From de4c2e99a969eb10708b02d8f2b6f31495eacce8 Mon Sep 17 00:00:00 2001 From: hrbrmstr Date: Mon, 7 Sep 2026 06:03:32 -0400 Subject: chore: weekly BPH update --- kevlar/2026-09-07/honeylabs/asn-enrichments.json | 314 ++++++ kevlar/2026-09-07/honeylabs/events-AS138915.ndjson | 0 kevlar/2026-09-07/honeylabs/events-AS140666.ndjson | 0 kevlar/2026-09-07/honeylabs/events-AS14956.ndjson | 95 ++ kevlar/2026-09-07/honeylabs/events-AS198953.ndjson | 100 ++ kevlar/2026-09-07/honeylabs/events-AS200593.ndjson | 0 kevlar/2026-09-07/honeylabs/events-AS200651.ndjson | 24 + kevlar/2026-09-07/honeylabs/events-AS202685.ndjson | 0 kevlar/2026-09-07/honeylabs/events-AS206728.ndjson | 0 kevlar/2026-09-07/honeylabs/events-AS209847.ndjson | 0 kevlar/2026-09-07/honeylabs/events-AS210644.ndjson | 51 + kevlar/2026-09-07/honeylabs/events-AS211720.ndjson | 0 kevlar/2026-09-07/honeylabs/events-AS213702.ndjson | 0 kevlar/2026-09-07/honeylabs/events-AS214351.ndjson | 0 kevlar/2026-09-07/honeylabs/events-AS214940.ndjson | 0 kevlar/2026-09-07/honeylabs/events-AS216139.ndjson | 0 kevlar/2026-09-07/honeylabs/events-AS216246.ndjson | 2 + kevlar/2026-09-07/honeylabs/events-AS216309.ndjson | 0 kevlar/2026-09-07/honeylabs/events-AS30823.ndjson | 0 kevlar/2026-09-07/honeylabs/events-AS33993.ndjson | 0 kevlar/2026-09-07/honeylabs/events-AS394711.ndjson | 0 kevlar/2026-09-07/honeylabs/events-AS400992.ndjson | 0 kevlar/2026-09-07/honeylabs/events-AS51396.ndjson | 100 ++ kevlar/2026-09-07/honeylabs/events-AS51852.ndjson | 32 + kevlar/2026-09-07/honeylabs/events-AS57043.ndjson | 12 + kevlar/2026-09-07/honeylabs/events-AS58854.ndjson | 0 kevlar/2026-09-07/honeylabs/fingerprints.csv | 37 + kevlar/2026-09-07/honeylabs/ioc-lookups.json | 1175 ++++++++++++++++++++ kevlar/2026-09-07/honeylabs/loop-summary.json | 239 ++++ .../honeylabs/top-attackers-ip-AS138915.json | 1 + .../honeylabs/top-attackers-ip-AS140666.json | 1 + .../honeylabs/top-attackers-ip-AS14956.json | 195 ++++ .../honeylabs/top-attackers-ip-AS198953.json | 75 ++ .../honeylabs/top-attackers-ip-AS200593.json | 1 + .../honeylabs/top-attackers-ip-AS200651.json | 19 + .../honeylabs/top-attackers-ip-AS202685.json | 1 + .../honeylabs/top-attackers-ip-AS206728.json | 1 + .../honeylabs/top-attackers-ip-AS209847.json | 1 + .../honeylabs/top-attackers-ip-AS210644.json | 20 + .../honeylabs/top-attackers-ip-AS211720.json | 1 + .../honeylabs/top-attackers-ip-AS213702.json | 1 + .../honeylabs/top-attackers-ip-AS214351.json | 1 + .../honeylabs/top-attackers-ip-AS214940.json | 1 + .../honeylabs/top-attackers-ip-AS216139.json | 1 + .../honeylabs/top-attackers-ip-AS216246.json | 34 + .../honeylabs/top-attackers-ip-AS216309.json | 1 + .../honeylabs/top-attackers-ip-AS30823.json | 1 + .../honeylabs/top-attackers-ip-AS33993.json | 1 + .../honeylabs/top-attackers-ip-AS394711.json | 1 + .../honeylabs/top-attackers-ip-AS400992.json | 1 + .../honeylabs/top-attackers-ip-AS51396.json | 396 +++++++ .../honeylabs/top-attackers-ip-AS51852.json | 84 ++ .../honeylabs/top-attackers-ip-AS57043.json | 38 + .../honeylabs/top-attackers-ip-AS58854.json | 1 + .../honeylabs/top-attackers-ua-AS138915.json | 1 + .../honeylabs/top-attackers-ua-AS140666.json | 1 + .../honeylabs/top-attackers-ua-AS14956.json | 55 + .../honeylabs/top-attackers-ua-AS198953.json | 54 + .../honeylabs/top-attackers-ua-AS200593.json | 1 + .../honeylabs/top-attackers-ua-AS200651.json | 67 ++ .../honeylabs/top-attackers-ua-AS202685.json | 1 + .../honeylabs/top-attackers-ua-AS206728.json | 1 + .../honeylabs/top-attackers-ua-AS209847.json | 1 + .../honeylabs/top-attackers-ua-AS210644.json | 16 + .../honeylabs/top-attackers-ua-AS211720.json | 1 + .../honeylabs/top-attackers-ua-AS213702.json | 1 + .../honeylabs/top-attackers-ua-AS214351.json | 1 + .../honeylabs/top-attackers-ua-AS214940.json | 1 + .../honeylabs/top-attackers-ua-AS216139.json | 1 + .../honeylabs/top-attackers-ua-AS216246.json | 15 + .../honeylabs/top-attackers-ua-AS216309.json | 1 + .../honeylabs/top-attackers-ua-AS30823.json | 1 + .../honeylabs/top-attackers-ua-AS33993.json | 1 + .../honeylabs/top-attackers-ua-AS394711.json | 1 + .../honeylabs/top-attackers-ua-AS400992.json | 1 + .../honeylabs/top-attackers-ua-AS51396.json | 254 +++++ .../honeylabs/top-attackers-ua-AS51852.json | 57 + .../honeylabs/top-attackers-ua-AS57043.json | 1 + .../honeylabs/top-attackers-ua-AS58854.json | 1 + kevlar/2026-09-07/honeylabs/top-attackers.csv | 48 + kevlar/2026-09-07/honeylabs/top-ips-all.json | 941 ++++++++++++++++ kevlar/2026-09-07/honeylabs/user-agents-all.json | 580 ++++++++++ 82 files changed, 5164 insertions(+) create mode 100644 kevlar/2026-09-07/honeylabs/asn-enrichments.json create mode 100644 kevlar/2026-09-07/honeylabs/events-AS138915.ndjson create mode 100644 kevlar/2026-09-07/honeylabs/events-AS140666.ndjson create mode 100644 kevlar/2026-09-07/honeylabs/events-AS14956.ndjson create mode 100644 kevlar/2026-09-07/honeylabs/events-AS198953.ndjson create mode 100644 kevlar/2026-09-07/honeylabs/events-AS200593.ndjson create mode 100644 kevlar/2026-09-07/honeylabs/events-AS200651.ndjson create mode 100644 kevlar/2026-09-07/honeylabs/events-AS202685.ndjson create mode 100644 kevlar/2026-09-07/honeylabs/events-AS206728.ndjson create mode 100644 kevlar/2026-09-07/honeylabs/events-AS209847.ndjson create mode 100644 kevlar/2026-09-07/honeylabs/events-AS210644.ndjson create mode 100644 kevlar/2026-09-07/honeylabs/events-AS211720.ndjson create mode 100644 kevlar/2026-09-07/honeylabs/events-AS213702.ndjson create mode 100644 kevlar/2026-09-07/honeylabs/events-AS214351.ndjson create mode 100644 kevlar/2026-09-07/honeylabs/events-AS214940.ndjson create mode 100644 kevlar/2026-09-07/honeylabs/events-AS216139.ndjson create mode 100644 kevlar/2026-09-07/honeylabs/events-AS216246.ndjson create mode 100644 kevlar/2026-09-07/honeylabs/events-AS216309.ndjson create mode 100644 kevlar/2026-09-07/honeylabs/events-AS30823.ndjson create mode 100644 kevlar/2026-09-07/honeylabs/events-AS33993.ndjson create mode 100644 kevlar/2026-09-07/honeylabs/events-AS394711.ndjson create mode 100644 kevlar/2026-09-07/honeylabs/events-AS400992.ndjson create mode 100644 kevlar/2026-09-07/honeylabs/events-AS51396.ndjson create mode 100644 kevlar/2026-09-07/honeylabs/events-AS51852.ndjson create mode 100644 kevlar/2026-09-07/honeylabs/events-AS57043.ndjson create mode 100644 kevlar/2026-09-07/honeylabs/events-AS58854.ndjson create mode 100644 kevlar/2026-09-07/honeylabs/fingerprints.csv create mode 100644 kevlar/2026-09-07/honeylabs/ioc-lookups.json create mode 100644 kevlar/2026-09-07/honeylabs/loop-summary.json create mode 100644 kevlar/2026-09-07/honeylabs/top-attackers-ip-AS138915.json create mode 100644 kevlar/2026-09-07/honeylabs/top-attackers-ip-AS140666.json create mode 100644 kevlar/2026-09-07/honeylabs/top-attackers-ip-AS14956.json create mode 100644 kevlar/2026-09-07/honeylabs/top-attackers-ip-AS198953.json create mode 100644 kevlar/2026-09-07/honeylabs/top-attackers-ip-AS200593.json create mode 100644 kevlar/2026-09-07/honeylabs/top-attackers-ip-AS200651.json create mode 100644 kevlar/2026-09-07/honeylabs/top-attackers-ip-AS202685.json create mode 100644 kevlar/2026-09-07/honeylabs/top-attackers-ip-AS206728.json create mode 100644 kevlar/2026-09-07/honeylabs/top-attackers-ip-AS209847.json create mode 100644 kevlar/2026-09-07/honeylabs/top-attackers-ip-AS210644.json create mode 100644 kevlar/2026-09-07/honeylabs/top-attackers-ip-AS211720.json create mode 100644 kevlar/2026-09-07/honeylabs/top-attackers-ip-AS213702.json create mode 100644 kevlar/2026-09-07/honeylabs/top-attackers-ip-AS214351.json create mode 100644 kevlar/2026-09-07/honeylabs/top-attackers-ip-AS214940.json create mode 100644 kevlar/2026-09-07/honeylabs/top-attackers-ip-AS216139.json create mode 100644 kevlar/2026-09-07/honeylabs/top-attackers-ip-AS216246.json create mode 100644 kevlar/2026-09-07/honeylabs/top-attackers-ip-AS216309.json create mode 100644 kevlar/2026-09-07/honeylabs/top-attackers-ip-AS30823.json create mode 100644 kevlar/2026-09-07/honeylabs/top-attackers-ip-AS33993.json create mode 100644 kevlar/2026-09-07/honeylabs/top-attackers-ip-AS394711.json create mode 100644 kevlar/2026-09-07/honeylabs/top-attackers-ip-AS400992.json create mode 100644 kevlar/2026-09-07/honeylabs/top-attackers-ip-AS51396.json create mode 100644 kevlar/2026-09-07/honeylabs/top-attackers-ip-AS51852.json create mode 100644 kevlar/2026-09-07/honeylabs/top-attackers-ip-AS57043.json create mode 100644 kevlar/2026-09-07/honeylabs/top-attackers-ip-AS58854.json create mode 100644 kevlar/2026-09-07/honeylabs/top-attackers-ua-AS138915.json create mode 100644 kevlar/2026-09-07/honeylabs/top-attackers-ua-AS140666.json create mode 100644 kevlar/2026-09-07/honeylabs/top-attackers-ua-AS14956.json create mode 100644 kevlar/2026-09-07/honeylabs/top-attackers-ua-AS198953.json create mode 100644 kevlar/2026-09-07/honeylabs/top-attackers-ua-AS200593.json create mode 100644 kevlar/2026-09-07/honeylabs/top-attackers-ua-AS200651.json create mode 100644 kevlar/2026-09-07/honeylabs/top-attackers-ua-AS202685.json create mode 100644 kevlar/2026-09-07/honeylabs/top-attackers-ua-AS206728.json create mode 100644 kevlar/2026-09-07/honeylabs/top-attackers-ua-AS209847.json create mode 100644 kevlar/2026-09-07/honeylabs/top-attackers-ua-AS210644.json create mode 100644 kevlar/2026-09-07/honeylabs/top-attackers-ua-AS211720.json create mode 100644 kevlar/2026-09-07/honeylabs/top-attackers-ua-AS213702.json create mode 100644 kevlar/2026-09-07/honeylabs/top-attackers-ua-AS214351.json create mode 100644 kevlar/2026-09-07/honeylabs/top-attackers-ua-AS214940.json create mode 100644 kevlar/2026-09-07/honeylabs/top-attackers-ua-AS216139.json create mode 100644 kevlar/2026-09-07/honeylabs/top-attackers-ua-AS216246.json create mode 100644 kevlar/2026-09-07/honeylabs/top-attackers-ua-AS216309.json create mode 100644 kevlar/2026-09-07/honeylabs/top-attackers-ua-AS30823.json create mode 100644 kevlar/2026-09-07/honeylabs/top-attackers-ua-AS33993.json create mode 100644 kevlar/2026-09-07/honeylabs/top-attackers-ua-AS394711.json create mode 100644 kevlar/2026-09-07/honeylabs/top-attackers-ua-AS400992.json create mode 100644 kevlar/2026-09-07/honeylabs/top-attackers-ua-AS51396.json create mode 100644 kevlar/2026-09-07/honeylabs/top-attackers-ua-AS51852.json create mode 100644 kevlar/2026-09-07/honeylabs/top-attackers-ua-AS57043.json create mode 100644 kevlar/2026-09-07/honeylabs/top-attackers-ua-AS58854.json create mode 100644 kevlar/2026-09-07/honeylabs/top-attackers.csv create mode 100644 kevlar/2026-09-07/honeylabs/top-ips-all.json create mode 100644 kevlar/2026-09-07/honeylabs/user-agents-all.json (limited to 'kevlar/2026-09-07/honeylabs') diff --git a/kevlar/2026-09-07/honeylabs/asn-enrichments.json b/kevlar/2026-09-07/honeylabs/asn-enrichments.json new file mode 100644 index 0000000..7e50be2 --- /dev/null +++ b/kevlar/2026-09-07/honeylabs/asn-enrichments.json @@ -0,0 +1,314 @@ +[ + { + "asn": "AS51396", + "name": "PFCLOUD", + "res": { + "asn_number": 51396, + "org_name": "Pfcloud UG (haftungsbeschrankt)", + "total_events": 8500, + "unique_ips": 49, + "first_seen": "2026-08-31T00:00:25", + "last_seen": "2026-09-06T23:58:26", + "top_ports": [ + 8080, + 8888, + 3128, + 25565, + 1081, + 888, + 1080, + 80, + 4145, + 8000 + ], + "top_protocols": [ + "", + "tls" + ], + "source_countries": [ + "NL", + "DE", + "UA" + ], + "top_source_ips": [ + { + "source_ip": "204.76.203.222", + "events": 1159 + }, + { + "source_ip": "204.76.203.221", + "events": 1154 + }, + { + "source_ip": "204.76.203.213", + "events": 1123 + }, + { + "source_ip": "204.76.203.214", + "events": 1091 + }, + { + "source_ip": "204.76.203.49", + "events": 836 + }, + { + "source_ip": "176.65.148.153", + "events": 453 + }, + { + "source_ip": "204.76.203.7", + "events": 446 + }, + { + "source_ip": "45.135.193.193", + "events": 400 + }, + { + "source_ip": "45.135.194.113", + "events": 220 + }, + { + "source_ip": "45.135.193.198", + "events": 200 + } + ] + } + }, + { + "asn": "AS198953", + "name": "PROTON66", + "res": { + "asn_number": 198953, + "org_name": "Proton66 OOO", + "total_events": 1669, + "unique_ips": 4, + "first_seen": "2026-08-31T09:44:36", + "last_seen": "2026-09-06T14:40:21", + "top_ports": [ + 4443, + 3389, + 8443, + 10443, + 35366, + 25366, + 5539, + 37628, + 16433, + 55366 + ], + "top_protocols": [ + "", + "tls" + ], + "source_countries": [ + "RU" + ], + "top_source_ips": [ + { + "source_ip": "176.120.22.61", + "events": 1597 + }, + { + "source_ip": "176.120.22.240", + "events": 45 + }, + { + "source_ip": "193.143.1.66", + "events": 24 + }, + { + "source_ip": "176.120.22.147", + "events": 3 + } + ] + } + }, + { + "asn": "AS14956", + "name": "ROUTERHOSTING", + "res": { + "asn_number": 14956, + "org_name": "RouterHosting LLC", + "total_events": 95, + "unique_ips": 12, + "first_seen": "2026-09-01T07:55:37", + "last_seen": "2026-09-06T15:51:16", + "top_ports": [ + 445, + 8008, + 2095, + 443, + 1723, + 7860, + 5061 + ], + "top_protocols": [ + "", + "tls" + ], + "source_countries": [ + "US" + ], + "top_source_ips": [ + { + "source_ip": "45.61.157.82", + "events": 32 + }, + { + "source_ip": "144.172.108.79", + "events": 24 + }, + { + "source_ip": "144.172.99.200", + "events": 16 + }, + { + "source_ip": "216.126.239.215", + "events": 8 + }, + { + "source_ip": "167.88.168.121", + "events": 4 + }, + { + "source_ip": "45.61.183.10", + "events": 4 + }, + { + "source_ip": "144.172.112.11", + "events": 2 + }, + { + "source_ip": "216.126.227.187", + "events": 1 + }, + { + "source_ip": "45.61.149.189", + "events": 1 + }, + { + "source_ip": "144.172.99.12", + "events": 1 + } + ] + } + }, + { + "asn": "AS210644", + "name": "AEZA-AS", + "res": { + "asn_number": 210644, + "org_name": "Aeza Group LLC", + "total_events": 51, + "unique_ips": 1, + "first_seen": "2026-08-31T22:44:34", + "last_seen": "2026-09-02T15:29:27", + "top_ports": [ + 443, + 2222, + 2375 + ], + "top_protocols": [ + "tls", + "" + ], + "source_countries": [ + "NL" + ], + "top_source_ips": [ + { + "source_ip": "185.246.217.150", + "events": 51 + } + ] + } + }, + { + "asn": "AS51852", + "name": "PLI-AS", + "res": { + "asn_number": 51852, + "org_name": "Private Layer INC", + "total_events": 32, + "unique_ips": 5, + "first_seen": "2026-08-31T15:32:52", + "last_seen": "2026-09-04T19:27:10", + "top_ports": [ + 8443, + 2087, + 1723, + 80, + 32400, + 443, + 8085 + ], + "top_protocols": [ + "", + "tls" + ], + "source_countries": [ + "CH" + ], + "top_source_ips": [ + { + "source_ip": "179.43.150.26", + "events": 16 + }, + { + "source_ip": "46.19.142.226", + "events": 6 + }, + { + "source_ip": "141.255.165.66", + "events": 5 + }, + { + "source_ip": "179.43.186.220", + "events": 3 + }, + { + "source_ip": "179.43.146.27", + "events": 2 + } + ] + } + }, + { + "asn": "AS57043", + "name": "HOSTKEY-AS", + "res": { + "asn_number": 57043, + "org_name": "Hostkey B.v.", + "total_events": 12, + "unique_ips": 2, + "first_seen": "2026-08-31T15:39:39", + "last_seen": "2026-09-03T03:47:57", + "top_ports": [ + 22, + 19571, + 42481, + 5070, + 44981, + 20271, + 14603 + ], + "top_protocols": [ + "" + ], + "source_countries": [ + "GB", + "DE" + ], + "top_source_ips": [ + { + "source_ip": "163.5.16.6", + "events": 8 + }, + { + "source_ip": "82.39.165.100", + "events": 4 + } + ] + } + } +] \ No newline at end of file diff --git a/kevlar/2026-09-07/honeylabs/events-AS138915.ndjson b/kevlar/2026-09-07/honeylabs/events-AS138915.ndjson new file mode 100644 index 0000000..e69de29 diff --git a/kevlar/2026-09-07/honeylabs/events-AS140666.ndjson b/kevlar/2026-09-07/honeylabs/events-AS140666.ndjson new file mode 100644 index 0000000..e69de29 diff --git a/kevlar/2026-09-07/honeylabs/events-AS14956.ndjson b/kevlar/2026-09-07/honeylabs/events-AS14956.ndjson new file mode 100644 index 0000000..455e751 --- /dev/null +++ b/kevlar/2026-09-07/honeylabs/events-AS14956.ndjson @@ -0,0 +1,95 @@ +{"timestamp":"2026-09-06T15:51:16","event_id":"60a28c68-17ac-4150-93c5-9686d637062e","source_ip":"45.61.149.189","source_port":58528,"source_domain":"189.149.61.45.static.cloudzy.com","country_code":"US","country_name":"United States","city_name":"Las Vegas","asn_number":14956,"asn_org":"RouterHosting LLC","dest_port":443,"network_protocol":"tls","application_protocol":"http","http_method":"GET","user_agent":"Python-urllib/3.13","url_path":"/webclient/","url_domain":"","http_request_headers":"{\"accept-encoding\":\"identity\",\"connection\":\"close\",\"host\":\":443\",\"user-agent\":\"Python-urllib/3.13\"}","ssh_client_hassh":"","tls_client_ja4":"t13i181000_85036bcba153_d41ae481755e","tls_client_ja3":"8a9d5d0f12f7d43ee3af1c51d2998d99","tls_client_version":"TLSv1.3","tls_client_cipher":"TLS_AES_128_GCM_SHA256","http_request_ja4h":"ge11nn0400_8fd06a127c33","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":132,"dest_bytes":78,"network_bytes":210,"event_summary":""} +{"timestamp":"2026-09-06T06:25:29","event_id":"bd943251-32d5-4e1d-90d5-01656ab58633","source_ip":"45.61.183.10","source_port":37524,"source_domain":"10.183.61.45.static.cloudzy.com","country_code":"US","country_name":"United States","city_name":"Las Vegas","asn_number":14956,"asn_org":"RouterHosting LLC","dest_port":445,"network_protocol":"","application_protocol":"smbv23","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":142,"dest_bytes":12,"network_bytes":154,"event_summary":"\u0000\u0000\u0000��SMB@\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000@\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000$\u0000\u0003\u0000\u0001\u0000\u0000\u0000\u0004\u0000\u0000\u0000\u0002�\\��[���5tP/\r��p\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0010\u0002\u0000\u0003\u0002\u0003\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0004\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0001\u0000\u0002\u0000\u0006\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0002\u0000\u0001\u0000"} +{"timestamp":"2026-09-06T02:17:58","event_id":"70e2b966-aa82-4a04-a97d-1af22a9b0b98","source_ip":"45.61.183.10","source_port":52936,"source_domain":"10.183.61.45.static.cloudzy.com","country_code":"US","country_name":"United States","city_name":"Las Vegas","asn_number":14956,"asn_org":"RouterHosting LLC","dest_port":445,"network_protocol":"","application_protocol":"smbv23","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":142,"dest_bytes":12,"network_bytes":154,"event_summary":"\u0000\u0000\u0000��SMB@\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000@\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000$\u0000\u0003\u0000\u0001\u0000\u0000\u0000\u0004\u0000\u0000\u0000�2�0�|c�z�'�F�B�p\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0010\u0002\u0000\u0003\u0002\u0003\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0004\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0001\u0000\u0002\u0000\u0006\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0002\u0000\u0001\u0000"} +{"timestamp":"2026-09-06T01:13:22","event_id":"41d0618e-ab40-43ae-ae62-97316c0d5916","source_ip":"45.61.183.10","source_port":41348,"source_domain":"10.183.61.45.static.cloudzy.com","country_code":"US","country_name":"United States","city_name":"Las Vegas","asn_number":14956,"asn_org":"RouterHosting LLC","dest_port":445,"network_protocol":"","application_protocol":"smbv23","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":142,"dest_bytes":12,"network_bytes":154,"event_summary":"\u0000\u0000\u0000��SMB@\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000@\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000$\u0000\u0003\u0000\u0001\u0000\u0000\u0000\u0004\u0000\u0000\u0000�\u001fS\u0010�1��c�\t�fsC\u0004p\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0010\u0002\u0000\u0003\u0002\u0003\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0004\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0001\u0000\u0002\u0000\u0006\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0002\u0000\u0001\u0000"} +{"timestamp":"2026-09-06T01:13:05","event_id":"6ced3596-6160-4283-b0c0-81164d97d976","source_ip":"45.61.183.10","source_port":53466,"source_domain":"10.183.61.45.static.cloudzy.com","country_code":"US","country_name":"United States","city_name":"Las Vegas","asn_number":14956,"asn_org":"RouterHosting LLC","dest_port":445,"network_protocol":"","application_protocol":"smbv23","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":142,"dest_bytes":12,"network_bytes":154,"event_summary":"\u0000\u0000\u0000��SMB@\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000@\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000$\u0000\u0003\u0000\u0001\u0000\u0000\u0000\u0004\u0000\u0000\u00008\u0006�/�XYjGr��X�6Dp\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0010\u0002\u0000\u0003\u0002\u0003\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0004\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0001\u0000\u0002\u0000\u0006\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0002\u0000\u0001\u0000"} +{"timestamp":"2026-09-06T00:12:34","event_id":"374ee997-5a95-4cf5-95f2-8178c771afb2","source_ip":"216.126.239.215","source_port":62508,"source_domain":"215.239.126.216.static.cloudzy.com","country_code":"US","country_name":"United States","city_name":"Ogden","asn_number":14956,"asn_org":"RouterHosting LLC","dest_port":445,"network_protocol":"","application_protocol":"smbv1","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":4,"event_duration":497000000,"source_bytes":455,"dest_bytes":60,"network_bytes":515,"event_summary":"\u0000\u0000\u0000N�SMB2\u0000\u0000\u0000\u0000\u0018\u0007�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000��\u0000\u0000A\u0000\u000f\f\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u00014�\u0000\u0000\u0000\f\u0000B\u0000\u0000\u0000N\u0000\u0001\u0000\u000e\u0000\r\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000"} +{"timestamp":"2026-09-06T00:12:34","event_id":"374ee997-5a95-4cf5-95f2-8178c771afb2","source_ip":"216.126.239.215","source_port":62508,"source_domain":"215.239.126.216.static.cloudzy.com","country_code":"US","country_name":"United States","city_name":"Ogden","asn_number":14956,"asn_org":"RouterHosting LLC","dest_port":445,"network_protocol":"","application_protocol":"smbv1","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":3,"event_duration":364000000,"source_bytes":373,"dest_bytes":45,"network_bytes":418,"event_summary":"\u0000\u0000\u0000\\�SMBu\u0000\u0000\u0000\u0000\u0018\u0007�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000��\u0000\u0000@\u0000\u0004�\u0000\\\u0000\b\u0000\u0001\u00001\u0000\u0000\\\u0000\\\u00001\u00009\u00002\u0000.\u00001\u00006\u00008\u0000.\u00005\u00006\u0000.\u00002\u00000\u0000\\\u0000I\u0000P\u0000C\u0000$\u0000\u0000\u0000?????\u0000"} +{"timestamp":"2026-09-06T00:12:34","event_id":"374ee997-5a95-4cf5-95f2-8178c771afb2","source_ip":"216.126.239.215","source_port":62508,"source_domain":"215.239.126.216.static.cloudzy.com","country_code":"US","country_name":"United States","city_name":"Ogden","asn_number":14956,"asn_org":"RouterHosting LLC","dest_port":445,"network_protocol":"","application_protocol":"smbv1","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":2,"event_duration":232000000,"source_bytes":277,"dest_bytes":30,"network_bytes":307,"event_summary":"\u0000\u0000\u0000��SMBs\u0000\u0000\u0000\u0000\u0018\u0007�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000��\u0000\u0000@\u0000\r�\u0000�\u0000\u0004\u0011\n\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000�\u0000\u0000\u0000K\u0000\u0000\u0000\u0000\u0000\u0000W\u0000i\u0000n\u0000d\u0000o\u0000w\u0000s\u0000 \u00002\u00000\u00000\u00000\u0000 \u00002\u00001\u00009\u00005\u0000\u0000\u0000W\u0000i\u0000n\u0000d\u0000o\u0000w\u0000s\u0000 \u00002\u00000\u00000\u00000\u0000 \u00005\u0000.\u00000\u0000\u0000\u0000"} +{"timestamp":"2026-09-06T00:12:34","event_id":"374ee997-5a95-4cf5-95f2-8178c771afb2","source_ip":"216.126.239.215","source_port":62508,"source_domain":"215.239.126.216.static.cloudzy.com","country_code":"US","country_name":"United States","city_name":"Ogden","asn_number":14956,"asn_org":"RouterHosting LLC","dest_port":445,"network_protocol":"","application_protocol":"","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":137,"dest_bytes":15,"network_bytes":152,"event_summary":"\u0000\u0000\u0000��SMBr\u0000\u0000\u0000\u0000\u0018S�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000��\u0000\u0000@\u0000\u0000b\u0000\u0002PC NETWORK PROGRAM 1.0\u0000\u0002LANMAN1.0\u0000\u0002Windows for Workgroups 3.1a\u0000\u0002LM1.2X002\u0000\u0002LANMAN2.1\u0000\u0002NT LM 0.12\u0000"} +{"timestamp":"2026-09-06T00:12:31","event_id":"f593bc88-9d56-4927-8715-6bcfa06c951c","source_ip":"216.126.239.215","source_port":61658,"source_domain":"215.239.126.216.static.cloudzy.com","country_code":"US","country_name":"United States","city_name":"Ogden","asn_number":14956,"asn_org":"RouterHosting LLC","dest_port":445,"network_protocol":"","application_protocol":"smbv1","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":4,"event_duration":575000000,"source_bytes":364,"dest_bytes":60,"network_bytes":424,"event_summary":"\u0000\u0000\u0000J�SMB%\u0000\u0000\u0000\u0000\u0018\u0001(\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0010\u0000\u0000\u0000\u0000����\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000J\u0000\u0000\u0000J\u0000\u0002\u0000#\u0000\u0000\u0000\u0007\u0000\\PIPE\\\u0000"} +{"timestamp":"2026-09-06T00:12:30","event_id":"f593bc88-9d56-4927-8715-6bcfa06c951c","source_ip":"216.126.239.215","source_port":61658,"source_domain":"215.239.126.216.static.cloudzy.com","country_code":"US","country_name":"United States","city_name":"Ogden","asn_number":14956,"asn_org":"RouterHosting LLC","dest_port":445,"network_protocol":"","application_protocol":"smbv1","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":3,"event_duration":443000000,"source_bytes":286,"dest_bytes":45,"network_bytes":331,"event_summary":"\u0000\u0000\u0000[�SMBu\u0000\u0000\u0000\u0000\u0018\u0001 \u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000/K\u0000\u0000�^\u0004�\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u001c\u0000\u0000\\\\216.126.239.170\\IPC$\u0000?????\u0000TH_REPLACE__?????\u0000"} +{"timestamp":"2026-09-06T00:12:30","event_id":"f593bc88-9d56-4927-8715-6bcfa06c951c","source_ip":"216.126.239.215","source_port":61658,"source_domain":"215.239.126.216.static.cloudzy.com","country_code":"US","country_name":"United States","city_name":"Ogden","asn_number":14956,"asn_org":"RouterHosting LLC","dest_port":445,"network_protocol":"","application_protocol":"smbv1","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":2,"event_duration":232000000,"source_bytes":191,"dest_bytes":30,"network_bytes":221,"event_summary":"\u0000\u0000\u0000c�SMBs\u0000\u0000\u0000\u0000\u0018\u0001 \u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000/K\u0000\u0000�^\r�\u0000\u0000\u0000��\u0002\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000@\u0000\u0000\u0000&\u0000\u0000.\u0000Windows 2000 2195\u0000Windows 2000 5.0\u0000"} +{"timestamp":"2026-09-06T00:12:30","event_id":"f593bc88-9d56-4927-8715-6bcfa06c951c","source_ip":"216.126.239.215","source_port":61658,"source_domain":"215.239.126.216.static.cloudzy.com","country_code":"US","country_name":"United States","city_name":"Ogden","asn_number":14956,"asn_org":"RouterHosting LLC","dest_port":445,"network_protocol":"","application_protocol":"","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":88,"dest_bytes":15,"network_bytes":103,"event_summary":"\u0000\u0000\u0000T�SMBr\u0000\u0000\u0000\u0000\u0018\u0001(\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000/K\u0000\u0000�^\u00001\u0000\u0002LANMAN1.0\u0000\u0002LM1.2X002\u0000\u0002NT LANMAN 1.0\u0000\u0002NT LM 0.12\u0000"} +{"timestamp":"2026-09-05T02:54:19","event_id":"51632da8-f7f7-4da2-b0b4-0c8d814f1af6","source_ip":"144.172.108.79","source_port":53083,"source_domain":"79.108.172.144.static.cloudzy.com","country_code":"US","country_name":"United States","city_name":"Las Vegas","asn_number":14956,"asn_org":"RouterHosting LLC","dest_port":445,"network_protocol":"","application_protocol":"smbv1","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":4,"event_duration":498000000,"source_bytes":455,"dest_bytes":56,"network_bytes":511,"event_summary":"\u0000\u0000\u0000N�SMB2\u0000\u0000\u0000\u0000\u0018\u0007�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000��\u0000\u0000A\u0000\u000f\f\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u00014�\u0000\u0000\u0000\f\u0000B\u0000\u0000\u0000N\u0000\u0001\u0000\u000e\u0000\r\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000"} +{"timestamp":"2026-09-05T02:54:19","event_id":"51632da8-f7f7-4da2-b0b4-0c8d814f1af6","source_ip":"144.172.108.79","source_port":53083,"source_domain":"79.108.172.144.static.cloudzy.com","country_code":"US","country_name":"United States","city_name":"Las Vegas","asn_number":14956,"asn_org":"RouterHosting LLC","dest_port":445,"network_protocol":"","application_protocol":"smbv1","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":3,"event_duration":366000000,"source_bytes":373,"dest_bytes":42,"network_bytes":415,"event_summary":"\u0000\u0000\u0000\\�SMBu\u0000\u0000\u0000\u0000\u0018\u0007�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000��\u0000\u0000@\u0000\u0004�\u0000\\\u0000\b\u0000\u0001\u00001\u0000\u0000\\\u0000\\\u00001\u00009\u00002\u0000.\u00001\u00006\u00008\u0000.\u00005\u00006\u0000.\u00002\u00000\u0000\\\u0000I\u0000P\u0000C\u0000$\u0000\u0000\u0000?????\u0000"} +{"timestamp":"2026-09-05T02:54:19","event_id":"51632da8-f7f7-4da2-b0b4-0c8d814f1af6","source_ip":"144.172.108.79","source_port":53083,"source_domain":"79.108.172.144.static.cloudzy.com","country_code":"US","country_name":"United States","city_name":"Las Vegas","asn_number":14956,"asn_org":"RouterHosting LLC","dest_port":445,"network_protocol":"","application_protocol":"smbv1","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":2,"event_duration":233000000,"source_bytes":277,"dest_bytes":28,"network_bytes":305,"event_summary":"\u0000\u0000\u0000��SMBs\u0000\u0000\u0000\u0000\u0018\u0007�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000��\u0000\u0000@\u0000\r�\u0000�\u0000\u0004\u0011\n\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000�\u0000\u0000\u0000K\u0000\u0000\u0000\u0000\u0000\u0000W\u0000i\u0000n\u0000d\u0000o\u0000w\u0000s\u0000 \u00002\u00000\u00000\u00000\u0000 \u00002\u00001\u00009\u00005\u0000\u0000\u0000W\u0000i\u0000n\u0000d\u0000o\u0000w\u0000s\u0000 \u00002\u00000\u00000\u00000\u0000 \u00005\u0000.\u00000\u0000\u0000\u0000"} +{"timestamp":"2026-09-05T02:54:19","event_id":"51632da8-f7f7-4da2-b0b4-0c8d814f1af6","source_ip":"144.172.108.79","source_port":53083,"source_domain":"79.108.172.144.static.cloudzy.com","country_code":"US","country_name":"United States","city_name":"Las Vegas","asn_number":14956,"asn_org":"RouterHosting LLC","dest_port":445,"network_protocol":"","application_protocol":"","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":137,"dest_bytes":14,"network_bytes":151,"event_summary":"\u0000\u0000\u0000��SMBr\u0000\u0000\u0000\u0000\u0018S�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000��\u0000\u0000@\u0000\u0000b\u0000\u0002PC NETWORK PROGRAM 1.0\u0000\u0002LANMAN1.0\u0000\u0002Windows for Workgroups 3.1a\u0000\u0002LM1.2X002\u0000\u0002LANMAN2.1\u0000\u0002NT LM 0.12\u0000"} +{"timestamp":"2026-09-05T02:54:16","event_id":"ef0d1806-55ce-4c77-82b9-5492b2b7647f","source_ip":"144.172.108.79","source_port":52284,"source_domain":"79.108.172.144.static.cloudzy.com","country_code":"US","country_name":"United States","city_name":"Las Vegas","asn_number":14956,"asn_org":"RouterHosting LLC","dest_port":445,"network_protocol":"","application_protocol":"smbv1","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":4,"event_duration":501000000,"source_bytes":364,"dest_bytes":56,"network_bytes":420,"event_summary":"\u0000\u0000\u0000J�SMB%\u0000\u0000\u0000\u0000\u0018\u0001(\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0010\u0000\u0000\u0000\u0000����\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000J\u0000\u0000\u0000J\u0000\u0002\u0000#\u0000\u0000\u0000\u0007\u0000\\PIPE\\\u0000"} +{"timestamp":"2026-09-05T02:54:15","event_id":"ef0d1806-55ce-4c77-82b9-5492b2b7647f","source_ip":"144.172.108.79","source_port":52284,"source_domain":"79.108.172.144.static.cloudzy.com","country_code":"US","country_name":"United States","city_name":"Las Vegas","asn_number":14956,"asn_org":"RouterHosting LLC","dest_port":445,"network_protocol":"","application_protocol":"smbv1","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":3,"event_duration":366000000,"source_bytes":286,"dest_bytes":42,"network_bytes":328,"event_summary":"\u0000\u0000\u0000[�SMBu\u0000\u0000\u0000\u0000\u0018\u0001 \u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000/K\u0003x�^\u0004�\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u001c\u0000\u0000\\\\144.172.108.181\\IPC$\u0000?????\u0000TH_REPLACE__?????\u0000"} +{"timestamp":"2026-09-05T02:54:15","event_id":"ef0d1806-55ce-4c77-82b9-5492b2b7647f","source_ip":"144.172.108.79","source_port":52284,"source_domain":"79.108.172.144.static.cloudzy.com","country_code":"US","country_name":"United States","city_name":"Las Vegas","asn_number":14956,"asn_org":"RouterHosting LLC","dest_port":445,"network_protocol":"","application_protocol":"smbv1","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":2,"event_duration":233000000,"source_bytes":191,"dest_bytes":28,"network_bytes":219,"event_summary":"\u0000\u0000\u0000c�SMBs\u0000\u0000\u0000\u0000\u0018\u0001 \u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000/K\u0000\u0000�^\r�\u0000\u0000\u0000��\u0002\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000@\u0000\u0000\u0000&\u0000\u0000.\u0000Windows 2000 2195\u0000Windows 2000 5.0\u0000"} +{"timestamp":"2026-09-05T02:54:15","event_id":"ef0d1806-55ce-4c77-82b9-5492b2b7647f","source_ip":"144.172.108.79","source_port":52284,"source_domain":"79.108.172.144.static.cloudzy.com","country_code":"US","country_name":"United States","city_name":"Las Vegas","asn_number":14956,"asn_org":"RouterHosting LLC","dest_port":445,"network_protocol":"","application_protocol":"","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":88,"dest_bytes":14,"network_bytes":102,"event_summary":"\u0000\u0000\u0000T�SMBr\u0000\u0000\u0000\u0000\u0018\u0001(\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000/K\u0000\u0000�^\u00001\u0000\u0002LANMAN1.0\u0000\u0002LM1.2X002\u0000\u0002NT LANMAN 1.0\u0000\u0002NT LM 0.12\u0000"} +{"timestamp":"2026-09-04T23:12:54","event_id":"fea24ceb-573f-45a5-8ab6-bf1e2b61af69","source_ip":"144.172.108.79","source_port":53115,"source_domain":"79.108.172.144.static.cloudzy.com","country_code":"US","country_name":"United States","city_name":"Las Vegas","asn_number":14956,"asn_org":"RouterHosting LLC","dest_port":445,"network_protocol":"","application_protocol":"smbv1","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":4,"event_duration":498000000,"source_bytes":455,"dest_bytes":56,"network_bytes":511,"event_summary":"\u0000\u0000\u0000N�SMB2\u0000\u0000\u0000\u0000\u0018\u0007�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000��\u0000\u0000A\u0000\u000f\f\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u00014�\u0000\u0000\u0000\f\u0000B\u0000\u0000\u0000N\u0000\u0001\u0000\u000e\u0000\r\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000"} +{"timestamp":"2026-09-04T23:12:54","event_id":"fea24ceb-573f-45a5-8ab6-bf1e2b61af69","source_ip":"144.172.108.79","source_port":53115,"source_domain":"79.108.172.144.static.cloudzy.com","country_code":"US","country_name":"United States","city_name":"Las Vegas","asn_number":14956,"asn_org":"RouterHosting LLC","dest_port":445,"network_protocol":"","application_protocol":"smbv1","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":3,"event_duration":365000000,"source_bytes":373,"dest_bytes":42,"network_bytes":415,"event_summary":"\u0000\u0000\u0000\\�SMBu\u0000\u0000\u0000\u0000\u0018\u0007�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000��\u0000\u0000@\u0000\u0004�\u0000\\\u0000\b\u0000\u0001\u00001\u0000\u0000\\\u0000\\\u00001\u00009\u00002\u0000.\u00001\u00006\u00008\u0000.\u00005\u00006\u0000.\u00002\u00000\u0000\\\u0000I\u0000P\u0000C\u0000$\u0000\u0000\u0000?????\u0000"} +{"timestamp":"2026-09-04T23:12:53","event_id":"fea24ceb-573f-45a5-8ab6-bf1e2b61af69","source_ip":"144.172.108.79","source_port":53115,"source_domain":"79.108.172.144.static.cloudzy.com","country_code":"US","country_name":"United States","city_name":"Las Vegas","asn_number":14956,"asn_org":"RouterHosting LLC","dest_port":445,"network_protocol":"","application_protocol":"smbv1","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":2,"event_duration":233000000,"source_bytes":277,"dest_bytes":28,"network_bytes":305,"event_summary":"\u0000\u0000\u0000��SMBs\u0000\u0000\u0000\u0000\u0018\u0007�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000��\u0000\u0000@\u0000\r�\u0000�\u0000\u0004\u0011\n\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000�\u0000\u0000\u0000K\u0000\u0000\u0000\u0000\u0000\u0000W\u0000i\u0000n\u0000d\u0000o\u0000w\u0000s\u0000 \u00002\u00000\u00000\u00000\u0000 \u00002\u00001\u00009\u00005\u0000\u0000\u0000W\u0000i\u0000n\u0000d\u0000o\u0000w\u0000s\u0000 \u00002\u00000\u00000\u00000\u0000 \u00005\u0000.\u00000\u0000\u0000\u0000"} +{"timestamp":"2026-09-04T23:12:53","event_id":"fea24ceb-573f-45a5-8ab6-bf1e2b61af69","source_ip":"144.172.108.79","source_port":53115,"source_domain":"79.108.172.144.static.cloudzy.com","country_code":"US","country_name":"United States","city_name":"Las Vegas","asn_number":14956,"asn_org":"RouterHosting LLC","dest_port":445,"network_protocol":"","application_protocol":"","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":137,"dest_bytes":14,"network_bytes":151,"event_summary":"\u0000\u0000\u0000��SMBr\u0000\u0000\u0000\u0000\u0018S�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000��\u0000\u0000@\u0000\u0000b\u0000\u0002PC NETWORK PROGRAM 1.0\u0000\u0002LANMAN1.0\u0000\u0002Windows for Workgroups 3.1a\u0000\u0002LM1.2X002\u0000\u0002LANMAN2.1\u0000\u0002NT LM 0.12\u0000"} +{"timestamp":"2026-09-04T23:12:50","event_id":"9ca8884d-0c99-49d9-9f7b-52f17a154c52","source_ip":"144.172.108.79","source_port":52278,"source_domain":"79.108.172.144.static.cloudzy.com","country_code":"US","country_name":"United States","city_name":"Las Vegas","asn_number":14956,"asn_org":"RouterHosting LLC","dest_port":445,"network_protocol":"","application_protocol":"smbv1","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":4,"event_duration":499000000,"source_bytes":364,"dest_bytes":56,"network_bytes":420,"event_summary":"\u0000\u0000\u0000J�SMB%\u0000\u0000\u0000\u0000\u0018\u0001(\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0010\u0000\u0000\u0000\u0000����\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000J\u0000\u0000\u0000J\u0000\u0002\u0000#\u0000\u0000\u0000\u0007\u0000\\PIPE\\\u0000"} +{"timestamp":"2026-09-04T23:12:50","event_id":"9ca8884d-0c99-49d9-9f7b-52f17a154c52","source_ip":"144.172.108.79","source_port":52278,"source_domain":"79.108.172.144.static.cloudzy.com","country_code":"US","country_name":"United States","city_name":"Las Vegas","asn_number":14956,"asn_org":"RouterHosting LLC","dest_port":445,"network_protocol":"","application_protocol":"smbv1","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":3,"event_duration":365000000,"source_bytes":286,"dest_bytes":42,"network_bytes":328,"event_summary":"\u0000\u0000\u0000[�SMBu\u0000\u0000\u0000\u0000\u0018\u0001 \u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000/K\u0003x�^\u0004�\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u001c\u0000\u0000\\\\144.172.108.181\\IPC$\u0000?????\u0000TH_REPLACE__?????\u0000"} +{"timestamp":"2026-09-04T23:12:50","event_id":"9ca8884d-0c99-49d9-9f7b-52f17a154c52","source_ip":"144.172.108.79","source_port":52278,"source_domain":"79.108.172.144.static.cloudzy.com","country_code":"US","country_name":"United States","city_name":"Las Vegas","asn_number":14956,"asn_org":"RouterHosting LLC","dest_port":445,"network_protocol":"","application_protocol":"smbv1","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":2,"event_duration":233000000,"source_bytes":191,"dest_bytes":28,"network_bytes":219,"event_summary":"\u0000\u0000\u0000c�SMBs\u0000\u0000\u0000\u0000\u0018\u0001 \u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000/K\u0000\u0000�^\r�\u0000\u0000\u0000��\u0002\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000@\u0000\u0000\u0000&\u0000\u0000.\u0000Windows 2000 2195\u0000Windows 2000 5.0\u0000"} +{"timestamp":"2026-09-04T23:12:50","event_id":"9ca8884d-0c99-49d9-9f7b-52f17a154c52","source_ip":"144.172.108.79","source_port":52278,"source_domain":"79.108.172.144.static.cloudzy.com","country_code":"US","country_name":"United States","city_name":"Las Vegas","asn_number":14956,"asn_org":"RouterHosting LLC","dest_port":445,"network_protocol":"","application_protocol":"","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":88,"dest_bytes":14,"network_bytes":102,"event_summary":"\u0000\u0000\u0000T�SMBr\u0000\u0000\u0000\u0000\u0018\u0001(\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000/K\u0000\u0000�^\u00001\u0000\u0002LANMAN1.0\u0000\u0002LM1.2X002\u0000\u0002NT LANMAN 1.0\u0000\u0002NT LM 0.12\u0000"} +{"timestamp":"2026-09-04T20:03:03","event_id":"016a1ac2-b401-4143-8727-fa7b70814ba5","source_ip":"144.172.108.79","source_port":62111,"source_domain":"79.108.172.144.static.cloudzy.com","country_code":"US","country_name":"United States","city_name":"Las Vegas","asn_number":14956,"asn_org":"RouterHosting LLC","dest_port":445,"network_protocol":"","application_protocol":"smbv1","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":4,"event_duration":498000000,"source_bytes":455,"dest_bytes":56,"network_bytes":511,"event_summary":"\u0000\u0000\u0000N�SMB2\u0000\u0000\u0000\u0000\u0018\u0007�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000��\u0000\u0000A\u0000\u000f\f\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u00014�\u0000\u0000\u0000\f\u0000B\u0000\u0000\u0000N\u0000\u0001\u0000\u000e\u0000\r\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000"} +{"timestamp":"2026-09-04T20:03:02","event_id":"016a1ac2-b401-4143-8727-fa7b70814ba5","source_ip":"144.172.108.79","source_port":62111,"source_domain":"79.108.172.144.static.cloudzy.com","country_code":"US","country_name":"United States","city_name":"Las Vegas","asn_number":14956,"asn_org":"RouterHosting LLC","dest_port":445,"network_protocol":"","application_protocol":"smbv1","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":3,"event_duration":365000000,"source_bytes":373,"dest_bytes":42,"network_bytes":415,"event_summary":"\u0000\u0000\u0000\\�SMBu\u0000\u0000\u0000\u0000\u0018\u0007�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000��\u0000\u0000@\u0000\u0004�\u0000\\\u0000\b\u0000\u0001\u00001\u0000\u0000\\\u0000\\\u00001\u00009\u00002\u0000.\u00001\u00006\u00008\u0000.\u00005\u00006\u0000.\u00002\u00000\u0000\\\u0000I\u0000P\u0000C\u0000$\u0000\u0000\u0000?????\u0000"} +{"timestamp":"2026-09-04T20:03:02","event_id":"016a1ac2-b401-4143-8727-fa7b70814ba5","source_ip":"144.172.108.79","source_port":62111,"source_domain":"79.108.172.144.static.cloudzy.com","country_code":"US","country_name":"United States","city_name":"Las Vegas","asn_number":14956,"asn_org":"RouterHosting LLC","dest_port":445,"network_protocol":"","application_protocol":"smbv1","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":2,"event_duration":233000000,"source_bytes":277,"dest_bytes":28,"network_bytes":305,"event_summary":"\u0000\u0000\u0000��SMBs\u0000\u0000\u0000\u0000\u0018\u0007�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000��\u0000\u0000@\u0000\r�\u0000�\u0000\u0004\u0011\n\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000�\u0000\u0000\u0000K\u0000\u0000\u0000\u0000\u0000\u0000W\u0000i\u0000n\u0000d\u0000o\u0000w\u0000s\u0000 \u00002\u00000\u00000\u00000\u0000 \u00002\u00001\u00009\u00005\u0000\u0000\u0000W\u0000i\u0000n\u0000d\u0000o\u0000w\u0000s\u0000 \u00002\u00000\u00000\u00000\u0000 \u00005\u0000.\u00000\u0000\u0000\u0000"} +{"timestamp":"2026-09-04T20:03:02","event_id":"016a1ac2-b401-4143-8727-fa7b70814ba5","source_ip":"144.172.108.79","source_port":62111,"source_domain":"79.108.172.144.static.cloudzy.com","country_code":"US","country_name":"United States","city_name":"Las Vegas","asn_number":14956,"asn_org":"RouterHosting LLC","dest_port":445,"network_protocol":"","application_protocol":"","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":137,"dest_bytes":14,"network_bytes":151,"event_summary":"\u0000\u0000\u0000��SMBr\u0000\u0000\u0000\u0000\u0018S�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000��\u0000\u0000@\u0000\u0000b\u0000\u0002PC NETWORK PROGRAM 1.0\u0000\u0002LANMAN1.0\u0000\u0002Windows for Workgroups 3.1a\u0000\u0002LM1.2X002\u0000\u0002LANMAN2.1\u0000\u0002NT LM 0.12\u0000"} +{"timestamp":"2026-09-04T20:02:59","event_id":"99957f6a-3b9d-4808-b8ee-294566417c12","source_ip":"144.172.108.79","source_port":61317,"source_domain":"79.108.172.144.static.cloudzy.com","country_code":"US","country_name":"United States","city_name":"Las Vegas","asn_number":14956,"asn_org":"RouterHosting LLC","dest_port":445,"network_protocol":"","application_protocol":"smbv1","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":4,"event_duration":498000000,"source_bytes":364,"dest_bytes":56,"network_bytes":420,"event_summary":"\u0000\u0000\u0000J�SMB%\u0000\u0000\u0000\u0000\u0018\u0001(\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0010\u0000\u0000\u0000\u0000����\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000J\u0000\u0000\u0000J\u0000\u0002\u0000#\u0000\u0000\u0000\u0007\u0000\\PIPE\\\u0000"} +{"timestamp":"2026-09-04T20:02:59","event_id":"99957f6a-3b9d-4808-b8ee-294566417c12","source_ip":"144.172.108.79","source_port":61317,"source_domain":"79.108.172.144.static.cloudzy.com","country_code":"US","country_name":"United States","city_name":"Las Vegas","asn_number":14956,"asn_org":"RouterHosting LLC","dest_port":445,"network_protocol":"","application_protocol":"smbv1","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":3,"event_duration":366000000,"source_bytes":286,"dest_bytes":42,"network_bytes":328,"event_summary":"\u0000\u0000\u0000[�SMBu\u0000\u0000\u0000\u0000\u0018\u0001 \u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000/K\u0003x�^\u0004�\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u001c\u0000\u0000\\\\144.172.108.181\\IPC$\u0000?????\u0000TH_REPLACE__?????\u0000"} +{"timestamp":"2026-09-04T20:02:59","event_id":"99957f6a-3b9d-4808-b8ee-294566417c12","source_ip":"144.172.108.79","source_port":61317,"source_domain":"79.108.172.144.static.cloudzy.com","country_code":"US","country_name":"United States","city_name":"Las Vegas","asn_number":14956,"asn_org":"RouterHosting LLC","dest_port":445,"network_protocol":"","application_protocol":"smbv1","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":2,"event_duration":233000000,"source_bytes":191,"dest_bytes":28,"network_bytes":219,"event_summary":"\u0000\u0000\u0000c�SMBs\u0000\u0000\u0000\u0000\u0018\u0001 \u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000/K\u0000\u0000�^\r�\u0000\u0000\u0000��\u0002\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000@\u0000\u0000\u0000&\u0000\u0000.\u0000Windows 2000 2195\u0000Windows 2000 5.0\u0000"} +{"timestamp":"2026-09-04T20:02:59","event_id":"99957f6a-3b9d-4808-b8ee-294566417c12","source_ip":"144.172.108.79","source_port":61317,"source_domain":"79.108.172.144.static.cloudzy.com","country_code":"US","country_name":"United States","city_name":"Las Vegas","asn_number":14956,"asn_org":"RouterHosting LLC","dest_port":445,"network_protocol":"","application_protocol":"","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":88,"dest_bytes":14,"network_bytes":102,"event_summary":"\u0000\u0000\u0000T�SMBr\u0000\u0000\u0000\u0000\u0018\u0001(\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000/K\u0000\u0000�^\u00001\u0000\u0002LANMAN1.0\u0000\u0002LM1.2X002\u0000\u0002NT LANMAN 1.0\u0000\u0002NT LM 0.12\u0000"} +{"timestamp":"2026-09-04T19:38:08","event_id":"c1253a1c-e27a-4026-8baa-98ff52909b27","source_ip":"167.88.168.121","source_port":37030,"source_domain":"121.168.88.167.static.cloudzy.com","country_code":"US","country_name":"United States","city_name":"Dallas","asn_number":14956,"asn_org":"RouterHosting LLC","dest_port":8008,"network_protocol":"","application_protocol":"http","http_method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0","url_path":"/","url_domain":"","http_request_headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\":8008\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0\"}","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"ge11nn0400_9c3956fad5da","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":169,"dest_bytes":79,"network_bytes":248,"event_summary":""} +{"timestamp":"2026-09-04T18:55:37","event_id":"a0ba0e8f-c0f9-438e-9d72-053d2a8254e4","source_ip":"167.88.168.121","source_port":55602,"source_domain":"121.168.88.167.static.cloudzy.com","country_code":"US","country_name":"United States","city_name":"Dallas","asn_number":14956,"asn_org":"RouterHosting LLC","dest_port":8008,"network_protocol":"","application_protocol":"http","http_method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0","url_path":"/","url_domain":"","http_request_headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\":8008\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0\"}","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"ge11nn0400_9c3956fad5da","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":169,"dest_bytes":79,"network_bytes":248,"event_summary":""} +{"timestamp":"2026-09-04T18:11:24","event_id":"584cca12-5f02-47db-99e3-a7678476ad26","source_ip":"144.172.112.11","source_port":52407,"source_domain":"11.112.172.144.static.cloudzy.com","country_code":"US","country_name":"United States","city_name":"Ogden","asn_number":14956,"asn_org":"RouterHosting LLC","dest_port":445,"network_protocol":"","application_protocol":"","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":51,"dest_bytes":14,"network_bytes":65,"event_summary":"\u0000\u0000\u0000/�SMBr\u0000\u0000\u0000\u0000\u0018\u0001H\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000���\u000e\u0000\u0000\u0000\u0000\u0000\f\u0000\u0002NT LM 0.12\u0000"} +{"timestamp":"2026-09-04T18:11:24","event_id":"2217b76e-7f86-4e72-ab0c-d53cd817cc94","source_ip":"144.172.112.11","source_port":52436,"source_domain":"11.112.172.144.static.cloudzy.com","country_code":"US","country_name":"United States","city_name":"Ogden","asn_number":14956,"asn_org":"RouterHosting LLC","dest_port":445,"network_protocol":"","application_protocol":"","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":51,"dest_bytes":14,"network_bytes":65,"event_summary":"\u0000\u0000\u0000/�SMBr\u0000\u0000\u0000\u0000\u0018\u0001H\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000���\u000e\u0000\u0000\u0000\u0000\u0000\f\u0000\u0002NT LM 0.12\u0000"} +{"timestamp":"2026-09-04T06:30:09","event_id":"41f43d38-4394-4a54-ace7-995325f3819d","source_ip":"45.61.157.82","source_port":50749,"source_domain":"82.157.61.45.static.cloudzy.com","country_code":"US","country_name":"United States","city_name":"Las Vegas","asn_number":14956,"asn_org":"RouterHosting LLC","dest_port":445,"network_protocol":"","application_protocol":"smbv1","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":4,"event_duration":554000000,"source_bytes":455,"dest_bytes":48,"network_bytes":503,"event_summary":"\u0000\u0000\u0000N�SMB2\u0000\u0000\u0000\u0000\u0018\u0007�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000��\u0000\u0000A\u0000\u000f\f\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u00014�\u0000\u0000\u0000\f\u0000B\u0000\u0000\u0000N\u0000\u0001\u0000\u000e\u0000\r\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000"} +{"timestamp":"2026-09-04T06:30:08","event_id":"41f43d38-4394-4a54-ace7-995325f3819d","source_ip":"45.61.157.82","source_port":50749,"source_domain":"82.157.61.45.static.cloudzy.com","country_code":"US","country_name":"United States","city_name":"Las Vegas","asn_number":14956,"asn_org":"RouterHosting LLC","dest_port":445,"network_protocol":"","application_protocol":"smbv1","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":3,"event_duration":403000000,"source_bytes":373,"dest_bytes":36,"network_bytes":409,"event_summary":"\u0000\u0000\u0000\\�SMBu\u0000\u0000\u0000\u0000\u0018\u0007�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000��\u0000\u0000@\u0000\u0004�\u0000\\\u0000\b\u0000\u0001\u00001\u0000\u0000\\\u0000\\\u00001\u00009\u00002\u0000.\u00001\u00006\u00008\u0000.\u00005\u00006\u0000.\u00002\u00000\u0000\\\u0000I\u0000P\u0000C\u0000$\u0000\u0000\u0000?????\u0000"} +{"timestamp":"2026-09-04T06:30:08","event_id":"41f43d38-4394-4a54-ace7-995325f3819d","source_ip":"45.61.157.82","source_port":50749,"source_domain":"82.157.61.45.static.cloudzy.com","country_code":"US","country_name":"United States","city_name":"Las Vegas","asn_number":14956,"asn_org":"RouterHosting LLC","dest_port":445,"network_protocol":"","application_protocol":"smbv1","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":2,"event_duration":252000000,"source_bytes":277,"dest_bytes":24,"network_bytes":301,"event_summary":"\u0000\u0000\u0000��SMBs\u0000\u0000\u0000\u0000\u0018\u0007�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000��\u0000\u0000@\u0000\r�\u0000�\u0000\u0004\u0011\n\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000�\u0000\u0000\u0000K\u0000\u0000\u0000\u0000\u0000\u0000W\u0000i\u0000n\u0000d\u0000o\u0000w\u0000s\u0000 \u00002\u00000\u00000\u00000\u0000 \u00002\u00001\u00009\u00005\u0000\u0000\u0000W\u0000i\u0000n\u0000d\u0000o\u0000w\u0000s\u0000 \u00002\u00000\u00000\u00000\u0000 \u00005\u0000.\u00000\u0000\u0000\u0000"} +{"timestamp":"2026-09-04T06:30:08","event_id":"41f43d38-4394-4a54-ace7-995325f3819d","source_ip":"45.61.157.82","source_port":50749,"source_domain":"82.157.61.45.static.cloudzy.com","country_code":"US","country_name":"United States","city_name":"Las Vegas","asn_number":14956,"asn_org":"RouterHosting LLC","dest_port":445,"network_protocol":"","application_protocol":"","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":137,"dest_bytes":12,"network_bytes":149,"event_summary":"\u0000\u0000\u0000��SMBr\u0000\u0000\u0000\u0000\u0018S�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000��\u0000\u0000@\u0000\u0000b\u0000\u0002PC NETWORK PROGRAM 1.0\u0000\u0002LANMAN1.0\u0000\u0002Windows for Workgroups 3.1a\u0000\u0002LM1.2X002\u0000\u0002LANMAN2.1\u0000\u0002NT LM 0.12\u0000"} +{"timestamp":"2026-09-04T06:30:05","event_id":"923c4ae1-281d-4564-a0d4-8b94466f8838","source_ip":"45.61.157.82","source_port":49934,"source_domain":"82.157.61.45.static.cloudzy.com","country_code":"US","country_name":"United States","city_name":"Las Vegas","asn_number":14956,"asn_org":"RouterHosting LLC","dest_port":445,"network_protocol":"","application_protocol":"smbv1","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":4,"event_duration":554000000,"source_bytes":364,"dest_bytes":48,"network_bytes":412,"event_summary":"\u0000\u0000\u0000J�SMB%\u0000\u0000\u0000\u0000\u0018\u0001(\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0010\u0000\u0000\u0000\u0000����\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000J\u0000\u0000\u0000J\u0000\u0002\u0000#\u0000\u0000\u0000\u0007\u0000\\PIPE\\\u0000"} +{"timestamp":"2026-09-04T06:30:05","event_id":"923c4ae1-281d-4564-a0d4-8b94466f8838","source_ip":"45.61.157.82","source_port":49934,"source_domain":"82.157.61.45.static.cloudzy.com","country_code":"US","country_name":"United States","city_name":"Las Vegas","asn_number":14956,"asn_org":"RouterHosting LLC","dest_port":445,"network_protocol":"","application_protocol":"smbv1","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":3,"event_duration":403000000,"source_bytes":286,"dest_bytes":36,"network_bytes":322,"event_summary":"\u0000\u0000\u0000[�SMBu\u0000\u0000\u0000\u0000\u0018\u0001 \u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000/K\u0000\u0000�^\u0004�\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u001c\u0000\u0000\\\\45.61.157.16\\IPC$\u0000?????