":1788142670917,"lte":1788142670917},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51396 Pfcloud UG (haftungsbeschrankt)","number":51396,"organization":{"name":"Pfcloud UG (haftungsbeschrankt)"}},"bytes":58,"geo":{"country_iso_code":"NL"},"ip":"204.76.203.7","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":1,"port":53908},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"ARIN","srcTTL":[242],"srcTTLCnt":1,"tags":["sensor:frantech-ts","honeypot","frantech-ts"],"tagsCnt":3,"tcp":{"ja4t":["65535_2_536_00"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":3354806349},"totDataBytes":0} +{"@timestamp":1788142533651,"_id":"260831-LDtfntzHvZhKppWC8VjqhVUn","_index":"arkime_sessions3-260831","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Pfcloud UG"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Intelligence Hosting LLC"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":0,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":0,"port":28888},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[82226],"firstPacket":1788142053701,"ipProtocol":6,"lastPacket":1788142053701,"length":0,"network":{"bytes":60,"community_id":"1:PmtImmjEFPLV3SFggwZFgSv+EPY=","packets":1},"node":"spark-afae","packetPos":[-82226,1314864],"packetRange":{"gte":1788142053701,"lte":1788142053701},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51396 Pfcloud UG (haftungsbeschrankt)","number":51396,"organization":{"name":"Pfcloud UG (haftungsbeschrankt)"}},"bytes":60,"geo":{"country_iso_code":"NL"},"ip":"204.76.203.7","mac":["fc:bd:67:9d:2b:2b"],"mac-cnt":1,"packets":1,"port":36469},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcRIR":"ARIN","srcTTL":[244],"srcTTLCnt":1,"tags":["sensor:contabo-sponge-01-ts","honeypot","contabo-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["65535_00_00_00"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":3132311412},"totDataBytes":0} +{"@timestamp":1788143140287,"_id":"260831-lMqU-6gz5ZlHT5Xcuy6t3mAE","_index":"arkime_sessions3-260831","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["netcup GmbH"],"isp.dstCnt":1,"isp.src":["Pfcloud UG"],"isp.srcCnt":1,"org.dst":["Netcup KVM"],"org.dstCnt":1,"org.src":["Intelligence Hosting LLC"],"org.srcCnt":1,"usertype.dst":["business"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS197540 netcup GmbH","number":197540,"organization":{"name":"netcup GmbH"}},"bytes":0,"geo":{"country_iso_code":"DE"},"ip":"159.195.21.150","mac":["8a:41:d3:b8:0d:d3"],"mac-cnt":1,"packets":0,"port":28888},"dstRIR":"ARIN","ethertype":2048,"fileId":[82229],"firstPacket":1788141859533,"ipProtocol":6,"lastPacket":1788141859533,"length":0,"network":{"bytes":56,"community_id":"1:ZV6Q+/8xGe4CeJmJG7oE5MusTos=","packets":1},"node":"spark-afae","packetPos":[-82229,54484],"packetRange":{"gte":1788141859533,"lte":1788141859533},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51396 Pfcloud UG (haftungsbeschrankt)","number":51396,"organization":{"name":"Pfcloud UG (haftungsbeschrankt)"}},"bytes":56,"geo":{"country_iso_code":"NL"},"ip":"204.76.203.7","mac":["bc:0f:fe:38:0b:a3"],"mac-cnt":1,"packets":1,"port":42629},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"ARIN","srcTTL":[248],"srcTTLCnt":1,"tags":["netcup-ts","sensor:netcup-ts","honeypot"],"tagsCnt":3,"tcp":{"ja4t":["65535_00_00_00"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":4024736387},"totDataBytes":0} +{"@timestamp":1788142856402,"_id":"260831-NzuqVaSzt-NLc6cyQkVIj2-I","_index":"arkime_sessions3-260831","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Kaopu Cloud HK Limited"],"isp.dstCnt":1,"isp.src":["Pfcloud UG"],"isp.srcCnt":1,"org.dst":["LightNode-BH"],"org.dstCnt":1,"org.src":["Intelligence Hosting LLC"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":0,"geo":{"country_iso_code":"BH"},"ip":"38.54.2.209","mac":["52:54:8f:9d:76:48"],"mac-cnt":1,"packets":0,"port":28888},"dstRIR":"ARIN","ethertype":2048,"fileId":[82228],"firstPacket":1788141786888,"ipProtocol":6,"lastPacket":1788141786888,"length":0,"network":{"bytes":54,"community_id":"1:wcmpDWImB3TPBI0FQW3De5JQw7U=","packets":1},"node":"spark-afae","packetPos":[-82228,388989],"packetRange":{"gte":1788141786888,"lte":1788141786888},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51396 Pfcloud UG (haftungsbeschrankt)","number":51396,"organization":{"name":"Pfcloud UG (haftungsbeschrankt)"}},"bytes":54,"geo":{"country_iso_code":"NL"},"ip":"204.76.203.7","mac":["98:44:ce:60:15:19"],"mac-cnt":1,"packets":1,"port":53194},"spoofable":["true"],"spoofableCnt":1,"srcDscp":[18],"srcDscpCnt":1,"srcOui":["Huawei Technologies Co.,Ltd"],"srcOuiCnt":1,"srcRIR":"ARIN","srcTTL":[241],"srcTTLCnt":1,"tags":["honeypot","sensor:bahrain-sponge-01-ts","bahrain-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["65535_00_00_00"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":1898245424},"totDataBytes":0} +{"@timestamp":1788142233089,"_id":"260831-fsotzh_aFgBCZ7akNQmHyKhM","_index":"arkime_sessions3-260831","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Hetzner Online GmbH"],"isp.dstCnt":1,"isp.src":["Pfcloud UG"],"isp.srcCnt":1,"org.dst":["HETZNER-DC"],"org.dstCnt":1,"org.src":["Intelligence Hosting LLC"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS24940 Hetzner Online GmbH","number":24940,"organization":{"name":"Hetzner Online GmbH"}},"bytes":0,"geo":{"country_iso_code":"FI"},"ip":"89.167.72.144","mac":["92:00:07:4c:82:70"],"mac-cnt":1,"packets":0,"port":28888},"dstRIR":"RIPE","ethertype":2048,"fileId":[82224],"firstPacket":1788141676153,"ipProtocol":6,"lastPacket":1788141676153,"length":0,"network":{"bytes":54,"community_id":"1:mnlGOofWoOo3WP2Q8bEKgfiUAYQ=","packets":1},"node":"spark-afae","packetPos":[-82224,92246],"packetRange":{"gte":1788141676153,"lte":1788141676153},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51396 Pfcloud UG (haftungsbeschrankt)","number":51396,"organization":{"name":"Pfcloud UG (haftungsbeschrankt)"}},"bytes":54,"geo":{"country_iso_code":"NL"},"ip":"204.76.203.7","mac":["d2:74:7f:6e:37:e3"],"mac-cnt":1,"packets":1,"port":38480},"spoofable":["true"],"spoofableCnt":1,"srcRIR":"ARIN","srcTTL":[245],"srcTTLCnt":1,"tags":["sponge-01-ts","honeypot","sensor:sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["65535_00_00_00"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":814544853},"totDataBytes":0} +{"@timestamp":1788141628493,"_id":"260831-KQr6tJ9lrA9JP5ZLYpvfSyke","_index":"arkime_sessions3-260831","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo GmbH"],"isp.dstCnt":1,"isp.src":["Pfcloud UG"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Intelligence Hosting LLC"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS51167 Contabo GmbH","number":51167,"organization":{"name":"Contabo GmbH"}},"bytes":0,"geo":{"country_iso_code":"FR"},"ip":"109.123.246.142","mac":["00:50:56:63:46:a6"],"mac-cnt":1,"packets":0,"port":28888},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[82217],"firstPacket":1788141042802,"ipProtocol":6,"lastPacket":1788141042802,"length":0,"network":{"bytes":60,"community_id":"1:h/TRCwKYBlgAYM5lPena7X6L80g=","packets":1},"node":"spark-afae","packetPos":[-82217,202016],"packetRange":{"gte":1788141042802,"lte":1788141042802},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51396 Pfcloud UG (haftungsbeschrankt)","number":51396,"organization":{"name":"Pfcloud UG (haftungsbeschrankt)"}},"bytes":60,"geo":{"country_iso_code":"NL"},"ip":"204.76.203.7","mac":["c0:69:11:cd:1f:19"],"mac-cnt":1,"packets":1,"port":51559},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcRIR":"ARIN","srcTTL":[243],"srcTTLCnt":1,"tags":["contabo-sponge-02-ts","sensor:contabo-sponge-02-ts","proxy"],"tagsCnt":3,"tcp":{"ja4t":["65535_00_00_00"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":2005429026},"totDataBytes":0} +{"@timestamp":1788141014144,"_id":"260831-9TqJvboli1lLGZ8u2m_abld0","_index":"arkime_sessions3-260831","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["netcup GmbH"],"isp.dstCnt":1,"isp.src":["Pfcloud UG"],"isp.srcCnt":1,"org.dst":["Netcup KVM"],"org.dstCnt":1,"org.src":["Intelligence Hosting LLC"],"org.srcCnt":1,"usertype.dst":["business"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS197540 netcup GmbH","number":197540,"organization":{"name":"netcup GmbH"}},"bytes":0,"geo":{"country_iso_code":"DE"},"ip":"159.195.21.150","mac":["8a:41:d3:b8:0d:d3"],"mac-cnt":1,"packets":0,"port":29290},"dstRIR":"ARIN","ethertype":2048,"fileId":[82216],"firstPacket":1788139838296,"ipProtocol":6,"lastPacket":1788139838296,"length":0,"network":{"bytes":56,"community_id":"1:nPknmfT9Uzdo90wn4vCb93XGhEA=","packets":1},"node":"spark-afae","packetPos":[-82216,2315],"packetRange":{"gte":1788139838296,"lte":1788139838296},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51396 Pfcloud UG (haftungsbeschrankt)","number":51396,"organization":{"name":"Pfcloud UG (haftungsbeschrankt)"}},"bytes":56,"geo":{"country_iso_code":"NL"},"ip":"204.76.203.7","mac":["bc:0f:fe:38:0b:a3"],"mac-cnt":1,"packets":1,"port":37436},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"ARIN","srcTTL":[248],"srcTTLCnt":1,"tags":["netcup-ts","honeypot","sensor:netcup-ts"],"tagsCnt":3,"tcp":{"ja4t":["65535_00_00_00"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":2318213173},"totDataBytes":0} +{"@timestamp":1788139190881,"_id":"260831-MMroVL7mzCNDX5a3aii20JJi","_index":"arkime_sessions3-260831","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Pfcloud UG"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Intelligence Hosting LLC"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":0,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":0,"port":29290},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[82204],"firstPacket":1788137901044,"ipProtocol":6,"lastPacket":1788137901044,"length":0,"network":{"bytes":60,"community_id":"1:atU3tFQqdFkeJafji1nGACr6nh0=","packets":1},"node":"spark-afae","packetPos":[-82204,289362],"packetRange":{"gte":1788137901044,"lte":1788137901044},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51396 Pfcloud UG (haftungsbeschrankt)","number":51396,"organization":{"name":"Pfcloud UG (haftungsbeschrankt)"}},"bytes":60,"geo":{"country_iso_code":"NL"},"ip":"204.76.203.7","mac":["fc:bd:67:9d:2b:2b"],"mac-cnt":1,"packets":1,"port":56181},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcRIR":"ARIN","srcTTL":[245],"srcTTLCnt":1,"tags":["honeypot","sensor:contabo-sponge-01-ts","contabo-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["65535_00_00_00"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":3210504997},"totDataBytes":0} +{"@timestamp":1788138287861,"_id":"260831-GcpiyAiyi-RL_6o4jS9FHuCz","_index":"arkime_sessions3-260831","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo GmbH"],"isp.dstCnt":1,"isp.src":["Pfcloud UG"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Intelligence Hosting LLC"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS51167 Contabo GmbH","number":51167,"organization":{"name":"Contabo GmbH"}},"bytes":0,"geo":{"country_iso_code":"FR"},"ip":"109.123.246.142","mac":["00:50:56:63:46:a6"],"mac-cnt":1,"packets":0,"port":29290},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[82199],"firstPacket":1788137304413,"ipProtocol":6,"lastPacket":1788137304413,"length":0,"network":{"bytes":60,"community_id":"1:RtJV4cZ9vDYiEK3j8VaHxlgenh0=","packets":1},"node":"spark-afae","packetPos":[-82199,131994],"packetRange":{"gte":1788137304413,"lte":1788137304413},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51396 Pfcloud UG (haftungsbeschrankt)","number":51396,"organization":{"name":"Pfcloud UG (haftungsbeschrankt)"}},"bytes":60,"geo":{"country_iso_code":"NL"},"ip":"204.76.203.7","mac":["c0:69:11:cd:1f:19"],"mac-cnt":1,"packets":1,"port":50256},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcRIR":"ARIN","srcTTL":[244],"srcTTLCnt":1,"tags":["sensor:contabo-sponge-02-ts","proxy","contabo-sponge-02-ts"],"tagsCnt":3,"tcp":{"ja4t":["65535_00_00_00"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":971956736},"totDataBytes":0} +{"@timestamp":1788138286732,"_id":"260831-nToxLYpLoFpGqJvjVu9mOVQ3","_index":"arkime_sessions3-260831","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Kaopu Cloud HK Limited"],"isp.dstCnt":1,"isp.src":["Pfcloud UG"],"isp.srcCnt":1,"org.dst":["LightNode-BH"],"org.dstCnt":1,"org.src":["Intelligence Hosting LLC"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":0,"geo":{"country_iso_code":"BH"},"ip":"38.54.2.209","mac":["52:54:8f:9d:76:48"],"mac-cnt":1,"packets":0,"port":29290},"dstRIR":"ARIN","ethertype":2048,"fileId":[82198],"firstPacket":1788137187576,"ipProtocol":6,"lastPacket":1788137187576,"length":0,"network":{"bytes":54,"community_id":"1:OtZs9E6l/uBhIOK9/c0ej6VmAH8=","packets":1},"node":"spark-afae","packetPos":[-82198,6758],"packetRange":{"gte":1788137187576,"lte":1788137187576},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51396 Pfcloud UG (haftungsbeschrankt)","number":51396,"organization":{"name":"Pfcloud UG (haftungsbeschrankt)"}},"bytes":54,"geo":{"country_iso_code":"NL"},"ip":"204.76.203.7","mac":["98:44:ce:60:15:19"],"mac-cnt":1,"packets":1,"port":42959},"spoofable":["true"],"spoofableCnt":1,"srcDscp":[18],"srcDscpCnt":1,"srcOui":["Huawei Technologies Co.,Ltd"],"srcOuiCnt":1,"srcRIR":"ARIN","srcTTL":[241],"srcTTLCnt":1,"tags":["bahrain-sponge-01-ts","honeypot","sensor:bahrain-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["65535_00_00_00"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":1015653785},"totDataBytes":0} +{"@timestamp":1788137986733,"_id":"260831-Dspvptefz-5K36vNbDaZ4_Wp","_index":"arkime_sessions3-260831","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["Pfcloud UG"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["Intelligence Hosting LLC"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":0,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":0,"port":29290},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstRIR":"ARIN","ethertype":2048,"fileId":[82196],"firstPacket":1788137182080,"ipProtocol":6,"lastPacket":1788137182080,"length":0,"network":{"bytes":58,"community_id":"1:a5HrDeKV+ApRgP/AQKXp0p5VX6Y=","packets":1},"node":"spark-afae","packetPos":[-82196,1549327],"packetRange":{"gte":1788137182080,"lte":1788137182080},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51396 Pfcloud UG (haftungsbeschrankt)","number":51396,"organization":{"name":"Pfcloud UG (haftungsbeschrankt)"}},"bytes":58,"geo":{"country_iso_code":"NL"},"ip":"204.76.203.7","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":1,"port":37856},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"ARIN","srcTTL":[242],"srcTTLCnt":1,"tags":["sensor:frantech-ts","frantech-ts","honeypot"],"tagsCnt":3,"tcp":{"ja4t":["65535_2_536_00"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":3762767177},"totDataBytes":0} +{"@timestamp":1788137987098,"_id":"260831-mkQYYLJsuKtPo6-Q3DMKtvu-","_index":"arkime_sessions3-260831","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Hetzner Online GmbH"],"isp.dstCnt":1,"isp.src":["Pfcloud UG"],"isp.srcCnt":1,"org.dst":["HETZNER-DC"],"org.dstCnt":1,"org.src":["Intelligence Hosting LLC"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS24940 Hetzner Online GmbH","number":24940,"organization":{"name":"Hetzner Online GmbH"}},"bytes":0,"geo":{"country_iso_code":"FI"},"ip":"89.167.72.144","mac":["92:00:07:4c:82:70"],"mac-cnt":1,"packets":0,"port":29290},"dstRIR":"RIPE","ethertype":2048,"fileId":[82194],"firstPacket":1788137045828,"ipProtocol":6,"lastPacket":1788137045828,"length":0,"network":{"bytes":54,"community_id":"1:8ZzqLH2LgTFzGL9qqtCoyG8qEJc=","packets":1},"node":"spark-afae","packetPos":[-82194,43996],"packetRange":{"gte":1788137045828,"lte":1788137045828},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51396 Pfcloud UG (haftungsbeschrankt)","number":51396,"organization":{"name":"Pfcloud UG (haftungsbeschrankt)"}},"bytes":54,"geo":{"country_iso_code":"NL"},"ip":"204.76.203.7","mac":["d2:74:7f:6e:37:e3"],"mac-cnt":1,"packets":1,"port":43711},"spoofable":["true"],"spoofableCnt":1,"srcRIR":"ARIN","srcTTL":[244],"srcTTLCnt":1,"tags":["sensor:sponge-01-ts","honeypot","sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["65535_00_00_00"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":763123731},"totDataBytes":0} +{"@timestamp":1788137985762,"_id":"260831-DsopHMe1xMJIU7Q-9sDMcX72","_index":"arkime_sessions3-260831","client":{"bytes":3},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["Pfcloud UG"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["Intelligence Hosting LLC"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":800,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":12,"port":30000},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[82196],"firstPacket":1788136681801,"initRTT":65,"ipProtocol":6,"lastPacket":1788136771666,"length":89865,"network":{"bytes":1801,"community_id":"1:dnZ/SB1Uy7k3VqZW6IcyNPcloSw=","packets":27},"node":"spark-afae","packetPos":[-82196,212045,90,230,82,85,13576,82,0,614,14483,82,152,0,16223,82,484,222,28027,82,152,0,18369,82,0,402,11294,82],"packetRange":{"gte":1788136681801,"lte":1788136771666},"protocol":["tcp"],"protocolCnt":1,"rootId":"260831-DsopHMe1xMJIU7Q-9sDMcX72","segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51396 Pfcloud UG (haftungsbeschrankt)","number":51396,"organization":{"name":"Pfcloud UG (haftungsbeschrankt)"}},"bytes":1001,"geo":{"country_iso_code":"NL"},"ip":"204.76.203.7","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":15,"port":34526},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcPayload8":"050100","srcRIR":"ARIN","srcTTL":[50],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":["Attempted Information Leak",""],"categoryCnt":2,"flowId":["344489378686822"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[2,3],"severityCnt":2,"signature":["553b5765-6241-4e9a-9982-0ca113796134","5a66c944-faed-4791-9d94-b44b7bd48352"],"signatureCnt":2,"signatureId":[1031235,2000181],"signatureIdCnt":2},"tags":["sensor:frantech-ts","frantech-ts","honeypot"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-4-8-1-3_1400_7"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":22,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":1,"psh":1,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":4240499847},"totDataBytes":3} +{"@timestamp":1788136786557,"_id":"260831-cTru6y_bsQFHpIRRi3GcsNB2","_index":"arkime_sessions3-260831","client":{"bytes":125},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["Pfcloud UG"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["Intelligence Hosting LLC"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":625,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":5,"port":30000},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstPayload8":"485454502f312e31","dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[82189],"firstPacket":1788136533803,"http":{"bodyMagic":["text/html"],"bodyMagicCnt":1,"clientVersion":["1.1"],"clientVersionCnt":1,"host":["azenv.net"],"hostCnt":1,"ja4h":["ge11nn040000_8391bea91fb6_000000000000_000000000000"],"ja4hCnt":1,"ja4h_r":["ge11nn040000_Host,User-Agent,Accept-Encoding,Connection__"],"ja4h_rCnt":1,"md5":["0f87454a3ea15f0db55ae928dbcd82fc"],"md5Cnt":1,"method":["GET"],"method-GET":1,"methodCnt":1,"path":["http://azenv.net/"],"pathCnt":1,"requestHeader":["accept-encoding","host","connection","user-agent"],"requestHeaderCnt":4,"requestHeaderField":["accept-encoding","connection"],"requestHeaderValue":["gzip","close"],"requestHeaderValueCnt":2,"response-server":["Apache/2.4.41 (Ubuntu)"],"response-serverCnt":1,"response-x-powered-by":["PHP/7.4.3"],"response-x-powered-byCnt":1,"responseHeader":["date","server","connection","content-type","x-powered-by","content-length"],"responseHeaderCnt":6,"responseHeaderField":["connection","content-type","date","content-length"],"responseHeaderValue":["close","text/plain; charset=utf-8","mon, 31 aug 2026 00:35:33 gmt","94"],"responseHeaderValueCnt":4,"serverVersion":["1.1"],"serverVersionCnt":1,"sha256":["1ca624415b2889dbeb3f969890b848b7bc5eaf96ca5e8fdd7461f943b45d10cb"],"sha256Cnt":1,"statuscode":[200],"statuscodeCnt":1,"uri":["http://azenv.net/"],"uriCnt":1,"useragent":["Go-http-client/1.1"],"useragentCnt":1},"initRTT":64,"ipProtocol":6,"lastPacket":1788136534060,"length":257,"network":{"bytes":1088,"community_id":"1:xqd7qCbRjQjmFP9xG2+V9vAEono=","packets":10},"node":"spark-afae","packetPos":[-82189,15376489,90,230,82,207,82,369,82,0,0],"packetRange":{"gte":1788136533803,"lte":1788136534060},"protocol":["http","tcp"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":287},"source":{"as":{"full":"AS51396 