From de4c2e99a969eb10708b02d8f2b6f31495eacce8 Mon Sep 17 00:00:00 2001 From: hrbrmstr Date: Mon, 7 Sep 2026 06:03:32 -0400 Subject: chore: weekly BPH update --- kevlar/2026-09-07/OPERATIONS_LOG.md | 57 + kevlar/2026-09-07/censys/agg-summary.json | 5692 ++++++++++++++++++++ .../2026-09-07/censys/aggregations-AS138915.ndjson | 5 + .../2026-09-07/censys/aggregations-AS140666.ndjson | 5 + .../2026-09-07/censys/aggregations-AS14956.ndjson | 5 + .../2026-09-07/censys/aggregations-AS198953.ndjson | 5 + .../2026-09-07/censys/aggregations-AS200593.ndjson | 5 + .../2026-09-07/censys/aggregations-AS200651.ndjson | 5 + .../2026-09-07/censys/aggregations-AS202685.ndjson | 5 + .../2026-09-07/censys/aggregations-AS206728.ndjson | 5 + .../2026-09-07/censys/aggregations-AS209847.ndjson | 5 + .../2026-09-07/censys/aggregations-AS210644.ndjson | 5 + .../2026-09-07/censys/aggregations-AS211720.ndjson | 5 + .../2026-09-07/censys/aggregations-AS213702.ndjson | 5 + .../2026-09-07/censys/aggregations-AS214351.ndjson | 5 + .../2026-09-07/censys/aggregations-AS214940.ndjson | 5 + .../2026-09-07/censys/aggregations-AS216139.ndjson | 5 + .../2026-09-07/censys/aggregations-AS216246.ndjson | 5 + .../2026-09-07/censys/aggregations-AS216309.ndjson | 5 + .../2026-09-07/censys/aggregations-AS30823.ndjson | 5 + .../2026-09-07/censys/aggregations-AS33993.ndjson | 5 + .../2026-09-07/censys/aggregations-AS394711.ndjson | 5 + .../2026-09-07/censys/aggregations-AS400992.ndjson | 5 + .../2026-09-07/censys/aggregations-AS51396.ndjson | 5 + .../2026-09-07/censys/aggregations-AS51852.ndjson | 5 + .../2026-09-07/censys/aggregations-AS57043.ndjson | 5 + .../2026-09-07/censys/aggregations-AS58854.ndjson | 5 + kevlar/2026-09-07/censys/enrichment-summary.json | 217 + kevlar/2026-09-07/censys/fleet-correlation.csv | 7 + kevlar/2026-09-07/censys/ip-enrichments.ndjson | 10 + kevlar/2026-09-07/changes/anomalies.csv | 48 + .../2026-09-07/changes/censys-software-changes.csv | 22 + kevlar/2026-09-07/changes/diff-vs-prior-week.csv | 26 + kevlar/2026-09-07/changes/numbers-table.json | 277 + .../changes/prior-window-2026-08-24_31.json | 1319 +++++ kevlar/2026-09-07/honeylabs/asn-enrichments.json | 314 ++ kevlar/2026-09-07/honeylabs/events-AS138915.ndjson | 0 kevlar/2026-09-07/honeylabs/events-AS140666.ndjson | 0 kevlar/2026-09-07/honeylabs/events-AS14956.ndjson | 95 + kevlar/2026-09-07/honeylabs/events-AS198953.ndjson | 100 + kevlar/2026-09-07/honeylabs/events-AS200593.ndjson | 0 kevlar/2026-09-07/honeylabs/events-AS200651.ndjson | 24 + kevlar/2026-09-07/honeylabs/events-AS202685.ndjson | 0 kevlar/2026-09-07/honeylabs/events-AS206728.ndjson | 0 kevlar/2026-09-07/honeylabs/events-AS209847.ndjson | 0 kevlar/2026-09-07/honeylabs/events-AS210644.ndjson | 51 + kevlar/2026-09-07/honeylabs/events-AS211720.ndjson | 0 kevlar/2026-09-07/honeylabs/events-AS213702.ndjson | 0 kevlar/2026-09-07/honeylabs/events-AS214351.ndjson | 0 kevlar/2026-09-07/honeylabs/events-AS214940.ndjson | 0 kevlar/2026-09-07/honeylabs/events-AS216139.ndjson | 0 kevlar/2026-09-07/honeylabs/events-AS216246.ndjson | 2 + kevlar/2026-09-07/honeylabs/events-AS216309.ndjson | 0 kevlar/2026-09-07/honeylabs/events-AS30823.ndjson | 0 kevlar/2026-09-07/honeylabs/events-AS33993.ndjson | 0 kevlar/2026-09-07/honeylabs/events-AS394711.ndjson | 0 kevlar/2026-09-07/honeylabs/events-AS400992.ndjson | 0 kevlar/2026-09-07/honeylabs/events-AS51396.ndjson | 100 + kevlar/2026-09-07/honeylabs/events-AS51852.ndjson | 32 + kevlar/2026-09-07/honeylabs/events-AS57043.ndjson | 12 + kevlar/2026-09-07/honeylabs/events-AS58854.ndjson | 0 kevlar/2026-09-07/honeylabs/fingerprints.csv | 37 + kevlar/2026-09-07/honeylabs/ioc-lookups.json | 1175 ++++ kevlar/2026-09-07/honeylabs/loop-summary.json | 239 + .../honeylabs/top-attackers-ip-AS138915.json | 1 + .../honeylabs/top-attackers-ip-AS140666.json | 1 + .../honeylabs/top-attackers-ip-AS14956.json | 195 + .../honeylabs/top-attackers-ip-AS198953.json | 75 + .../honeylabs/top-attackers-ip-AS200593.json | 1 + .../honeylabs/top-attackers-ip-AS200651.json | 19 + .../honeylabs/top-attackers-ip-AS202685.json | 1 + .../honeylabs/top-attackers-ip-AS206728.json | 1 + .../honeylabs/top-attackers-ip-AS209847.json | 1 + .../honeylabs/top-attackers-ip-AS210644.json | 20 + .../honeylabs/top-attackers-ip-AS211720.json | 1 + .../honeylabs/top-attackers-ip-AS213702.json | 1 + .../honeylabs/top-attackers-ip-AS214351.json | 1 + .../honeylabs/top-attackers-ip-AS214940.json | 1 + .../honeylabs/top-attackers-ip-AS216139.json | 1 + .../honeylabs/top-attackers-ip-AS216246.json | 34 + .../honeylabs/top-attackers-ip-AS216309.json | 1 + .../honeylabs/top-attackers-ip-AS30823.json | 1 + .../honeylabs/top-attackers-ip-AS33993.json | 1 + .../honeylabs/top-attackers-ip-AS394711.json | 1 + .../honeylabs/top-attackers-ip-AS400992.json | 1 + .../honeylabs/top-attackers-ip-AS51396.json | 396 ++ .../honeylabs/top-attackers-ip-AS51852.json | 84 + .../honeylabs/top-attackers-ip-AS57043.json | 38 + .../honeylabs/top-attackers-ip-AS58854.json | 1 + .../honeylabs/top-attackers-ua-AS138915.json | 1 + .../honeylabs/top-attackers-ua-AS140666.json | 1 + .../honeylabs/top-attackers-ua-AS14956.json | 55 + .../honeylabs/top-attackers-ua-AS198953.json | 54 + .../honeylabs/top-attackers-ua-AS200593.json | 1 + .../honeylabs/top-attackers-ua-AS200651.json | 67 + .../honeylabs/top-attackers-ua-AS202685.json | 1 + .../honeylabs/top-attackers-ua-AS206728.json | 1 + .../honeylabs/top-attackers-ua-AS209847.json | 1 + .../honeylabs/top-attackers-ua-AS210644.json | 16 + .../honeylabs/top-attackers-ua-AS211720.json | 1 + .../honeylabs/top-attackers-ua-AS213702.json | 1 + .../honeylabs/top-attackers-ua-AS214351.json | 1 + .../honeylabs/top-attackers-ua-AS214940.json | 1 + .../honeylabs/top-attackers-ua-AS216139.json | 1 + .../honeylabs/top-attackers-ua-AS216246.json | 15 + .../honeylabs/top-attackers-ua-AS216309.json | 1 + .../honeylabs/top-attackers-ua-AS30823.json | 1 + .../honeylabs/top-attackers-ua-AS33993.json | 1 + .../honeylabs/top-attackers-ua-AS394711.json | 1 + .../honeylabs/top-attackers-ua-AS400992.json | 1 + .../honeylabs/top-attackers-ua-AS51396.json | 254 + .../honeylabs/top-attackers-ua-AS51852.json | 57 + .../honeylabs/top-attackers-ua-AS57043.json | 1 + .../honeylabs/top-attackers-ua-AS58854.json | 1 + kevlar/2026-09-07/honeylabs/top-attackers.csv | 48 + kevlar/2026-09-07/honeylabs/top-ips-all.json | 941 ++++ kevlar/2026-09-07/honeylabs/user-agents-all.json | 580 ++ kevlar/2026-09-07/iocs/README.md | 12 + kevlar/2026-09-07/iocs/all-observed-ips.txt | 152 + kevlar/2026-09-07/iocs/c2-paths.txt | 41 + kevlar/2026-09-07/iocs/fingerprints.txt | 34 + kevlar/2026-09-07/sponge/bp-ip-sessions.csv | 13 + kevlar/2026-09-07/sponge/data-range-1d.ndjson | 180 + .../sponge/port-targeting-AS138915.ndjson | 20 + .../sponge/port-targeting-AS140666.ndjson | 0 .../sponge/port-targeting-AS14956.ndjson | 20 + .../sponge/port-targeting-AS198953.ndjson | 20 + .../sponge/port-targeting-AS200593.ndjson | 1 + .../sponge/port-targeting-AS200651.ndjson | 4 + .../sponge/port-targeting-AS202685.ndjson | 0 .../sponge/port-targeting-AS206728.ndjson | 0 .../sponge/port-targeting-AS209847.ndjson | 1 + .../sponge/port-targeting-AS210644.ndjson | 20 + .../sponge/port-targeting-AS211720.ndjson | 14 + .../sponge/port-targeting-AS213702.ndjson | 0 .../sponge/port-targeting-AS214351.ndjson | 0 .../sponge/port-targeting-AS214940.ndjson | 3 + .../sponge/port-targeting-AS216139.ndjson | 0 .../sponge/port-targeting-AS216246.ndjson | 0 .../sponge/port-targeting-AS216309.ndjson | 1 + .../sponge/port-targeting-AS30823.ndjson | 1 + .../sponge/port-targeting-AS33993.ndjson | 0 .../sponge/port-targeting-AS394711.ndjson | 0 .../sponge/port-targeting-AS400992.ndjson | 14 + .../sponge/port-targeting-AS51396.ndjson | 20 + .../sponge/port-targeting-AS51852.ndjson | 20 + .../sponge/port-targeting-AS57043.ndjson | 6 + .../sponge/port-targeting-AS58854.ndjson | 0 .../sponge/session-stats-by-ip-AS138915.ndjson | 20 + .../sponge/session-stats-by-ip-AS140666.ndjson | 0 .../sponge/session-stats-by-ip-AS14956.ndjson | 20 + .../sponge/session-stats-by-ip-AS198953.ndjson | 4 + .../sponge/session-stats-by-ip-AS200593.ndjson | 1 + .../sponge/session-stats-by-ip-AS200651.ndjson | 2 + .../sponge/session-stats-by-ip-AS202685.ndjson | 0 .../sponge/session-stats-by-ip-AS206728.ndjson | 0 .../sponge/session-stats-by-ip-AS209847.ndjson | 1 + .../sponge/session-stats-by-ip-AS210644.ndjson | 5 + .../sponge/session-stats-by-ip-AS211720.ndjson | 1 + .../sponge/session-stats-by-ip-AS213702.ndjson | 0 .../sponge/session-stats-by-ip-AS214351.ndjson | 0 .../sponge/session-stats-by-ip-AS214940.ndjson | 3 + .../sponge/session-stats-by-ip-AS216139.ndjson | 0 .../sponge/session-stats-by-ip-AS216246.ndjson | 0 .../sponge/session-stats-by-ip-AS216309.ndjson | 20 + .../sponge/session-stats-by-ip-AS30823.ndjson | 1 + .../sponge/session-stats-by-ip-AS33993.ndjson | 0 .../sponge/session-stats-by-ip-AS394711.ndjson | 0 .../sponge/session-stats-by-ip-AS400992.ndjson | 4 + .../sponge/session-stats-by-ip-AS51396.ndjson | 20 + .../sponge/session-stats-by-ip-AS51852.ndjson | 8 + .../sponge/session-stats-by-ip-AS57043.ndjson | 5 + .../sponge/session-stats-by-ip-AS58854.ndjson | 0 kevlar/2026-09-07/sponge/timeline-all-asns.ndjson | 840 +++ 174 files changed, 14516 insertions(+) create mode 100644 kevlar/2026-09-07/OPERATIONS_LOG.md create mode 100644 kevlar/2026-09-07/censys/agg-summary.json create mode 100644 kevlar/2026-09-07/censys/aggregations-AS138915.ndjson create mode 100644 kevlar/2026-09-07/censys/aggregations-AS140666.ndjson create mode 100644 kevlar/2026-09-07/censys/aggregations-AS14956.ndjson create mode 100644 kevlar/2026-09-07/censys/aggregations-AS198953.ndjson create mode 100644 kevlar/2026-09-07/censys/aggregations-AS200593.ndjson create mode 100644 kevlar/2026-09-07/censys/aggregations-AS200651.ndjson create mode 100644 kevlar/2026-09-07/censys/aggregations-AS202685.ndjson create mode 100644 kevlar/2026-09-07/censys/aggregations-AS206728.ndjson create mode 100644 kevlar/2026-09-07/censys/aggregations-AS209847.ndjson create mode 100644 kevlar/2026-09-07/censys/aggregations-AS210644.ndjson create mode 100644 kevlar/2026-09-07/censys/aggregations-AS211720.ndjson create mode 100644 kevlar/2026-09-07/censys/aggregations-AS213702.ndjson create mode 100644 kevlar/2026-09-07/censys/aggregations-AS214351.ndjson create mode 100644 kevlar/2026-09-07/censys/aggregations-AS214940.ndjson create mode 100644 kevlar/2026-09-07/censys/aggregations-AS216139.ndjson create mode 100644 kevlar/2026-09-07/censys/aggregations-AS216246.ndjson create mode 100644 kevlar/2026-09-07/censys/aggregations-AS216309.ndjson create mode 100644 kevlar/2026-09-07/censys/aggregations-AS30823.ndjson create mode 100644 kevlar/2026-09-07/censys/aggregations-AS33993.ndjson create mode 100644 kevlar/2026-09-07/censys/aggregations-AS394711.ndjson create mode 100644 kevlar/2026-09-07/censys/aggregations-AS400992.ndjson create mode 100644 kevlar/2026-09-07/censys/aggregations-AS51396.ndjson create mode 100644 kevlar/2026-09-07/censys/aggregations-AS51852.ndjson create mode 100644 kevlar/2026-09-07/censys/aggregations-AS57043.ndjson create mode 100644 kevlar/2026-09-07/censys/aggregations-AS58854.ndjson create mode 100644 kevlar/2026-09-07/censys/enrichment-summary.json create mode 100644 kevlar/2026-09-07/censys/fleet-correlation.csv create mode 100644 kevlar/2026-09-07/censys/ip-enrichments.ndjson create mode 100644 kevlar/2026-09-07/changes/anomalies.csv create mode 100644 kevlar/2026-09-07/changes/censys-software-changes.csv create mode 100644 kevlar/2026-09-07/changes/diff-vs-prior-week.csv create mode 100644 kevlar/2026-09-07/changes/numbers-table.json create mode 100644 kevlar/2026-09-07/changes/prior-window-2026-08-24_31.json create mode 100644 kevlar/2026-09-07/honeylabs/asn-enrichments.json create mode 100644 kevlar/2026-09-07/honeylabs/events-AS138915.ndjson create mode 100644 kevlar/2026-09-07/honeylabs/events-AS140666.ndjson create mode 100644 kevlar/2026-09-07/honeylabs/events-AS14956.ndjson create mode 100644 kevlar/2026-09-07/honeylabs/events-AS198953.ndjson create mode 100644 kevlar/2026-09-07/honeylabs/events-AS200593.ndjson create mode 100644 kevlar/2026-09-07/honeylabs/events-AS200651.ndjson create mode 100644 kevlar/2026-09-07/honeylabs/events-AS202685.ndjson create mode 100644 kevlar/2026-09-07/honeylabs/events-AS206728.ndjson create mode 100644 kevlar/2026-09-07/honeylabs/events-AS209847.ndjson create mode 100644 kevlar/2026-09-07/honeylabs/events-AS210644.ndjson create mode 100644 kevlar/2026-09-07/honeylabs/events-AS211720.ndjson create mode 100644 kevlar/2026-09-07/honeylabs/events-AS213702.ndjson create mode 100644 kevlar/2026-09-07/honeylabs/events-AS214351.ndjson create mode 100644 kevlar/2026-09-07/honeylabs/events-AS214940.ndjson create mode 100644 kevlar/2026-09-07/honeylabs/events-AS216139.ndjson create mode 100644 kevlar/2026-09-07/honeylabs/events-AS216246.ndjson create mode 100644 kevlar/2026-09-07/honeylabs/events-AS216309.ndjson create mode 100644 kevlar/2026-09-07/honeylabs/events-AS30823.ndjson create mode 100644 kevlar/2026-09-07/honeylabs/events-AS33993.ndjson create mode 100644 kevlar/2026-09-07/honeylabs/events-AS394711.ndjson create mode 100644 kevlar/2026-09-07/honeylabs/events-AS400992.ndjson create mode 100644 kevlar/2026-09-07/honeylabs/events-AS51396.ndjson create mode 100644 kevlar/2026-09-07/honeylabs/events-AS51852.ndjson create mode 100644 kevlar/2026-09-07/honeylabs/events-AS57043.ndjson create mode 100644 kevlar/2026-09-07/honeylabs/events-AS58854.ndjson create mode 100644 kevlar/2026-09-07/honeylabs/fingerprints.csv create mode 100644 kevlar/2026-09-07/honeylabs/ioc-lookups.json create mode 100644 kevlar/2026-09-07/honeylabs/loop-summary.json create mode 100644 kevlar/2026-09-07/honeylabs/top-attackers-ip-AS138915.json create mode 100644 kevlar/2026-09-07/honeylabs/top-attackers-ip-AS140666.json create mode 100644 kevlar/2026-09-07/honeylabs/top-attackers-ip-AS14956.json create mode 100644 kevlar/2026-09-07/honeylabs/top-attackers-ip-AS198953.json create mode 100644 kevlar/2026-09-07/honeylabs/top-attackers-ip-AS200593.json create mode 100644 kevlar/2026-09-07/honeylabs/top-attackers-ip-AS200651.json create mode 100644 kevlar/2026-09-07/honeylabs/top-attackers-ip-AS202685.json create mode 100644 kevlar/2026-09-07/honeylabs/top-attackers-ip-AS206728.json create mode 100644 kevlar/2026-09-07/honeylabs/top-attackers-ip-AS209847.json create mode 100644 kevlar/2026-09-07/honeylabs/top-attackers-ip-AS210644.json create mode 100644 kevlar/2026-09-07/honeylabs/top-attackers-ip-AS211720.json create mode 100644 kevlar/2026-09-07/honeylabs/top-attackers-ip-AS213702.json create mode 100644 kevlar/2026-09-07/honeylabs/top-attackers-ip-AS214351.json create mode 100644 kevlar/2026-09-07/honeylabs/top-attackers-ip-AS214940.json create mode 100644 kevlar/2026-09-07/honeylabs/top-attackers-ip-AS216139.json create mode 100644 kevlar/2026-09-07/honeylabs/top-attackers-ip-AS216246.json create mode 100644 kevlar/2026-09-07/honeylabs/top-attackers-ip-AS216309.json create mode 100644 kevlar/2026-09-07/honeylabs/top-attackers-ip-AS30823.json create mode 100644 kevlar/2026-09-07/honeylabs/top-attackers-ip-AS33993.json create mode 100644 kevlar/2026-09-07/honeylabs/top-attackers-ip-AS394711.json create mode 100644 kevlar/2026-09-07/honeylabs/top-attackers-ip-AS400992.json create mode 100644 kevlar/2026-09-07/honeylabs/top-attackers-ip-AS51396.json create mode 100644 kevlar/2026-09-07/honeylabs/top-attackers-ip-AS51852.json create mode 100644 kevlar/2026-09-07/honeylabs/top-attackers-ip-AS57043.json create mode 100644 kevlar/2026-09-07/honeylabs/top-attackers-ip-AS58854.json create mode 100644 kevlar/2026-09-07/honeylabs/top-attackers-ua-AS138915.json create mode 100644 kevlar/2026-09-07/honeylabs/top-attackers-ua-AS140666.json create mode 100644 kevlar/2026-09-07/honeylabs/top-attackers-ua-AS14956.json create mode 100644 kevlar/2026-09-07/honeylabs/top-attackers-ua-AS198953.json create mode 100644 kevlar/2026-09-07/honeylabs/top-attackers-ua-AS200593.json create mode 100644 kevlar/2026-09-07/honeylabs/top-attackers-ua-AS200651.json create mode 100644 kevlar/2026-09-07/honeylabs/top-attackers-ua-AS202685.json create mode 100644 kevlar/2026-09-07/honeylabs/top-attackers-ua-AS206728.json create mode 100644 kevlar/2026-09-07/honeylabs/top-attackers-ua-AS209847.json create mode 100644 kevlar/2026-09-07/honeylabs/top-attackers-ua-AS210644.json create mode 100644 kevlar/2026-09-07/honeylabs/top-attackers-ua-AS211720.json create mode 100644 kevlar/2026-09-07/honeylabs/top-attackers-ua-AS213702.json create mode 100644 kevlar/2026-09-07/honeylabs/top-attackers-ua-AS214351.json create mode 100644 kevlar/2026-09-07/honeylabs/top-attackers-ua-AS214940.json create mode 100644 kevlar/2026-09-07/honeylabs/top-attackers-ua-AS216139.json create mode 100644 kevlar/2026-09-07/honeylabs/top-attackers-ua-AS216246.json create mode 100644 kevlar/2026-09-07/honeylabs/top-attackers-ua-AS216309.json create mode 100644 kevlar/2026-09-07/honeylabs/top-attackers-ua-AS30823.json create mode 100644 kevlar/2026-09-07/honeylabs/top-attackers-ua-AS33993.json create mode 100644 kevlar/2026-09-07/honeylabs/top-attackers-ua-AS394711.json create mode 100644 kevlar/2026-09-07/honeylabs/top-attackers-ua-AS400992.json create mode 100644 kevlar/2026-09-07/honeylabs/top-attackers-ua-AS51396.json create mode 100644 