\u0000EPATH_REPLACE__?????\u0000"} +{"timestamp":"2026-09-04T06:30:05","event_id":"923c4ae1-281d-4564-a0d4-8b94466f8838","source_ip":"45.61.157.82","source_port":49934,"source_domain":"82.157.61.45.static.cloudzy.com","country_code":"US","country_name":"United States","city_name":"Las Vegas","asn_number":14956,"asn_org":"RouterHosting LLC","dest_port":445,"network_protocol":"","application_protocol":"smbv1","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":2,"event_duration":251000000,"source_bytes":191,"dest_bytes":24,"network_bytes":215,"event_summary":"\u0000\u0000\u0000c�SMBs\u0000\u0000\u0000\u0000\u0018\u0001 \u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000/K\u0000\u0000�^\r�\u0000\u0000\u0000��\u0002\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000@\u0000\u0000\u0000&\u0000\u0000.\u0000Windows 2000 2195\u0000Windows 2000 5.0\u0000"} +{"timestamp":"2026-09-04T06:30:04","event_id":"923c4ae1-281d-4564-a0d4-8b94466f8838","source_ip":"45.61.157.82","source_port":49934,"source_domain":"82.157.61.45.static.cloudzy.com","country_code":"US","country_name":"United States","city_name":"Las Vegas","asn_number":14956,"asn_org":"RouterHosting LLC","dest_port":445,"network_protocol":"","application_protocol":"","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":88,"dest_bytes":12,"network_bytes":100,"event_summary":"\u0000\u0000\u0000T�SMBr\u0000\u0000\u0000\u0000\u0018\u0001(\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000/K\u0000\u0000�^\u00001\u0000\u0002LANMAN1.0\u0000\u0002LM1.2X002\u0000\u0002NT LANMAN 1.0\u0000\u0002NT LM 0.12\u0000"} +{"timestamp":"2026-09-04T04:39:13","event_id":"a31f1233-0fef-4fbe-8b22-df72be99e3e9","source_ip":"45.61.157.82","source_port":62738,"source_domain":"82.157.61.45.static.cloudzy.com","country_code":"US","country_name":"United States","city_name":"Las Vegas","asn_number":14956,"asn_org":"RouterHosting LLC","dest_port":445,"network_protocol":"","application_protocol":"smbv1","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":4,"event_duration":555000000,"source_bytes":455,"dest_bytes":48,"network_bytes":503,"event_summary":"\u0000\u0000\u0000N�SMB2\u0000\u0000\u0000\u0000\u0018\u0007�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000��\u0000\u0000A\u0000\u000f\f\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u00014�\u0000\u0000\u0000\f\u0000B\u0000\u0000\u0000N\u0000\u0001\u0000\u000e\u0000\r\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000"} +{"timestamp":"2026-09-04T04:39:13","event_id":"a31f1233-0fef-4fbe-8b22-df72be99e3e9","source_ip":"45.61.157.82","source_port":62738,"source_domain":"82.157.61.45.static.cloudzy.com","country_code":"US","country_name":"United States","city_name":"Las Vegas","asn_number":14956,"asn_org":"RouterHosting LLC","dest_port":445,"network_protocol":"","application_protocol":"smbv1","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":3,"event_duration":403000000,"source_bytes":373,"dest_bytes":36,"network_bytes":409,"event_summary":"\u0000\u0000\u0000\\�SMBu\u0000\u0000\u0000\u0000\u0018\u0007�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000��\u0000\u0000@\u0000\u0004�\u0000\\\u0000\b\u0000\u0001\u00001\u0000\u0000\\\u0000\\\u00001\u00009\u00002\u0000.\u00001\u00006\u00008\u0000.\u00005\u00006\u0000.\u00002\u00000\u0000\\\u0000I\u0000P\u0000C\u0000$\u0000\u0000\u0000?????\u0000"} +{"timestamp":"2026-09-04T04:39:13","event_id":"a31f1233-0fef-4fbe-8b22-df72be99e3e9","source_ip":"45.61.157.82","source_port":62738,"source_domain":"82.157.61.45.static.cloudzy.com","country_code":"US","country_name":"United States","city_name":"Las Vegas","asn_number":14956,"asn_org":"RouterHosting LLC","dest_port":445,"network_protocol":"","application_protocol":"smbv1","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":2,"event_duration":252000000,"source_bytes":277,"dest_bytes":24,"network_bytes":301,"event_summary":"\u0000\u0000\u0000��SMBs\u0000\u0000\u0000\u0000\u0018\u0007�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000��\u0000\u0000@\u0000\r�\u0000�\u0000\u0004\u0011\n\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000�\u0000\u0000\u0000K\u0000\u0000\u0000\u0000\u0000\u0000W\u0000i\u0000n\u0000d\u0000o\u0000w\u0000s\u0000 \u00002\u00000\u00000\u00000\u0000 \u00002\u00001\u00009\u00005\u0000\u0000\u0000W\u0000i\u0000n\u0000d\u0000o\u0000w\u0000s\u0000 \u00002\u00000\u00000\u00000\u0000 \u00005\u0000.\u00000\u0000\u0000\u0000"} +{"timestamp":"2026-09-04T04:39:13","event_id":"a31f1233-0fef-4fbe-8b22-df72be99e3e9","source_ip":"45.61.157.82","source_port":62738,"source_domain":"82.157.61.45.static.cloudzy.com","country_code":"US","country_name":"United States","city_name":"Las Vegas","asn_number":14956,"asn_org":"RouterHosting LLC","dest_port":445,"network_protocol":"","application_protocol":"","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":137,"dest_bytes":12,"network_bytes":149,"event_summary":"\u0000\u0000\u0000��SMBr\u0000\u0000\u0000\u0000\u0018S�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000��\u0000\u0000@\u0000\u0000b\u0000\u0002PC NETWORK PROGRAM 1.0\u0000\u0002LANMAN1.0\u0000\u0002Windows for Workgroups 3.1a\u0000\u0002LM1.2X002\u0000\u0002LANMAN2.1\u0000\u0002NT LM 0.12\u0000"} +{"timestamp":"2026-09-04T04:39:10","event_id":"2908ae00-9d4a-4c25-a636-9cf3d31835f0","source_ip":"45.61.157.82","source_port":61929,"source_domain":"82.157.61.45.static.cloudzy.com","country_code":"US","country_name":"United States","city_name":"Las Vegas","asn_number":14956,"asn_org":"RouterHosting LLC","dest_port":445,"network_protocol":"","application_protocol":"smbv1","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":4,"event_duration":554000000,"source_bytes":364,"dest_bytes":48,"network_bytes":412,"event_summary":"\u0000\u0000\u0000J�SMB%\u0000\u0000\u0000\u0000\u0018\u0001(\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0010\u0000\u0000\u0000\u0000����\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000J\u0000\u0000\u0000J\u0000\u0002\u0000#\u0000\u0000\u0000\u0007\u0000\\PIPE\\\u0000"} +{"timestamp":"2026-09-04T04:39:09","event_id":"2908ae00-9d4a-4c25-a636-9cf3d31835f0","source_ip":"45.61.157.82","source_port":61929,"source_domain":"82.157.61.45.static.cloudzy.com","country_code":"US","country_name":"United States","city_name":"Las Vegas","asn_number":14956,"asn_org":"RouterHosting LLC","dest_port":445,"network_protocol":"","application_protocol":"smbv1","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":3,"event_duration":402000000,"source_bytes":286,"dest_bytes":36,"network_bytes":322,"event_summary":"\u0000\u0000\u0000[�SMBu\u0000\u0000\u0000\u0000\u0018\u0001 \u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000/K\u0000\u0000�^\u0004�\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u001c\u0000\u0000\\\\45.61.157.16\\IPC$\u0000?????\u0000EPATH_REPLACE__?????\u0000"} +{"timestamp":"2026-09-04T04:39:09","event_id":"2908ae00-9d4a-4c25-a636-9cf3d31835f0","source_ip":"45.61.157.82","source_port":61929,"source_domain":"82.157.61.45.static.cloudzy.com","country_code":"US","country_name":"United States","city_name":"Las Vegas","asn_number":14956,"asn_org":"RouterHosting LLC","dest_port":445,"network_protocol":"","application_protocol":"smbv1","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":2,"event_duration":251000000,"source_bytes":191,"dest_bytes":24,"network_bytes":215,"event_summary":"\u0000\u0000\u0000c�SMBs\u0000\u0000\u0000\u0000\u0018\u0001 \u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000/K\u0000\u0000�^\r�\u0000\u0000\u0000��\u0002\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000@\u0000\u0000\u0000&\u0000\u0000.\u0000Windows 2000 2195\u0000Windows 2000 5.0\u0000"} +{"timestamp":"2026-09-04T04:39:09","event_id":"2908ae00-9d4a-4c25-a636-9cf3d31835f0","source_ip":"45.61.157.82","source_port":61929,"source_domain":"82.157.61.45.static.cloudzy.com","country_code":"US","country_name":"United States","city_name":"Las Vegas","asn_number":14956,"asn_org":"RouterHosting LLC","dest_port":445,"network_protocol":"","application_protocol":"","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":88,"dest_bytes":12,"network_bytes":100,"event_summary":"\u0000\u0000\u0000T�SMBr\u0000\u0000\u0000\u0000\u0018\u0001(\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000/K\u0000\u0000�^\u00001\u0000\u0002LANMAN1.0\u0000\u0002LM1.2X002\u0000\u0002NT LANMAN 1.0\u0000\u0002NT LM 0.12\u0000"} +{"timestamp":"2026-09-04T02:30:36","event_id":"bcb35be1-77bb-4d87-a3f9-79c14c4d8d9a","source_ip":"45.61.157.82","source_port":58786,"source_domain":"82.157.61.45.static.cloudzy.com","country_code":"US","country_name":"United States","city_name":"Las Vegas","asn_number":14956,"asn_org":"RouterHosting LLC","dest_port":445,"network_protocol":"","application_protocol":"smbv1","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":4,"event_duration":554000000,"source_bytes":455,"dest_bytes":48,"network_bytes":503,"event_summary":"\u0000\u0000\u0000N�SMB2\u0000\u0000\u0000\u0000\u0018\u0007�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000��\u0000\u0000A\u0000\u000f\f\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u00014�\u0000\u0000\u0000\f\u0000B\u0000\u0000\u0000N\u0000\u0001\u0000\u000e\u0000\r\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000"} +{"timestamp":"2026-09-04T02:30:36","event_id":"bcb35be1-77bb-4d87-a3f9-79c14c4d8d9a","source_ip":"45.61.157.82","source_port":58786,"source_domain":"82.157.61.45.static.cloudzy.com","country_code":"US","country_name":"United States","city_name":"Las Vegas","asn_number":14956,"asn_org":"RouterHosting LLC","dest_port":445,"network_protocol":"","application_protocol":"smbv1","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":3,"event_duration":402000000,"source_bytes":373,"dest_bytes":36,"network_bytes":409,"event_summary":"\u0000\u0000\u0000\\�SMBu\u0000\u0000\u0000\u0000\u0018\u0007�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000��\u0000\u0000@\u0000\u0004�\u0000\\\u0000\b\u0000\u0001\u00001\u0000\u0000\\\u0000\\\u00001\u00009\u00002\u0000.\u00001\u00006\u00008\u0000.\u00005\u00006\u0000.\u00002\u00000\u0000\\\u0000I\u0000P\u0000C\u0000$\u0000\u0000\u0000?????\u0000"} +{"timestamp":"2026-09-04T02:30:35","event_id":"bcb35be1-77bb-4d87-a3f9-79c14c4d8d9a","source_ip":"45.61.157.82","source_port":58786,"source_domain":"82.157.61.45.static.cloudzy.com","country_code":"US","country_name":"United States","city_name":"Las Vegas","asn_number":14956,"asn_org":"RouterHosting LLC","dest_port":445,"network_protocol":"","application_protocol":"smbv1","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":2,"event_duration":251000000,"source_bytes":277,"dest_bytes":24,"network_bytes":301,"event_summary":"\u0000\u0000\u0000��SMBs\u0000\u0000\u0000\u0000\u0018\u0007�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000��\u0000\u0000@\u0000\r�\u0000�\u0000\u0004\u0011\n\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000�\u0000\u0000\u0000K\u0000\u0000\u0000\u0000\u0000\u0000W\u0000i\u0000n\u0000d\u0000o\u0000w\u0000s\u0000 \u00002\u00000\u00000\u00000\u0000 \u00002\u00001\u00009\u00005\u0000\u0000\u0000W\u0000i\u0000n\u0000d\u0000o\u0000w\u0000s\u0000 \u00002\u00000\u00000\u00000\u0000 \u00005\u0000.\u00000\u0000\u0000\u0000"} +{"timestamp":"2026-09-04T02:30:35","event_id":"bcb35be1-77bb-4d87-a3f9-79c14c4d8d9a","source_ip":"45.61.157.82","source_port":58786,"source_domain":"82.157.61.45.static.cloudzy.com","country_code":"US","country_name":"United States","city_name":"Las Vegas","asn_number":14956,"asn_org":"RouterHosting LLC","dest_port":445,"network_protocol":"","application_protocol":"","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":137,"dest_bytes":12,"network_bytes":149,"event_summary":"\u0000\u0000\u0000��SMBr\u0000\u0000\u0000\u0000\u0018S�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000��\u0000\u0000@\u0000\u0000b\u0000\u0002PC NETWORK PROGRAM 1.0\u0000\u0002LANMAN1.0\u0000\u0002Windows for Workgroups 3.1a\u0000\u0002LM1.2X002\u0000\u0002LANMAN2.1\u0000\u0002NT LM 0.12\u0000"} +{"timestamp":"2026-09-04T02:30:32","event_id":"51bae7b7-1b45-4aa4-b366-ca6bb47a8b6e","source_ip":"45.61.157.82","source_port":57806,"source_domain":"82.157.61.45.static.cloudzy.com","country_code":"US","country_name":"United States","city_name":"Las Vegas","asn_number":14956,"asn_org":"RouterHosting LLC","dest_port":445,"network_protocol":"","application_protocol":"smbv1","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":4,"event_duration":555000000,"source_bytes":364,"dest_bytes":48,"network_bytes":412,"event_summary":"\u0000\u0000\u0000J�SMB%\u0000\u0000\u0000\u0000\u0018\u0001(\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0010\u0000\u0000\u0000\u0000����\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000J\u0000\u0000\u0000J\u0000\u0002\u0000#\u0000\u0000\u0000\u0007\u0000\\PIPE\\\u0000"} +{"timestamp":"2026-09-04T02:30:32","event_id":"51bae7b7-1b45-4aa4-b366-ca6bb47a8b6e","source_ip":"45.61.157.82","source_port":57806,"source_domain":"82.157.61.45.static.cloudzy.com","country_code":"US","country_name":"United States","city_name":"Las Vegas","asn_number":14956,"asn_org":"RouterHosting LLC","dest_port":445,"network_protocol":"","application_protocol":"smbv1","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":3,"event_duration":404000000,"source_bytes":286,"dest_bytes":36,"network_bytes":322,"event_summary":"\u0000\u0000\u0000[�SMBu\u0000\u0000\u0000\u0000\u0018\u0001 \u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000/K\u0000\u0000�^\u0004�\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u001c\u0000\u0000\\\\45.61.157.16\\IPC$\u0000?????\u0000EPATH_REPLACE__?????\u0000"} +{"timestamp":"2026-09-04T02:30:32","event_id":"51bae7b7-1b45-4aa4-b366-ca6bb47a8b6e","source_ip":"45.61.157.82","source_port":57806,"source_domain":"82.157.61.45.static.cloudzy.com","country_code":"US","country_name":"United States","city_name":"Las Vegas","asn_number":14956,"asn_org":"RouterHosting LLC","dest_port":445,"network_protocol":"","application_protocol":"smbv1","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":2,"event_duration":252000000,"source_bytes":191,"dest_bytes":24,"network_bytes":215,"event_summary":"\u0000\u0000\u0000c�SMBs\u0000\u0000\u0000\u0000\u0018\u0001 \u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000/K\u0000\u0000�^\r�\u0000\u0000\u0000��\u0002\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000@\u0000\u0000\u0000&\u0000\u0000.\u0000Windows 2000 2195\u0000Windows 2000 5.0\u0000"} +{"timestamp":"2026-09-04T02:30:32","event_id":"51bae7b7-1b45-4aa4-b366-ca6bb47a8b6e","source_ip":"45.61.157.82","source_port":57806,"source_domain":"82.157.61.45.static.cloudzy.com","country_code":"US","country_name":"United States","city_name":"Las Vegas","asn_number":14956,"asn_org":"RouterHosting LLC","dest_port":445,"network_protocol":"","application_protocol":"","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":88,"dest_bytes":12,"network_bytes":100,"event_summary":"\u0000\u0000\u0000T�SMBr\u0000\u0000\u0000\u0000\u0018\u0001(\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000/K\u0000\u0000�^\u00001\u0000\u0002LANMAN1.0\u0000\u0002LM1.2X002\u0000\u0002NT LANMAN 1.0\u0000\u0002NT LM 0.12\u0000"} +{"timestamp":"2026-09-04T01:15:16","event_id":"1ed9a151-9080-48ac-ba95-d3966b1a3f42","source_ip":"45.61.157.82","source_port":50609,"source_domain":"82.157.61.45.static.cloudzy.com","country_code":"US","country_name":"United States","city_name":"Las Vegas","asn_number":14956,"asn_org":"RouterHosting LLC","dest_port":445,"network_protocol":"","application_protocol":"smbv1","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":4,"event_duration":553000000,"source_bytes":455,"dest_bytes":48,"network_bytes":503,"event_summary":"\u0000\u0000\u0000N�SMB2\u0000\u0000\u0000\u0000\u0018\u0007�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000��\u0000\u0000A\u0000\u000f\f\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u00014�\u0000\u0000\u0000\f\u0000B\u0000\u0000\u0000N\u0000\u0001\u0000\u000e\u0000\r\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000"} +{"timestamp":"2026-09-04T01:15:16","event_id":"1ed9a151-9080-48ac-ba95-d3966b1a3f42","source_ip":"45.61.157.82","source_port":50609,"source_domain":"82.157.61.45.static.cloudzy.com","country_code":"US","country_name":"United States","city_name":"Las Vegas","asn_number":14956,"asn_org":"RouterHosting LLC","dest_port":445,"network_protocol":"","application_protocol":"smbv1","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":3,"event_duration":402000000,"source_bytes":373,"dest_bytes":36,"network_bytes":409,"event_summary":"\u0000\u0000\u0000\\�SMBu\u0000\u0000\u0000\u0000\u0018\u0007�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000��\u0000\u0000@\u0000\u0004�\u0000\\\u0000\b\u0000\u0001\u00001\u0000\u0000\\\u0000\\\u00001\u00009\u00002\u0000.\u00001\u00006\u00008\u0000.\u00005\u00006\u0000.\u00002\u00000\u0000\\\u0000I\u0000P\u0000C\u0000$\u0000\u0000\u0000?????\u0000"} +{"timestamp":"2026-09-04T01:15:16","event_id":"1ed9a151-9080-48ac-ba95-d3966b1a3f42","source_ip":"45.61.157.82","source_port":50609,"source_domain":"82.157.61.45.static.cloudzy.com","country_code":"US","country_name":"United States","city_name":"Las Vegas","asn_number":14956,"asn_org":"RouterHosting LLC","dest_port":445,"network_protocol":"","application_protocol":"smbv1","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":2,"event_duration":251000000,"source_bytes":277,"dest_bytes":24,"network_bytes":301,"event_summary":"\u0000\u0000\u0000��SMBs\u0000\u0000\u0000\u0000\u0018\u0007�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000��\u0000\u0000@\u0000\r�\u0000�\u0000\u0004\u0011\n\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000�\u0000\u0000\u0000K\u0000\u0000\u0000\u0000\u0000\u0000W\u0000i\u0000n\u0000d\u0000o\u0000w\u0000s\u0000 \u00002\u00000\u00000\u00000\u0000 \u00002\u00001\u00009\u00005\u0000\u0000\u0000W\u0000i\u0000n\u0000d\u0000o\u0000w\u0000s\u0000 \u00002\u00000\u00000\u00000\u0000 \u00005\u0000.\u00000\u0000\u0000\u0000"} +{"timestamp":"2026-09-04T01:15:16","event_id":"1ed9a151-9080-48ac-ba95-d3966b1a3f42","source_ip":"45.61.157.82","source_port":50609,"source_domain":"82.157.61.45.static.cloudzy.com","country_code":"US","country_name":"United States","city_name":"Las Vegas","asn_number":14956,"asn_org":"RouterHosting LLC","dest_port":445,"network_protocol":"","application_protocol":"","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":137,"dest_bytes":12,"network_bytes":149,"event_summary":"\u0000\u0000\u0000��SMBr\u0000\u0000\u0000\u0000\u0018S�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000��\u0000\u0000@\u0000\u0000b\u0000\u0002PC NETWORK PROGRAM 1.0\u0000\u0002LANMAN1.0\u0000\u0002Windows for Workgroups 3.1a\u0000\u0002LM1.2X002\u0000\u0002LANMAN2.1\u0000\u0002NT LM 0.12\u0000"} +{"timestamp":"2026-09-04T01:15:13","event_id":"1786a3f2-2fe2-44c8-8705-5a952b3cd908","source_ip":"45.61.157.82","source_port":49822,"source_domain":"82.157.61.45.static.cloudzy.com","country_code":"US","country_name":"United States","city_name":"Las Vegas","asn_number":14956,"asn_org":"RouterHosting LLC","dest_port":445,"network_protocol":"","application_protocol":"smbv1","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":4,"event_duration":553000000,"source_bytes":364,"dest_bytes":48,"network_bytes":412,"event_summary":"\u0000\u0000\u0000J�SMB%\u0000\u0000\u0000\u0000\u0018\u0001(\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0010\u0000\u0000\u0000\u0000����\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000J\u0000\u0000\u0000J\u0000\u0002\u0000#\u0000\u0000\u0000\u0007\u0000\\PIPE\\\u0000"} +{"timestamp":"2026-09-04T01:15:13","event_id":"1786a3f2-2fe2-44c8-8705-5a952b3cd908","source_ip":"45.61.157.82","source_port":49822,"source_domain":"82.157.61.45.static.cloudzy.com","country_code":"US","country_name":"United States","city_name":"Las Vegas","asn_number":14956,"asn_org":"RouterHosting LLC","dest_port":445,"network_protocol":"","application_protocol":"smbv1","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":3,"event_duration":402000000,"source_bytes":286,"dest_bytes":36,"network_bytes":322,"event_summary":"\u0000\u0000\u0000[�SMBu\u0000\u0000\u0000\u0000\u0018\u0001 \u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000/K\u0000\u0000�^\u0004�\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u001c\u0000\u0000\\\\45.61.157.16\\IPC$\u0000?????\u0000EPATH_REPLACE__?????\u0000"} +{"timestamp":"2026-09-04T01:15:12","event_id":"1786a3f2-2fe2-44c8-8705-5a952b3cd908","source_ip":"45.61.157.82","source_port":49822,"source_domain":"82.157.61.45.static.cloudzy.com","country_code":"US","country_name":"United States","city_name":"Las Vegas","asn_number":14956,"asn_org":"RouterHosting LLC","dest_port":445,"network_protocol":"","application_protocol":"smbv1","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":2,"event_duration":251000000,"source_bytes":191,"dest_bytes":24,"network_bytes":215,"event_summary":"\u0000\u0000\u0000c�SMBs\u0000\u0000\u0000\u0000\u0018\u0001 \u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000/K\u0000\u0000�^\r�\u0000\u0000\u0000��\u0002\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000@\u0000\u0000\u0000&\u0000\u0000.\u0000Windows 2000 2195\u0000Windows 2000 5.0\u0000"} +{"timestamp":"2026-09-04T01:15:12","event_id":"1786a3f2-2fe2-44c8-8705-5a952b3cd908","source_ip":"45.61.157.82","source_port":49822,"source_domain":"82.157.61.45.static.cloudzy.com","country_code":"US","country_name":"United States","city_name":"Las Vegas","asn_number":14956,"asn_org":"RouterHosting LLC","dest_port":445,"network_protocol":"","application_protocol":"","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":88,"dest_bytes":12,"network_bytes":100,"event_summary":"\u0000\u0000\u0000T�SMBr\u0000\u0000\u0000\u0000\u0018\u0001(\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000/K\u0000\u0000�^\u00001\u0000\u0002LANMAN1.0\u0000\u0002LM1.2X002\u0000\u0002NT LANMAN 1.0\u0000\u0002NT LM 0.12\u0000"} +{"timestamp":"2026-09-03T17:01:38","event_id":"15af6305-9d5b-4964-91ac-c88074751ba6","source_ip":"216.126.227.187","source_port":55802,"source_domain":"187.227.126.216.static.cloudzy.com","country_code":"US","country_name":"United States","city_name":"Ogden","asn_number":14956,"asn_org":"RouterHosting LLC","dest_port":7860,"network_protocol":"","application_protocol":"http","http_method":"GET","user_agent":"Python/3.13 aiohttp/3.13.5","url_path":"/api/v1/version","url_domain":"","http_request_headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate\",\"host\":\":7860\",\"user-agent\":\"Python/3.13 aiohttp/3.13.5\"}","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"ge11nn0400_c3abebcf3d28","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":142,"dest_bytes":80,"network_bytes":222,"event_summary":""} +{"timestamp":"2026-09-03T06:57:25","event_id":"74b4b901-bc2a-4e2d-8182-092ed8770b7f","source_ip":"167.88.168.121","source_port":57714,"source_domain":"121.168.88.167.static.cloudzy.com","country_code":"US","country_name":"United States","city_name":"Dallas","asn_number":14956,"asn_org":"RouterHosting LLC","dest_port":2095,"network_protocol":"","application_protocol":"http","http_method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0","url_path":"/","url_domain":"","http_request_headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\":2095\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0\"}","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"ge11nn0400_9c3956fad5da","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":101000000,"source_bytes":169,"dest_bytes":79,"network_bytes":248,"event_summary":""} +{"timestamp":"2026-09-03T06:47:31","event_id":"d7c504a0-df38-4cd9-b95e-5355dd56f993","source_ip":"167.88.168.121","source_port":48929,"source_domain":"121.168.88.167.static.cloudzy.com","country_code":"US","country_name":"United States","city_name":"Dallas","asn_number":14956,"asn_org":"RouterHosting LLC","dest_port":2095,"network_protocol":"","application_protocol":"http","http_method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0","url_path":"/","url_domain":"","http_request_headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\":2095\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0\"}","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"ge11nn0400_9c3956fad5da","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":169,"dest_bytes":79,"network_bytes":248,"event_summary":""} +{"timestamp":"2026-09-02T07:32:32","event_id":"1581fc5f-2cbd-4cc8-b736-4ef59604cf61","source_ip":"144.172.100.114","source_port":46306,"source_domain":"114.100.172.144.static.cloudzy.com","country_code":"US","country_name":"United States","city_name":"Las Vegas","asn_number":14956,"asn_org":"RouterHosting LLC","dest_port":1723,"network_protocol":"","application_protocol":"pptp","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":156,"dest_bytes":15,"network_bytes":171,"event_summary":"\u0000�\u0000\u0001\u001a+","http_request_headers":"{\"connection\":\"keep-alive\",\"host\":\"\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36\"}","ssh_client_hassh":"","tls_client_ja4":"t13i100900_61a7ad8aa9b6_88aa062a14c8","tls_client_ja3":"92e3065cf9444ba90adc1bce4206011c","tls_client_version":"TLSv1.3","tls_client_cipher":"TLS_CHACHA20_POLY1305_SHA256","http_request_ja4h":"ge11nn0300_7fd797acd99d","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":191,"dest_bytes":78,"network_bytes":269,"event_summary":""} +{"timestamp":"2026-09-01T09:05:26","event_id":"f4d3dcbe-b794-4846-b640-4e7b1e632904","source_ip":"144.172.115.222","source_port":39444,"source_domain":"222.115.172.144.static.cloudzy.com","country_code":"US","country_name":"United States","city_name":"Ogden","asn_number":14956,"asn_org":"RouterHosting LLC","dest_port":5061,"network_protocol":"tls","application_protocol":"sip","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"t13i311000_e8f1e7e78f70_d41ae481755e","tls_client_ja3":"004556e859f3c26c5d19746b3a957c74","tls_client_version":"TLSv1.3","tls_client_cipher":"TLS_CHACHA20_POLY1305_SHA256","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":380000000,"source_bytes":635,"dest_bytes":15,"network_bytes":650,"event_summary":"INVITE sip:00972567158234@:5061 SIP/2.0\r\nVia: SIP/2.0/TLS 0.0.0.0:39444;branch=z9hG4bK8eae81b4e3;rport\r\nFrom: ;tag=36a03fb3\r\nTo: :5061>\r\nCall-ID: 52609705-565c-4841-8f7a-bc67985faa02@0.0.0.0\r\nCSeq: 1 INVITE\r\nContact: \r\nMax-Forwards: 70\r\nUser-Agent: 1001/GOLIATH\r\nAccept: application/sdp\r\nContent-Type: application/sdp\r\nContent-Length: 201\r\n\r\nv=0\r\no=- 1788253526 1788253526 IN IP4 0.0.0.0\r\ns=Call\r\nc=IN IP4 0.0.0.0\r\nt=0 0\r\nm=audio 7078 RTP/AVP 0 8 101\r\na=rtpmap:0 PCMU/8000\r\na=rtpmap:8 PCMA/8000\r\na=rtpmap:101 telephone-event/8000\r\na=sendrecv\r\n"} +{"timestamp":"2026-09-01T08:57:36","event_id":"bb04fa8e-6ada-44c8-910a-f0bb5b322711","source_ip":"144.172.99.200","source_port":51647,"source_domain":"200.99.172.144.static.cloudzy.com","country_code":"US","country_name":"United States","city_name":"Staten Island","asn_number":14956,"asn_org":"RouterHosting LLC","dest_port":445,"network_protocol":"","application_protocol":"smbv1","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":4,"event_duration":497000000,"source_bytes":455,"dest_bytes":56,"network_bytes":511,"event_summary":"\u0000\u0000\u0000N�SMB2\u0000\u0000\u0000\u0000\u0018\u0007�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000��\u0000\u0000A\u0000\u000f\f\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u00014�\u0000\u0000\u0000\f\u0000B\u0000\u0000\u0000N\u0000\u0001\u0000\u000e\u0000\r\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000"} +{"timestamp":"2026-09-01T08:57:36","event_id":"bb04fa8e-6ada-44c8-910a-f0bb5b322711","source_ip":"144.172.99.200","source_port":51647,"source_domain":"200.99.172.144.static.cloudzy.com","country_code":"US","country_name":"United States","city_name":"Staten Island","asn_number":14956,"asn_org":"RouterHosting LLC","dest_port":445,"network_protocol":"","application_protocol":"smbv1","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":3,"event_duration":365000000,"source_bytes":373,"dest_bytes":42,"network_bytes":415,"event_summary":"\u0000\u0000\u0000\\�SMBu\u0000\u0000\u0000\u0000\u0018\u0007�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000��\u0000\u0000@\u0000\u0004�\u0000\\\u0000\b\u0000\u0001\u00001\u0000\u0000\\\u0000\\\u00001\u00009\u00002\u0000.\u00001\u00006\u00008\u0000.\u00005\u00006\u0000.\u00002\u00000\u0000\\\u0000I\u0000P\u0000C\u0000$\u0000\u0000\u0000?????\u0000"} +{"timestamp":"2026-09-01T08:57:36","event_id":"bb04fa8e-6ada-44c8-910a-f0bb5b322711","source_ip":"144.172.99.200","source_port":51647,"source_domain":"200.99.172.144.static.cloudzy.com","country_code":"US","country_name":"United States","city_name":"Staten Island","asn_number":14956,"asn_org":"RouterHosting LLC","dest_port":445,"network_protocol":"","application_protocol":"smbv1","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":2,"event_duration":233000000,"source_bytes":277,"dest_bytes":28,"network_bytes":305,"event_summary":"\u0000\u0000\u0000��SMBs\u0000\u0000\u0000\u0000\u0018\u0007�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000��\u0000\u0000@\u0000\r�\u0000�\u0000\u0004\u0011\n\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000�\u0000\u0000\u0000K\u0000\u0000\u0000\u0000\u0000\u0000W\u0000i\u0000n\u0000d\u0000o\u0000w\u0000s\u0000 \u00002\u00000\u00000\u00000\u0000 \u00002\u00001\u00009\u00005\u0000\u0000\u0000W\u0000i\u0000n\u0000d\u0000o\u0000w\u0000s\u0000 \u00002\u00000\u00000\u00000\u0000 \u00005\u0000.\u00000\u0000\u0000\u0000"} +{"timestamp":"2026-09-01T08:57:36","event_id":"bb04fa8e-6ada-44c8-910a-f0bb5b322711","source_ip":"144.172.99.200","source_port":51647,"source_domain":"200.99.172.144.static.cloudzy.com","country_code":"US","country_name":"United States","city_name":"Staten Island","asn_number":14956,"asn_org":"RouterHosting LLC","dest_port":445,"network_protocol":"","application_protocol":"","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":137,"dest_bytes":14,"network_bytes":151,"event_summary":"\u0000\u0000\u0000��SMBr\u0000\u0000\u0000\u0000\u0018S�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000��\u0000\u0000@\u0000\u0000b\u0000\u0002PC NETWORK PROGRAM 1.0\u0000\u0002LANMAN1.0\u0000\u0002Windows for Workgroups 3.1a\u0000\u0002LM1.2X002\u0000\u0002LANMAN2.1\u0000\u0002NT LM 0.12\u0000"} +{"timestamp":"2026-09-01T08:57:33","event_id":"af19a649-31dd-4d6a-8d0f-17aac046f0e5","source_ip":"144.172.99.200","source_port":50607,"source_domain":"200.99.172.144.static.cloudzy.com","country_code":"US","country_name":"United States","city_name":"Staten Island","asn_number":14956,"asn_org":"RouterHosting LLC","dest_port":445,"network_protocol":"","application_protocol":"smbv1","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":4,"event_duration":498000000,"source_bytes":364,"dest_bytes":56,"network_bytes":420,"event_summary":"\u0000\u0000\u0000J�SMB%\u0000\u0000\u0000\u0000\u0018\u0001(\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0010\u0000\u0000\u0000\u0000����\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000J\u0000\u0000\u0000J\u0000\u0002\u0000#\u0000\u0000\u0000\u0007\u0000\\PIPE\\\u0000"} +{"timestamp":"2026-09-01T08:57:33","event_id":"af19a649-31dd-4d6a-8d0f-17aac046f0e5","source_ip":"144.172.99.200","source_port":50607,"source_domain":"200.99.172.144.static.cloudzy.com","country_code":"US","country_name":"United States","city_name":"Staten Island","asn_number":14956,"asn_org":"RouterHosting LLC","dest_port":445,"network_protocol":"","application_protocol":"smbv1","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":3,"event_duration":366000000,"source_bytes":286,"dest_bytes":42,"network_bytes":328,"event_summary":"\u0000\u0000\u0000[�SMBu\u0000\u0000\u0000\u0000\u0018\u0001 \u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000/K\u0002��^\u0004�\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u001c\u0000\u0000\\\\144.172.99.25\\IPC$\u0000?????\u0000PATH_REPLACE__?????\u0000"} +{"timestamp":"2026-09-01T08:57:32","event_id":"af19a649-31dd-4d6a-8d0f-17aac046f0e5","source_ip":"144.172.99.200","source_port":50607,"source_domain":"200.99.172.144.static.cloudzy.com","country_code":"US","country_name":"United States","city_name":"Staten Island","asn_number":14956,"asn_org":"RouterHosting LLC","dest_port":445,"network_protocol":"","application_protocol":"smbv1","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":2,"event_duration":233000000,"source_bytes":191,"dest_bytes":28,"network_bytes":219,"event_summary":"\u0000\u0000\u0000c�SMBs\u0000\u0000\u0000\u0000\u0018\u0001 \u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000/K\u0000\u0000�^\r�\u0000\u0000\u0000��\u0002\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000@\u0000\u0000\u0000&\u0000\u0000.\u0000Windows 2000 2195\u0000Windows 2000 5.0\u0000"} +{"timestamp":"2026-09-01T08:57:32","event_id":"af19a649-31dd-4d6a-8d0f-17aac046f0e5","source_ip":"144.172.99.200","source_port":50607,"source_domain":"200.99.172.144.static.cloudzy.com","country_code":"US","country_name":"United States","city_name":"Staten Island","asn_number":14956,"asn_org":"RouterHosting LLC","dest_port":445,"network_protocol":"","application_protocol":"","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":101000000,"source_bytes":88,"dest_bytes":14,"network_bytes":102,"event_summary":"\u0000\u0000\u0000T�SMBr\u0000\u0000\u0000\u0000\u0018\u0001(\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000/K\u0000\u0000�^\u00001\u0000\u0002LANMAN1.0\u0000\u0002LM1.2X002\u0000\u0002NT LANMAN 1.0\u0000\u0002NT LM 0.12\u0000"} +{"timestamp":"2026-09-01T07:55:41","event_id":"93739a42-1fa4-4724-8837-fe1ecfa17156","source_ip":"144.172.99.200","source_port":62794,"source_domain":"200.99.172.144.static.cloudzy.com","country_code":"US","country_name":"United States","city_name":"Staten Island","asn_number":14956,"asn_org":"RouterHosting LLC","dest_port":445,"network_protocol":"","application_protocol":"smbv1","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":4,"event_duration":499000000,"source_bytes":455,"dest_bytes":56,"network_bytes":511,"event_summary":"\u0000\u0000\u0000N�SMB2\u0000\u0000\u0000\u0000\u0018\u0007�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000��\u0000\u0000A\u0000\u000f\f\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u00014�\u0000\u0000\u0000\f\u0000B\u0000\u0000\u0000N\u0000\u0001\u0000\u000e\u0000\r\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000"} +{"timestamp":"2026-09-01T07:55:41","event_id":"93739a42-1fa4-4724-8837-fe1ecfa17156","source_ip":"144.172.99.200","source_port":62794,"source_domain":"200.99.172.144.static.cloudzy.com","country_code":"US","country_name":"United States","city_name":"Staten Island","asn_number":14956,"asn_org":"RouterHosting LLC","dest_port":445,"network_protocol":"","application_protocol":"smbv1","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":3,"event_duration":366000000,"source_bytes":373,"dest_bytes":42,"network_bytes":415,"event_summary":"\u0000\u0000\u0000\\�SMBu\u0000\u0000\u0000\u0000\u0018\u0007�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000��\u0000\u0000@\u0000\u0004�\u0000\\\u0000\b\u0000\u0001\u00001\u0000\u0000\\\u0000\\\u00001\u00009\u00002\u0000.\u00001\u00006\u00008\u0000.\u00005\u00006\u0000.\u00002\u00000\u0000\\\u0000I\u0000P\u0000C\u0000$\u0000\u0000\u0000?????\u0000"} +{"timestamp":"2026-09-01T07:55:40","event_id":"93739a42-1fa4-4724-8837-fe1ecfa17156","source_ip":"144.172.99.200","source_port":62794,"source_domain":"200.99.172.144.static.cloudzy.com","country_code":"US","country_name":"United States","city_name":"Staten Island","asn_number":14956,"asn_org":"RouterHosting LLC","dest_port":445,"network_protocol":"","application_protocol":"smbv1","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":2,"event_duration":233000000,"source_bytes":277,"dest_bytes":28,"network_bytes":305,"event_summary":"\u0000\u0000\u0000��SMBs\u0000\u0000\u0000\u0000\u0018\u0007�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000��\u0000\u0000@\u0000\r�\u0000�\u0000\u0004\u0011\n\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000�\u0000\u0000\u0000K\u0000\u0000\u0000\u0000\u0000\u0000W\u0000i\u0000n\u0000d\u0000o\u0000w\u0000s\u0000 \u00002\u00000\u00000\u00000\u0000 \u00002\u00001\u00009\u00005\u0000\u0000\u0000W\u0000i\u0000n\u0000d\u0000o\u0000w\u0000s\u0000 \u00002\u00000\u00000\u00000\u0000 \u00005\u0000.\u00000\u0000\u0000\u0000"} +{"timestamp":"2026-09-01T07:55:40","event_id":"93739a42-1fa4-4724-8837-fe1ecfa17156","source_ip":"144.172.99.200","source_port":62794,"source_domain":"200.99.172.144.static.cloudzy.com","country_code":"US","country_name":"United States","city_name":"Staten Island","asn_number":14956,"asn_org":"RouterHosting LLC","dest_port":445,"network_protocol":"","application_protocol":"","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":137,"dest_bytes":14,"network_bytes":151,"event_summary":"\u0000\u0000\u0000��SMBr\u0000\u0000\u0000\u0000\u0018S�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000��\u0000\u0000@\u0000\u0000b\u0000\u0002PC NETWORK PROGRAM 1.0\u0000\u0002LANMAN1.0\u0000\u0002Windows for Workgroups 3.1a\u0000\u0002LM1.2X002\u0000\u0002LANMAN2.1\u0000\u0002NT LM 0.12\u0000"} +{"timestamp":"2026-09-01T07:55:37","event_id":"6d21ae31-0dcf-4993-b276-5e20d5838ede","source_ip":"144.172.99.200","source_port":61904,"source_domain":"200.99.172.144.static.cloudzy.com","country_code":"US","country_name":"United States","city_name":"Staten Island","asn_number":14956,"asn_org":"RouterHosting LLC","dest_port":445,"network_protocol":"","application_protocol":"smbv1","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":4,"event_duration":499000000,"source_bytes":364,"dest_bytes":56,"network_bytes":420,"event_summary":"\u0000\u0000\u0000J�SMB%\u0000\u0000\u0000\u0000\u0018\u0001(\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0010\u0000\u0000\u0000\u0000����\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000J\u0000\u0000\u0000J\u0000\u0002\u0000#\u0000\u0000\u0000\u0007\u0000\\PIPE\\\u0000"} +{"timestamp":"2026-09-01T07:55:37","event_id":"6d21ae31-0dcf-4993-b276-5e20d5838ede","source_ip":"144.172.99.200","source_port":61904,"source_domain":"200.99.172.144.static.cloudzy.com","country_code":"US","country_name":"United States","city_name":"Staten Island","asn_number":14956,"asn_org":"RouterHosting LLC","dest_port":445,"network_protocol":"","application_protocol":"smbv1","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":3,"event_duration":367000000,"source_bytes":286,"dest_bytes":42,"network_bytes":328,"event_summary":"\u0000\u0000\u0000[�SMBu\u0000\u0000\u0000\u0000\u0018\u0001 \u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000/K\u0002��^\u0004�\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u001c\u0000\u0000\\\\144.172.99.25\\IPC$\u0000?????\u0000PATH_REPLACE__?????\u0000"} +{"timestamp":"2026-09-01T07:55:37","event_id":"6d21ae31-0dcf-4993-b276-5e20d5838ede","source_ip":"144.172.99.200","source_port":61904,"source_domain":"200.99.172.144.static.cloudzy.com","country_code":"US","country_name":"United States","city_name":"Staten Island","asn_number":14956,"asn_org":"RouterHosting LLC","dest_port":445,"network_protocol":"","application_protocol":"smbv1","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":2,"event_duration":234000000,"source_bytes":191,"dest_bytes":28,"network_bytes":219,"event_summary":"\u0000\u0000\u0000c�SMBs\u0000\u0000\u0000\u0000\u0018\u0001 \u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000/K\u0000\u0000�^\r�\u0000\u0000\u0000��\u0002\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000@\u0000\u0000\u0000&\u0000\u0000.\u0000Windows 2000 2195\u0000Windows 2000 5.0\u0000"} +{"timestamp":"2026-09-01T07:55:37","event_id":"6d21ae31-0dcf-4993-b276-5e20d5838ede","source_ip":"144.172.99.200","source_port":61904,"source_domain":"200.99.172.144.static.cloudzy.com","country_code":"US","country_name":"United States","city_name":"Staten Island","asn_number":14956,"asn_org":"RouterHosting LLC","dest_port":445,"network_protocol":"","application_protocol":"","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":101000000,"source_bytes":88,"dest_bytes":14,"network_bytes":102,"event_summary":"\u0000\u0000\u0000T�SMBr\u0000\u0000\u0000\u0000\u0018\u0001(\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000/K\u0000\u0000�^\u00001\u0000\u0002LANMAN1.0\u0000\u0002LM1.2X002\u0000\u0002NT LANMAN 1.0\u0000\u0002NT LM 0.12\u0000"} \ No newline at end of file diff --git a/kevlar/2026-09-07/honeylabs/events-AS198953.ndjson b/kevlar/2026-09-07/honeylabs/events-AS198953.ndjson new file mode 100644 index 0000000..4e32815 --- /dev/null +++ b/kevlar/2026-09-07/honeylabs/events-AS198953.ndjson @@ -0,0 +1,100 @@ +{"timestamp":"2026-09-06T14:40:21","event_id":"c6b4f133-cacf-48b8-a3ed-dd85ed1463f2","source_ip":"176.120.22.240","source_port":17914,"source_domain":"","country_code":"RU","country_name":"Russia","city_name":"","asn_number":198953,"asn_org":"Proton66 OOO","dest_port":4443,"network_protocol":"tls","application_protocol":"http","http_method":"GET","user_agent":"","url_path":"/remote/login?lang=en","url_domain":"","http_request_headers":"{\"accept-encoding\":\"gzip\",\"host\":\":4443\"}","ssh_client_hassh":"","tls_client_ja4":"t12i210600_76e208dd3e22_f28add8e7af0","tls_client_ja3":"c12f54a3f91dc7bafd92cb59fe009a35","tls_client_version":"TLSv1.2","tls_client_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","http_request_ja4h":"ge11nn0200_549fad093d6b","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":2,"event_duration":1582000000,"source_bytes":198,"dest_bytes":158,"network_bytes":356,"event_summary":""} +{"timestamp":"2026-09-06T14:40:19","event_id":"c6b4f133-cacf-48b8-a3ed-dd85ed1463f2","source_ip":"176.120.22.240","source_port":17914,"source_domain":"","country_code":"RU","country_name":"Russia","city_name":"","asn_number":198953,"asn_org":"Proton66 OOO","dest_port":4443,"network_protocol":"tls","application_protocol":"http","http_method":"GET","user_agent":"","url_path":"/remote/login?lang=en","url_domain":"","http_request_headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"Keep-Alive\",\"host\":\":4443\"}","ssh_client_hassh":"","tls_client_ja4":"t12i210600_76e208dd3e22_f28add8e7af0","tls_client_ja3":"c12f54a3f91dc7bafd92cb59fe009a35","tls_client_version":"TLSv1.2","tls_client_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","http_request_ja4h":"ge11nn0300_80168362a4ec","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":165000000,"source_bytes":111,"dest_bytes":79,"network_bytes":190,"event_summary":""} +{"timestamp":"2026-09-06T13:42:24","event_id":"8df6bcd3-93dc-4308-a50f-e49130ee0c56","source_ip":"176.120.22.240","source_port":43708,"source_domain":"","country_code":"RU","country_name":"Russia","city_name":"","asn_number":198953,"asn_org":"Proton66 OOO","dest_port":4443,"network_protocol":"tls","application_protocol":"http","http_method":"GET","user_agent":"","url_path":"/remote/login?lang=en","url_domain":"","http_request_headers":"{\"accept-encoding\":\"gzip\",\"host\":\":4443\"}","ssh_client_hassh":"","tls_client_ja4":"t12i210600_76e208dd3e22_f28add8e7af0","tls_client_ja3":"c12f54a3f91dc7bafd92cb59fe009a35","tls_client_version":"TLSv1.2","tls_client_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","http_request_ja4h":"ge11nn0200_549fad093d6b","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":2,"event_duration":3573000000,"source_bytes":196,"dest_bytes":158,"network_bytes":354,"event_summary":""} +{"timestamp":"2026-09-06T13:42:21","event_id":"8df6bcd3-93dc-4308-a50f-e49130ee0c56","source_ip":"176.120.22.240","source_port":43708,"source_domain":"","country_code":"RU","country_name":"Russia","city_name":"","asn_number":198953,"asn_org":"Proton66 OOO","dest_port":4443,"network_protocol":"tls","application_protocol":"http","http_method":"GET","user_agent":"","url_path":"/remote/login?lang=en","url_domain":"","http_request_headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"Keep-Alive\",\"host\":\":4443\"}","ssh_client_hassh":"","tls_client_ja4":"t12i210600_76e208dd3e22_f28add8e7af0","tls_client_ja3":"c12f54a3f91dc7bafd92cb59fe009a35","tls_client_version":"TLSv1.2","tls_client_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","http_request_ja4h":"ge11nn0300_80168362a4ec","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":750000000,"source_bytes":110,"dest_bytes":79,"network_bytes":189,"event_summary":""} +{"timestamp":"2026-09-06T13:42:21","event_id":"f7973a55-d5f8-443f-a644-22e7cfa408f3","source_ip":"176.120.22.240","source_port":43778,"source_domain":"","country_code":"RU","country_name":"Russia","city_name":"","asn_number":198953,"asn_org":"Proton66 OOO","dest_port":4443,"network_protocol":"tls","application_protocol":"http","http_method":"GET","user_agent":"","url_path":"/remote/login?lang=en","url_domain":"","http_request_headers":"{\"accept-encoding\":\"gzip\",\"host\":\":4443\"}","ssh_client_hassh":"","tls_client_ja4":"t12i210600_76e208dd3e22_f28add8e7af0","tls_client_ja3":"c12f54a3f91dc7bafd92cb59fe009a35","tls_client_version":"TLSv1.2","tls_client_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","http_request_ja4h":"ge11nn0200_549fad093d6b","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":2,"event_duration":1108000000,"source_bytes":196,"dest_bytes":158,"network_bytes":354,"event_summary":""} +{"timestamp":"2026-09-06T13:42:21","event_id":"f7973a55-d5f8-443f-a644-22e7cfa408f3","source_ip":"176.120.22.240","source_port":43778,"source_domain":"","country_code":"RU","country_name":"Russia","city_name":"","asn_number":198953,"asn_org":"Proton66 OOO","dest_port":4443,"network_protocol":"tls","application_protocol":"http","http_method":"GET","user_agent":"","url_path":"/remote/login?lang=en","url_domain":"","http_request_headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"Keep-Alive\",\"host\":\":4443\"}","ssh_client_hassh":"","tls_client_ja4":"t12i210600_76e208dd3e22_f28add8e7af0","tls_client_ja3":"c12f54a3f91dc7bafd92cb59fe009a35","tls_client_version":"TLSv1.2","tls_client_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","http_request_ja4h":"ge11nn0300_80168362a4ec","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":608000000,"source_bytes":110,"dest_bytes":79,"network_bytes":189,"event_summary":""} +{"timestamp":"2026-09-06T12:52:46","event_id":"515790ec-c5a5-4431-bb51-83c808dde8e5","source_ip":"176.120.22.240","source_port":27076,"source_domain":"","country_code":"RU","country_name":"Russia","city_name":"","asn_number":198953,"asn_org":"Proton66 OOO","dest_port":4443,"network_protocol":"tls","application_protocol":"http","http_method":"GET","user_agent":"","url_path":"/remote/login?lang=en","url_domain":"","http_request_headers":"{\"accept-encoding\":\"gzip\",\"host\":\":4443\"}","ssh_client_hassh":"","tls_client_ja4":"t12i210600_76e208dd3e22_f28add8e7af0","tls_client_ja3":"c12f54a3f91dc7bafd92cb59fe009a35","tls_client_version":"TLSv1.2","tls_client_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","http_request_ja4h":"ge11nn0200_549fad093d6b","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":2,"event_duration":1013000000,"source_bytes":200,"dest_bytes":158,"network_bytes":358,"event_summary":""} +{"timestamp":"2026-09-06T12:52:46","event_id":"515790ec-c5a5-4431-bb51-83c808dde8e5","source_ip":"176.120.22.240","source_port":27076,"source_domain":"","country_code":"RU","country_name":"Russia","city_name":"","asn_number":198953,"asn_org":"Proton66 OOO","dest_port":4443,"network_protocol":"tls","application_protocol":"http","http_method":"GET","user_agent":"","url_path":"/remote/login?lang=en","url_domain":"","http_request_headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"Keep-Alive\",\"host\":\":4443\"}","ssh_client_hassh":"","tls_client_ja4":"t12i210600_76e208dd3e22_f28add8e7af0","tls_client_ja3":"c12f54a3f91dc7bafd92cb59fe009a35","tls_client_version":"TLSv1.2","tls_client_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","http_request_ja4h":"ge11nn0300_80168362a4ec","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":640000000,"source_bytes":112,"dest_bytes":79,"network_bytes":191,"event_summary":""} +{"timestamp":"2026-09-04T23:21:09","event_id":"2efbcd64-1acc-417d-90e5-5f308cb5761d","source_ip":"176.120.22.240","source_port":15501,"source_domain":"","country_code":"RU","country_name":"Russia","city_name":"","asn_number":198953,"asn_org":"Proton66 OOO","dest_port":10443,"network_protocol":"tls","application_protocol":"http","http_method":"GET","user_agent":"","url_path":"/remote/login?lang=en","url_domain":"","http_request_headers":"{\"accept-encoding\":\"gzip\",\"host\":\":10443\"}","ssh_client_hassh":"","tls_client_ja4":"t12i210600_76e208dd3e22_f28add8e7af0","tls_client_ja3":"c12f54a3f91dc7bafd92cb59fe009a35","tls_client_version":"TLSv1.2","tls_client_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","http_request_ja4h":"ge11nn0200_549fad093d6b","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":172000000,"source_bytes":88,"dest_bytes":79,"network_bytes":167,"event_summary":""} +{"timestamp":"2026-09-04T23:21:09","event_id":"3ee16f48-c66d-4efe-991b-38a8c2a5b284","source_ip":"176.120.22.240","source_port":6995,"source_domain":"","country_code":"RU","country_name":"Russia","city_name":"","asn_number":198953,"asn_org":"Proton66 OOO","dest_port":4443,"network_protocol":"tls","application_protocol":"http","http_method":"GET","user_agent":"","url_path":"/remote/login?lang=en","url_domain":"","http_request_headers":"{\"accept-encoding\":\"gzip\",\"host\":\":4443\"}","ssh_client_hassh":"","tls_client_ja4":"t12i210600_76e208dd3e22_f28add8e7af0","tls_client_ja3":"c12f54a3f91dc7bafd92cb59fe009a35","tls_client_version":"TLSv1.2","tls_client_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","http_request_ja4h":"ge11nn0200_549fad093d6b","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":181000000,"source_bytes":87,"dest_bytes":79,"network_bytes":166,"event_summary":""} +{"timestamp":"2026-09-04T23:21:09","event_id":"e6bf592d-f101-412d-b0ac-52c1e44f54f9","source_ip":"176.120.22.240","source_port":35419,"source_domain":"","country_code":"RU","country_name":"Russia","city_name":"","asn_number":198953,"asn_org":"Proton66 OOO","dest_port":8443,"network_protocol":"tls","application_protocol":"http","http_method":"GET","user_agent":"","url_path":"/remote/login?lang=en","url_domain":"","http_request_headers":"{\"accept-encoding\":\"gzip\",\"host\":\":8443\"}","ssh_client_hassh":"","tls_client_ja4":"t12i210600_76e208dd3e22_f28add8e7af0","tls_client_ja3":"c12f54a3f91dc7bafd92cb59fe009a35","tls_client_version":"TLSv1.2","tls_client_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","http_request_ja4h":"ge11nn0200_549fad093d6b","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":179000000,"source_bytes":87,"dest_bytes":79,"network_bytes":166,"event_summary":""} +{"timestamp":"2026-09-04T23:19:57","event_id":"6261eeb4-451f-49a6-8585-a2e7c01410e2","source_ip":"176.120.22.240","source_port":6074,"source_domain":"","country_code":"RU","country_name":"Russia","city_name":"","asn_number":198953,"asn_org":"Proton66 OOO","dest_port":10443,"network_protocol":"tls","application_protocol":"http","http_method":"GET","user_agent":"","url_path":"/remote/login?lang=en","url_domain":"","http_request_headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"Keep-Alive\",\"host\":\":10443\"}","ssh_client_hassh":"","tls_client_ja4":"t12i210600_76e208dd3e22_f28add8e7af0","tls_client_ja3":"c12f54a3f91dc7bafd92cb59fe009a35","tls_client_version":"TLSv1.2","tls_client_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","http_request_ja4h":"ge11nn0300_80168362a4ec","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":18663000000,"source_bytes":112,"dest_bytes":79,"network_bytes":191,"event_summary":""} +{"timestamp":"2026-09-04T23:19:57","event_id":"209ef126-d18b-4619-9602-2635a29990d6","source_ip":"176.120.22.240","source_port":6062,"source_domain":"","country_code":"RU","country_name":"Russia","city_name":"","asn_number":198953,"asn_org":"Proton66 OOO","dest_port":4443,"network_protocol":"tls","application_protocol":"http","http_method":"GET","user_agent":"","url_path":"/remote/login?lang=en","url_domain":"","http_request_headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"Keep-Alive\",\"host\":\":4443\"}","ssh_client_hassh":"","tls_client_ja4":"t12i210600_76e208dd3e22_f28add8e7af0","tls_client_ja3":"c12f54a3f91dc7bafd92cb59fe009a35","tls_client_version":"TLSv1.2","tls_client_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","http_request_ja4h":"ge11nn0300_80168362a4ec","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":18715000000,"source_bytes":111,"dest_bytes":79,"network_bytes":190,"event_summary":""} +{"timestamp":"2026-09-04T23:19:57","event_id":"b2fe911a-58a4-4c9f-9f8b-e52f22a00378","source_ip":"176.120.22.240","source_port":63317,"source_domain":"","country_code":"RU","country_name":"Russia","city_name":"","asn_number":198953,"asn_org":"Proton66 OOO","dest_port":8443,"network_protocol":"tls","application_protocol":"http","http_method":"GET","user_agent":"","url_path":"/remote/login?lang=en","url_domain":"","http_request_headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"Keep-Alive\",\"host\":\":8443\"}","ssh_client_hassh":"","tls_client_ja4":"t12i210600_76e208dd3e22_f28add8e7af0","tls_client_ja3":"c12f54a3f91dc7bafd92cb59fe009a35","tls_client_version":"TLSv1.2","tls_client_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","http_request_ja4h":"ge11nn0300_80168362a4ec","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":19767000000,"source_bytes":111,"dest_bytes":79,"network_bytes":190,"event_summary":""} +{"timestamp":"2026-09-04T21:27:35","event_id":"3d51b233-b72a-4e3d-9374-22f7b72a698f","source_ip":"193.143.1.66","source_port":13521,"source_domain":"","country_code":"RU","country_name":"Russia","city_name":"Moscow","asn_number":198953,"asn_org":"Proton66 OOO","dest_port":33894,"network_protocol":"","application_protocol":"rdp","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":44,"dest_bytes":12,"network_bytes":56,"event_summary":"\u0003\u0000\u0000,'�\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Domain\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000"} +{"timestamp":"2026-09-04T21:27:34","event_id":"02cd9693-c407-470a-8c96-b06ee169f0b3","source_ip":"193.143.1.66","source_port":13197,"source_domain":"","country_code":"RU","country_name":"Russia","city_name":"Moscow","asn_number":198953,"asn_org":"Proton66 OOO","dest_port":33894,"network_protocol":"","application_protocol":"rdp","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":44,"dest_bytes":12,"network_bytes":56,"event_summary":"\u0003\u0000\u0000,'�\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Domain\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000"} +{"timestamp":"2026-09-04T21:27:34","event_id":"5f5ce89b-5827-4158-bd0a-09255f73689f","source_ip":"193.143.1.66","source_port":12902,"source_domain":"","country_code":"RU","country_name":"Russia","city_name":"Moscow","asn_number":198953,"asn_org":"Proton66 