Pfcloud UG (haftungsbeschrankt)","number":51396,"organization":{"name":"Pfcloud UG (haftungsbeschrankt)"}},"bytes":463,"geo":{"country_iso_code":"NL"},"ip":"204.76.203.7","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":5,"port":44396},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcPayload8":"4745542068747470","srcRIR":"ARIN","srcTTL":[50],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["1479308480467253"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["ee583a2e-d308-4c53-b8e2-a1cd45cd1bb7","ce8622a8-6d2f-4fe3-ab81-0cc86e19363e","3d144850-efcc-436a-9008-c5d28ac581ae","23e6932c-e2bd-48cf-80b8-aa98ae9276c4","869feaa1-dc77-4037-aee2-247b7a39cf7d"],"signatureCnt":5,"signatureId":[2000166,1070034,1030619,1031486,2000008],"signatureIdCnt":5},"tag":{"block":["true","false"],"blockCnt":2,"category":["activity","protocol","tool","attack","recon"],"categoryCnt":5,"cves":[""],"cvesCnt":1,"description":["cloud credential scanning probe detected. requests for sensitive configuration files and credentials indicate automated scanning for exposed secrets and api keys.","generic web crawler traffic detected. the simple pattern of get requests without specific exploitation indicators suggests automated crawling activity, possibly for search indexing or vulnerability scanning.","ip addresses with this tag have been seen crawling http(s) servers around the internet.","ip addresses with this tag have been observed crawling the internet for unauthenticated web proxies and testing if they are functional.","ip addresses with this tag have been observed scanning the internet using the golang http client."],"intention":["suspicious","unknown","malicious"],"intentionCnt":3,"name":["go http client","open proxy scanner","web crawler","root path scanner"],"nameCnt":4},"tags":["sensor:frantech-ts","honeypot","frantech-ts"],"tagsCnt":3,"tcp":{"ja4ls":"79_64_tcp","ja4t":["64240_2-4-8-1-3_1400_7"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":4,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":2,"psh":2,"rst":0,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":799213434},"totDataBytes":412} +{"@timestamp":1788136482173,"_id":"260831-hETy3lZp1Q9K2YJUafKnpV4V","_index":"arkime_sessions3-260831","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["netcup GmbH"],"isp.dstCnt":1,"isp.src":["Pfcloud UG"],"isp.srcCnt":1,"org.dst":["Netcup KVM"],"org.dstCnt":1,"org.src":["Intelligence Hosting LLC"],"org.srcCnt":1,"usertype.dst":["business"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS197540 netcup GmbH","number":197540,"organization":{"name":"netcup GmbH"}},"bytes":0,"geo":{"country_iso_code":"DE"},"ip":"159.195.21.150","mac":["8a:41:d3:b8:0d:d3"],"mac-cnt":1,"packets":0,"port":30000},"dstRIR":"ARIN","ethertype":2048,"fileId":[82185],"firstPacket":1788136099667,"ipProtocol":6,"lastPacket":1788136099667,"length":0,"network":{"bytes":56,"community_id":"1:HTzAAZF1Pjr/t8fiUd8uKjOINR4=","packets":1},"node":"spark-afae","packetPos":[-82185,823320],"packetRange":{"gte":1788136099667,"lte":1788136099667},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51396 Pfcloud UG (haftungsbeschrankt)","number":51396,"organization":{"name":"Pfcloud UG (haftungsbeschrankt)"}},"bytes":56,"geo":{"country_iso_code":"NL"},"ip":"204.76.203.7","mac":["bc:0f:fe:38:0b:a3"],"mac-cnt":1,"packets":1,"port":54356},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"ARIN","srcTTL":[248],"srcTTLCnt":1,"tags":["honeypot","netcup-ts","sensor:netcup-ts"],"tagsCnt":3,"tcp":{"ja4t":["65535_00_00_00"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":1993494910},"totDataBytes":0} +{"@timestamp":1788135280511,"_id":"260831-OjrDOSAvVXNOoa7pxf-6bw4K","_index":"arkime_sessions3-260831","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Pfcloud UG"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Intelligence Hosting LLC"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":0,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":0,"port":30000},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[82178],"firstPacket":1788134851910,"ipProtocol":6,"lastPacket":1788134851910,"length":0,"network":{"bytes":60,"community_id":"1:8eHc8D7H++r4EPcFE85cyVid7gM=","packets":1},"node":"spark-afae","packetPos":[-82178,1687187],"packetRange":{"gte":1788134851910,"lte":1788134851910},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51396 Pfcloud UG (haftungsbeschrankt)","number":51396,"organization":{"name":"Pfcloud UG (haftungsbeschrankt)"}},"bytes":60,"geo":{"country_iso_code":"NL"},"ip":"204.76.203.7","mac":["fc:bd:67:9d:2b:2b"],"mac-cnt":1,"packets":1,"port":51057},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcRIR":"ARIN","srcTTL":[245],"srcTTLCnt":1,"tags":["honeypot","contabo-sponge-01-ts","sensor:contabo-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["65535_00_00_00"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":3848156381},"totDataBytes":0} +{"@timestamp":1788135579890,"_id":"260830-zMlZllLV5gpEQoZXHWAsNt-u","_index":"arkime_sessions3-260830","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo GmbH"],"isp.dstCnt":1,"isp.src":["Pfcloud UG"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Intelligence Hosting LLC"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS51167 Contabo GmbH","number":51167,"organization":{"name":"Contabo GmbH"}},"bytes":0,"geo":{"country_iso_code":"FR"},"ip":"109.123.246.142","mac":["00:50:56:63:46:a6"],"mac-cnt":1,"packets":0,"port":30000},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[82180],"firstPacket":1788134339309,"ipProtocol":6,"lastPacket":1788134339309,"length":0,"network":{"bytes":60,"community_id":"1:gPXH77EEO9Pt4fCIYYnm6/ql6Kc=","packets":1},"node":"spark-afae","packetPos":[-82180,7466],"packetRange":{"gte":1788134339309,"lte":1788134339309},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51396 Pfcloud UG (haftungsbeschrankt)","number":51396,"organization":{"name":"Pfcloud UG (haftungsbeschrankt)"}},"bytes":60,"geo":{"country_iso_code":"NL"},"ip":"204.76.203.7","mac":["c0:69:11:cd:1f:19"],"mac-cnt":1,"packets":1,"port":46615},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcRIR":"ARIN","srcTTL":[244],"srcTTLCnt":1,"tags":["sensor:contabo-sponge-02-ts","proxy","contabo-sponge-02-ts"],"tagsCnt":3,"tcp":{"ja4t":["65535_00_00_00"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":481489574},"totDataBytes":0} +{"@timestamp":1788134978273,"_id":"260830-tsk4cYKkE4pDk4vQF97qthC4","_index":"arkime_sessions3-260830","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["Pfcloud UG"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["Intelligence Hosting LLC"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":58,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":1,"port":30000},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[82176],"firstPacket":1788134267818,"ipProtocol":6,"lastPacket":1788134267953,"length":135,"network":{"bytes":170,"community_id":"1:X3c6I/PPRmgeqkII4n/EIppGQFA=","packets":3},"node":"spark-afae","packetPos":[-82176,939475,74,2138],"packetRange":{"gte":1788134267818,"lte":1788134267953},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51396 Pfcloud UG (haftungsbeschrankt)","number":51396,"organization":{"name":"Pfcloud UG (haftungsbeschrankt)"}},"bytes":112,"geo":{"country_iso_code":"NL"},"ip":"204.76.203.7","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":2,"port":58875},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"ARIN","srcTTL":[51,242],"srcTTLCnt":2,"tags":["frantech-ts","honeypot","sensor:frantech-ts"],"tagsCnt":3,"tcp":{"ja4t":["65535_2_536_00"],"ja4tCnt":1,"ja4ts":["64240_2_1460_00"],"ja4tsCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":812891657},"totDataBytes":0} +{"@timestamp":1788134978785,"_id":"260830-Lzp7xs7DO-NGLqV9AZh8Vdmo","_index":"arkime_sessions3-260830","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Kaopu Cloud HK Limited"],"isp.dstCnt":1,"isp.src":["Pfcloud UG"],"isp.srcCnt":1,"org.dst":["LightNode-BH"],"org.dstCnt":1,"org.src":["Intelligence Hosting LLC"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":0,"geo":{"country_iso_code":"BH"},"ip":"38.54.2.209","mac":["52:54:8f:9d:76:48"],"mac-cnt":1,"packets":0,"port":30000},"dstRIR":"ARIN","ethertype":2048,"fileId":[82175],"firstPacket":1788133561287,"ipProtocol":6,"lastPacket":1788133561287,"length":0,"network":{"bytes":54,"community_id":"1:+HhfJ6Rt00pWASG5jOUpli2HHL0=","packets":1},"node":"spark-afae","packetPos":[-82175,4430],"packetRange":{"gte":1788133561287,"lte":1788133561287},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51396 Pfcloud UG (haftungsbeschrankt)","number":51396,"organization":{"name":"Pfcloud UG (haftungsbeschrankt)"}},"bytes":54,"geo":{"country_iso_code":"NL"},"ip":"204.76.203.7","mac":["98:44:ce:60:15:19"],"mac-cnt":1,"packets":1,"port":59914},"spoofable":["true"],"spoofableCnt":1,"srcDscp":[18],"srcDscpCnt":1,"srcOui":["Huawei Technologies Co.,Ltd"],"srcOuiCnt":1,"srcRIR":"ARIN","srcTTL":[241],"srcTTLCnt":1,"tags":["bahrain-sponge-01-ts","sensor:bahrain-sponge-01-ts","honeypot"],"tagsCnt":3,"tcp":{"ja4t":["65535_00_00_00"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":1620709661},"totDataBytes":0} +{"@timestamp":1788133477337,"_id":"260830-iskt59XOMzFITpZZM2yS_4rV","_index":"arkime_sessions3-260830","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Hetzner Online GmbH"],"isp.dstCnt":1,"isp.src":["Pfcloud UG"],"isp.srcCnt":1,"org.dst":["HETZNER-DC"],"org.dstCnt":1,"org.src":["Intelligence Hosting LLC"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS24940 Hetzner Online GmbH","number":24940,"organization":{"name":"Hetzner Online GmbH"}},"bytes":0,"geo":{"country_iso_code":"FI"},"ip":"89.167.72.144","mac":["92:00:07:4c:82:70"],"mac-cnt":1,"packets":0,"port":30000},"dstRIR":"RIPE","ethertype":2048,"fileId":[82165],"firstPacket":1788132679104,"ipProtocol":6,"lastPacket":1788132679104,"length":0,"network":{"bytes":54,"community_id":"1:7RHyzkE7qnPVX0DFCUmj6K/h7ig=","packets":1},"node":"spark-afae","packetPos":[-82165,80346],"packetRange":{"gte":1788132679104,"lte":1788132679104},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51396 Pfcloud UG (haftungsbeschrankt)","number":51396,"organization":{"name":"Pfcloud UG (haftungsbeschrankt)"}},"bytes":54,"geo":{"country_iso_code":"NL"},"ip":"204.76.203.7","mac":["d2:74:7f:6e:37:e3"],"mac-cnt":1,"packets":1,"port":48434},"spoofable":["true"],"spoofableCnt":1,"srcRIR":"ARIN","srcTTL":[244],"srcTTLCnt":1,"tags":["sensor:sponge-01-ts","sponge-01-ts","honeypot"],"tagsCnt":3,"tcp":{"ja4t":["65535_00_00_00"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":479118179},"totDataBytes":0} +{"@timestamp":1788133175638,"_id":"260830-7zkOf__-DqBC-bJLuSonnlnK","_index":"arkime_sessions3-260830","client":{"bytes":3},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["Pfcloud UG"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["Intelligence Hosting LLC"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":932,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":14,"port":30001},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[82164],"firstPacket":1788132161217,"initRTT":64,"ipProtocol":6,"lastPacket":1788132265007,"length":103790,"network":{"bytes":2065,"community_id":"1:5Df6HM6ZxUZJ/Vf6DJhc8cMQ9ko=","packets":31},"node":"spark-afae","packetPos":[-82164,170194,90,0,82,85,26191,82,246,344,18960,82,150,572,15364,82,246,164,15624,82,0,246,14673,82,1162,164,17415,82,0,246,15428,82],"packetRange":{"gte":1788132161217,"lte":1788132265007},"protocol":["tcp"],"protocolCnt":1,"rootId":"260830-7zkOf__-DqBC-bJLuSonnlnK","segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51396 Pfcloud UG (haftungsbeschrankt)","number":51396,"organization":{"name":"Pfcloud UG (haftungsbeschrankt)"}},"bytes":1133,"geo":{"country_iso_code":"NL"},"ip":"204.76.203.7","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":17,"port":53250},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcPayload8":"050100","srcRIR":"ARIN","srcTTL":[51],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":["Attempted Information Leak",""],"categoryCnt":2,"flowId":["370731583544697"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[2,3],"severityCnt":2,"signature":["5a66c944-faed-4791-9d94-b44b7bd48352","553b5765-6241-4e9a-9982-0ca113796134"],"signatureCnt":2,"signatureId":[1031235,2000181],"signatureIdCnt":2},"tags":["frantech-ts","sensor:frantech-ts","honeypot"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-4-8-1-3_1400_7"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":26,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":1,"psh":1,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":3233187118},"totDataBytes":3} +{"@timestamp":1788132273674,"_id":"260830-zjlxXgOvDYpKia068YY7cus4","_index":"arkime_sessions3-260830","client":{"bytes":125},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["Pfcloud UG"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["Intelligence Hosting LLC"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":625,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":5,"port":30001},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstPayload8":"485454502f312e31","dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[82158],"firstPacket":1788132017026,"http":{"bodyMagic":["text/html"],"bodyMagicCnt":1,"clientVersion":["1.1"],"clientVersionCnt":1,"host":["azenv.net"],"hostCnt":1,"ja4h":["ge11nn040000_8391bea91fb6_000000000000_000000000000"],"ja4hCnt":1,"ja4h_r":["ge11nn040000_Host,User-Agent,Accept-Encoding,Connection__"],"ja4h_rCnt":1,"md5":["0f87454a3ea15f0db55ae928dbcd82fc"],"md5Cnt":1,"method":["GET"],"method-GET":1,"methodCnt":1,"path":["http://azenv.net/"],"pathCnt":1,"requestHeader":["connection","user-agent","host","accept-encoding"],"requestHeaderCnt":4,"requestHeaderField":["accept-encoding","connection"],"requestHeaderValue":["gzip","close"],"requestHeaderValueCnt":2,"response-server":["Apache/2.4.41 (Ubuntu)"],"response-serverCnt":1,"response-x-powered-by":["PHP/7.4.3"],"response-x-powered-byCnt":1,"responseHeader":["server","connection","x-powered-by","date","content-type","content-length"],"responseHeaderCnt":6,"responseHeaderField":["connection","content-type","date","content-length"],"responseHeaderValue":["close","text/plain; charset=utf-8","sun, 30 aug 2026 23:20:17 gmt","94"],"responseHeaderValueCnt":4,"serverVersion":["1.1"],"serverVersionCnt":1,"sha256":["1ca624415b2889dbeb3f969890b848b7bc5eaf96ca5e8fdd7461f943b45d10cb"],"sha256Cnt":1,"statuscode":[200],"statuscodeCnt":1,"uri":["http://azenv.net/"],"uriCnt":1,"useragent":["Go-http-client/1.1"],"useragentCnt":1},"initRTT":64,"ipProtocol":6,"lastPacket":1788132017287,"length":261,"network":{"bytes":1088,"community_id":"1:dsvRwluyT/b6KXxhFZ+Px+lHOLc=","packets":10},"node":"spark-afae","packetPos":[-82158,6715130,90,172,82,207,82,369,82,0,0],"packetRange":{"gte":1788132017026,"lte":1788132017287},"protocol":["tcp","http"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":287},"source":{"as":{"full":"AS51396 Pfcloud UG (haftungsbeschrankt)","number":51396,"organization":{"name":"Pfcloud UG (haftungsbeschrankt)"}},"bytes":463,"geo":{"country_iso_code":"NL"},"ip":"204.76.203.7","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":5,"port":53012},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcPayload8":"4745542068747470","srcRIR":"ARIN","srcTTL":[50],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["396948687801212"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["869feaa1-dc77-4037-aee2-247b7a39cf7d","3d144850-efcc-436a-9008-c5d28ac581ae","23e6932c-e2bd-48cf-80b8-aa98ae9276c4","ee583a2e-d308-4c53-b8e2-a1cd45cd1bb7","ce8622a8-6d2f-4fe3-ab81-0cc86e19363e"],"signatureCnt":5,"signatureId":[2000166,1070034,1030619,1031486,2000008],"signatureIdCnt":5},"tag":{"block":["false","true"],"blockCnt":2,"category":["attack","tool","activity","recon","protocol"],"categoryCnt":5,"cves":[""],"cvesCnt":1,"description":["ip addresses with this tag have been seen crawling http(s) servers around the internet.","ip addresses with this tag have been observed scanning the internet using the golang http client.","ip addresses with this tag have been observed crawling the internet for unauthenticated web proxies and testing if they are functional.","cloud credential scanning probe detected. requests for sensitive configuration files and credentials indicate automated scanning for exposed secrets and api keys.","generic web crawler traffic detected. the simple pattern of get requests without specific exploitation indicators suggests automated crawling activity, possibly for search indexing or vulnerability scanning."],"intention":["malicious","unknown","suspicious"],"intentionCnt":3,"name":["go http client","open proxy scanner","web crawler","root path scanner"],"nameCnt":4},"tags":["frantech-ts","sensor:frantech-ts","honeypot"],"tagsCnt":3,"tcp":{"ja4ls":"46_64_tcp","ja4t":["64240_2-4-8-1-3_1400_7"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":4,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":2,"psh":2,"rst":0,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":815154421},"totDataBytes":412} +{"@timestamp":1788131072756,"_id":"260830-WES186TBN9BBD4Z5-yZkgrW1","_index":"arkime_sessions3-260830","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo GmbH"],"isp.dstCnt":1,"isp.src":["Pfcloud UG"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Intelligence Hosting LLC"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS51167 Contabo GmbH","number":51167,"organization":{"name":"Contabo GmbH"}},"bytes":0,"geo":{"country_iso_code":"FR"},"ip":"109.123.246.142","mac":["00:50:56:63:46:a6"],"mac-cnt":1,"packets":0,"port":30001},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[82148],"firstPacket":1788130372311,"ipProtocol":6,"lastPacket":1788130372311,"length":0,"network":{"bytes":60,"community_id":"1:WYUGWalE5n6sE/BZ9EmHPWWE7nU=","packets":1},"node":"spark-afae","packetPos":[-82148,247942],"packetRange":{"gte":1788130372311,"lte":1788130372311},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51396 Pfcloud UG (haftungsbeschrankt)","number":51396,"organization":{"name":"Pfcloud UG (haftungsbeschrankt)"}},"bytes":60,"geo":{"country_iso_code":"NL"},"ip":"204.76.203.7","mac":["c0:69:11:cd:1f:19"],"mac-cnt":1,"packets":1,"port":59550},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcRIR":"ARIN","srcTTL":[244],"srcTTLCnt":1,"tags":["sensor:contabo-sponge-02-ts","proxy","contabo-sponge-02-ts"],"tagsCnt":3,"tcp":{"ja4t":["65535_00_00_00"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":3402996338},"totDataBytes":0} +{"@timestamp":1788131370941,"_id":"260830-rTkYf13UYT9A_43IM8iioMlK","_index":"arkime_sessions3-260830","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["Pfcloud UG"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["Intelligence Hosting LLC"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":58,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":1,"port":30001},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[82152],"firstPacket":1788130235614,"ipProtocol":6,"lastPacket":1788130235749,"length":135,"network":{"bytes":170,"community_id":"1:F6HbFlVKuCQj/eaoM3c7ByD2GMQ=","packets":3},"node":"spark-afae","packetPos":[-82152,3306,74,1190],"packetRange":{"gte":1788130235614,"lte":1788130235749},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51396 Pfcloud UG (haftungsbeschrankt)","number":51396,"organization":{"name":"Pfcloud UG (haftungsbeschrankt)"}},"bytes":112,"geo":{"country_iso_code":"NL"},"ip":"204.76.203.7","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":2,"port":44961},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"ARIN","srcTTL":[51,242],"srcTTLCnt":2,"tags":["sensor:frantech-ts","frantech-ts","honeypot"],"tagsCnt":3,"tcp":{"ja4t":["65535_2_536_00"],"ja4tCnt":1,"ja4ts":["64240_2_1460_00"],"ja4tsCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":766774919},"totDataBytes":0} +{"@timestamp":1788131072279,"_id":"260830-HgoF556RO65KjL-wl3OGIs6v","_index":"arkime_sessions3-260830","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["netcup GmbH"],"isp.dstCnt":1,"isp.src":["Pfcloud UG"],"isp.srcCnt":1,"org.dst":["Netcup KVM"],"org.dstCnt":1,"org.src":["Intelligence Hosting LLC"],"org.srcCnt":1,"usertype.dst":["business"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS197540 netcup GmbH","number":197540,"organization":{"name":"netcup