kevlar/2026-09-07/honeylabs/top-attackers-ua-AS51852.json create mode 100644 kevlar/2026-09-07/honeylabs/top-attackers-ua-AS57043.json create mode 100644 kevlar/2026-09-07/honeylabs/top-attackers-ua-AS58854.json create mode 100644 kevlar/2026-09-07/honeylabs/top-attackers.csv create mode 100644 kevlar/2026-09-07/honeylabs/top-ips-all.json create mode 100644 kevlar/2026-09-07/honeylabs/user-agents-all.json create mode 100644 kevlar/2026-09-07/iocs/README.md create mode 100644 kevlar/2026-09-07/iocs/all-observed-ips.txt create mode 100644 kevlar/2026-09-07/iocs/c2-paths.txt create mode 100644 kevlar/2026-09-07/iocs/fingerprints.txt create mode 100644 kevlar/2026-09-07/sponge/bp-ip-sessions.csv create mode 100644 kevlar/2026-09-07/sponge/data-range-1d.ndjson create mode 100644 kevlar/2026-09-07/sponge/port-targeting-AS138915.ndjson create mode 100644 kevlar/2026-09-07/sponge/port-targeting-AS140666.ndjson create mode 100644 kevlar/2026-09-07/sponge/port-targeting-AS14956.ndjson create mode 100644 kevlar/2026-09-07/sponge/port-targeting-AS198953.ndjson create mode 100644 kevlar/2026-09-07/sponge/port-targeting-AS200593.ndjson create mode 100644 kevlar/2026-09-07/sponge/port-targeting-AS200651.ndjson create mode 100644 kevlar/2026-09-07/sponge/port-targeting-AS202685.ndjson create mode 100644 kevlar/2026-09-07/sponge/port-targeting-AS206728.ndjson create mode 100644 kevlar/2026-09-07/sponge/port-targeting-AS209847.ndjson create mode 100644 kevlar/2026-09-07/sponge/port-targeting-AS210644.ndjson create mode 100644 kevlar/2026-09-07/sponge/port-targeting-AS211720.ndjson create mode 100644 kevlar/2026-09-07/sponge/port-targeting-AS213702.ndjson create mode 100644 kevlar/2026-09-07/sponge/port-targeting-AS214351.ndjson create mode 100644 kevlar/2026-09-07/sponge/port-targeting-AS214940.ndjson create mode 100644 kevlar/2026-09-07/sponge/port-targeting-AS216139.ndjson create mode 100644 kevlar/2026-09-07/sponge/port-targeting-AS216246.ndjson create mode 100644 kevlar/2026-09-07/sponge/port-targeting-AS216309.ndjson create mode 100644 kevlar/2026-09-07/sponge/port-targeting-AS30823.ndjson create mode 100644 kevlar/2026-09-07/sponge/port-targeting-AS33993.ndjson create mode 100644 kevlar/2026-09-07/sponge/port-targeting-AS394711.ndjson create mode 100644 kevlar/2026-09-07/sponge/port-targeting-AS400992.ndjson create mode 100644 kevlar/2026-09-07/sponge/port-targeting-AS51396.ndjson create mode 100644 kevlar/2026-09-07/sponge/port-targeting-AS51852.ndjson create mode 100644 kevlar/2026-09-07/sponge/port-targeting-AS57043.ndjson create mode 100644 kevlar/2026-09-07/sponge/port-targeting-AS58854.ndjson create mode 100644 kevlar/2026-09-07/sponge/session-stats-by-ip-AS138915.ndjson create mode 100644 kevlar/2026-09-07/sponge/session-stats-by-ip-AS140666.ndjson create mode 100644 kevlar/2026-09-07/sponge/session-stats-by-ip-AS14956.ndjson create mode 100644 kevlar/2026-09-07/sponge/session-stats-by-ip-AS198953.ndjson create mode 100644 kevlar/2026-09-07/sponge/session-stats-by-ip-AS200593.ndjson create mode 100644 kevlar/2026-09-07/sponge/session-stats-by-ip-AS200651.ndjson create mode 100644 kevlar/2026-09-07/sponge/session-stats-by-ip-AS202685.ndjson create mode 100644 kevlar/2026-09-07/sponge/session-stats-by-ip-AS206728.ndjson create mode 100644 kevlar/2026-09-07/sponge/session-stats-by-ip-AS209847.ndjson create mode 100644 kevlar/2026-09-07/sponge/session-stats-by-ip-AS210644.ndjson create mode 100644 kevlar/2026-09-07/sponge/session-stats-by-ip-AS211720.ndjson create mode 100644 kevlar/2026-09-07/sponge/session-stats-by-ip-AS213702.ndjson create mode 100644 kevlar/2026-09-07/sponge/session-stats-by-ip-AS214351.ndjson create mode 100644 kevlar/2026-09-07/sponge/session-stats-by-ip-AS214940.ndjson create mode 100644 kevlar/2026-09-07/sponge/session-stats-by-ip-AS216139.ndjson create mode 100644 kevlar/2026-09-07/sponge/session-stats-by-ip-AS216246.ndjson create mode 100644 kevlar/2026-09-07/sponge/session-stats-by-ip-AS216309.ndjson create mode 100644 kevlar/2026-09-07/sponge/session-stats-by-ip-AS30823.ndjson create mode 100644 kevlar/2026-09-07/sponge/session-stats-by-ip-AS33993.ndjson create mode 100644 kevlar/2026-09-07/sponge/session-stats-by-ip-AS394711.ndjson create mode 100644 kevlar/2026-09-07/sponge/session-stats-by-ip-AS400992.ndjson create mode 100644 kevlar/2026-09-07/sponge/session-stats-by-ip-AS51396.ndjson create mode 100644 kevlar/2026-09-07/sponge/session-stats-by-ip-AS51852.ndjson create mode 100644 kevlar/2026-09-07/sponge/session-stats-by-ip-AS57043.ndjson create mode 100644 kevlar/2026-09-07/sponge/session-stats-by-ip-AS58854.ndjson create mode 100644 kevlar/2026-09-07/sponge/timeline-all-asns.ndjson (limited to 'kevlar/2026-09-07') diff --git a/kevlar/2026-09-07/OPERATIONS_LOG.md b/kevlar/2026-09-07/OPERATIONS_LOG.md new file mode 100644 index 0000000..94680dc --- /dev/null +++ b/kevlar/2026-09-07/OPERATIONS_LOG.md @@ -0,0 +1,57 @@ +# Weekly BP Report Operations Log — 2026-09-07 + +## 2026-09-07 09:39 UTC — Phase 0: Initialize +- ASNs loaded: 25 (bulletproof-asns.csv) +- Run dir created: ~/Documents/gists/kevlar/2026-09-07/{sponge,honeylabs,censys,changes,iocs} +- Censys credits: 10,000 (resets 2026-09-13) — above 500, per-IP enrichment enabled +- Prior baseline: 2026-08-31 + +## 2026-09-07 09:40 UTC — Phase 1: Sponge (Arkime) +- Connectivity: OK. Data range 2026-03-12 → 2026-09-07 (180 days), 10k+ sessions/day +- 1b: 50 session_stats calls (25 ASNs × source.ip + destination.port), window 2026-08-31→2026-09-07 +- 1c: multi-ASN 1h timeline, 840 rows (top-5 ASNs by split, default split_size) +- Active ASNs (sessions): KAOPU-HK 138915 (10k+ cap), PFCLOUD 51396 (10k+ cap), PROTON66 198953 (1469), ROUTERHOSTING 14956 (277), ZHOUYISAT 400992 (226), HOSTKEY 57043 (196), AEZA 210644 (97), PLI 51852 (97), FLOKINET 200651 (76), INVISIONTECH 216309 (60), KPRONET 214940 (59), Datashield 211720 (20), THE 209847 (3), AUROLOGIC 30823 (2), PROSPERO 200593 (1) +- Zero-session ASNs: IRONHOST, UFO, QWINS, RU-AEZA, ADPL, FEMOIT, MEDIALAND, KAOPY, TR-ARKEL, KORGRID +- Cached: 50 stats files + timeline-all-asns.ndjson + data-range-1d.ndjson +- API calls: 53; Errors: none + +## 2026-09-07 09:5x UTC — Phase 2: Honeylabs +- Window: 2026-08-31 → 2026-09-07. 750ms pacing, sequential per ASN. +- top_attackers(by=ip/user_agent) × 25 ASNs = 50 calls; search_events × 25 (6 needed artifact re-reads for large payloads); ioc_lookup × 18 top IPs (days=7); asn_enrich × 6 +- Notable: PFCLOUD 8,500 events/49 IPs; PROTON66 1,669/4; ROUTERHOSTING 95/12; AEZA 51/1 (exploit attempts, 185.246.217.150); PLI 32/5 (exploit attempts, 179.43.150.26); HOSTKEY 12/2 +- Zero-activity ASNs in Honeylabs: THE, KAOPU-HK, IRONHOST, ZHOUYISAT, UFO, QWINS, AUROLOGIC, ADPL, FEMOIT, PROSPERO, KPRONET, MEDIALAND, Datashield, INVISIONTECH, KAOPY, TR-ARKEL, KORGRID; RU-AEZA 2 events +- Cached: events-AS*.ndjson, top-attackers-*.json, ioc-lookups.json, asn-enrichments.json, top-attackers.csv (47 rows), fingerprints.csv (36 IPs) +- Errors: 6 search_events inline-parse failures recovered via artifact:// re-read; no rate-limit hits + +## 2026-09-07 10:0x UTC — Phase 3: Censys +- Credits at start: 10,000 +- 3b: 125 aggregate calls (25 ASNs × 5 fields), 400ms pacing, zero errors +- 3c: 20 calls (get_host + get_host_services × top 10 Honeylabs IPs) +- 3d: fleet correlation — PFCLOUD cloned /29 (204.76.203.213/221/222, OpenSSH 8.9p1 Ubuntu-3ubuntu0.17); ROUTERHOSTING Windows RDP fleet; PROTON66 RDP node 176.120.22.61; FLOKINET Tor exit 185.100.87.136 (SSH 7288); 9/10 enriched IPs carry Censys BULLETPROOF label +- Cached: aggregations-AS*.ndjson × 25, ip-enrichments.ndjson, enrichment-summary.json, fleet-correlation.csv + +## 2026-09-07 10:0x UTC — Phase 4: Change detection +- Baseline 2026-08-31. Discovery: prior run's Sponge stats cached UNBOUNDED windows (spot check: HOSTKEY prior-week windowed=6 vs cached 1990) — raw deltas were artifacts. +- Re-queried prior week (2026-08-24→31) for all 25 ASNs × 2 fields (50 calls) for matched-window diff; cached changes/prior-window-2026-08-24_31.json +- Matched-window findings: PFCLOUD 2.5x spike (34,932→87,938); HOSTKEY 6→196; AEZA collapse 80,345→97; INVISIONTECH new (0→26); ROUTERHOSTING -85%; PLI -87%; THE -93% +- Censys prior-file format (nested result.result, no top-level total) initially parsed empty; re-parsed correctly. ADPL +3,757 visible hosts; KAOPU -1,246 +- Notable new cert issuers: Hydra Authentication RSA SubCA (PLI = HydraPanel), AnyDesk Client (ROUTERHOSTING, PROSPERO), USDTCDN (ADPL), Cloudbase-Init WinRM (PFCLOUD) +- Cached: diff-vs-prior-week.csv (25 rows), anomalies.csv (47 rows), censys-software-changes.csv + +## 2026-09-07 10:1x UTC — Phase 1d: BP IP session searches +- 12 top IPs