OOO","dest_port":33894,"network_protocol":"","application_protocol":"rdp","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":44,"dest_bytes":12,"network_bytes":56,"event_summary":"\u0003\u0000\u0000,'�\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Domain\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000"} +{"timestamp":"2026-09-04T20:33:55","event_id":"0b8506bb-db78-4f84-ba0a-a6bd071ff84f","source_ip":"193.143.1.66","source_port":56343,"source_domain":"","country_code":"RU","country_name":"Russia","city_name":"Moscow","asn_number":198953,"asn_org":"Proton66 OOO","dest_port":3389,"network_protocol":"","application_protocol":"rdp","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":44,"dest_bytes":12,"network_bytes":56,"event_summary":"\u0003\u0000\u0000,'�\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Domain\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000"} +{"timestamp":"2026-09-04T20:33:55","event_id":"d3b97721-5efa-4457-999c-a156974d0b58","source_ip":"193.143.1.66","source_port":55780,"source_domain":"","country_code":"RU","country_name":"Russia","city_name":"Moscow","asn_number":198953,"asn_org":"Proton66 OOO","dest_port":3389,"network_protocol":"","application_protocol":"rdp","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":44,"dest_bytes":12,"network_bytes":56,"event_summary":"\u0003\u0000\u0000,'�\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Domain\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000"} +{"timestamp":"2026-09-04T20:33:55","event_id":"6f9e066e-5ff1-4447-a687-c3a1057484f1","source_ip":"193.143.1.66","source_port":55298,"source_domain":"","country_code":"RU","country_name":"Russia","city_name":"Moscow","asn_number":198953,"asn_org":"Proton66 OOO","dest_port":3389,"network_protocol":"","application_protocol":"rdp","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":44,"dest_bytes":12,"network_bytes":56,"event_summary":"\u0003\u0000\u0000,'�\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Domain\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000"} +{"timestamp":"2026-09-04T15:44:29","event_id":"78cbc648-75e1-4221-b03c-fa76c30a7012","source_ip":"176.120.22.240","source_port":27106,"source_domain":"","country_code":"RU","country_name":"Russia","city_name":"","asn_number":198953,"asn_org":"Proton66 OOO","dest_port":8443,"network_protocol":"tls","application_protocol":"http","http_method":"GET","user_agent":"","url_path":"/remote/login?lang=en","url_domain":"","http_request_headers":"{\"accept-encoding\":\"gzip\",\"host\":\":8443\"}","ssh_client_hassh":"","tls_client_ja4":"t12i210600_76e208dd3e22_f28add8e7af0","tls_client_ja3":"c12f54a3f91dc7bafd92cb59fe009a35","tls_client_version":"TLSv1.2","tls_client_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","http_request_ja4h":"ge11nn0200_549fad093d6b","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":2,"event_duration":13905000000,"source_bytes":196,"dest_bytes":158,"network_bytes":354,"event_summary":""} +{"timestamp":"2026-09-04T15:44:29","event_id":"19e11de3-0718-4b96-8006-f3b54582be18","source_ip":"176.120.22.240","source_port":27135,"source_domain":"","country_code":"RU","country_name":"Russia","city_name":"","asn_number":198953,"asn_org":"Proton66 OOO","dest_port":8443,"network_protocol":"tls","application_protocol":"http","http_method":"GET","user_agent":"","url_path":"/remote/login?lang=en","url_domain":"","http_request_headers":"{\"accept-encoding\":\"gzip\",\"host\":\":8443\"}","ssh_client_hassh":"","tls_client_ja4":"t12i210600_76e208dd3e22_f28add8e7af0","tls_client_ja3":"c12f54a3f91dc7bafd92cb59fe009a35","tls_client_version":"TLSv1.2","tls_client_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","http_request_ja4h":"ge11nn0200_549fad093d6b","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":2,"event_duration":14281000000,"source_bytes":196,"dest_bytes":158,"network_bytes":354,"event_summary":""} +{"timestamp":"2026-09-04T15:44:15","event_id":"78cbc648-75e1-4221-b03c-fa76c30a7012","source_ip":"176.120.22.240","source_port":27106,"source_domain":"","country_code":"RU","country_name":"Russia","city_name":"","asn_number":198953,"asn_org":"Proton66 OOO","dest_port":8443,"network_protocol":"tls","application_protocol":"http","http_method":"GET","user_agent":"","url_path":"/remote/login?lang=en","url_domain":"","http_request_headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"Keep-Alive\",\"host\":\":8443\"}","ssh_client_hassh":"","tls_client_ja4":"t12i210600_76e208dd3e22_f28add8e7af0","tls_client_ja3":"c12f54a3f91dc7bafd92cb59fe009a35","tls_client_version":"TLSv1.2","tls_client_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","http_request_ja4h":"ge11nn0300_80168362a4ec","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":562000000,"source_bytes":110,"dest_bytes":79,"network_bytes":189,"event_summary":""} +{"timestamp":"2026-09-04T15:44:15","event_id":"19e11de3-0718-4b96-8006-f3b54582be18","source_ip":"176.120.22.240","source_port":27135,"source_domain":"","country_code":"RU","country_name":"Russia","city_name":"","asn_number":198953,"asn_org":"Proton66 OOO","dest_port":8443,"network_protocol":"tls","application_protocol":"http","http_method":"GET","user_agent":"","url_path":"/remote/login?lang=en","url_domain":"","http_request_headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"Keep-Alive\",\"host\":\":8443\"}","ssh_client_hassh":"","tls_client_ja4":"t12i210600_76e208dd3e22_f28add8e7af0","tls_client_ja3":"c12f54a3f91dc7bafd92cb59fe009a35","tls_client_version":"TLSv1.2","tls_client_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","http_request_ja4h":"ge11nn0300_80168362a4ec","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":602000000,"source_bytes":110,"dest_bytes":79,"network_bytes":189,"event_summary":""} +{"timestamp":"2026-09-04T15:30:28","event_id":"3ff413eb-9ed9-47a0-a1fa-a4ae8bd38d83","source_ip":"176.120.22.240","source_port":41882,"source_domain":"","country_code":"RU","country_name":"Russia","city_name":"","asn_number":198953,"asn_org":"Proton66 OOO","dest_port":4443,"network_protocol":"tls","application_protocol":"http","http_method":"GET","user_agent":"","url_path":"/remote/login?lang=en","url_domain":"","http_request_headers":"{\"accept-encoding\":\"gzip\",\"host\":\":4443\"}","ssh_client_hassh":"","tls_client_ja4":"t12i210600_76e208dd3e22_f28add8e7af0","tls_client_ja3":"c12f54a3f91dc7bafd92cb59fe009a35","tls_client_version":"TLSv1.2","tls_client_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","http_request_ja4h":"ge11nn0200_549fad093d6b","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":2,"event_duration":17602000000,"source_bytes":200,"dest_bytes":158,"network_bytes":358,"event_summary":""} +{"timestamp":"2026-09-04T15:30:28","event_id":"7073c07c-b02f-48b3-8099-23c8cb6e379d","source_ip":"176.120.22.240","source_port":41853,"source_domain":"","country_code":"RU","country_name":"Russia","city_name":"","asn_number":198953,"asn_org":"Proton66 OOO","dest_port":8443,"network_protocol":"tls","application_protocol":"http","http_method":"GET","user_agent":"","url_path":"/remote/login?lang=en","url_domain":"","http_request_headers":"{\"accept-encoding\":\"gzip\",\"host\":\":8443\"}","ssh_client_hassh":"","tls_client_ja4":"t12i210600_76e208dd3e22_f28add8e7af0","tls_client_ja3":"c12f54a3f91dc7bafd92cb59fe009a35","tls_client_version":"TLSv1.2","tls_client_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","http_request_ja4h":"ge11nn0200_549fad093d6b","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":2,"event_duration":17598000000,"source_bytes":200,"dest_bytes":158,"network_bytes":358,"event_summary":""} +{"timestamp":"2026-09-04T15:30:16","event_id":"3ff413eb-9ed9-47a0-a1fa-a4ae8bd38d83","source_ip":"176.120.22.240","source_port":41882,"source_domain":"","country_code":"RU","country_name":"Russia","city_name":"","asn_number":198953,"asn_org":"Proton66 OOO","dest_port":4443,"network_protocol":"tls","application_protocol":"http","http_method":"GET","user_agent":"","url_path":"/remote/login?lang=en","url_domain":"","http_request_headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"Keep-Alive\",\"host\":\":4443\"}","ssh_client_hassh":"","tls_client_ja4":"t12i210600_76e208dd3e22_f28add8e7af0","tls_client_ja3":"c12f54a3f91dc7bafd92cb59fe009a35","tls_client_version":"TLSv1.2","tls_client_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","http_request_ja4h":"ge11nn0300_80168362a4ec","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":6383000000,"source_bytes":112,"dest_bytes":79,"network_bytes":191,"event_summary":""} +{"timestamp":"2026-09-04T15:30:16","event_id":"7073c07c-b02f-48b3-8099-23c8cb6e379d","source_ip":"176.120.22.240","source_port":41853,"source_domain":"","country_code":"RU","country_name":"Russia","city_name":"","asn_number":198953,"asn_org":"Proton66 OOO","dest_port":8443,"network_protocol":"tls","application_protocol":"http","http_method":"GET","user_agent":"","url_path":"/remote/login?lang=en","url_domain":"","http_request_headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"Keep-Alive\",\"host\":\":8443\"}","ssh_client_hassh":"","tls_client_ja4":"t12i210600_76e208dd3e22_f28add8e7af0","tls_client_ja3":"c12f54a3f91dc7bafd92cb59fe009a35","tls_client_version":"TLSv1.2","tls_client_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","http_request_ja4h":"ge11nn0300_80168362a4ec","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":6304000000,"source_bytes":112,"dest_bytes":79,"network_bytes":191,"event_summary":""} +{"timestamp":"2026-09-04T13:58:36","event_id":"316dbfe6-366f-4b78-bd09-72b3b411d78f","source_ip":"176.120.22.240","source_port":62250,"source_domain":"","country_code":"RU","country_name":"Russia","city_name":"","asn_number":198953,"asn_org":"Proton66 OOO","dest_port":4443,"network_protocol":"tls","application_protocol":"http","http_method":"GET","user_agent":"","url_path":"/remote/login?lang=en","url_domain":"","http_request_headers":"{\"accept-encoding\":\"gzip\",\"host\":\":4443\"}","ssh_client_hassh":"","tls_client_ja4":"t12i210600_76e208dd3e22_f28add8e7af0","tls_client_ja3":"c12f54a3f91dc7bafd92cb59fe009a35","tls_client_version":"TLSv1.2","tls_client_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","http_request_ja4h":"ge11nn0200_549fad093d6b","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":2,"event_duration":7323000000,"source_bytes":198,"dest_bytes":158,"network_bytes":356,"event_summary":""} +{"timestamp":"2026-09-04T13:58:30","event_id":"316dbfe6-366f-4b78-bd09-72b3b411d78f","source_ip":"176.120.22.240","source_port":62250,"source_domain":"","country_code":"RU","country_name":"Russia","city_name":"","asn_number":198953,"asn_org":"Proton66 OOO","dest_port":4443,"network_protocol":"tls","application_protocol":"http","http_method":"GET","user_agent":"","url_path":"/remote/login?lang=en","url_domain":"","http_request_headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"Keep-Alive\",\"host\":\":4443\"}","ssh_client_hassh":"","tls_client_ja4":"t12i210600_76e208dd3e22_f28add8e7af0","tls_client_ja3":"c12f54a3f91dc7bafd92cb59fe009a35","tls_client_version":"TLSv1.2","tls_client_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","http_request_ja4h":"ge11nn0300_80168362a4ec","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":1116000000,"source_bytes":111,"dest_bytes":79,"network_bytes":190,"event_summary":""} +{"timestamp":"2026-09-04T12:25:21","event_id":"98aeb392-8479-47ea-8f51-d29b0c51188d","source_ip":"176.120.22.240","source_port":9818,"source_domain":"","country_code":"RU","country_name":"Russia","city_name":"","asn_number":198953,"asn_org":"Proton66 OOO","dest_port":4443,"network_protocol":"tls","application_protocol":"http","http_method":"GET","user_agent":"","url_path":"/remote/login?lang=en","url_domain":"","http_request_headers":"{\"accept-encoding\":\"gzip\",\"host\":\":4443\"}","ssh_client_hassh":"","tls_client_ja4":"t12i210600_76e208dd3e22_f28add8e7af0","tls_client_ja3":"c12f54a3f91dc7bafd92cb59fe009a35","tls_client_version":"TLSv1.2","tls_client_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","http_request_ja4h":"ge11nn0200_549fad093d6b","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":2,"event_duration":985000000,"source_bytes":196,"dest_bytes":158,"network_bytes":354,"event_summary":""} +{"timestamp":"2026-09-04T12:25:21","event_id":"dab757f4-21a9-4941-b2b9-e52e9232f922","source_ip":"176.120.22.240","source_port":9815,"source_domain":"","country_code":"RU","country_name":"Russia","city_name":"","asn_number":198953,"asn_org":"Proton66 OOO","dest_port":4443,"network_protocol":"tls","application_protocol":"http","http_method":"GET","user_agent":"","url_path":"/remote/login?lang=en","url_domain":"","http_request_headers":"{\"accept-encoding\":\"gzip\",\"host\":\":4443\"}","ssh_client_hassh":"","tls_client_ja4":"t12i210600_76e208dd3e22_f28add8e7af0","tls_client_ja3":"c12f54a3f91dc7bafd92cb59fe009a35","tls_client_version":"TLSv1.2","tls_client_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","http_request_ja4h":"ge11nn0200_549fad093d6b","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":2,"event_duration":1194000000,"source_bytes":196,"dest_bytes":158,"network_bytes":354,"event_summary":""} +{"timestamp":"2026-09-04T12:25:20","event_id":"98aeb392-8479-47ea-8f51-d29b0c51188d","source_ip":"176.120.22.240","source_port":9818,"source_domain":"","country_code":"RU","country_name":"Russia","city_name":"","asn_number":198953,"asn_org":"Proton66 OOO","dest_port":4443,"network_protocol":"tls","application_protocol":"http","http_method":"GET","user_agent":"","url_path":"/remote/login?lang=en","url_domain":"","http_request_headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"Keep-Alive\",\"host\":\":4443\"}","ssh_client_hassh":"","tls_client_ja4":"t12i210600_76e208dd3e22_f28add8e7af0","tls_client_ja3":"c12f54a3f91dc7bafd92cb59fe009a35","tls_client_version":"TLSv1.2","tls_client_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","http_request_ja4h":"ge11nn0300_80168362a4ec","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":582000000,"source_bytes":110,"dest_bytes":79,"network_bytes":189,"event_summary":""} +{"timestamp":"2026-09-04T12:25:20","event_id":"dab757f4-21a9-4941-b2b9-e52e9232f922","source_ip":"176.120.22.240","source_port":9815,"source_domain":"","country_code":"RU","country_name":"Russia","city_name":"","asn_number":198953,"asn_org":"Proton66 OOO","dest_port":4443,"network_protocol":"tls","application_protocol":"http","http_method":"GET","user_agent":"","url_path":"/remote/login?lang=en","url_domain":"","http_request_headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"Keep-Alive\",\"host\":\":4443\"}","ssh_client_hassh":"","tls_client_ja4":"t12i210600_76e208dd3e22_f28add8e7af0","tls_client_ja3":"c12f54a3f91dc7bafd92cb59fe009a35","tls_client_version":"TLSv1.2","tls_client_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","http_request_ja4h":"ge11nn0300_80168362a4ec","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":729000000,"source_bytes":110,"dest_bytes":79,"network_bytes":189,"event_summary":""} +{"timestamp":"2026-09-04T11:31:53","event_id":"8d98cfbf-f75d-4faa-a0d4-0722f2749080","source_ip":"176.120.22.240","source_port":12439,"source_domain":"","country_code":"RU","country_name":"Russia","city_name":"","asn_number":198953,"asn_org":"Proton66 OOO","dest_port":4443,"network_protocol":"tls","application_protocol":"http","http_method":"GET","user_agent":"","url_path":"/remote/login?lang=en","url_domain":"","http_request_headers":"{\"accept-encoding\":\"gzip\",\"host\":\":4443\"}","ssh_client_hassh":"","tls_client_ja4":"t12i210600_76e208dd3e22_f28add8e7af0","tls_client_ja3":"c12f54a3f91dc7bafd92cb59fe009a35","tls_client_version":"TLSv1.2","tls_client_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","http_request_ja4h":"ge11nn0200_549fad093d6b","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":2,"event_duration":1483000000,"source_bytes":200,"dest_bytes":158,"network_bytes":358,"event_summary":""} +{"timestamp":"2026-09-04T11:31:53","event_id":"8d98cfbf-f75d-4faa-a0d4-0722f2749080","source_ip":"176.120.22.240","source_port":12439,"source_domain":"","country_code":"RU","country_name":"Russia","city_name":"","asn_number":198953,"asn_org":"Proton66 OOO","dest_port":4443,"network_protocol":"tls","application_protocol":"http","http_method":"GET","user_agent":"","url_path":"/remote/login?lang=en","url_domain":"","http_request_headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"Keep-Alive\",\"host\":\":4443\"}","ssh_client_hassh":"","tls_client_ja4":"t12i210600_76e208dd3e22_f28add8e7af0","tls_client_ja3":"c12f54a3f91dc7bafd92cb59fe009a35","tls_client_version":"TLSv1.2","tls_client_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","http_request_ja4h":"ge11nn0300_80168362a4ec","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":1160000000,"source_bytes":112,"dest_bytes":79,"network_bytes":191,"event_summary":""} +{"timestamp":"2026-09-04T10:20:48","event_id":"a8427ab9-3afa-43f6-b66d-38f3ba237750","source_ip":"176.120.22.61","source_port":12948,"source_domain":"","country_code":"RU","country_name":"Russia","city_name":"","asn_number":198953,"asn_org":"Proton66 OOO","dest_port":1800,"network_protocol":"","application_protocol":"mssql-tds","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":26,"dest_bytes":13,"network_bytes":39,"event_summary":"\u0012\u0001\u0000\u001a\u0000\u0000\u0001\u0000\u0000\u0000\u000b\u0000\u0006\u0001\u0000\u0011\u0000\u0001�\u000f\u0000\u0007�\u0000\u0000\u0002"} +{"timestamp":"2026-09-04T10:20:48","event_id":"a2830b10-93e6-46b3-b472-781538ff3a6d","source_ip":"176.120.22.61","source_port":12708,"source_domain":"","country_code":"RU","country_name":"Russia","city_name":"","asn_number":198953,"asn_org":"Proton66 OOO","dest_port":3000,"network_protocol":"","application_protocol":"mssql-tds","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":26,"dest_bytes":13,"network_bytes":39,"event_summary":"\u0012\u0001\u0000\u001a\u0000\u0000\u0001\u0000\u0000\u0000\u000b\u0000\u0006\u0001\u0000\u0011\u0000\u0001�\u000f\u0000\u0007�\u0000\u0000\u0002"} +{"timestamp":"2026-09-04T10:20:48","event_id":"73a246f9-3d46-46e9-8a75-c9fa2a5e5bd5","source_ip":"176.120.22.61","source_port":11952,"source_domain":"","country_code":"RU","country_name":"Russia","city_name":"","asn_number":198953,"asn_org":"Proton66 OOO","dest_port":4433,"network_protocol":"","application_protocol":"mssql-tds","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":104000000,"source_bytes":26,"dest_bytes":13,"network_bytes":39,"event_summary":"\u0012\u0001\u0000\u001a\u0000\u0000\u0001\u0000\u0000\u0000\u000b\u0000\u0006\u0001\u0000\u0011\u0000\u0001�\u000f\u0000\u0007�\u0000\u0000\u0002"} +{"timestamp":"2026-09-04T10:20:48","event_id":"f13b11b1-a9da-4a61-8a1f-f1743ef4e8c9","source_ip":"176.120.22.61","source_port":11865,"source_domain":"","country_code":"RU","country_name":"Russia","city_name":"","asn_number":198953,"asn_org":"Proton66 OOO","dest_port":1440,"network_protocol":"","application_protocol":"mssql-tds","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":26,"dest_bytes":13,"network_bytes":39,"event_summary":"\u0012\u0001\u0000\u001a\u0000\u0000\u0001\u0000\u0000\u0000\u000b\u0000\u0006\u0001\u0000\u0011\u0000\u0001�\u000f\u0000\u0007�\u0000\u0000\u0002"} +{"timestamp":"2026-09-04T10:20:48","event_id":"483854e6-3fed-454f-9fb3-be5af86d71a7","source_ip":"176.120.22.61","source_port":11413,"source_domain":"","country_code":"RU","country_name":"Russia","city_name":"","asn_number":198953,"asn_org":"Proton66 OOO","dest_port":2017,"network_protocol":"","application_protocol":"mssql-tds","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":101000000,"source_bytes":26,"dest_bytes":13,"network_bytes":39,"event_summary":"\u0012\u0001\u0000\u001a\u0000\u0000\u0001\u0000\u0000\u0000\u000b\u0000\u0006\u0001\u0000\u0011\u0000\u0001�\u000f\u0000\u0007�\u0000\u0000\u0002"} +{"timestamp":"2026-09-04T10:20:48","event_id":"eaf68c53-27c4-43cf-a1fa-5728178f0992","source_ip":"176.120.22.61","source_port":10858,"source_domain":"","country_code":"RU","country_name":"Russia","city_name":"","asn_number":198953,"asn_org":"Proton66 OOO","dest_port":8888,"network_protocol":"","application_protocol":"mssql-tds","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":26,"dest_bytes":13,"network_bytes":39,"event_summary":"\u0012\u0001\u0000\u001a\u0000\u0000\u0001\u0000\u0000\u0000\u000b\u0000\u0006\u0001\u0000\u0011\u0000\u0001�\u000f\u0000\u0007�\u0000\u0000\u0002"} +{"timestamp":"2026-09-04T10:20:48","event_id":"99ac8188-a367-4fd0-83f7-94a4099af177","source_ip":"176.120.22.61","source_port":9298,"source_domain":"","country_code":"RU","country_name":"Russia","city_name":"","asn_number":198953,"asn_org":"Proton66 OOO","dest_port":23341,"network_protocol":"","application_protocol":"mssql-tds","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":26,"dest_bytes":13,"network_bytes":39,"event_summary":"\u0012\u0001\u0000\u001a\u0000\u0000\u0001\u0000\u0000\u0000\u000b\u0000\u0006\u0001\u0000\u0011\u0000\u0001�\u000f\u0000\u0007�\u0000\u0000\u0002"} +{"timestamp":"2026-09-04T10:20:48","event_id":"a140dd13-f085-4d38-817a-922a733fd77e","source_ip":"176.120.22.61","source_port":8888,"source_domain":"","country_code":"RU","country_name":"Russia","city_name":"","asn_number":198953,"asn_org":"Proton66 OOO","dest_port":14334,"network_protocol":"","application_protocol":"mssql-tds","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":26,"dest_bytes":13,"network_bytes":39,"event_summary":"\u0012\u0001\u0000\u001a\u0000\u0000\u0001\u0000\u0000\u0000\u000b\u0000\u0006\u0001\u0000\u0011\u0000\u0001�\u000f\u0000\u0007�\u0000\u0000\u0002"} +{"timestamp":"2026-09-04T10:20:48","event_id":"621060ba-c577-47b6-acff-785b51011e13","source_ip":"176.120.22.61","source_port":8816,"source_domain":"","country_code":"RU","country_name":"Russia","city_name":"","asn_number":198953,"asn_org":"Proton66 OOO","dest_port":6802,"network_protocol":"","application_protocol":"mssql-tds","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":26,"dest_bytes":13,"network_bytes":39,"event_summary":"\u0012\u0001\u0000\u001a\u0000\u0000\u0001\u0000\u0000\u0000\u000b\u0000\u0006\u0001\u0000\u0011\u0000\u0001�\u000f\u0000\u0007�\u0000\u0000\u0002"} +{"timestamp":"2026-09-04T10:20:48","event_id":"b67eb01f-fb27-44cd-9f48-fd4429b059bb","source_ip":"176.120.22.61","source_port":8553,"source_domain":"","country_code":"RU","country_name":"Russia","city_name":"","asn_number":198953,"asn_org":"Proton66 OOO","dest_port":35366,"network_protocol":"","application_protocol":"mssql-tds","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":26,"dest_bytes":13,"network_bytes":39,"event_summary":"\u0012\u0001\u0000\u001a\u0000\u0000\u0001\u0000\u0000\u0000\u000b\u0000\u0006\u0001\u0000\u0011\u0000\u0001�\u000f\u0000\u0007�\u0000\u0000\u0002"} +{"timestamp":"2026-09-04T10:20:48","event_id":"8b17de74-63d9-464b-8467-5861e5735bcb","source_ip":"176.120.22.61","source_port":8541,"source_domain":"","country_code":"RU","country_name":"Russia","city_name":"","asn_number":198953,"asn_org":"Proton66 OOO","dest_port":5001,"network_protocol":"","application_protocol":"targusdataspeed","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":26,"dest_bytes":13,"network_bytes":39,"event_summary":"\u0012\u0001\u0000\u001a\u0000\u0000\u0001\u0000\u0000\u0000\u000b\u0000\u0006\u0001\u0000\u0011\u0000\u0001�\u000f\u0000\u0007�\u0000\u0000\u0002"} +{"timestamp":"2026-09-04T10:20:48","event_id":"a1486c2b-40b3-457d-9e5f-f8b3b6aaf180","source_ip":"176.120.22.61","source_port":7634,"source_domain":"","country_code":"RU","country_name":"Russia","city_name":"","asn_number":198953,"asn_org":"Proton66 OOO","dest_port":22020,"network_protocol":"","application_protocol":"mssql-tds","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":26,"dest_bytes":13,"network_bytes":39,"event_summary":"\u0012\u0001\u0000\u001a\u0000\u0000\u0001\u0000\u0000\u0000\u000b\u0000\u0006\u0001\u0000\u0011\u0000\u0001�\u000f\u0000\u0007�\u0000\u0000\u0002"} +{"timestamp":"2026-09-04T10:20:48","event_id":"41d2ac12-97da-40ab-9fe7-856ea326c9ce","source_ip":"176.120.22.61","source_port":7540,"source_domain":"","country_code":"RU","country_name":"Russia","city_name":"","asn_number":198953,"asn_org":"Proton66 OOO","dest_port":9898,"network_protocol":"","application_protocol":"mssql-tds","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":26,"dest_bytes":13,"network_bytes":39,"event_summary":"\u0012\u0001\u0000\u001a\u0000\u0000\u0001\u0000\u0000\u0000\u000b\u0000\u0006\u0001\u0000\u0011\u0000\u0001�\u000f\u0000\u0007�\u0000\u0000\u0002"} +{"timestamp":"2026-09-04T10:20:48","event_id":"0684d3d9-ab38-443c-abf0-a33ca6b9c1ef","source_ip":"176.120.22.61","source_port":7374,"source_domain":"","country_code":"RU","country_name":"Russia","city_name":"","asn_number":198953,"asn_org":"Proton66 OOO","dest_port":9090,"network_protocol":"","application_protocol":"mssql-tds","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":101000000,"source_bytes":26,"dest_bytes":13,"network_bytes":39,"event_summary":"\u0012\u0001\u0000\u001a\u0000\u0000\u0001\u0000\u0000\u0000\u000b\u0000\u0006\u0001\u0000\u0011\u0000\u0001�\u000f\u0000\u0007�\u0000\u0000\u0002"} +{"timestamp":"2026-09-04T10:20:48","event_id":"67a22ac6-ba60-4fdc-a81d-acc4d8792d46","source_ip":"176.120.22.61","source_port":7154,"source_domain":"","country_code":"RU","country_name":"Russia","city_name":"","asn_number":198953,"asn_org":"Proton66 OOO","dest_port":49160,"network_protocol":"","application_protocol":"mssql-tds","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":26,"dest_bytes":13,"network_bytes":39,"event_summary":"\u0012\u0001\u0000\u001a\u0000\u0000\u0001\u0000\u0000\u0000\u000b\u0000\u0006\u0001\u0000\u0011\u0000\u0001�\u000f\u0000\u0007�\u0000\u0000\u0002"} +{"timestamp":"2026-09-04T10:20:48","event_id":"e322d632-ef38-496c-9068-c4cdc34ecf28","source_ip":"176.120.22.61","source_port":6429,"source_domain":"","country_code":"RU","country_name":"Russia","city_name":"","asn_number":198953,"asn_org":"Proton66 OOO","dest_port":4404,"network_protocol":"","application_protocol":"mssql-tds","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":26,"dest_bytes":13,"network_bytes":39,"event_summary":"\u0012\u0001\u0000\u001a\u0000\u0000\u0001\u0000\u0000\u0000\u000b\u0000\u0006\u0001\u0000\u0011\u0000\u0001�\u000f\u0000\u0007�\u0000\u0000\u0002"} +{"timestamp":"2026-09-04T10:20:48","event_id":"20ad0940-8e99-4990-a45f-a7c2fe6505a8","source_ip":"176.120.22.61","source_port":5921,"source_domain":"","country_code":"RU","country_name":"Russia","city_name":"","asn_number":198953,"asn_org":"Proton66 OOO","dest_port":4000,"network_protocol":"","application_protocol":"mssql-tds","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":26,"dest_bytes":13,"network_bytes":39,"event_summary":"\u0012\u0001\u0000\u001a\u0000\u0000\u0001\u0000\u0000\u0000\u000b\u0000\u0006\u0001\u0000\u0011\u0000\u0001�\u000f\u0000\u0007�\u0000\u0000\u0002"} +{"timestamp":"2026-09-04T10:20:48","event_id":"4b75f0f1-a284-48a8-b2ae-ac2da37dfa9a","source_ip":"176.120.22.61","source_port":5865,"source_domain":"","country_code":"RU","country_name":"Russia","city_name":"","asn_number":198953,"asn_org":"Proton66 OOO","dest_port":7979,"network_protocol":"","application_protocol":"mssql-tds","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":26,"dest_bytes":13,"network_bytes":39,"event_summary":"\u0012\u0001\u0000\u001a\u0000\u0000\u0001\u0000\u0000\u0000\u000b\u0000\u0006\u0001\u0000\u0011\u0000\u0001�\u000f\u0000\u0007�\u0000\u0000\u0002"} +{"timestamp":"2026-09-04T10:20:48","event_id":"4fed8360-19ae-4dab-8e9f-96e05d38bc3a","source_ip":"176.120.22.61","source_port":5655,"source_domain":"","country_code":"RU","country_name":"Russia","city_name":"","asn_number":198953,"asn_org":"Proton66 OOO","dest_port":1588,"network_protocol":"","application_protocol":"mssql-tds","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":26,"dest_bytes":13,"network_bytes":39,"event_summary":"\u0012\u0001\u0000\u001a\u0000\u0000\u0001\u0000\u0000\u0000\u000b\u0000\u0006\u0001\u0000\u0011\u0000\u0001�\u000f\u0000\u0007�\u0000\u0000\u0002"} +{"timestamp":"2026-09-04T10:20:48","event_id":"0b036645-c174-460d-a42f-d4a40a8cf9f8","source_ip":"176.120.22.61","source_port":5450,"source_domain":"","country_code":"RU","country_name":"Russia","city_name":"","asn_number":198953,"asn_org":"Proton66 OOO","dest_port":1333,"network_protocol":"","application_protocol":"mssql-tds","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":26,"dest_bytes":13,"network_bytes":39,"event_summary":"\u0012\u0001\u0000\u001a\u0000\u0000\u0001\u0000\u0000\u0000\u000b\u0000\u0006\u0001\u0000\u0011\u0000\u0001�\u000f\u0000\u0007�\u0000\u0000\u0002"} +{"timestamp":"2026-09-04T10:20:48","event_id":"d8baa34d-f832-4696-acbb-7c4298ecc2e7","source_ip":"176.120.22.61","source_port":5419,"source_domain":"","country_code":"RU","country_name":"Russia","city_name":"","asn_number":198953,"asn_org":"Proton66 OOO","dest_port":5005,"network_protocol":"","application_protocol":"mssql-tds","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":26,"dest_bytes":13,"network_bytes":39,"event_summary":"\u0012\u0001\u0000\u001a\u0000\u0000\u0001\u0000\u0000\u0000\u000b\u0000\u0006\u0001\u0000\u0011\u0000\u0001�\u000f\u0000\u0007�\u0000\u0000\u0002"} +{"timestamp":"2026-09-04T10:20:48","event_id":"5b328763-1118-433c-8938-93bbad7c422d","source_ip":"176.120.22.61","source_port":5345,"source_domain":"","country_code":"RU","country_name":"Russia","city_name":"","asn_number":198953,"asn_org":"Proton66 OOO","dest_port":8989,"network_protocol":"","application_protocol":"mssql-tds","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":101000000,"source_bytes":26,"dest_bytes":13,"network_bytes":39,"event_summary":"\u0012\u0001\u0000\u001a\u0000\u0000\u0001\u0000\u0000\u0000\u000b\u0000\u0006\u0001\u0000\u0011\u0000\u0001�\u000f\u0000\u0007�\u0000\u0000\u0002"} +{"timestamp":"2026-09-04T10:20:48","event_id":"e1f99dfc-4de0-4ffe-84b1-8795d654cd62","source_ip":"176.120.22.61","source_port":5173,"source_domain":"","country_code":"RU","country_name":"Russia","city_name":"","asn_number":198953,"asn_org":"Proton66 OOO","dest_port":2580,"network_protocol":"","application_protocol":"mssql-tds","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":26,"dest_bytes":13,"network_bytes":39,"event_summary":"\u0012\u0001\u0000\u001a\u0000\u0000\u0001\u0000\u0000\u0000\u000b\u0000\u0006\u0001\u0000\u0011\u0000\u0001�\u000f\u0000\u0007�\u0000\u0000\u0002"} +{"timestamp":"2026-09-04T10:20:48","event_id":"64274e39-df26-434a-b310-10554dd5e05b","source_ip":"176.120.22.61","source_port":5181,"source_domain":"","country_code":"RU","country_name":"Russia","city_name":"","asn_number":198953,"asn_org":"Proton66 OOO","dest_port":1444,"network_protocol":"","application_protocol":"mssql-tds","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":26,"dest_bytes":13,"network_bytes":39,"event_summary":"\u0012\u0001\u0000\u001a\u0000\u0000\u0001\u0000\u0000\u0000\u000b\u0000\u0006\u0001\u0000\u0011\u0000\u0001�\u000f\u0000\u0007�\u0000\u0000\u0002"} +{"timestamp":"2026-09-04T10:20:48","event_id":"05abb9dd-9409-40b6-ad39-65a43de70b77","source_ip":"176.120.22.61","source_port":4625,"source_domain":"","country_code":"RU","country_name":"Russia","city_name":"","asn_number":198953,"asn_org":"Proton66 OOO","dest_port":2433,"network_protocol":"","application_protocol":"mssql-tds","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":26,"dest_bytes":13,"network_bytes":39,"event_summary":"\u0012\u0001\u0000\u001a\u0000\u0000\u0001\u0000\u0000\u0000\u000b\u0000\u0006\u0001\u0000\u0011\u0000\u0001�\u000f\u0000\u0007�\u0000\u0000\u0002"} +{"timestamp":"2026-09-04T10:20:48","event_id":"fb181ba9-4efd-4b60-b254-0a0829baa300","source_ip":"176.120.22.61","source_port":4369,"source_domain":"","country_code":"RU","country_name":"Russia","city_name":"","asn_number":198953,"asn_org":"Proton66 OOO","dest_port":1441,"network_protocol":"","application_protocol":"mssql-tds","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":26,"dest_bytes":13,"network_bytes":39,"event_summary":"\u0012\u0001\u0000\u001a\u0000\u0000\u0001\u0000\u0000\u0000\u000b\u0000\u0006\u0001\u0000\u0011\u0000\u0001�\u000f\u0000\u0007�\u0000\u0000\u0002"} +{"timestamp":"2026-09-04T10:20:48","event_id":"ae04e9a7-18a7-46b6-bf8d-ee2d09f53287","source_ip":"176.120.22.61","source_port":4212,"source_domain":"","country_code":"RU","country_name":"Russia","city_name":"","asn_number":198953,"asn_org":"Proton66 OOO","dest_port":22222,"network_protocol":"","application_protocol":"mssql-tds","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":26,"dest_bytes":13,"network_bytes":39,"event_summary":"\u0012\u0001\u0000\u001a\u0000\u0000\u0001\u0000\u0000\u0000\u000b\u0000\u0006\u0001\u0000\u0011\u0000\u0001�\u000f\u0000\u0007�\u0000\u0000\u0002"} +{"timestamp":"2026-09-04T10:20:48","event_id":"212b9010-1bc3-4bd2-9f65-31be7afdf75a","source_ip":"176.120.22.61","source_port":3874,"source_domain":"","country_code":"RU","country_name":"Russia","city_name":"","asn_number":198953,"asn_org":"Proton66 OOO","dest_port":60000,"network_protocol":"","application_protocol":"mssql-tds","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":26,"dest_bytes":13,"network_bytes":39,"event_summary":"\u0012\u0001\u0000\u001a\u0000\u0000\u0001\u0000\u0000\u0000\u000b\u0000\u0006\u0001\u0000\u0011\u0000\u0001�\u000f\u0000\u0007�\u0000\u0000\u0002"} +{"timestamp":"2026-09-04T10:20:48","event_id":"61d23173-d243-4c6a-9ee3-dd9a4a11d269","source_ip":"176.120.22.61","source_port":3375,"source_domain":"","country_code":"RU","country_name":"Russia","city_name":"","asn_number":198953,"asn_org":"Proton66 OOO","dest_port":3309,"network_protocol":"","application_protocol":"mssql-tds","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":26,"dest_bytes":13,"network_bytes":39,"event_summary":"\u0012\u0001\u0000\u001a\u0000\u0000\u0001\u0000\u0000\u0000\u000b\u0000\u0006\u0001\u0000\u0011\u0000\u0001�\u000f\u0000\u0007�\u0000\u0000\u0002"} +{"timestamp":"2026-09-04T10:20:48","event_id":"f85dcdba-515d-48fb-8867-9821ee078058","source_ip":"176.120.22.61","source_port":3362,"source_domain":"","country_code":"RU","country_name":"Russia","city_name":"","asn_number":198953,"asn_org":"Proton66 OOO","dest_port":5367,"network_protocol":"","application_protocol":"mssql-tds","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":26,"dest_bytes":13,"network_bytes":39,"event_summary":"\u0012\u0001\u0000\u001a\u0000\u0000\u0001\u0000\u0000\u0000\u000b\u0000\u0006\u0001\u0000\u0011\u0000\u0001�\u000f\u0000\u0007�\u0000\u0000\u0002"} +{"timestamp":"2026-09-04T10:20:48","event_id":"af844aa1-718e-43f0-b9f9-c40908f997af","source_ip":"176.120.22.61","source_port":3096,"source_domain":"","country_code":"RU","country_name":"Russia","city_name":"","asn_number":198953,"asn_org":"Proton66 OOO","dest_port":54321,"network_protocol":"","application_protocol":"mssql-tds","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":26,"dest_bytes":13,"network_bytes":39,"event_summary":"\u0012\u0001\u0000\u001a\u0000\u0000\u0001\u0000\u0000\u0000\u000b\u0000\u0006\u0001\u0000\u0011\u0000\u0001�\u000f\u0000\u0007�\u0000\u0000\u0002"} +{"timestamp":"2026-09-04T10:20:48","event_id":"a876ab42-e929-4f5b-b7f8-f1e9744189c9","source_ip":"176.120.22.61","source_port":2762,"source_domain":"","country_code":"RU","country_name":"Russia","city_name":"","asn_number":198953,"asn_org":"Proton66 OOO","dest_port":7433,"network_protocol":"","application_protocol":"mssql-tds","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":101000000,"source_bytes":26,"dest_bytes":13,"network_bytes":39,"event_summary":"\u0012\u0001\u0000\u001a\u0000\u0000\u0001\u0000\u0000\u0000\u000b\u0000\u0006\u0001\u0000\u0011\u0000\u0001�\u000f\u0000\u0007�\u0000\u0000\u0002"} +{"timestamp":"2026-09-04T10:20:47","event_id":"c16122d5-9cdf-4285-b180-cc78cc82b30b","source_ip":"176.120.22.61","source_port":2186,"source_domain":"","country_code":"RU","country_name":"Russia","city_name":"","asn_number":198953,"asn_org":"Proton66 OOO","dest_port":9002,"network_protocol":"","application_protocol":"mssql-tds","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":26,"dest_bytes":13,"network_bytes":39,"event_summary":"\u0012\u0001\u0000\u001a\u0000\u0000\u0001\u0000\u0000\u0000\u000b\u0000\u0006\u0001\u0000\u0011\u0000\u0001�\u000f\u0000\u0007�\u0000\u0000\u0002"} +{"timestamp":"2026-09-04T10:20:47","event_id":"d5872c50-a9e6-4d8e-b153-5ef00c8f314e","source_ip":"176.120.22.61","source_port":1722,"source_domain":"","country_code":"RU","country_name":"Russia","city_name":"","asn_number":198953,"asn_org":"Proton66 OOO","dest_port":5555,"network_protocol":"","application_protocol":"mssql-tds","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":26,"dest_bytes":13,"network_bytes":39,"event_summary":"\u0012\u0001\u0000\u001a\u0000\u0000\u0001\u0000\u0000\u0000\u000b\u0000\u0006\u0001\u0000\u0011\u0000\u0001�\u000f\u0000\u0007�\u0000\u0000\u0002"} +{"timestamp":"2026-09-04T10:20:47","event_id":"76e1a80b-1ec6-4130-8188-fe823bb7f780","source_ip":"176.120.22.61","source_port":1431,"source_domain":"","country_code":"RU","country_name":"Russia","city_name":"","asn_number":198953,"asn_org":"Proton66 OOO","dest_port":55366,"network_protocol":"","application_protocol":"mssql-tds","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":26,"dest_bytes":13,"network_bytes":39,"event_summary":"\u0012\u0001\u0000\u001a\u0000\u0000\u0001\u0000\u0000\u0000\u000b\u0000\u0006\u0001\u0000\u0011\u0000\u0001�\u000f\u0000\u0007�\u0000\u0000\u0002"} +{"timestamp":"2026-09-04T10:20:47","event_id":"dd0b13b5-3c31-479a-82d4-bdbef40cfe35","source_ip":"176.120.22.61","source_port":1136,"source_domain":"","country_code":"RU","country_name":"Russia","city_name":"","asn_number":198953,"asn_org":"Proton66 OOO","dest_port":14332,"network_protocol":"","application_protocol":"mssql-tds","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":26,"dest_bytes":13,"network_bytes":39,"event_summary":"\u0012\u0001\u0000\u001a\u0000\u0000\u0001\u0000\u0000\u0000\u000b\u0000\u0006\u0001\u0000\u0011\u0000\u0001�\u000f\u0000\u0007�\u0000\u0000\u0002"} +{"timestamp":"2026-09-04T10:20:47","event_id":"e35b4820-1bf0-472c-ad2f-800bf91a2f49","source_ip":"176.120.22.61","source_port":59915,"source_domain":"","country_code":"RU","country_name":"Russia","city_name":"","asn_number":198953,"asn_org":"Proton66 OOO","dest_port":8005,"network_protocol":"","application_protocol":"mssql-tds","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":101000000,"source_bytes":26,"dest_bytes":13,"network_bytes":39,"event_summary":"\u0012\u0001\u0000\u001a\u0000\u0000\u0001\u0000\u0000\u0000\u000b\u0000\u0006\u0001\u0000\u0011\u0000\u0001�\u000f\u0000\u0007�\u0000\u0000\u0002"} +{"timestamp":"2026-09-04T10:20:47","event_id":"a2777441-2fa7-4cfb-9e01-e4771fa20149","source_ip":"176.120.22.61","source_port":59756,"source_domain":"","country_code":"RU","country_name":"Russia","city_name":"","asn_number":198953,"asn_org":"Proton66 OOO","dest_port":45366,"network_protocol":"","application_protocol":"mssql-tds","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":26,"dest_bytes":13,"network_bytes":39,"event_summary":"\u0012\u0001\u0000\u001a\u0000\u0000\u0001\u0000\u0000\u0000\u000b\u0000\u0006\u0001\u0000\u0011\u0000\u0001�\u000f\u0000\u0007�\u0000\u0000\u0002"} +{"timestamp":"2026-09-04T10:20:47","event_id":"a3f2393c-ac19-42a9-926c-0470915128c3","source_ip":"176.120.22.61","source_port":59525,"source_domain":"","country_code":"RU","country_name":"Russia","city_name":"","asn_number":198953,"asn_org":"Proton66 OOO","dest_port":1433,"network_protocol":"","application_protocol":"mssql-tds","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":26,"dest_bytes":13,"network_bytes":39,"event_summary":"\u0012\u0001\u0000\u001a\u0000\u0000\u0001\u0000\u0000\u0000\u000b\u0000\u0006\u0001\u0000\u0011\u0000\u0001�\u000f\u0000\u0007�\u0000\u0000\u0002"} +{"timestamp":"2026-09-04T10:20:47","event_id":"c121be8a-07c0-4aa4-8272-5090829ce4da","source_ip":"176.120.22.61","source_port":58701,"source_domain":"","country_code":"RU","country_name":"Russia","city_name":"","asn_number":198953,"asn_org":"Proton66 OOO","dest_port":8000,"network_protocol":"","application_protocol":"mssql-tds","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":26,"dest_bytes":13,"network_bytes":39,"event_summary":"\u0012\u0001\u0000\u001a\u0000\u0000\u0001\u0000\u0000\u0000\u000b\u0000\u0006\u0001\u0000\u0011\u0000\u0001�\u000f\u0000\u0007�\u0000\u0000\u0002"} +{"timestamp":"2026-09-04T10:20:47","event_id":"b85224dc-88b3-4d85-b740-a72908a9f50e","source_ip":"176.120.22.61","source_port":58359,"source_domain":"","country_code":"RU","country_name":"Russia","city_name":"","asn_number":198953,"asn_org":"Proton66 OOO","dest_port":55555,"network_protocol":"","application_protocol":"mssql-tds","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":26,"dest_bytes":13,"network_bytes":39,"event_summary":"\u0012\u0001\u0000\u001a\u0000\u0000\u0001\u0000\u0000\u0000\u000b\u0000\u0006\u0001\u0000\u0011\u0000\u0001�\u000f\u0000\u0007�\u0000\u0000\u0002"} +{"timestamp":"2026-09-04T10:20:47","event_id":"3ecf7b2d-7f3b-4da0-9caa-949376389452","source_ip":"176.120.22.61","source_port":58085,"source_domain":"","country_code":"RU","country_name":"Russia","city_name":"","asn_number":198953,"asn_org":"Proton66 OOO","dest_port":20433,"network_protocol":"","application_protocol":"mssql-tds","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":26,"dest_bytes":13,"network_bytes":39,"event_summary":"\u0012\u0001\u0000\u001a\u0000\u0000\u0001\u0000\u0000\u0000\u000b\u0000\u0006\u0001\u0000\u0011\u0000\u0001�\u000f\u0000\u0007�\u0000\u0000\u0002"} +{"timestamp":"2026-09-04T10:20:47","event_id":"1d7df42d-6e4f-4982-9033-7dd05aa92ac3","source_ip":"176.120.22.61","source_port":57876,"source_domain":"","country_code":"RU","country_name":"Russia","city_name":"","asn_number":198953,"asn_org":"Proton66 OOO","dest_port":8777,"network_protocol":"","application_protocol":"mssql-tds","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":26,"dest_bytes":13,"network_bytes":39,"event_summary":"\u0012\u0001\u0000\u001a\u0000\u0000\u0001\u0000\u0000\u0000\u000b\u0000\u0006\u0001\u0000\u0011\u0000\u0001�\u000f\u0000\u0007�\u0000\u0000\u0002"} +{"timestamp":"2026-09-04T10:20:47","event_id":"5b524760-6858-4634-9665-407c1b1c37ee","source_ip":"176.120.22.61","source_port":57715,"source_domain":"","country_code":"RU","country_name":"Russia","city_name":"","asn_number":198953,"asn_org":"Proton66 OOO","dest_port":1489,"network_protocol":"","application_protocol":"mssql-tds","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":26,"dest_bytes":13,"network_bytes":39,"event_summary":"\u0012\u0001\u0000\u001a\u0000\u0000\u0001\u0000\u0000\u0000\u000b\u0000\u0006\u0001\u0000\u0011\u0000\u0001�\u000f\u0000\u0007�\u0000\u0000\u0002"} +{"timestamp":"2026-09-04T10:20:47","event_id":"b1837eea-705f-4f96-9535-12557997d62e","source_ip":"176.120.22.61","source_port":57672,"source_domain":"","country_code":"RU","country_name":"Russia","city_name":"","asn_number":198953,"asn_org":"Proton66 OOO","dest_port":1744,"network_protocol":"","application_protocol":"mssql-tds","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":26,"dest_bytes":13,"network_bytes":39,"event_summary":"\u0012\u0001\u0000\u001a\u0000\u0000\u0001\u0000\u0000\u0000\u000b\u0000\u0006\u0001\u0000\u0011\u0000\u0001�\u000f\u0000\u0007�\u0000\u0000\u0002"} +{"timestamp":"2026-09-04T10:20:47","event_id":"751d20a8-acfd-4bb1-bffa-dd3d1e6b548c","source_ip":"176.120.22.61","source_port":57130,"source_domain":"","country_code":"RU","country_name":"Russia","city_name":"","asn_number":198953,"asn_org":"Proton66 OOO","dest_port":15433,"network_protocol":"","application_protocol":"mssql-tds","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":26,"dest_bytes":13,"network_bytes":39,"event_summary":"\u0012\u0001\u0000\u001a\u0000\u0000\u0001\u0000\u0000\u0000\u000b\u0000\u0006\u0001\u0000\u0011\u0000\u0001�\u000f\u0000\u0007�\u0000\u0000\u0002"} +{"timestamp":"2026-09-04T10:20:47","event_id":"32cfedd3-e70f-4cfb-bbd7-145300fabc78","source_ip":"176.120.22.61","source_port":57010,"source_domain":"","country_code":"RU","country_name":"Russia","city_name":"","asn_number":198953,"asn_org":"Proton66 OOO","dest_port":1544,"network_protocol":"","application_protocol":"mssql-tds","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":26,"dest_bytes":13,"network_bytes":39,"event_summary":"\u0012\u0001\u0000\u001a\u0000\u0000\u0001\u0000\u0000\u0000\u000b\u0000\u0006\u0001\u0000\u0011\u0000\u0001�\u000f\u0000\u0007�\u0000\u0000\u0002"} +{"timestamp":"2026-09-04T10:20:47","event_id":"27d2e25c-051f-42a5-a8aa-37e44f6b029c","source_ip":"176.120.22.61","source_port":56996,"source_domain":"","country_code":"RU","country_name":"Russia","city_name":"","asn_number":198953,"asn_org":"Proton66 OOO","dest_port":6602,"network_protocol":"","application_protocol":"mssql-tds","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":26,"dest_bytes":13,"network_bytes":39,"event_summary":"\u0012\u0001\u0000\u001a\u0000\u0000\u0001\u0000\u0000\u0000\u000b\u0000\u0006\u0001\u0000\u0011\u0000\u0001�\u000f\u0000\u0007�\u0000\u0000\u0002"} +{"timestamp":"2026-09-04T10:20:47","event_id":"49c1e17a-bf72-479a-93c2-7404d2f7076c","source_ip":"176.120.22.61","source_port":56768,"source_domain":"","country_code":"RU","country_name":"Russia","city_name":"","asn_number":198953,"asn_org":"Proton66 OOO","dest_port":3123,"network_protocol":"","application_protocol":"mssql-tds","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":101000000,"source_bytes":26,"dest_bytes":13,"network_bytes":39,"event_summary":"\u0012\u0001\u0000\u001a\u0000\u0000\u0001\u0000\u0000\u0000\u000b\u0000\u0006\u0001\u0000\u0011\u0000\u0001�\u000f\u0000\u0007�\u0000\u0000\u0002"} +{"timestamp":"2026-09-04T10:20:47","event_id":"7ec527a5-0ad4-4039-a72b-61230c367686","source_ip":"176.120.22.61","source_port":56514,"source_domain":"","country_code":"RU","country_name":"Russia","city_name":"","asn_number":198953,"asn_org":"Proton66 OOO","dest_port":42130,"network_protocol":"","application_protocol":"mssql-tds","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":26,"dest_bytes":13,"network_bytes":39,"event_summary":"\u0012\u0001\u0000\u001a\u0000\u0000\u0001\u0000\u0000\u0000\u000b\u0000\u0006\u0001\u0000\u0011\u0000\u0001�\u000f\u0000\u0007�\u0000\u0000\u0002"} +{"timestamp":"2026-09-04T10:20:47","event_id":"5a55204b-1ba7-4efb-8769-1b0aa46f9433","source_ip":"176.120.22.61","source_port":55987,"source_domain":"","country_code":"RU","country_name":"Russia","city_name":"","asn_number":198953,"asn_org":"Proton66 OOO","dest_port":14330,"network_protocol":"","application_protocol":"mssql-tds","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":26,"dest_bytes":13,"network_bytes":39,"event_summary":"\u0012\u0001\u0000\u001a\u0000\u0000\u0001\u0000\u0000\u0000\u000b\u0000\u0006\u0001\u0000\u0011\u0000\u0001�\u000f\u0000\u0007�\u0000\u0000\u0002"} +{"timestamp":"2026-09-04T10:20:47","event_id":"36f47e97-5f50-4f0a-877d-df1728aee6ad","source_ip":"176.120.22.61","source_port":55843,"source_domain":"","country_code":"RU","country_name":"Russia","city_name":"","asn_number":198953,"asn_org":"Proton66 OOO","dest_port":1488,"network_protocol":"","application_protocol":"mssql-tds","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":26,"dest_bytes":13,"network_bytes":39,"event_summary":"\u0012\u0001\u0000\u001a\u0000\u0000\u0001\u0000\u0000\u0000\u000b\u0000\u0006\u0001\u0000\u0011\u0000\u0001�\u000f\u0000\u0007�\u0000\u0000\u0002"} +{"timestamp":"2026-09-04T10:20:47","event_id":"73a624d5-5551-4a44-a6ca-f5092a47a18a","source_ip":"176.120.22.61","source_port":55466,"source_domain":"","country_code":"RU","country_name":"Russia","city_name":"","asn_number":198953,"asn_org":"Proton66 OOO","dest_port":3307,"network_protocol":"","application_protocol":"mssql-tds","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":26,"dest_bytes":13,"network_bytes":39,"event_summary":"\u0012\u0001\u0000\u001a\u0000\u0000\u0001\u0000\u0000\u0000\u000b\u0000\u0006\u0001\u0000\u0011\u0000\u0001�\u000f\u0000\u0007�\u0000\u0000\u0002"} +{"timestamp":"2026-09-04T10:20:47","event_id":"4549bb2b-c8ea-49ac-88d2-b58aacf65a27","source_ip":"176.120.22.61","source_port":55235,"source_domain":"","country_code":"RU","country_name":"Russia","city_name":"","asn_number":198953,"asn_org":"Proton66 OOO","dest_port":19433,"network_protocol":"","application_protocol":"mssql-tds","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":26,"dest_bytes":13,"network_bytes":39,"event_summary":"\u0012\u0001\u0000\u001a\u0000\u0000\u0001\u0000\u0000\u0000\u000b\u0000\u0006\u0001\u0000\u0011\u0000\u0001�\u000f\u0000\u0007�\u0000\u0000\u0002"} +{"timestamp":"2026-09-04T10:20:47","event_id":"e8c2e6e9-2383-41d6-aa72-920692a1f7f1","source_ip":"176.120.22.61","source_port":55011,"source_domain":"","country_code":"RU","country_name":"Russia","city_name":"","asn_number":198953,"asn_org":"Proton66 OOO","dest_port":1666,"network_protocol":"","application_protocol":"mssql-tds","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":26,"dest_bytes":13,"network_bytes":39,"event_summary":"\u0012\u0001\u0000\u001a\u0000\u0000\u0001\u0000\u0000\u0000\u000b\u0000\u0006\u0001\u0000\u0011\u0000\u0001�\u000f\u0000\u0007�\u0000\u0000\u0002"} +{"timestamp":"2026-09-04T10:20:47","event_id":"f9a75e95-1f0a-4d6d-a52b-589ee8687873","source_ip":"176.120.22.61","source_port":54949,"source_domain":"","country_code":"RU","country_name":"Russia","city_name":"","asn_number":198953,"asn_org":"Proton66 OOO","dest_port":41433,"network_protocol":"","application_protocol":"mssql-tds","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":26,"dest_bytes":13,"network_bytes":39,"event_summary":"\u0012\u0001\u0000\u001a\u0000\u0000\u0001\u0000\u0000\u0000\u000b\u0000\u0006\u0001\u0000\u0011\u0000\u0001�\u000f\u0000\u0007�\u0000\u0000\u0002"} +{"timestamp":"2026-09-04T10:20:47","event_id":"b07619ed-7210-46a4-9165-2f1dcfa9fe60","source_ip":"176.120.22.61","source_port":54705,"source_domain":"","country_code":"RU","country_name":"Russia","city_name":"","asn_number":198953,"asn_org":"Proton66 OOO","dest_port":1400,"network_protocol":"","application_protocol":"mssql-tds","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":26,"dest_bytes":13,"network_bytes":39,"event_summary":"\u0012\u0001\u0000\u001a\u0000\u0000\u0001\u0000\u0000\u0000\u000b\u0000\u0006\u0001\u0000\u0011\u0000\u0001�\u000f\u0000\u0007�\u0000\u0000\u0002"} +{"timestamp":"2026-09-04T10:20:47","event_id":"78f13f4b-ba3b-4e11-a2a0-e829a3848871","source_ip":"176.120.22.61","source_port":54322,"source_domain":"","country_code":"RU","country_name":"Russia","city_name":"","asn_number":198953,"asn_org":"Proton66 OOO","dest_port":1100,"network_protocol":"","application_protocol":"mssql-tds","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":26,"dest_bytes":13,"network_bytes":39,"event_summary":"\u0012\u0001\u0000\u001a\u0000\u0000\u0001\u0000\u0000\u0000\u000b\u0000\u0006\u0001\u0000\u0011\u0000\u0001�\u000f\u0000\u0007�\u0000\u0000\u0002"} +{"timestamp":"2026-09-04T10:20:47","event_id":"e416e8b7-8184-4b1b-b99d-3bb4d0ac578b","source_ip":"176.120.22.61","source_port":53834,"source_domain":"","country_code":"RU","country_name":"Russia","city_name":"","asn_number":198953,"asn_org":"Proton66 OOO","dest_port":1032,"network_protocol":"","application_protocol":"mssql-tds","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":26,"dest_bytes":13,"network_bytes":39,"event_summary":"\u0012\u0001\u0000\u001a\u0000\u0000\u0001\u0000\u0000\u0000\u000b\u0000\u0006\u0001\u0000\u0011\u0000\u0001�\u000f\u0000\u0007�\u0000\u0000\u0002"} +{"timestamp":"2026-09-04T10:20:47","event_id":"8fb87b1e-638c-4ee9-8e93-7bde8d4318c7","source_ip":"176.120.22.61","source_port":53274,"source_domain":"","country_code":"RU","country_name":"Russia","city_name":"","asn_number":198953,"asn_org":"Proton66 OOO","dest_port":1112,"network_protocol":"","application_protocol":"mssql-tds","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":26,"dest_bytes":13,"network_bytes":39,"event_summary":"\u0012\u0001\u0000\u001a\u0000\u0000\u0001\u0000\u0000\u0000\u000b\u0000\u0006\u0001\u0000\u0011\u0000\u0001�\u000f\u0000\u0007�\u0000\u0000\u0002"} +{"timestamp":"2026-09-04T10:20:47","event_id":"27d1562b-81f5-4c39-b7ec-1dbcaa11cd59","source_ip":"176.120.22.61","source_port":52990,"source_domain":"","country_code":"RU","country_name":"Russia","city_name":"","asn_number":198953,"asn_org":"Proton66 OOO","dest_port":1499,"network_protocol":"","application_protocol":"mssql-tds","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":26,"dest_bytes":13,"network_bytes":39,"event_summary":"\u0012\u0001\u0000\u001a\u0000\u0000\u0001\u0000\u0000\u0000\u000b\u0000\u0006\u0001\u0000\u0011\u0000\u0001�\u000f\u0000\u0007�\u0000\u0000\u0002"} +{"timestamp":"2026-09-04T10:20:47","event_id":"894d58ba-d7e9-4be2-888c-79ffc4b7b2e2","source_ip":"176.120.22.61","source_port":51874,"source_domain":"","country_code":"RU","country_name":"Russia","city_name":"","asn_number":198953,"asn_org":"Proton66 OOO","dest_port":1431,"network_protocol":"","application_protocol":"mssql-tds","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":26,"dest_bytes":13,"network_bytes":39,"event_summary":"\u0012\u0001\u0000\u001a\u0000\u0000\u0001\u0000\u0000\u0000\u000b\u0000\u0006\u0001\u0000\u0011\u0000\u0001�\u000f\u0000\u0007�\u0000\u0000\u0002"} +{"timestamp":"2026-09-04T10:20:47","event_id":"7a90d9cf-4e03-4a43-95e8-9c548ad65846","source_ip":"176.120.22.61","source_port":51516,"source_domain":"","country_code":"RU","country_name":"Russia","city_name":"","asn_number":198953,"asn_org":"Proton66 OOO","dest_port":3308,"network_protocol":"","application_protocol":"mssql-tds","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":26,"dest_bytes":13,"network_bytes":39,"event_summary":"\u0012\u0001\u0000\u001a\u0000\u0000\u0001\u0000\u0000\u0000\u000b\u0000\u0006\u0001\u0000\u0011\u0000\u0001�\u000f\u0000\u0007�\u0000\u0000\u0002"} +{"timestamp":"2026-09-04T10:20:47","event_id":"c76435c3-3b7a-4f57-9fef-d325dee0c6ee","source_ip":"176.120.22.61","source_port":51225,"source_domain":"","country_code":"RU","country_name":"Russia","city_name":"","asn_number":198953,"asn_org":"Proton66 OOO","dest_port":23922,"network_protocol":"","application_protocol":"mssql-tds","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":26,"dest_bytes":13,"network_bytes":39,"event_summary":"\u0012\u0001\u0000\u001a\u0000\u0000\u0001\u0000\u0000\u0000\u000b\u0000\u0006\u0001\u0000\u0011\u0000\u0001�\u000f\u0000\u0007�\u0000\u0000\u0002"} \ No newline at end of file diff --git a/kevlar/2026-09-07/honeylabs/events-AS200593.ndjson b/kevlar/2026-09-07/honeylabs/events-AS200593.ndjson new file mode 100644 index 0000000..e69de29 diff --git a/kevlar/2026-09-07/honeylabs/events-AS200651.ndjson b/kevlar/2026-09-07/honeylabs/events-AS200651.ndjson new file mode 100644 index 0000000..a1d82fd --- /dev/null +++ b/kevlar/2026-09-07/honeylabs/events-AS200651.ndjson @@ -0,0 +1,24 @@ +{"timestamp":"2026-09-06T22:18:29","event_id":"459a4d61-22f6-481f-a5ea-1e1a11e1257b","source_ip":"185.100.87.136","source_port":60666,"source_domain":"","country_code":"RO","country_name":"Romania","city_name":"Bucharest","asn_number":200651,"asn_org":"FlokiNET ehf","dest_port":443,"network_protocol":"tls","application_protocol":"http","http_method":"GET","user_agent":"Mozilla/5.0 (Android 12; Mobile; rv:117.0) Gecko/117.0 Focus/117.0","url_path":"/eventmanager","url_domain":"","http_request_headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"\",\"user-agent\":\"Mozilla/5.0 (Android 12; Mobile; rv:117.0) Gecko/117.0 