GmbH"}},"bytes":0,"geo":{"country_iso_code":"DE"},"ip":"159.195.21.150","mac":["8a:41:d3:b8:0d:d3"],"mac-cnt":1,"packets":0,"port":30001},"dstRIR":"ARIN","ethertype":2048,"fileId":[82149],"firstPacket":1788130189819,"ipProtocol":6,"lastPacket":1788130189819,"length":0,"network":{"bytes":56,"community_id":"1:ve4e1re66Cnkd034Q3CwCGlBJOQ=","packets":1},"node":"spark-afae","packetPos":[-82149,430413],"packetRange":{"gte":1788130189819,"lte":1788130189819},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51396 Pfcloud UG (haftungsbeschrankt)","number":51396,"organization":{"name":"Pfcloud UG (haftungsbeschrankt)"}},"bytes":56,"geo":{"country_iso_code":"NL"},"ip":"204.76.203.7","mac":["bc:0f:fe:38:0b:a3"],"mac-cnt":1,"packets":1,"port":51718},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"ARIN","srcTTL":[248],"srcTTLCnt":1,"tags":["honeypot","sensor:netcup-ts","netcup-ts"],"tagsCnt":3,"tcp":{"ja4t":["65535_00_00_00"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":3904939883},"totDataBytes":0} +{"@timestamp":1788130772467,"_id":"260830-SMlM3rXpW4dMV5PhG2h6JbT6","_index":"arkime_sessions3-260830","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Hetzner Online GmbH"],"isp.dstCnt":1,"isp.src":["Pfcloud UG"],"isp.srcCnt":1,"org.dst":["HETZNER-DC"],"org.dstCnt":1,"org.src":["Intelligence Hosting LLC"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS24940 Hetzner Online GmbH","number":24940,"organization":{"name":"Hetzner Online GmbH"}},"bytes":0,"geo":{"country_iso_code":"FI"},"ip":"89.167.72.144","mac":["92:00:07:4c:82:70"],"mac-cnt":1,"packets":0,"port":30001},"dstRIR":"RIPE","ethertype":2048,"fileId":[82146],"firstPacket":1788129904283,"ipProtocol":6,"lastPacket":1788129904283,"length":0,"network":{"bytes":54,"community_id":"1:1vnTe2XqOlK+ftaiEAnf4M3NNE0=","packets":1},"node":"spark-afae","packetPos":[-82146,193548],"packetRange":{"gte":1788129904283,"lte":1788129904283},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51396 Pfcloud UG (haftungsbeschrankt)","number":51396,"organization":{"name":"Pfcloud UG (haftungsbeschrankt)"}},"bytes":54,"geo":{"country_iso_code":"NL"},"ip":"204.76.203.7","mac":["d2:74:7f:6e:37:e3"],"mac-cnt":1,"packets":1,"port":39493},"spoofable":["true"],"spoofableCnt":1,"srcRIR":"ARIN","srcTTL":[244],"srcTTLCnt":1,"tags":["sponge-01-ts","honeypot","sensor:sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["65535_00_00_00"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":509711478},"totDataBytes":0} +{"@timestamp":1788130473500,"_id":"260830-jDmZkEZBnxNOBZUlVEGsSrwJ","_index":"arkime_sessions3-260830","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Kaopu Cloud HK Limited"],"isp.dstCnt":1,"isp.src":["Pfcloud UG"],"isp.srcCnt":1,"org.dst":["LightNode-BH"],"org.dstCnt":1,"org.src":["Intelligence Hosting LLC"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":0,"geo":{"country_iso_code":"BH"},"ip":"38.54.2.209","mac":["52:54:8f:9d:76:48"],"mac-cnt":1,"packets":0,"port":30001},"dstRIR":"ARIN","ethertype":2048,"fileId":[82145],"firstPacket":1788129829778,"ipProtocol":6,"lastPacket":1788129829778,"length":0,"network":{"bytes":54,"community_id":"1:vVUFcZk6YcGIDfa9eweCBbC/jbc=","packets":1},"node":"spark-afae","packetPos":[-82145,136812],"packetRange":{"gte":1788129829778,"lte":1788129829778},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51396 Pfcloud UG (haftungsbeschrankt)","number":51396,"organization":{"name":"Pfcloud UG (haftungsbeschrankt)"}},"bytes":54,"geo":{"country_iso_code":"NL"},"ip":"204.76.203.7","mac":["98:44:ce:60:15:19"],"mac-cnt":1,"packets":1,"port":46860},"spoofable":["true"],"spoofableCnt":1,"srcDscp":[18],"srcDscpCnt":1,"srcOui":["Huawei Technologies Co.,Ltd"],"srcOuiCnt":1,"srcRIR":"ARIN","srcTTL":[241],"srcTTLCnt":1,"tags":["honeypot","sensor:bahrain-sponge-01-ts","bahrain-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["65535_00_00_00"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":4071662634},"totDataBytes":0} +{"@timestamp":1788129871579,"_id":"260830-djmzor9L9yJPPYt2P00BBHgU","_index":"arkime_sessions3-260830","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Pfcloud UG"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Intelligence Hosting LLC"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":0,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":0,"port":30001},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[82143],"firstPacket":1788129167110,"ipProtocol":6,"lastPacket":1788129167110,"length":0,"network":{"bytes":60,"community_id":"1:YxM8O5ZZI4PDrtD/IRmWW4c9L5k=","packets":1},"node":"spark-afae","packetPos":[-82143,797634],"packetRange":{"gte":1788129167110,"lte":1788129167110},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51396 Pfcloud UG (haftungsbeschrankt)","number":51396,"organization":{"name":"Pfcloud UG (haftungsbeschrankt)"}},"bytes":60,"geo":{"country_iso_code":"NL"},"ip":"204.76.203.7","mac":["fc:bd:67:9d:2b:2b"],"mac-cnt":1,"packets":1,"port":32789},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcRIR":"ARIN","srcTTL":[244],"srcTTLCnt":1,"tags":["honeypot","contabo-sponge-01-ts","sensor:contabo-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["65535_00_00_00"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":1505260832},"totDataBytes":0} +{"@timestamp":1788129563551,"_id":"260830-azl00varU3BIwYZvas7GZ8PX","_index":"arkime_sessions3-260830","client":{"bytes":3},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["Pfcloud UG"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["Intelligence Hosting LLC"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":800,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":12,"port":30002},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[82140],"firstPacket":1788128963630,"initRTT":65,"ipProtocol":6,"lastPacket":1788129051142,"length":87512,"network":{"bytes":1801,"community_id":"1:kxUonW4mzIXuvrGnib6ZL3JbFcQ=","packets":27},"node":"spark-afae","packetPos":[-82140,11682896,90,370,82,85,122408,152,220,82,38397,82,332,82,18677,152,462,82,46072,82,474,82,726121,1108,496,82,20118,82],"packetRange":{"gte":1788128963630,"lte":1788129051142},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51396 Pfcloud UG (haftungsbeschrankt)","number":51396,"organization":{"name":"Pfcloud UG (haftungsbeschrankt)"}},"bytes":1001,"geo":{"country_iso_code":"NL"},"ip":"204.76.203.7","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":15,"port":45270},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcPayload8":"050100","srcRIR":"ARIN","srcTTL":[51],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":["Attempted Information Leak",""],"categoryCnt":2,"flowId":["1019610670446578"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[2,3],"severityCnt":2,"signature":["553b5765-6241-4e9a-9982-0ca113796134","5a66c944-faed-4791-9d94-b44b7bd48352"],"signatureCnt":2,"signatureId":[1031235,2000181],"signatureIdCnt":2},"tag":{"block":["false","true"],"blockCnt":2,"category":["recon","activity"],"categoryCnt":2,"cves":[""],"cvesCnt":1,"description":["ip addresses with this tag have been observed attempting to discover socks5 proxies that do not require authentication.","socks proxy protocol negotiation"],"intention":["suspicious"],"intentionCnt":1,"name":["socks5 proxy scanner","socks proxy protocol negotiation"],"nameCnt":2},"tags":["sensor:frantech-ts","honeypot","frantech-ts"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-4-8-1-3_1400_7"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":22,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":1,"psh":1,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":1607578471},"totDataBytes":3} +{"@timestamp":1788129562105,"_id":"260830-aznazsdqN0dKZKQviAyyLzV1","_index":"arkime_sessions3-260830","client":{"bytes":125},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["Pfcloud UG"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["Intelligence Hosting LLC"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":625,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":5,"port":30002},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstPayload8":"485454502f312e31","dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[82140],"firstPacket":1788128824667,"http":{"bodyMagic":["text/html"],"bodyMagicCnt":1,"clientVersion":["1.1"],"clientVersionCnt":1,"host":["azenv.net"],"hostCnt":1,"ja4h":["ge11nn040000_8391bea91fb6_000000000000_000000000000"],"ja4hCnt":1,"ja4h_r":["ge11nn040000_Host,User-Agent,Accept-Encoding,Connection__"],"ja4h_rCnt":1,"md5":["0f87454a3ea15f0db55ae928dbcd82fc"],"md5Cnt":1,"method":["GET"],"method-GET":1,"methodCnt":1,"path":["http://azenv.net/"],"pathCnt":1,"requestHeader":["host","accept-encoding","user-agent","connection"],"requestHeaderCnt":4,"requestHeaderField":["accept-encoding","connection"],"requestHeaderValue":["gzip","close"],"requestHeaderValueCnt":2,"response-server":["Apache/2.4.41 (Ubuntu)"],"response-serverCnt":1,"response-x-powered-by":["PHP/7.4.3"],"response-x-powered-byCnt":1,"responseHeader":["x-powered-by","content-type","server","content-length","connection","date"],"responseHeaderCnt":6,"responseHeaderField":["connection","content-type","date","content-length"],"responseHeaderValue":["close","text/plain; charset=utf-8","sun, 30 aug 2026 22:27:04 gmt","94"],"responseHeaderValueCnt":4,"serverVersion":["1.1"],"serverVersionCnt":1,"sha256":["1ca624415b2889dbeb3f969890b848b7bc5eaf96ca5e8fdd7461f943b45d10cb"],"sha256Cnt":1,"statuscode":[200],"statuscodeCnt":1,"uri":["http://azenv.net/"],"uriCnt":1,"useragent":["Go-http-client/1.1"],"useragentCnt":1},"initRTT":65,"ipProtocol":6,"lastPacket":1788128824929,"length":262,"network":{"bytes":1088,"community_id":"1:F2Dw9AS5/Nd8jxj6qt17SNFyU9g=","packets":10},"node":"spark-afae","packetPos":[-82140,10962346,90,706,82,207,82,369,232,82,0],"packetRange":{"gte":1788128824667,"lte":1788128824929},"protocol":["http","tcp"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":287},"source":{"as":{"full":"AS51396 Pfcloud UG (haftungsbeschrankt)","number":51396,"organization":{"name":"Pfcloud UG (haftungsbeschrankt)"}},"bytes":463,"geo":{"country_iso_code":"NL"},"ip":"204.76.203.7","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":5,"port":44944},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcPayload8":"4745542068747470","srcRIR":"ARIN","srcTTL":[50],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["51164267721549"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["869feaa1-dc77-4037-aee2-247b7a39cf7d","23e6932c-e2bd-48cf-80b8-aa98ae9276c4","ee583a2e-d308-4c53-b8e2-a1cd45cd1bb7","ce8622a8-6d2f-4fe3-ab81-0cc86e19363e","3d144850-efcc-436a-9008-c5d28ac581ae"],"signatureCnt":5,"signatureId":[2000166,1070034,1030619,1031486,2000008],"signatureIdCnt":5},"tag":{"block":["false","true"],"blockCnt":2,"category":["tool","attack","recon","activity","protocol"],"categoryCnt":5,"cves":[""],"cvesCnt":1,"description":["ip addresses with this tag have been observed crawling the internet for unauthenticated web proxies and testing if they are functional.","cloud credential scanning probe detected. requests for sensitive configuration files and credentials indicate automated scanning for exposed secrets and api keys.","generic web crawler traffic detected. the simple pattern of get requests without specific exploitation indicators suggests automated crawling activity, possibly for search indexing or vulnerability scanning.","ip addresses with this tag have been observed scanning the internet using the golang http client.","ip addresses with this tag have been seen crawling http(s) servers around the internet."],"intention":["suspicious","unknown","malicious"],"intentionCnt":3,"name":["go http client","web crawler","root path scanner","open proxy scanner"],"nameCnt":4},"tags":["sensor:frantech-ts","honeypot","frantech-ts"],"tagsCnt":3,"tcp":{"ja4ls":"40_64_tcp","ja4t":["64240_2-4-8-1-3_1400_7"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":4,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":2,"psh":2,"rst":0,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":741358885},"totDataBytes":412} +{"@timestamp":1788128953711,"_id":"260830-VTmLGMFIo1BLk5846kLWrIa7","_index":"arkime_sessions3-260830","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Pfcloud UG"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Intelligence Hosting LLC"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":0,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":0,"port":30002},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[82137],"firstPacket":1788128361978,"ipProtocol":6,"lastPacket":1788128361978,"length":0,"network":{"bytes":60,"community_id":"1:McL1TL4HT/ohJE/ECKDmvElgPWE=","packets":1},"node":"spark-afae","packetPos":[-82137,798064],"packetRange":{"gte":1788128361978,"lte":1788128361978},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51396 Pfcloud UG (haftungsbeschrankt)","number":51396,"organization":{"name":"Pfcloud UG (haftungsbeschrankt)"}},"bytes":60,"geo":{"country_iso_code":"NL"},"ip":"204.76.203.7","mac":["fc:bd:67:9d:2b:2b"],"mac-cnt":1,"packets":1,"port":43849},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcRIR":"ARIN","srcTTL":[244],"srcTTLCnt":1,"tags":["contabo-sponge-01-ts","honeypot","sensor:contabo-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4t":["65535_00_00_00"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":2405335583},"totDataBytes":0} +{"@timestamp":1788128339872,"_id":"260830-Pzl_uoMyC7VH8ojtPNot3Gvs","_index":"arkime_sessions3-260830","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Kaopu Cloud HK Limited"],"isp.dstCnt":1,"isp.src":["Pfcloud UG"],"isp.srcCnt":1,"org.dst":["LightNode-BH"],"org.dstCnt":1,"org.src":["Intelligence Hosting LLC"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":0,"geo":{"country_iso_code":"BH"},"ip":"38.54.2.209","mac":["52:54:8f:9d:76:48"],"mac-cnt":1,"packets":0,"port":30002},"dstRIR":"ARIN","ethertype":2048,"fileId":[82132],"firstPacket":1788127919977,"ipProtocol":6,"lastPacket":1788127919977,"length":0,"network":{"bytes":54,"community_id":"1:FpKkhc+toqWFtB2xi7UCUxUtyLs=","packets":1},"node":"spark-afae","packetPos":[-82132,124352],"packetRange":{"gte":1788127919977,"lte":1788127919977},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51396 Pfcloud UG (haftungsbeschrankt)","number":51396,"organization":{"name":"Pfcloud UG (haftungsbeschrankt)"}},"bytes":54,"geo":{"country_iso_code":"NL"},"ip":"204.76.203.7","mac":["98:44:ce:60:15:19"],"mac-cnt":1,"packets":1,"port":46894},"spoofable":["true"],"spoofableCnt":1,"srcDscp":[18],"srcDscpCnt":1,"srcOui":["Huawei Technologies Co.,Ltd"],"srcOuiCnt":1,"srcRIR":"ARIN","srcTTL":[240],"srcTTLCnt":1,"tags":["sensor:bahrain-sponge-01-ts","bahrain-sponge-01-ts","honeypot"],"tagsCnt":3,"tcp":{"ja4t":["65535_00_00_00"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":2547715482},"totDataBytes":0} +{"@timestamp":1788127733013,"_id":"260830-KTm1JMAjwfVPjoHs0YzsyjPw","_index":"arkime_sessions3-260830","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["Pfcloud UG"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["Intelligence Hosting LLC"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":58,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":1,"port":30002},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[82128],"firstPacket":1788127171595,"ipProtocol":6,"lastPacket":1788127171727,"length":132,"network":{"bytes":170,"community_id":"1:6nByggNjrD05Llq8XQoqNY6DRFw=","packets":3},"node":"spark-afae","packetPos":[-82128,7330765,74,3842],"packetRange":{"gte":1788127171595,"lte":1788127171727},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51396 Pfcloud UG (haftungsbeschrankt)","number":51396,"organization":{"name":"Pfcloud UG (haftungsbeschrankt)"}},"bytes":112,"geo":{"country_iso_code":"NL"},"ip":"204.76.203.7","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":2,"port":51308},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"ARIN","srcTTL":[50,241],"srcTTLCnt":2,"tags":["honeypot","frantech-ts","sensor:frantech-ts"],"tagsCnt":3,"tcp":{"ja4t":["65535_2_536_00"],"ja4tCnt":1,"ja4ts":["64240_2_1460_00"],"ja4tsCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":1341238343},"totDataBytes":0} +{"@timestamp":1788127433611,"_id":"260830-N0REeoRX5htKDKBz5Vm_v_k1","_index":"arkime_sessions3-260830","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["netcup GmbH"],"isp.dstCnt":1,"isp.src":["Pfcloud UG"],"isp.srcCnt":1,"org.dst":["Netcup KVM"],"org.dstCnt":1,"org.src":["Intelligence Hosting LLC"],"org.srcCnt":1,"usertype.dst":["business"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS197540 netcup GmbH","number":197540,"organization":{"name":"netcup GmbH"}},"bytes":0,"geo":{"country_iso_code":"DE"},"ip":"159.195.21.150","mac":["8a:41:d3:b8:0d:d3"],"mac-cnt":1,"packets":0,"port":30002},"dstRIR":"ARIN","ethertype":2048,"fileId":[82126],"firstPacket":1788127081041,"ipProtocol":6,"lastPacket":1788127081041,"length":0,"network":{"bytes":56,"community_id":"1:hR3M1hNGuqVRc/pcUdOskI3H7LU=","packets":1},"node":"spark-afae","packetPos":[-82126,367364],"packetRange":{"gte":1788127081041,"lte":1788127081041},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51396 Pfcloud UG (haftungsbeschrankt)","number":51396,"organization":{"name":"Pfcloud UG (haftungsbeschrankt)"}},"bytes":56,"geo":{"country_iso_code":"NL"},"ip":"204.76.203.7","mac":["bc:0f:fe:38:0b:a3"],"mac-cnt":1,"packets":1,"port":34707},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcRIR":"ARIN","srcTTL":[248],"srcTTLCnt":1,"tags":["netcup-ts","honeypot","sensor:netcup-ts"],"tagsCnt":3,"tcp":{"ja4t":["65535_00_00_00"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":4037021180},"totDataBytes":0} +{"@timestamp":1788127433087,"_id":"260830--shVSS0N_MBHa5VX1nceMofv","_index":"arkime_sessions3-260830","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo GmbH"],"isp.dstCnt":1,"isp.src":["Pfcloud UG"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Intelligence Hosting LLC"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS51167 Contabo GmbH","number":51167,"organization":{"name":"Contabo GmbH"}},"bytes":0,"geo":{"country_iso_code":"FR"},"ip":"109.123.246.142","mac":["00:50:56:63:46:a6"],"mac-cnt":1,"packets":0,"port":30002},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","ethertype":2048,"fileId":[82125],"firstPacket":1788126270098,"ipProtocol":6,"lastPacket":1788126270098,"length":0,"network":{"bytes":60,"community_id":"1:6CVoWDE3B41D+9UykWHks1nFBbA=","packets":1},"node":"spark-afae","packetPos":[-82125,22409],"packetRange":{"gte":1788126270098,"lte":1788126270098},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51396 Pfcloud UG (haftungsbeschrankt)","number":51396,"organization":{"name":"Pfcloud UG (haftungsbeschrankt)"}},"bytes":60,"geo":{"country_iso_code":"NL"},"ip":"204.76.203.7","mac":["c0:69:11:cd:1f:19"],"mac-cnt":1,"packets":1,"port":47899},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Arista Networks"],"srcOuiCnt":1,"srcRIR":"ARIN","srcTTL":[243],"srcTTLCnt":1,"tags":["contabo-sponge-02-ts","proxy","sensor:contabo-sponge-02-ts"],"tagsCnt":3,"tcp":{"ja4t":["65535_00_00_00"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":1936657872},"totDataBytes":0} +{"@timestamp":1788127119134,"_id":"260830-LEQSdJVbOn5Dz7Dlg_vQ4QeQ","_index":"arkime_sessions3-260830","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Hetzner Online GmbH"],"isp.dstCnt":1,"isp.src":["Pfcloud UG"],"isp.srcCnt":1,"org.dst":["HETZNER-DC"],"org.dstCnt":1,"org.src":["Intelligence Hosting LLC"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS24940 Hetzner Online GmbH","number":24940,"organization":{"name":"Hetzner Online GmbH"}},"bytes":0,"geo":{"country_iso_code":"FI"},"ip":"89.167.72.144","mac":["92:00:07:4c:82:70"],"mac-cnt":1,"packets":0,"port":30002},"dstRIR":"RIPE","ethertype":2048,"fileId":[82122],"firstPacket":1788126068063,"ipProtocol":6,"lastPacket":1788126068063,"length":0,"network":{"bytes":54,"community_id":"1:i6MGe4wWYk7arsamwar86Vek46U=","packets":1},"node":"spark-afae","packetPos":[-82122,25534],"packetRange":{"gte":1788126068063,"lte":1788126068063},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51396 Pfcloud UG (haftungsbeschrankt)","number":51396,"organization":{"name":"Pfcloud UG (haftungsbeschrankt)"}},"bytes":54,"geo":{"country_iso_code":"NL"},"ip":"204.76.203.7","mac":["d2:74:7f:6e:37:e3"],"mac-cnt":1,"packets":1,"port":41671},"spoofable":["true"],"spoofableCnt":1,"srcRIR":"ARIN","srcTTL":[244],"srcTTLCnt":1,"tags":["sensor:sponge-01-ts","sponge-01-ts","honeypot"],"tagsCnt":3,"tcp":{"ja4t":["65535_00_00_00"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":1,"syn-ack":0,"urg":0},"tcpseq":{"src":3897506870},"totDataBytes":0} +{"@timestamp":1788126216732,"_id":"260830-2shE7Nf9SfZH376ZLdorZJj9","_index":"arkime_sessions3-260830","client":{"bytes":3},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["Pfcloud