searched in Sponge (window 08-31→09-07, size=5) +- Corroborated in Sponge: PROTON66 .61, PFCLOUD .4/.222, FLOKINET .136, PLI .26, ZHOUYISAT .87, KAOPU .209, KPRONET .94, THE .2 +- Not in Sponge: AEZA 185.246.217.150, ROUTERHOSTING 45.61.157.82 / 144.172.108.79 (Honeylabs-only) +- Cached: sponge/bp-ip-sessions.csv + +## 2026-09-07 10:2x UTC — Phase 5: Blog post +- Draft written under technical-prose skill; banned-phrase scan clean (domain terms only); style-editing (Williams) pass applied: 4 over-length sentences split, 2 -ing verbs removed, unverified claim dropped +- Fact corrections after verification pass: 37 eval-stdin paths (was 9), 3 /eventmanager hits (was 4), JA4H ge11nn0400 attribution ROUTERHOSTING/PLI/PFCLOUD (was AEZA) +- Build: npm run build PASS, 0 errors 0 warnings, post at /posts/2026-09-07-weekly-bulletproof-report/ + +## 2026-09-07 10:2x UTC — Phase 6: IoC archival +- all-observed-ips.txt: 135 unique IPs grouped by ASN (sponge + honeylabs merged) +- fingerprints.txt: 9 JA4, 17 JA4H, 2 HASSH with IP attribution +- c2-paths.txt: top 40 of 75 observed paths +- README.md: run summary +- Run complete diff --git a/kevlar/2026-09-07/censys/agg-summary.json b/kevlar/2026-09-07/censys/agg-summary.json new file mode 100644 index 0000000..508af7f --- /dev/null +++ b/kevlar/2026-09-07/censys/agg-summary.json @@ -0,0 +1,5692 @@ +[ + { + "asn": "AS57043", + "name": "HOSTKEY-AS", + "fields": { + "port": { + "total": 101919, + "buckets": [ + { + "count": 77184, + "key": "22" + }, + { + "count": 50237, + "key": "443" + }, + { + "count": 33035, + "key": "80" + }, + { + "count": 14781, + "key": "2096" + }, + { + "count": 8370, + "key": "8443" + }, + { + "count": 4740, + "key": "111" + }, + { + "count": 2942, + "key": "8080" + }, + { + "count": 2599, + "key": "2222" + }, + { + "count": 2592, + "key": "2053" + }, + { + "count": 2487, + "key": "53" + }, + { + "count": 2409, + "key": "9100" + }, + { + "count": 1869, + "key": "2212" + }, + { + "count": 1864, + "key": "6767" + }, + { + "count": 1840, + "key": "21" + }, + { + "count": 1838, + "key": "1881" + } + ] + }, + "software": { + "total": 101918, + "buckets": [ + { + "count": 76988, + "key": "openssh" + }, + { + "count": 61500, + "key": "nginx" + }, + { + "count": 8740, + "key": "google_web_services" + }, + { + "count": 8740, + "key": "web_server" + }, + { + "count": 6293, + "key": "ghost" + }, + { + "count": 6289, + "key": "app_and_api_protector" + }, + { + "count": 5413, + "key": "express" + }, + { + "count": 4095, + "key": "caddy" + }, + { + "count": 3938, + "key": "dovecot" + }, + { + "count": 3609, + "key": "waf" + }, + { + "count": 3453, + "key": "cloudflare_load_balancer" + }, + { + "count": 3042, + "key": "http_server" + }, + { + "count": 3024, + "key": "next.js" + }, + { + "count": 2218, + "key": "uvicorn" + }, + { + "count": 2008, + "key": "bootstrap" + } + ] + }, + "labels": { + "total": 101918, + "buckets": [ + { + "count": 101918, + "key": "BULLETPROOF" + }, + { + "count": 7, + "key": "IPV6" + } + ] + }, + "cert_issuer": { + "total": 101918, + "buckets": [ + { + "count": 15470, + "key": "YE2" + }, + { + "count": 13541, + "key": "YE1" + }, + { + "count": 8815, + "key": "invalid2.invalid" + }, + { + "count": 7505, + "key": "YR1" + }, + { + "count": 3903, + "key": "YR2" + }, + { + "count": 2294, + "key": "GeoTrust TLS RSA CA G1" + }, + { + "count": 2053, + "key": "TRAEFIK DEFAULT CERT" + }, + { + "count": 1922, + "key": "hypervisor.hv" + }, + { + "count": 1821, + "key": "DigiCert Global G2 TLS RSA SHA256 2020 CA1" + }, + { + "count": 1535, + "key": "Microsoft TLS G2 RSA CA OCSP 04" + }, + { + "count": 1269, + "key": "Apple Public EV Server RSA CA 1 - G1" + }, + { + "count": 1221, + "key": "GlobalSign ECC OV SSL CA 2018" + }, + { + "count": 1163, + "key": "GlobalSign RSA OV SSL CA 2018" + }, + { + "count": 1007, + "key": "HARICA DV TLS RSA" + }, + { + "count": 996, + "key": "Sectigo Public Server Authentication CA DV E36" + } + ] + }, + "os": { + "total": 101918, + "buckets": [ + { + "count": 72787, + "key": "linux" + }, + { + "count": 834, + "key": "ubuntu" + }, + { + "count": 572, + "key": "windows" + }, + { + "count": 299, + "key": "routeros" + }, + { + "count": 271, + "key": "debian_linux" + }, + { + "count": 175, + "key": "proxmox" + }, + { + "count": 133, + "key": "linux_kernel" + }, + { + "count": 112, + "key": "adaptive_security_appliance_software" + }, + { + "count": 54, + "key": "freebsd" + }, + { + "count": 43, + "key": "centos" + }, + { + "count": 40, + "key": "ios" + }, + { + "count": 38, + "key": "vmware_esxi_server" + }, + { + "count": 21, + "key": "enterprise_linux" + }, + { + "count": 10, + "key": "windows_server" + }, + { + "count": 8, + "key": "linux_ami" + } + ] + } + }, + "errors": [] + }, + { + "asn": "AS209847", + "name": "THE", + "fields": { + "port": { + "total": 1458, + "buckets": [ + { + "count": 884, + "key": "22" + }, + { + "count": 423, + "key": "443" + }, + { + "count": 413, + "key": "8080" + }, + { + "count": 404, + "key": "53" + }, + { + "count": 370, + "key": "1030" + }, + { + "count": 370, + "key": "1050" + }, + { + "count": 370, + "key": "24442" + }, + { + "count": 368, + "key": "1234" + }, + { + "count": 368, + "key": "1235" + }, + { + "count": 337, + "key": "80" + }, + { + "count": 207, + "key": "1500" + }, + { + "count": 200, + "key": "21" + }, + { + "count": 182, + "key": "1501" + }, + { + "count": 109, + "key": "2096" + }, + { + "count": 92, + "key": "25" + } + ] + }, + "software": { + "total": 1458, + "buckets": [ + { + "count": 1126, + "key": "python" + }, + { + "count": 1116, + "key": "openssh" + }, + { + "count": 1112, + "key": "aiohttp" + }, + { + "count": 670, + "key": "nginx" + }, + { + "count": 357, + "key": "bind" + }, + { + "count": 291, + "key": "dovecot" + }, + { + "count": 204, + "key": "exim" + }, + { + "count": 195, + "key": "proftpd" + }, + { + "count": 133, + "key": "google_web_services" + }, + { + "count": 133, + "key": "web_server" + }, + { + "count": 45, + "key": "app_and_api_protector" + }, + { + "count": 45, + "key": "express" + }, + { + "count": 45, + "key": "ghost" + }, + { + "count": 42, + "key": "bootstrap" + }, + { + "count": 38, + "key": "http_server" + } + ] + }, + "labels": { + "total": 1458, + "buckets": [ + { + "count": 1458, + "key": "BULLETPROOF" + }, + { + "count": 5, + "key": "IPV6" + } + ] + }, + "cert_issuer": { + "total": 1458, + "buckets": [ + { + "count": 217, + "key": "YR2" + }, + { + "count": 184, + "key": "YR1" + }, + { + "count": 133, + "key": "invalid2.invalid" + }, + { + "count": 127, + "key": "YE2" + }, + { + "count": 116, + "key": "YE1" + }, + { + "count": 34, + "key": "server" + }, + { + "count": 24, + "key": "GlobalSign RSA OV SSL CA 2018" + }, + { + "count": 20, + "key": "GeoTrust TLS RSA CA G1" + }, + { + "count": 15, + "key": "Sectigo Public Server Authentication CA DV E36" + }, + { + "count": 14, + "key": "GlobalSign Atlas R46 DV TLS CA 2026 Q3" + }, + { + "count": 14, + "key": "Microsoft TLS G2 RSA CA OCSP 04" + }, + { + "count": 13, + "key": "vm15882839.example.com" + }, + { + "count": 11, + "key": "DigiCert Global G2 TLS RSA SHA256 2020 CA1" + }, + { + "count": 10, + "key": "R13" + }, + { + "count": 9, + "key": "dmitrievd1.example.com" + } + ] + }, + "os": { + "total": 1458, + "buckets": [ + { + "count": 1098, + "key": "linux" + }, + { + "count": 14, + "key": "windows" + }, + { + "count": 7, + "key": "ubuntu" + }, + { + "count": 5, + "key": "routeros" + }, + { + "count": 2, + "key": "linux_kernel" + }, + { + "count": 1, + "key": "adaptive_security_appliance_software" + }, + { + "count": 1, + "key": "debian_linux" + } + ] + } + }, + "errors": [] + }, + { + "asn": "AS210644", + "name": "AEZA-AS", + "fields": { + "port": { + "total": 71701, + "buckets": [ + { + "count": 62026, + "key": "22" + }, + { + "count": 35342, + "key": "443" + }, + { + "count": 18338, + "key": "80" + }, + { + "count": 12259, + "key": "2096" + }, + { + "count": 8310, + "key": "8443" + }, + { + "count": 6116, + "key": "8080" + }, + { + "count": 3493, + "key": "2053" + }, + { + "count": 2001, + "key": "2222" + }, + { + "count": 1715, + "key": "3389" + }, + { + "count": 1172, + "key": "53" + }, + { + "count": 1165, + "key": "51821" + }, + { + "count": 1085, + "key": "25" + }, + { + "count": 1068, + "key": "3000" + }, + { + "count": 1062, + "key": "8000" + }, + { + "count": 862, + "key": "9443" + } + ] + }, + "software": { + "total": 71701, + "buckets": [ + { + "count": 61391, + "key": "openssh" + }, + { + "count": 30077, + "key": "nginx" + }, + { + "count": 7276, + "key": "google_web_services" + }, + { + "count": 7275, + "key": "web_server" + }, + { + "count": 5365, + "key": "ghost" + }, + { + "count": 5360, + "key": "app_and_api_protector" + }, + { + "count": 