Focus/117.0\"}","ssh_client_hassh":"","tls_client_ja4":"t13i1909h2_9dc949149365_97f8aa674fd9","tls_client_ja3":"7c1e207beb00684bbbe144f1b0abe1d5","tls_client_version":"TLSv1.3","tls_client_cipher":"TLS_CHACHA20_POLY1305_SHA256","http_request_ja4h":"ge11nn0400_88d30a62b7ad","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":166,"dest_bytes":79,"network_bytes":245,"event_summary":""} +{"timestamp":"2026-09-06T21:56:00","event_id":"c38de225-590b-4c66-9ff6-dda73cd0e45b","source_ip":"185.100.87.136","source_port":38156,"source_domain":"","country_code":"RO","country_name":"Romania","city_name":"Bucharest","asn_number":200651,"asn_org":"FlokiNET ehf","dest_port":443,"network_protocol":"tls","application_protocol":"http","http_method":"GET","user_agent":"Mozilla/5.0 (Android 12; Mobile; rv:117.0) Gecko/117.0 Focus/117.0","url_path":"/eventmanager","url_domain":"","http_request_headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"\",\"user-agent\":\"Mozilla/5.0 (Android 12; Mobile; rv:117.0) Gecko/117.0 Focus/117.0\"}","ssh_client_hassh":"","tls_client_ja4":"t13i1909h2_9dc949149365_97f8aa674fd9","tls_client_ja3":"7c1e207beb00684bbbe144f1b0abe1d5","tls_client_version":"TLSv1.3","tls_client_cipher":"TLS_CHACHA20_POLY1305_SHA256","http_request_ja4h":"ge11nn0400_88d30a62b7ad","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":166,"dest_bytes":79,"network_bytes":245,"event_summary":""} +{"timestamp":"2026-09-06T20:33:31","event_id":"88551c1c-5d03-4ba9-99c7-668dbac3c9b4","source_ip":"185.100.87.136","source_port":58300,"source_domain":"","country_code":"RO","country_name":"Romania","city_name":"Bucharest","asn_number":200651,"asn_org":"FlokiNET ehf","dest_port":443,"network_protocol":"tls","application_protocol":"http","http_method":"GET","user_agent":"Mozilla/5.0 (Android 12; Mobile; rv:117.0) Gecko/117.0 Focus/117.0","url_path":"/eventmanager","url_domain":"","http_request_headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"\",\"user-agent\":\"Mozilla/5.0 (Android 12; Mobile; rv:117.0) Gecko/117.0 Focus/117.0\"}","ssh_client_hassh":"","tls_client_ja4":"t13i1909h2_9dc949149365_97f8aa674fd9","tls_client_ja3":"7c1e207beb00684bbbe144f1b0abe1d5","tls_client_version":"TLSv1.3","tls_client_cipher":"TLS_CHACHA20_POLY1305_SHA256","http_request_ja4h":"ge11nn0400_88d30a62b7ad","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":167,"dest_bytes":79,"network_bytes":246,"event_summary":""} +{"timestamp":"2026-09-05T02:46:08","event_id":"79552256-e055-42af-a25e-02d0c9f36f70","source_ip":"185.100.87.136","source_port":48056,"source_domain":"","country_code":"RO","country_name":"Romania","city_name":"Bucharest","asn_number":200651,"asn_org":"FlokiNET ehf","dest_port":443,"network_protocol":"","application_protocol":"","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":101000000,"source_bytes":52,"dest_bytes":14,"network_bytes":66,"event_summary":"ɔѦ��\u0005lM/\t�p#��*5#]�R:Ȏ/\u0011�͉Z��\u0019f�γ������%d1\u0017�%n�"} +{"timestamp":"2026-09-05T01:58:06","event_id":"3940f8bf-833f-4700-8098-7bc7fc7534cf","source_ip":"185.100.87.136","source_port":53828,"source_domain":"","country_code":"RO","country_name":"Romania","city_name":"Bucharest","asn_number":200651,"asn_org":"FlokiNET ehf","dest_port":443,"network_protocol":"","application_protocol":"","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":52,"dest_bytes":14,"network_bytes":66,"event_summary":"ɔѦ��\u0005lM/\t�p#��*5#]�R:Ȏ/\u0011�͉Z��\u0019f�γ������%d1\u0017�%n�"} +{"timestamp":"2026-09-05T01:02:29","event_id":"d4f9e0d2-3bb0-4765-97c6-5b373e22f9a1","source_ip":"185.100.87.136","source_port":38102,"source_domain":"","country_code":"RO","country_name":"Romania","city_name":"Bucharest","asn_number":200651,"asn_org":"FlokiNET ehf","dest_port":443,"network_protocol":"","application_protocol":"","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":52,"dest_bytes":14,"network_bytes":66,"event_summary":"ɔѦ��\u0005lM/\t�p#��*5#]�R:Ȏ/\u0011�͉Z��\u0019f�γ������%d1\u0017�%n�"} +{"timestamp":"2026-09-04T11:17:00","event_id":"962d5041-7ddd-4c49-a5b3-61fbf24efd36","source_ip":"185.100.87.136","source_port":55902,"source_domain":"","country_code":"RO","country_name":"Romania","city_name":"Bucharest","asn_number":200651,"asn_org":"FlokiNET ehf","dest_port":443,"network_protocol":"","application_protocol":"","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":16,"dest_bytes":14,"network_bytes":30,"event_summary":"\u0010 \u0000\u0000BBBB����DAAA"} +{"timestamp":"2026-09-04T08:53:42","event_id":"761b5c3e-1c7d-46e0-88a3-10ca6a2b1dbe","source_ip":"185.100.87.136","source_port":50650,"source_domain":"","country_code":"RO","country_name":"Romania","city_name":"Bucharest","asn_number":200651,"asn_org":"FlokiNET ehf","dest_port":443,"network_protocol":"","application_protocol":"","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":16,"dest_bytes":14,"network_bytes":30,"event_summary":"\u0010 \u0000\u0000BBBB����DAAA"} +{"timestamp":"2026-09-04T04:44:38","event_id":"71c6a2df-8670-42d4-a879-3935ab56c3a9","source_ip":"185.100.87.136","source_port":46942,"source_domain":"","country_code":"RO","country_name":"Romania","city_name":"Bucharest","asn_number":200651,"asn_org":"FlokiNET ehf","dest_port":443,"network_protocol":"","application_protocol":"","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":16,"dest_bytes":14,"network_bytes":30,"event_summary":"\u0010 \u0000\u0000BBBB����DAAA"} +{"timestamp":"2026-09-03T23:55:20","event_id":"db098465-edfc-48e2-8ca3-a229ef8bc264","source_ip":"185.100.87.136","source_port":44996,"source_domain":"","country_code":"RO","country_name":"Romania","city_name":"Bucharest","asn_number":200651,"asn_org":"FlokiNET ehf","dest_port":443,"network_protocol":"","application_protocol":"http","http_method":"POST","user_agent":"SPARK COMMIT: 08059e95dacafe0bf6e5782f8e2c8ec9cd8c5a17","url_path":"/api/client/update?arch=amd64&commit=08059e95dacafe0bf6e5782f8e2c8ec9cd8c5a17&os=windows","url_domain":"","http_request_headers":"{\"accept-encoding\":\"gzip\",\"content-length\":\"384\",\"content-type\":\"application/octet-stream\",\"host\":\":443\",\"secret\":\"3de172c65c5204dbce4c985d6616ca6fbbf337be4ddd40746307af802fa510a2\",\"user-agent\":\"SPARK COMMIT: 08059e95dacafe0bf6e5782f8e2c8ec9cd8c5a17\"}","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"po11nn0600_c9506d37ac14","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":740,"dest_bytes":79,"network_bytes":819,"event_summary":""} +{"timestamp":"2026-09-03T23:55:19","event_id":"a32a59e6-6870-417b-9aa5-022304265cdd","source_ip":"185.100.87.136","source_port":44988,"source_domain":"","country_code":"RO","country_name":"Romania","city_name":"Bucharest","asn_number":200651,"asn_org":"FlokiNET ehf","dest_port":443,"network_protocol":"tls","application_protocol":"http","http_method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:104.71.6212.24) Gecko/25.2.4212.671 Firefox/2.0","url_path":"/","url_domain":"","http_request_headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:104.71.6212.24) Gecko/25.2.4212.671 Firefox/2.0\"}","ssh_client_hassh":"","tls_client_ja4":"t13i1909h2_9dc949149365_97f8aa674fd9","tls_client_ja3":"7c1e207beb00684bbbe144f1b0abe1d5","tls_client_version":"TLSv1.3","tls_client_cipher":"TLS_CHACHA20_POLY1305_SHA256","http_request_ja4h":"ge11nn0400_88d30a62b7ad","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":180,"dest_bytes":79,"network_bytes":259,"event_summary":""} +{"timestamp":"2026-09-03T23:45:20","event_id":"e71711cc-c103-4332-90ab-bc4a12635627","source_ip":"185.100.87.136","source_port":53482,"source_domain":"","country_code":"RO","country_name":"Romania","city_name":"Bucharest","asn_number":200651,"asn_org":"FlokiNET ehf","dest_port":443,"network_protocol":"","application_protocol":"http","http_method":"POST","user_agent":"SPARK COMMIT: 08059e95dacafe0bf6e5782f8e2c8ec9cd8c5a17","url_path":"/api/client/update?arch=amd64&commit=08059e95dacafe0bf6e5782f8e2c8ec9cd8c5a17&os=windows","url_domain":"","http_request_headers":"{\"accept-encoding\":\"gzip\",\"content-length\":\"384\",\"content-type\":\"application/octet-stream\",\"host\":\":443\",\"secret\":\"3de172c65c5204dbce4c985d6616ca6fbbf337be4ddd40746307af802fa510a2\",\"user-agent\":\"SPARK COMMIT: 08059e95dacafe0bf6e5782f8e2c8ec9cd8c5a17\"}","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"po11nn0600_c9506d37ac14","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":741,"dest_bytes":79,"network_bytes":820,"event_summary":""} +{"timestamp":"2026-09-03T23:45:20","event_id":"b6430ce7-8aa3-42ca-9c00-6e85c648367a","source_ip":"185.100.87.136","source_port":53470,"source_domain":"","country_code":"RO","country_name":"Romania","city_name":"Bucharest","asn_number":200651,"asn_org":"FlokiNET ehf","dest_port":443,"network_protocol":"tls","application_protocol":"http","http_method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:104.71.6212.24) Gecko/25.2.4212.671 Firefox/2.0","url_path":"/","url_domain":"","http_request_headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:104.71.6212.24) Gecko/25.2.4212.671 Firefox/2.0\"}","ssh_client_hassh":"","tls_client_ja4":"t13i1909h2_9dc949149365_97f8aa674fd9","tls_client_ja3":"7c1e207beb00684bbbe144f1b0abe1d5","tls_client_version":"TLSv1.3","tls_client_cipher":"TLS_CHACHA20_POLY1305_SHA256","http_request_ja4h":"ge11nn0400_88d30a62b7ad","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":181,"dest_bytes":79,"network_bytes":260,"event_summary":""} +{"timestamp":"2026-09-03T20:46:54","event_id":"d3d22cdf-65d5-4332-8537-4704fc4ddc3b","source_ip":"185.100.87.136","source_port":48684,"source_domain":"","country_code":"RO","country_name":"Romania","city_name":"Bucharest","asn_number":200651,"asn_org":"FlokiNET ehf","dest_port":443,"network_protocol":"","application_protocol":"http","http_method":"POST","user_agent":"SPARK COMMIT: 08059e95dacafe0bf6e5782f8e2c8ec9cd8c5a17","url_path":"/api/client/update?arch=amd64&commit=08059e95dacafe0bf6e5782f8e2c8ec9cd8c5a17&os=windows","url_domain":"","http_request_headers":"{\"accept-encoding\":\"gzip\",\"content-length\":\"384\",\"content-type\":\"application/octet-stream\",\"host\":\":443\",\"secret\":\"3de172c65c5204dbce4c985d6616ca6fbbf337be4ddd40746307af802fa510a2\",\"user-agent\":\"SPARK COMMIT: 08059e95dacafe0bf6e5782f8e2c8ec9cd8c5a17\"}","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"po11nn0600_c9506d37ac14","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":740,"dest_bytes":79,"network_bytes":819,"event_summary":""} +{"timestamp":"2026-09-03T20:46:53","event_id":"2eae9013-b353-4ea8-8b21-14e4e41c030e","source_ip":"185.100.87.136","source_port":53106,"source_domain":"","country_code":"RO","country_name":"Romania","city_name":"Bucharest","asn_number":200651,"asn_org":"FlokiNET ehf","dest_port":443,"network_protocol":"tls","application_protocol":"http","http_method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:104.71.6212.24) Gecko/25.2.4212.671 Firefox/2.0","url_path":"/","url_domain":"","http_request_headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:104.71.6212.24) Gecko/25.2.4212.671 Firefox/2.0\"}","ssh_client_hassh":"","tls_client_ja4":"t13i1909h2_9dc949149365_97f8aa674fd9","tls_client_ja3":"7c1e207beb00684bbbe144f1b0abe1d5","tls_client_version":"TLSv1.3","tls_client_cipher":"TLS_CHACHA20_POLY1305_SHA256","http_request_ja4h":"ge11nn0400_88d30a62b7ad","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":180,"dest_bytes":79,"network_bytes":259,"event_summary":""} +{"timestamp":"2026-09-03T01:16:18","event_id":"ab300e7e-dd77-42ed-95a3-357e941b432a","source_ip":"185.100.87.136","source_port":40120,"source_domain":"","country_code":"RO","country_name":"Romania","city_name":"Bucharest","asn_number":200651,"asn_org":"FlokiNET ehf","dest_port":443,"network_protocol":"","application_protocol":"","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":76,"dest_bytes":14,"network_bytes":90,"event_summary":"\u0012\u0000\u0000\u0000nwe7x7apiRuyIcBpzg.\u0000\u0000\u0000\u0000\u0000\u0000\u0000{�ZH�ZF������\u0003Z\u0007�3����*����N�@��4\\��4\u0012c�zb�o��"} +{"timestamp":"2026-09-03T01:00:41","event_id":"50cf017a-05d4-40ec-99ca-1ddc0326b02e","source_ip":"185.100.87.136","source_port":54278,"source_domain":"","country_code":"RO","country_name":"Romania","city_name":"Bucharest","asn_number":200651,"asn_org":"FlokiNET ehf","dest_port":443,"network_protocol":"","application_protocol":"","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":96,"dest_bytes":14,"network_bytes":110,"event_summary":"\u000f\u0000\u0000\u0000BVHNjUZCOseZTEuE\u0000\u0000\u0000\u0000\u0000\u0000\u0000�.��\u001b��\u001b�%\u001c��<�\u0015\u0002\u0018���\u001b<$n8'\u0018\f�hU��Y�XP�a\u0017'8>\n\u000b���tQ%�\u0006\u0005���p\rzE��!\u0011\r��"} +{"timestamp":"2026-09-03T00:54:40","event_id":"c40be23d-1aab-44be-996f-9c258edd5eec","source_ip":"185.100.87.136","source_port":52772,"source_domain":"","country_code":"RO","country_name":"Romania","city_name":"Bucharest","asn_number":200651,"asn_org":"FlokiNET ehf","dest_port":443,"network_protocol":"","application_protocol":"","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":111,"dest_bytes":14,"network_bytes":125,"event_summary":"\u0013\u0000\u0000\u0000OnznfoENhbZUQIe5YY3P\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u000b��{�\u0014����\u0001�\r�NG\u001e�����\u0012M]y��6��\u001a�N�+��\f6Rt(�v:��H�H�}\u00158tpjMZ\u0005\u0011T\u000b��AiM�X-9|\u0015E�\u001d�"} +{"timestamp":"2026-09-01T14:07:55","event_id":"915197c7-4b83-4885-b21c-d7e36cd1841e","source_ip":"185.100.87.136","source_port":42160,"source_domain":"","country_code":"RO","country_name":"Romania","city_name":"Bucharest","asn_number":200651,"asn_org":"FlokiNET ehf","dest_port":8443,"network_protocol":"","application_protocol":"http","http_method":"POST","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64)","url_path":"/api/checkin","url_domain":"","http_request_headers":"{\"cache-control\":\"no-cache\",\"content-length\":\"26\",\"content-type\":\"application/json\",\"host\":\":8443\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\"}","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"po11nn0500_e4a47a99f1ac","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":213,"dest_bytes":79,"network_bytes":292,"event_summary":""} +{"timestamp":"2026-09-01T12:52:23","event_id":"f4c8c13d-8813-42e0-8b5e-9aa1dc09332b","source_ip":"185.100.87.136","source_port":32786,"source_domain":"","country_code":"RO","country_name":"Romania","city_name":"Bucharest","asn_number":200651,"asn_org":"FlokiNET ehf","dest_port":8443,"network_protocol":"","application_protocol":"http","http_method":"POST","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64)","url_path":"/api/checkin","url_domain":"","http_request_headers":"{\"cache-control\":\"no-cache\",\"content-length\":\"26\",\"content-type\":\"application/json\",\"host\":\":8443\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\"}","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"po11nn0500_e4a47a99f1ac","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":214,"dest_bytes":79,"network_bytes":293,"event_summary":""} +{"timestamp":"2026-09-01T12:25:00","event_id":"5f816950-0f5b-49bc-a693-f5a07fea295c","source_ip":"185.100.87.136","source_port":58810,"source_domain":"","country_code":"RO","country_name":"Romania","city_name":"Bucharest","asn_number":200651,"asn_org":"FlokiNET ehf","dest_port":8443,"network_protocol":"","application_protocol":"http","http_method":"POST","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64)","url_path":"/api/checkin","url_domain":"","http_request_headers":"{\"cache-control\":\"no-cache\",\"content-length\":\"26\",\"content-type\":\"application/json\",\"host\":\":8443\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\"}","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"po11nn0500_e4a47a99f1ac","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":101000000,"source_bytes":213,"dest_bytes":79,"network_bytes":292,"event_summary":""} +{"timestamp":"2026-08-31T06:06:56","event_id":"7ae2542a-f64f-4c51-903f-b2274cc16211","source_ip":"185.100.87.136","source_port":47020,"source_domain":"","country_code":"RO","country_name":"Romania","city_name":"Bucharest","asn_number":200651,"asn_org":"FlokiNET ehf","dest_port":443,"network_protocol":"tls","application_protocol":"http","http_method":"GET","user_agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3 rv:3.0; eu-FR) AppleWebKit/533.4.2 (KHTML, like Gecko) Version/5.0.1 Safari/533.4.2","url_path":"/images/transparentpix.gif","url_domain":"","http_request_headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"\",\"user-agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3 rv:3.0; eu-FR) AppleWebKit/533.4.2 (KHTML, like Gecko) Version/5.0.1 Safari/533.4.2\"}","ssh_client_hassh":"","tls_client_ja4":"t13i1909h2_9dc949149365_97f8aa674fd9","tls_client_ja3":"7c1e207beb00684bbbe144f1b0abe1d5","tls_client_version":"TLSv1.3","tls_client_cipher":"TLS_CHACHA20_POLY1305_SHA256","http_request_ja4h":"ge11nn0400_88d30a62b7ad","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":243,"dest_bytes":79,"network_bytes":322,"event_summary":""} +{"timestamp":"2026-08-31T05:00:49","event_id":"32bde13b-d088-49bf-9f4b-c07080faae72","source_ip":"185.100.87.136","source_port":54264,"source_domain":"","country_code":"RO","country_name":"Romania","city_name":"Bucharest","asn_number":200651,"asn_org":"FlokiNET ehf","dest_port":443,"network_protocol":"tls","application_protocol":"http","http_method":"GET","user_agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3 rv:3.0; eu-FR) AppleWebKit/533.4.2 (KHTML, like Gecko) Version/5.0.1 Safari/533.4.2","url_path":"/images/transparentpix.gif","url_domain":"","http_request_headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"\",\"user-agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3 rv:3.0; eu-FR) AppleWebKit/533.4.2 (KHTML, like Gecko) Version/5.0.1 Safari/533.4.2\"}","ssh_client_hassh":"","tls_client_ja4":"t13i1909h2_9dc949149365_97f8aa674fd9","tls_client_ja3":"7c1e207beb00684bbbe144f1b0abe1d5","tls_client_version":"TLSv1.3","tls_client_cipher":"TLS_CHACHA20_POLY1305_SHA256","http_request_ja4h":"ge11nn0400_88d30a62b7ad","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":242,"dest_bytes":79,"network_bytes":321,"event_summary":""} +{"timestamp":"2026-08-31T01:12:02","event_id":"4486ee38-07be-4f89-af15-2474d6d06b49","source_ip":"185.100.87.136","source_port":41682,"source_domain":"","country_code":"RO","country_name":"Romania","city_name":"Bucharest","asn_number":200651,"asn_org":"FlokiNET ehf","dest_port":443,"network_protocol":"tls","application_protocol":"http","http_method":"GET","user_agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3 rv:3.0; eu-FR) AppleWebKit/533.4.2 (KHTML, like Gecko) Version/5.0.1 Safari/533.4.2","url_path":"/images/transparentpix.gif","url_domain":"","http_request_headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"\",\"user-agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3 rv:3.0; eu-FR) AppleWebKit/533.4.2 (KHTML, like Gecko) Version/5.0.1 Safari/533.4.2\"}","ssh_client_hassh":"","tls_client_ja4":"t13i1909h2_9dc949149365_97f8aa674fd9","tls_client_ja3":"7c1e207beb00684bbbe144f1b0abe1d5","tls_client_version":"TLSv1.3","tls_client_cipher":"TLS_CHACHA20_POLY1305_SHA256","http_request_ja4h":"ge11nn0400_88d30a62b7ad","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":242,"dest_bytes":79,"network_bytes":321,"event_summary":""} \ No newline at end of file diff --git a/kevlar/2026-09-07/honeylabs/events-AS202685.ndjson b/kevlar/2026-09-07/honeylabs/events-AS202685.ndjson new file mode 100644 index 0000000..e69de29 diff --git a/kevlar/2026-09-07/honeylabs/events-AS206728.ndjson b/kevlar/2026-09-07/honeylabs/events-AS206728.ndjson new file mode 100644 index 0000000..e69de29 diff --git a/kevlar/2026-09-07/honeylabs/events-AS209847.ndjson b/kevlar/2026-09-07/honeylabs/events-AS209847.ndjson new file mode 100644 index 0000000..e69de29 diff --git a/kevlar/2026-09-07/honeylabs/events-AS210644.ndjson b/kevlar/2026-09-07/honeylabs/events-AS210644.ndjson new file mode 100644 index 0000000..22757b9 --- /dev/null +++ b/kevlar/2026-09-07/honeylabs/events-AS210644.ndjson @@ -0,0 +1,51 @@ +{"timestamp":"2026-09-02T15:29:27","event_id":"51b8b9fc-93ad-4029-8e8a-4db45b57c40e","source_ip":"185.246.217.150","source_port":20284,"source_domain":"","country_code":"NL","country_name":"The Netherlands","city_name":"Amsterdam","asn_number":210644,"asn_org":"Aeza Group LLC","dest_port":443,"network_protocol":"tls","application_protocol":"http","http_method":"GET","user_agent":"libredtail-http","url_path":"/containers/json","url_domain":"","http_request_headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"host\":\":443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","ssh_client_hassh":"","tls_client_ja4":"t13i170900_5b57614c22b0_78e6aca7449b","tls_client_ja3":"052a5e65c3a64e860e1706b1de3c46a9","tls_client_version":"TLSv1.3","tls_client_cipher":"TLS_AES_128_GCM_SHA256","http_request_ja4h":"ge11nn0500_7992432eef13","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":49,"event_duration":10514000000,"source_bytes":19145,"dest_bytes":3920,"network_bytes":23065,"event_summary":""} +{"timestamp":"2026-09-02T15:29:27","event_id":"51b8b9fc-93ad-4029-8e8a-4db45b57c40e","source_ip":"185.246.217.150","source_port":20284,"source_domain":"","country_code":"NL","country_name":"The Netherlands","city_name":"Amsterdam","asn_number":210644,"asn_org":"Aeza Group LLC","dest_port":443,"network_protocol":"tls","application_protocol":"http","http_method":"GET","user_agent":"libredtail-http","url_path":"/index.php?lang=../../../../../../../../tmp/index1","url_domain":"","http_request_headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"host\":\":443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","ssh_client_hassh":"","tls_client_ja4":"t13i170900_5b57614c22b0_78e6aca7449b","tls_client_ja3":"052a5e65c3a64e860e1706b1de3c46a9","tls_client_version":"TLSv1.3","tls_client_cipher":"TLS_AES_128_GCM_SHA256","http_request_ja4h":"ge11nn0500_7992432eef13","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":48,"event_duration":10296000000,"source_bytes":18992,"dest_bytes":3840,"network_bytes":22832,"event_summary":""} +{"timestamp":"2026-09-02T15:29:27","event_id":"51b8b9fc-93ad-4029-8e8a-4db45b57c40e","source_ip":"185.246.217.150","source_port":20284,"source_domain":"","country_code":"NL","country_name":"The Netherlands","city_name":"Amsterdam","asn_number":210644,"asn_org":"Aeza Group LLC","dest_port":443,"network_protocol":"tls","application_protocol":"http","http_method":"GET","user_agent":"libredtail-http","url_path":"/index.php?lang=../../../../../../../../usr/local/lib/php/pearcmd&+config-create+/&/+/tmp/index1.php","url_domain":"","http_request_headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"host\":\":443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","ssh_client_hassh":"","tls_client_ja4":"t13i170900_5b57614c22b0_78e6aca7449b","tls_client_ja3":"052a5e65c3a64e860e1706b1de3c46a9","tls_client_version":"TLSv1.3","tls_client_cipher":"TLS_AES_128_GCM_SHA256","http_request_ja4h":"ge11nn0500_7992432eef13","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":47,"event_duration":10087000000,"source_bytes":18805,"dest_bytes":3760,"network_bytes":22565,"event_summary":""} +{"timestamp":"2026-09-02T15:29:27","event_id":"51b8b9fc-93ad-4029-8e8a-4db45b57c40e","source_ip":"185.246.217.150","source_port":20284,"source_domain":"","country_code":"NL","country_name":"The Netherlands","city_name":"Amsterdam","asn_number":210644,"asn_org":"Aeza Group LLC","dest_port":443,"network_protocol":"tls","application_protocol":"http","http_method":"GET","user_agent":"libredtail-http","url_path":"/public/index.php?s=/index/\\think\\app/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1][]=Hello","url_domain":"","http_request_headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"host\":\":443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","ssh_client_hassh":"","tls_client_ja4":"t13i170900_5b57614c22b0_78e6aca7449b","tls_client_ja3":"052a5e65c3a64e860e1706b1de3c46a9","tls_client_version":"TLSv1.3","tls_client_cipher":"TLS_AES_128_GCM_SHA256","http_request_ja4h":"ge11nn0500_7992432eef13","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":46,"event_duration":9865000000,"source_bytes":18548,"dest_bytes":3680,"network_bytes":22228,"event_summary":""} +{"timestamp":"2026-09-02T15:29:26","event_id":"51b8b9fc-93ad-4029-8e8a-4db45b57c40e","source_ip":"185.246.217.150","source_port":20284,"source_domain":"","country_code":"NL","country_name":"The Netherlands","city_name":"Amsterdam","asn_number":210644,"asn_org":"Aeza Group LLC","dest_port":443,"network_protocol":"tls","application_protocol":"http","http_method":"GET","user_agent":"libredtail-http","url_path":"/index.php?s=/index/\\think\\app/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1][]=Hello","url_domain":"","http_request_headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"host\":\":443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","ssh_client_hassh":"","tls_client_ja4":"t13i170900_5b57614c22b0_78e6aca7449b","tls_client_ja3":"052a5e65c3a64e860e1706b1de3c46a9","tls_client_version":"TLSv1.3","tls_client_cipher":"TLS_AES_128_GCM_SHA256","http_request_ja4h":"ge11nn0500_7992432eef13","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":45,"event_duration":9655000000,"source_bytes":18301,"dest_bytes":3600,"network_bytes":21901,"event_summary":""} +{"timestamp":"2026-09-02T15:29:26","event_id":"51b8b9fc-93ad-4029-8e8a-4db45b57c40e","source_ip":"185.246.217.150","source_port":20284,"source_domain":"","country_code":"NL","country_name":"The Netherlands","city_name":"Amsterdam","asn_number":210644,"asn_org":"Aeza Group LLC","dest_port":443,"network_protocol":"tls","application_protocol":"http","http_method":"GET","user_agent":"libredtail-http","url_path":"/app/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","url_domain":"","http_request_headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"content-length\":\"33\",\"content-type\":\"text/plain\",\"host\":\":443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","ssh_client_hassh":"","tls_client_ja4":"t13i170900_5b57614c22b0_78e6aca7449b","tls_client_ja3":"052a5e65c3a64e860e1706b1de3c46a9","tls_client_version":"TLSv1.3","tls_client_cipher":"TLS_AES_128_GCM_SHA256","http_request_ja4h":"ge11nn0700_3161ce9d7233","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":44,"event_duration":9446000000,"source_bytes":18061,"dest_bytes":3520,"network_bytes":21581,"event_summary":""} +{"timestamp":"2026-09-02T15:29:26","event_id":"51b8b9fc-93ad-4029-8e8a-4db45b57c40e","source_ip":"185.246.217.150","source_port":20284,"source_domain":"","country_code":"NL","country_name":"The Netherlands","city_name":"Amsterdam","asn_number":210644,"asn_org":"Aeza Group LLC","dest_port":443,"network_protocol":"tls","application_protocol":"http","http_method":"GET","user_agent":"libredtail-http","url_path":"/apps/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","url_domain":"","http_request_headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"content-length\":\"33\",\"content-type\":\"text/plain\",\"host\":\":443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","ssh_client_hassh":"","tls_client_ja4":"t13i170900_5b57614c22b0_78e6aca7449b","tls_client_ja3":"052a5e65c3a64e860e1706b1de3c46a9","tls_client_version":"TLSv1.3","tls_client_cipher":"TLS_AES_128_GCM_SHA256","http_request_ja4h":"ge11nn0700_3161ce9d7233","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":43,"event_duration":9236000000,"source_bytes":17790,"dest_bytes":3440,"network_bytes":21230,"event_summary":""} +{"timestamp":"2026-09-02T15:29:26","event_id":"51b8b9fc-93ad-4029-8e8a-4db45b57c40e","source_ip":"185.246.217.150","source_port":20284,"source_domain":"","country_code":"NL","country_name":"The Netherlands","city_name":"Amsterdam","asn_number":210644,"asn_org":"Aeza Group LLC","dest_port":443,"network_protocol":"tls","application_protocol":"http","http_method":"GET","user_agent":"libredtail-http","url_path":"/public/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","url_domain":"","http_request_headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"content-length\":\"33\",\"content-type\":\"text/plain\",\"host\":\":443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","ssh_client_hassh":"","tls_client_ja4":"t13i170900_5b57614c22b0_78e6aca7449b","tls_client_ja3":"052a5e65c3a64e860e1706b1de3c46a9","tls_client_version":"TLSv1.3","tls_client_cipher":"TLS_AES_128_GCM_SHA256","http_request_ja4h":"ge11nn0700_3161ce9d7233","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":42,"event_duration":9015000000,"source_bytes":17518,"dest_bytes":3360,"network_bytes":20878,"event_summary":""} +{"timestamp":"2026-09-02T15:29:25","event_id":"51b8b9fc-93ad-4029-8e8a-4db45b57c40e","source_ip":"185.246.217.150","source_port":20284,"source_domain":"","country_code":"NL","country_name":"The Netherlands","city_name":"Amsterdam","asn_number":210644,"asn_org":"Aeza Group LLC","dest_port":443,"network_protocol":"tls","application_protocol":"http","http_method":"GET","user_agent":"libredtail-http","url_path":"/panel/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","url_domain":"","http_request_headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"content-length\":\"33\",\"content-type\":\"text/plain\",\"host\":\":443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","ssh_client_hassh":"","tls_client_ja4":"t13i170900_5b57614c22b0_78e6aca7449b","tls_client_ja3":"052a5e65c3a64e860e1706b1de3c46a9","tls_client_version":"TLSv1.3","tls_client_cipher":"TLS_AES_128_GCM_SHA256","http_request_ja4h":"ge11nn0700_3161ce9d7233","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":41,"event_duration":8771000000,"source_bytes":17244,"dest_bytes":3280,"network_bytes":20524,"event_summary":""} +{"timestamp":"2026-09-02T15:29:25","event_id":"51b8b9fc-93ad-4029-8e8a-4db45b57c40e","source_ip":"185.246.217.150","source_port":20284,"source_domain":"","country_code":"NL","country_name":"The Netherlands","city_name":"Amsterdam","asn_number":210644,"asn_org":"Aeza Group LLC","dest_port":443,"network_protocol":"tls","application_protocol":"http","http_method":"GET","user_agent":"libredtail-http","url_path":"/workspace/drupal/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","url_domain":"","http_request_headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"content-length\":\"33\",\"content-type\":\"text/plain\",\"host\":\":443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","ssh_client_hassh":"","tls_client_ja4":"t13i170900_5b57614c22b0_78e6aca7449b","tls_client_ja3":"052a5e65c3a64e860e1706b1de3c46a9","tls_client_version":"TLSv1.3","tls_client_cipher":"TLS_AES_128_GCM_SHA256","http_request_ja4h":"ge11nn0700_3161ce9d7233","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":40,"event_duration":8551000000,"source_bytes":16971,"dest_bytes":3200,"network_bytes":20171,"event_summary":""} +{"timestamp":"2026-09-02T15:29:25","event_id":"51b8b9fc-93ad-4029-8e8a-4db45b57c40e","source_ip":"185.246.217.150","source_port":20284,"source_domain":"","country_code":"NL","country_name":"The Netherlands","city_name":"Amsterdam","asn_number":210644,"asn_org":"Aeza Group LLC","dest_port":443,"network_protocol":"tls","application_protocol":"http","http_method":"GET","user_agent":"libredtail-http","url_path":"/blog/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","url_domain":"","http_request_headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"content-length\":\"33\",\"content-type\":\"text/plain\",\"host\":\":443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","ssh_client_hassh":"","tls_client_ja4":"t13i170900_5b57614c22b0_78e6aca7449b","tls_client_ja3":"052a5e65c3a64e860e1706b1de3c46a9","tls_client_version":"TLSv1.3","tls_client_cipher":"TLS_AES_128_GCM_SHA256","http_request_ja4h":"ge11nn0700_3161ce9d7233","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":39,"event_duration":8329000000,"source_bytes":16687,"dest_bytes":3120,"network_bytes":19807,"event_summary":""} +{"timestamp":"2026-09-02T15:29:25","event_id":"51b8b9fc-93ad-4029-8e8a-4db45b57c40e","source_ip":"185.246.217.150","source_port":20284,"source_domain":"","country_code":"NL","country_name":"The Netherlands","city_name":"Amsterdam","asn_number":210644,"asn_org":"Aeza Group LLC","dest_port":443,"network_protocol":"tls","application_protocol":"http","http_method":"GET","user_agent":"libredtail-http","url_path":"/backup/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","url_domain":"","http_request_headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"content-length\":\"33\",\"content-type\":\"text/plain\",\"host\":\":443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","ssh_client_hassh":"","tls_client_ja4":"t13i170900_5b57614c22b0_78e6aca7449b","tls_client_ja3":"052a5e65c3a64e860e1706b1de3c46a9","tls_client_version":"TLSv1.3","tls_client_cipher":"TLS_AES_128_GCM_SHA256","http_request_ja4h":"ge11nn0700_3161ce9d7233","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":38,"event_duration":8110000000,"source_bytes":16415,"dest_bytes":3040,"network_bytes":19455,"event_summary":""} +{"timestamp":"2026-09-02T15:29:25","event_id":"51b8b9fc-93ad-4029-8e8a-4db45b57c40e","source_ip":"185.246.217.150","source_port":20284,"source_domain":"","country_code":"NL","country_name":"The Netherlands","city_name":"Amsterdam","asn_number":210644,"asn_org":"Aeza Group LLC","dest_port":443,"network_protocol":"tls","application_protocol":"http","http_method":"GET","user_agent":"libredtail-http","url_path":"/admin/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","url_domain":"","http_request_headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"content-length\":\"33\",\"content-type\":\"text/plain\",\"host\":\":443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","ssh_client_hassh":"","tls_client_ja4":"t13i170900_5b57614c22b0_78e6aca7449b","tls_client_ja3":"052a5e65c3a64e860e1706b1de3c46a9","tls_client_version":"TLSv1.3","tls_client_cipher":"TLS_AES_128_GCM_SHA256","http_request_ja4h":"ge11nn0700_3161ce9d7233","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":37,"event_duration":7894000000,"source_bytes":16141,"dest_bytes":2960,"network_bytes":19101,"event_summary":""} +{"timestamp":"2026-09-02T15:29:24","event_id":"51b8b9fc-93ad-4029-8e8a-4db45b57c40e","source_ip":"185.246.217.150","source_port":20284,"source_domain":"","country_code":"NL","country_name":"The Netherlands","city_name":"Amsterdam","asn_number":210644,"asn_org":"Aeza Group LLC","dest_port":443,"network_protocol":"tls","application_protocol":"http","http_method":"GET","user_agent":"libredtail-http","url_path":"/crm/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","url_domain":"","http_request_headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"content-length\":\"33\",\"content-type\":\"text/plain\",\"host\":\":443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","ssh_client_hassh":"","tls_client_ja4":"t13i170900_5b57614c22b0_78e6aca7449b","tls_client_ja3":"052a5e65c3a64e860e1706b1de3c46a9","tls_client_version":"TLSv1.3","tls_client_cipher":"TLS_AES_128_GCM_SHA256","http_request_ja4h":"ge11nn0700_3161ce9d7233","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":36,"event_duration":7678000000,"source_bytes":15868,"dest_bytes":2880,"network_bytes":18748,"event_summary":""} +{"timestamp":"2026-09-02T15:29:24","event_id":"51b8b9fc-93ad-4029-8e8a-4db45b57c40e","source_ip":"185.246.217.150","source_port":20284,"source_domain":"","country_code":"NL","country_name":"The Netherlands","city_name":"Amsterdam","asn_number":210644,"asn_org":"Aeza Group LLC","dest_port":443,"network_protocol":"tls","application_protocol":"http","http_method":"GET","user_agent":"libredtail-http","url_path":"/cms/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","url_domain":"","http_request_headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"content-length\":\"33\",\"content-type\":\"text/plain\",\"host\":\":443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","ssh_client_hassh":"","tls_client_ja4":"t13i170900_5b57614c22b0_78e6aca7449b","tls_client_ja3":"052a5e65c3a64e860e1706b1de3c46a9","tls_client_version":"TLSv1.3","tls_client_cipher":"TLS_AES_128_GCM_SHA256","http_request_ja4h":"ge11nn0700_3161ce9d7233","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":35,"event_duration":7469000000,"source_bytes":15597,"dest_bytes":2800,"network_bytes":18397,"event_summary":""} +{"timestamp":"2026-09-02T15:29:24","event_id":"51b8b9fc-93ad-4029-8e8a-4db45b57c40e","source_ip":"185.246.217.150","source_port":20284,"source_domain":"","country_code":"NL","country_name":"The Netherlands","city_name":"Amsterdam","asn_number":210644,"asn_org":"Aeza Group LLC","dest_port":443,"network_protocol":"tls","application_protocol":"http","http_method":"GET","user_agent":"libredtail-http","url_path":"/demo/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","url_domain":"","http_request_headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"content-length\":\"33\",\"content-type\":\"text/plain\",\"host\":\":443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","ssh_client_hassh":"","tls_client_ja4":"t13i170900_5b57614c22b0_78e6aca7449b","tls_client_ja3":"052a5e65c3a64e860e1706b1de3c46a9","tls_client_version":"TLSv1.3","tls_client_cipher":"TLS_AES_128_GCM_SHA256","http_request_ja4h":"ge11nn0700_3161ce9d7233","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":34,"event_duration":7253000000,"source_bytes":15326,"dest_bytes":2720,"network_bytes":18046,"event_summary":""} +{"timestamp":"2026-09-02T15:29:24","event_id":"51b8b9fc-93ad-4029-8e8a-4db45b57c40e","source_ip":"185.246.217.150","source_port":20284,"source_domain":"","country_code":"NL","country_name":"The Netherlands","city_name":"Amsterdam","asn_number":210644,"asn_org":"Aeza Group LLC","dest_port":443,"network_protocol":"tls","application_protocol":"http","http_method":"GET","user_agent":"libredtail-http","url_path":"/api/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","url_domain":"","http_request_headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"content-length\":\"33\",\"content-type\":\"text/plain\",\"host\":\":443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","ssh_client_hassh":"","tls_client_ja4":"t13i170900_5b57614c22b0_78e6aca7449b","tls_client_ja3":"052a5e65c3a64e860e1706b1de3c46a9","tls_client_version":"TLSv1.3","tls_client_cipher":"TLS_AES_128_GCM_SHA256","http_request_ja4h":"ge11nn0700_3161ce9d7233","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":33,"event_duration":7035000000,"source_bytes":15054,"dest_bytes":2640,"network_bytes":17694,"event_summary":""} +{"timestamp":"2026-09-02T15:29:23","event_id":"51b8b9fc-93ad-4029-8e8a-4db45b57c40e","source_ip":"185.246.217.150","source_port":20284,"source_domain":"","country_code":"NL","country_name":"The Netherlands","city_name":"Amsterdam","asn_number":210644,"asn_org":"Aeza Group LLC","dest_port":443,"network_protocol":"tls","application_protocol":"http","http_method":"GET","user_agent":"libredtail-http","url_path":"/testing/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","url_domain":"","http_request_headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"content-length\":\"33\",\"content-type\":\"text/plain\",\"host\":\":443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","ssh_client_hassh":"","tls_client_ja4":"t13i170900_5b57614c22b0_78e6aca7449b","tls_client_ja3":"052a5e65c3a64e860e1706b1de3c46a9","tls_client_version":"TLSv1.3","tls_client_cipher":"TLS_AES_128_GCM_SHA256","http_request_ja4h":"ge11nn0700_3161ce9d7233","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":32,"event_duration":6816000000,"source_bytes":14783,"dest_bytes":2560,"network_bytes":17343,"event_summary":""} +{"timestamp":"2026-09-02T15:29:23","event_id":"51b8b9fc-93ad-4029-8e8a-4db45b57c40e","source_ip":"185.246.217.150","source_port":20284,"source_domain":"","country_code":"NL","country_name":"The Netherlands","city_name":"Amsterdam","asn_number":210644,"asn_org":"Aeza Group LLC","dest_port":443,"network_protocol":"tls","application_protocol":"http","http_method":"GET","user_agent":"libredtail-http","url_path":"/test/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","url_domain":"","http_request_headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"content-length\":\"33\",\"content-type\":\"text/plain\",\"host\":\":443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","ssh_client_hassh":"","tls_client_ja4":"t13i170900_5b57614c22b0_78e6aca7449b","tls_client_ja3":"052a5e65c3a64e860e1706b1de3c46a9","tls_client_version":"TLSv1.3","tls_client_cipher":"TLS_AES_128_GCM_SHA256","http_request_ja4h":"ge11nn0700_3161ce9d7233","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":31,"event_duration":6608000000,"source_bytes":14508,"dest_bytes":2480,"network_bytes":16988,"event_summary":""} +{"timestamp":"2026-09-02T15:29:23","event_id":"51b8b9fc-93ad-4029-8e8a-4db45b57c40e","source_ip":"185.246.217.150","source_port":20284,"source_domain":"","country_code":"NL","country_name":"The Netherlands","city_name":"Amsterdam","asn_number":210644,"asn_org":"Aeza Group LLC","dest_port":443,"network_protocol":"tls","application_protocol":"http","http_method":"GET","user_agent":"libredtail-http","url_path":"/tests/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","url_domain":"","http_request_headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"content-length\":\"33\",\"content-type\":\"text/plain\",\"host\":\":443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","ssh_client_hassh":"","tls_client_ja4":"t13i170900_5b57614c22b0_78e6aca7449b","tls_client_ja3":"052a5e65c3a64e860e1706b1de3c46a9","tls_client_version":"TLSv1.3","tls_client_cipher":"TLS_AES_128_GCM_SHA256","http_request_ja4h":"ge11nn0700_3161ce9d7233","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":30,"event_duration":6394000000,"source_bytes":14236,"dest_bytes":2400,"network_bytes":16636,"event_summary":""} +{"timestamp":"2026-09-02T15:29:23","event_id":"51b8b9fc-93ad-4029-8e8a-4db45b57c40e","source_ip":"185.246.217.150","source_port":20284,"source_domain":"","country_code":"NL","country_name":"The Netherlands","city_name":"Amsterdam","asn_number":210644,"asn_org":"Aeza Group LLC","dest_port":443,"network_protocol":"tls","application_protocol":"http","http_method":"GET","user_agent":"libredtail-http","url_path":"/V2/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","url_domain":"","http_request_headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"content-length\":\"33\",\"content-type\":\"text/plain\",\"host\":\":443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","ssh_client_hassh":"","tls_client_ja4":"t13i170900_5b57614c22b0_78e6aca7449b","tls_client_ja3":"052a5e65c3a64e860e1706b1de3c46a9","tls_client_version":"TLSv1.3","tls_client_cipher":"TLS_AES_128_GCM_SHA256","http_request_ja4h":"ge11nn0700_3161ce9d7233","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":29,"event_duration":6191000000,"source_bytes":13963,"dest_bytes":2320,"network_bytes":16283,"event_summary":""} +{"timestamp":"2026-09-02T15:29:23","event_id":"51b8b9fc-93ad-4029-8e8a-4db45b57c40e","source_ip":"185.246.217.150","source_port":20284,"source_domain":"","country_code":"NL","country_name":"The Netherlands","city_name":"Amsterdam","asn_number":210644,"asn_org":"Aeza Group LLC","dest_port":443,"network_protocol":"tls","application_protocol":"http","http_method":"GET","user_agent":"libredtail-http","url_path":"/ws/ec/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","url_domain":"","http_request_headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"content-length\":\"33\",\"content-type\":\"text/plain\",\"host\":\":443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","ssh_client_hassh":"","tls_client_ja4":"t13i170900_5b57614c22b0_78e6aca7449b","tls_client_ja3":"052a5e65c3a64e860e1706b1de3c46a9","tls_client_version":"TLSv1.3","tls_client_cipher":"TLS_AES_128_GCM_SHA256","http_request_ja4h":"ge11nn0700_3161ce9d7233","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":28,"event_duration":5957000000,"source_bytes":13693,"dest_bytes":2240,"network_bytes":15933,"event_summary":""} +{"timestamp":"2026-09-02T15:29:22","event_id":"51b8b9fc-93ad-4029-8e8a-4db45b57c40e","source_ip":"185.246.217.150","source_port":20284,"source_domain":"","country_code":"NL","country_name":"The Netherlands","city_name":"Amsterdam","asn_number":210644,"asn_org":"Aeza Group LLC","dest_port":443,"network_protocol":"tls","application_protocol":"http","http_method":"GET","user_agent":"libredtail-http","url_path":"/zend/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","url_domain":"","http_request_headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"content-length\":\"33\",\"content-type\":\"text/plain\",\"host\":\":443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","ssh_client_hassh":"","tls_client_ja4":"t13i170900_5b57614c22b0_78e6aca7449b","tls_client_ja3":"052a5e65c3a64e860e1706b1de3c46a9","tls_client_version":"TLSv1.3","tls_client_cipher":"TLS_AES_128_GCM_SHA256","http_request_ja4h":"ge11nn0700_3161ce9d7233","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":27,"event_duration":5727000000,"source_bytes":13420,"dest_bytes":2160,"network_bytes":15580,"event_summary":""} +{"timestamp":"2026-09-02T15:29:22","event_id":"51b8b9fc-93ad-4029-8e8a-4db45b57c40e","source_ip":"185.246.217.150","source_port":20284,"source_domain":"","country_code":"NL","country_name":"The Netherlands","city_name":"Amsterdam","asn_number":210644,"asn_org":"Aeza Group LLC","dest_port":443,"network_protocol":"tls","application_protocol":"http","http_method":"GET","user_agent":"libredtail-http","url_path":"/yii/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","url_domain":"","http_request_headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"content-length\":\"33\",\"content-type\":\"text/plain\",\"host\":\":443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","ssh_client_hassh":"","tls_client_ja4":"t13i170900_5b57614c22b0_78e6aca7449b","tls_client_ja3":"052a5e65c3a64e860e1706b1de3c46a9","tls_client_version":"TLSv1.3","tls_client_cipher":"TLS_AES_128_GCM_SHA256","http_request_ja4h":"ge11nn0700_3161ce9d7233","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":26,"event_duration":5507000000,"source_bytes":13148,"dest_bytes":2080,"network_bytes":15228,"event_summary":""} +{"timestamp":"2026-09-02T15:29:22","event_id":"51b8b9fc-93ad-4029-8e8a-4db45b57c40e","source_ip":"185.246.217.150","source_port":20284,"source_domain":"","country_code":"NL","country_name":"The Netherlands","city_name":"Amsterdam","asn_number":210644,"asn_org":"Aeza Group LLC","dest_port":443,"network_protocol":"tls","application_protocol":"http","http_method":"GET","user_agent":"libredtail-http","url_path":"/ws/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","url_domain":"","http_request_headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"content-length\":\"33\",\"content-type\":\"text/plain\",\"host\":\":443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","ssh_client_hassh":"","tls_client_ja4":"t13i170900_5b57614c22b0_78e6aca7449b","tls_client_ja3":"052a5e65c3a64e860e1706b1de3c46a9","tls_client_version":"TLSv1.3","tls_client_cipher":"TLS_AES_128_GCM_SHA256","http_request_ja4h":"ge11nn0700_3161ce9d7233","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":25,"event_duration":5296000000,"source_bytes":12877,"dest_bytes":2000,"network_bytes":14877,"event_summary":""} +{"timestamp":"2026-09-02T15:29:22","event_id":"51b8b9fc-93ad-4029-8e8a-4db45b57c40e","source_ip":"185.246.217.150","source_port":20284,"source_domain":"","country_code":"NL","country_name":"The Netherlands","city_name":"Amsterdam","asn_number":210644,"asn_org":"Aeza Group LLC","dest_port":443,"network_protocol":"tls","application_protocol":"http","http_method":"GET","user_agent":"libredtail-http","url_path":"/www/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","url_domain":"","http_request_headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"content-length\":\"33\",\"content-type\":\"text/plain\",\"host\":\":443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","ssh_client_hassh":"","tls_client_ja4":"t13i170900_5b57614c22b0_78e6aca7449b","tls_client_ja3":"052a5e65c3a64e860e1706b1de3c46a9","tls_client_version":"TLSv1.3","tls_client_cipher":"TLS_AES_128_GCM_SHA256","http_request_ja4h":"ge11nn0700_3161ce9d7233","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":24,"event_duration":5067000000,"source_bytes":12607,"dest_bytes":1920,"network_bytes":14527,"event_summary":""} +{"timestamp":"2026-09-02T15:29:22","event_id":"51b8b9fc-93ad-4029-8e8a-4db45b57c40e","source_ip":"185.246.217.150","source_port":20284,"source_domain":"","country_code":"NL","country_name":"The Netherlands","city_name":"Amsterdam","asn_number":210644,"asn_org":"Aeza Group LLC","dest_port":443,"network_protocol":"tls","application_protocol":"http","http_method":"GET","user_agent":"libredtail-http","url_path":"/laravel/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","url_domain":"","http_request_headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"content-length\":\"33\",\"content-type\":\"text/plain\",\"host\":\":443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","ssh_client_hassh":"","tls_client_ja4":"t13i170900_5b57614c22b0_78e6aca7449b","tls_client_ja3":"052a5e65c3a64e860e1706b1de3c46a9","tls_client_version":"TLSv1.3","tls_client_cipher":"TLS_AES_128_GCM_SHA256","http_request_ja4h":"ge11nn0700_3161ce9d7233","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":23,"event_duration":4863000000,"source_bytes":12336,"dest_bytes":1840,"network_bytes":14176,"event_summary":""} +{"timestamp":"2026-09-02T15:29:21","event_id":"51b8b9fc-93ad-4029-8e8a-4db45b57c40e","source_ip":"185.246.217.150","source_port":20284,"source_domain":"","country_code":"NL","country_name":"The Netherlands","city_name":"Amsterdam","asn_number":210644,"asn_org":"Aeza Group LLC","dest_port":443,"network_protocol":"tls","application_protocol":"http","http_method":"GET","user_agent":"libredtail-http","url_path":"/lib/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","url_domain":"","http_request_headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"content-length\":\"33\",\"content-type\":\"text/plain\",\"host\":\":443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","ssh_client_hassh":"","tls_client_ja4":"t13i170900_5b57614c22b0_78e6aca7449b","tls_client_ja3":"052a5e65c3a64e860e1706b1de3c46a9","tls_client_version":"TLSv1.3","tls_client_cipher":"TLS_AES_128_GCM_SHA256","http_request_ja4h":"ge11nn0700_3161ce9d7233","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":22,"event_duration":4653000000,"source_bytes":12061,"dest_bytes":1760,"network_bytes":13821,"event_summary":""} +{"timestamp":"2026-09-02T15:29:21","event_id":"51b8b9fc-93ad-4029-8e8a-4db45b57c40e","source_ip":"185.246.217.150","source_port":20284,"source_domain":"","country_code":"NL","country_name":"The Netherlands","city_name":"Amsterdam","asn_number":210644,"asn_org":"Aeza Group LLC","dest_port":443,"network_protocol":"tls","application_protocol":"http","http_method":"GET","user_agent":"libredtail-http","url_path":"/lib/phpunit/Util/PHP/eval-stdin.php","url_domain":"","http_request_headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"content-length\":\"33\",\"content-type\":\"text/plain\",\"host\":\":443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","ssh_client_hassh":"","tls_client_ja4":"t13i170900_5b57614c22b0_78e6aca7449b","tls_client_ja3":"052a5e65c3a64e860e1706b1de3c46a9","tls_client_version":"TLSv1.3","tls_client_cipher":"TLS_AES_128_GCM_SHA256","http_request_ja4h":"ge11nn0700_3161ce9d7233","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":21,"event_duration":4439000000,"source_bytes":11790,"dest_bytes":1680,"network_bytes":13470,"event_summary":""} +{"timestamp":"2026-09-02T15:29:21","event_id":"51b8b9fc-93ad-4029-8e8a-4db45b57c40e","source_ip":"185.246.217.150","source_port":20284,"source_domain":"","country_code":"NL","country_name":"The Netherlands","city_name":"Amsterdam","asn_number":210644,"asn_org":"Aeza Group LLC","dest_port":443,"network_protocol":"tls","application_protocol":"http","http_method":"GET","user_agent":"libredtail-http","url_path":"/lib/phpunit/src/Util/PHP/eval-stdin.php","url_domain":"","http_request_headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"content-length\":\"33\",\"content-type\":\"text/plain\",\"host\":\":443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","ssh_client_hassh":"","tls_client_ja4":"t13i170900_5b57614c22b0_78e6aca7449b","tls_client_ja3":"052a5e65c3a64e860e1706b1de3c46a9","tls_client_version":"TLSv1.3","tls_client_cipher":"TLS_AES_128_GCM_SHA256","http_request_ja4h":"ge11nn0700_3161ce9d7233","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":20,"event_duration":4226000000,"source_bytes":11538,"dest_bytes":1600,"network_bytes":13138,"event_summary":""} +{"timestamp":"2026-09-02T15:29:21","event_id":"51b8b9fc-93ad-4029-8e8a-4db45b57c40e","source_ip":"185.246.217.150","source_port":20284,"source_domain":"","country_code":"NL","country_name":"The Netherlands","city_name":"Amsterdam","asn_number":210644,"asn_org":"Aeza Group LLC","dest_port":443,"network_protocol":"tls","application_protocol":"http","http_method":"GET","user_agent":"libredtail-http","url_path":"/lib/phpunit/phpunit/Util/PHP/eval-stdin.php","url_domain":"","http_request_headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"content-length\":\"33\",\"content-type\":\"text/plain\",\"host\":\":443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","ssh_client_hassh":"","tls_client_ja4":"t13i170900_5b57614c22b0_78e6aca7449b","tls_client_ja3":"052a5e65c3a64e860e1706b1de3c46a9","tls_client_version":"TLSv1.3","tls_client_cipher":"TLS_AES_128_GCM_SHA256","http_request_ja4h":"ge11nn0700_3161ce9d7233","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":19,"event_duration":4006000000,"source_bytes":11282,"dest_bytes":1520,"network_bytes":12802,"event_summary":""} +{"timestamp":"2026-09-02T15:29:20","event_id":"51b8b9fc-93ad-4029-8e8a-4db45b57c40e","source_ip":"185.246.217.150","source_port":20284,"source_domain":"","country_code":"NL","country_name":"The Netherlands","city_name":"Amsterdam","asn_number":210644,"asn_org":"Aeza Group LLC","dest_port":443,"network_protocol":"tls","application_protocol":"http","http_method":"GET","user_agent":"libredtail-http","url_path":"/lib/phpunit/phpunit/src/Util/PHP/eval-stdin.php","url_domain":"","http_request_headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"content-length\":\"33\",\"content-type\":\"text/plain\",\"host\":\":443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","ssh_client_hassh":"","tls_client_ja4":"t13i170900_5b57614c22b0_78e6aca7449b","tls_client_ja3":"052a5e65c3a64e860e1706b1de3c46a9","tls_client_version":"TLSv1.3","tls_client_cipher":"TLS_AES_128_GCM_SHA256","http_request_ja4h":"ge11nn0700_3161ce9d7233","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":18,"event_duration":3791000000,"source_bytes":11022,"dest_bytes":1440,"network_bytes":12462,"event_summary":""} +{"timestamp":"2026-09-02T15:29:20","event_id":"51b8b9fc-93ad-4029-8e8a-4db45b57c40e","source_ip":"185.246.217.150","source_port":20284,"source_domain":"","country_code":"NL","country_name":"The Netherlands","city_name":"Amsterdam","asn_number":210644,"asn_org":"Aeza Group LLC","dest_port":443,"network_protocol":"tls","application_protocol":"http","http_method":"GET","user_agent":"libredtail-http","url_path":"/phpunit/Util/PHP/eval-stdin.php","url_domain":"","http_request_headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"content-length\":\"33\",\"content-type\":\"text/plain\",\"host\":\":443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","ssh_client_hassh":"","tls_client_ja4":"t13i170900_5b57614c22b0_78e6aca7449b","tls_client_ja3":"052a5e65c3a64e860e1706b1de3c46a9","tls_client_version":"TLSv1.3","tls_client_cipher":"TLS_AES_128_GCM_SHA256","http_request_ja4h":"ge11nn0700_3161ce9d7233","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":17,"event_duration":3572000000,"source_bytes":10758,"dest_bytes":1360,"network_bytes":12118,"event_summary":""} +{"timestamp":"2026-09-02T15:29:20","event_id":"51b8b9fc-93ad-4029-8e8a-4db45b57c40e","source_ip":"185.246.217.150","source_port":20284,"source_domain":"","country_code":"NL","country_name":"The