UG"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["Intelligence Hosting LLC"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":404,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":6,"port":30003},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[82118],"firstPacket":1788125595034,"initRTT":65,"ipProtocol":6,"lastPacket":1788125640725,"length":45691,"network":{"bytes":1009,"community_id":"1:divrrLgkFc+WaNv3RzQxWYUL83s=","packets":15},"node":"spark-afae","packetPos":[-82118,7358648,90,0,82,85,20731,82,0,288,27651,82,818,246,31671,82],"packetRange":{"gte":1788125595034,"lte":1788125640725},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS51396 Pfcloud UG (haftungsbeschrankt)","number":51396,"organization":{"name":"Pfcloud UG (haftungsbeschrankt)"}},"bytes":605,"geo":{"country_iso_code":"NL"},"ip":"204.76.203.7","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":9,"port":56940},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcPayload8":"050100","srcRIR":"ARIN","srcTTL":[50],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":["","Attempted Information Leak"],"categoryCnt":2,"flowId":["991618623057523"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[2,3],"severityCnt":2,"signature":["553b5765-6241-4e9a-9982-0ca113796134","5a66c944-faed-4791-9d94-b44b7bd48352"],"signatureCnt":2,"signatureId":[1031235,2000181],"signatureIdCnt":2},"tag":{"block":["false","true"],"blockCnt":2,"category":["recon","activity"],"categoryCnt":2,"cves":[""],"cvesCnt":1,"description":["socks proxy protocol negotiation","ip addresses with this tag have been observed attempting to discover socks5 proxies that do not require authentication."],"intention":["suspicious"],"intentionCnt":1,"name":["socks proxy protocol negotiation","socks5 proxy scanner"],"nameCnt":2},"tags":["frantech-ts","honeypot","sensor:frantech-ts"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-4-8-1-3_1400_7"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":10,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":1,"psh":1,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":1321906750},"totDataBytes":3} +{"@timestamp":1788126215895,"_id":"260830-2sjO1WA_Yt9PtZ_Ak00634D4","_index":"arkime_sessions3-260830","client":{"bytes":125},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["Pfcloud UG"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["Intelligence Hosting LLC"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":625,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":5,"port":30003},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstPayload8":"485454502f312e31","dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[82118],"firstPacket":1788125444348,"http":{"bodyMagic":["text/html"],"bodyMagicCnt":1,"clientVersion":["1.1"],"clientVersionCnt":1,"host":["azenv.net"],"hostCnt":1,"ja4h":["ge11nn040000_8391bea91fb6_000000000000_000000000000"],"ja4hCnt":1,"ja4h_r":["ge11nn040000_Host,User-Agent,Accept-Encoding,Connection__"],"ja4h_rCnt":1,"md5":["0f87454a3ea15f0db55ae928dbcd82fc"],"md5Cnt":1,"method":["GET"],"method-GET":1,"methodCnt":1,"path":["http://azenv.net/"],"pathCnt":1,"requestHeader":["connection","accept-encoding","host","user-agent"],"requestHeaderCnt":4,"requestHeaderField":["accept-encoding","connection"],"requestHeaderValue":["gzip","close"],"requestHeaderValueCnt":2,"response-server":["Apache/2.4.41 (Ubuntu)"],"response-serverCnt":1,"response-x-powered-by":["PHP/7.4.3"],"response-x-powered-byCnt":1,"responseHeader":["x-powered-by","content-length","date","connection","content-type","server"],"responseHeaderCnt":6,"responseHeaderField":["connection","content-type","date","content-length"],"responseHeaderValue":["close","text/plain; charset=utf-8","sun, 30 aug 2026 21:30:44 gmt","94"],"responseHeaderValueCnt":4,"serverVersion":["1.1"],"serverVersionCnt":1,"sha256":["1ca624415b2889dbeb3f969890b848b7bc5eaf96ca5e8fdd7461f943b45d10cb"],"sha256Cnt":1,"statuscode":[200],"statuscodeCnt":1,"uri":["http://azenv.net/"],"uriCnt":1,"useragent":["Go-http-client/1.1"],"useragentCnt":1},"initRTT":65,"ipProtocol":6,"lastPacket":1788125444610,"length":262,"network":{"bytes":1088,"community_id":"1:G30sMzWDVLKnoLwDQRBDMy4dMA0=","packets":10},"node":"spark-afae","packetPos":[-82118,6955717,90,978,82,207,82,369,472,82,0],"packetRange":{"gte":1788125444348,"lte":1788125444610},"protocol":["http","tcp"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":287},"source":{"as":{"full":"AS51396 Pfcloud UG (haftungsbeschrankt)","number":51396,"organization":{"name":"Pfcloud UG (haftungsbeschrankt)"}},"bytes":463,"geo":{"country_iso_code":"NL"},"ip":"204.76.203.7","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":5,"port":48016},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcPayload8":"4745542068747470","srcRIR":"ARIN","srcTTL":[49],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["1216331664851689"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["869feaa1-dc77-4037-aee2-247b7a39cf7d","23e6932c-e2bd-48cf-80b8-aa98ae9276c4","ee583a2e-d308-4c53-b8e2-a1cd45cd1bb7","ce8622a8-6d2f-4fe3-ab81-0cc86e19363e","3d144850-efcc-436a-9008-c5d28ac581ae"],"signatureCnt":5,"signatureId":[2000166,1070034,1030619,1031486,2000008],"signatureIdCnt":5},"tag":{"block":["false","true"],"blockCnt":2,"category":["recon","protocol","attack","activity","tool"],"categoryCnt":5,"cves":[""],"cvesCnt":1,"description":["generic web crawler traffic detected. the simple pattern of get requests without specific exploitation indicators suggests automated crawling activity, possibly for search indexing or vulnerability scanning.","ip addresses with this tag have been observed scanning the internet using the golang http client.","cloud credential scanning probe detected. requests for sensitive configuration files and credentials indicate automated scanning for exposed secrets and api keys.","ip addresses with this tag have been observed crawling the internet for unauthenticated web proxies and testing if they are functional.","ip addresses with this tag have been seen crawling http(s) servers around the internet."],"intention":["malicious","unknown","suspicious"],"intentionCnt":3,"name":["root path scanner","open proxy scanner","web crawler","go http client"],"nameCnt":4},"tags":["frantech-ts","honeypot","sensor:frantech-ts"],"tagsCnt":3,"tcp":{"ja4ls":"44_64_tcp","ja4t":["64240_2-4-8-1-3_1400_7"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":4,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":2,"psh":2,"rst":0,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":2516290599},"totDataBytes":412} diff --git a/kevlar/2026-08-31/sponge/ip-sessions/session_search_20260831T113642_d85fd0f2.ndjson b/kevlar/2026-08-31/sponge/ip-sessions/session_search_20260831T113642_d85fd0f2.ndjson new file mode 100644 index 0000000..e69de29 diff --git a/kevlar/2026-08-31/sponge/ip-sessions/session_search_20260831T113643_ccfc4339.ndjson b/kevlar/2026-08-31/sponge/ip-sessions/session_search_20260831T113643_ccfc4339.ndjson new file mode 100644 index 0000000..0f45ff3 --- /dev/null +++ b/kevlar/2026-08-31/sponge/ip-sessions/session_search_20260831T113643_ccfc4339.ndjson @@ -0,0 +1,6 @@ +{"@timestamp":1787898583931,"_id":"260828-MBlXqVmj1VlHw7CkyI6x7um0","_index":"arkime_sessions3-260828","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Kaopu Cloud HK Limited"],"isp.dstCnt":1,"isp.src":["Femo IT Solutions Limited"],"isp.srcCnt":1,"org.dst":["LightNode-BH"],"org.dstCnt":1,"org.src":["Femo IT Solutions Limited"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["business"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":0,"geo":{"country_iso_code":"BH"},"ip":"38.54.2.209","mac":["52:54:8f:9d:76:48"],"mac-cnt":1,"packets":0,"port":1723},"dstRIR":"ARIN","ethertype":2048,"fileId":[80584],"firstPacket":1787897596892,"ipProtocol":6,"lastPacket":1787897604118,"length":7226,"network":{"bytes":296,"community_id":"1:F2EvHiQirlc6ShhfoIhtFYMQNsU=","packets":4},"node":"spark-afae","packetPos":[-80584,197629,306,90,262],"packetRange":{"gte":1787897596892,"lte":1787897604118},"protocol":["tcp"],"protocolCnt":1,"rootId":"260828-MBlXqVmj1VlHw7CkyI6x7um0","segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS214351 Femo It Solutions Limited","number":214351,"organization":{"name":"Femo It Solutions Limited"}},"bytes":296,"geo":{"country_iso_code":"DE"},"ip":"62.60.226.150","mac":["98:44:ce:60:15:19"],"mac-cnt":1,"packets":4,"port":43984},"spoofable":["true"],"spoofableCnt":1,"srcOui":["Huawei Technologies Co.,Ltd"],"srcOuiCnt":1,"srcRIR":"RIPE","srcTTL":[49],"srcTTLCnt":1,"tags":["bahrain-sponge-01-ts","sensor:bahrain-sponge-01-ts","honeypot"],"tagsCnt":3,"tcp":{"ja4t":["64240_2-4-8-1-3_1394_7"],"ja4tCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":0,"srcZero":0,"syn":4,"syn-ack":0,"urg":0},"tcpseq":{"src":233533529},"totDataBytes":0} +{"@timestamp":1787699384732,"_id":"260825-hqF32jJtNnJDx46pDgxM6Nqb","_index":"arkime_sessions3-260825","client":{"bytes":156},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["Femo IT Solutions Limited"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["Femo IT Solutions Limited"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["business"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":375,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":4,"port":1723},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstPayload8":"485454502f312e31","dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[79467],"firstPacket":1787698922647,"http":{"bodyMagic":["text/plain"],"bodyMagicCnt":1,"md5":["6196dba52703776af2e6593f772ed7ce"],"md5Cnt":1,"responseHeader":["connection","content-type"],"responseHeaderCnt":2,"responseHeaderField":["content-type","connection"],"responseHeaderValue":["text/plain; charset=utf-8","close"],"responseHeaderValueCnt":2,"serverVersion":["1.1"],"serverVersionCnt":1,"sha256":["19b843cc92cb12aa314bb3c3913b2feeb852e85969bf06cb9d096931bfda34ba"],"sha256Cnt":1,"statuscode":[400],"statuscodeCnt":1},"initRTT":73,"ipProtocol":6,"lastPacket":1787698930785,"length":8138,"network":{"bytes":857,"community_id":"1:GGzGR7YfREyMzCSy0+9D/rKTYSg=","packets":9},"node":"spark-afae","packetPos":[-79467,3160913,90,0,82,238,21364,82,185,292],"packetRange":{"gte":1787698922647,"lte":1787698930785},"protocol":["tcp","http"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":103},"source":{"as":{"full":"AS214351 