4102, + "key": "express" + }, + { + "count": 3511, + "key": "caddy" + }, + { + "count": 3140, + "key": "waf" + }, + { + "count": 2924, + "key": "cloudflare_load_balancer" + }, + { + "count": 2008, + "key": "uvicorn" + }, + { + "count": 1919, + "key": "next.js" + }, + { + "count": 1629, + "key": "http_server" + }, + { + "count": 1582, + "key": "python" + }, + { + "count": 1578, + "key": "jquery" + } + ] + }, + "labels": { + "total": 71701, + "buckets": [ + { + "count": 71701, + "key": "BULLETPROOF" + }, + { + "count": 499, + "key": "IPV6" + } + ] + }, + "cert_issuer": { + "total": 71701, + "buckets": [ + { + "count": 14987, + "key": "YE2" + }, + { + "count": 12936, + "key": "YE1" + }, + { + "count": 7359, + "key": "invalid2.invalid" + }, + { + "count": 3525, + "key": "HARICA DV TLS RSA" + }, + { + "count": 3217, + "key": "YR1" + }, + { + "count": 2129, + "key": "GeoTrust TLS RSA CA G1" + }, + { + "count": 1981, + "key": "YR2" + }, + { + "count": 1750, + "key": "GlobalSign RSA OV SSL CA 2018" + }, + { + "count": 1301, + "key": "Microsoft TLS G2 RSA CA OCSP 04" + }, + { + "count": 1278, + "key": "GlobalSign ECC OV SSL CA 2018" + }, + { + "count": 1025, + "key": "Apple Public EV Server RSA CA 1 - G1" + }, + { + "count": 965, + "key": "DigiCert Global G2 TLS RSA SHA256 2020 CA1" + }, + { + "count": 916, + "key": "TRAEFIK DEFAULT CERT" + }, + { + "count": 774, + "key": "GlobalSign Atlas R46 DV TLS CA 2026 Q3" + }, + { + "count": 760, + "key": "Sectigo Public Server Authentication CA DV E36" + } + ] + }, + "os": { + "total": 71701, + "buckets": [ + { + "count": 59980, + "key": "linux" + }, + { + "count": 740, + "key": "ubuntu" + }, + { + "count": 561, + "key": "windows" + }, + { + "count": 201, + "key": "debian_linux" + }, + { + "count": 92, + "key": "routeros" + }, + { + "count": 90, + "key": "linux_kernel" + }, + { + "count": 33, + "key": "adaptive_security_appliance_software" + }, + { + "count": 16, + "key": "linux_ami" + }, + { + "count": 14, + "key": "centos" + }, + { + "count": 11, + "key": "windows_server" + }, + { + "count": 7, + "key": "freebsd" + }, + { + "count": 3, + "key": "dsm" + }, + { + "count": 2, + "key": "enterprise_linux" + }, + { + "count": 1, + "key": "ios" + }, + { + "count": 1, + "key": "macos" + } + ] + } + }, + "errors": [] + }, + { + "asn": "AS138915", + "name": "KAOPU-HK", + "fields": { + "port": { + "total": 12308, + "buckets": [ + { + "count": 6621, + "key": "22" + }, + { + "count": 2412, + "key": "32080" + }, + { + "count": 2381, + "key": "443" + }, + { + "count": 2357, + "key": "43080" + }, + { + "count": 2255, + "key": "80" + }, + { + "count": 2242, + "key": "40003" + }, + { + "count": 2236, + "key": "40801" + }, + { + "count": 2233, + "key": "40803" + }, + { + "count": 2228, + "key": "40804" + }, + { + "count": 2198, + "key": "40810" + }, + { + "count": 872, + "key": "123" + }, + { + "count": 559, + "key": "8080" + }, + { + "count": 502, + "key": "3389" + }, + { + "count": 477, + "key": "135" + }, + { + "count": 475, + "key": "3081" + } + ] + }, + "software": { + "total": 12308, + "buckets": [ + { + "count": 7058, + "key": "openssh" + }, + { + "count": 6333, + "key": "openresty" + }, + { + "count": 4660, + "key": "tengine" + }, + { + "count": 2975, + "key": "nginx" + }, + { + "count": 866, + "key": "http_api" + }, + { + "count": 452, + "key": "http_server" + }, + { + "count": 384, + "key": "express" + }, + { + "count": 344, + "key": "jquery" + }, + { + "count": 249, + "key": "bootstrap" + }, + { + "count": 246, + "key": "openvpn_access_server" + }, + { + "count": 208, + "key": "python" + }, + { + "count": 205, + "key": "squid" + }, + { + "count": 199, + "key": "node_exporter" + }, + { + "count": 188, + "key": "litespeed_web_server" + }, + { + "count": 185, + "key": "moment" + } + ] + }, + "labels": { + "total": 12308, + "buckets": [ + { + "count": 12308, + "key": "BULLETPROOF" + }, + { + "count": 100, + "key": "IPV6" + } + ] + }, + "cert_issuer": { + "total": 12308, + "buckets": [ + { + "count": 4572, + "key": "GlobalSign GCC R3 OV TLS CA 2024" + }, + { + "count": 2333, + "key": "localhost" + }, + { + "count": 2290, + "key": "prod-vpn.example.com" + }, + { + "count": 2266, + "key": "GlobalSign RSA OV SSL CA 2018" + }, + { + "count": 2123, + "key": "GlobalSign GCC R46 OV TLS CA 2025" + }, + { + "count": 1190, + "key": "Sectigo Public Server Authentication CA DV R36" + }, + { + "count": 427, + "key": "NONE" + }, + { + "count": 412, + "key": "WoTrus RSA DV SSL CA 2" + }, + { + "count": 313, + "key": "WIN-9QFKHJ39QE9" + }, + { + "count": 312, + "key": "YR1" + }, + { + "count": 277, + "key": "QY" + }, + { + "count": 232, + "key": "YR2" + }, + { + "count": 211, + "key": "YE1" + }, + { + "count": 209, + "key": "YE2" + }, + { + "count": 172, + "key": "tls.internal.ypc.org" + } + ] + }, + "os": { + "total": 12308, + "buckets": [ + { + "count": 5600, + "key": "linux" + }, + { + "count": 538, + "key": "windows" + }, + { + "count": 86, + "key": "routeros" + }, + { + "count": 30, + "key": "ubuntu" + }, + { + "count": 22, + "key": "centos" + }, + { + "count": 19, + "key": "debian_linux" + }, + { + "count": 11, + "key": "adaptive_security_appliance_software" + }, + { + "count": 10, + "key": "proxmox" + }, + { + "count": 4, + "key": "linux_kernel" + }, + { + "count": 1, + "key": "freebsd" + }, + { + "count": 1, + "key": "ios" + }, + { + "count": 1, + "key": "junos" + }, + { + "count": 1, + "key": "netscaler" + }, + { + "count": 1, + "key": "pulse_connect_secure" + }, + { + "count": 1, + "key": "usg6655e_firmware" + } + ] + } + }, + "errors": [] + }, + { + "asn": "AS14956", + "name": "ROUTERHOSTING", + "fields": { + "port": { + "total": 25632, + "buckets": [ + { + "count": 15454, + "key": "22" + }, + { + "count": 8555, + "key": "443" + }, + { + "count": 7568, + "key": "80" + }, + { + "count": 7553, + "key": "3389" + }, + { + "count": 1143, + "key": "5985" + }, + { + "count": 1122, + "key": "2096" + }, + { + "count": 951, + "key": "135" + }, + { + "count": 870, + "key": "8443" + }, + { + "count": 812, + "key": "445" + }, + { + "count": 782, + "key": "53" + }, + { + "count": 666, + "key": "25" + }, + { + "count": 615, + "key": "139" + }, + { + "count": 599, + "key": "8080" + }, + { + "count": 582, + "key": "21" + }, + { + "count": 545, + "key": "111" + } + ] + }, + "software": { + "total": 25632, + "buckets": [ + { + "count": 14517, + "key": "openssh" + }, + { + "count": 10237, + "key": "nginx" + }, + { + "count": 2654, + "key": "express" + }, + { + "count": 1598, + "key": "http_server" + }, + { + "count": 1224, + "key": "dovecot" + }, + { + "count": 1155, + "key": "http_api" + }, + { + "count": 997, + "key": "next.js" + }, + { + "count": 906, + "key": "google_web_services" + }, + { + "count": 895, + "key": "web_server" + }, + { + "count": 751, + "key": "caddy" + }, + { + "count": 690, + "key": "jquery" + }, + { + "count": 599, + "key": "internet_information_services" + }, + { + "count": 570, + "key": "php" + }, + { + "count": 566, + "key": "bootstrap" + }, + { + "count": 503, + "key": "python" + } + ] + }, + "labels": { + "total": 25632, + "buckets": [ + { + "count": 25632, + "key": "BULLETPROOF" + }, + { + "count": 206, + "key": "IPV6" + } + ] + }, + "cert_issuer": { + "total": 25632, + "buckets": [ + { + "count": 2338, + "key": "YE2" + }, + { + "count": 1976, + "key": "YE1" + }, + { + "count": 993, + "key": "windows-Dallas0" + }, + { + "count": 985, + "key": "YR1" + }, + { + "count": 933, + "key": "YR2" + }, + { + "count": 915, + "key": "invalid2.invalid" + }, + { + "count": 481, + "key": "windows-Utah-4g" + }, + { + "count": 389, + "key": "windows-Amsterd" + }, + { + "count": 379, + "key": "www.example.com" + }, + { + "count": 351, + "key": "windows-Utah-4H" + }, + { + "count": 341, + "key": "TRAEFIK DEFAULT CERT" + }, + { + "count": 320, + "key": "windows-Utah-2g" + }, + { + "count": 288, + "key": "AnyDesk Client" + }, + { + "count": 278, + "key": "Plesk" + }, + { + "count": 238, + "key": "windows-LasVega" + } + ] + }, + "os": { + "total": 25632, + "buckets": [ + { + "count": 13719, + "key": "linux" + }, + { + "count": 5476, + "key": "windows" + }, + { + "count": 210, + "key": "ubuntu" + }, + { + "count": 135, + "key": "debian_linux" + }, + { + "count": 97, + "key": "routeros" + }, + { + "count": 30, + "key": "freebsd" + }, + { + "count": 21, + "key": "windows_server" + }, + { + "count": 19, + "key": "linux_kernel" + }, + { + "count": 8, + "key": "adaptive_security_appliance_software" + }, + { + "count": 7, + "key": "centos" + }, + { + "count": 6, + "key": "enterprise_linux" + }, + { + "count": 6, + "key": "proxmox" + }, + { + "count": 3, + "key": "windows_server_2012_r2" + }, + { + "count": 2, + "key": "openbsd" + }, + { + "count": 