Netherlands","city_name":"Amsterdam","asn_number":210644,"asn_org":"Aeza Group LLC","dest_port":443,"network_protocol":"tls","application_protocol":"http","http_method":"GET","user_agent":"libredtail-http","url_path":"/phpunit/src/Util/PHP/eval-stdin.php","url_domain":"","http_request_headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"content-length\":\"33\",\"content-type\":\"text/plain\",\"host\":\":443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","ssh_client_hassh":"","tls_client_ja4":"t13i170900_5b57614c22b0_78e6aca7449b","tls_client_ja3":"052a5e65c3a64e860e1706b1de3c46a9","tls_client_version":"TLSv1.3","tls_client_cipher":"TLS_AES_128_GCM_SHA256","http_request_ja4h":"ge11nn0700_3161ce9d7233","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":16,"event_duration":3363000000,"source_bytes":10510,"dest_bytes":1280,"network_bytes":11790,"event_summary":""} +{"timestamp":"2026-09-02T15:29:20","event_id":"51b8b9fc-93ad-4029-8e8a-4db45b57c40e","source_ip":"185.246.217.150","source_port":20284,"source_domain":"","country_code":"NL","country_name":"The Netherlands","city_name":"Amsterdam","asn_number":210644,"asn_org":"Aeza Group LLC","dest_port":443,"network_protocol":"tls","application_protocol":"http","http_method":"GET","user_agent":"libredtail-http","url_path":"/phpunit/phpunit/Util/PHP/eval-stdin.php","url_domain":"","http_request_headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"content-length\":\"33\",\"content-type\":\"text/plain\",\"host\":\":443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","ssh_client_hassh":"","tls_client_ja4":"t13i170900_5b57614c22b0_78e6aca7449b","tls_client_ja3":"052a5e65c3a64e860e1706b1de3c46a9","tls_client_version":"TLSv1.3","tls_client_cipher":"TLS_AES_128_GCM_SHA256","http_request_ja4h":"ge11nn0700_3161ce9d7233","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":15,"event_duration":3150000000,"source_bytes":10258,"dest_bytes":1200,"network_bytes":11458,"event_summary":""} +{"timestamp":"2026-09-02T15:29:20","event_id":"51b8b9fc-93ad-4029-8e8a-4db45b57c40e","source_ip":"185.246.217.150","source_port":20284,"source_domain":"","country_code":"NL","country_name":"The Netherlands","city_name":"Amsterdam","asn_number":210644,"asn_org":"Aeza Group LLC","dest_port":443,"network_protocol":"tls","application_protocol":"http","http_method":"GET","user_agent":"libredtail-http","url_path":"/phpunit/phpunit/src/Util/PHP/eval-stdin.php","url_domain":"","http_request_headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"content-length\":\"33\",\"content-type\":\"text/plain\",\"host\":\":443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","ssh_client_hassh":"","tls_client_ja4":"t13i170900_5b57614c22b0_78e6aca7449b","tls_client_ja3":"052a5e65c3a64e860e1706b1de3c46a9","tls_client_version":"TLSv1.3","tls_client_cipher":"TLS_AES_128_GCM_SHA256","http_request_ja4h":"ge11nn0700_3161ce9d7233","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":14,"event_duration":2935000000,"source_bytes":10002,"dest_bytes":1120,"network_bytes":11122,"event_summary":""} +{"timestamp":"2026-09-02T15:29:19","event_id":"51b8b9fc-93ad-4029-8e8a-4db45b57c40e","source_ip":"185.246.217.150","source_port":20284,"source_domain":"","country_code":"NL","country_name":"The Netherlands","city_name":"Amsterdam","asn_number":210644,"asn_org":"Aeza Group LLC","dest_port":443,"network_protocol":"tls","application_protocol":"http","http_method":"GET","user_agent":"libredtail-http","url_path":"/vendor/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","url_domain":"","http_request_headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"content-length\":\"33\",\"content-type\":\"text/plain\",\"host\":\":443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","ssh_client_hassh":"","tls_client_ja4":"t13i170900_5b57614c22b0_78e6aca7449b","tls_client_ja3":"052a5e65c3a64e860e1706b1de3c46a9","tls_client_version":"TLSv1.3","tls_client_cipher":"TLS_AES_128_GCM_SHA256","http_request_ja4h":"ge11nn0700_3161ce9d7233","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":13,"event_duration":2708000000,"source_bytes":9742,"dest_bytes":1040,"network_bytes":10782,"event_summary":""} +{"timestamp":"2026-09-02T15:29:19","event_id":"51b8b9fc-93ad-4029-8e8a-4db45b57c40e","source_ip":"185.246.217.150","source_port":20284,"source_domain":"","country_code":"NL","country_name":"The Netherlands","city_name":"Amsterdam","asn_number":210644,"asn_org":"Aeza Group LLC","dest_port":443,"network_protocol":"tls","application_protocol":"http","http_method":"GET","user_agent":"libredtail-http","url_path":"/vendor/phpunit/phpunit/LICENSE/eval-stdin.php","url_domain":"","http_request_headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"content-length\":\"33\",\"content-type\":\"text/plain\",\"host\":\":443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","ssh_client_hassh":"","tls_client_ja4":"t13i170900_5b57614c22b0_78e6aca7449b","tls_client_ja3":"052a5e65c3a64e860e1706b1de3c46a9","tls_client_version":"TLSv1.3","tls_client_cipher":"TLS_AES_128_GCM_SHA256","http_request_ja4h":"ge11nn0700_3161ce9d7233","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":12,"event_duration":2485000000,"source_bytes":9468,"dest_bytes":960,"network_bytes":10428,"event_summary":""} +{"timestamp":"2026-09-02T15:29:19","event_id":"51b8b9fc-93ad-4029-8e8a-4db45b57c40e","source_ip":"185.246.217.150","source_port":20284,"source_domain":"","country_code":"NL","country_name":"The Netherlands","city_name":"Amsterdam","asn_number":210644,"asn_org":"Aeza Group LLC","dest_port":443,"network_protocol":"tls","application_protocol":"http","http_method":"GET","user_agent":"libredtail-http","url_path":"/vendor/phpunit/Util/PHP/eval-stdin.php","url_domain":"","http_request_headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"content-length\":\"33\",\"content-type\":\"text/plain\",\"host\":\":443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","ssh_client_hassh":"","tls_client_ja4":"t13i170900_5b57614c22b0_78e6aca7449b","tls_client_ja3":"052a5e65c3a64e860e1706b1de3c46a9","tls_client_version":"TLSv1.3","tls_client_cipher":"TLS_AES_128_GCM_SHA256","http_request_ja4h":"ge11nn0700_3161ce9d7233","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":11,"event_duration":2258000000,"source_bytes":9206,"dest_bytes":880,"network_bytes":10086,"event_summary":""} +{"timestamp":"2026-09-02T15:29:19","event_id":"51b8b9fc-93ad-4029-8e8a-4db45b57c40e","source_ip":"185.246.217.150","source_port":20284,"source_domain":"","country_code":"NL","country_name":"The Netherlands","city_name":"Amsterdam","asn_number":210644,"asn_org":"Aeza Group LLC","dest_port":443,"network_protocol":"tls","application_protocol":"http","http_method":"GET","user_agent":"libredtail-http","url_path":"/vendor/phpunit/src/Util/PHP/eval-stdin.php","url_domain":"","http_request_headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"content-length\":\"33\",\"content-type\":\"text/plain\",\"host\":\":443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","ssh_client_hassh":"","tls_client_ja4":"t13i170900_5b57614c22b0_78e6aca7449b","tls_client_ja3":"052a5e65c3a64e860e1706b1de3c46a9","tls_client_version":"TLSv1.3","tls_client_cipher":"TLS_AES_128_GCM_SHA256","http_request_ja4h":"ge11nn0700_3161ce9d7233","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":10,"event_duration":2036000000,"source_bytes":8951,"dest_bytes":800,"network_bytes":9751,"event_summary":""} +{"timestamp":"2026-09-02T15:29:19","event_id":"51b8b9fc-93ad-4029-8e8a-4db45b57c40e","source_ip":"185.246.217.150","source_port":20284,"source_domain":"","country_code":"NL","country_name":"The Netherlands","city_name":"Amsterdam","asn_number":210644,"asn_org":"Aeza Group LLC","dest_port":443,"network_protocol":"tls","application_protocol":"http","http_method":"GET","user_agent":"libredtail-http","url_path":"/vendor/phpunit/phpunit/Util/PHP/eval-stdin.php","url_domain":"","http_request_headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"content-length\":\"33\",\"content-type\":\"text/plain\",\"host\":\":443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","ssh_client_hassh":"","tls_client_ja4":"t13i170900_5b57614c22b0_78e6aca7449b","tls_client_ja3":"052a5e65c3a64e860e1706b1de3c46a9","tls_client_version":"TLSv1.3","tls_client_cipher":"TLS_AES_128_GCM_SHA256","http_request_ja4h":"ge11nn0700_3161ce9d7233","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":9,"event_duration":1830000000,"source_bytes":8692,"dest_bytes":720,"network_bytes":9412,"event_summary":""} +{"timestamp":"2026-09-02T15:29:18","event_id":"51b8b9fc-93ad-4029-8e8a-4db45b57c40e","source_ip":"185.246.217.150","source_port":20284,"source_domain":"","country_code":"NL","country_name":"The Netherlands","city_name":"Amsterdam","asn_number":210644,"asn_org":"Aeza Group LLC","dest_port":443,"network_protocol":"tls","application_protocol":"http","http_method":"GET","user_agent":"libredtail-http","url_path":"/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","url_domain":"","http_request_headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"content-length\":\"33\",\"content-type\":\"text/plain\",\"host\":\":443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","ssh_client_hassh":"","tls_client_ja4":"t13i170900_5b57614c22b0_78e6aca7449b","tls_client_ja3":"052a5e65c3a64e860e1706b1de3c46a9","tls_client_version":"TLSv1.3","tls_client_cipher":"TLS_AES_128_GCM_SHA256","http_request_ja4h":"ge11nn0700_3161ce9d7233","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":8,"event_duration":1609000000,"source_bytes":8429,"dest_bytes":640,"network_bytes":9069,"event_summary":""} +{"timestamp":"2026-09-02T15:29:18","event_id":"51b8b9fc-93ad-4029-8e8a-4db45b57c40e","source_ip":"185.246.217.150","source_port":20284,"source_domain":"","country_code":"NL","country_name":"The Netherlands","city_name":"Amsterdam","asn_number":210644,"asn_org":"Aeza Group LLC","dest_port":443,"network_protocol":"tls","application_protocol":"http","http_method":"POST","user_agent":"libredtail-http","url_path":"/index.php?-d+allow_url_include%3don+-d+auto_prepend_file%3dphp%3a//input","url_domain":"","http_request_headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"content-length\":\"1193\",\"content-type\":\"application/x-www-form-urlencoded\",\"host\":\":443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","ssh_client_hassh":"","tls_client_ja4":"t13i170900_5b57614c22b0_78e6aca7449b","tls_client_ja3":"052a5e65c3a64e860e1706b1de3c46a9","tls_client_version":"TLSv1.3","tls_client_cipher":"TLS_AES_128_GCM_SHA256","http_request_ja4h":"po11nn0700_3161ce9d7233","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":7,"event_duration":1402000000,"source_bytes":8162,"dest_bytes":560,"network_bytes":8722,"event_summary":""} +{"timestamp":"2026-09-02T15:29:18","event_id":"51b8b9fc-93ad-4029-8e8a-4db45b57c40e","source_ip":"185.246.217.150","source_port":20284,"source_domain":"","country_code":"NL","country_name":"The Netherlands","city_name":"Amsterdam","asn_number":210644,"asn_org":"Aeza Group LLC","dest_port":443,"network_protocol":"tls","application_protocol":"http","http_method":"POST","user_agent":"libredtail-http","url_path":"/test.hello?%25ADd+allow_url_include%3D1+%25ADd+auto_prepend_file%3Dphp://input","url_domain":"","http_request_headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"content-length\":\"1193\",\"content-type\":\"application/x-www-form-urlencoded\",\"host\":\":443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","ssh_client_hassh":"","tls_client_ja4":"t13i170900_5b57614c22b0_78e6aca7449b","tls_client_ja3":"052a5e65c3a64e860e1706b1de3c46a9","tls_client_version":"TLSv1.3","tls_client_cipher":"TLS_AES_128_GCM_SHA256","http_request_ja4h":"po11nn0700_3161ce9d7233","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":6,"event_duration":1193000000,"source_bytes":6687,"dest_bytes":480,"network_bytes":7167,"event_summary":""} +{"timestamp":"2026-09-02T15:29:18","event_id":"51b8b9fc-93ad-4029-8e8a-4db45b57c40e","source_ip":"185.246.217.150","source_port":20284,"source_domain":"","country_code":"NL","country_name":"The Netherlands","city_name":"Amsterdam","asn_number":210644,"asn_org":"Aeza Group LLC","dest_port":443,"network_protocol":"tls","application_protocol":"http","http_method":"POST","user_agent":"libredtail-http","url_path":"/index.php?%25ADd+allow_url_include%3D1+%25ADd+auto_prepend_file%3Dphp://input","url_domain":"","http_request_headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"content-length\":\"1193\",\"content-type\":\"application/x-www-form-urlencoded\",\"host\":\":443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","ssh_client_hassh":"","tls_client_ja4":"t13i170900_5b57614c22b0_78e6aca7449b","tls_client_ja3":"052a5e65c3a64e860e1706b1de3c46a9","tls_client_version":"TLSv1.3","tls_client_cipher":"TLS_AES_128_GCM_SHA256","http_request_ja4h":"po11nn0700_3161ce9d7233","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":5,"event_duration":981000000,"source_bytes":5206,"dest_bytes":400,"network_bytes":5606,"event_summary":""} +{"timestamp":"2026-09-02T15:29:17","event_id":"51b8b9fc-93ad-4029-8e8a-4db45b57c40e","source_ip":"185.246.217.150","source_port":20284,"source_domain":"","country_code":"NL","country_name":"The Netherlands","city_name":"Amsterdam","asn_number":210644,"asn_org":"Aeza Group LLC","dest_port":443,"network_protocol":"tls","application_protocol":"http","http_method":"POST","user_agent":"libredtail-http","url_path":"/?%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input","url_domain":"","http_request_headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"content-length\":\"1193\",\"content-type\":\"application/x-www-form-urlencoded\",\"host\":\":443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","ssh_client_hassh":"","tls_client_ja4":"t13i170900_5b57614c22b0_78e6aca7449b","tls_client_ja3":"052a5e65c3a64e860e1706b1de3c46a9","tls_client_version":"TLSv1.3","tls_client_cipher":"TLS_AES_128_GCM_SHA256","http_request_ja4h":"po11nn0700_3161ce9d7233","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":4,"event_duration":762000000,"source_bytes":3726,"dest_bytes":320,"network_bytes":4046,"event_summary":""} +{"timestamp":"2026-09-02T15:29:17","event_id":"51b8b9fc-93ad-4029-8e8a-4db45b57c40e","source_ip":"185.246.217.150","source_port":20284,"source_domain":"","country_code":"NL","country_name":"The Netherlands","city_name":"Amsterdam","asn_number":210644,"asn_org":"Aeza Group LLC","dest_port":443,"network_protocol":"tls","application_protocol":"http","http_method":"POST","user_agent":"libredtail-http","url_path":"/hello.world?%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input","url_domain":"","http_request_headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"content-length\":\"1193\",\"content-type\":\"application/x-www-form-urlencoded\",\"host\":\":443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","ssh_client_hassh":"","tls_client_ja4":"t13i170900_5b57614c22b0_78e6aca7449b","tls_client_ja3":"052a5e65c3a64e860e1706b1de3c46a9","tls_client_version":"TLSv1.3","tls_client_cipher":"TLS_AES_128_GCM_SHA256","http_request_ja4h":"po11nn0700_3161ce9d7233","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":3,"event_duration":546000000,"source_bytes":2259,"dest_bytes":240,"network_bytes":2499,"event_summary":""} +{"timestamp":"2026-09-02T15:29:17","event_id":"51b8b9fc-93ad-4029-8e8a-4db45b57c40e","source_ip":"185.246.217.150","source_port":20284,"source_domain":"","country_code":"NL","country_name":"The Netherlands","city_name":"Amsterdam","asn_number":210644,"asn_org":"Aeza Group LLC","dest_port":443,"network_protocol":"tls","application_protocol":"http","http_method":"POST","user_agent":"libredtail-http","url_path":"/cgi-bin/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/bin/sh","url_domain":"","http_request_headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"content-length\":\"113\",\"content-type\":\"text/plain\",\"host\":\":443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","ssh_client_hassh":"","tls_client_ja4":"t13i170900_5b57614c22b0_78e6aca7449b","tls_client_ja3":"052a5e65c3a64e860e1706b1de3c46a9","tls_client_version":"TLSv1.3","tls_client_cipher":"TLS_AES_128_GCM_SHA256","http_request_ja4h":"po11nn0700_3161ce9d7233","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":2,"event_duration":334000000,"source_bytes":781,"dest_bytes":160,"network_bytes":941,"event_summary":""} +{"timestamp":"2026-09-02T15:29:17","event_id":"51b8b9fc-93ad-4029-8e8a-4db45b57c40e","source_ip":"185.246.217.150","source_port":20284,"source_domain":"","country_code":"NL","country_name":"The Netherlands","city_name":"Amsterdam","asn_number":210644,"asn_org":"Aeza Group LLC","dest_port":443,"network_protocol":"tls","application_protocol":"http","http_method":"POST","user_agent":"libredtail-http","url_path":"/cgi-bin/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/bin/sh","url_domain":"","http_request_headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"content-length\":\"113\",\"content-type\":\"text/plain\",\"host\":\":443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","ssh_client_hassh":"","tls_client_ja4":"t13i170900_5b57614c22b0_78e6aca7449b","tls_client_ja3":"052a5e65c3a64e860e1706b1de3c46a9","tls_client_version":"TLSv1.3","tls_client_cipher":"TLS_AES_128_GCM_SHA256","http_request_ja4h":"po11nn0700_3161ce9d7233","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":363,"dest_bytes":80,"network_bytes":443,"event_summary":""} +{"timestamp":"2026-09-01T23:24:45","event_id":"1a3b2108-0dc1-453f-9079-e1a5b2ff49a6","source_ip":"185.246.217.150","source_port":13054,"source_domain":"","country_code":"NL","country_name":"The Netherlands","city_name":"Amsterdam","asn_number":210644,"asn_org":"Aeza Group LLC","dest_port":2222,"network_protocol":"","application_protocol":"ssh","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"19532158b559096b89b1a5f7d17175b2","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":136000000,"source_bytes":1536,"dest_bytes":15,"network_bytes":1551,"event_summary":"SSH-2.0-libssh2_1.11.1\r\n\u0000\u0000\u0005�\u000b\u0014��\u001cj�\t��CP�D��0�\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com\u0000\u0000\u0001fecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ssh-ed25519,ssh-ed25519-cert-v01@openssh.com,rsa-sha2-512,rsa-sha2-256,rsa-sha2-512-cert-v01@openssh.com,rsa-sha2-256-cert-v01@openssh.com,ssh-rsa,ssh-rsa-cert-v01@openssh.com\u0000\u0000\u0000�chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,arcfour128,arcfour,3des-cbc\u0000\u0000\u0000�chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,arcfour128,arcfour,3des-cbc\u0000\u0000\u0000�hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96\u0000\u0000\u0000�hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96\u0000\u0000\u0000\u0004none\u0000\u0000\u0000\u0004none\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000��\u0001s;�)�S\u0004�"} +{"timestamp":"2026-08-31T22:44:34","event_id":"3e3b6543-22ba-47ce-8746-3665d3c34f27","source_ip":"185.246.217.150","source_port":31990,"source_domain":"","country_code":"NL","country_name":"The Netherlands","city_name":"Amsterdam","asn_number":210644,"asn_org":"Aeza Group LLC","dest_port":2375,"network_protocol":"","application_protocol":"http","http_method":"GET","user_agent":"libredtail-http","url_path":"/containers/json","url_domain":"","http_request_headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"host\":\":2375\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"ge11nn0500_3012a89e1aee","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":154,"dest_bytes":80,"network_bytes":234,"event_summary":""} \ No newline at end of file diff --git a/kevlar/2026-09-07/honeylabs/events-AS211720.ndjson b/kevlar/2026-09-07/honeylabs/events-AS211720.ndjson new file mode 100644 index 0000000..e69de29 diff --git a/kevlar/2026-09-07/honeylabs/events-AS213702.ndjson b/kevlar/2026-09-07/honeylabs/events-AS213702.ndjson new file mode 100644 index 0000000..e69de29 diff --git a/kevlar/2026-09-07/honeylabs/events-AS214351.ndjson b/kevlar/2026-09-07/honeylabs/events-AS214351.ndjson new file mode 100644 index 0000000..e69de29 diff --git a/kevlar/2026-09-07/honeylabs/events-AS214940.ndjson b/kevlar/2026-09-07/honeylabs/events-AS214940.ndjson new file mode 100644 index 0000000..e69de29 diff --git a/kevlar/2026-09-07/honeylabs/events-AS216139.ndjson b/kevlar/2026-09-07/honeylabs/events-AS216139.ndjson new file mode 100644 index 0000000..e69de29 diff --git a/kevlar/2026-09-07/honeylabs/events-AS216246.ndjson b/kevlar/2026-09-07/honeylabs/events-AS216246.ndjson new file mode 100644 index 0000000..62f74df --- /dev/null +++ b/kevlar/2026-09-07/honeylabs/events-AS216246.ndjson @@ -0,0 +1,2 @@ +{"timestamp":"2026-09-03T20:05:03","event_id":"b177bb95-06e3-4c45-8713-3db77a154ce9","source_ip":"45.151.101.38","source_port":36904,"source_domain":"","country_code":"RU","country_name":"Russia","city_name":"Moscow","asn_number":216246,"asn_org":"Aeza Group LLC","dest_port":8006,"network_protocol":"tls","application_protocol":"http","http_method":"POST","user_agent":"Python-urllib/3.10","url_path":"/api2/json/access/ticket","url_domain":"","http_request_headers":"{\"accept-encoding\":\"identity\",\"connection\":\"close\",\"content-length\":\"48\",\"content-type\":\"application/x-www-form-urlencoded\",\"host\":\":8006\",\"user-agent\":\"Python-urllib/3.10\"}","ssh_client_hassh":"","tls_client_ja4":"t13i181000_85036bcba153_d41ae481755e","tls_client_ja3":"8a9d5d0f12f7d43ee3af1c51d2998d99","tls_client_version":"TLSv1.3","tls_client_cipher":"TLS_AES_128_GCM_SHA256","http_request_ja4h":"po11nn0600_def5433ae821","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":101000000,"source_bytes":263,"dest_bytes":78,"network_bytes":341,"event_summary":""} +{"timestamp":"2026-08-31T13:15:24","event_id":"433ef92e-cd2f-4ef0-8ae0-fc11b23ec8c4","source_ip":"176.124.222.61","source_port":57138,"source_domain":"","country_code":"RU","country_name":"Russia","city_name":"Moscow","asn_number":216246,"asn_org":"Aeza Group LLC","dest_port":5432,"network_protocol":"","application_protocol":"","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":8,"dest_bytes":14,"network_bytes":22,"event_summary":"\u0000\u0000\u0000\b\u0004�\u0016/"} \ No newline at end of file diff --git a/kevlar/2026-09-07/honeylabs/events-AS216309.ndjson b/kevlar/2026-09-07/honeylabs/events-AS216309.ndjson new file mode 100644 index 0000000..e69de29 diff --git a/kevlar/2026-09-07/honeylabs/events-AS30823.ndjson b/kevlar/2026-09-07/honeylabs/events-AS30823.ndjson new file mode 100644 index 0000000..e69de29 diff --git a/kevlar/2026-09-07/honeylabs/events-AS33993.ndjson b/kevlar/2026-09-07/honeylabs/events-AS33993.ndjson new file mode 100644 index 0000000..e69de29 diff --git a/kevlar/2026-09-07/honeylabs/events-AS394711.ndjson b/kevlar/2026-09-07/honeylabs/events-AS394711.ndjson new file mode 100644 index 0000000..e69de29 diff --git a/kevlar/2026-09-07/honeylabs/events-AS400992.ndjson b/kevlar/2026-09-07/honeylabs/events-AS400992.ndjson new file mode 100644 index 0000000..e69de29 diff --git a/kevlar/2026-09-07/honeylabs/events-AS51396.ndjson b/kevlar/2026-09-07/honeylabs/events-AS51396.ndjson new file mode 100644 index 0000000..379893d --- /dev/null +++ b/kevlar/2026-09-07/honeylabs/events-AS51396.ndjson @@ -0,0 +1,100 @@ +{"timestamp":"2026-09-06T23:58:26","event_id":"f49daf0c-c56d-456a-b59a-cdee44ac673d","source_ip":"176.65.149.27","source_port":54702,"source_domain":"176.65.149.27.ptr.pfcloud.network","country_code":"NL","country_name":"The Netherlands","city_name":"Eygelshoven","asn_number":51396,"asn_org":"Pfcloud UG (haftungsbeschrankt)","dest_port":38049,"network_protocol":"","application_protocol":"ssh","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":109000000,"source_bytes":17,"dest_bytes":13,"network_bytes":30,"event_summary":"SSH-2.0-OpenSSH\r\n"} +{"timestamp":"2026-09-06T23:57:44","event_id":"39a8ab9e-a97d-45f2-b363-9d51b4974f63","source_ip":"204.76.203.221","source_port":40742,"source_domain":"204.76.203.221.ptr.pfcloud.network","country_code":"NL","country_name":"The Netherlands","city_name":"Eygelshoven","asn_number":51396,"asn_org":"Pfcloud UG (haftungsbeschrankt)","dest_port":1897,"network_protocol":"","application_protocol":"socks5","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":3,"dest_bytes":14,"network_bytes":17,"event_summary":"\u0005\u0001\u0000"} +{"timestamp":"2026-09-06T23:57:44","event_id":"84919345-adc4-4130-a728-449c9f1ae840","source_ip":"204.76.203.214","source_port":42142,"source_domain":"204.76.203.214.ptr.pfcloud.network","country_code":"NL","country_name":"The Netherlands","city_name":"Eygelshoven","asn_number":51396,"asn_org":"Pfcloud UG (haftungsbeschrankt)","dest_port":1897,"network_protocol":"","application_protocol":"http_connect","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":102000000,"source_bytes":67,"dest_bytes":14,"network_bytes":81,"event_summary":"CONNECT api64.ipify.org:443 HTTP/1.1\r\nHost: api64.ipify.org:443\r\n\r\n"} +{"timestamp":"2026-09-06T23:57:28","event_id":"205db62f-b023-432e-9cc5-1e6ec3914b36","source_ip":"204.76.203.221","source_port":50488,"source_domain":"204.76.203.221.ptr.pfcloud.network","country_code":"NL","country_name":"The Netherlands","city_name":"Eygelshoven","asn_number":51396,"asn_org":"Pfcloud UG (haftungsbeschrankt)","dest_port":5107,"network_protocol":"","application_protocol":"http_connect","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":63,"dest_bytes":14,"network_bytes":77,"event_summary":"CONNECT icanhazip.com:443 HTTP/1.1\r\nHost: icanhazip.com:443\r\n\r\n"} +{"timestamp":"2026-09-06T23:57:28","event_id":"0f2d761c-ab56-4191-b040-edcb9631793e","source_ip":"204.76.203.214","source_port":24452,"source_domain":"204.76.203.214.ptr.pfcloud.network","country_code":"NL","country_name":"The Netherlands","city_name":"Eygelshoven","asn_number":51396,"asn_org":"Pfcloud UG (haftungsbeschrankt)","dest_port":5107,"network_protocol":"","application_protocol":"socks5","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":103000000,"source_bytes":3,"dest_bytes":14,"network_bytes":17,"event_summary":"\u0005\u0001\u0000"} +{"timestamp":"2026-09-06T23:53:14","event_id":"4527e689-d194-44af-828b-83a0f837f227","source_ip":"176.65.148.243","source_port":59898,"source_domain":"176.65.148.243.ptr.pfcloud.network","country_code":"NL","country_name":"The Netherlands","city_name":"Eygelshoven","asn_number":51396,"asn_org":"Pfcloud UG (haftungsbeschrankt)","dest_port":25565,"network_protocol":"","application_protocol":"","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":21,"dest_bytes":14,"network_bytes":35,"event_summary":"\u0012\u0000\u0000\fc�\u0001\u0001\u0000"} +{"timestamp":"2026-09-06T23:51:54","event_id":"72d1c4f7-c654-4e1e-a2a8-17bf725275c6","source_ip":"204.76.203.221","source_port":49850,"source_domain":"204.76.203.221.ptr.pfcloud.network","country_code":"NL","country_name":"The Netherlands","city_name":"Eygelshoven","asn_number":51396,"asn_org":"Pfcloud UG (haftungsbeschrankt)","dest_port":11811,"network_protocol":"","application_protocol":"http_connect","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":102000000,"source_bytes":67,"dest_bytes":14,"network_bytes":81,"event_summary":"CONNECT api64.ipify.org:443 HTTP/1.1\r\nHost: api64.ipify.org:443\r\n\r\n"} +{"timestamp":"2026-09-06T23:51:54","event_id":"217f2a3b-ea33-4c03-b8b2-4044a71f6ffa","source_ip":"204.76.203.214","source_port":37484,"source_domain":"204.76.203.214.ptr.pfcloud.network","country_code":"NL","country_name":"The Netherlands","city_name":"Eygelshoven","asn_number":51396,"asn_org":"Pfcloud UG (haftungsbeschrankt)","dest_port":11811,"network_protocol":"","application_protocol":"socks5","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":3,"dest_bytes":14,"network_bytes":17,"event_summary":"\u0005\u0001\u0000"} +{"timestamp":"2026-09-06T23:49:00","event_id":"218f030a-50a8-49b0-9168-39a4fbe38a59","source_ip":"204.76.203.221","source_port":27860,"source_domain":"204.76.203.221.ptr.pfcloud.network","country_code":"NL","country_name":"The Netherlands","city_name":"Eygelshoven","asn_number":51396,"asn_org":"Pfcloud UG (haftungsbeschrankt)","dest_port":1212,"network_protocol":"","application_protocol":"socks5","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":101000000,"source_bytes":3,"dest_bytes":14,"network_bytes":17,"event_summary":"\u0005\u0001\u0000"} +{"timestamp":"2026-09-06T23:49:00","event_id":"3ca84960-e4cd-48d8-9788-dea907880a9c","source_ip":"204.76.203.214","source_port":35548,"source_domain":"204.76.203.214.ptr.pfcloud.network","country_code":"NL","country_name":"The Netherlands","city_name":"Eygelshoven","asn_number":51396,"asn_org":"Pfcloud UG (haftungsbeschrankt)","dest_port":1212,"network_protocol":"","application_protocol":"amazonaws","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":102000000,"source_bytes":79,"dest_bytes":14,"network_bytes":93,"event_summary":"CONNECT checkip.amazonaws.com:443 HTTP/1.1\r\nHost: checkip.amazonaws.com:443\r\n\r\n"} +{"timestamp":"2026-09-06T23:47:43","event_id":"e7f3ce17-42f9-4667-93d7-2893171dca8e","source_ip":"176.65.134.48","source_port":37316,"source_domain":"176.65.134.48.ptr.pfcloud.network","country_code":"DE","country_name":"Germany","city_name":"","asn_number":51396,"asn_org":"Pfcloud UG (haftungsbeschrankt)","dest_port":4550,"network_protocol":"","application_protocol":"http_proxy","http_method":"GET","user_agent":"Go-http-client/1.1","url_path":"http://proxy.flarevpn.digital:8080/judge","url_domain":"proxy.flarevpn.digital","http_request_headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"proxy.flarevpn.digital:8080\",\"user-agent\":\"Go-http-client/1.1\"}","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"ge11nn0400_9c3956fad5da","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":166,"dest_bytes":78,"network_bytes":244,"event_summary":""} +{"timestamp":"2026-09-06T23:47:43","event_id":"9905e2f9-7562-4d9e-befc-2a441fb2f8ef","source_ip":"176.65.134.48","source_port":37308,"source_domain":"176.65.134.48.ptr.pfcloud.network","country_code":"DE","country_name":"Germany","city_name":"","asn_number":51396,"asn_org":"Pfcloud UG (haftungsbeschrankt)","dest_port":4550,"network_protocol":"","application_protocol":"socks5","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":3,"dest_bytes":13,"network_bytes":16,"event_summary":"\u0005\u0001\u0000"} +{"timestamp":"2026-09-06T23:47:43","event_id":"604da2ee-f1e1-4b4a-a56c-4d60b9e07ca9","source_ip":"176.65.134.48","source_port":37296,"source_domain":"176.65.134.48.ptr.pfcloud.network","country_code":"DE","country_name":"Germany","city_name":"","asn_number":51396,"asn_org":"Pfcloud UG (haftungsbeschrankt)","dest_port":4550,"network_protocol":"","application_protocol":"http_proxy","http_method":"GET","user_agent":"Go-http-client/1.1","url_path":"http://proxy.flarevpn.digital:8080/judge","url_domain":"proxy.flarevpn.digital","http_request_headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"proxy.flarevpn.digital:8080\",\"user-agent\":\"Go-http-client/1.1\"}","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"ge11nn0400_9c3956fad5da","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":166,"dest_bytes":78,"network_bytes":244,"event_summary":""} +{"timestamp":"2026-09-06T23:47:43","event_id":"15379a01-b026-497d-ad3a-2f3244680849","source_ip":"176.65.134.48","source_port":37286,"source_domain":"176.65.134.48.ptr.pfcloud.network","country_code":"DE","country_name":"Germany","city_name":"","asn_number":51396,"asn_org":"Pfcloud UG (haftungsbeschrankt)","dest_port":4550,"network_protocol":"","application_protocol":"socks5","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":3,"dest_bytes":13,"network_bytes":16,"event_summary":"\u0005\u0001\u0000"} +{"timestamp":"2026-09-06T23:43:17","event_id":"18000d02-5dbe-476c-a071-051752e09a94","source_ip":"204.76.203.222","source_port":14346,"source_domain":"204.76.203.222.ptr.pfcloud.network","country_code":"NL","country_name":"The Netherlands","city_name":"Eygelshoven","asn_number":51396,"asn_org":"Pfcloud UG (haftungsbeschrankt)","dest_port":10258,"network_protocol":"","application_protocol":"http_connect","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":67,"dest_bytes":14,"network_bytes":81,"event_summary":"CONNECT api64.ipify.org:443 HTTP/1.1\r\nHost: api64.ipify.org:443\r\n\r\n"} +{"timestamp":"2026-09-06T23:43:17","event_id":"64f35fca-f37c-4070-8fb8-eda9c11d8e65","source_ip":"204.76.203.214","source_port":58782,"source_domain":"204.76.203.214.ptr.pfcloud.network","country_code":"NL","country_name":"The Netherlands","city_name":"Eygelshoven","asn_number":51396,"asn_org":"Pfcloud UG (haftungsbeschrankt)","dest_port":10258,"network_protocol":"","application_protocol":"socks5","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":101000000,"source_bytes":3,"dest_bytes":14,"network_bytes":17,"event_summary":"\u0005\u0001\u0000"} +{"timestamp":"2026-09-06T23:41:28","event_id":"bb44f793-d611-42c0-82c8-51614e7a5c4b","source_ip":"204.76.203.222","source_port":38114,"source_domain":"204.76.203.222.ptr.pfcloud.network","country_code":"NL","country_name":"The Netherlands","city_name":"Eygelshoven","asn_number":51396,"asn_org":"Pfcloud UG (haftungsbeschrankt)","dest_port":44500,"network_protocol":"","application_protocol":"amazonaws","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":101000000,"source_bytes":79,"dest_bytes":14,"network_bytes":93,"event_summary":"CONNECT checkip.amazonaws.com:443 HTTP/1.1\r\nHost: checkip.amazonaws.com:443\r\n\r\n"} +{"timestamp":"2026-09-06T23:41:28","event_id":"6b1bbfe8-55a7-4d8f-a43a-61898ad73112","source_ip":"204.76.203.221","source_port":58238,"source_domain":"204.76.203.221.ptr.pfcloud.network","country_code":"NL","country_name":"The Netherlands","city_name":"Eygelshoven","asn_number":51396,"asn_org":"Pfcloud UG (haftungsbeschrankt)","dest_port":44500,"network_protocol":"","application_protocol":"socks5","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":3,"dest_bytes":14,"network_bytes":17,"event_summary":"\u0005\u0001\u0000"} +{"timestamp":"2026-09-06T23:40:09","event_id":"97e5d5c3-f6f0-42f7-a285-ea48787f609b","source_ip":"204.76.203.214","source_port":37988,"source_domain":"204.76.203.214.ptr.pfcloud.network","country_code":"NL","country_name":"The Netherlands","city_name":"Eygelshoven","asn_number":51396,"asn_org":"Pfcloud UG (haftungsbeschrankt)","dest_port":20131,"network_protocol":"","application_protocol":"socks5","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":3,"dest_bytes":14,"network_bytes":17,"event_summary":"\u0005\u0001\u0000"} +{"timestamp":"2026-09-06T23:40:09","event_id":"7cd11877-e5f8-4e3f-a5d9-e3acb6129cf2","source_ip":"204.76.203.213","source_port":22094,"source_domain":"204.76.203.213.ptr.pfcloud.network","country_code":"NL","country_name":"The Netherlands","city_name":"Eygelshoven","asn_number":51396,"asn_org":"Pfcloud UG (haftungsbeschrankt)","dest_port":20131,"network_protocol":"","application_protocol":"http_connect","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":101000000,"source_bytes":67,"dest_bytes":14,"network_bytes":81,"event_summary":"CONNECT api64.ipify.org:443 HTTP/1.1\r\nHost: api64.ipify.org:443\r\n\r\n"} +{"timestamp":"2026-09-06T23:39:23","event_id":"6f101876-11db-405a-939f-14e388fe4bfe","source_ip":"204.76.203.214","source_port":1750,"source_domain":"204.76.203.214.ptr.pfcloud.network","country_code":"NL","country_name":"The Netherlands","city_name":"Eygelshoven","asn_number":51396,"asn_org":"Pfcloud UG (haftungsbeschrankt)","dest_port":10474,"network_protocol":"","application_protocol":"http_connect","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":102000000,"source_bytes":63,"dest_bytes":14,"network_bytes":77,"event_summary":"CONNECT icanhazip.com:443 HTTP/1.1\r\nHost: icanhazip.com:443\r\n\r\n"} +{"timestamp":"2026-09-06T23:39:23","event_id":"d36497d7-0619-4fe0-958a-cda1d5519ea2","source_ip":"204.76.203.213","source_port":37420,"source_domain":"204.76.203.213.ptr.pfcloud.network","country_code":"NL","country_name":"The Netherlands","city_name":"Eygelshoven","asn_number":51396,"asn_org":"Pfcloud UG (haftungsbeschrankt)","dest_port":10474,"network_protocol":"","application_protocol":"socks5","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":3,"dest_bytes":14,"network_bytes":17,"event_summary":"\u0005\u0001\u0000"} +{"timestamp":"2026-09-06T23:39:02","event_id":"0047ec2b-6af1-4f8b-a719-961e60691f98","source_ip":"204.76.203.214","source_port":33066,"source_domain":"204.76.203.214.ptr.pfcloud.network","country_code":"NL","country_name":"The Netherlands","city_name":"Eygelshoven","asn_number":51396,"asn_org":"Pfcloud UG (haftungsbeschrankt)","dest_port":55555,"network_protocol":"","application_protocol":"socks5","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":3,"dest_bytes":14,"network_bytes":17,"event_summary":"\u0005\u0001\u0000"} +{"timestamp":"2026-09-06T23:39:02","event_id":"4fda5b0b-9534-4559-bf7d-2356b3335f44","source_ip":"204.76.203.213","source_port":47900,"source_domain":"204.76.203.213.ptr.pfcloud.network","country_code":"NL","country_name":"The Netherlands","city_name":"Eygelshoven","asn_number":51396,"asn_org":"Pfcloud UG (haftungsbeschrankt)","dest_port":55555,"network_protocol":"","application_protocol":"http_connect","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":102000000,"source_bytes":67,"dest_bytes":14,"network_bytes":81,"event_summary":"CONNECT api64.ipify.org:443 HTTP/1.1\r\nHost: api64.ipify.org:443\r\n\r\n"} +{"timestamp":"2026-09-06T23:36:24","event_id":"3c0e13bf-7cc4-4c21-9486-7f473836ae9e","source_ip":"204.76.203.221","source_port":60178,"source_domain":"204.76.203.221.ptr.pfcloud.network","country_code":"NL","country_name":"The Netherlands","city_name":"Eygelshoven","asn_number":51396,"asn_org":"Pfcloud UG (haftungsbeschrankt)","dest_port":19318,"network_protocol":"","application_protocol":"socks5","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":102000000,"source_bytes":3,"dest_bytes":14,"network_bytes":17,"event_summary":"\u0005\u0001\u0000"} +{"timestamp":"2026-09-06T23:36:24","event_id":"0c2dcaaf-c74f-45c2-b025-501860d9eca3","source_ip":"204.76.203.214","source_port":31800,"source_domain":"204.76.203.214.ptr.pfcloud.network","country_code":"NL","country_name":"The Netherlands","city_name":"Eygelshoven","asn_number":51396,"asn_org":"Pfcloud UG (haftungsbeschrankt)","dest_port":19318,"network_protocol":"","application_protocol":"amazonaws","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":79,"dest_bytes":14,"network_bytes":93,"event_summary":"CONNECT checkip.amazonaws.com:443 HTTP/1.1\r\nHost: checkip.amazonaws.com:443\r\n\r\n"} +{"timestamp":"2026-09-06T23:35:48","event_id":"e901d83d-d89f-47cf-979a-39d945010a8e","source_ip":"204.76.203.222","source_port":30420,"source_domain":"204.76.203.222.ptr.pfcloud.network","country_code":"NL","country_name":"The Netherlands","city_name":"Eygelshoven","asn_number":51396,"asn_org":"Pfcloud UG (haftungsbeschrankt)","dest_port":12019,"network_protocol":"","application_protocol":"socks5","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":101000000,"source_bytes":3,"dest_bytes":14,"network_bytes":17,"event_summary":"\u0005\u0001\u0000"} +{"timestamp":"2026-09-06T23:35:48","event_id":"af303d5f-8879-4b8b-9dcf-1bfd2e7a5be8","source_ip":"204.76.203.221","source_port":37830,"source_domain":"204.76.203.221.ptr.pfcloud.network","country_code":"NL","country_name":"The Netherlands","city_name":"Eygelshoven","asn_number":51396,"asn_org":"Pfcloud UG (haftungsbeschrankt)","dest_port":12019,"network_protocol":"","application_protocol":"amazonaws","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":101000000,"source_bytes":79,"dest_bytes":14,"network_bytes":93,"event_summary":"CONNECT checkip.amazonaws.com:443 HTTP/1.1\r\nHost: checkip.amazonaws.com:443\r\n\r\n"} +{"timestamp":"2026-09-06T23:35:19","event_id":"08a98e53-b934-4fec-8ee7-8134e571be5a","source_ip":"204.76.203.221","source_port":33132,"source_domain":"204.76.203.221.ptr.pfcloud.network","country_code":"NL","country_name":"The Netherlands","city_name":"Eygelshoven","asn_number":51396,"asn_org":"Pfcloud UG (haftungsbeschrankt)","dest_port":20006,"network_protocol":"","application_protocol":"socks5","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":3,"dest_bytes":14,"network_bytes":17,"event_summary":"\u0005\u0001\u0000"} +{"timestamp":"2026-09-06T23:35:19","event_id":"8e255033-15da-4111-8da4-0221e9676c0a","source_ip":"204.76.203.214","source_port":41396,"source_domain":"204.76.203.214.ptr.pfcloud.network","country_code":"NL","country_name":"The Netherlands","city_name":"Eygelshoven","asn_number":51396,"asn_org":"Pfcloud UG (haftungsbeschrankt)","dest_port":20006,"network_protocol":"","application_protocol":"amazonaws","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":103000000,"source_bytes":79,"dest_bytes":14,"network_bytes":93,"event_summary":"CONNECT checkip.amazonaws.com:443 HTTP/1.1\r\nHost: checkip.amazonaws.com:443\r\n\r\n"} +{"timestamp":"2026-09-06T23:34:01","event_id":"488c7aff-2f57-4e58-992b-fe2144e1ec99","source_ip":"204.76.203.221","source_port":34682,"source_domain":"204.76.203.221.ptr.pfcloud.network","country_code":"NL","country_name":"The Netherlands","city_name":"Eygelshoven","asn_number":51396,"asn_org":"Pfcloud UG (haftungsbeschrankt)","dest_port":11439,"network_protocol":"","application_protocol":"socks5","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":101000000,"source_bytes":3,"dest_bytes":14,"network_bytes":17,"event_summary":"\u0005\u0001\u0000"} +{"timestamp":"2026-09-06T23:34:01","event_id":"8ef19b16-3b04-481c-ae8a-9c2e2d850236","source_ip":"204.76.203.214","source_port":40406,"source_domain":"204.76.203.214.ptr.pfcloud.network","country_code":"NL","country_name":"The Netherlands","city_name":"Eygelshoven","asn_number":51396,"asn_org":"Pfcloud UG (haftungsbeschrankt)","dest_port":11439,"network_protocol":"","application_protocol":"http_connect","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":67,"dest_bytes":14,"network_bytes":81,"event_summary":"CONNECT api64.ipify.org:443 HTTP/1.1\r\nHost: api64.ipify.org:443\r\n\r\n"} +{"timestamp":"2026-09-06T23:33:03","event_id":"7c797a9a-c72b-4bee-9471-889ba8fc1922","source_ip":"204.76.203.221","source_port":5626,"source_domain":"204.76.203.221.ptr.pfcloud.network","country_code":"NL","country_name":"The Netherlands","city_name":"Eygelshoven","asn_number":51396,"asn_org":"Pfcloud UG (haftungsbeschrankt)","dest_port":42500,"network_protocol":"","application_protocol":"socks5","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":101000000,"source_bytes":3,"dest_bytes":14,"network_bytes":17,"event_summary":"\u0005\u0001\u0000"} +{"timestamp":"2026-09-06T23:33:03","event_id":"1022bae0-2575-445c-bf42-f49f6c3b18a1","source_ip":"204.76.203.213","source_port":15612,"source_domain":"204.76.203.213.ptr.pfcloud.network","country_code":"NL","country_name":"The Netherlands","city_name":"Eygelshoven","asn_number":51396,"asn_org":"Pfcloud UG (haftungsbeschrankt)","dest_port":42500,"network_protocol":"","application_protocol":"http_connect","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":67,"dest_bytes":14,"network_bytes":81,"event_summary":"CONNECT api64.ipify.org:443 HTTP/1.1\r\nHost: api64.ipify.org:443\r\n\r\n"} +{"timestamp":"2026-09-06T23:32:25","event_id":"8bca9a6d-3667-474d-8e5c-f12324406147","source_ip":"176.65.149.31","source_port":51680,"source_domain":"176.65.149.31.ptr.pfcloud.network","country_code":"NL","country_name":"The Netherlands","city_name":"Eygelshoven","asn_number":51396,"asn_org":"Pfcloud UG (haftungsbeschrankt)","dest_port":1930,"network_protocol":"","application_protocol":"ssh","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":117000000,"source_bytes":17,"dest_bytes":13,"network_bytes":30,"event_summary":"SSH-2.0-OpenSSH\r\n"} +{"timestamp":"2026-09-06T23:32:22","event_id":"3a640124-0a29-4d79-8f26-4fb17f8c6ace","source_ip":"204.76.203.214","source_port":59178,"source_domain":"204.76.203.214.ptr.pfcloud.network","country_code":"NL","country_name":"The Netherlands","city_name":"Eygelshoven","asn_number":51396,"asn_org":"Pfcloud UG (haftungsbeschrankt)","dest_port":5858,"network_protocol":"","application_protocol":"amazonaws","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":101000000,"source_bytes":79,"dest_bytes":14,"network_bytes":93,"event_summary":"CONNECT checkip.amazonaws.com:443 HTTP/1.1\r\nHost: checkip.amazonaws.com:443\r\n\r\n"} +{"timestamp":"2026-09-06T23:32:22","event_id":"823db01c-7e29-4e1e-9684-95a76e31caf2","source_ip":"204.76.203.213","source_port":63460,"source_domain":"204.76.203.213.ptr.pfcloud.network","country_code":"NL","country_name":"The Netherlands","city_name":"Eygelshoven","asn_number":51396,"asn_org":"Pfcloud UG (haftungsbeschrankt)","dest_port":5858,"network_protocol":"","application_protocol":"socks5","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":3,"dest_bytes":14,"network_bytes":17,"event_summary":"\u0005\u0001\u0000"} +{"timestamp":"2026-09-06T23:31:42","event_id":"ac30ae6d-eb4f-4aa4-9fd5-cec8f9cbe181","source_ip":"176.65.148.243","source_port":53822,"source_domain":"176.65.148.243.ptr.pfcloud.network","country_code":"NL","country_name":"The Netherlands","city_name":"Eygelshoven","asn_number":51396,"asn_org":"Pfcloud UG (haftungsbeschrankt)","dest_port":25565,"network_protocol":"","application_protocol":"","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":22,"dest_bytes":14,"network_bytes":36,"event_summary":"\u0013\u0000\u0000\rc�\u0001\u0001\u0000"} +{"timestamp":"2026-09-06T23:31:04","event_id":"edb8b213-e42f-4e2d-82e3-6e72ea7349b4","source_ip":"204.76.203.214","source_port":3906,"source_domain":"204.76.203.214.ptr.pfcloud.network","country_code":"NL","country_name":"The Netherlands","city_name":"Eygelshoven","asn_number":51396,"asn_org":"Pfcloud UG (haftungsbeschrankt)","dest_port":10100,"network_protocol":"","application_protocol":"http_connect","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":63,"dest_bytes":14,"network_bytes":77,"event_summary":"CONNECT icanhazip.com:443 HTTP/1.1\r\nHost: icanhazip.com:443\r\n\r\n"} +{"timestamp":"2026-09-06T23:31:04","event_id":"7f03168f-f031-48ab-8c12-4fa14cee113c","source_ip":"204.76.203.213","source_port":20244,"source_domain":"204.76.203.213.ptr.pfcloud.network","country_code":"NL","country_name":"The Netherlands","city_name":"Eygelshoven","asn_number":51396,"asn_org":"Pfcloud UG (haftungsbeschrankt)","dest_port":10100,"network_protocol":"","application_protocol":"socks5","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":103000000,"source_bytes":3,"dest_bytes":14,"network_bytes":17,"event_summary":"\u0005\u0001\u0000"} +{"timestamp":"2026-09-06T23:31:03","event_id":"faef2b41-58c2-4497-865d-e19608fca789","source_ip":"204.76.203.214","source_port":13278,"source_domain":"204.76.203.214.ptr.pfcloud.network","country_code":"NL","country_name":"The Netherlands","city_name":"Eygelshoven","asn_number":51396,"asn_org":"Pfcloud UG (haftungsbeschrankt)","dest_port":22222,"network_protocol":"","application_protocol":"socks5","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":3,"dest_bytes":14,"network_bytes":17,"event_summary":"\u0005\u0001\u0000"} +{"timestamp":"2026-09-06T23:31:03","event_id":"94752b88-0c45-4582-9adf-18ce3f78ddc0","source_ip":"204.76.203.213","source_port":8628,"source_domain":"204.76.203.213.ptr.pfcloud.network","country_code":"NL","country_name":"The Netherlands","city_name":"Eygelshoven","asn_number":51396,"asn_org":"Pfcloud UG (haftungsbeschrankt)","dest_port":22222,"network_protocol":"","application_protocol":"amazonaws","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":101000000,"source_bytes":79,"dest_bytes":14,"network_bytes":93,"event_summary":"CONNECT checkip.amazonaws.com:443 HTTP/1.1\r\nHost: checkip.amazonaws.com:443\r\n\r\n"} +{"timestamp":"2026-09-06T23:30:10","event_id":"a1a44699-0875-4220-b802-3006bc591749","source_ip":"204.76.203.222","source_port":41688,"source_domain":"204.76.203.222.ptr.pfcloud.network","country_code":"NL","country_name":"The Netherlands","city_name":"Eygelshoven","asn_number":51396,"asn_org":"Pfcloud UG (haftungsbeschrankt)","dest_port":11180,"network_protocol":"","application_protocol":"socks5","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":102000000,"source_bytes":3,"dest_bytes":14,"network_bytes":17,"event_summary":"\u0005\u0001\u0000"} +{"timestamp":"2026-09-06T23:30:10","event_id":"8f30868a-a636-467f-8d24-d01e1e32c0b0","source_ip":"204.76.203.213","source_port":39730,"source_domain":"204.76.203.213.ptr.pfcloud.network","country_code":"NL","country_name":"The Netherlands","city_name":"Eygelshoven","asn_number":51396,"asn_org":"Pfcloud UG (haftungsbeschrankt)","dest_port":11180,"network_protocol":"","application_protocol":"http_connect","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":67,"dest_bytes":14,"network_bytes":81,"event_summary":"CONNECT api64.ipify.org:443 HTTP/1.1\r\nHost: api64.ipify.org:443\r\n\r\n"} +{"timestamp":"2026-09-06T23:29:08","event_id":"731917cb-fd22-46e4-a6e9-3e5a7d28b3d5","source_ip":"204.76.203.222","source_port":24984,"source_domain":"204.76.203.222.ptr.pfcloud.network","country_code":"NL","country_name":"The Netherlands","city_name":"Eygelshoven","asn_number":51396,"asn_org":"Pfcloud UG (haftungsbeschrankt)","dest_port":4121,"network_protocol":"","application_protocol":"socks5","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":101000000,"source_bytes":3,"dest_bytes":14,"network_bytes":17,"event_summary":"\u0005\u0001\u0000"} +{"timestamp":"2026-09-06T23:29:08","event_id":"58a05c2f-d54a-40a5-8019-2f6a0018a169","source_ip":"204.76.203.214","source_port":56908,"source_domain":"204.76.203.214.ptr.pfcloud.network","country_code":"NL","country_name":"The Netherlands","city_name":"Eygelshoven","asn_number":51396,"asn_org":"Pfcloud UG (haftungsbeschrankt)","dest_port":4121,"network_protocol":"","application_protocol":"http_connect","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":104000000,"source_bytes":67,"dest_bytes":14,"network_bytes":81,"event_summary":"CONNECT api64.ipify.org:443 HTTP/1.1\r\nHost: api64.ipify.org:443\r\n\r\n"} +{"timestamp":"2026-09-06T23:27:42","event_id":"790d5622-9ecd-44e4-b310-e3a93925e9e8","source_ip":"204.76.203.222","source_port":12138,"source_domain":"204.76.203.222.ptr.pfcloud.network","country_code":"NL","country_name":"The Netherlands","city_name":"Eygelshoven","asn_number":51396,"asn_org":"Pfcloud UG (haftungsbeschrankt)","dest_port":10001,"network_protocol":"","application_protocol":"socks5","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":101000000,"source_bytes":3,"dest_bytes":14,"network_bytes":17,"event_summary":"\u0005\u0001\u0000"} +{"timestamp":"2026-09-06T23:27:42","event_id":"10a0ff21-547f-4263-9397-3376a3626d31","source_ip":"204.76.203.214","source_port":62632,"source_domain":"204.76.203.214.ptr.pfcloud.network","country_code":"NL","country_name":"The Netherlands","city_name":"Eygelshoven","asn_number":51396,"asn_org":"Pfcloud UG (haftungsbeschrankt)","dest_port":10001,"network_protocol":"","application_protocol":"http_connect","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":63,"dest_bytes":14,"network_bytes":77,"event_summary":"CONNECT icanhazip.com:443 HTTP/1.1\r\nHost: icanhazip.com:443\r\n\r\n"} +{"timestamp":"2026-09-06T23:26:59","event_id":"f9096b36-10cc-4dc4-b843-1f9bc3349942","source_ip":"204.76.203.222","source_port":55442,"source_domain":"204.76.203.222.ptr.pfcloud.network","country_code":"NL","country_name":"The Netherlands","city_name":"Eygelshoven","asn_number":51396,"asn_org":"Pfcloud UG (haftungsbeschrankt)","dest_port":10213,"network_protocol":"","application_protocol":"amazonaws","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":101000000,"source_bytes":79,"dest_bytes":14,"network_bytes":93,"event_summary":"CONNECT checkip.amazonaws.com:443 HTTP/1.1\r\nHost: checkip.amazonaws.com:443\r\n\r\n"} +{"timestamp":"2026-09-06T23:26:59","event_id":"9d0e9897-ed84-47b4-9bfe-d5cc81c8c4e5","source_ip":"204.76.203.214","source_port":7378,"source_domain":"204.76.203.214.ptr.pfcloud.network","country_code":"NL","country_name":"The Netherlands","city_name":"Eygelshoven","asn_number":51396,"asn_org":"Pfcloud UG (haftungsbeschrankt)","dest_port":10213,"network_protocol":"","application_protocol":"socks5","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":3,"dest_bytes":14,"network_bytes":17,"event_summary":"\u0005\u0001\u0000"} +{"timestamp":"2026-09-06T23:26:34","event_id":"aa824cf5-10cd-4f2c-b230-48750680d534","source_ip":"45.135.193.193","source_port":48036,"source_domain":"45.135.193.193.ptr.pfcloud.network","country_code":"DE","country_name":"Germany","city_name":"Langen","asn_number":51396,"asn_org":"Pfcloud UG (haftungsbeschrankt)","dest_port":8888,"network_protocol":"","application_protocol":"http_connect","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":104000000,"source_bytes":89,"dest_bytes":14,"network_bytes":103,"event_summary":"CONNECT httpbin.org:443 HTTP/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive\r\n\r\n"} +{"timestamp":"2026-09-06T23:26:34","event_id":"42eea07e-191f-4a34-ad3e-034c5561d821","source_ip":"45.135.193.193","source_port":57294,"source_domain":"45.135.193.193.ptr.pfcloud.network","country_code":"DE","country_name":"Germany","city_name":"Langen","asn_number":51396,"asn_org":"Pfcloud UG (haftungsbeschrankt)","dest_port":8080,"network_protocol":"","application_protocol":"http_connect","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":104000000,"source_bytes":89,"dest_bytes":14,"network_bytes":103,"event_summary":"CONNECT httpbin.org:443 HTTP/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive\r\n\r\n"} +{"timestamp":"2026-09-06T23:26:34","event_id":"101a15e7-7537-4ccf-9e89-155b2eb36f88","source_ip":"45.135.193.193","source_port":56894,"source_domain":"45.135.193.193.ptr.pfcloud.network","country_code":"DE","country_name":"Germany","city_name":"Langen","asn_number":51396,"asn_org":"Pfcloud UG (haftungsbeschrankt)","dest_port":8000,"network_protocol":"","application_protocol":"http_connect","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":104000000,"source_bytes":89,"dest_bytes":14,"network_bytes":103,"event_summary":"CONNECT httpbin.org:443 HTTP/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive\r\n\r\n"} +{"timestamp":"2026-09-06T23:26:34","event_id":"155eb390-e6c4-416a-8551-943ac169d831","source_ip":"45.135.193.193","source_port":60222,"source_domain":"45.135.193.193.ptr.pfcloud.network","country_code":"DE","country_name":"Germany","city_name":"Langen","asn_number":51396,"asn_org":"Pfcloud UG (haftungsbeschrankt)","dest_port":81,"network_protocol":"","application_protocol":"http_connect","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":103000000,"source_bytes":89,"dest_bytes":14,"network_bytes":103,"event_summary":"CONNECT httpbin.org:443 HTTP/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive\r\n\r\n"} +{"timestamp":"2026-09-06T23:26:34","event_id":"d618e9a6-aac3-4e81-86e9-cff955bba00c","source_ip":"45.135.193.193","source_port":57318,"source_domain":"45.135.193.193.ptr.pfcloud.network","country_code":"DE","country_name":"Germany","city_name":"Langen","asn_number":51396,"asn_org":"Pfcloud UG (haftungsbeschrankt)","dest_port":3128,"network_protocol":"","application_protocol":"http_connect","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":103000000,"source_bytes":89,"dest_bytes":14,"network_bytes":103,"event_summary":"CONNECT httpbin.org:443 