Femo It Solutions Limited","number":214351,"organization":{"name":"Femo It Solutions Limited"}},"bytes":482,"geo":{"country_iso_code":"DE"},"ip":"62.60.226.150","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":5,"port":58938},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcPayload8":"009c00011a2b3c4d","srcRIR":"RIPE","srcTTL":[47],"srcTTLCnt":1,"tags":["honeypot","frantech-ts","sensor:frantech-ts"],"tagsCnt":3,"tcp":{"ja4ls":"47_64_3922961","ja4t":["64240_2-4-8-1-3_1394_7"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":2,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":2,"psh":2,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":3767985395},"totDataBytes":259} +{"@timestamp":1787677019495,"_id":"260825-rp83mjU0fCJOzo6wEdQK-iQ0","_index":"arkime_sessions3-260825","client":{"bytes":156},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Femo IT Solutions Limited"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Femo IT Solutions Limited"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["business"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":375,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":4,"port":1723},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstPayload8":"485454502f312e31","dstRIR":"RIPE","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[79342],"firstPacket":1787676267895,"http":{"bodyMagic":["text/plain"],"bodyMagicCnt":1,"md5":["6196dba52703776af2e6593f772ed7ce"],"md5Cnt":1,"responseHeader":["content-type","connection"],"responseHeaderCnt":2,"responseHeaderField":["content-type","connection"],"responseHeaderValue":["text/plain; charset=utf-8","close"],"responseHeaderValueCnt":2,"serverVersion":["1.1"],"serverVersionCnt":1,"sha256":["19b843cc92cb12aa314bb3c3913b2feeb852e85969bf06cb9d096931bfda34ba"],"sha256Cnt":1,"statuscode":[400],"statuscodeCnt":1},"initRTT":80,"ipProtocol":6,"lastPacket":1787676276046,"length":8151,"network":{"bytes":863,"community_id":"1:qFmqrPUOGfSt2K7xp4O+GXDw0hk=","packets":9},"node":"spark-afae","packetPos":[-79342,2275107,90,254,82,238,17640,82,185,82],"packetRange":{"gte":1787676267895,"lte":1787676276046},"protocol":["tcp","http"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":103},"source":{"as":{"full":"AS214351 Femo It Solutions Limited","number":214351,"organization":{"name":"Femo It Solutions Limited"}},"bytes":488,"geo":{"country_iso_code":"DE"},"ip":"62.60.226.150","mac":["00:c0:1d:c0:ff:ee","fc:bd:67:9d:2b:2b"],"mac-cnt":2,"packets":5,"port":60586},"srcOui":["Arista Networks","Grand Junction Networks, Inc."],"srcOuiCnt":2,"srcPayload8":"009c00011a2b3c4d","srcRIR":"RIPE","srcTTL":[51],"srcTTLCnt":1,"tags":["honeypot","sensor:contabo-sponge-01-ts","contabo-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4ls":"60_64_3916546","ja4t":["64240_2-4-8-1-3_1394_7"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":2,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":2,"psh":2,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":828789835},"totDataBytes":259} +{"@timestamp":1787595533070,"_id":"260824-K_JAJkut32dLU6cUeR3Eo26S","_index":"arkime_sessions3-260824","client":{"bytes":156},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Kaopu Cloud HK Limited"],"isp.dstCnt":1,"isp.src":["Femo IT Solutions Limited"],"isp.srcCnt":1,"org.dst":["LightNode-BH"],"org.dstCnt":1,"org.src":["Femo IT Solutions Limited"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["business"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":375,"geo":{"country_iso_code":"BH"},"ip":"38.54.2.209","mac":["52:54:8f:9d:76:48"],"mac-cnt":1,"packets":4,"port":1723},"dstPayload8":"485454502f312e31","dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[78890],"firstPacket":1787594284327,"http":{"bodyMagic":["text/plain"],"bodyMagicCnt":1,"responseHeader":["content-type","connection"],"responseHeaderCnt":2,"responseHeaderField":["content-type","connection"],"responseHeaderValue":["text/plain; charset=utf-8","close"],"responseHeaderValueCnt":2,"serverVersion":["1.1"],"serverVersionCnt":1,"statuscode":[400],"statuscodeCnt":1},"initRTT":50,"ipProtocol":6,"lastPacket":1787594292420,"length":8093,"network":{"bytes":857,"community_id":"1:9+pgazzoxnMWanb+kIFrioedXWE=","packets":9},"node":"spark-afae","packetPos":[-78890,1009930,90,180,82,238,10986,82,185,344],"packetRange":{"gte":1787594284327,"lte":1787594292420},"protocol":["http","tcp"],"protocolCnt":2,"rootId":"260824-K_JAJkut32dLU6cUeR3Eo26S","segmentCnt":1,"server":{"bytes":103},"source":{"as":{"full":"AS214351 Femo It Solutions Limited","number":214351,"organization":{"name":"Femo It Solutions Limited"}},"bytes":482,"geo":{"country_iso_code":"DE"},"ip":"62.60.226.150","mac":["98:44:ce:60:15:19"],"mac-cnt":1,"packets":5,"port":41582},"srcDscp":[8],"srcDscpCnt":1,"srcOui":["Huawei Technologies Co.,Ltd"],"srcOuiCnt":1,"srcPayload8":"009c00011a2b3c4d","srcRIR":"RIPE","srcTTL":[50],"srcTTLCnt":1,"tags":["bahrain-sponge-01-ts","honeypot","sensor:bahrain-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4ls":"34_64_3946084","ja4t":["64240_2-4-8-1-3_1394_7"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":2,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":2,"psh":2,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":936974917},"totDataBytes":259} +{"@timestamp":1787404409987,"_id":"260822-ay0-hY0NOYdGbLZMm_PnK46C","_index":"arkime_sessions3-260822","client":{"bytes":156},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["FranTech Solutions"],"isp.dstCnt":1,"isp.src":["Femo IT Solutions Limited"],"isp.srcCnt":1,"org.dst":["Thinkpenguin Inc"],"org.dstCnt":1,"org.src":["Femo IT Solutions Limited"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["business"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS53667 FranTech Solutions","number":53667,"organization":{"name":"FranTech Solutions"}},"bytes":375,"geo":{"country_iso_code":"US"},"ip":"209.141.62.110","mac":["00:16:0d:1e:79:31"],"mac-cnt":1,"packets":4,"port":1723},"dstOui":["Be Here Corporation"],"dstOuiCnt":1,"dstPayload8":"485454502f312e31","dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[77828],"firstPacket":1787403129363,"http":{"bodyMagic":["text/plain"],"bodyMagicCnt":1,"responseHeader":["content-type","connection"],"responseHeaderCnt":2,"responseHeaderField":["content-type","connection"],"responseHeaderValue":["text/plain; charset=utf-8","close"],"responseHeaderValueCnt":2,"serverVersion":["1.1"],"serverVersionCnt":1,"statuscode":[400],"statuscodeCnt":1},"initRTT":72,"ipProtocol":6,"lastPacket":1787403137500,"length":8137,"network":{"bytes":857,"community_id":"1:bspKSR+dyoR8GvtZhQtEWhYbRlQ=","packets":9},"node":"spark-afae","packetPos":[-77828,1700042,90,164,82,238,14174,82,185,382],"packetRange":{"gte":1787403129363,"lte":1787403137500},"protocol":["tcp","http"],"protocolCnt":2,"rootId":"260822-ay0-hY0NOYdGbLZMm_PnK46C","segmentCnt":1,"server":{"bytes":103},"source":{"as":{"full":"AS214351 Femo It Solutions Limited","number":214351,"organization":{"name":"Femo It Solutions Limited"}},"bytes":482,"geo":{"country_iso_code":"DE"},"ip":"62.60.226.150","mac":["b8:c2:53:de:48:37"],"mac-cnt":1,"packets":5,"port":51330},"srcOui":["Juniper Networks"],"srcOuiCnt":1,"srcPayload8":"009c00011a2b3c4d","srcRIR":"RIPE","srcTTL":[46],"srcTTLCnt":1,"tags":["sensor:frantech-ts","frantech-ts","honeypot"],"tagsCnt":3,"tcp":{"ja4ls":"66_64_3923492","ja4t":["64240_2-4-8-1-3_1394_7"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":2,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":2,"psh":2,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":1605903274},"totDataBytes":259} +{"@timestamp":1787381511765,"_id":"260822-udYXXGTrx8tLc7zZlxu7XLuH","_index":"arkime_sessions3-260822","client":{"bytes":156},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo Asia Private Limited"],"isp.dstCnt":1,"isp.src":["Femo IT Solutions Limited"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["Femo IT Solutions Limited"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["business"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS141995 Contabo Asia Private Limited","number":141995,"organization":{"name":"Contabo Asia Private Limited"}},"bytes":375,"geo":{"country_iso_code":"SG"},"ip":"217.15.163.226","mac":["00:50:56:62:7a:fd"],"mac-cnt":1,"packets":4,"port":1723},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstPayload8":"485454502f312e31","dstRIR":"RIPE","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[77700],"firstPacket":1787380468805,"http":{"bodyMagic":["text/plain"],"bodyMagicCnt":1,"responseHeader":["connection","content-type"],"responseHeaderCnt":2,"responseHeaderField":["content-type","connection"],"responseHeaderValue":["text/plain; charset=utf-8","close"],"responseHeaderValueCnt":2,"serverVersion":["1.1"],"serverVersionCnt":1,"statuscode":[400],"statuscodeCnt":1},"initRTT":80,"ipProtocol":6,"lastPacket":1787380476958,"length":8153,"network":{"bytes":863,"community_id":"1:cyHT0yF/pVfHqh0HDbUUCVouB4g=","packets":9},"node":"spark-afae","packetPos":[-77700,489847,90,1338,82,238,15079,82,185,1243],"packetRange":{"gte":1787380468805,"lte":1787380476958},"protocol":["http","tcp"],"protocolCnt":2,"rootId":"260822-udYXXGTrx8tLc7zZlxu7XLuH","segmentCnt":1,"server":{"bytes":103},"source":{"as":{"full":"AS214351 Femo It Solutions Limited","number":214351,"organization":{"name":"Femo It Solutions Limited"}},"bytes":488,"geo":{"country_iso_code":"DE"},"ip":"62.60.226.150","mac":["fc:bd:67:9d:2b:2b","00:c0:1d:c0:ff:ee"],"mac-cnt":2,"packets":5,"port":41240},"srcOui":["Arista Networks","Grand Junction Networks, Inc."],"srcOuiCnt":2,"srcPayload8":"009c00011a2b3c4d","srcRIR":"RIPE","srcTTL":[52],"srcTTLCnt":1,"tags":["contabo-sponge-01-ts","honeypot","sensor:contabo-sponge-01-ts"],"tagsCnt":3,"tcp":{"ja4ls":"68_64_3911989","ja4t":["64240_2-4-8-1-3_1394_7"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":2,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":2,"psh":2,"rst":1,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":338230336},"totDataBytes":259} -- cgit v1.2.3