1, + "key": "linux_ami" + } + ] + } + }, + "errors": [] + }, + { + "asn": "AS216139", + "name": "IRONHOST", + "fields": { + "port": { + "total": 8797, + "buckets": [ + { + "count": 5381, + "key": "22" + }, + { + "count": 3417, + "key": "443" + }, + { + "count": 2110, + "key": "80" + }, + { + "count": 928, + "key": "51821" + }, + { + "count": 787, + "key": "53" + }, + { + "count": 641, + "key": "21" + }, + { + "count": 606, + "key": "2096" + }, + { + "count": 463, + "key": "25" + }, + { + "count": 455, + "key": "993" + }, + { + "count": 444, + "key": "143" + }, + { + "count": 428, + "key": "3306" + }, + { + "count": 416, + "key": "110" + }, + { + "count": 399, + "key": "587" + }, + { + "count": 369, + "key": "8443" + }, + { + "count": 348, + "key": "1500" + } + ] + }, + "software": { + "total": 8797, + "buckets": [ + { + "count": 4419, + "key": "openssh" + }, + { + "count": 3457, + "key": "nginx" + }, + { + "count": 1467, + "key": "dovecot" + }, + { + "count": 932, + "key": "exim" + }, + { + "count": 901, + "key": "wg-easy" + }, + { + "count": 711, + "key": "express" + }, + { + "count": 656, + "key": "google_web_services" + }, + { + "count": 656, + "key": "web_server" + }, + { + "count": 553, + "key": "ddos-guard" + }, + { + "count": 429, + "key": "http_server" + }, + { + "count": 390, + "key": "bind" + }, + { + "count": 338, + "key": "app_and_api_protector" + }, + { + "count": 338, + "key": "ghost" + }, + { + "count": 292, + "key": "php" + }, + { + "count": 283, + "key": "mysql" + } + ] + }, + "labels": { + "total": 8797, + "buckets": [ + { + "count": 8797, + "key": "BULLETPROOF" + }, + { + "count": 4, + "key": "IPV6" + } + ] + }, + "cert_issuer": { + "total": 8797, + "buckets": [ + { + "count": 751, + "key": "YE2" + }, + { + "count": 710, + "key": "invalid2.invalid" + }, + { + "count": 618, + "key": "YE1" + }, + { + "count": 459, + "key": "GlobalSign GCC R6 AlphaSSL CA 2025" + }, + { + "count": 262, + "key": "idrac" + }, + { + "count": 231, + "key": "YR1" + }, + { + "count": 219, + "key": "YR2" + }, + { + "count": 216, + "key": "isp13.eurobyte.ru" + }, + { + "count": 193, + "key": "MySQL_Server_5.7.22-22_Auto_Generated_CA_Certificate" + }, + { + "count": 141, + "key": "DigiCert Global G2 TLS RSA SHA256 2020 CA1" + }, + { + "count": 140, + "key": "vps1.dev.mchost.ru" + }, + { + "count": 116, + "key": "vps1.dev.eurobyte.ru" + }, + { + "count": 113, + "key": "etc" + }, + { + "count": 98, + "key": "isp15.eurobyte.ru" + }, + { + "count": 94, + "key": "GeoTrust TLS RSA CA G1" + } + ] + }, + "os": { + "total": 8797, + "buckets": [ + { + "count": 3705, + "key": "linux" + }, + { + "count": 190, + "key": "ubuntu" + }, + { + "count": 67, + "key": "routeros" + }, + { + "count": 53, + "key": "enterprise_linux" + }, + { + "count": 39, + "key": "debian_linux" + }, + { + "count": 26, + "key": "centos" + }, + { + "count": 11, + "key": "adaptive_security_appliance_software" + }, + { + "count": 6, + "key": "freebsd" + }, + { + "count": 3, + "key": "linux_ami" + }, + { + "count": 2, + "key": "linux_kernel" + }, + { + "count": 2, + "key": "windows" + } + ] + } + }, + "errors": [] + }, + { + "asn": "AS51852", + "name": "PLI-AS", + "fields": { + "port": { + "total": 8634, + "buckets": [ + { + "count": 4334, + "key": "443" + }, + { + "count": 4041, + "key": "22" + }, + { + "count": 3586, + "key": "161" + }, + { + "count": 2811, + "key": "80" + }, + { + "count": 1892, + "key": "123" + }, + { + "count": 1547, + "key": "53" + }, + { + "count": 845, + "key": "500" + }, + { + "count": 794, + "key": "21" + }, + { + "count": 793, + "key": "143" + }, + { + "count": 786, + "key": "993" + }, + { + "count": 783, + "key": "110" + }, + { + "count": 771, + "key": "25" + }, + { + "count": 660, + "key": "1194" + }, + { + "count": 627, + "key": "587" + }, + { + "count": 587, + "key": "8082" + } + ] + }, + "software": { + "total": 8634, + "buckets": [ + { + "count": 4673, + "key": "nginx" + }, + { + "count": 4060, + "key": "openssh" + }, + { + "count": 2414, + "key": "dovecot" + }, + { + "count": 1224, + "key": "exim" + }, + { + "count": 837, + "key": "cpanel" + }, + { + "count": 815, + "key": "openvpn_access_server" + }, + { + "count": 760, + "key": "http_server" + }, + { + "count": 757, + "key": "bind" + }, + { + "count": 601, + "key": "ceph" + }, + { + "count": 517, + "key": "webmail" + }, + { + "count": 374, + "key": "php" + }, + { + "count": 359, + "key": "proftpd" + }, + { + "count": 336, + "key": "express" + }, + { + "count": 326, + "key": "virtual_environment" + }, + { + "count": 324, + "key": "pve" + } + ] + }, + "labels": { + "total": 8634, + "buckets": [ + { + "count": 8634, + "key": "BULLETPROOF" + }, + { + "count": 38, + "key": "IPV6" + } + ] + }, + "cert_issuer": { + "total": 8634, + "buckets": [ + { + "count": 1716, + "key": "server" + }, + { + "count": 1497, + "key": "YR2" + }, + { + "count": 894, + "key": "Hydra Authentication RSA SubCA #154" + }, + { + "count": 861, + "key": "YR1" + }, + { + "count": 773, + "key": "server.domain.com" + }, + { + "count": 523, + "key": "YE2" + }, + { + "count": 416, + "key": "YE1" + }, + { + "count": 342, + "key": "server.ibras.eu" + }, + { + "count": 278, + "key": "''" + }, + { + "count": 261, + "key": "invalid2.invalid" + }, + { + "count": 163, + "key": "Proxmox Virtual Environment" + }, + { + "count": 160, + "key": "Hydra Authentication RSA SubCA #156" + }, + { + "count": 142, + "key": "Plesk" + }, + { + "count": 110, + "key": "server.xtreme-results.net" + }, + { + "count": 99, + "key": "Hydra Authentication RSA SubCA #155" + } + ] + }, + "os": { + "total": 8634, + "buckets": [ + { + "count": 3027, + "key": "linux" + }, + { + "count": 201, + "key": "windows" + }, + { + "count": 156, + "key": "proxmox" + }, + { + "count": 129, + "key": "enterprise_linux" + }, + { + "count": 49, + "key": "ubuntu" + }, + { + "count": 41, + "key": "debian_linux" + }, + { + "count": 35, + "key": "freebsd" + }, + { + "count": 25, + "key": "centos" + }, + { + "count": 21, + "key": "routeros" + }, + { + "count": 17, + "key": "vmware_esxi_server" + }, + { + "count": 4, + "key": "idrac_linux" + }, + { + "count": 3, + "key": "adaptive_security_appliance_software" + }, + { + "count": 3, + "key": "linux_kernel" + }, + { + "count": 3, + "key": "windows_server" + }, + { + "count": 3, + "key": "windows_server_2012_r2" + } + ] + } + }, + "errors": [] + }, + { + "asn": "AS400992", + "name": "ZHOUYISAT-COMMUNICATIONS", + "fields": { + "port": { + "total": 7982, + "buckets": [ + { + "count": 6772, + "key": "22" + }, + { + "count": 3333, + "key": "443" + }, + { + "count": 1402, + "key": "80" + }, + { + "count": 1044, + "key": "2096" + }, + { + "count": 513, + "key": "8443" + }, + { + "count": 200, + "key": "2222" + }, + { + "count": 192, + "key": "8080" + }, + { + "count": 180, + "key": "2053" + }, + { + "count": 179, + "key": "3389" + }, + { + "count": 144, + "key": "25" + }, + { + "count": 115, + "key": "53" + }, + { + "count": 85, + "key": "8000" + }, + { + "count": 83, + "key": "500" + }, + { + "count": 82, + "key": "1080" + }, + { + "count": 79, + "key": "587" + } + ] + }, + "software": { + "total": 7982, + "buckets": [ + { + "count": 5827, + "key": "openssh" + }, + { + "count": 2076, + "key": "nginx" + }, + { + "count": 939, + "key": "google_web_services" + }, + { + "count": 937, + "key": "web_server" + }, + { + "count": 421, + "key": "app_and_api_protector" + }, + { + "count": 421, + "key": "ghost" + }, + { + "count": 281, + "key": "waf" + }, + { + "count": 274, + "key": "caddy" + }, + { + "count": 268, + "key": "cloudflare_load_balancer" + }, + { + "count": 219, + "key": "express" + }, + { + "count": 217, + "key": "traffic_server" + }, + { + "count": 157, + "key": "http_server" + }, + { + "count": 134, + "key": "bootstrap" + }, + { + "count": 134, + "key": "jquery" + }, + { + "count": 130, + "key": "dovecot" + } + ] + }, + "labels": { + "total": 7982, + "buckets": [ + { + "count": 7982, + "key": "BULLETPROOF" + }, + { + "count": 41, + "key": "IPV6" + } + ] + }, + "cert_issuer": { + "total": 7982, + "buckets": [ + { + "count": 1110, + "key": "YE2" + }, + { + "count": 944, + "key": "invalid2.invalid" + }, + { + "count": 925, + "key": "YE1" + }, + { + "count": 281, + "key": "YR1" + }, + { + "count": 260, + "key": "DigiCert Global G2 TLS RSA SHA256 2020 CA1" + }, + { + "count": 189, + "key": "YR2" + }, + { + "count": 127, + "key": "GeoTrust TLS RSA CA G1" + }, + { + "count": 103, + "key": "GlobalSign ECC OV SSL CA 2018" + }, + { + "count": 99, + "key": "GlobalSign Atlas R46 DV TLS CA 2026 Q3" + }, + { + "count": 98, + "key": "Sectigo Public Server Authentication CA DV E36" + }, + { + "count": 96, + "key": "Microsoft TLS G2 RSA CA OCSP 04" + }, + { + "count": 93, + "key": "Apple Public EV Server RSA CA 1 - G1" + }, + { + "count": 