HTTP/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive\r\n\r\n"} +{"timestamp":"2026-09-06T23:26:34","event_id":"9938cf7e-96b3-4f52-953c-d944dc12c0db","source_ip":"45.135.193.193","source_port":37508,"source_domain":"45.135.193.193.ptr.pfcloud.network","country_code":"DE","country_name":"Germany","city_name":"Langen","asn_number":51396,"asn_org":"Pfcloud UG (haftungsbeschrankt)","dest_port":443,"network_protocol":"","application_protocol":"http_connect","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":103000000,"source_bytes":89,"dest_bytes":14,"network_bytes":103,"event_summary":"CONNECT httpbin.org:443 HTTP/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive\r\n\r\n"} +{"timestamp":"2026-09-06T23:26:34","event_id":"ade85edd-a2b1-458d-a88a-687b982b973e","source_ip":"45.135.193.193","source_port":40094,"source_domain":"45.135.193.193.ptr.pfcloud.network","country_code":"DE","country_name":"Germany","city_name":"Langen","asn_number":51396,"asn_org":"Pfcloud UG (haftungsbeschrankt)","dest_port":8081,"network_protocol":"","application_protocol":"http_connect","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":102000000,"source_bytes":89,"dest_bytes":14,"network_bytes":103,"event_summary":"CONNECT httpbin.org:443 HTTP/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive\r\n\r\n"} +{"timestamp":"2026-09-06T23:26:34","event_id":"f854a4f6-5600-4d68-a5c5-9d6edcc1f6fb","source_ip":"45.135.193.193","source_port":54976,"source_domain":"45.135.193.193.ptr.pfcloud.network","country_code":"DE","country_name":"Germany","city_name":"Langen","asn_number":51396,"asn_org":"Pfcloud UG (haftungsbeschrankt)","dest_port":80,"network_protocol":"","application_protocol":"http_connect","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":89,"dest_bytes":14,"network_bytes":103,"event_summary":"CONNECT httpbin.org:443 HTTP/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive\r\n\r\n"} +{"timestamp":"2026-09-06T23:26:25","event_id":"39657d23-0685-4945-b1d5-f11f366d5783","source_ip":"204.76.203.214","source_port":38228,"source_domain":"204.76.203.214.ptr.pfcloud.network","country_code":"NL","country_name":"The Netherlands","city_name":"Eygelshoven","asn_number":51396,"asn_org":"Pfcloud UG (haftungsbeschrankt)","dest_port":11537,"network_protocol":"","application_protocol":"http_connect","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":102000000,"source_bytes":67,"dest_bytes":14,"network_bytes":81,"event_summary":"CONNECT api64.ipify.org:443 HTTP/1.1\r\nHost: api64.ipify.org:443\r\n\r\n"} +{"timestamp":"2026-09-06T23:26:25","event_id":"fde82192-e3c8-4ebf-b18b-65135dbbca4a","source_ip":"204.76.203.213","source_port":24398,"source_domain":"204.76.203.213.ptr.pfcloud.network","country_code":"NL","country_name":"The Netherlands","city_name":"Eygelshoven","asn_number":51396,"asn_org":"Pfcloud UG (haftungsbeschrankt)","dest_port":11537,"network_protocol":"","application_protocol":"socks5","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":101000000,"source_bytes":3,"dest_bytes":14,"network_bytes":17,"event_summary":"\u0005\u0001\u0000"} +{"timestamp":"2026-09-06T23:24:55","event_id":"b940ab1b-acba-45c5-9bfd-53c2f523f9d3","source_ip":"204.76.203.214","source_port":44240,"source_domain":"204.76.203.214.ptr.pfcloud.network","country_code":"NL","country_name":"The Netherlands","city_name":"Eygelshoven","asn_number":51396,"asn_org":"Pfcloud UG (haftungsbeschrankt)","dest_port":11508,"network_protocol":"","application_protocol":"socks5","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":103000000,"source_bytes":3,"dest_bytes":14,"network_bytes":17,"event_summary":"\u0005\u0001\u0000"} +{"timestamp":"2026-09-06T23:24:55","event_id":"e63a0f68-7a71-47b7-a484-9f82ecc9ee29","source_ip":"204.76.203.213","source_port":19378,"source_domain":"204.76.203.213.ptr.pfcloud.network","country_code":"NL","country_name":"The Netherlands","city_name":"Eygelshoven","asn_number":51396,"asn_org":"Pfcloud UG (haftungsbeschrankt)","dest_port":11508,"network_protocol":"","application_protocol":"http_connect","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":101000000,"source_bytes":63,"dest_bytes":14,"network_bytes":77,"event_summary":"CONNECT icanhazip.com:443 HTTP/1.1\r\nHost: icanhazip.com:443\r\n\r\n"} +{"timestamp":"2026-09-06T23:23:20","event_id":"a3b83c22-0dd2-4f33-848b-2e79dd6e6d6a","source_ip":"204.76.203.222","source_port":35542,"source_domain":"204.76.203.222.ptr.pfcloud.network","country_code":"NL","country_name":"The Netherlands","city_name":"Eygelshoven","asn_number":51396,"asn_org":"Pfcloud UG (haftungsbeschrankt)","dest_port":12328,"network_protocol":"","application_protocol":"amazonaws","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":79,"dest_bytes":14,"network_bytes":93,"event_summary":"CONNECT checkip.amazonaws.com:443 HTTP/1.1\r\nHost: checkip.amazonaws.com:443\r\n\r\n"} +{"timestamp":"2026-09-06T23:23:20","event_id":"26c27852-e08a-47b6-9a7b-7807be021df0","source_ip":"204.76.203.221","source_port":49870,"source_domain":"204.76.203.221.ptr.pfcloud.network","country_code":"NL","country_name":"The Netherlands","city_name":"Eygelshoven","asn_number":51396,"asn_org":"Pfcloud UG (haftungsbeschrankt)","dest_port":12328,"network_protocol":"","application_protocol":"socks5","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":102000000,"source_bytes":3,"dest_bytes":14,"network_bytes":17,"event_summary":"\u0005\u0001\u0000"} +{"timestamp":"2026-09-06T23:20:40","event_id":"63dac0c9-1316-4fd9-a5f2-64302d797558","source_ip":"204.76.203.222","source_port":7880,"source_domain":"204.76.203.222.ptr.pfcloud.network","country_code":"NL","country_name":"The Netherlands","city_name":"Eygelshoven","asn_number":51396,"asn_org":"Pfcloud UG (haftungsbeschrankt)","dest_port":1666,"network_protocol":"","application_protocol":"socks5","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":3,"dest_bytes":14,"network_bytes":17,"event_summary":"\u0005\u0001\u0000"} +{"timestamp":"2026-09-06T23:20:40","event_id":"f866219e-3a24-484c-810f-4162436df1c4","source_ip":"204.76.203.213","source_port":21686,"source_domain":"204.76.203.213.ptr.pfcloud.network","country_code":"NL","country_name":"The Netherlands","city_name":"Eygelshoven","asn_number":51396,"asn_org":"Pfcloud UG (haftungsbeschrankt)","dest_port":1666,"network_protocol":"","application_protocol":"amazonaws","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":101000000,"source_bytes":79,"dest_bytes":14,"network_bytes":93,"event_summary":"CONNECT checkip.amazonaws.com:443 HTTP/1.1\r\nHost: checkip.amazonaws.com:443\r\n\r\n"} +{"timestamp":"2026-09-06T23:19:03","event_id":"1e75345a-4116-4211-9966-a100262af549","source_ip":"204.76.203.222","source_port":15494,"source_domain":"204.76.203.222.ptr.pfcloud.network","country_code":"NL","country_name":"The Netherlands","city_name":"Eygelshoven","asn_number":51396,"asn_org":"Pfcloud UG (haftungsbeschrankt)","dest_port":10020,"network_protocol":"","application_protocol":"http_connect","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":63,"dest_bytes":14,"network_bytes":77,"event_summary":"CONNECT icanhazip.com:443 HTTP/1.1\r\nHost: icanhazip.com:443\r\n\r\n"} +{"timestamp":"2026-09-06T23:19:03","event_id":"9e21aa27-462a-4cbf-a789-aefbb040b7fe","source_ip":"204.76.203.213","source_port":27372,"source_domain":"204.76.203.213.ptr.pfcloud.network","country_code":"NL","country_name":"The Netherlands","city_name":"Eygelshoven","asn_number":51396,"asn_org":"Pfcloud UG (haftungsbeschrankt)","dest_port":10020,"network_protocol":"","application_protocol":"socks5","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":3,"dest_bytes":14,"network_bytes":17,"event_summary":"\u0005\u0001\u0000"} +{"timestamp":"2026-09-06T23:18:44","event_id":"b17e4854-abf4-476e-a304-78a02075c471","source_ip":"204.76.203.221","source_port":16600,"source_domain":"204.76.203.221.ptr.pfcloud.network","country_code":"NL","country_name":"The Netherlands","city_name":"Eygelshoven","asn_number":51396,"asn_org":"Pfcloud UG (haftungsbeschrankt)","dest_port":10258,"network_protocol":"","application_protocol":"http_connect","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":102000000,"source_bytes":67,"dest_bytes":14,"network_bytes":81,"event_summary":"CONNECT api64.ipify.org:443 HTTP/1.1\r\nHost: api64.ipify.org:443\r\n\r\n"} +{"timestamp":"2026-09-06T23:18:44","event_id":"30afc8b1-b128-45a6-b121-171949646a9c","source_ip":"204.76.203.213","source_port":42102,"source_domain":"204.76.203.213.ptr.pfcloud.network","country_code":"NL","country_name":"The Netherlands","city_name":"Eygelshoven","asn_number":51396,"asn_org":"Pfcloud UG (haftungsbeschrankt)","dest_port":10258,"network_protocol":"","application_protocol":"socks5","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":101000000,"source_bytes":3,"dest_bytes":14,"network_bytes":17,"event_summary":"\u0005\u0001\u0000"} +{"timestamp":"2026-09-06T23:18:35","event_id":"be74dffc-88ba-43aa-a0bc-c733495bafb1","source_ip":"204.76.203.222","source_port":11802,"source_domain":"204.76.203.222.ptr.pfcloud.network","country_code":"NL","country_name":"The Netherlands","city_name":"Eygelshoven","asn_number":51396,"asn_org":"Pfcloud UG (haftungsbeschrankt)","dest_port":5512,"network_protocol":"","application_protocol":"http_connect","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":63,"dest_bytes":14,"network_bytes":77,"event_summary":"CONNECT icanhazip.com:443 HTTP/1.1\r\nHost: icanhazip.com:443\r\n\r\n"} +{"timestamp":"2026-09-06T23:18:35","event_id":"f3bc9caa-0a61-40e2-bbc6-6b4a70331aa1","source_ip":"204.76.203.214","source_port":58276,"source_domain":"204.76.203.214.ptr.pfcloud.network","country_code":"NL","country_name":"The Netherlands","city_name":"Eygelshoven","asn_number":51396,"asn_org":"Pfcloud UG (haftungsbeschrankt)","dest_port":5512,"network_protocol":"","application_protocol":"socks5","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":3,"dest_bytes":14,"network_bytes":17,"event_summary":"\u0005\u0001\u0000"} +{"timestamp":"2026-09-06T23:18:31","event_id":"f64243e0-1fd7-41f1-943e-c70c7c5f7c33","source_ip":"204.76.203.222","source_port":43730,"source_domain":"204.76.203.222.ptr.pfcloud.network","country_code":"NL","country_name":"The Netherlands","city_name":"Eygelshoven","asn_number":51396,"asn_org":"Pfcloud UG (haftungsbeschrankt)","dest_port":11007,"network_protocol":"","application_protocol":"socks5","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":103000000,"source_bytes":3,"dest_bytes":14,"network_bytes":17,"event_summary":"\u0005\u0001\u0000"} +{"timestamp":"2026-09-06T23:18:31","event_id":"6bd45fce-3349-4c00-a8cc-6e770b70e5db","source_ip":"204.76.203.213","source_port":40614,"source_domain":"204.76.203.213.ptr.pfcloud.network","country_code":"NL","country_name":"The Netherlands","city_name":"Eygelshoven","asn_number":51396,"asn_org":"Pfcloud UG (haftungsbeschrankt)","dest_port":11007,"network_protocol":"","application_protocol":"http_connect","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":63,"dest_bytes":14,"network_bytes":77,"event_summary":"CONNECT icanhazip.com:443 HTTP/1.1\r\nHost: icanhazip.com:443\r\n\r\n"} +{"timestamp":"2026-09-06T23:17:26","event_id":"c3fd4de7-3b63-46eb-90c4-f0a9138d349e","source_ip":"204.76.203.222","source_port":57358,"source_domain":"204.76.203.222.ptr.pfcloud.network","country_code":"NL","country_name":"The Netherlands","city_name":"Eygelshoven","asn_number":51396,"asn_org":"Pfcloud UG (haftungsbeschrankt)","dest_port":42103,"network_protocol":"","application_protocol":"amazonaws","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":79,"dest_bytes":14,"network_bytes":93,"event_summary":"CONNECT checkip.amazonaws.com:443 HTTP/1.1\r\nHost: checkip.amazonaws.com:443\r\n\r\n"} +{"timestamp":"2026-09-06T23:17:26","event_id":"c6be4aa6-b993-4232-b4e2-ce416f7068fa","source_ip":"204.76.203.213","source_port":6966,"source_domain":"204.76.203.213.ptr.pfcloud.network","country_code":"NL","country_name":"The Netherlands","city_name":"Eygelshoven","asn_number":51396,"asn_org":"Pfcloud UG (haftungsbeschrankt)","dest_port":42103,"network_protocol":"","application_protocol":"socks5","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":3,"dest_bytes":14,"network_bytes":17,"event_summary":"\u0005\u0001\u0000"} +{"timestamp":"2026-09-06T23:12:13","event_id":"baad81ab-daa5-4796-9207-43e96987ceb5","source_ip":"204.76.203.222","source_port":37024,"source_domain":"204.76.203.222.ptr.pfcloud.network","country_code":"NL","country_name":"The Netherlands","city_name":"Eygelshoven","asn_number":51396,"asn_org":"Pfcloud UG (haftungsbeschrankt)","dest_port":11236,"network_protocol":"","application_protocol":"socks5","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":101000000,"source_bytes":3,"dest_bytes":14,"network_bytes":17,"event_summary":"\u0005\u0001\u0000"} +{"timestamp":"2026-09-06T23:12:13","event_id":"b4fd3734-b0f8-4785-97c1-8cb78ea8a950","source_ip":"204.76.203.221","source_port":27510,"source_domain":"204.76.203.221.ptr.pfcloud.network","country_code":"NL","country_name":"The Netherlands","city_name":"Eygelshoven","asn_number":51396,"asn_org":"Pfcloud UG (haftungsbeschrankt)","dest_port":11236,"network_protocol":"","application_protocol":"http_connect","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":63,"dest_bytes":14,"network_bytes":77,"event_summary":"CONNECT icanhazip.com:443 HTTP/1.1\r\nHost: icanhazip.com:443\r\n\r\n"} +{"timestamp":"2026-09-06T23:12:11","event_id":"be7f8416-77cd-4b8e-97ea-08419c77586f","source_ip":"204.76.203.222","source_port":3850,"source_domain":"204.76.203.222.ptr.pfcloud.network","country_code":"NL","country_name":"The Netherlands","city_name":"Eygelshoven","asn_number":51396,"asn_org":"Pfcloud UG (haftungsbeschrankt)","dest_port":4203,"network_protocol":"","application_protocol":"socks5","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":101000000,"source_bytes":3,"dest_bytes":14,"network_bytes":17,"event_summary":"\u0005\u0001\u0000"} +{"timestamp":"2026-09-06T23:12:11","event_id":"fc6c78da-43c3-4197-938c-f42b87585d60","source_ip":"204.76.203.221","source_port":55752,"source_domain":"204.76.203.221.ptr.pfcloud.network","country_code":"NL","country_name":"The Netherlands","city_name":"Eygelshoven","asn_number":51396,"asn_org":"Pfcloud UG (haftungsbeschrankt)","dest_port":4203,"network_protocol":"","application_protocol":"http_connect","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":101000000,"source_bytes":67,"dest_bytes":14,"network_bytes":81,"event_summary":"CONNECT api64.ipify.org:443 HTTP/1.1\r\nHost: api64.ipify.org:443\r\n\r\n"} +{"timestamp":"2026-09-06T23:11:54","event_id":"d4ee38a4-549d-4a0c-9ce0-ee77a4114f12","source_ip":"204.76.203.221","source_port":4714,"source_domain":"204.76.203.221.ptr.pfcloud.network","country_code":"NL","country_name":"The Netherlands","city_name":"Eygelshoven","asn_number":51396,"asn_org":"Pfcloud UG (haftungsbeschrankt)","dest_port":20028,"network_protocol":"","application_protocol":"http_connect","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":67,"dest_bytes":14,"network_bytes":81,"event_summary":"CONNECT api64.ipify.org:443 HTTP/1.1\r\nHost: api64.ipify.org:443\r\n\r\n"} +{"timestamp":"2026-09-06T23:11:54","event_id":"dd497055-df87-4a20-93d5-92b94cb2bd05","source_ip":"204.76.203.214","source_port":49888,"source_domain":"204.76.203.214.ptr.pfcloud.network","country_code":"NL","country_name":"The Netherlands","city_name":"Eygelshoven","asn_number":51396,"asn_org":"Pfcloud UG (haftungsbeschrankt)","dest_port":20028,"network_protocol":"","application_protocol":"socks5","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":102000000,"source_bytes":3,"dest_bytes":14,"network_bytes":17,"event_summary":"\u0005\u0001\u0000"} +{"timestamp":"2026-09-06T23:11:08","event_id":"e461397a-1821-47d2-a998-47da155f0011","source_ip":"204.76.203.221","source_port":15574,"source_domain":"204.76.203.221.ptr.pfcloud.network","country_code":"NL","country_name":"The Netherlands","city_name":"Eygelshoven","asn_number":51396,"asn_org":"Pfcloud UG (haftungsbeschrankt)","dest_port":1082,"network_protocol":"","application_protocol":"socks5","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":3,"dest_bytes":14,"network_bytes":17,"event_summary":"\u0005\u0001\u0000"} +{"timestamp":"2026-09-06T23:11:08","event_id":"bec962f0-8cf6-40da-8f44-49707f3cf2b8","source_ip":"204.76.203.214","source_port":23068,"source_domain":"204.76.203.214.ptr.pfcloud.network","country_code":"NL","country_name":"The Netherlands","city_name":"Eygelshoven","asn_number":51396,"asn_org":"Pfcloud UG (haftungsbeschrankt)","dest_port":1082,"network_protocol":"","application_protocol":"amazonaws","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":79,"dest_bytes":14,"network_bytes":93,"event_summary":"CONNECT checkip.amazonaws.com:443 HTTP/1.1\r\nHost: checkip.amazonaws.com:443\r\n\r\n"} +{"timestamp":"2026-09-06T23:08:11","event_id":"e5628600-8de9-4109-ba86-737eb87856c4","source_ip":"204.76.203.222","source_port":6638,"source_domain":"204.76.203.222.ptr.pfcloud.network","country_code":"NL","country_name":"The Netherlands","city_name":"Eygelshoven","asn_number":51396,"asn_org":"Pfcloud UG (haftungsbeschrankt)","dest_port":50020,"network_protocol":"","application_protocol":"socks5","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":144000000,"source_bytes":3,"dest_bytes":14,"network_bytes":17,"event_summary":"\u0005\u0001\u0000"} +{"timestamp":"2026-09-06T23:08:11","event_id":"3551d32c-b5f3-4658-a2cd-3a76b51595cf","source_ip":"204.76.203.213","source_port":48106,"source_domain":"204.76.203.213.ptr.pfcloud.network","country_code":"NL","country_name":"The Netherlands","city_name":"Eygelshoven","asn_number":51396,"asn_org":"Pfcloud UG (haftungsbeschrankt)","dest_port":50020,"network_protocol":"","application_protocol":"amazonaws","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":145000000,"source_bytes":79,"dest_bytes":14,"network_bytes":93,"event_summary":"CONNECT checkip.amazonaws.com:443 HTTP/1.1\r\nHost: checkip.amazonaws.com:443\r\n\r\n"} +{"timestamp":"2026-09-06T23:07:55","event_id":"415e27cb-f881-40e6-b8c8-27f987474390","source_ip":"204.76.203.222","source_port":8678,"source_domain":"204.76.203.222.ptr.pfcloud.network","country_code":"NL","country_name":"The Netherlands","city_name":"Eygelshoven","asn_number":51396,"asn_org":"Pfcloud UG (haftungsbeschrankt)","dest_port":6330,"network_protocol":"","application_protocol":"socks5","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":102000000,"source_bytes":3,"dest_bytes":14,"network_bytes":17,"event_summary":"\u0005\u0001\u0000"} +{"timestamp":"2026-09-06T23:07:55","event_id":"63741316-fb65-40d1-be98-a05258403364","source_ip":"204.76.203.213","source_port":23220,"source_domain":"204.76.203.213.ptr.pfcloud.network","country_code":"NL","country_name":"The Netherlands","city_name":"Eygelshoven","asn_number":51396,"asn_org":"Pfcloud UG (haftungsbeschrankt)","dest_port":6330,"network_protocol":"","application_protocol":"http_connect","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":101000000,"source_bytes":63,"dest_bytes":14,"network_bytes":77,"event_summary":"CONNECT icanhazip.com:443 HTTP/1.1\r\nHost: icanhazip.com:443\r\n\r\n"} +{"timestamp":"2026-09-06T23:07:14","event_id":"7228075d-ea4d-4278-a9c1-aad9ce2279ee","source_ip":"204.76.203.214","source_port":26612,"source_domain":"204.76.203.214.ptr.pfcloud.network","country_code":"NL","country_name":"The Netherlands","city_name":"Eygelshoven","asn_number":51396,"asn_org":"Pfcloud UG (haftungsbeschrankt)","dest_port":10474,"network_protocol":"","application_protocol":"socks5","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":3,"dest_bytes":14,"network_bytes":17,"event_summary":"\u0005\u0001\u0000"} +{"timestamp":"2026-09-06T23:07:14","event_id":"786c402b-38b9-4fde-9434-688b84203c16","source_ip":"204.76.203.213","source_port":25764,"source_domain":"204.76.203.213.ptr.pfcloud.network","country_code":"NL","country_name":"The Netherlands","city_name":"Eygelshoven","asn_number":51396,"asn_org":"Pfcloud UG (haftungsbeschrankt)","dest_port":10474,"network_protocol":"","application_protocol":"amazonaws","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":101000000,"source_bytes":79,"dest_bytes":14,"network_bytes":93,"event_summary":"CONNECT checkip.amazonaws.com:443 HTTP/1.1\r\nHost: checkip.amazonaws.com:443\r\n\r\n"} +{"timestamp":"2026-09-06T23:04:52","event_id":"df77e265-2606-4f90-b73d-80115b3e568c","source_ip":"204.76.203.222","source_port":51422,"source_domain":"204.76.203.222.ptr.pfcloud.network","country_code":"NL","country_name":"The Netherlands","city_name":"Eygelshoven","asn_number":51396,"asn_org":"Pfcloud UG (haftungsbeschrankt)","dest_port":20105,"network_protocol":"","application_protocol":"socks5","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":3,"dest_bytes":14,"network_bytes":17,"event_summary":"\u0005\u0001\u0000"} +{"timestamp":"2026-09-06T23:04:52","event_id":"923394d0-65ac-489d-b7f9-2466a113862c","source_ip":"204.76.203.213","source_port":9676,"source_domain":"204.76.203.213.ptr.pfcloud.network","country_code":"NL","country_name":"The Netherlands","city_name":"Eygelshoven","asn_number":51396,"asn_org":"Pfcloud UG (haftungsbeschrankt)","dest_port":20105,"network_protocol":"","application_protocol":"http_connect","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":101000000,"source_bytes":67,"dest_bytes":14,"network_bytes":81,"event_summary":"CONNECT api64.ipify.org:443 HTTP/1.1\r\nHost: api64.ipify.org:443\r\n\r\n"} +{"timestamp":"2026-09-06T23:04:39","event_id":"52bdcae5-8c21-488d-a1d7-9fab072e91bd","source_ip":"176.65.149.212","source_port":38310,"source_domain":"176.65.149.212.ptr.pfcloud.network","country_code":"NL","country_name":"The Netherlands","city_name":"Eygelshoven","asn_number":51396,"asn_org":"Pfcloud UG (haftungsbeschrankt)","dest_port":8038,"network_protocol":"","application_protocol":"ssh","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":115000000,"source_bytes":17,"dest_bytes":14,"network_bytes":31,"event_summary":"SSH-2.0-OpenSSH\r\n"} +{"timestamp":"2026-09-06T23:03:47","event_id":"f83d5e7c-de7c-45dc-9556-cd13b666d2b8","source_ip":"204.76.203.222","source_port":46728,"source_domain":"204.76.203.222.ptr.pfcloud.network","country_code":"NL","country_name":"The Netherlands","city_name":"Eygelshoven","asn_number":51396,"asn_org":"Pfcloud UG (haftungsbeschrankt)","dest_port":20011,"network_protocol":"","application_protocol":"socks5","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":3,"dest_bytes":14,"network_bytes":17,"event_summary":"\u0005\u0001\u0000"} +{"timestamp":"2026-09-06T23:03:47","event_id":"4e555db4-1b7f-4d47-8db1-d8b73706b30b","source_ip":"204.76.203.214","source_port":27728,"source_domain":"204.76.203.214.ptr.pfcloud.network","country_code":"NL","country_name":"The Netherlands","city_name":"Eygelshoven","asn_number":51396,"asn_org":"Pfcloud UG (haftungsbeschrankt)","dest_port":20011,"network_protocol":"","application_protocol":"http_connect","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":67,"dest_bytes":14,"network_bytes":81,"event_summary":"CONNECT api64.ipify.org:443 HTTP/1.1\r\nHost: api64.ipify.org:443\r\n\r\n"} +{"timestamp":"2026-09-06T23:03:41","event_id":"b24d5556-a5b6-49a2-a395-4ea5bb1b59b6","source_ip":"204.76.203.222","source_port":11534,"source_domain":"204.76.203.222.ptr.pfcloud.network","country_code":"NL","country_name":"The Netherlands","city_name":"Eygelshoven","asn_number":51396,"asn_org":"Pfcloud UG (haftungsbeschrankt)","dest_port":30006,"network_protocol":"","application_protocol":"socks5","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":101000000,"source_bytes":3,"dest_bytes":14,"network_bytes":17,"event_summary":"\u0005\u0001\u0000"} +{"timestamp":"2026-09-06T23:03:41","event_id":"1dca77e2-93be-4a85-a46c-299cc5e7c8f7","source_ip":"204.76.203.221","source_port":65274,"source_domain":"204.76.203.221.ptr.pfcloud.network","country_code":"NL","country_name":"The Netherlands","city_name":"Eygelshoven","asn_number":51396,"asn_org":"Pfcloud UG (haftungsbeschrankt)","dest_port":30006,"network_protocol":"","application_protocol":"amazonaws","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":79,"dest_bytes":14,"network_bytes":93,"event_summary":"CONNECT checkip.amazonaws.com:443 HTTP/1.1\r\nHost: checkip.amazonaws.com:443\r\n\r\n"} +{"timestamp":"2026-09-06T23:01:39","event_id":"b73a7bbf-324a-48c6-8417-697ad12467a5","source_ip":"204.76.203.221","source_port":57288,"source_domain":"204.76.203.221.ptr.pfcloud.network","country_code":"NL","country_name":"The Netherlands","city_name":"Eygelshoven","asn_number":51396,"asn_org":"Pfcloud UG (haftungsbeschrankt)","dest_port":11000,"network_protocol":"","application_protocol":"socks5","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":3,"dest_bytes":14,"network_bytes":17,"event_summary":"\u0005\u0001\u0000"} +{"timestamp":"2026-09-06T23:01:39","event_id":"1f8c1314-ca42-4cb0-81f8-7c50b1b733c1","source_ip":"204.76.203.213","source_port":6720,"source_domain":"204.76.203.213.ptr.pfcloud.network","country_code":"NL","country_name":"The Netherlands","city_name":"Eygelshoven","asn_number":51396,"asn_org":"Pfcloud UG (haftungsbeschrankt)","dest_port":11000,"network_protocol":"","application_protocol":"http_connect","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":102000000,"source_bytes":67,"dest_bytes":14,"network_bytes":81,"event_summary":"CONNECT api64.ipify.org:443 HTTP/1.1\r\nHost: api64.ipify.org:443\r\n\r\n"} +{"timestamp":"2026-09-06T22:58:48","event_id":"27d04307-7b1d-44a1-8f8a-ff9cd51ae7e7","source_ip":"204.76.203.214","source_port":52920,"source_domain":"204.76.203.214.ptr.pfcloud.network","country_code":"NL","country_name":"The Netherlands","city_name":"Eygelshoven","asn_number":51396,"asn_org":"Pfcloud UG (haftungsbeschrankt)","dest_port":9898,"network_protocol":"","application_protocol":"socks5","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":101000000,"source_bytes":3,"dest_bytes":14,"network_bytes":17,"event_summary":"\u0005\u0001\u0000"} \ No newline at end of file diff --git a/kevlar/2026-09-07/honeylabs/events-AS51852.ndjson b/kevlar/2026-09-07/honeylabs/events-AS51852.ndjson new file mode 100644 index 0000000..0de2d8f --- /dev/null +++ b/kevlar/2026-09-07/honeylabs/events-AS51852.ndjson @@ -0,0 +1,32 @@ +{"timestamp":"2026-09-04T19:27:10","event_id":"e3bf526d-779d-4d55-9f3c-2118cb5a6d7e","source_ip":"46.19.142.226","source_port":41174,"source_domain":"hostedby.privatelayer.com","country_code":"CH","country_name":"Switzerland","city_name":"","asn_number":51852,"asn_org":"Private Layer INC","dest_port":2087,"network_protocol":"tls","application_protocol":"http","http_method":"POST","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64)","url_path":"/login/?login_only=1","url_domain":"","http_request_headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"content-length\":\"20\",\"host\":\":2087\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\"}","ssh_client_hassh":"","tls_client_ja4":"t13i190800_9dc949149365_97f8aa674fd9","tls_client_ja3":"19e29534fd49dd27d09234e639c4057e","tls_client_version":"TLSv1.3","tls_client_cipher":"TLS_AES_128_GCM_SHA256","http_request_ja4h":"po11nn0500_c5c1780925fe","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":200,"dest_bytes":78,"network_bytes":278,"event_summary":""} +{"timestamp":"2026-09-04T19:27:10","event_id":"58284d32-335d-4c17-a679-d3ebfa7345af","source_ip":"46.19.142.226","source_port":41172,"source_domain":"hostedby.privatelayer.com","country_code":"CH","country_name":"Switzerland","city_name":"","asn_number":51852,"asn_org":"Private Layer INC","dest_port":2087,"network_protocol":"tls","application_protocol":"http","http_method":"GET","user_agent":"Mozilla/5.0","url_path":"/openid_connect/cpanelid","url_domain":"","http_request_headers":"{\"accept-encoding\":\"gzip\",\"host\":\":2087\",\"user-agent\":\"Mozilla/5.0\"}","ssh_client_hassh":"","tls_client_ja4":"t13i190800_9dc949149365_97f8aa674fd9","tls_client_ja3":"19e29534fd49dd27d09234e639c4057e","tls_client_version":"TLSv1.3","tls_client_cipher":"TLS_AES_128_GCM_SHA256","http_request_ja4h":"ge11nn0300_0db47b7d240d","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":114,"dest_bytes":78,"network_bytes":192,"event_summary":""} +{"timestamp":"2026-09-04T18:34:59","event_id":"b1cbfc26-7468-4d58-b4a9-d9f0d93cc47b","source_ip":"46.19.142.226","source_port":54674,"source_domain":"hostedby.privatelayer.com","country_code":"CH","country_name":"Switzerland","city_name":"","asn_number":51852,"asn_org":"Private Layer INC","dest_port":2087,"network_protocol":"tls","application_protocol":"http","http_method":"POST","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64)","url_path":"/login/?login_only=1","url_domain":"","http_request_headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"content-length\":\"20\",\"host\":\":2087\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\"}","ssh_client_hassh":"","tls_client_ja4":"t13i190800_9dc949149365_97f8aa674fd9","tls_client_ja3":"19e29534fd49dd27d09234e639c4057e","tls_client_version":"TLSv1.3","tls_client_cipher":"TLS_AES_128_GCM_SHA256","http_request_ja4h":"po11nn0500_c5c1780925fe","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":201,"dest_bytes":78,"network_bytes":279,"event_summary":""} +{"timestamp":"2026-09-04T18:34:59","event_id":"d5daae92-0aab-434a-b263-8120b3659ace","source_ip":"46.19.142.226","source_port":54660,"source_domain":"hostedby.privatelayer.com","country_code":"CH","country_name":"Switzerland","city_name":"","asn_number":51852,"asn_org":"Private Layer INC","dest_port":2087,"network_protocol":"tls","application_protocol":"http","http_method":"GET","user_agent":"Mozilla/5.0","url_path":"/openid_connect/cpanelid","url_domain":"","http_request_headers":"{\"accept-encoding\":\"gzip\",\"host\":\":2087\",\"user-agent\":\"Mozilla/5.0\"}","ssh_client_hassh":"","tls_client_ja4":"t13i190800_9dc949149365_97f8aa674fd9","tls_client_ja3":"19e29534fd49dd27d09234e639c4057e","tls_client_version":"TLSv1.3","tls_client_cipher":"TLS_AES_128_GCM_SHA256","http_request_ja4h":"ge11nn0300_0db47b7d240d","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":115,"dest_bytes":78,"network_bytes":193,"event_summary":""} +{"timestamp":"2026-09-04T18:34:20","event_id":"4829ffac-a4a5-4d99-8003-e0fef24fb7d3","source_ip":"46.19.142.226","source_port":35154,"source_domain":"hostedby.privatelayer.com","country_code":"CH","country_name":"Switzerland","city_name":"","asn_number":51852,"asn_org":"Private Layer INC","dest_port":2087,"network_protocol":"tls","application_protocol":"http","http_method":"POST","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64)","url_path":"/login/?login_only=1","url_domain":"","http_request_headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"content-length\":\"20\",\"host\":\":2087\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\"}","ssh_client_hassh":"","tls_client_ja4":"t13i190800_9dc949149365_97f8aa674fd9","tls_client_ja3":"19e29534fd49dd27d09234e639c4057e","tls_client_version":"TLSv1.3","tls_client_cipher":"TLS_CHACHA20_POLY1305_SHA256","http_request_ja4h":"po11nn0500_c5c1780925fe","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":101000000,"source_bytes":200,"dest_bytes":78,"network_bytes":278,"event_summary":""} +{"timestamp":"2026-09-04T18:34:20","event_id":"7983218d-b32a-4de8-a85c-a2204b7a20bd","source_ip":"46.19.142.226","source_port":35150,"source_domain":"hostedby.privatelayer.com","country_code":"CH","country_name":"Switzerland","city_name":"","asn_number":51852,"asn_org":"Private Layer INC","dest_port":2087,"network_protocol":"tls","application_protocol":"http","http_method":"GET","user_agent":"Mozilla/5.0","url_path":"/openid_connect/cpanelid","url_domain":"","http_request_headers":"{\"accept-encoding\":\"gzip\",\"host\":\":2087\",\"user-agent\":\"Mozilla/5.0\"}","ssh_client_hassh":"","tls_client_ja4":"t13i190800_9dc949149365_97f8aa674fd9","tls_client_ja3":"19e29534fd49dd27d09234e639c4057e","tls_client_version":"TLSv1.3","tls_client_cipher":"TLS_CHACHA20_POLY1305_SHA256","http_request_ja4h":"ge11nn0300_0db47b7d240d","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":114,"dest_bytes":78,"network_bytes":192,"event_summary":""} +{"timestamp":"2026-09-04T11:46:33","event_id":"5d784166-36bc-4cd4-8f22-138b953ff499","source_ip":"141.255.165.66","source_port":29456,"source_domain":"4soho.com","country_code":"CH","country_name":"Switzerland","city_name":"Zurich","asn_number":51852,"asn_org":"Private Layer INC","dest_port":1723,"network_protocol":"","application_protocol":"pptp","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":156,"dest_bytes":14,"network_bytes":170,"event_summary":"\u0000�\u0000\u0001\u001a+","http_request_headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\":8085\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0\"}","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"ge11nn0400_9c3956fad5da","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":170,"dest_bytes":78,"network_bytes":248,"event_summary":""} +{"timestamp":"2026-09-01T12:06:54","event_id":"af88c093-e605-464c-8bc5-7c2f6fb43c2e","source_ip":"179.43.186.220","source_port":16180,"source_domain":"hostedby.privatelayer.com","country_code":"CH","country_name":"Switzerland","city_name":"Rümlang","asn_number":51852,"asn_org":"Private Layer INC","dest_port":80,"network_protocol":"","application_protocol":"http","http_method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/125 Safari/537.36","url_path":"/wp-json/","url_domain":"","http_request_headers":"{\"accept\":\"text/html,application/json;q=0.9,*/*;q=0.8\",\"accept-encoding\":\"gzip\",\"host\":\"\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/125 Safari/537.36\"}","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"ge11nn0400_88d30a62b7ad","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":222,"dest_bytes":79,"network_bytes":301,"event_summary":""} +{"timestamp":"2026-09-01T12:06:48","event_id":"ef2aa5ee-8575-4f20-928b-76241191649d","source_ip":"179.43.186.220","source_port":26588,"source_domain":"hostedby.privatelayer.com","country_code":"CH","country_name":"Switzerland","city_name":"Rümlang","asn_number":51852,"asn_org":"Private Layer INC","dest_port":443,"network_protocol":"tls","application_protocol":"http","http_method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/125 Safari/537.36","url_path":"/","url_domain":"","http_request_headers":"{\"accept\":\"text/html,application/json;q=0.9,*/*;q=0.8\",\"accept-encoding\":\"gzip\",\"host\":\"\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/125 Safari/537.36\"}","ssh_client_hassh":"","tls_client_ja4":"t13i131000_f57a46bbacb6_ab7e3b40a677","tls_client_ja3":"56b0f6febc953849f7ace70c5a2ae34d","tls_client_version":"TLSv1.3","tls_client_cipher":"TLS_CHACHA20_POLY1305_SHA256","http_request_ja4h":"ge11nn0400_88d30a62b7ad","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":214,"dest_bytes":79,"network_bytes":293,"event_summary":""} +{"timestamp":"2026-09-01T12:06:48","event_id":"ce36e8d8-030b-48af-84af-847026382dbb","source_ip":"179.43.186.220","source_port":16172,"source_domain":"hostedby.privatelayer.com","country_code":"CH","country_name":"Switzerland","city_name":"Rümlang","asn_number":51852,"asn_org":"Private Layer INC","dest_port":80,"network_protocol":"","application_protocol":"http","http_method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/125 Safari/537.36","url_path":"/","url_domain":"","http_request_headers":"{\"accept\":\"text/html,application/json;q=0.9,*/*;q=0.8\",\"accept-encoding\":\"gzip\",\"host\":\"\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/125 Safari/537.36\"}","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"ge11nn0400_88d30a62b7ad","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":214,"dest_bytes":79,"network_bytes":293,"event_summary":""} +{"timestamp":"2026-09-01T07:55:46","event_id":"f9051fae-07c1-4f83-a000-99c8cde5a819","source_ip":"179.43.146.27","source_port":36984,"source_domain":"mta2.smartfastjoy3.com","country_code":"CH","country_name":"Switzerland","city_name":"Rümlang","asn_number":51852,"asn_org":"Private Layer INC","dest_port":32400,"network_protocol":"tls","application_protocol":"http","http_method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0","url_path":"/","url_domain":"","http_request_headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\":32400\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0\"}","ssh_client_hassh":"","tls_client_ja4":"t13i1310h1_f57a46bbacb6_e7c285222651","tls_client_ja3":"faa162b5a653756fba26803ea81b362f","tls_client_version":"TLSv1.3","tls_client_cipher":"TLS_AES_128_GCM_SHA256","http_request_ja4h":"ge11nn0400_9c3956fad5da","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":101000000,"source_bytes":171,"dest_bytes":78,"network_bytes":249,"event_summary":""} +{"timestamp":"2026-08-31T16:49:55","event_id":"5b352e94-db6a-45da-a7b9-31843a2ed8b5","source_ip":"179.43.150.26","source_port":50786,"source_domain":"hostedby.privatelayer.com","country_code":"CH","country_name":"Switzerland","city_name":"Rümlang","asn_number":51852,"asn_org":"Private Layer INC","dest_port":8443,"network_protocol":"","application_protocol":"http","http_method":"GET","user_agent":"Mozilla/5.0","url_path":"/z1356","url_domain":"","http_request_headers":"{\"accept\":\"*/*\",\"host\":\":8443\",\"user-agent\":\"Mozilla/5.0\"}","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"ge11nn0300_341eb0d8946c","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":4,"event_duration":1038000000,"source_bytes":352,"dest_bytes":312,"network_bytes":664,"event_summary":""} +{"timestamp":"2026-08-31T16:49:55","event_id":"5b352e94-db6a-45da-a7b9-31843a2ed8b5","source_ip":"179.43.150.26","source_port":50786,"source_domain":"hostedby.privatelayer.com","country_code":"CH","country_name":"Switzerland","city_name":"Rümlang","asn_number":51852,"asn_org":"Private Layer INC","dest_port":8443,"network_protocol":"","application_protocol":"http","http_method":"GET","user_agent":"Mozilla/5.0","url_path":"/s/1974","url_domain":"","http_request_headers":"{\"accept\":\"*/*\",\"host\":\":8443\",\"user-agent\":\"Mozilla/5.0\"}","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"ge11nn0300_341eb0d8946c","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":3,"event_duration":741000000,"source_bytes":264,"dest_bytes":234,"network_bytes":498,"event_summary":""} +{"timestamp":"2026-08-31T16:49:55","event_id":"5b352e94-db6a-45da-a7b9-31843a2ed8b5","source_ip":"179.43.150.26","source_port":50786,"source_domain":"hostedby.privatelayer.com","country_code":"CH","country_name":"Switzerland","city_name":"Rümlang","asn_number":51852,"asn_org":"Private Layer INC","dest_port":8443,"network_protocol":"","application_protocol":"http","http_method":"GET","user_agent":"Mozilla/5.0","url_path":"/.e199","url_domain":"","http_request_headers":"{\"accept\":\"*/*\",\"host\":\":8443\",\"user-agent\":\"Mozilla/5.0\"}","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"ge11nn0300_341eb0d8946c","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":2,"event_duration":433000000,"source_bytes":175,"dest_bytes":156,"network_bytes":331,"event_summary":""} +{"timestamp":"2026-08-31T16:49:54","event_id":"5b352e94-db6a-45da-a7b9-31843a2ed8b5","source_ip":"179.43.150.26","source_port":50786,"source_domain":"hostedby.privatelayer.com","country_code":"CH","country_name":"Switzerland","city_name":"Rümlang","asn_number":51852,"asn_org":"Private Layer INC","dest_port":8443,"network_protocol":"","application_protocol":"http","http_method":"GET","user_agent":"Mozilla/5.0","url_path":"/.env","url_domain":"","http_request_headers":"{\"accept\":\"*/*\",\"host\":\":8443\",\"user-agent\":\"Mozilla/5.0\"}","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"ge11nn0300_341eb0d8946c","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":87,"dest_bytes":78,"network_bytes":165,"event_summary":""} +{"timestamp":"2026-08-31T15:36:22","event_id":"b1eee67b-cd86-47c4-a031-cc111067d5f8","source_ip":"179.43.150.26","source_port":54320,"source_domain":"hostedby.privatelayer.com","country_code":"CH","country_name":"Switzerland","city_name":"Rümlang","asn_number":51852,"asn_org":"Private Layer INC","dest_port":8443,"network_protocol":"","application_protocol":"http","http_method":"GET","user_agent":"Mozilla/5.0","url_path":"/z945","url_domain":"","http_request_headers":"{\"accept\":\"*/*\",\"host\":\":8443\",\"user-agent\":\"Mozilla/5.0\"}","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"ge11nn0300_341eb0d8946c","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":4,"event_duration":1168000000,"source_bytes":344,"dest_bytes":312,"network_bytes":656,"event_summary":""} +{"timestamp":"2026-08-31T15:36:22","event_id":"b61409d4-193c-47ea-a783-bcf69924583c","source_ip":"179.43.150.26","source_port":42000,"source_domain":"hostedby.privatelayer.com","country_code":"CH","country_name":"Switzerland","city_name":"Rümlang","asn_number":51852,"asn_org":"Private Layer INC","dest_port":8443,"network_protocol":"","application_protocol":"http","http_method":"GET","user_agent":"Mozilla/5.0","url_path":"/z1891","url_domain":"","http_request_headers":"{\"accept\":\"*/*\",\"host\":\":8443\",\"user-agent\":\"Mozilla/5.0\"}","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"ge11nn0300_341eb0d8946c","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":4,"event_duration":987000000,"source_bytes":345,"dest_bytes":312,"network_bytes":657,"event_summary":""} +{"timestamp":"2026-08-31T15:36:21","event_id":"b1eee67b-cd86-47c4-a031-cc111067d5f8","source_ip":"179.43.150.26","source_port":54320,"source_domain":"hostedby.privatelayer.com","country_code":"CH","country_name":"Switzerland","city_name":"Rümlang","asn_number":51852,"asn_org":"Private Layer INC","dest_port":8443,"network_protocol":"","application_protocol":"http","http_method":"GET","user_agent":"Mozilla/5.0","url_path":"/s/1688","url_domain":"","http_request_headers":"{\"accept\":\"*/*\",\"host\":\":8443\",\"user-agent\":\"Mozilla/5.0\"}","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"ge11nn0300_341eb0d8946c","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":3,"event_duration":827000000,"source_bytes":259,"dest_bytes":234,"network_bytes":493,"event_summary":""} +{"timestamp":"2026-08-31T15:36:21","event_id":"b1eee67b-cd86-47c4-a031-cc111067d5f8","source_ip":"179.43.150.26","source_port":54320,"source_domain":"hostedby.privatelayer.com","country_code":"CH","country_name":"Switzerland","city_name":"Rümlang","asn_number":51852,"asn_org":"Private Layer INC","dest_port":8443,"network_protocol":"","application_protocol":"http","http_method":"GET","user_agent":"Mozilla/5.0","url_path":"/.e3448","url_domain":"","http_request_headers":"{\"accept\":\"*/*\",\"host\":\":8443\",\"user-agent\":\"Mozilla/5.0\"}","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"ge11nn0300_341eb0d8946c","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":2,"event_duration":463000000,"source_bytes":172,"dest_bytes":156,"network_bytes":328,"event_summary":""} +{"timestamp":"2026-08-31T15:36:21","event_id":"b1eee67b-cd86-47c4-a031-cc111067d5f8","source_ip":"179.43.150.26","source_port":54320,"source_domain":"hostedby.privatelayer.com","country_code":"CH","country_name":"Switzerland","city_name":"Rümlang","asn_number":51852,"asn_org":"Private Layer INC","dest_port":8443,"network_protocol":"","application_protocol":"http","http_method":"GET","user_agent":"Mozilla/5.0","url_path":"/.env","url_domain":"","http_request_headers":"{\"accept\":\"*/*\",\"host\":\":8443\",\"user-agent\":\"Mozilla/5.0\"}","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"ge11nn0300_341eb0d8946c","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":101000000,"source_bytes":85,"dest_bytes":78,"network_bytes":163,"event_summary":""} +{"timestamp":"2026-08-31T15:36:21","event_id":"b61409d4-193c-47ea-a783-bcf69924583c","source_ip":"179.43.150.26","source_port":42000,"source_domain":"hostedby.privatelayer.com","country_code":"CH","country_name":"Switzerland","city_name":"Rümlang","asn_number":51852,"asn_org":"Private Layer INC","dest_port":8443,"network_protocol":"","application_protocol":"http","http_method":"GET","user_agent":"Mozilla/5.0","url_path":"/s/6254","url_domain":"","http_request_headers":"{\"accept\":\"*/*\",\"host\":\":8443\",\"user-agent\":\"Mozilla/5.0\"}","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"ge11nn0300_341eb0d8946c","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":3,"event_duration":702000000,"source_bytes":259,"dest_bytes":234,"network_bytes":493,"event_summary":""} +{"timestamp":"2026-08-31T15:36:21","event_id":"b61409d4-193c-47ea-a783-bcf69924583c","source_ip":"179.43.150.26","source_port":42000,"source_domain":"hostedby.privatelayer.com","country_code":"CH","country_name":"Switzerland","city_name":"Rümlang","asn_number":51852,"asn_org":"Private Layer INC","dest_port":8443,"network_protocol":"","application_protocol":"http","http_method":"GET","user_agent":"Mozilla/5.0","url_path":"/.e4641","url_domain":"","http_request_headers":"{\"accept\":\"*/*\",\"host\":\":8443\",\"user-agent\":\"Mozilla/5.0\"}","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"ge11nn0300_341eb0d8946c","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":2,"event_duration":376000000,"source_bytes":172,"dest_bytes":156,"network_bytes":328,"event_summary":""} +{"timestamp":"2026-08-31T15:36:21","event_id":"b61409d4-193c-47ea-a783-bcf69924583c","source_ip":"179.43.150.26","source_port":42000,"source_domain":"hostedby.privatelayer.com","country_code":"CH","country_name":"Switzerland","city_name":"Rümlang","asn_number":51852,"asn_org":"Private Layer INC","dest_port":8443,"network_protocol":"","application_protocol":"http","http_method":"GET","user_agent":"Mozilla/5.0","url_path":"/.env","url_domain":"","http_request_headers":"{\"accept\":\"*/*\",\"host\":\":8443\",\"user-agent\":\"Mozilla/5.0\"}","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"ge11nn0300_341eb0d8946c","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":85,"dest_bytes":78,"network_bytes":163,"event_summary":""} +{"timestamp":"2026-08-31T15:32:53","event_id":"144bcfa3-e3de-495b-8f1f-4044dc2c78db","source_ip":"179.43.150.26","source_port":54024,"source_domain":"hostedby.privatelayer.com","country_code":"CH","country_name":"Switzerland","city_name":"Rümlang","asn_number":51852,"asn_org":"Private Layer INC","dest_port":8443,"network_protocol":"","application_protocol":"http","http_method":"GET","user_agent":"Mozilla/5.0","url_path":"/z3411","url_domain":"","http_request_headers":"{\"accept\":\"*/*\",\"host\":\":8443\",\"user-agent\":\"Mozilla/5.0\"}","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"ge11nn0300_341eb0d8946c","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":4,"event_duration":864000000,"source_bytes":349,"dest_bytes":312,"network_bytes":661,"event_summary":""} +{"timestamp":"2026-08-31T15:32:53","event_id":"144bcfa3-e3de-495b-8f1f-4044dc2c78db","source_ip":"179.43.150.26","source_port":54024,"source_domain":"hostedby.privatelayer.com","country_code":"CH","country_name":"Switzerland","city_name":"Rümlang","asn_number":51852,"asn_org":"Private Layer INC","dest_port":8443,"network_protocol":"","application_protocol":"http","http_method":"GET","user_agent":"Mozilla/5.0","url_path":"/s/7694","url_domain":"","http_request_headers":"{\"accept\":\"*/*\",\"host\":\":8443\",\"user-agent\":\"Mozilla/5.0\"}","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"ge11nn0300_341eb0d8946c","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":3,"event_duration":676000000,"source_bytes":262,"dest_bytes":234,"network_bytes":496,"event_summary":""} +{"timestamp":"2026-08-31T15:32:52","event_id":"144bcfa3-e3de-495b-8f1f-4044dc2c78db","source_ip":"179.43.150.26","source_port":54024,"source_domain":"hostedby.privatelayer.com","country_code":"CH","country_name":"Switzerland","city_name":"Rümlang","asn_number":51852,"asn_org":"Private Layer INC","dest_port":8443,"network_protocol":"","application_protocol":"http","http_method":"GET","user_agent":"Mozilla/5.0","url_path":"/.e7095","url_domain":"","http_request_headers":"{\"accept\":\"*/*\",\"host\":\":8443\",\"user-agent\":\"Mozilla/5.0\"}","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"ge11nn0300_341eb0d8946c","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":2,"event_duration":392000000,"source_bytes":174,"dest_bytes":156,"network_bytes":330,"event_summary":""} +{"timestamp":"2026-08-31T15:32:52","event_id":"144bcfa3-e3de-495b-8f1f-4044dc2c78db","source_ip":"179.43.150.26","source_port":54024,"source_domain":"hostedby.privatelayer.com","country_code":"CH","country_name":"Switzerland","city_name":"Rümlang","asn_number":51852,"asn_org":"Private Layer INC","dest_port":8443,"network_protocol":"","application_protocol":"http","http_method":"GET","user_agent":"Mozilla/5.0","url_path":"/.env","url_domain":"","http_request_headers":"{\"accept\":\"*/*\",\"host\":\":8443\",\"user-agent\":\"Mozilla/5.0\"}","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"ge11nn0300_341eb0d8946c","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":86,"dest_bytes":78,"network_bytes":164,"event_summary":""} \ No newline at end of file diff --git a/kevlar/2026-09-07/honeylabs/events-AS57043.ndjson b/kevlar/2026-09-07/honeylabs/events-AS57043.ndjson new file mode 100644 index 0000000..2c7100e --- /dev/null +++ b/kevlar/2026-09-07/honeylabs/events-AS57043.ndjson @@ -0,0 +1,12 @@ +{"timestamp":"2026-09-03T03:47:57","event_id":"1e3817f0-a1a4-46b7-9013-f28d17df1bf4","source_ip":"82.39.165.100","source_port":51071,"source_domain":"","country_code":"DE","country_name":"Germany","city_name":"Frankfurt am Main","asn_number":57043,"asn_org":"Hostkey B.v.","dest_port":22,"network_protocol":"","application_protocol":"ssh","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"98ddc5604ef6a1006a2b49a58759fbe6","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":166000000,"source_bytes":812,"dest_bytes":13,"network_bytes":825,"event_summary":"SSH-2.0-Go\r\n\u0000\u0000\u0003\u001c\t\u0014\f���MR��0��'D(��\u0000\u0000\u0000qcurve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1\u0000\u0000\u0001-ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa,ssh-dss,ssh-ed25519\u0000\u0000\u0000Uaes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr\u0000\u0000\u0000Uaes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr\u0000\u0000\u0000Bhmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96\u0000\u0000\u0000Bhmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96\u0000\u0000\u0000\u0004none\u0000\u0000\u0000\u0004none\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0010���f����"} +{"timestamp":"2026-09-03T03:28:44","event_id":"93a051be-273f-4957-8968-294c0c7e8b67","source_ip":"82.39.165.100","source_port":59633,"source_domain":"","country_code":"DE","country_name":"Germany","city_name":"Frankfurt am Main","asn_number":57043,"asn_org":"Hostkey B.v.","dest_port":22,"network_protocol":"","application_protocol":"ssh","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"98ddc5604ef6a1006a2b49a58759fbe6","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":453000000,"source_bytes":812,"dest_bytes":13,"network_bytes":825,"event_summary":"SSH-2.0-Go\r\n\u0000\u0000\u0003\u001c\t\u0014�<����w՛�سbc�\u0000\u0000\u0000qcurve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1\u0000\u0000\u0001-ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa,ssh-dss,ssh-ed25519\u0000\u0000\u0000Uaes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr\u0000\u0000\u0000Uaes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr\u0000\u0000\u0000Bhmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96\u0000\u0000\u0000Bhmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96\u0000\u0000\u0000\u0004none\u0000\u0000\u0000\u0004none\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000�x~��e\ri�"} +{"timestamp":"2026-09-02T21:19:46","event_id":"f60f3808-99b6-4f53-b37f-579a605741e9","source_ip":"163.5.16.6","source_port":8315,"source_domain":"","country_code":"GB","country_name":"United Kingdom","city_name":"London","asn_number":57043,"asn_org":"Hostkey B.v.","dest_port":19571,"network_protocol":"","application_protocol":"rdp","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":19,"dest_bytes":10,"network_bytes":29,"event_summary":"\u0003\u0000\u0000\u0013\u000e�\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000"} +{"timestamp":"2026-09-02T21:19:36","event_id":"75f1111a-32b9-4dd6-8695-79fa7cd62698","source_ip":"163.5.16.6","source_port":3027,"source_domain":"","country_code":"GB","country_name":"United Kingdom","city_name":"London","asn_number":57043,"asn_org":"Hostkey B.v.","dest_port":19571,"network_protocol":"","application_protocol":"rdp","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":19,"dest_bytes":10,"network_bytes":29,"event_summary":"\u0003\u0000\u0000\u0013\u000e�\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000"} +{"timestamp":"2026-09-02T21:19:35","event_id":"6a566b38-21a7-4d73-b456-2ff3cb935d34","source_ip":"163.5.16.6","source_port":2913,"source_domain":"","country_code":"GB","country_name":"United Kingdom","city_name":"London","asn_number":57043,"asn_org":"Hostkey B.v.","dest_port":19571,"network_protocol":"","application_protocol":"rdp","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":19,"dest_bytes":10,"network_bytes":29,"event_summary":"\u0003\u0000\u0000\u0013\u000e�\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000"} +{"timestamp":"2026-09-02T21:17:28","event_id":"b813e4f7-babf-4454-b715-a960656463c4","source_ip":"163.5.16.6","source_port":7296,"source_domain":"","country_code":"GB","country_name":"United Kingdom","city_name":"London","asn_number":57043,"asn_org":"Hostkey B.v.","dest_port":5070,"network_protocol":"","application_protocol":"rdp","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":19,"dest_bytes":10,"network_bytes":29,"event_summary":"\u0003\u0000\u0000\u0013\u000e�\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000"} +{"timestamp":"2026-09-02T21:13:20","event_id":"7ac37f87-3ff5-4fad-845a-2be8da3ea05a","source_ip":"163.5.16.6","source_port":13381,"source_domain":"","country_code":"GB","country_name":"United Kingdom","city_name":"London","asn_number":57043,"asn_org":"Hostkey B.v.","dest_port":14603,"network_protocol":"","application_protocol":"rdp","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":19,"dest_bytes":10,"network_bytes":29,"event_summary":"\u0003\u0000\u0000\u0013\u000e�\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000"} +{"timestamp":"2026-09-02T21:13:19","event_id":"d61fae98-7e28-469c-8f89-816c804b888c","source_ip":"163.5.16.6","source_port":12957,"source_domain":"","country_code":"GB","country_name":"United Kingdom","city_name":"London","asn_number":57043,"asn_org":"Hostkey B.v.","dest_port":20271,"network_protocol":"","application_protocol":"rdp","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":19,"dest_bytes":10,"network_bytes":29,"event_summary":"\u0003\u0000\u0000\u0013\u000e�\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000"} +{"timestamp":"2026-09-02T21:03:21","event_id":"9c359aa4-344e-4a79-ba49-90cdeb2c2508","source_ip":"163.5.16.6","source_port":53446,"source_domain":"","country_code":"GB","country_name":"United Kingdom","city_name":"London","asn_number":57043,"asn_org":"Hostkey B.v.","dest_port":42481,"network_protocol":"","application_protocol":"rdp","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":19,"dest_bytes":10,"network_bytes":29,"event_summary":"\u0003\u0000\u0000\u0013\u000e�\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000"} +{"timestamp":"2026-09-02T21:02:40","event_id":"11f773c4-942e-43e0-82db-665e9a83311a","source_ip":"163.5.16.6","source_port":32984,"source_domain":"","country_code":"GB","country_name":"United Kingdom","city_name":"London","asn_number":57043,"asn_org":"Hostkey