82, + "key": "GlobalSign RSA OV SSL CA 2018" + }, + { + "count": 81, + "key": "HARICA DV TLS RSA" + }, + { + "count": 68, + "key": "TRAEFIK DEFAULT CERT" + } + ] + }, + "os": { + "total": 7982, + "buckets": [ + { + "count": 5596, + "key": "linux" + }, + { + "count": 84, + "key": "ubuntu" + }, + { + "count": 47, + "key": "windows" + }, + { + "count": 27, + "key": "debian_linux" + }, + { + "count": 17, + "key": "routeros" + }, + { + "count": 9, + "key": "adaptive_security_appliance_software" + }, + { + "count": 5, + "key": "freebsd" + }, + { + "count": 5, + "key": "linux_kernel" + }, + { + "count": 4, + "key": "centos" + }, + { + "count": 1, + "key": "linux_ami" + }, + { + "count": 1, + "key": "windows_server_2012" + } + ] + } + }, + "errors": [] + }, + { + "asn": "AS33993", + "name": "UFO-AS", + "fields": { + "port": { + "total": 4692, + "buckets": [ + { + "count": 3082, + "key": "22" + }, + { + "count": 1914, + "key": "443" + }, + { + "count": 1900, + "key": "80" + }, + { + "count": 1295, + "key": "53" + }, + { + "count": 654, + "key": "21" + }, + { + "count": 592, + "key": "3000" + }, + { + "count": 506, + "key": "1500" + }, + { + "count": 497, + "key": "25" + }, + { + "count": 489, + "key": "65534" + }, + { + "count": 475, + "key": "993" + }, + { + "count": 466, + "key": "143" + }, + { + "count": 463, + "key": "587" + }, + { + "count": 457, + "key": "110" + }, + { + "count": 427, + "key": "1501" + }, + { + "count": 288, + "key": "2096" + } + ] + }, + "software": { + "total": 4692, + "buckets": [ + { + "count": 3541, + "key": "nginx" + }, + { + "count": 3202, + "key": "openssh" + }, + { + "count": 1488, + "key": "dovecot" + }, + { + "count": 1026, + "key": "bind" + }, + { + "count": 1015, + "key": "exim" + }, + { + "count": 514, + "key": "proftpd" + }, + { + "count": 363, + "key": "express" + }, + { + "count": 291, + "key": "python" + }, + { + "count": 227, + "key": "aiohttp" + }, + { + "count": 209, + "key": "caddy" + }, + { + "count": 180, + "key": "http_server" + }, + { + "count": 163, + "key": "bootstrap" + }, + { + "count": 143, + "key": "jquery" + }, + { + "count": 130, + "key": "next.js" + }, + { + "count": 116, + "key": "traefik_proxy" + } + ] + }, + "labels": { + "total": 4692, + "buckets": [ + { + "count": 4692, + "key": "BULLETPROOF" + }, + { + "count": 10, + "key": "IPV6" + } + ] + }, + "cert_issuer": { + "total": 4692, + "buckets": [ + { + "count": 598, + "key": "YR1" + }, + { + "count": 553, + "key": "YR2" + }, + { + "count": 552, + "key": "YE2" + }, + { + "count": 480, + "key": "YE1" + }, + { + "count": 309, + "key": "ssl.by" + }, + { + "count": 238, + "key": "Sectigo Public Server Authentication CA DV E36" + }, + { + "count": 191, + "key": "HARICA DV TLS RSA" + }, + { + "count": 155, + "key": "issssrt.ru" + }, + { + "count": 116, + "key": "TRAEFIK DEFAULT CERT" + }, + { + "count": 98, + "key": "invalid2.invalid" + }, + { + "count": 82, + "key": "GlobalSign RSA OV SSL CA 2018" + }, + { + "count": 81, + "key": "GlobalSign ECC OV SSL CA 2018" + }, + { + "count": 53, + "key": "GlobalSign GCC R46 OV TLS CA 2025" + }, + { + "count": 49, + "key": "etc" + }, + { + "count": 46, + "key": "Microsoft TLS G2 RSA CA OCSP 04" + } + ] + }, + "os": { + "total": 4692, + "buckets": [ + { + "count": 2914, + "key": "linux" + }, + { + "count": 57, + "key": "windows" + }, + { + "count": 52, + "key": "ubuntu" + }, + { + "count": 38, + "key": "enterprise_linux" + }, + { + "count": 25, + "key": "debian_linux" + }, + { + "count": 20, + "key": "routeros" + }, + { + "count": 8, + "key": "freebsd" + }, + { + "count": 4, + "key": "centos" + }, + { + "count": 4, + "key": "windows_server" + }, + { + "count": 3, + "key": "adaptive_security_appliance_software" + }, + { + "count": 3, + "key": "linux_kernel" + }, + { + "count": 2, + "key": "proxmox" + }, + { + "count": 1, + "key": "ios" + } + ] + } + }, + "errors": [] + }, + { + "asn": "AS51396", + "name": "PFCLOUD", + "fields": { + "port": { + "total": 2005, + "buckets": [ + { + "count": 841, + "key": "22" + }, + { + "count": 357, + "key": "80" + }, + { + "count": 275, + "key": "443" + }, + { + "count": 121, + "key": "3389" + }, + { + "count": 100, + "key": "1407" + }, + { + "count": 99, + "key": "11407" + }, + { + "count": 87, + "key": "135" + }, + { + "count": 85, + "key": "445" + }, + { + "count": 80, + "key": "5985" + }, + { + "count": 79, + "key": "139" + }, + { + "count": 74, + "key": "53" + }, + { + "count": 73, + "key": "8080" + }, + { + "count": 69, + "key": "2096" + }, + { + "count": 64, + "key": "47001" + }, + { + "count": 61, + "key": "6239" + } + ] + }, + "software": { + "total": 2005, + "buckets": [ + { + "count": 753, + "key": "openssh" + }, + { + "count": 398, + "key": "nginx" + }, + { + "count": 185, + "key": "http_server" + }, + { + "count": 110, + "key": "http_api" + }, + { + "count": 102, + "key": "express" + }, + { + "count": 72, + "key": "php" + }, + { + "count": 56, + "key": "python" + }, + { + "count": 43, + "key": "dovecot" + }, + { + "count": 43, + "key": "pve" + }, + { + "count": 42, + "key": "next.js" + }, + { + "count": 42, + "key": "virtual_environment" + }, + { + "count": 35, + "key": "node_exporter" + }, + { + "count": 35, + "key": "simplehttp" + }, + { + "count": 30, + "key": "drupal" + }, + { + "count": 30, + "key": "tinyproxy" + } + ] + }, + "labels": { + "total": 2005, + "buckets": [ + { + "count": 2005, + "key": "BULLETPROOF" + }, + { + "count": 15, + "key": "IPV6" + } + ] + }, + "cert_issuer": { + "total": 2005, + "buckets": [ + { + "count": 124, + "key": "YE1" + }, + { + "count": 109, + "key": "YE2" + }, + { + "count": 49, + "key": "YR2" + }, + { + "count": 31, + "key": "YR1" + }, + { + "count": 27, + "key": "WIN-9QL4SDRB93L" + }, + { + "count": 21, + "key": "TRAEFIK DEFAULT CERT" + }, + { + "count": 18, + "key": "Proxmox Virtual Environment" + }, + { + "count": 17, + "key": "WIN-IK7N6SD2UBU" + }, + { + "count": 17, + "key": "localhost" + }, + { + "count": 11, + "key": "Cloudbase-Init WinRM" + }, + { + "count": 11, + "key": "invalid2.invalid" + }, + { + "count": 10, + "key": "hosting12.coolsshservers.com" + }, + { + "count": 9, + "key": "WIN-OU0SUKQBJN2" + }, + { + "count": 9, + "key": "imap.example.com" + }, + { + "count": 9, + "key": "srv1.dedusapp.icu" + } + ] + }, + "os": { + "total": 2005, + "buckets": [ + { + "count": 678, + "key": "linux" + }, + { + "count": 82, + "key": "windows" + }, + { + "count": 36, + "key": "debian_linux" + }, + { + "count": 19, + "key": "proxmox" + }, + { + "count": 14, + "key": "ubuntu" + }, + { + "count": 5, + "key": "centos" + }, + { + "count": 2, + "key": "routeros" + }, + { + "count": 1, + "key": "vmware_esxi_server" + } + ] + } + }, + "errors": [] + }, + { + "asn": "AS213702", + "name": "QWINS-LTD", + "fields": { + "port": { + "total": 7681, + "buckets": [ + { + "count": 6701, + "key": "22" + }, + { + "count": 4574, + "key": "443" + }, + { + "count": 2232, + "key": "2222" + }, + { + "count": 2163, + "key": "80" + }, + { + "count": 775, + "key": "8443" + }, + { + "count": 678, + "key": "2096" + }, + { + "count": 371, + "key": "3389" + }, + { + "count": 236, + "key": "8080" + }, + { + "count": 199, + "key": "2053" + }, + { + "count": 171, + "key": "9443" + }, + { + "count": 129, + "key": "3000" + }, + { + "count": 124, + "key": "4443" + }, + { + "count": 93, + "key": "8000" + }, + { + "count": 89, + "key": "445" + }, + { + "count": 81, + "key": "2083" + } + ] + }, + "software": { + "total": 7681, + "buckets": [ + { + "count": 6428, + "key": "openssh" + }, + { + "count": 3432, + "key": "nginx" + }, + { + "count": 643, + "key": "caddy" + }, + { + "count": 479, + "key": "google_web_services" + }, + { + "count": 479, + "key": "web_server" + }, + { + "count": 449, + "key": "app_and_api_protector" + }, + { + "count": 449, + "key": "ghost" + }, + { + "count": 297, + "key": "waf" + }, + { + "count": 285, + "key": "cloudflare_load_balancer" + }, + { + "count": 261, + "key": "express" + }, + { + "count": 235, + "key": "next.js" + }, + { + "count": 200, + "key": "openresty" + }, + { + "count": 188, + "key": "uvicorn" + }, + { + "count": 132, + "key": "http_server" + }, + { + "count": 127, + "key": "bootstrap" + } + ] + }, + "labels": { + "total": 7681, + "buckets": [ + { + "count": 7681, + "key": "BULLETPROOF" + }, + { + "count": 18, + "key": "IPV6" + } + ] + }, + "cert_issuer": { + "total": 7681, + "buckets": [ + { + "count": 1384, + "key": "YE2" + }, + { + "count": 1093, + "key": "YE1" + }, + { + "count": 775, + "key": "2LqvyXLUXjAf2MoZx6VEPgJuz1349naDyLo" + }, + { + "count": 498, + "key": "invalid2.invalid" + }, + { + "count": 310, + "key": "NvJhHp68p5mjSuW_EK9Lab6bH9" + }, + { + "count": 300, + "key": "GlobalSign Atlas R3 DV TLS CA 2026 Q2" + }, + { + "count": 235, + "key": "YR1" + }, + { + "count": 