B.v.","dest_port":44981,"network_protocol":"","application_protocol":"rdp","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":19,"dest_bytes":10,"network_bytes":29,"event_summary":"\u0003\u0000\u0000\u0013\u000e�\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000"} +{"timestamp":"2026-08-31T15:43:13","event_id":"b48001ad-4b6a-4ff9-9794-4e43328fcfaa","source_ip":"82.39.165.100","source_port":62142,"source_domain":"","country_code":"DE","country_name":"Germany","city_name":"Frankfurt am Main","asn_number":57043,"asn_org":"Hostkey B.v.","dest_port":22,"network_protocol":"","application_protocol":"ssh","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"98ddc5604ef6a1006a2b49a58759fbe6","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":165000000,"source_bytes":812,"dest_bytes":13,"network_bytes":825,"event_summary":"SSH-2.0-Go\r\n\u0000\u0000\u0003\u001c\t\u0014�\r�L\u001d�\u0016O�EK�w�<\u0000\u0000\u0000qcurve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1\u0000\u0000\u0001-ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa,ssh-dss,ssh-ed25519\u0000\u0000\u0000Uaes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr\u0000\u0000\u0000Uaes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr\u0000\u0000\u0000Bhmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96\u0000\u0000\u0000Bhmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96\u0000\u0000\u0000\u0004none\u0000\u0000\u0000\u0004none\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000%BJ�c���{"} +{"timestamp":"2026-08-31T15:39:39","event_id":"190a3bf5-5b40-4feb-8571-cc49b4eb05db","source_ip":"82.39.165.100","source_port":49356,"source_domain":"","country_code":"DE","country_name":"Germany","city_name":"Frankfurt am Main","asn_number":57043,"asn_org":"Hostkey B.v.","dest_port":22,"network_protocol":"","application_protocol":"ssh","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"98ddc5604ef6a1006a2b49a58759fbe6","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":329000000,"source_bytes":812,"dest_bytes":13,"network_bytes":825,"event_summary":"SSH-2.0-Go\r\n\u0000\u0000\u0003\u001c\t\u0014�\u0016a�K2\u000bAޠ_{\u001a��8\u0000\u0000\u0000qcurve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1\u0000\u0000\u0001-ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa,ssh-dss,ssh-ed25519\u0000\u0000\u0000Uaes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr\u0000\u0000\u0000Uaes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr\u0000\u0000\u0000Bhmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96\u0000\u0000\u0000Bhmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96\u0000\u0000\u0000\u0004none\u0000\u0000\u0000\u0004none\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000�&���\u0013\u0000,�"} \ No newline at end of file diff --git a/kevlar/2026-09-07/honeylabs/events-AS58854.ndjson b/kevlar/2026-09-07/honeylabs/events-AS58854.ndjson new file mode 100644 index 0000000..e69de29 diff --git a/kevlar/2026-09-07/honeylabs/fingerprints.csv b/kevlar/2026-09-07/honeylabs/fingerprints.csv new file mode 100644 index 0000000..db55459 --- /dev/null +++ b/kevlar/2026-09-07/honeylabs/fingerprints.csv @@ -0,0 +1,37 @@ +ip,asn,events,ja4,ja4h,hassh,user_agents,url_paths +"45.151.101.38","AS216246","1","t13i181000_85036bcba153_d41ae481755e","po11nn0600_def5433ae821","","Python-urllib/3.10","/api2/json/access/ticket" +"176.124.222.61","AS216246","1","","","","","" +"176.65.149.27","AS51396","1","","","","","" +"204.76.203.221","AS51396","18","","","","","" +"204.76.203.214","AS51396","25","","","","","" +"176.65.148.243","AS51396","2","","","","","" +"176.65.134.48","AS51396","4","","ge11nn0400_9c3956fad5da","","Go-http-client/1.1","http://proxy.flarevpn.digital:8080/judge" +"204.76.203.222","AS51396","20","","","","","" +"204.76.203.213","AS51396","20","","","","","" +"176.65.149.31","AS51396","1","","","","","" +"45.135.193.193","AS51396","8","","","","","" +"176.65.149.212","AS51396","1","","","","","" +"176.120.22.240","AS198953","30","t12i210600_76e208dd3e22_f28add8e7af0","ge11nn0200_549fad093d6b ge11nn0300_80168362a4ec","","","/remote/login?lang=en" +"193.143.1.66","AS198953","6","","","","","" +"176.120.22.61","AS198953","64","","","","","" +"185.100.87.136","AS200651","24","t13i1909h2_9dc949149365_97f8aa674fd9","ge11nn0400_88d30a62b7ad po11nn0600_c9506d37ac14 po11nn0500_e4a47a99f1ac","","Mozilla/5.0 (Android 12; Mobile; rv:117.0) Gecko/117.0 Focus/117.0 | SPARK COMMIT: 08059e95dacafe0bf6e5782f8e2c8ec9cd8c5a17 | Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:104.71.6212.24) Gecko/25.2.4212.671 Firefox/2.0 | Mozilla/5.0 (Windows NT 10.0; Win64; x64) | Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3 rv:3.0; eu-FR) AppleWebKit/533.4.2 (KHTML, like Gecko) Version/5.0.1 Safari/533.4.2","/eventmanager /api/client/update?arch=amd64&commit=08059e95dacafe0bf6e5782f8e2c8ec9cd8c5a17&os=windows / /api/checkin /images/transparentpix.gif" +"185.246.217.150","AS210644","51","t13i170900_5b57614c22b0_78e6aca7449b","ge11nn0500_7992432eef13 ge11nn0700_3161ce9d7233 po11nn0700_3161ce9d7233 ge11nn0500_3012a89e1aee","19532158b559096b89b1a5f7d17175b2","libredtail-http","/containers/json /index.php?lang=../../../../../../../../tmp/index1 /index.php?lang=../../../../../../../../usr/local/lib/php/pearcmd&+config-create+/&/+/tmp/index1.php /public/index.php?s=/index/\think\app/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1][]=Hello /index.php?s=/index/\think\app/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1][]=Hello /app/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php /apps/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php /public/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php /panel/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php /workspace/drupal/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php" +"46.19.142.226","AS51852","6","t13i190800_9dc949149365_97f8aa674fd9","po11nn0500_c5c1780925fe ge11nn0300_0db47b7d240d","","Mozilla/5.0 (Windows NT 10.0; Win64; x64) | Mozilla/5.0","/login/?login_only=1 /openid_connect/cpanelid" +"141.255.165.66","AS51852","5","","","","","" +"179.43.146.27","AS51852","2","t13i1310h1_f57a46bbacb6_e7c285222651","ge11nn0400_9c3956fad5da","","Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0","/" +"179.43.186.220","AS51852","3","t13i131000_f57a46bbacb6_ab7e3b40a677","ge11nn0400_88d30a62b7ad","","Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/125 Safari/537.36","/wp-json/ /" +"179.43.150.26","AS51852","16","","ge11nn0300_341eb0d8946c","","Mozilla/5.0","/z1356 /s/1974 /.e199 /.env /z945 /z1891 /s/1688 /.e3448 /s/6254 /.e4641" +"45.61.149.189","AS14956","1","t13i181000_85036bcba153_d41ae481755e","ge11nn0400_8fd06a127c33","","Python-urllib/3.13","/webclient/" +"45.61.183.10","AS14956","4","","","","","" +"216.126.239.215","AS14956","8","","","","","" +"144.172.108.79","AS14956","24","","","","","" +"167.88.168.121","AS14956","4","","ge11nn0400_9c3956fad5da","","Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0","/" +"144.172.112.11","AS14956","2","","","","","" +"45.61.157.82","AS14956","32","","","","","" +"216.126.227.187","AS14956","1","","ge11nn0400_c3abebcf3d28","","Python/3.13 aiohttp/3.13.5","/api/v1/version" +"144.172.100.114","AS14956","1","","","","","" +"144.172.99.12","AS14956","1","t13i100900_61a7ad8aa9b6_88aa062a14c8","ge11nn0300_7fd797acd99d","","Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36","/.env" +"144.172.115.222","AS14956","1","t13i311000_e8f1e7e78f70_d41ae481755e","","","","" +"144.172.99.200","AS14956","16","","","","","" +"82.39.165.100","AS57043","4","","","98ddc5604ef6a1006a2b49a58759fbe6","","" +"163.5.16.6","AS57043","8","","","","","" \ No newline at end of file diff --git a/kevlar/2026-09-07/honeylabs/ioc-lookups.json b/kevlar/2026-09-07/honeylabs/ioc-lookups.json new file mode 100644 index 0000000..252b936 --- /dev/null +++ b/kevlar/2026-09-07/honeylabs/ioc-lookups.json @@ -0,0 +1,1175 @@ +[ + { + "asn": "AS57043", + "name": "HOSTKEY-AS", + "ip": "163.5.16.6", + "event_count": 8, + "lookup": { + "total_events": 8, + "first_seen": "2026-09-02T21:02:40", + "last_seen": "2026-09-02T21:19:46", + "asn_number": 57043, + "asn_org": "Hostkey B.v.", + "country_name": "United Kingdom", + "country_code": "GB", + "ports_targeted": [ + 19571, + 42481, + 5070, + 14603, + 44981, + 20271 + ], + "ports_targeted_count": 6, + "tls_event_count": 0, + "top_http_methods": [], + "top_user_agents": [], + "top_url_paths": [], + "top_ja4_fingerprints": [], + "top_ja3_fingerprints": [], + "top_hassh_fingerprints": [], + "client_cert_event_count": 0, + "client_cert_subjects": [], + "rdns": "", + "loader_hits": 0, + "exploit_hits": 0, + "bytes_sent": 152, + "unique_source_ips": 1, + "ioc": "163.5.16.6", + "window": "last 7 days", + "query_type": "ip", + "scanner": null, + "verdict_key": "probing", + "verdict": "Low-level probing", + "verdict_why": [ + "8 event(s), fewer than 10 distinct ports, no exploit payloads.", + "Not in any known-scanner range." + ], + "verdict_confidence": "low", + "cve_probes": [] + } + }, + { + "asn": "AS57043", + "name": "HOSTKEY-AS", + "ip": "82.39.165.100", + "event_count": 4, + "lookup": { + "total_events": 4, + "first_seen": "2026-08-31T15:39:39", + "last_seen": "2026-09-03T03:47:57", + "asn_number": 57043, + "asn_org": "Hostkey B.v.", + "country_name": "Germany", + "country_code": "DE", + "ports_targeted": [ + 22 + ], + "ports_targeted_count": 1, + "tls_event_count": 0, + "top_http_methods": [], + "top_user_agents": [], + "top_url_paths": [], + "top_ja4_fingerprints": [], + "top_ja3_fingerprints": [], + "top_hassh_fingerprints": [ + "98ddc5604ef6a1006a2b49a58759fbe6" + ], + "client_cert_event_count": 0, + "client_cert_subjects": [], + "rdns": "", + "loader_hits": 0, + "exploit_hits": 0, + "bytes_sent": 3248, + "unique_source_ips": 1, + "ioc": "82.39.165.100", + "window": "last 7 days", + "query_type": "ip", + "scanner": null, + "verdict_key": "probing", + "verdict": "Low-level probing", + "verdict_why": [ + "4 event(s), fewer than 10 distinct ports, no exploit payloads.", + "Not in any known-scanner range." + ], + "verdict_confidence": "low", + "cve_probes": [] + } + }, + { + "asn": "AS210644", + "name": "AEZA-AS", + "ip": "185.246.217.150", + "event_count": 51, + "lookup": { + "total_events": 51, + "first_seen": "2026-08-31T22:44:34", + "last_seen": "2026-09-02T15:29:27", + "asn_number": 210644, + "asn_org": "Aeza Group LLC", + "country_name": "The Netherlands", + "country_code": "NL", + "ports_targeted": [ + 443, + 2222, + 2375 + ], + "ports_targeted_count": 3, + "tls_event_count": 49, + "top_http_methods": [ + "GET", + "POST" + ], + "top_user_agents": [ + "libredtail-http" + ], + "top_url_paths": [ + "/containers/json", + "/crm/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php", + "/cms/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php", + "/demo/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php", + "/yii/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php", + "/api/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php", + "/testing/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php", + "/ws/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php", + "/ws/ec/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php", + "/test/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php" + ], + "top_ja4_fingerprints": [ + "t13i170900_5b57614c22b0_78e6aca7449b" + ], + "top_ja3_fingerprints": [ + "052a5e65c3a64e860e1706b1de3c46a9" + ], + "top_hassh_fingerprints": [ + "19532158b559096b89b1a5f7d17175b2" + ], + "client_cert_event_count": 0, + "client_cert_subjects": [], + "rdns": "", + "loader_hits": 2, + "exploit_hits": 45, + "bytes_sent": 610617, + "unique_source_ips": 1, + "ioc": "185.246.217.150", + "window": "last 7 days", + "query_type": "ip", + "scanner": null, + "verdict_key": "malicious", + "verdict": "Exploit attempts observed", + "verdict_why": [ + "45 request(s) matched a known exploit path.", + "Exploit-path hits present; HTTP verb mix unknown, so read cautiously.", + "5+ hits raise confidence to high.", + "Not in any known-scanner range.", + "Sent 610,617 bytes: sustained payload delivery, not a single opportunistic request." + ], + "verdict_confidence": "high", + "cve_probes": [ + { + "cve_id": "CVE-2017-9841", + "title": "PHPUnit - Remote Code Execution", + "severity": "critical", + "actively_exploited": true + }, + { + "cve_id": "CVE-2021-42013", + "title": "Apache 2.4.49/2.4.50 - Path Traversal and Remote Code Execution", + "severity": "critical", + "actively_exploited": true + } + ] + } + }, + { + "asn": "AS14956", + "name": "ROUTERHOSTING", + "ip": "45.61.157.82", + "event_count": 32, + "lookup": { + "total_events": 32, + "first_seen": "2026-09-04T01:15:12", + "last_seen": "2026-09-04T06:30:09", + "asn_number": 14956, + "asn_org": "RouterHosting LLC", + "country_name": "United States", + "country_code": "US", + "ports_targeted": [ + 445 + ], + "ports_targeted_count": 1, + "tls_event_count": 0, + "top_http_methods": [], + "top_user_agents": [], + "top_url_paths": [], + "top_ja4_fingerprints": [], + "top_ja3_fingerprints": [], + "top_hassh_fingerprints": [], + "client_cert_event_count": 0, + "client_cert_subjects": [], + "rdns": "82.157.61.45.static.cloudzy.com", + "loader_hits": 0, + "exploit_hits": 0, + "bytes_sent": 8684, + "unique_source_ips": 1, + "ioc": "45.61.157.82", + "window": "last 7 days", + "query_type": "ip", + "scanner": null, + "verdict_key": "probing", + "verdict": "Low-level probing", + "verdict_why": [ + "32 event(s), fewer than 10 distinct ports, no exploit payloads.", + "Not in any known-scanner range.", + "Sent 8,684 bytes despite few ports and no known exploit path: focused interaction with one service, worth a look." + ], + "verdict_confidence": "low", + "cve_probes": [] + } + }, + { + "asn": "AS14956", + "name": "ROUTERHOSTING", + "ip": "144.172.108.79", + "event_count": 24, + "lookup": { + "total_events": 24, + "first_seen": "2026-09-04T20:02:59", + "last_seen": "2026-09-05T02:54:19", + "asn_number": 14956, + "asn_org": "RouterHosting LLC", + "country_name": "United States", + "country_code": "US", + "ports_targeted": [ + 445 + ], + "ports_targeted_count": 1, + "tls_event_count": 0, + "top_http_methods": [], + "top_user_agents": [], + "top_url_paths": [], + "top_ja4_fingerprints": [], + "top_ja3_fingerprints": [], + "top_hassh_fingerprints": [], + "client_cert_event_count": 0, + "client_cert_subjects": [], + "rdns": "79.108.172.144.static.cloudzy.com", + "loader_hits": 0, + "exploit_hits": 0, + "bytes_sent": 6513, + "unique_source_ips": 1, + "ioc": "144.172.108.79", + "window": "last 7 days", + "query_type": "ip", + "scanner": null, + "verdict_key": "probing", + "verdict": "Low-level probing", + "verdict_why": [ + "24 event(s), fewer than 10 distinct ports, no exploit payloads.", + "Not in any known-scanner range.", + "Sent 6,513 bytes despite few ports and no known exploit path: focused interaction with one service, worth a look." + ], + "verdict_confidence": "low", + "cve_probes": [] + } + }, + { + "asn": "AS14956", + "name": "ROUTERHOSTING", + "ip": "144.172.99.200", + "event_count": 16, + "lookup": { + "total_events": 16, + "first_seen": "2026-09-01T07:55:37", + "last_seen": "2026-09-01T08:57:36", + "asn_number": 14956, + "asn_org": "RouterHosting LLC", + "country_name": "United States", + "country_code": "US", + "ports_targeted": [ + 445 + ], + "ports_targeted_count": 1, + "tls_event_count": 0, + "top_http_methods": [], + "top_user_agents": [], + "top_url_paths": [], + "top_ja4_fingerprints": [], + "top_ja3_fingerprints": [], + "top_hassh_fingerprints": [], + "client_cert_event_count": 0, + "client_cert_subjects": [], + "rdns": "200.99.172.144.static.cloudzy.com", + "loader_hits": 0, + "exploit_hits": 0, + "bytes_sent": 4342, + "unique_source_ips": 1, + "ioc": "144.172.99.200", + "window": "last 7 days", + "query_type": "ip", + "scanner": null, + "verdict_key": "probing", + "verdict": "Low-level probing", + "verdict_why": [ + "16 event(s), fewer than 10 distinct ports, no exploit payloads.", + "Not in any known-scanner range.", + "Sent 4,342 bytes despite few ports and no known exploit path: focused interaction with one service, worth a look." + ], + "verdict_confidence": "low", + "cve_probes": [] + } + }, + { + "asn": "AS51852", + "name": "PLI-AS", + "ip": "179.43.150.26", + "event_count": 16, + "lookup": { + "total_events": 16, + "first_seen": "2026-08-31T15:32:52", + "last_seen": "2026-08-31T16:49:55", + "asn_number": 51852, + "asn_org": "Private Layer INC", + "country_name": "Switzerland", + "country_code": "CH", + "ports_targeted": [ + 8443 + ], + "ports_targeted_count": 1, + "tls_event_count": 0, + "top_http_methods": [ + "GET" + ], + "top_user_agents": [ + "Mozilla/5.0" + ], + "top_url_paths": [ + "/.env", + "/z1356", + "/s/1974", + "/.e199", + "/z1891", + "/s/1688", + "/.e3448", + "/z945", + "/s/7694", + "/s/6254" + ], + "top_ja4_fingerprints": [], + "top_ja3_fingerprints": [], + "top_hassh_fingerprints": [], + "client_cert_event_count": 0, + "client_cert_subjects": [], + "rdns": "hostedby.privatelayer.com", + "loader_hits": 0, + "exploit_hits": 4, + "bytes_sent": 3470, + "unique_source_ips": 1, + "ioc": "179.43.150.26", + "window": "last 7 days", + "query_type": "ip", + "scanner": null, + "verdict_key": "malicious", + "verdict": "Exploit attempts observed", + "verdict_why": [ + "4 request(s) matched a known exploit path.", + "Exploit-path hits present; HTTP verb mix unknown, so read cautiously.", + "Under 5 hits, so confidence is medium.", + "Not in any known-scanner range." + ], + "verdict_confidence": "medium", + "cve_probes": [] + } + }, + { + "asn": "AS51852", + "name": "PLI-AS", + "ip": "46.19.142.226", + "event_count": 6, + "lookup": { + "total_events": 6, + "first_seen": "2026-09-04T18:34:20", + "last_seen": "2026-09-04T19:27:10", + "asn_number": 51852, + "asn_org": "Private Layer INC", + "country_name": "Switzerland", + "country_code": "CH", + "ports_targeted": [ + 2087 + ], + "ports_targeted_count": 1, + "tls_event_count": 6, + "top_http_methods": [ + "GET", + "POST" + ], + "top_user_agents": [ + "Mozilla/5.0", + "Mozilla/5.0 (Windows NT 10.0; Win64; x64)" + ], + "top_url_paths": [ + "/openid_connect/cpanelid", + "/login/?login_only=1" + ], + "top_ja4_fingerprints": [ + "t13i190800_9dc949149365_97f8aa674fd9" + ], + "top_ja3_fingerprints": [ + "19e29534fd49dd27d09234e639c4057e" + ], + "top_hassh_fingerprints": [], + "client_cert_event_count": 0, + "client_cert_subjects": [], + "rdns": "hostedby.privatelayer.com", + "loader_hits": 0, + "exploit_hits": 0, + "bytes_sent": 944, + "unique_source_ips": 1, + "ioc": "46.19.142.226", + "window": "last 7 days", + "query_type": "ip", + "scanner": null, + "verdict_key": "probing", + "verdict": "Low-level probing", + "verdict_why": [ + "6 event(s), fewer than 10 distinct ports, no exploit payloads.", + "Not in any known-scanner range." + ], + "verdict_confidence": "low", + "cve_probes": [ + { + "cve_id": "CVE-2026-41940", + "title": "cPanel & WHM - Authentication Bypass via Session-File CRLF Injection", + "severity": "CRITICAL", + "actively_exploited": true + } + ] + } + }, + { + "asn": "AS51852", + "name": "PLI-AS", + "ip": "141.255.165.66", + "event_count": 5, + "lookup": { + "total_events": 5, + "first_seen": "2026-09-03T20:48:30", + "last_seen": "2026-09-04T11:46:33", + "asn_number": 51852, + "asn_org": "Private Layer INC", + "country_name": "Switzerland", + "country_code": "CH", + "ports_targeted": [ + 1723 + ], + "ports_targeted_count": 1, + "tls_event_count": 0, + "top_http_methods": [], + "top_user_agents": [], + "top_url_paths": [], + "top_ja4_fingerprints": [], + "top_ja3_fingerprints": [], + "top_hassh_fingerprints": [], + "client_cert_event_count": 0, + "client_cert_subjects": [], + "rdns": "4soho.com", + "loader_hits": 0, + "exploit_hits": 0, + "bytes_sent": 780, + "unique_source_ips": 1, + "ioc": "141.255.165.66", + "window": "last 7 days", + "query_type": "ip", + "scanner": null, + "verdict_key": "probing", + "verdict": "Low-level probing", + "verdict_why": [ + "5 event(s), fewer than 10 distinct ports, no exploit payloads.", + "Not in any known-scanner range." + ], + "verdict_confidence": "low", + "cve_probes": [] + } + }, + { + "asn": "AS51396", + "name": "PFCLOUD", + "ip": "204.76.203.222", + "event_count": 1159, + "lookup": { + "total_events": 1331, + "first_seen": "2026-09-02T09:47:23", + "last_seen": "2026-09-07T09:45:33", + "asn_number": 51396, + "asn_org": "Pfcloud UG (haftungsbeschrankt)", + "country_name": "The Netherlands", + "country_code": "NL", + "ports_targeted": [ + 5151, + 10118, + 11517, + 2222, + 10080, + 50009, + 7375, + 52120, + 50032, + 11004, + 11338, + 2018, + 8004, + 11238, + 8084, + 10803, + 6666, + 13292, + 9000, + 6652, + 9443, + 11148, + 5477, + 56789, + 10165, + 30006, + 10023, + 30011, + 10001, + 5001, + 2026, + 11635, + 11435, + 11409, + 2030, + 6128, + 11415, + 6969, + 20999, + 8095, + 9252, + 13509, + 5212, + 8045, + 50007, + 9054, + 12367, + 32536, + 3389, + 9098 + ], + "ports_targeted_count": 879, + "tls_event_count": 0, + "top_http_methods": [], + "top_user_agents": [], + "top_url_paths": [], + "top_ja4_fingerprints": [], + "top_ja3_fingerprints": [], + "top_hassh_fingerprints": [], + "client_cert_event_count": 0, + "client_cert_subjects": [], + "rdns": "204.76.203.222.ptr.pfcloud.network", + "loader_hits": 0, + "exploit_hits": 0, + "bytes_sent": 49337, + "unique_source_ips": 1, + "ioc": "204.76.203.222", + "window": "last 7 days", + "query_type": "ip", + "scanner": null, + "verdict_key": "scanning", + "verdict": "Unrecognized scanner", + "verdict_why": [ + "No exploit payloads observed.", + "Swept 879 distinct ports (threshold for a sweep is 10).", + "Not in any known-scanner range." + ], + "verdict_confidence": "medium", + "cve_probes": [] + } + }, + { + "asn": "AS51396", + "name": "PFCLOUD", + "ip": "204.76.203.221", + "event_count": 1154, + "lookup": { + "total_events": 1332, + "first_seen": "2026-09-02T09:47:23", + "last_seen": "2026-09-07T09:47:47", + "asn_number": 51396, + "asn_org": "Pfcloud UG (haftungsbeschrankt)", + "country_name": "The Netherlands", + "country_code": "NL", + "ports_targeted": [ + 5477, + 11617, + 11918, + 10080, + 11587, + 10231, + 5918, + 6588, + 11416, + 11000, + 20898, + 5507, + 31280, + 11181, + 9258, + 20274, + 9040, + 20132, + 1083, + 20621, + 11081, + 11111, + 11528, + 20023, + 6685, + 10031, + 20038, + 10023, + 3129, + 50008, + 11338, + 1080, + 10109, + 50028, + 8225, + 10000, + 50019, + 10157, + 9898, + 5513, + 1058, + 9999, + 18505, + 5108, + 10034, + 11404, + 9422, + 8045, + 10432, + 32260 + ], + "ports_targeted_count": 890, + "tls_event_count": 0, + "top_http_methods": [], + "top_user_agents": [], + "top_url_paths": [], + "top_ja4_fingerprints": [], + "top_ja3_fingerprints": [], + "top_hassh_fingerprints": [], + "client_cert_event_count": 0, + "client_cert_subjects": [], + "rdns": "204.76.203.221.ptr.pfcloud.network", + "loader_hits": 0, + "exploit_hits": 0, + "bytes_sent": 47840, + "unique_source_ips": 1, + "ioc": "204.76.203.221", + "window": "last 7 days", + "query_type": "ip", + "scanner": null, + "verdict_key": "scanning", + "verdict": "Unrecognized scanner", + "verdict_why": [ + "No exploit payloads observed.", + "Swept 890 distinct ports (threshold for a sweep is 10).", + "Not in any known-scanner range." + ], + "verdict_confidence": "medium", + "cve_probes": [] + } + }, + { + "asn": "AS51396", + "name": "PFCLOUD", + "ip": "204.76.203.213", + "event_count": 1123, + "lookup": { + "total_events": 1286, + "first_seen": "2026-09-02T09:53:18", + "last_seen": "2026-09-07T09:39:49", + "asn_number": 51396, + "asn_org": "Pfcloud UG (haftungsbeschrankt)", + "country_name": "The Netherlands", + "country_code": "NL", + "ports_targeted": [ + 11000, + 5518, + 20009, + 5112, + 11537, + 20035, + 11008, + 50029, + 56789, + 31460, + 4219, + 2028, + 3385, + 1112, + 10027, + 10140, + 5918, + 11918, + 10101, + 4544, + 20104, + 10033, + 30000, + 10109, + 10801, + 9898, + 20390, + 8891, + 10041, + 11322, + 10075, + 25412, + 49532, + 34491, + 50012, + 17891, + 50008, + 20015, + 20248, + 11644, + 33128, + 9002, + 1065, + 6724, + 18080, + 10137, + 11508, + 10821, + 20132, + 31526 + ], + "ports_targeted_count": 872, + "tls_event_count": 0, + "top_http_methods": [], + "top_user_agents": [], + "top_url_paths": [], + "top_ja4_fingerprints": [], + "top_ja3_fingerprints": [], + "top_hassh_fingerprints": [], + "client_cert_event_count": 0, + "client_cert_subjects": [], + "rdns": "204.76.203.213.ptr.pfcloud.network", + "loader_hits": 0, + "exploit_hits": 0, + "bytes_sent": 46038, + "unique_source_ips": 1, + "ioc": "204.76.203.213", + "window": "last 7 days", + "query_type": "ip", + "scanner": null, + "verdict_key": "scanning", + "verdict": "Unrecognized scanner", + "verdict_why": [ + "No exploit payloads observed.", + "Swept 872 distinct ports (threshold for a sweep is 10).", + "Not in any known-scanner range." + ], + "verdict_confidence": "medium", + "cve_probes": [] + } + }, + { + "asn": "AS216246", + "name": "RU-AEZA-AS", + "ip": "176.124.222.61", + "event_count": 1, + "lookup": { + "total_events": 1, + "first_seen": "2026-08-31T13:15:24", + "last_seen": "2026-08-31T13:15:24", + "asn_number": 216246, + "asn_org": "Aeza Group LLC", + "country_name": "Russia", + "country_code": "RU", + "ports_targeted": [ + 5432 + ], + "ports_targeted_count": 1, + "tls_event_count": 0, + "top_http_methods": [], + "top_user_agents": [], + "top_url_paths": [], + "top_ja4_fingerprints": [], + "top_ja3_fingerprints": [], + "top_hassh_fingerprints": [], + "client_cert_event_count": 0, + "client_cert_subjects": [], + "rdns": "", + "loader_hits": 0, + "exploit_hits": 0, + "bytes_sent": 8, + "unique_source_ips": 1, + "ioc": "176.124.222.61", + "window": "last 7 days", + "query_type": "ip", + "scanner": null, + "verdict_key": "probing", + "verdict": "Low-level probing", + "verdict_why": [ + "1 event(s), fewer than 10 distinct ports, no exploit payloads.", + "Not in any known-scanner range." + ], + "verdict_confidence": "low", + "cve_probes": [] + } + }, + { + "asn": "AS216246", + "name": "RU-AEZA-AS", + "ip": "45.151.101.38", + "event_count": 1, + "lookup": { + "total_events": 1, + "first_seen": "2026-09-03T20:05:03", + "last_seen": "2026-09-03T20:05:03", + "asn_number": 216246, + "asn_org": "Aeza Group LLC", + "country_name": "Russia", + "country_code": "RU", + "ports_targeted": [ + 8006 + ], + "ports_targeted_count": 1, + "tls_event_count": 1, + "top_http_methods": [ + "POST" + ], + "top_user_agents": [ + "Python-urllib/3.10" + ], + "top_url_paths": [ + "/api2/json/access/ticket" + ], + "top_ja4_fingerprints": [ + "t13i181000_85036bcba153_d41ae481755e" + ], + "top_ja3_fingerprints": [ + "8a9d5d0f12f7d43ee3af1c51d2998d99" + ], + "top_hassh_fingerprints": [], + "client_cert_event_count": 0, + "client_cert_subjects": [], + "rdns": "", + "loader_hits": 0, + "exploit_hits": 0, + "bytes_sent": 263, + "unique_source_ips": 1, + "ioc": "45.151.101.38", + "window": "last 7 days", + "query_type": "ip", + "scanner": null, + "verdict_key": "probing", + "verdict": "Low-level probing", + "verdict_why": [ + "1 event(s), fewer than 10 distinct ports, no exploit payloads.", + "Not in any known-scanner range." + ], + "verdict_confidence": "low", + "cve_probes": [ + { + "cve_id": "CVE-2023-54391", + "title": "Proxmox VE - Default Credentials with TFA Bypass", + "severity": "critical", + "actively_exploited": false + } + ] + } + }, + { + "asn": "AS200651", + "name": "FLOKINET", + "ip": "185.100.87.136", + "event_count": 24, + "lookup": { + "total_events": 22, + "first_seen": "2026-09-01T12:25:00", + "last_seen": "2026-09-07T09:47:19", + "asn_number": 200651, + "asn_org": "FlokiNET ehf", + "country_name": "Romania", + "country_code": "RO", + "ports_targeted": [ + 443, + 8443 + ], + "ports_targeted_count": 2, + "tls_event_count": 7, + "top_http_methods": [ + "GET", + "POST" + ], + "top_user_agents": [ + "SPARK COMMIT: 08059e95dacafe0bf6e5782f8e2c8ec9cd8c5a17", + "Mozilla/5.0 (Windows NT 10.0; Win64; x64)", + "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:104.71.6212.24) Gecko/25.2.4212.671 Firefox/2.0", + "Mozilla/5.0 (Android 12; Mobile; rv:117.0) Gecko/117.0 Focus/117.0" + ], + "top_url_paths": [ + "/api/checkin", + "/", + "/api/client/update?arch=amd64&commit=08059e95dacafe0bf6e5782f8e2c8ec9cd8c5a17&os=windows", + "/eventmanager", + "/images/transparentpix.gif" + ], + "top_ja4_fingerprints": [ + "t13i1909h2_9dc949149365_97f8aa674fd9" + ], + "top_ja3_fingerprints": [ + "7c1e207beb00684bbbe144f1b0abe1d5" + ], + "top_hassh_fingerprints": [], + "client_cert_event_count": 0, + "client_cert_subjects": [], + "rdns": "", + "loader_hits": 0, + "exploit_hits": 0, + "bytes_sent": 4631, + "unique_source_ips": 1, + "ioc": "185.100.87.136", + "window": "last 7 days", + "query_type": "ip", + "scanner": null, + "verdict_key": "probing", + "verdict": "Low-level probing", + "verdict_why": [ + "22 event(s), fewer than 10 distinct ports, no exploit payloads.", + "Not in any known-scanner range.", + "Sent 4,631 bytes despite few ports and no known exploit path: focused interaction with one service, worth a look." + ], + "verdict_confidence": "low", + "cve_probes": [] + } + }, + { + "asn": "AS198953", + "name": "PROTON66", + "ip": "176.120.22.61", + "event_count": 1597, + "lookup": { + "total_events": 1634, + "first_seen": "2026-08-31T11:36:25", + "last_seen": "2026-09-07T09:23:19", + "asn_number": 198953, + "asn_org": "Proton66 OOO", + "country_name": "Russia", + "country_code": "RU", + "ports_targeted": [ + 11433, + 5433, + 2433, + 15366, + 2017, + 22020, + 35366, + 23341, + 1002, + 13433, + 37628, + 5539, + 7433, + 1434, + 7788, + 5000, + 5678, + 40501, + 1433, + 14330, + 2866, + 9001, + 18433, + 41433, + 1438, + 55366, + 3433, + 1501, + 1800, + 15774, + 8989, + 9999, + 1455, + 42130, + 6000, + 5005, + 21433, + 8888, + 7366, + 4433, + 5368, + 1444, + 16433, + 22433, + 19433, + 1456, + 6602, + 51234, + 6240, + 2468 + ], + "ports_targeted_count": 270, + "tls_event_count": 0, + "top_http_methods": [], + "top_user_agents": [], + "top_url_paths": [], + "top_ja4_fingerprints": [], + "top_ja3_fingerprints": [], + "top_hassh_fingerprints": [], + "client_cert_event_count": 0, + "client_cert_subjects": [], + "rdns": "", + "loader_hits": 0, + "exploit_hits": 0, + "bytes_sent": 129048, + "unique_source_ips": 1, + "ioc": "176.120.22.61", + "window": "last 7 days", + "query_type": "ip", + "scanner": null, + "verdict_key": "scanning", + "verdict": "Unrecognized scanner", + "verdict_why": [ + "No exploit payloads observed.", + "Swept 270 distinct ports (threshold for a sweep is 10).", + "Not in any known-scanner range." + ], + "verdict_confidence": "medium", + "cve_probes": [] + } + }, + { + "asn": "AS198953", + "name": "PROTON66", + "ip": "176.120.22.240", + "event_count": 45, + "lookup": { + "total_events": 60, + "first_seen": "2026-09-01T05:50:24", + "last_seen": "2026-09-07T03:25:20", + "asn_number": 198953, + "asn_org": "Proton66 OOO", + "country_name": "Russia", + "country_code": "RU", + "ports_targeted": [ + 4443, + 8443, + 10443, + 500, + 1701, + 443, + 3799, + 8013, + 47, + 1812, + 1813, + 4500, + 8014, + 1443, + 2443, + 11443 + ], + "ports_targeted_count": 16, + "tls_event_count": 60, + "top_http_methods": [ + "GET" + ], + "top_user_agents": [ + "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:74.0) Gecko/20100101 Firefox/74.0 - github.com/anasbousselham/)" + ], + "top_url_paths": [ + "/remote/login?lang=en", + "/remote/fgt_lang?lang=/../../../..//////////dev/cmdb/sslvpn_websession" + ], + "top_ja4_fingerprints": [ + "t12i210600_76e208dd3e22_f28add8e7af0", + "t13i190800_9dc949149365_97f8aa674fd9" + ], + "top_ja3_fingerprints": [ + "c12f54a3f91dc7bafd92cb59fe009a35", + "89be98bbd4f065fe510fca4893cf8d9b" + ], + "top_hassh_fingerprints": [], + "client_cert_event_count": 0, + "client_cert_subjects": [], + "rdns": "", + "loader_hits": 0, + "exploit_hits": 0, + "bytes_sent": 8294, + "unique_source_ips": 1, + "ioc": "176.120.22.240", + "window": "last 7 days", + "query_type": "ip", + "scanner": null, + "verdict_key": "scanning", + "verdict": "Unrecognized scanner", + "verdict_why": [ + "No exploit payloads observed.", + "Swept 16 distinct ports (threshold for a sweep is 10).", + "Not in any known-scanner range." + ], + "verdict_confidence": "medium", + "cve_probes": [ + { + "cve_id": "CVE-2018-13379", + "title": "Fortinet FortiOS SSL VPN path traversal", + "severity": "critical", + "actively_exploited": true + } + ] + } + }, + { + "asn": "AS198953", + "name": "PROTON66", + "ip": "193.143.1.66", + "event_count": 24, + "lookup": { + "total_events": 24, + "first_seen": "2026-08-31T18:27:14", + "last_seen": "2026-09-04T21:27:35", + "asn_number": 198953, + "asn_org": "Proton66 OOO", + "country_name": "Russia", + "country_code": "RU", + "ports_targeted": [ + 3389, + 3384, + 3349, + 33894 + ], + "ports_targeted_count": 4, + "tls_event_count": 0, + "top_http_methods": [], + "top_user_agents": [], + "top_url_paths": [], + "top_ja4_fingerprints": [], + "top_ja3_fingerprints": [], + "top_hassh_fingerprints": [], + "client_cert_event_count": 0, + "client_cert_subjects": [], + "rdns": "", + "loader_hits": 0, + "exploit_hits": 0, + "bytes_sent": 1056, + "unique_source_ips": 1, + "ioc": "193.143.1.66", + "window": "last 7 days", + "query_type": "ip", + "scanner": null, + "verdict_key": "probing", + "verdict": "Low-level probing", + "verdict_why": [ + "24 event(s), fewer than 10 distinct ports, no exploit payloads.", + "Not in any known-scanner range." + ], + "verdict_confidence": "low", + "cve_probes": [] + } + } +] \ No newline at end of file diff --git a/kevlar/2026-09-07/honeylabs/loop-summary.json b/kevlar/2026-09-07/honeylabs/loop-summary.json new file mode 100644 index 0000000..4648c3e --- /dev/null +++ b/kevlar/2026-09-07/honeylabs/loop-summary.json @@ -0,0 +1,239 @@ +[ + { + "asn": "AS57043", + "name": "HOSTKEY-AS", + "ipRows": 2, + "uaRows": 0, + "events": 12, + "eventTotal": 12, + "errors": [] + }, + { + "asn": "AS209847", + "name": "THE", + "ipRows": 0, + "uaRows": 0, + "events": 0, + "eventTotal": 0, + "errors": [] + }, + { + "asn": "AS210644", + "name": "AEZA-AS", + "ipRows": 1, + "uaRows": 1, + "events": 0, + "eventTotal": 0, + "errors": [ + "events:unparseable" + ] + }, + { + "asn": "AS138915", + "name": "KAOPU-HK", + "ipRows": 0, + "uaRows": 0, + "events": 0, + "eventTotal": 0, + "errors": [] + }, + { + "asn": "AS14956", + "name": "ROUTERHOSTING", + "ipRows": 12, + "uaRows": 4, + "events": 0, + "eventTotal": 0, + "errors": [ + "events:unparseable" + ] + }, + { + "asn": "AS216139", + "name": "IRONHOST", + "ipRows": 0, + "uaRows": 0, + "events": 0, + "eventTotal": 0, + "errors": [] + }, + { + "asn": "AS51852", + "name": "PLI-AS", + "ipRows": 5, + "uaRows": 4, + "events": 0, + "eventTotal": 0, + "errors": [ + "events:unparseable" + ] + }, + { + "asn": "AS400992", + "name": "ZHOUYISAT-COMMUNICATIONS", + "ipRows": 0, + "uaRows": 0, + "events": 0, + "eventTotal": 0, + "errors": [] + }, + { + "asn": "AS33993", + "name": "UFO-AS", + "ipRows": 0, + "uaRows": 0, + "events": 0, + "eventTotal": 0, + "errors": [] + }, + { + "asn": "AS51396", + "name": "PFCLOUD", + "ipRows": 20, + "uaRows": 18, + "events": 0, + "eventTotal": 0, + "errors": [ + "events:unparseable" + ] + }, + { + "asn": "AS213702", + "name": "QWINS-LTD", + "ipRows": 0, + "uaRows": 0, + "events": 0, + "eventTotal": 0, + "errors": [] + }, + { + "asn": "AS216246", + "name": "RU-AEZA-AS", + "ipRows": 2, + "uaRows": 1, + "events": 2, + "eventTotal": 2, + "errors": [] + }, + { + "asn": "AS200651", + "name": "FLOKINET", + "ipRows": 1, + "uaRows": 5, + "events": 0, + "eventTotal": 0, + "errors": [ + "events:unparseable" + ] + }, + { + "asn": "AS30823", + "name": "AUROLOGIC", + "ipRows": 0, + "uaRows": 0, + "events": 0, + "eventTotal": 0, + "errors": [] + }, + { + "asn": "AS140666", + "name": "ADPL-AS-AP", + "ipRows": 0, + "uaRows": 0, + "events": 0, + "eventTotal": 0, + "errors": [] + }, + { + "asn": "AS214351", + "name": "FEMOIT", + "ipRows": 0, + "uaRows": 0, + "events": 0, + "eventTotal": 0, + "errors": [] + }, + { + "asn": "AS198953", + "name": "PROTON66", + "ipRows": 4, + "uaRows": 4, + "events": 0, + "eventTotal": 0, + "errors": [ + "events:unparseable" + ] + }, + { + "asn": "AS200593", + "name": "PROSPERO-AS", + "ipRows": 0, + "uaRows": 0, + "events": 0, + "eventTotal": 0, + "errors": [] + }, + { + "asn": "AS214940", + "name": "KPRONET", + "ipRows": 0, + "uaRows": 0, + "events": 0, + "eventTotal": 0, + "errors": [] + }, + { + "asn": "AS206728", + "name": "MEDIALAND-AS", + "ipRows": 0, + "uaRows": 0, + "events": 0, + "eventTotal": 0, + "errors": [] + }, + { + "asn": "AS211720", + "name": "Datashield", + "ipRows": 0, + "uaRows": 0, + "events": 0, + "eventTotal": 0, + "errors": [] + }, + { + "asn": "AS216309", + "name": "INVISIONTECH-GROUP-SRL", + "ipRows": 0, + "uaRows": 0, + "events": 0, + "eventTotal": 0, + "errors": [] + }, + { + "asn": "AS58854", + "name": "KAOPY", + "ipRows": 0, + "uaRows": 0, + "events": 0, + "eventTotal": 0, + "errors": [] + }, + { + "asn": "AS202685", + "name": "TR-ARKEL", + "ipRows": 0, + "uaRows": 0, + "events": 0, + "eventTotal": 0, + "errors": [] + }, + { + "asn": "AS394711", + "name": "KORGRID", + "ipRows": 0, + "uaRows": 0, + "events": 0, + "eventTotal": 0, + "errors": [] + } +] \ No newline at end of file diff --git a/kevlar/2026-09-07/honeylabs/top-attackers-ip-AS138915.json b/kevlar/2026-09-07/honeylabs/top-attackers-ip-AS138915.json new file mode 100644 index 0000000..0637a08 --- /dev/null +++ b/kevlar/2026-09-07/honeylabs/top-attackers-ip-AS138915.json @@ -0,0 +1 @@ +[] \ No newline at end of file diff --git a/kevlar/2026-09-07/honeylabs/top-attackers-ip-AS140666.json b/kevlar/2026-09-07/honeylabs/top-attackers-ip-AS140666.json new file mode 100644 index 0000000..0637a08 --- /dev/null +++ b/kevlar/2026-09-07/honeylabs/top-attackers-ip-AS140666.json @@ -0,0 +1 @@ +[] \ No newline at end of file diff --git a/kevlar/2026-09-07/honeylabs/top-attackers-ip-AS14956.json b/kevlar/2026-09-07/honeylabs/top-attackers-ip-AS14956.json new file mode 100644 index 0000000..c2237ad --- /dev/null +++ b/kevlar/2026-09-07/honeylabs/top-attackers-ip-AS14956.json @@ -0,0 +1,195 @@ +[ + { + "value": "::ffff:45.61.157.82", + "event_count": 32, + "unique_ips": 1, + "first_seen": "2026-09-04T01:15:12", + "last_seen": "2026-09-04T06:30:09", + "top_ports": [ + 445 + ], + "countries": [ + "US" + ], + "asn_org": "RouterHosting LLC", + "asn_number": 14956, + "country_name": "United States" + }, + { + "value": "::ffff:144.172.108.79", + "event_count": 24, + "unique_ips": 1, + "first_seen": "2026-09-04T20:02:59", + "last_seen": "2026-09-05T02:54:19", + "top_ports": [ + 445 + ], + "countries": [ + "US" + ], + "asn_org": "RouterHosting LLC", + "asn_number": 14956, + "country_name": "United States" + }, + { + "value": "::ffff:144.172.99.200", + "event_count": 16, + "unique_ips": 1, + "first_seen": "2026-09-01T07:55:37", + "last_seen": "2026-09-01T08:57:36", + "top_ports": [ + 445 + ], + "countries": [ + "US" + ], + "asn_org": "RouterHosting LLC", + "asn_number": 14956, + "country_name": "United States" + }, + { + "value": "::ffff:216.126.239.215", + "event_count": 8, + "unique_ips": 1, + "first_seen": "2026-09-06T00:12:30", + "last_seen": "2026-09-06T00:12:34", + "top_ports": [ + 445 + ], + "countries": [ + "US" + ], + "asn_org": "RouterHosting LLC", + "asn_number": 14956, + "country_name": "United States" + }, + { + "value": "::ffff:45.61.183.10", + "event_count": 4, + "unique_ips": 1, + "first_seen": "2026-09-06T01:13:05", + "last_seen": "2026-09-06T06:25:29", + "top_ports": [ + 445 + ], + "countries": [ + "US" + ], + "asn_org": "RouterHosting LLC", + "asn_number": 14956, + "country_name": "United States" + }, + { + "value": "::ffff:167.88.168.121", + "event_count": 4, + "unique_ips": 1, + "first_seen": "2026-09-03T06:47:31", + "last_seen": "2026-09-04T19:38:08", + "top_ports": [ + 2095, + 8008 + ], + "countries": [ + "US" + ], + "asn_org": "RouterHosting LLC", + "asn_number": 14956, + "country_name": "United States" + }, + { + "value": "::ffff:144.172.112.11", + "event_count": 2, + "unique_ips": 1, + "first_seen": "2026-09-04T18:11:24", + "last_seen": "2026-09-04T18:11:24", + "top_ports": [ + 445 + ], + "countries": [ + "US" + ], + "asn_org": "RouterHosting LLC", + "asn_number": 14956, + "country_name": "United States" + }, + { + "value": "::ffff:144.172.100.114", + "event_count": 1, + "unique_ips": 1, + "first_seen": "2026-09-02T07:32:32", + "last_seen": "2026-09-02T07:32:32", + "top_ports": [ + 1723 + ], + "countries": [ + "US" + ], + "asn_org": "RouterHosting LLC", + "asn_number": 14956, + "country_name": "United States" + }, + { + "value": "::ffff:144.172.99.12", + "event_count": 1, + "unique_ips": 1, + "first_seen": "2026-09-02T02:45:38", + "last_seen": "2026-09-02T02:45:38", + "top_ports": [ + 443 + ], + "countries": [ + "US" + ], + "asn_org": "RouterHosting LLC", + "asn_number": 14956, + "country_name": "United States" + }, + { + "value": "::ffff:45.61.149.189", + "event_count": 1, + "unique_ips": 1, + "first_seen": "2026-09-06T15:51:16", + "last_seen": "2026-09-06T15:51:16", + "top_ports": [ + 443 + ], + "countries": [ + "US" + ], + "asn_org": "RouterHosting LLC", + "asn_number": 14956, + "country_name": "United States" + }, + { + "value": "::ffff:216.126.227.187", + "event_count": 1, + "unique_ips": 1, + "first_seen": "2026-09-03T17:01:38", + "last_seen": "2026-09-03T17:01:38", + "top_ports": [ + 7860 + ], + "countries": [ + "US" + ], + "asn_org": "RouterHosting LLC", + "asn_number": 14956, + "country_name": "United States" + }, + { + "value": "::ffff:144.172.115.222", + "event_count": 1, + "unique_ips": 1, + "first_seen": "2026-09-01T09:05:26", + "last_seen": "2026-09-01T09:05:26", + "top_ports": [ + 5061 + ], + "countries": [ + "US" + ], + "asn_org": "RouterHosting LLC", + "asn_number": 14956, + "country_name": "United States" + } +] \ No newline at end of file diff --git a/kevlar/2026-09-07/honeylabs/top-attackers-ip-AS198953.json b/kevlar/2026-09-07/honeylabs/top-attackers-ip-AS198953.json new file mode 100644 index 0000000..fb76840 --- /dev/null +++ b/kevlar/2026-09-07/honeylabs/top-attackers-ip-AS198953.json @@ -0,0 +1,75 @@ +[ + { + "value": "::ffff:176.120.22.61", + "event_count": 1597, + "unique_ips": 1, + "first_seen": "2026-08-31T09:44:36", + "last_seen": "2026-09-04T10:20:48", + "top_ports": [ + 11433, + 14331, + 14330, + 35366, + 37628 + ], + "countries": [ + "RU" + ], + "asn_org": "Proton66 OOO", + "asn_number": 198953, + "country_name": "Russia" + }, + { + "value": "::ffff:176.120.22.240", + "event_count": 45, + "unique_ips": 1, + "first_seen": "2026-09-01T05:50:24", + "last_seen": "2026-09-06T14:40:21", + "top_ports": [ + 4443, + 8443, + 10443 + ], + "countries": [ + "RU" + ], + "asn_org": "Proton66 OOO", + "asn_number": 198953, + "country_name": "Russia" + }, + { + "value": "::ffff:193.143.1.66", + "event_count": 24, + "unique_ips": 1, + "first_seen": "2026-08-31T18:27:14", + "last_seen": "2026-09-04T21:27:35", + "top_ports": [ + 3389, + 3384, + 3349, + 33894 + ], + "countries": [ + "RU" + ], + "asn_org": "Proton66 OOO", + "asn_number": 198953, + "country_name": "Russia" + }, + { + "value": "::ffff:176.120.22.147", + "event_count": 3, + "unique_ips": 1, + "first_seen": "2026-09-03T02:10:02", + "last_seen": "2026-09-03T02:11:21", + "top_ports": [ + 8006 + ], + "countries": [ + "RU" + ], + "asn_org": "Proton66 OOO", + "asn_number": 198953, + "country_name": "Russia" + } +] \ No newline at end of file diff --git a/kevlar/2026-09-07/honeylabs/top-attackers-ip-AS200593.json b/kevlar/2026-09-07/honeylabs/top-attackers-ip-AS200593.json new file mode 100644 index 0000000..0637a08 --- /dev/null +++ b/kevlar/2026-09-07/honeylabs/top-attackers-ip-AS200593.json @@ -0,0 +1 @@ +[] \ No newline at end of file diff --git a/kevlar/2026-09-07/honeylabs/top-attackers-ip-AS200651.json b/kevlar/2026-09-07/honeylabs/top-attackers-ip-AS200651.json new file mode 100644 index 0000000..f29fdbd --- /dev/null +++ b/kevlar/2026-09-07/honeylabs/top-attackers-ip-AS200651.json @@ -0,0 +1,19 @@ +[ + { + "value": "::ffff:185.100.87.136", + "event_count": 24, + "unique_ips": 1, + "first_seen": "2026-08-31T01:12:02", + "last_seen": "2026-09-06T22:18:29", + "top_ports": [ + 443, + 8443 + ], + "countries": [ + "RO" + ], + "asn_org": "FlokiNET ehf", + "asn_number": 200651, + "country_name": "Romania" + } +] \ No newline at end of file diff --git a/kevlar/2026-09-07/honeylabs/top-attackers-ip-AS202685.json b/kevlar/2026-09-07/honeylabs/top-attackers-ip-AS202685.json new file mode 100644 index 0000000..0637a08 --- /dev/null +++ b/kevlar/2026-09-07/honeylabs/top-attackers-ip-AS202685.json @@ -0,0 +1 @@ +[] \ No newline at end of file diff --git a/kevlar/2026-09-07/honeylabs/top-attackers-ip-AS206728.json b/kevlar/2026-09-07/honeylabs/top-attackers-ip-AS206728.json new file mode 100644 index 0000000..0637a08 --- /dev/null +++ b/kevlar/2026-09-07/honeylabs/top-attackers-ip-AS206728.json @@ -0,0 +1 @@ +[] \ No newline at end of file diff --git a/kevlar/2026-09-07/honeylabs/top-attackers-ip-AS209847.json b/kevlar/2026-09-07/honeylabs/top-attackers-ip-AS209847.json new file mode 100644 index 0000000..0637a08 --- /dev/null +++ b/kevlar/2026-09-07/honeylabs/top-attackers-ip-AS209847.json @@ -0,0 +1 @@ +[] \ No newline at end of file diff --git a/kevlar/2026-09-07/honeylabs/top-attackers-ip-AS210644.json b/kevlar/2026-09-07/honeylabs/top-attackers-ip-AS210644.json new file mode 100644 index 0000000..df91df1 --- /dev/null +++ b/kevlar/2026-09-07/honeylabs/top-attackers-ip-AS210644.json @@ -0,0 +1,20 @@ +[ + { + "value": "::ffff:185.246.217.150", + "event_count": 51, + "unique_ips": 1, + "first_seen": "2026-08-31T22:44:34", + "last_seen": "2026-09-02T15:29:27", + "top_ports": [ + 443, + 2222, + 2375 + ], + "countries": [ + "NL" + ], + "asn_org": "Aeza Group LLC", + "asn_number": 210644, + "country_name": "The Netherlands" + } +] \ No newline at end of file diff --git a/kevlar/2026-09-07/honeylabs/top-attackers-ip-AS211720.json b/kevlar/2026-09-07/honeylabs/top-attackers-ip-AS211720.json new file mode 100644 index 0000000..0637a08 --- /dev/null +++ b/kevlar/2026-09-07/honeylabs/top-attackers-ip-AS211720.json @@ -0,0 +1 @@ +[] \ No newline at end of file diff --git a/kevlar/2026-09-07/honeylabs/top-attackers-ip-AS213702.json b/kevlar/2026-09-07/honeylabs/top-attackers-ip-AS213702.json new file mode 100644 index 0000000..0637a08 --- /dev/null +++ b/kevlar/2026-09-07/honeylabs/top-attackers-ip-AS213702.json @@ -0,0 +1 @@ +[] \ No newline at end of file diff --git a/kevlar/2026-09-07/honeylabs/top-attackers-ip-AS214351.json b/kevlar/2026-09-07/honeylabs/top-attackers-ip-AS214351.json new file mode 100644 index 0000000..0637a08 --- /dev/null +++ b/kevlar/2026-09-07/honeylabs/top-attackers-ip-AS214351.json @@ -0,0 +1 @@ +[] \ No newline at end of file diff --git a/kevlar/2026-09-07/honeylabs/top-attackers-ip-AS214940.json b/kevlar/2026-09-07/honeylabs/top-attackers-ip-AS214940.json new file mode 100644 index 0000000..0637a08 --- /dev/null +++ b/kevlar/2026-09-07/honeylabs/top-attackers-ip-AS214940.json @@ -0,0 +1 @@ +[] \ No newline at end of file diff --git a/kevlar/2026-09-07/honeylabs/top-attackers-ip-AS216139.json b/kevlar/2026-09-07/honeylabs/top-attackers-ip-AS216139.json new file mode 100644 index 0000000..0637a08 --- /dev/null +++ b/kevlar/2026-09-07/honeylabs/top-attackers-ip-AS216139.json @@ -0,0 +1 @@ +[] \ No newline at end of file diff --git a/kevlar/2026-09-07/honeylabs/top-attackers-ip-AS216246.json b/kevlar/2026-09-07/honeylabs/top-attackers-ip-AS216246.json new file mode 100644 index 0000000..1076b6a --- /dev/null +++ b/kevlar/2026-09-07/honeylabs/top-attackers-ip-AS216246.json @@ -0,0 +1,34 @@ +[ + { + "value": "::ffff:176.124.222.61", + "event_count": 1, + "unique_ips": 1, + "first_seen": "2026-08-31T13:15:24", + "last_seen": "2026-08-31T13:15:24", + "top_ports": [ + 5432 + ], + "countries": [ + "RU" + ], + "asn_org": "Aeza Group LLC", + "asn_number": 216246, + "country_name": "Russia" + }, + { + "value": "::ffff:45.151.101.38", + "event_count": 1, + "unique_ips": 1, + "first_seen": "2026-09-03T20:05:03", + "last_seen": "2026-09-03T20:05:03", + "top_ports": [ + 8006 + ], + "countries": [ + "RU" + ], + "asn_org": "Aeza Group LLC", + "asn_number": 216246, + "country_name": "Russia" + } +] \ No newline at end of file diff --git a/kevlar/2026-09-07/honeylabs/top-attackers-ip-AS216309.json b/kevlar/2026-09-07/honeylabs/top-attackers-ip-AS216309.json new file mode 100644 index 0000000..0637a08 --- /dev/null +++ b/kevlar/2026-09-07/honeylabs/top-attackers-ip-AS216309.json @@ -0,0 +1 @@ +[] \ No newline at end of file diff --git a/kevlar/2026-09-07/honeylabs/top-attackers-ip-AS30823.json b/kevlar/2026-09-07/honeylabs/top-attackers-ip-AS30823.json new file mode 100644 index 0000000..0637a08 --- /dev/null +++ b/kevlar/2026-09-07/honeylabs/top-attackers-ip-AS30823.json @@ -0,0 +1 @@ +[] \ No newline at end of file diff --git a/kevlar/2026-09-07/honeylabs/top-attackers-ip-AS33993.json b/kevlar/2026-09-07/honeylabs/top-attackers-ip-AS33993.json new file mode 100644 index 0000000..0637a08 --- /dev/null +++ b/kevlar/2026-09-07/honeylabs/top-attackers-ip-AS33993.json @@ -0,0 +1 @@ +[] \ No newline at end of file diff --git a/kevlar/2026-09-07/honeylabs/top-attackers-ip-AS394711.json b/kevlar/2026-09-07/honeylabs/top-attackers-ip-AS394711.json new file mode 100644 index 0000000..0637a08 --- /dev/null +++ b/kevlar/2026-09-07/honeylabs/top-attackers-ip-AS394711.json @@ -0,0 +1 @@ +[] \ No newline at end of file diff --git a/kevlar/2026-09-07/honeylabs/top-attackers-ip-AS400992.json b/kevlar/2026-09-07/honeylabs/top-attackers-ip-AS400992.json new file mode 100644 index 0000000..0637a08 --- /dev/null +++ b/kevlar/2026-09-07/honeylabs/top-attackers-ip-AS400992.json @@ -0,0 +1 @@ +[] \ No newline at end of file diff --git a/kevlar/2026-09-07/honeylabs/top-attackers-ip-AS51396.json b/kevlar/2026-09-07/honeylabs/top-attackers-ip-AS51396.json new file mode 100644 index 0000000..c72dab5 --- /dev/null +++ b/kevlar/2026-09-07/honeylabs/top-attackers-ip-AS51396.json @@ -0,0 +1,396 @@ +[ + { + "value": "::ffff:204.76.203.222", + "event_count": 1159, + "unique_ips": 1, + "first_seen": "2026-09-02T09:47:23", + "last_seen": "2026-09-06T23:43:17", + "top_ports": [ + 6128, + 11238, + 10803, + 11148, + 11415 + ], + "countries": [ + "NL" + ], + "asn_org": "Pfcloud UG (haftungsbeschrankt)", + "asn_number": 51396, + "country_name": "The Netherlands" + }, + { + "value": "::ffff:204.76.203.221", + "event_count": 1154, + "unique_ips": 1, + "first_seen": "2026-09-02T09:47:23", + "last_seen": "2026-09-06T23:57:44", + "top_ports": [ + 11587, + 10231, + 13246, + 31280, + 1083 + ], + "countries": [ + "NL" + ], + "asn_org": "Pfcloud UG (haftungsbeschrankt)", + "asn_number": 51396, + "country_name": "The Netherlands" + }, + { + "value": "::ffff:204.76.203.213", + "event_count": 1123, + "unique_ips": 1, + "first_seen": "2026-09-02T09:53:18", + "last_seen": "2026-09-06T23:40:09", + "top_ports": [ + 5112, + 3385, + 10140, + 50012, + 11644 + ], + "countries": [ + "NL" + ], + "asn_org": "Pfcloud UG (haftungsbeschrankt)", + "asn_number": 51396, + "country_name": "The Netherlands" + }, + { + "value": "::ffff:204.76.203.214", + "event_count": 1091, + "unique_ips": 1, + "first_seen": "2026-09-02T09:48:01", + "last_seen": "2026-09-06T23:57:44", + "top_ports": [ + 10119, + 21698, + 11100, + 15120, + 10006 + ], + "countries": [ + "NL" + ], + "asn_org": "Pfcloud UG (haftungsbeschrankt)", + "asn_number": 51396, + "country_name": "The Netherlands" + }, + { + "value": "::ffff:204.76.203.49", + "event_count": 836, + "unique_ips": 1, + "first_seen": "2026-08-31T00:54:43", + "last_seen": "2026-09-06T22:29:18", + "top_ports": [ + 8080, + 1081, + 888, + 8888, + 4145 + ], + "countries": [ + "NL" + ], + "asn_org": "Pfcloud UG (haftungsbeschrankt)", + "asn_number": 51396, + "country_name": "The Netherlands" + }, + { + "value": "::ffff:176.65.148.153", + "event_count": 453, + "unique_ips": 1, + "first_seen": "2026-09-01T22:14:32", + "last_seen": "2026-09-04T09:28:19", + "top_ports": [ + 3389, + 3318, + 3324, + 3349, + 3372 + ], + "countries": [ + "NL" + ], + "asn_org": "Pfcloud UG (haftungsbeschrankt)", + "asn_number": 51396, + "country_name": "The Netherlands" + }, + { + "value": "::ffff:204.76.203.7", + "event_count": 446, + "unique_ips": 1, + "first_seen": "2026-08-31T00:35:35", + "last_seen": "2026-09-03T00:22:11", + "top_ports": [ + 24575, + 24001, + 24444, + 20129, + 20119 + ], + "countries": [ + "NL" + ], + "asn_org": "Pfcloud UG (haftungsbeschrankt)", + "asn_number": 51396, + "country_name": "The Netherlands" + }, + { + "value": "::ffff:45.135.193.193", + "event_count": 400, + "unique_ips": 1, + "first_seen": "2026-08-31T11:30:54", + "last_seen": "2026-09-06T23:26:34", + "top_ports": [ + 8888, + 3128, + 81, + 80, + 8080 + ], + "countries": [ + "DE" + ], + "asn_org": "Pfcloud UG (haftungsbeschrankt)", + "asn_number": 51396, + "country_name": "Germany" + }, + { + "value": "::ffff:45.135.194.113", + "event_count": 220, + "unique_ips": 1, + "first_seen": "2026-08-31T01:05:13", + "last_seen": "2026-09-06T21:38:43", + "top_ports": [ + 666, + 555, + 8888, + 90, + 8000 + ], + "countries": [ + "DE" + ], + "asn_org": "Pfcloud UG (haftungsbeschrankt)", + "asn_number": 51396, + "country_name": "Germany" + }, + { + "value": "::ffff:45.135.193.198", + "event_count": 200, + "unique_ips": 1, + "first_seen": "2026-08-31T01:11:46", + "last_seen": "2026-09-06T07:38:01", + "top_ports": [ + 8181, + 8080, + 18080, + 9999, + 8000 + ], + "countries": [ + "DE" + ], + "asn_org": "Pfcloud UG (haftungsbeschrankt)", + "asn_number": 51396, + "country_name": "Germany" + }, + { + "value": "::ffff:176.65.148.226", + "event_count": 126, + "unique_ips": 1, + "first_seen": "2026-08-31T02:03:10", + "last_seen": "2026-09-06T17:30:01", + "top_ports": [ + 80, + 443, + 8500, + 8090, + 3000 + ], + "countries": [ + "NL" + ], + "asn_org": "Pfcloud UG (haftungsbeschrankt)", + "asn_number": 51396, + "country_name": "The Netherlands" + }, + { + "value": "::ffff:176.65.149.212", + "event_count": 106, + "unique_ips": 1, + "first_seen": "2026-08-31T00:00:25", + "last_seen": "2026-09-06T23:04:39", + "top_ports": [ + 7994, + 7993, + 7990, + 8010, + 8016 + ], + "countries": [ + "NL" + ], + "asn_org": "Pfcloud UG (haftungsbeschrankt)", + "asn_number": 51396, + "country_name": "The Netherlands" + }, + { + "value": "::ffff:176.65.149.27", + "event_count": 102, + "unique_ips": 1, + "first_seen": "2026-08-31T00:56:02", + "last_seen": "2026-09-06T23:58:26", + "top_ports": [ + 38002, + 38026, + 38000, + 38020, + 38001 + ], + "countries": [ + "NL" + ], + "asn_org": "Pfcloud UG (haftungsbeschrankt)", + "asn_number": 51396, + "country_name": "The Netherlands" + }, + { + "value": "::ffff:176.65.149.31", + "event_count": 99, + "unique_ips": 1, + "first_seen": "2026-08-31T01:21:26", + "last_seen": "2026-09-06T23:32:25", + "top_ports": [ + 1883, + 1908, + 1906, + 1897, + 1905 + ], + "countries": [ + "NL" + ], + "asn_org": "Pfcloud UG (haftungsbeschrankt)", + "asn_number": 51396, + "country_name": "The Netherlands" + }, + { + "value": "::ffff:176.65.149.30", + "event_count": 89, + "unique_ips": 1, + "first_seen": "2026-08-31T00:39:52", + "last_seen": "2026-09-06T22:50:28", + "top_ports": [ + 31975, + 32019, + 31973, + 31974, + 32017 + ], + "countries": [ + "NL" + ], + "asn_org": "Pfcloud UG (haftungsbeschrankt)", + "asn_number": 51396, + "country_name": "The Netherlands" + }, + { + "value": "::ffff:176.65.148.93", + "event_count": 67, + "unique_ips": 1, + "first_seen": "2026-09-01T07:37:27", + "last_seen": "2026-09-06T22:49:21", + "top_ports": [ + 1082, + 1085, + 1080, + 1094, + 1079 + ], + "countries": [ + "NL" + ], + "asn_org": "Pfcloud UG (haftungsbeschrankt)", + "asn_number": 51396, + "country_name": "The Netherlands" + }, + { + "value": "::ffff:176.65.149.236", + "event_count": 62, + "unique_ips": 1, + "first_seen": "2026-08-31T05:44:55", + "last_seen": "2026-09-06T21:26:21", + "top_ports": [ + 8000, + 9000, + 82, + 88, + 443 + ], + "countries": [ + "NL" + ], + "asn_org": "Pfcloud UG (haftungsbeschrankt)", + "asn_number": 51396, + "country_name": "The Netherlands" + }, + { + "value": "::ffff:204.76.203.4", + "event_count": 51, + "unique_ips": 1, + "first_seen": "2026-08-31T00:03:33", + "last_seen": "2026-08-31T11:42:35", + "top_ports": [ + 25564, + 25566, + 25565 + ], + "countries": [ + "NL" + ], + "asn_org": "Pfcloud UG (haftungsbeschrankt)", + "asn_number": 51396, + "country_name": "The Netherlands" + }, + { + "value": "::ffff:176.65.148.156", + "event_count": 51, + "unique_ips": 1, + "first_seen": "2026-08-31T15:53:23", + "last_seen": "2026-09-05T11:36:49", + "top_ports": [ + 25565 + ], + "countries": [ + "NL" + ], + "asn_org": "Pfcloud UG (haftungsbeschrankt)", + "asn_number": 51396, + "country_name": "The Netherlands" + }, + { + "value": "::ffff:176.65.134.48", + "event_count": 48, + "unique_ips": 1, + "first_seen": "2026-09-05T04:30:55", + "last_seen": "2026-09-06T23:47:43", + "top_ports": [ + 4550, + 4747, + 4700, + 4646, + 4567 + ], + "countries": [ + "DE" + ], + "asn_org": "Pfcloud UG (haftungsbeschrankt)", + "asn_number": 51396, + "country_name": "Germany" + } +] \ No newline at end of file diff --git a/kevlar/2026-09-07/honeylabs/top-attackers-ip-AS51852.json b/kevlar/2026-09-07/honeylabs/top-attackers-ip-AS51852.json new file mode 100644 index 0000000..489e877 --- /dev/null +++ b/kevlar/2026-09-07/honeylabs/top-attackers-ip-AS51852.json @@ -0,0 +1,84 @@ +[ + { + "value": "::ffff:179.43.150.26", + "event_count": 16, + "unique_ips": 1, + "first_seen": "2026-08-31T15:32:52", + "last_seen": "2026-08-31T16:49:55", + "top_ports": [ + 8443 + ], + "countries": [ + "CH" + ], + "asn_org": "Private Layer INC", + "asn_number": 51852, + "country_name": "Switzerland" + }, + { + "value": "::ffff:46.19.142.226", + "event_count": 6, + "unique_ips": 1, + "first_seen": "2026-09-04T18:34:20", + "last_seen": "2026-09-04T19:27:10", + "top_ports": [ + 2087 + ], + "countries": [ + "CH" + ], + "asn_org": "Private Layer INC", + "asn_number": 51852, + "country_name": "Switzerland" + }, + { + "value": "::ffff:141.255.165.66", + "event_count": 5, + "unique_ips": 1, + "first_seen": "2026-09-03T20:48:30", + "last_seen": "2026-09-04T11:46:33", + "top_ports": [ + 1723 + ], + "countries": [ + "CH" + ], + "asn_org": "Private Layer INC", + "asn_number": 51852, + "country_name": "Switzerland" + }, + { + "value": "::ffff:179.43.186.220", + "event_count": 3, + "unique_ips": 1, + "first_seen": "2026-09-01T12:06:48", + "last_seen": "2026-09-01T12:06:54", + "top_ports": [ + 80, + 443 + ], + "countries": [ + "CH" + ], + "asn_org": "Private Layer INC", + "asn_number": 51852, + "country_name": "Switzerland" + }, + { + "value": "::ffff:179.43.146.27", + "event_count": 2, + "unique_ips": 1, + "first_seen": "2026-09-01T07:55:46", + "last_seen": "2026-09-02T18:13:22", + "top_ports": [ + 32400, + 8085 + ], + "countries": [ + "CH" + ], + "asn_org": "Private Layer INC", + "asn_number": 51852, + "country_name": "Switzerland" + } +] \ No newline at end of file diff --git a/kevlar/2026-09-07/honeylabs/top-attackers-ip-AS57043.json b/kevlar/2026-09-07/honeylabs/top-attackers-ip-AS57043.json new file mode 100644 index 0000000..97c2523 --- /dev/null +++ b/kevlar/2026-09-07/honeylabs/top-attackers-ip-AS57043.json @@ -0,0 +1,38 @@ +[ + { + "value": "::ffff:163.5.16.6", + "event_count": 8, + "unique_ips": 1, + "first_seen": "2026-09-02T21:02:40", + "last_seen": "2026-09-02T21:19:46", + "top_ports": [ + 19571, + 44981, + 14603, + 5070, + 20271 + ], + "countries": [ + "GB" + ], + "asn_org": "Hostkey B.v.", + "asn_number": 57043, + "country_name": "United Kingdom" + }, + { + "value": "::ffff:82.39.165.100", + "event_count": 4, + "unique_ips": 1, + "first_seen": "2026-08-31T15:39:39", + "last_seen": "2026-09-03T03:47:57", + "top_ports": [ + 22 + ], + "countries": [ + "DE" + ], + "asn_org": "Hostkey B.v.", + "asn_number": 57043, + "country_name": "Germany" + } +] \ No newline at end of file diff --git a/kevlar/2026-09-07/honeylabs/top-attackers-ip-AS58854.json b/kevlar/2026-09-07/honeylabs/top-attackers-ip-AS58854.json new file mode 100644 index 0000000..0637a08 --- /dev/null +++ b/kevlar/2026-09-07/honeylabs/top-attackers-ip-AS58854.json @@ -0,0 +1 @@ +[] \ No newline at end of file diff --git a/kevlar/2026-09-07/honeylabs/top-attackers-ua-AS138915.json b/kevlar/2026-09-07/honeylabs/top-attackers-ua-AS138915.json new file mode 100644 index 0000000..0637a08 --- /dev/null +++ b/kevlar/2026-09-07/honeylabs/top-attackers-ua-AS138915.json @@ -0,0 +1 @@ +[] \ No newline at end of file diff --git a/kevlar/2026-09-07/honeylabs/top-attackers-ua-AS140666.json b/kevlar/2026-09-07/honeylabs/top-attackers-ua-AS140666.json new file mode 100644 index 0000000..0637a08 --- /dev/null +++ b/kevlar/2026-09-07/honeylabs/top-attackers-ua-AS140666.json @@ -0,0 +1 @@ +[] \ No newline at end of file diff --git a/kevlar/2026-09-07/honeylabs/top-attackers-ua-AS14956.json b/kevlar/2026-09-07/honeylabs/top-attackers-ua-AS14956.json new file mode 100644 index 0000000..70c1586 --- /dev/null +++ b/kevlar/2026-09-07/honeylabs/top-attackers-ua-AS14956.json @@ -0,0 +1,55 @@ +[ + { + "value": "Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0", + "event_count": 4, + "unique_ips": 1, + "first_seen": "2026-09-03T06:47:31", + "last_seen": "2026-09-04T19:38:08", + "top_ports": [ + 2095, + 8008 + ], + "countries": [ + "US" + ] + }, + { + "value": "Python-urllib/3.13", + "event_count": 1, + "unique_ips": 1, + "first_seen": "2026-09-06T15:51:16", + "last_seen": "2026-09-06T15:51:16", + "top_ports": [ + 443 + ], + "countries": [ + "US" + ] + }, + { + "value": "Python/3.13 aiohttp/3.13.5", + "event_count": 1, + "unique_ips": 1, + "first_seen": "2026-09-03T17:01:38", + "last_seen": "2026-09-03T17:01:38", + "top_ports": [ + 7860 + ], + "countries": [ + "US" + ] + }, + { + "value": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36", + "event_count": 1, + "unique_ips": 1, + "first_seen": "2026-09-02T02:45:38", + "last_seen": "2026-09-02T02:45:38", + "top_ports": [ + 443 + ], + "countries": [ + "US" + ] + } +] \ No newline at end of file diff --git a/kevlar/2026-09-07/honeylabs/top-attackers-ua-AS198953.json b/kevlar/2026-09-07/honeylabs/top-attackers-ua-AS198953.json new file mode 100644 index 0000000..009a778 --- /dev/null +++ b/kevlar/2026-09-07/honeylabs/top-attackers-ua-AS198953.json @@ -0,0 +1,54 @@ +[ + { + "value": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.1 Mobile/15E148 Safari/604.1", + "event_count": 1, + "unique_ips": 1, + "first_seen": "2026-09-03T02:11:21", + "last_seen": "2026-09-03T02:11:21", + "top_ports": [ + 8006 + ], + "countries": [ + "RU" + ] + }, + { + "value": "Mozilla/5.0 (Macintosh, Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/15.6.1 Safari/605.1.15", + "event_count": 1, + "unique_ips": 1, + "first_seen": "2026-09-03T02:10:04", + "last_seen": "2026-09-03T02:10:04", + "top_ports": [ + 8006 + ], + "countries": [ + "RU" + ] + }, + { + "value": "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:74.0) Gecko/20100101 Firefox/74.0 - github.com/anasbousselham/)", + "event_count": 1, + "unique_ips": 1, + "first_seen": "2026-09-01T05:50:24", + "last_seen": "2026-09-01T05:50:24", + "top_ports": [ + 10443 + ], + "countries": [ + "RU" + ] + }, + { + "value": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36", + "event_count": 1, + "unique_ips": 1, + "first_seen": "2026-09-03T02:10:02", + "last_seen": "2026-09-03T02:10:02", + "top_ports": [ + 8006 + ], + "countries": [ + "RU" + ] + } +] \ No newline at end of file diff --git a/kevlar/2026-09-07/honeylabs/top-attackers-ua-AS200593.json b/kevlar/2026-09-07/honeylabs/top-attackers-ua-AS200593.json new file mode 100644 index 0000000..0637a08 --- /dev/null +++ b/kevlar/2026-09-07/honeylabs/top-attackers-ua-AS200593.json @@ -0,0 +1 @@ +[] \ No newline at end of file diff --git a/kevlar/2026-09-07/honeylabs/top-attackers-ua-AS200651.json b/kevlar/2026-09-07/honeylabs/top-attackers-ua-AS200651.json new file mode 100644 index 0000000..d10948d --- /dev/null +++ b/kevlar/2026-09-07/honeylabs/top-attackers-ua-AS200651.json @@ -0,0 +1,67 @@ +[ + { + "value": "SPARK COMMIT: 08059e95dacafe0bf6e5782f8e2c8ec9cd8c5a17", + "event_count": 3, + "unique_ips": 1, + "first_seen": "2026-09-03T20:46:54", + "last_seen": "2026-09-03T23:55:20", + "top_ports": [ + 443 + ], + "countries": [ + "RO" + ] + }, + { + "value": "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:104.71.6212.24) Gecko/25.2.4212.671 Firefox/2.0", + "event_count": 3, + "unique_ips": 1, + "first_seen": "2026-09-03T20:46:53", + "last_seen": "2026-09-03T23:55:19", + "top_ports": [ + 443 + ], + "countries": [ + "RO" + ] + }, + { + "value": "Mozilla/5.0 (Android 12; Mobile; rv:117.0) Gecko/117.0 Focus/117.0", + "event_count": 3, + "unique_ips": 1, + "first_seen": "2026-09-06T20:33:31", + "last_seen": "2026-09-06T22:18:29", + "top_ports": [ + 443 + ], + "countries": [ + "RO" + ] + }, + { + "value": "Mozilla/5.0 (Windows NT 10.0; Win64; x64)", + "event_count": 3, + "unique_ips": 1, + "first_seen": "2026-09-01T12:25:00", + "last_seen": "2026-09-01T14:07:55", + "top_ports": [ + 8443 + ], + "countries": [ + "RO" + ] + }, + { + "value": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3 rv:3.0; eu-FR) AppleWebKit/533.4.2 (KHTML, like Gecko) Version/5.0.1 Safari/533.4.2", + "event_count": 3, + "unique_ips": 1, + "first_seen": "2026-08-31T01:12:02", + "last_seen": "2026-08-31T06:06:56", + "top_ports": [ + 443 + ], + "countries": [ + "RO" + ] + } +] \ No newline at end of file diff --git a/kevlar/2026-09-07/honeylabs/top-attackers-ua-AS202685.json b/kevlar/2026-09-07/honeylabs/top-attackers-ua-AS202685.json new file mode 100644 index 0000000..0637a08 --- /dev/null +++ b/kevlar/2026-09-07/honeylabs/top-attackers-ua-AS202685.json @@ -0,0 +1 @@ +[] \ No newline at end of file diff --git a/kevlar/2026-09-07/honeylabs/top-attackers-ua-AS206728.json b/kevlar/2026-09-07/honeylabs/top-attackers-ua-AS206728.json new file mode 100644 index 0000000..0637a08 --- /dev/null +++ b/kevlar/2026-09-07/honeylabs/top-attackers-ua-AS206728.json @@ -0,0 +1 @@ +[] \ No newline at end of file diff --git a/kevlar/2026-09-07/honeylabs/top-attackers-ua-AS209847.json b/kevlar/2026-09-07/honeylabs/top-attackers-ua-AS209847.json new file mode 100644 index 0000000..0637a08 --- /dev/null +++ b/kevlar/2026-09-07/honeylabs/top-attackers-ua-AS209847.json @@ -0,0 +1 @@ +[] \ No newline at end of file diff --git a/kevlar/2026-09-07/honeylabs/top-attackers-ua-AS210644.json b/kevlar/2026-09-07/honeylabs/top-attackers-ua-AS210644.json new file mode 100644 index 0000000..5836a89 --- /dev/null +++ b/kevlar/2026-09-07/honeylabs/top-attackers-ua-AS210644.json @@ -0,0 +1,16 @@ +[ + { + "value": "libredtail-http", + "event_count": 50, + "unique_ips": 1, + "first_seen": "2026-08-31T22:44:34", + "last_seen": "2026-09-02T15:29:27", + "top_ports": [ + 443, + 2375 + ], + "countries": [ + "NL" + ] + } +] \ No newline at end of file diff --git a/kevlar/2026-09-07/honeylabs/top-attackers-ua-AS211720.json b/kevlar/2026-09-07/honeylabs/top-attackers-ua-AS211720.json new file mode 100644 index 0000000..0637a08 --- /dev/null +++ b/kevlar/2026-09-07/honeylabs/top-attackers-ua-AS211720.json @@ -0,0 +1 @@ +[] \ No newline at end of file diff --git a/kevlar/2026-09-07/honeylabs/top-attackers-ua-AS213702.json b/kevlar/2026-09-07/honeylabs/top-attackers-ua-AS213702.json new file mode 100644 index 0000000..0637a08 --- /dev/null +++ b/kevlar/2026-09-07/honeylabs/top-attackers-ua-AS213702.json @@ -0,0 +1 @@ +[] \ No newline at end of file diff --git a/kevlar/2026-09-07/honeylabs/top-attackers-ua-AS214351.json b/kevlar/2026-09-07/honeylabs/top-attackers-ua-AS214351.json new file mode 100644 index 0000000..0637a08 --- /dev/null +++ b/kevlar/2026-09-07/honeylabs/top-attackers-ua-AS214351.json @@ -0,0 +1 @@ +[] \ No newline at end of file diff --git a/kevlar/2026-09-07/honeylabs/top-attackers-ua-AS214940.json b/kevlar/2026-09-07/honeylabs/top-attackers-ua-AS214940.json new file mode 100644 index 0000000..0637a08 --- /dev/null +++ b/kevlar/2026-09-07/honeylabs/top-attackers-ua-AS214940.json @@ -0,0 +1 @@ +[] \ No newline at end of file diff --git a/kevlar/2026-09-07/honeylabs/top-attackers-ua-AS216139.json b/kevlar/2026-09-07/honeylabs/top-attackers-ua-AS216139.json new file mode 100644 index 0000000..0637a08 --- /dev/null +++ b/kevlar/2026-09-07/honeylabs/top-attackers-ua-AS216139.json @@ -0,0 +1 @@ +[] \ No newline at end of file diff --git a/kevlar/2026-09-07/honeylabs/top-attackers-ua-AS216246.json b/kevlar/2026-09-07/honeylabs/top-attackers-ua-AS216246.json new file mode 100644 index 0000000..9396a02 --- /dev/null +++ b/kevlar/2026-09-07/honeylabs/top-attackers-ua-AS216246.json @@ -0,0 +1,15 @@ +[ + { + "value": "Python-urllib/3.10", + "event_count": 1, + "unique_ips": 1, + "first_seen": "2026-09-03T20:05:03", + "last_seen": "2026-09-03T20:05:03", + "top_ports": [ + 8006 + ], + "countries": [ + "RU" + ] + } +] \ No newline at end of file diff --git a/kevlar/2026-09-07/honeylabs/top-attackers-ua-AS216309.json b/kevlar/2026-09-07/honeylabs/top-attackers-ua-AS216309.json new file mode 100644 index 0000000..0637a08 --- /dev/null +++ b/kevlar/2026-09-07/honeylabs/top-attackers-ua-AS216309.json @@ -0,0 +1 @@ +[] \ No newline at end of file diff --git a/kevlar/2026-09-07/honeylabs/top-attackers-ua-AS30823.json b/kevlar/2026-09-07/honeylabs/top-attackers-ua-AS30823.json new file mode 100644 index 0000000..0637a08 --- /dev/null +++ b/kevlar/2026-09-07/honeylabs/top-attackers-ua-AS30823.json @@ -0,0 +1 @@ +[] \ No newline at end of file diff --git a/kevlar/2026-09-07/honeylabs/top-attackers-ua-AS33993.json b/kevlar/2026-09-07/honeylabs/top-attackers-ua-AS33993.json new file mode 100644 index 0000000..0637a08 --- /dev/null +++ b/kevlar/2026-09-07/honeylabs/top-attackers-ua-AS33993.json @@ -0,0 +1 @@ +[] \ No newline at end of file diff --git a/kevlar/2026-09-07/honeylabs/top-attackers-ua-AS394711.json b/kevlar/2026-09-07/honeylabs/top-attackers-ua-AS394711.json new file mode 100644 index 0000000..0637a08 --- /dev/null +++ b/kevlar/2026-09-07/honeylabs/top-attackers-ua-AS394711.json @@ -0,0 +1 @@ +[] \ No newline at end of file diff --git a/kevlar/2026-09-07/honeylabs/top-attackers-ua-AS400992.json b/kevlar/2026-09-07/honeylabs/top-attackers-ua-AS400992.json new file mode 100644 index 0000000..0637a08 --- /dev/null +++ b/kevlar/2026-09-07/honeylabs/top-attackers-ua-AS400992.json @@ -0,0 +1 @@ +[] \ No newline at end of file diff --git a/kevlar/2026-09-07/honeylabs/top-attackers-ua-AS51396.json b/kevlar/2026-09-07/honeylabs/top-attackers-ua-AS51396.json new file mode 100644 index 0000000..933fc46 --- /dev/null +++ b/kevlar/2026-09-07/honeylabs/top-attackers-ua-AS51396.json @@ -0,0 +1,254 @@ +[ + { + "value": "Go-http-client/1.1", + "event_count": 372, + "unique_ips": 5, + "first_seen": "2026-08-31T00:35:35", + "last_seen": "2026-09-06T23:47:43", + "top_ports": [ + 4550, + 4747, + 222, + 8000, + 11434 + ], + "countries": [ + "NL", + "DE" + ] + }, + { + "value": "0day", + "event_count": 200, + "unique_ips": 1, + "first_seen": "2026-08-31T01:11:46", + "last_seen": "2026-09-06T07:38:01", + "top_ports": [ + 8181, + 8080, + 18080, + 18088, + 8888 + ], + "countries": [ + "DE" + ] + }, + { + "value": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36", + "event_count": 126, + "unique_ips": 1, + "first_seen": "2026-08-31T02:03:10", + "last_seen": "2026-09-06T17:30:01", + "top_ports": [ + 80, + 443, + 8500, + 8090, + 3000 + ], + "countries": [ + "NL" + ] + }, + { + "value": "Mozilla/5.0 zgrab/0.x", + "event_count": 95, + "unique_ips": 5, + "first_seen": "2026-08-31T00:50:18", + "last_seen": "2026-09-06T21:26:21", + "top_ports": [ + 8000, + 8001, + 443, + 9000, + 88 + ], + "countries": [ + "NL" + ] + }, + { + "value": "kubo-probe/1.0", + "event_count": 12, + "unique_ips": 1, + "first_seen": "2026-08-31T11:11:43", + "last_seen": "2026-09-02T16:28:23", + "top_ports": [ + 5001, + 8080 + ], + "countries": [ + "DE" + ] + }, + { + "value": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36", + "event_count": 10, + "unique_ips": 1, + "first_seen": "2026-08-31T10:08:26", + "last_seen": "2026-09-05T08:05:52", + "top_ports": [ + 80 + ], + "countries": [ + "NL" + ] + }, + { + "value": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36", + "event_count": 6, + "unique_ips": 1, + "first_seen": "2026-09-05T12:54:20", + "last_seen": "2026-09-05T13:26:20", + "top_ports": [ + 8090 + ], + "countries": [ + "NL" + ] + }, + { + "value": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36", + "event_count": 4, + "unique_ips": 1, + "first_seen": "2026-09-01T09:55:22", + "last_seen": "2026-09-02T01:32:40", + "top_ports": [ + 80 + ], + "countries": [ + "NL" + ] + }, + { + "value": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.3 Safari/605.1.15", + "event_count": 1, + "unique_ips": 1, + "first_seen": "2026-09-01T10:40:15", + "last_seen": "2026-09-01T10:40:15", + "top_ports": [ + 443 + ], + "countries": [ + "UA" + ] + }, + { + "value": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1 Safari/605.1.15", + "event_count": 1, + "unique_ips": 1, + "first_seen": "2026-09-01T06:45:24", + "last_seen": "2026-09-01T06:45:24", + "top_ports": [ + 443 + ], + "countries": [ + "UA" + ] + }, + { + "value": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36", + "event_count": 1, + "unique_ips": 1, + "first_seen": "2026-08-31T07:27:42", + "last_seen": "2026-08-31T07:27:42", + "top_ports": [ + 443 + ], + "countries": [ + "UA" + ] + }, + { + "value": "Mozilla/5.0 (Knoppix; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36", + "event_count": 1, + "unique_ips": 1, + "first_seen": "2026-08-31T09:52:59", + "last_seen": "2026-08-31T09:52:59", + "top_ports": [ + 443 + ], + "countries": [ + "UA" + ] + }, + { + "value": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Safari/537.36 Edge/12.246", + "event_count": 1, + "unique_ips": 1, + "first_seen": "2026-09-03T10:27:07", + "last_seen": "2026-09-03T10:27:07", + "top_ports": [ + 8080 + ], + "countries": [ + "NL" + ] + }, + { + "value": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36", + "event_count": 1, + "unique_ips": 1, + "first_seen": "2026-08-31T18:59:50", + "last_seen": "2026-08-31T18:59:50", + "top_ports": [ + 443 + ], + "countries": [ + "UA" + ] + }, + { + "value": "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0", + "event_count": 1, + "unique_ips": 1, + "first_seen": "2026-09-01T07:30:45", + "last_seen": "2026-09-01T07:30:45", + "top_ports": [ + 443 + ], + "countries": [ + "UA" + ] + }, + { + "value": "Mozilla/5.0 (Macintosh, Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/19.0 Safari/605.1.15", + "event_count": 1, + "unique_ips": 1, + "first_seen": "2026-08-31T07:08:42", + "last_seen": "2026-08-31T07:08:42", + "top_ports": [ + 443 + ], + "countries": [ + "UA" + ] + }, + { + "value": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.5 Safari/605.1.15 AlohaBrowser/7.6.0", + "event_count": 1, + "unique_ips": 1, + "first_seen": "2026-08-31T19:29:52", + "last_seen": "2026-08-31T19:29:52", + "top_ports": [ + 443 + ], + "countries": [ + "UA" + ] + }, + { + "value": "Mozilla/5.0 (X11; Linux x86_64; rv:1.9.6.20) Gecko/ Firefox/3.6.17", + "event_count": 1, + "unique_ips": 1, + "first_seen": "2026-08-31T22:17:09", + "last_seen": "2026-08-31T22:17:09", + "top_ports": [ + 443 + ], + "countries": [ + "UA" + ] + } +] \ No newline at end of file diff --git a/kevlar/2026-09-07/honeylabs/top-attackers-ua-AS51852.json b/kevlar/2026-09-07/honeylabs/top-attackers-ua-AS51852.json new file mode 100644 index 0000000..28cef53 --- /dev/null +++ b/kevlar/2026-09-07/honeylabs/top-attackers-ua-AS51852.json @@ -0,0 +1,57 @@ +[ + { + "value": "Mozilla/5.0", + "event_count": 19, + "unique_ips": 2, + "first_seen": "2026-08-31T15:32:52", + "last_seen": "2026-09-04T19:27:10", + "top_ports": [ + 8443, + 2087 + ], + "countries": [ + "CH" + ] + }, + { + "value": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/125 Safari/537.36", + "event_count": 3, + "unique_ips": 1, + "first_seen": "2026-09-01T12:06:48", + "last_seen": "2026-09-01T12:06:54", + "top_ports": [ + 80, + 443 + ], + "countries": [ + "CH" + ] + }, + { + "value": "Mozilla/5.0 (Windows NT 10.0; Win64; x64)", + "event_count": 3, + "unique_ips": 1, + "first_seen": "2026-09-04T18:34:20", + "last_seen": "2026-09-04T19:27:10", + "top_ports": [ + 2087 + ], + "countries": [ + "CH" + ] + }, + { + "value": "Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0", + "event_count": 2, + "unique_ips": 1, + "first_seen": "2026-09-01T07:55:46", + "last_seen": "2026-09-02T18:13:22", + "top_ports": [ + 32400, + 8085 + ], + "countries": [ + "CH" + ] + } +] \ No newline at end of file diff --git a/kevlar/2026-09-07/honeylabs/top-attackers-ua-AS57043.json b/kevlar/2026-09-07/honeylabs/top-attackers-ua-AS57043.json new file mode 100644 index 0000000..0637a08 --- /dev/null +++ b/kevlar/2026-09-07/honeylabs/top-attackers-ua-AS57043.json @@ -0,0 +1 @@ +[] \ No newline at end of file diff --git a/kevlar/2026-09-07/honeylabs/top-attackers-ua-AS58854.json b/kevlar/2026-09-07/honeylabs/top-attackers-ua-AS58854.json new file mode 100644 index 0000000..0637a08 --- /dev/null +++ b/kevlar/2026-09-07/honeylabs/top-attackers-ua-AS58854.json @@ -0,0 +1 @@ +[] \ No newline at end of file diff --git a/kevlar/2026-09-07/honeylabs/top-attackers.csv b/kevlar/2026-09-07/honeylabs/top-attackers.csv new file mode 100644 index 0000000..24ebbc3 --- /dev/null +++ b/kevlar/2026-09-07/honeylabs/top-attackers.csv @@ -0,0 +1,48 @@ +asn,asn_name,ip,event_count,first_seen,last_seen,top_ports,countries +"AS57043","HOSTKEY-AS","163.5.16.6","8","2026-09-02T21:02:40","2026-09-02T21:19:46","19571 44981 14603 5070 20271","GB" +"AS57043","HOSTKEY-AS","82.39.165.100","4","2026-08-31T15:39:39","2026-09-03T03:47:57","22","DE" +"AS210644","AEZA-AS","185.246.217.150","51","2026-08-31T22:44:34","2026-09-02T15:29:27","443 2222 2375","NL" +"AS14956","ROUTERHOSTING","45.61.157.82","32","2026-09-04T01:15:12","2026-09-04T06:30:09","445","US" +"AS14956","ROUTERHOSTING","144.172.108.79","24","2026-09-04T20:02:59","2026-09-05T02:54:19","445","US" +"AS14956","ROUTERHOSTING","144.172.99.200","16","2026-09-01T07:55:37","2026-09-01T08:57:36","445","US" +"AS14956","ROUTERHOSTING","216.126.239.215","8","2026-09-06T00:12:30","2026-09-06T00:12:34","445","US" +"AS14956","ROUTERHOSTING","45.61.183.10","4","2026-09-06T01:13:05","2026-09-06T06:25:29","445","US" +"AS14956","ROUTERHOSTING","167.88.168.121","4","2026-09-03T06:47:31","2026-09-04T19:38:08","2095 8008","US" +"AS14956","ROUTERHOSTING","144.172.112.11","2","2026-09-04T18:11:24","2026-09-04T18:11:24","445","US" +"AS14956","ROUTERHOSTING","144.172.100.114","1","2026-09-02T07:32:32","2026-09-02T07:32:32","1723","US" +"AS14956","ROUTERHOSTING","144.172.99.12","1","2026-09-02T02:45:38","2026-09-02T02:45:38","443","US" +"AS14956","ROUTERHOSTING","45.61.149.189","1","2026-09-06T15:51:16","2026-09-06T15:51:16","443","US" +"AS14956","ROUTERHOSTING","216.126.227.187","1","2026-09-03T17:01:38","2026-09-03T17:01:38","7860","US" +"AS14956","ROUTERHOSTING","144.172.115.222","1","2026-09-01T09:05:26","2026-09-01T09:05:26","5061","US" +"AS51852","PLI-AS","179.43.150.26","16","2026-08-31T15:32:52","2026-08-31T16:49:55","8443","CH" +"AS51852","PLI-AS","46.19.142.226","6","2026-09-04T18:34:20","2026-09-04T19:27:10","2087","CH" +"AS51852","PLI-AS","141.255.165.66","5","2026-09-03T20:48:30","2026-09-04T11:46:33","1723","CH" +"AS51852","PLI-AS","179.43.186.220","3","2026-09-01T12:06:48","2026-09-01T12:06:54","80 443","CH" +"AS51852","PLI-AS","179.43.146.27","2","2026-09-01T07:55:46","2026-09-02T18:13:22","32400 8085","CH" +"AS51396","PFCLOUD","204.76.203.222","1159","2026-09-02T09:47:23","2026-09-06T23:43:17","6128 11238 10803 11148 11415","NL" +"AS51396","PFCLOUD","204.76.203.221","1154","2026-09-02T09:47:23","2026-09-06T23:57:44","11587 10231 13246 31280 1083","NL" +"AS51396","PFCLOUD","204.76.203.213","1123","2026-09-02T09:53:18","2026-09-06T23:40:09","5112 3385 10140 50012 11644","NL" +"AS51396","PFCLOUD","204.76.203.214","1091","2026-09-02T09:48:01","2026-09-06T23:57:44","10119 21698 11100 15120 10006","NL" +"AS51396","PFCLOUD","204.76.203.49","836","2026-08-31T00:54:43","2026-09-06T22:29:18","8080 1081 888 8888 4145","NL" +"AS51396","PFCLOUD","176.65.148.153","453","2026-09-01T22:14:32","2026-09-04T09:28:19","3389 3318 3324 3349 3372","NL" +"AS51396","PFCLOUD","204.76.203.7","446","2026-08-31T00:35:35","2026-09-03T00:22:11","24575 24001 24444 20129 20119","NL" +"AS51396","PFCLOUD","45.135.193.193","400","2026-08-31T11:30:54","2026-09-06T23:26:34","8888 3128 81 80 8080","DE" +"AS51396","PFCLOUD","45.135.194.113","220","2026-08-31T01:05:13","2026-09-06T21:38:43","666 555 8888 90 8000","DE" +"AS51396","PFCLOUD","45.135.193.198","200","2026-08-31T01:11:46","2026-09-06T07:38:01","8181 8080 18080 9999 8000","DE" +"AS51396","PFCLOUD","176.65.148.226","126","2026-08-31T02:03:10","2026-09-06T17:30:01","80 443 8500 8090 3000","NL" +"AS51396","PFCLOUD","176.65.149.212","106","2026-08-31T00:00:25","2026-09-06T23:04:39","7994 7993 7990 8010 8016","NL" +"AS51396","PFCLOUD","176.65.149.27","102","2026-08-31T00:56:02","2026-09-06T23:58:26","38002 38026 38000 38020 38001","NL" +"AS51396","PFCLOUD","176.65.149.31","99","2026-08-31T01:21:26","2026-09-06T23:32:25","1883 1908 1906 1897 1905","NL" +"AS51396","PFCLOUD","176.65.149.30","89","2026-08-31T00:39:52","2026-09-06T22:50:28","31975 32019 31973 31974 32017","NL" +"AS51396","PFCLOUD","176.65.148.93","67","2026-09-01T07:37:27","2026-09-06T22:49:21","1082 1085 1080 1094 1079","NL" +"AS51396","PFCLOUD","176.65.149.236","62","2026-08-31T05:44:55","2026-09-06T21:26:21","8000 9000 82 88 443","NL" +"AS51396","PFCLOUD","204.76.203.4","51","2026-08-31T00:03:33","2026-08-31T11:42:35","25564 25566 25565","NL" +"AS51396","PFCLOUD","176.65.148.156","51","2026-08-31T15:53:23","2026-09-05T11:36:49","25565","NL" +"AS51396","PFCLOUD","176.65.134.48","48","2026-09-05T04:30:55","2026-09-06T23:47:43","4550 4747 4700 4646 4567","DE" +"AS216246","RU-AEZA-AS","176.124.222.61","1","2026-08-31T13:15:24","2026-08-31T13:15:24","5432","RU" +"AS216246","RU-AEZA-AS","45.151.101.38","1","2026-09-03T20:05:03","2026-09-03T20:05:03","8006","RU" +"AS200651","FLOKINET","185.100.87.136","24","2026-08-31T01:12:02","2026-09-06T22:18:29","443 8443","RO" +"AS198953","PROTON66","176.120.22.61","1597","2026-08-31T09:44:36","2026-09-04T10:20:48","11433 14331 14330 35366 37628","RU" +"AS198953","PROTON66","176.120.22.240","45","2026-09-01T05:50:24","2026-09-06T14:40:21","4443 8443 10443","RU" +"AS198953","PROTON66","193.143.1.66","24","2026-08-31T18:27:14","2026-09-04T21:27:35","3389 3384 3349 33894","RU" +"AS198953","PROTON66","176.120.22.147","3","2026-09-03T02:10:02","2026-09-03T02:11:21","8006","RU" \ No newline at end of file diff --git a/kevlar/2026-09-07/honeylabs/top-ips-all.json b/kevlar/2026-09-07/honeylabs/top-ips-all.json new file mode 100644 index 0000000..bb90954 --- /dev/null +++ b/kevlar/2026-09-07/honeylabs/top-ips-all.json @@ -0,0 +1,941 @@ +[ + { + "asn": "AS57043", + "name": "HOSTKEY-AS", + "value": "::ffff:163.5.16.6", + "event_count": 8, + "unique_ips": 1, + "first_seen": "2026-09-02T21:02:40", + "last_seen": "2026-09-02T21:19:46", + "top_ports": [ + 19571, + 44981, + 14603, + 5070, + 20271 + ], + "countries": [ + "GB" + ], + "asn_org": "Hostkey B.v.", + "asn_number": 57043, + "country_name": "United Kingdom" + }, + { + "asn": "AS57043", + "name": "HOSTKEY-AS", + "value": "::ffff:82.39.165.100", + "event_count": 4, + "unique_ips": 1, + "first_seen": "2026-08-31T15:39:39", + "last_seen": "2026-09-03T03:47:57", + "top_ports": [ + 22 + ], + "countries": [ + "DE" + ], + "asn_org": "Hostkey B.v.", + "asn_number": 57043, + "country_name": "Germany" + }, + { + "asn": "AS210644", + "name": "AEZA-AS", + "value": "::ffff:185.246.217.150", + "event_count": 51, + "unique_ips": 1, + "first_seen": "2026-08-31T22:44:34", + "last_seen": "2026-09-02T15:29:27", + "top_ports": [ + 443, + 2222, + 2375 + ], + "countries": [ + "NL" + ], + "asn_org": "Aeza Group LLC", + "asn_number": 210644, + "country_name": "The Netherlands" + }, + { + "asn": "AS14956", + "name": "ROUTERHOSTING", + "value": "::ffff:45.61.157.82", + "event_count": 32, + "unique_ips": 1, + "first_seen": "2026-09-04T01:15:12", + "last_seen": "2026-09-04T06:30:09", + "top_ports": [ + 445 + ], + "countries": [ + "US" + ], + "asn_org": "RouterHosting LLC", + "asn_number": 14956, + "country_name": "United States" + }, + { + "asn": "AS14956", + "name": "ROUTERHOSTING", + "value": "::ffff:144.172.108.79", + "event_count": 24, + "unique_ips": 1, + "first_seen": "2026-09-04T20:02:59", + "last_seen": "2026-09-05T02:54:19", + "top_ports": [ + 445 + ], + "countries": [ + "US" + ], + "asn_org": "RouterHosting LLC", + "asn_number": 14956, + "country_name": "United States" + }, + { + "asn": "AS14956", + "name": "ROUTERHOSTING", + "value": "::ffff:144.172.99.200", + "event_count": 16, + "unique_ips": 1, + "first_seen": "2026-09-01T07:55:37", + "last_seen": "2026-09-01T08:57:36", + "top_ports": [ + 445 + ], + "countries": [ + "US" + ], + "asn_org": "RouterHosting LLC", + "asn_number": 14956, + "country_name": "United States" + }, + { + "asn": "AS14956", + "name": "ROUTERHOSTING", + "value": "::ffff:216.126.239.215", + "event_count": 8, + "unique_ips": 1, + "first_seen": "2026-09-06T00:12:30", + "last_seen": "2026-09-06T00:12:34", + "top_ports": [ + 445 + ], + "countries": [ + "US" + ], + "asn_org": "RouterHosting LLC", + "asn_number": 14956, + "country_name": "United States" + }, + { + "asn": "AS14956", + "name": "ROUTERHOSTING", + "value": "::ffff:45.61.183.10", + "event_count": 4, + "unique_ips": 1, + "first_seen": "2026-09-06T01:13:05", + "last_seen": "2026-09-06T06:25:29", + "top_ports": [ + 445 + ], + "countries": [ + "US" + ], + "asn_org": "RouterHosting LLC", + "asn_number": 14956, + "country_name": "United States" + }, + { + "asn": "AS14956", + "name": "ROUTERHOSTING", + "value": "::ffff:167.88.168.121", + "event_count": 4, + "unique_ips": 1, + "first_seen": "2026-09-03T06:47:31", + "last_seen": "2026-09-04T19:38:08", + "top_ports": [ + 2095, + 8008 + ], + "countries": [ + "US" + ], + "asn_org": "RouterHosting LLC", + "asn_number": 14956, + "country_name": "United States" + }, + { + "asn": "AS14956", + "name": "ROUTERHOSTING", + "value": "::ffff:144.172.112.11", + "event_count": 2, + "unique_ips": 1, + "first_seen": "2026-09-04T18:11:24", + "last_seen": "2026-09-04T18:11:24", + "top_ports": [ + 445 + ], + "countries": [ + "US" + ], + "asn_org": "RouterHosting LLC", + "asn_number": 14956, + "country_name": "United States" + }, + { + "asn": "AS14956", + "name": "ROUTERHOSTING", + "value": "::ffff:144.172.100.114", + "event_count": 1, + "unique_ips": 1, + "first_seen": "2026-09-02T07:32:32", + "last_seen": "2026-09-02T07:32:32", + "top_ports": [ + 1723 + ], + "countries": [ + "US" + ], + "asn_org": "RouterHosting LLC", + "asn_number": 14956, + "country_name": "United States" + }, + { + "asn": "AS14956", + "name": "ROUTERHOSTING", + "value": "::ffff:144.172.99.12", + "event_count": 1, + "unique_ips": 1, + "first_seen": "2026-09-02T02:45:38", + "last_seen": "2026-09-02T02:45:38", + "top_ports": [ + 443 + ], + "countries": [ + "US" + ], + "asn_org": "RouterHosting LLC", + "asn_number": 14956, + "country_name": "United States" + }, + { + "asn": "AS14956", + "name": "ROUTERHOSTING", + "value": "::ffff:45.61.149.189", + "event_count": 1, + "unique_ips": 1, + "first_seen": "2026-09-06T15:51:16", + "last_seen": "2026-09-06T15:51:16", + "top_ports": [ + 443 + ], + "countries": [ + "US" + ], + "asn_org": "RouterHosting LLC", + "asn_number": 14956, + "country_name": "United States" + }, + { + "asn": "AS14956", + "name": "ROUTERHOSTING", + "value": "::ffff:216.126.227.187", + "event_count": 1, + "unique_ips": 1, + "first_seen": "2026-09-03T17:01:38", + "last_seen": "2026-09-03T17:01:38", + "top_ports": [ + 7860 + ], + "countries": [ + "US" + ], + "asn_org": "RouterHosting LLC", + "asn_number": 14956, + "country_name": "United States" + }, + { + "asn": "AS14956", + "name": "ROUTERHOSTING", + "value": "::ffff:144.172.115.222", + "event_count": 1, + "unique_ips": 1, + "first_seen": "2026-09-01T09:05:26", + "last_seen": "2026-09-01T09:05:26", + "top_ports": [ + 5061 + ], + "countries": [ + "US" + ], + "asn_org": "RouterHosting LLC", + "asn_number": 14956, + "country_name": "United States" + }, + { + "asn": "AS51852", + "name": "PLI-AS", + "value": "::ffff:179.43.150.26", + "event_count": 16, + "unique_ips": 1, + "first_seen": "2026-08-31T15:32:52", + "last_seen": "2026-08-31T16:49:55", + "top_ports": [ + 8443 + ], + "countries": [ + "CH" + ], + "asn_org": "Private Layer INC", + "asn_number": 51852, + "country_name": "Switzerland" + }, + { + "asn": "AS51852", + "name": "PLI-AS", + "value": "::ffff:46.19.142.226", + "event_count": 6, + "unique_ips": 1, + "first_seen": "2026-09-04T18:34:20", + "last_seen": "2026-09-04T19:27:10", + "top_ports": [ + 2087 + ], + "countries": [ + "CH" + ], + "asn_org": "Private Layer INC", + "asn_number": 51852, + "country_name": "Switzerland" + }, + { + "asn": "AS51852", + "name": "PLI-AS", + "value": "::ffff:141.255.165.66", + "event_count": 5, + "unique_ips": 1, + "first_seen": "2026-09-03T20:48:30", + "last_seen": "2026-09-04T11:46:33", + "top_ports": [ + 1723 + ], + "countries": [ + "CH" + ], + "asn_org": "Private Layer INC", + "asn_number": 51852, + "country_name": "Switzerland" + }, + { + "asn": "AS51852", + "name": "PLI-AS", + "value": "::ffff:179.43.186.220", + "event_count": 3, + "unique_ips": 1, + "first_seen": "2026-09-01T12:06:48", + "last_seen": "2026-09-01T12:06:54", + "top_ports": [ + 80, + 443 + ], + "countries": [ + "CH" + ], + "asn_org": "Private Layer INC", + "asn_number": 51852, + "country_name": "Switzerland" + }, + { + "asn": "AS51852", + "name": "PLI-AS", + "value": "::ffff:179.43.146.27", + "event_count": 2, + "unique_ips": 1, + "first_seen": "2026-09-01T07:55:46", + "last_seen": "2026-09-02T18:13:22", + "top_ports": [ + 32400, + 8085 + ], + "countries": [ + "CH" + ], + "asn_org": "Private Layer INC", + "asn_number": 51852, + "country_name": "Switzerland" + }, + { + "asn": "AS51396", + "name": "PFCLOUD", + "value": "::ffff:204.76.203.222", + "event_count": 1159, + "unique_ips": 1, + "first_seen": "2026-09-02T09:47:23", + "last_seen": "2026-09-06T23:43:17", + "top_ports": [ + 6128, + 11238, + 10803, + 11148, + 11415 + ], + "countries": [ + "NL" + ], + "asn_org": "Pfcloud UG (haftungsbeschrankt)", + "asn_number": 51396, + "country_name": "The Netherlands" + }, + { + "asn": "AS51396", + "name": "PFCLOUD", + "value": "::ffff:204.76.203.221", + "event_count": 1154, + "unique_ips": 1, + "first_seen": "2026-09-02T09:47:23", + "last_seen": "2026-09-06T23:57:44", + "top_ports": [ + 11587, + 10231, + 13246, + 31280, + 1083 + ], + "countries": [ + "NL" + ], + "asn_org": "Pfcloud UG (haftungsbeschrankt)", + "asn_number": 51396, + "country_name": "The Netherlands" + }, + { + "asn": "AS51396", + "name": "PFCLOUD", + "value": "::ffff:204.76.203.213", + "event_count": 1123, + "unique_ips": 1, + "first_seen": "2026-09-02T09:53:18", + "last_seen": "2026-09-06T23:40:09", + "top_ports": [ + 5112, + 3385, + 10140, + 50012, + 11644 + ], + "countries": [ + "NL" + ], + "asn_org": "Pfcloud UG (haftungsbeschrankt)", + "asn_number": 51396, + "country_name": "The Netherlands" + }, + { + "asn": "AS51396", + "name": "PFCLOUD", + "value": "::ffff:204.76.203.214", + "event_count": 1091, + "unique_ips": 1, + "first_seen": "2026-09-02T09:48:01", + "last_seen": "2026-09-06T23:57:44", + "top_ports": [ + 10119, + 21698, + 11100, + 15120, + 10006 + ], + "countries": [ + "NL" + ], + "asn_org": "Pfcloud UG (haftungsbeschrankt)", + "asn_number": 51396, + "country_name": "The Netherlands" + }, + { + "asn": "AS51396", + "name": "PFCLOUD", + "value": "::ffff:204.76.203.49", + "event_count": 836, + "unique_ips": 1, + "first_seen": "2026-08-31T00:54:43", + "last_seen": "2026-09-06T22:29:18", + "top_ports": [ + 8080, + 1081, + 888, + 8888, + 4145 + ], + "countries": [ + "NL" + ], + "asn_org": "Pfcloud UG (haftungsbeschrankt)", + "asn_number": 51396, + "country_name": "The Netherlands" + }, + { + "asn": "AS51396", + "name": "PFCLOUD", + "value": "::ffff:176.65.148.153", + "event_count": 453, + "unique_ips": 1, + "first_seen": "2026-09-01T22:14:32", + "last_seen": "2026-09-04T09:28:19", + "top_ports": [ + 3389, + 3318, + 3324, + 3349, + 3372 + ], + "countries": [ + "NL" + ], + "asn_org": "Pfcloud UG (haftungsbeschrankt)", + "asn_number": 51396, + "country_name": "The Netherlands" + }, + { + "asn": "AS51396", + "name": "PFCLOUD", + "value": "::ffff:204.76.203.7", + "event_count": 446, + "unique_ips": 1, + "first_seen": "2026-08-31T00:35:35", + "last_seen": "2026-09-03T00:22:11", + "top_ports": [ + 24575, + 24001, + 24444, + 20129, + 20119 + ], + "countries": [ + "NL" + ], + "asn_org": "Pfcloud UG (haftungsbeschrankt)", + "asn_number": 51396, + "country_name": "The Netherlands" + }, + { + "asn": "AS51396", + "name": "PFCLOUD", + "value": "::ffff:45.135.193.193", + "event_count": 400, + "unique_ips": 1, + "first_seen": "2026-08-31T11:30:54", + "last_seen": "2026-09-06T23:26:34", + "top_ports": [ + 8888, + 3128, + 81, + 80, + 8080 + ], + "countries": [ + "DE" + ], + "asn_org": "Pfcloud UG (haftungsbeschrankt)", + "asn_number": 51396, + "country_name": "Germany" + }, + { + "asn": "AS51396", + "name": "PFCLOUD", + "value": "::ffff:45.135.194.113", + "event_count": 220, + "unique_ips": 1, + "first_seen": "2026-08-31T01:05:13", + "last_seen": "2026-09-06T21:38:43", + "top_ports": [ + 666, + 555, + 8888, + 90, + 8000 + ], + "countries": [ + "DE" + ], + "asn_org": "Pfcloud UG (haftungsbeschrankt)", + "asn_number": 51396, + "country_name": "Germany" + }, + { + "asn": "AS51396", + "name": "PFCLOUD", + "value": "::ffff:45.135.193.198", + "event_count": 200, + "unique_ips": 1, + "first_seen": "2026-08-31T01:11:46", + "last_seen": "2026-09-06T07:38:01", + "top_ports": [ + 8181, + 8080, + 18080, + 9999, + 8000 + ], + "countries": [ + "DE" + ], + "asn_org": "Pfcloud UG (haftungsbeschrankt)", + "asn_number": 51396, + "country_name": "Germany" + }, + { + "asn": "AS51396", + "name": "PFCLOUD", + "value": "::ffff:176.65.148.226", + "event_count": 126, + "unique_ips": 1, + "first_seen": "2026-08-31T02:03:10", + "last_seen": "2026-09-06T17:30:01", + "top_ports": [ + 80, + 443, + 8500, + 8090, + 3000 + ], + "countries": [ + "NL" + ], + "asn_org": "Pfcloud UG (haftungsbeschrankt)", + "asn_number": 51396, + "country_name": "The Netherlands" + }, + { + "asn": "AS51396", + "name": "PFCLOUD", + "value": "::ffff:176.65.149.212", + "event_count": 106, + "unique_ips": 1, + "first_seen": "2026-08-31T00:00:25", + "last_seen": "2026-09-06T23:04:39", + "top_ports": [ + 7994, + 7993, + 7990, + 8010, + 8016 + ], + "countries": [ + "NL" + ], + "asn_org": "Pfcloud UG (haftungsbeschrankt)", + "asn_number": 51396, + "country_name": "The Netherlands" + }, + { + "asn": "AS51396", + "name": "PFCLOUD", + "value": "::ffff:176.65.149.27", + "event_count": 102, + "unique_ips": 1, + "first_seen": "2026-08-31T00:56:02", + "last_seen": "2026-09-06T23:58:26", + "top_ports": [ + 38002, + 38026, + 38000, + 38020, + 38001 + ], + "countries": [ + "NL" + ], + "asn_org": "Pfcloud UG (haftungsbeschrankt)", + "asn_number": 51396, + "country_name": "The Netherlands" + }, + { + "asn": "AS51396", + "name": "PFCLOUD", + "value": "::ffff:176.65.149.31", + "event_count": 99, + "unique_ips": 1, + "first_seen": "2026-08-31T01:21:26", + "last_seen": "2026-09-06T23:32:25", + "top_ports": [ + 1883, + 1908, + 1906, + 1897, + 1905 + ], + "countries": [ + "NL" + ], + "asn_org": "Pfcloud UG (haftungsbeschrankt)", + "asn_number": 51396, + "country_name": "The Netherlands" + }, + { + "asn": "AS51396", + "name": "PFCLOUD", + "value": "::ffff:176.65.149.30", + "event_count": 89, + "unique_ips": 1, + "first_seen": "2026-08-31T00:39:52", + "last_seen": "2026-09-06T22:50:28", + "top_ports": [ + 31975, + 32019, + 31973, + 31974, + 32017 + ], + "countries": [ + "NL" + ], + "asn_org": "Pfcloud UG (haftungsbeschrankt)", + "asn_number": 51396, + "country_name": "The Netherlands" + }, + { + "asn": "AS51396", + "name": "PFCLOUD", + "value": "::ffff:176.65.148.93", + "event_count": 67, + "unique_ips": 1, + "first_seen": "2026-09-01T07:37:27", + "last_seen": "2026-09-06T22:49:21", + "top_ports": [ + 1082, + 1085, + 1080, + 1094, + 1079 + ], + "countries": [ + "NL" + ], + "asn_org": "Pfcloud UG (haftungsbeschrankt)", + "asn_number": 51396, + "country_name": "The Netherlands" + }, + { + "asn": "AS51396", + "name": "PFCLOUD", + "value": "::ffff:176.65.149.236", + "event_count": 62, + "unique_ips": 1, + "first_seen": "2026-08-31T05:44:55", + "last_seen": "2026-09-06T21:26:21", + "top_ports": [ + 8000, + 9000, + 82, + 88, + 443 + ], + "countries": [ + "NL" + ], + "asn_org": "Pfcloud UG (haftungsbeschrankt)", + "asn_number": 51396, + "country_name": "The Netherlands" + }, + { + "asn": "AS51396", + "name": "PFCLOUD", + "value": "::ffff:204.76.203.4", + "event_count": 51, + "unique_ips": 1, + "first_seen": "2026-08-31T00:03:33", + "last_seen": "2026-08-31T11:42:35", + "top_ports": [ + 25564, + 25566, + 25565 + ], + "countries": [ + "NL" + ], + "asn_org": "Pfcloud UG (haftungsbeschrankt)", + "asn_number": 51396, + "country_name": "The Netherlands" + }, + { + "asn": "AS51396", + "name": "PFCLOUD", + "value": "::ffff:176.65.148.156", + "event_count": 51, + "unique_ips": 1, + "first_seen": "2026-08-31T15:53:23", + "last_seen": "2026-09-05T11:36:49", + "top_ports": [ + 25565 + ], + "countries": [ + "NL" + ], + "asn_org": "Pfcloud UG (haftungsbeschrankt)", + "asn_number": 51396, + "country_name": "The Netherlands" + }, + { + "asn": "AS51396", + "name": "PFCLOUD", + "value": "::ffff:176.65.134.48", + "event_count": 48, + "unique_ips": 1, + "first_seen": "2026-09-05T04:30:55", + "last_seen": "2026-09-06T23:47:43", + "top_ports": [ + 4550, + 4747, + 4700, + 4646, + 4567 + ], + "countries": [ + "DE" + ], + "asn_org": "Pfcloud UG (haftungsbeschrankt)", + "asn_number": 51396, + "country_name": "Germany" + }, + { + "asn": "AS216246", + "name": "RU-AEZA-AS", + "value": "::ffff:176.124.222.61", + "event_count": 1, + "unique_ips": 1, + "first_seen": "2026-08-31T13:15:24", + "last_seen": "2026-08-31T13:15:24", + "top_ports": [ + 5432 + ], + "countries": [ + "RU" + ], + "asn_org": "Aeza Group LLC", + "asn_number": 216246, + "country_name": "Russia" + }, + { + "asn": "AS216246", + "name": "RU-AEZA-AS", + "value": "::ffff:45.151.101.38", + "event_count": 1, + "unique_ips": 1, + "first_seen": "2026-09-03T20:05:03", + "last_seen": "2026-09-03T20:05:03", + "top_ports": [ + 8006 + ], + "countries": [ + "RU" + ], + "asn_org": "Aeza Group LLC", + "asn_number": 216246, + "country_name": "Russia" + }, + { + "asn": "AS200651", + "name": "FLOKINET", + "value": "::ffff:185.100.87.136", + "event_count": 24, + "unique_ips": 1, + "first_seen": "2026-08-31T01:12:02", + "last_seen": "2026-09-06T22:18:29", + "top_ports": [ + 443, + 8443 + ], + "countries": [ + "RO" + ], + "asn_org": "FlokiNET ehf", + "asn_number": 200651, + "country_name": "Romania" + }, + { + "asn": "AS198953", + "name": "PROTON66", + "value": "::ffff:176.120.22.61", + "event_count": 1597, + "unique_ips": 1, + "first_seen": "2026-08-31T09:44:36", + "last_seen": "2026-09-04T10:20:48", + "top_ports": [ + 11433, + 14331, + 14330, + 35366, + 37628 + ], + "countries": [ + "RU" + ], + "asn_org": "Proton66 OOO", + "asn_number": 198953, + "country_name": "Russia" + }, + { + "asn": "AS198953", + "name": "PROTON66", + "value": "::ffff:176.120.22.240", + "event_count": 45, + "unique_ips": 1, + "first_seen": "2026-09-01T05:50:24", + "last_seen": "2026-09-06T14:40:21", + "top_ports": [ + 4443, + 8443, + 10443 + ], + "countries": [ + "RU" + ], + "asn_org": "Proton66 OOO", + "asn_number": 198953, + "country_name": "Russia" + }, + { + "asn": "AS198953", + "name": "PROTON66", + "value": "::ffff:193.143.1.66", + "event_count": 24, + "unique_ips": 1, + "first_seen": "2026-08-31T18:27:14", + "last_seen": "2026-09-04T21:27:35", + "top_ports": [ + 3389, + 3384, + 3349, + 33894 + ], + "countries": [ + "RU" + ], + "asn_org": "Proton66 OOO", + "asn_number": 198953, + "country_name": "Russia" + }, + { + "asn": "AS198953", + "name": "PROTON66", + "value": "::ffff:176.120.22.147", + "event_count": 3, + "unique_ips": 1, + "first_seen": "2026-09-03T02:10:02", + "last_seen": "2026-09-03T02:11:21", + "top_ports": [ + 8006 + ], + "countries": [ + "RU" + ], + "asn_org": "Proton66 OOO", + "asn_number": 198953, + "country_name": "Russia" + } +] \ No newline at end of file diff --git a/kevlar/2026-09-07/honeylabs/user-agents-all.json b/kevlar/2026-09-07/honeylabs/user-agents-all.json new file mode 100644 index 0000000..3e8f85c --- /dev/null +++ b/kevlar/2026-09-07/honeylabs/user-agents-all.json @@ -0,0 +1,580 @@ +[ + { + "asn": "AS210644", + "name": "AEZA-AS", + "value": "libredtail-http", + "event_count": 50, + "unique_ips": 1, + "first_seen": "2026-08-31T22:44:34", + "last_seen": "2026-09-02T15:29:27", + "top_ports": [ + 443, + 2375 + ], + "countries": [ + "NL" + ] + }, + { + "asn": "AS14956", + "name": "ROUTERHOSTING", + "value": "Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0", + "event_count": 4, + "unique_ips": 1, + "first_seen": "2026-09-03T06:47:31", + "last_seen": "2026-09-04T19:38:08", + "top_ports": [ + 2095, + 8008 + ], + "countries": [ + "US" + ] + }, + { + "asn": "AS14956", + "name": "ROUTERHOSTING", + "value": "Python-urllib/3.13", + "event_count": 1, + "unique_ips": 1, + "first_seen": "2026-09-06T15:51:16", + "last_seen": "2026-09-06T15:51:16", + "top_ports": [ + 443 + ], + "countries": [ + "US" + ] + }, + { + "asn": "AS14956", + "name": "ROUTERHOSTING", + "value": "Python/3.13 aiohttp/3.13.5", + "event_count": 1, + "unique_ips": 1, + "first_seen": "2026-09-03T17:01:38", + "last_seen": "2026-09-03T17:01:38", + "top_ports": [ + 7860 + ], + "countries": [ + "US" + ] + }, + { + "asn": "AS14956", + "name": "ROUTERHOSTING", + "value": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36", + "event_count": 1, + "unique_ips": 1, + "first_seen": "2026-09-02T02:45:38", + "last_seen": "2026-09-02T02:45:38", + "top_ports": [ + 443 + ], + "countries": [ + "US" + ] + }, + { + "asn": "AS51852", + "name": "PLI-AS", + "value": "Mozilla/5.0", + "event_count": 19, + "unique_ips": 2, + "first_seen": "2026-08-31T15:32:52", + "last_seen": "2026-09-04T19:27:10", + "top_ports": [ + 8443, + 2087 + ], + "countries": [ + "CH" + ] + }, + { + "asn": "AS51852", + "name": "PLI-AS", + "value": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/125 Safari/537.36", + "event_count": 3, + "unique_ips": 1, + "first_seen": "2026-09-01T12:06:48", + "last_seen": "2026-09-01T12:06:54", + "top_ports": [ + 80, + 443 + ], + "countries": [ + "CH" + ] + }, + { + "asn": "AS51852", + "name": "PLI-AS", + "value": "Mozilla/5.0 (Windows NT 10.0; Win64; x64)", + "event_count": 3, + "unique_ips": 1, + "first_seen": "2026-09-04T18:34:20", + "last_seen": "2026-09-04T19:27:10", + "top_ports": [ + 2087 + ], + "countries": [ + "CH" + ] + }, + { + "asn": "AS51852", + "name": "PLI-AS", + "value": "Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0", + "event_count": 2, + "unique_ips": 1, + "first_seen": "2026-09-01T07:55:46", + "last_seen": "2026-09-02T18:13:22", + "top_ports": [ + 32400, + 8085 + ], + "countries": [ + "CH" + ] + }, + { + "asn": "AS51396", + "name": "PFCLOUD", + "value": "Go-http-client/1.1", + "event_count": 372, + "unique_ips": 5, + "first_seen": "2026-08-31T00:35:35", + "last_seen": "2026-09-06T23:47:43", + "top_ports": [ + 4550, + 4747, + 222, + 8000, + 11434 + ], + "countries": [ + "NL", + "DE" + ] + }, + { + "asn": "AS51396", + "name": "PFCLOUD", + "value": "0day", + "event_count": 200, + "unique_ips": 1, + "first_seen": "2026-08-31T01:11:46", + "last_seen": "2026-09-06T07:38:01", + "top_ports": [ + 8181, + 8080, + 18080, + 18088, + 8888 + ], + "countries": [ + "DE" + ] + }, + { + "asn": "AS51396", + "name": "PFCLOUD", + "value": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36", + "event_count": 126, + "unique_ips": 1, + "first_seen": "2026-08-31T02:03:10", + "last_seen": "2026-09-06T17:30:01", + "top_ports": [ + 80, + 443, + 8500, + 8090, + 3000 + ], + "countries": [ + "NL" + ] + }, + { + "asn": "AS51396", + "name": "PFCLOUD", + "value": "Mozilla/5.0 zgrab/0.x", + "event_count": 95, + "unique_ips": 5, + "first_seen": "2026-08-31T00:50:18", + "last_seen": "2026-09-06T21:26:21", + "top_ports": [ + 8000, + 8001, + 443, + 9000, + 88 + ], + "countries": [ + "NL" + ] + }, + { + "asn": "AS51396", + "name": "PFCLOUD", + "value": "kubo-probe/1.0", + "event_count": 12, + "unique_ips": 1, + "first_seen": "2026-08-31T11:11:43", + "last_seen": "2026-09-02T16:28:23", + "top_ports": [ + 5001, + 8080 + ], + "countries": [ + "DE" + ] + }, + { + "asn": "AS51396", + "name": "PFCLOUD", + "value": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36", + "event_count": 10, + "unique_ips": 1, + "first_seen": "2026-08-31T10:08:26", + "last_seen": "2026-09-05T08:05:52", + "top_ports": [ + 80 + ], + "countries": [ + "NL" + ] + }, + { + "asn": "AS51396", + "name": "PFCLOUD", + "value": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36", + "event_count": 6, + "unique_ips": 1, + "first_seen": "2026-09-05T12:54:20", + "last_seen": "2026-09-05T13:26:20", + "top_ports": [ + 8090 + ], + "countries": [ + "NL" + ] + }, + { + "asn": "AS51396", + "name": "PFCLOUD", + "value": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36", + "event_count": 4, + "unique_ips": 1, + "first_seen": "2026-09-01T09:55:22", + "last_seen": "2026-09-02T01:32:40", + "top_ports": [ + 80 + ], + "countries": [ + "NL" + ] + }, + { + "asn": "AS51396", + "name": "PFCLOUD", + "value": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.3 Safari/605.1.15", + "event_count": 1, + "unique_ips": 1, + "first_seen": "2026-09-01T10:40:15", + "last_seen": "2026-09-01T10:40:15", + "top_ports": [ + 443 + ], + "countries": [ + "UA" + ] + }, + { + "asn": "AS51396", + "name": "PFCLOUD", + "value": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1 Safari/605.1.15", + "event_count": 1, + "unique_ips": 1, + "first_seen": "2026-09-01T06:45:24", + "last_seen": "2026-09-01T06:45:24", + "top_ports": [ + 443 + ], + "countries": [ + "UA" + ] + }, + { + "asn": "AS51396", + "name": "PFCLOUD", + "value": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36", + "event_count": 1, + "unique_ips": 1, + "first_seen": "2026-08-31T07:27:42", + "last_seen": "2026-08-31T07:27:42", + "top_ports": [ + 443 + ], + "countries": [ + "UA" + ] + }, + { + "asn": "AS51396", + "name": "PFCLOUD", + "value": "Mozilla/5.0 (Knoppix; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36", + "event_count": 1, + "unique_ips": 1, + "first_seen": "2026-08-31T09:52:59", + "last_seen": "2026-08-31T09:52:59", + "top_ports": [ + 443 + ], + "countries": [ + "UA" + ] + }, + { + "asn": "AS51396", + "name": "PFCLOUD", + "value": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Safari/537.36 Edge/12.246", + "event_count": 1, + "unique_ips": 1, + "first_seen": "2026-09-03T10:27:07", + "last_seen": "2026-09-03T10:27:07", + "top_ports": [ + 8080 + ], + "countries": [ + "NL" + ] + }, + { + "asn": "AS51396", + "name": "PFCLOUD", + "value": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36", + "event_count": 1, + "unique_ips": 1, + "first_seen": "2026-08-31T18:59:50", + "last_seen": "2026-08-31T18:59:50", + "top_ports": [ + 443 + ], + "countries": [ + "UA" + ] + }, + { + "asn": "AS51396", + "name": "PFCLOUD", + "value": "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0", + "event_count": 1, + "unique_ips": 1, + "first_seen": "2026-09-01T07:30:45", + "last_seen": "2026-09-01T07:30:45", + "top_ports": [ + 443 + ], + "countries": [ + "UA" + ] + }, + { + "asn": "AS51396", + "name": "PFCLOUD", + "value": "Mozilla/5.0 (Macintosh, Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/19.0 Safari/605.1.15", + "event_count": 1, + "unique_ips": 1, + "first_seen": "2026-08-31T07:08:42", + "last_seen": "2026-08-31T07:08:42", + "top_ports": [ + 443 + ], + "countries": [ + "UA" + ] + }, + { + "asn": "AS51396", + "name": "PFCLOUD", + "value": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.5 Safari/605.1.15 AlohaBrowser/7.6.0", + "event_count": 1, + "unique_ips": 1, + "first_seen": "2026-08-31T19:29:52", + "last_seen": "2026-08-31T19:29:52", + "top_ports": [ + 443 + ], + "countries": [ + "UA" + ] + }, + { + "asn": "AS51396", + "name": "PFCLOUD", + "value": "Mozilla/5.0 (X11; Linux x86_64; rv:1.9.6.20) Gecko/ Firefox/3.6.17", + "event_count": 1, + "unique_ips": 1, + "first_seen": "2026-08-31T22:17:09", + "last_seen": "2026-08-31T22:17:09", + "top_ports": [ + 443 + ], + "countries": [ + "UA" + ] + }, + { + "asn": "AS216246", + "name": "RU-AEZA-AS", + "value": "Python-urllib/3.10", + "event_count": 1, + "unique_ips": 1, + "first_seen": "2026-09-03T20:05:03", + "last_seen": "2026-09-03T20:05:03", + "top_ports": [ + 8006 + ], + "countries": [ + "RU" + ] + }, + { + "asn": "AS200651", + "name": "FLOKINET", + "value": "SPARK COMMIT: 08059e95dacafe0bf6e5782f8e2c8ec9cd8c5a17", + "event_count": 3, + "unique_ips": 1, + "first_seen": "2026-09-03T20:46:54", + "last_seen": "2026-09-03T23:55:20", + "top_ports": [ + 443 + ], + "countries": [ + "RO" + ] + }, + { + "asn": "AS200651", + "name": "FLOKINET", + "value": "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:104.71.6212.24) Gecko/25.2.4212.671 Firefox/2.0", + "event_count": 3, + "unique_ips": 1, + "first_seen": "2026-09-03T20:46:53", + "last_seen": "2026-09-03T23:55:19", + "top_ports": [ + 443 + ], + "countries": [ + "RO" + ] + }, + { + "asn": "AS200651", + "name": "FLOKINET", + "value": "Mozilla/5.0 (Android 12; Mobile; rv:117.0) Gecko/117.0 Focus/117.0", + "event_count": 3, + "unique_ips": 1, + "first_seen": "2026-09-06T20:33:31", + "last_seen": "2026-09-06T22:18:29", + "top_ports": [ + 443 + ], + "countries": [ + "RO" + ] + }, + { + "asn": "AS200651", + "name": "FLOKINET", + "value": "Mozilla/5.0 (Windows NT 10.0; Win64; x64)", + "event_count": 3, + "unique_ips": 1, + "first_seen": "2026-09-01T12:25:00", + "last_seen": "2026-09-01T14:07:55", + "top_ports": [ + 8443 + ], + "countries": [ + "RO" + ] + }, + { + "asn": "AS200651", + "name": "FLOKINET", + "value": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3 rv:3.0; eu-FR) AppleWebKit/533.4.2 (KHTML, like Gecko) Version/5.0.1 Safari/533.4.2", + "event_count": 3, + "unique_ips": 1, + "first_seen": "2026-08-31T01:12:02", + "last_seen": "2026-08-31T06:06:56", + "top_ports": [ + 443 + ], + "countries": [ + "RO" + ] + }, + { + "asn": "AS198953", + "name": "PROTON66", + "value": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.1 Mobile/15E148 Safari/604.1", + "event_count": 1, + "unique_ips": 1, + "first_seen": "2026-09-03T02:11:21", + "last_seen": "2026-09-03T02:11:21", + "top_ports": [ + 8006 + ], + "countries": [ + "RU" + ] + }, + { + "asn": "AS198953", + "name": "PROTON66", + "value": "Mozilla/5.0 (Macintosh, Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/15.6.1 Safari/605.1.15", + "event_count": 1, + "unique_ips": 1, + "first_seen": "2026-09-03T02:10:04", + "last_seen": "2026-09-03T02:10:04", + "top_ports": [ + 8006 + ], + "countries": [ + "RU" + ] + }, + { + "asn": "AS198953", + "name": "PROTON66", + "value": "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:74.0) Gecko/20100101 Firefox/74.0 - github.com/anasbousselham/)", + "event_count": 1, + "unique_ips": 1, + "first_seen": "2026-09-01T05:50:24", + "last_seen": "2026-09-01T05:50:24", + "top_ports": [ + 10443 + ], + "countries": [ + "RU" + ] + }, + { + "asn": "AS198953", + "name": "PROTON66", + "value": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36", + "event_count": 1, + "unique_ips": 1, + "first_seen": "2026-09-03T02:10:02", + "last_seen": "2026-09-03T02:10:02", + "top_ports": [ + 8006 + ], + "countries": [ + "RU" + ] + } +] \ No newline at end of file -- cgit v1.2.3