227, + "key": "GeoTrust TLS RSA CA G1" + }, + { + "count": 220, + "key": "zAqJHcz8C2V0TC9uVVmwYr8jbL2sjgaT_5" + }, + { + "count": 188, + "key": "YR2" + }, + { + "count": 181, + "key": "HARICA DV TLS RSA" + }, + { + "count": 145, + "key": "GlobalSign RSA OV SSL CA 2018" + }, + { + "count": 139, + "key": "WR1" + }, + { + "count": 122, + "key": "Apple Public EV Server RSA CA 1 - G1" + }, + { + "count": 110, + "key": "GlobalSign ECC OV SSL CA 2018" + } + ] + }, + "os": { + "total": 7681, + "buckets": [ + { + "count": 6310, + "key": "linux" + }, + { + "count": 65, + "key": "ubuntu" + }, + { + "count": 65, + "key": "windows" + }, + { + "count": 12, + "key": "debian_linux" + }, + { + "count": 10, + "key": "linux_kernel" + }, + { + "count": 2, + "key": "enterprise_linux" + }, + { + "count": 1, + "key": "linux_ami" + } + ] + } + }, + "errors": [] + }, + { + "asn": "AS216246", + "name": "RU-AEZA-AS", + "fields": { + "port": { + "total": 6960, + "buckets": [ + { + "count": 5620, + "key": "22" + }, + { + "count": 4211, + "key": "443" + }, + { + "count": 3289, + "key": "80" + }, + { + "count": 688, + "key": "8443" + }, + { + "count": 657, + "key": "2096" + }, + { + "count": 389, + "key": "8080" + }, + { + "count": 331, + "key": "2222" + }, + { + "count": 305, + "key": "3389" + }, + { + "count": 194, + "key": "3000" + }, + { + "count": 172, + "key": "3478" + }, + { + "count": 162, + "key": "25" + }, + { + "count": 162, + "key": "53" + }, + { + "count": 130, + "key": "2053" + }, + { + "count": 128, + "key": "993" + }, + { + "count": 127, + "key": "5985" + } + ] + }, + "software": { + "total": 6960, + "buckets": [ + { + "count": 5168, + "key": "openssh" + }, + { + "count": 4990, + "key": "nginx" + }, + { + "count": 672, + "key": "caddy" + }, + { + "count": 498, + "key": "express" + }, + { + "count": 455, + "key": "next.js" + }, + { + "count": 271, + "key": "dovecot" + }, + { + "count": 240, + "key": "ghost" + }, + { + "count": 239, + "key": "app_and_api_protector" + }, + { + "count": 235, + "key": "traefik_proxy" + }, + { + "count": 183, + "key": "fastpanel" + }, + { + "count": 182, + "key": "waf" + }, + { + "count": 177, + "key": "http_server" + }, + { + "count": 175, + "key": "uvicorn" + }, + { + "count": 174, + "key": "google_web_services" + }, + { + "count": 174, + "key": "web_server" + } + ] + }, + "labels": { + "total": 6960, + "buckets": [ + { + "count": 6960, + "key": "BULLETPROOF" + }, + { + "count": 133, + "key": "IPV6" + } + ] + }, + "cert_issuer": { + "total": 6960, + "buckets": [ + { + "count": 1428, + "key": "YE2" + }, + { + "count": 1332, + "key": "YE1" + }, + { + "count": 261, + "key": "YR1" + }, + { + "count": 235, + "key": "TRAEFIK DEFAULT CERT" + }, + { + "count": 231, + "key": "GlobalSign ECC OV SSL CA 2018" + }, + { + "count": 224, + "key": "HARICA DV TLS RSA" + }, + { + "count": 180, + "key": "invalid2.invalid" + }, + { + "count": 176, + "key": "YR2" + }, + { + "count": 143, + "key": "GlobalSign RSA OV SSL CA 2018" + }, + { + "count": 128, + "key": "WR1" + }, + { + "count": 86, + "key": "GeoTrust TLS RSA CA G1" + }, + { + "count": 85, + "key": "etc" + }, + { + "count": 81, + "key": "WIN-4NFSE1QOBMS" + }, + { + "count": 69, + "key": "Microsoft TLS G2 RSA CA OCSP 04" + }, + { + "count": 58, + "key": "GlobalSign GCC R46 OV TLS CA 2025" + } + ] + }, + "os": { + "total": 6960, + "buckets": [ + { + "count": 5015, + "key": "linux" + }, + { + "count": 246, + "key": "ubuntu" + }, + { + "count": 134, + "key": "windows" + }, + { + "count": 31, + "key": "debian_linux" + }, + { + "count": 8, + "key": "routeros" + }, + { + "count": 7, + "key": "linux_kernel" + }, + { + "count": 3, + "key": "proxmox" + }, + { + "count": 2, + "key": "adaptive_security_appliance_software" + }, + { + "count": 2, + "key": "windows_server" + }, + { + "count": 1, + "key": "centos" + }, + { + "count": 1, + "key": "freebsd" + }, + { + "count": 1, + "key": "megarac_spx" + }, + { + "count": 1, + "key": "windows_server_2012_r2" + } + ] + } + }, + "errors": [] + }, + { + "asn": "AS200651", + "name": "FLOKINET", + "fields": { + "port": { + "total": 3824, + "buckets": [ + { + "count": 2849, + "key": "22" + }, + { + "count": 2126, + "key": "443" + }, + { + "count": 1919, + "key": "80" + }, + { + "count": 385, + "key": "53" + }, + { + "count": 281, + "key": "25" + }, + { + "count": 235, + "key": "587" + }, + { + "count": 222, + "key": "993" + }, + { + "count": 192, + "key": "111" + }, + { + "count": 185, + "key": "143" + }, + { + "count": 167, + "key": "110" + }, + { + "count": 162, + "key": "8080" + }, + { + "count": 144, + "key": "2096" + }, + { + "count": 143, + "key": "8443" + }, + { + "count": 135, + "key": "21" + }, + { + "count": 97, + "key": "9001" + } + ] + }, + "software": { + "total": 3824, + "buckets": [ + { + "count": 2797, + "key": "nginx" + }, + { + "count": 2571, + "key": "openssh" + }, + { + "count": 554, + "key": "dovecot" + }, + { + "count": 449, + "key": "http_server" + }, + { + "count": 357, + "key": "cpanel" + }, + { + "count": 288, + "key": "express" + }, + { + "count": 270, + "key": "caddy" + }, + { + "count": 255, + "key": "exim" + }, + { + "count": 251, + "key": "openresty" + }, + { + "count": 197, + "key": "authoritative_server" + }, + { + "count": 183, + "key": "next.js" + }, + { + "count": 166, + "key": "jquery" + }, + { + "count": 159, + "key": "postfix" + }, + { + "count": 157, + "key": "webmail" + }, + { + "count": 133, + "key": "traefik_proxy" + } + ] + }, + "labels": { + "total": 3824, + "buckets": [ + { + "count": 3824, + "key": "BULLETPROOF" + }, + { + "count": 130, + "key": "IPV6" + } + ] + }, + "cert_issuer": { + "total": 3824, + "buckets": [ + { + "count": 705, + "key": "YE1" + }, + { + "count": 650, + "key": "YE2" + }, + { + "count": 599, + "key": "YR2" + }, + { + "count": 580, + "key": "YR1" + }, + { + "count": 133, + "key": "TRAEFIK DEFAULT CERT" + }, + { + "count": 102, + "key": "invalid2.invalid" + }, + { + "count": 59, + "key": "localhost" + }, + { + "count": 41, + "key": "www.example.com" + }, + { + "count": 40, + "key": "GlobalSign Atlas R46 DV TLS CA 2026 Q3" + }, + { + "count": 34, + "key": "fin01.m-cr.org" + }, + { + "count": 30, + "key": "Sectigo Public Server Authentication CA DV R36" + }, + { + "count": 28, + "key": "GlobalSign RSA OV SSL CA 2018" + }, + { + "count": 26, + "key": "protect@DDoS-Filter.domain" + }, + { + "count": 25, + "key": "E7" + }, + { + "count": 25, + "key": "Proxmox Virtual Environment" + } + ] + }, + "os": { + "total": 3824, + "buckets": [ + { + "count": 2155, + "key": "linux" + }, + { + "count": 65, + "key": "ubuntu" + }, + { + "count": 45, + "key": "debian_linux" + }, + { + "count": 30, + "key": "proxmox" + }, + { + "count": 24, + "key": "windows" + }, + { + "count": 10, + "key": "freebsd" + }, + { + "count": 8, + "key": "routeros" + }, + { + "count": 6, + "key": "enterprise_linux" + }, + { + "count": 6, + "key": "openbsd" + }, + { + "count": 5, + "key": "centos" + }, + { + "count": 3, + "key": "windows_server_2008_r2" + }, + { + "count": 1, + "key": "ilo_3" + }, + { + "count": 1, + "key": "linux_kernel" + }, + { + "count": 1, + "key": "openmediavault" + }, + { + "count": 1, + "key": "sonicos" + } + ] + } + }, + "errors": [] + }, + { + "asn": "AS30823", + "name": "AUROLOGIC", + "fields": { + "port": { + "total": 2178, + "buckets": [ + { + "count": 1274, + "key": "22" + }, + { + "count": 855, + "key": "443" + }, + { + "count": 651, + "key": "80" + }, + { + "count": 476, + "key": "53" + }, + { + "count": 379, + "key": "27015" + }, + { + "count": 300, + "key": "3389" + }, + { + "count": 122, + "key": "8443" + }, + { + "count": 120, + "key": "25" + }, + { + "count": 99, + "key": "2096" + }, + { + "count": 80, + "key": "8080" + }, + { + "count": 63, + "key": "135" + }, + { + "count": 61, + "key": "111" + }, + { + "count": 61, + "key": "5985" + }, + { + "count": 55, + "key": "445" + }, + { + "count": 52, + "key": "2222" + } + ] + }, + "software": { + "total": 2178, + "buckets": [ + { + "count": 1148, + "key": "openssh" + }, + { + "count": 850, + "key": "nginx" + }, + { + "count": 201, + "key": "express" + }, + { + "count": 134, + "key": "http_server" + }, + { + "count": 104, + "key": "google_web_services" + }, + { + "count": 104, + "key": "web_server" + }, + { + "count": 100, + "key": "http_api" + }, + { + "count": 92, + "key": "dovecot" + }, + { + "count": 73, + "key": "next.js" + }, + { + "count": 70, + "key": "caddy" + }, + { + "count": 70, + "key": "postfix" + }, + { + "count": 69, + "key": "app_and_api_protector" + }, + { + "count": 69, + "key": "ghost" + }, + { + "count": 67, + "key": "cloudflare_load_balancer" + }, + { + "count": 67, + "key": "waf" + } + ] + }, + "labels": { + "total": 2178, + "buckets": [ + { + "count": 2178, + "key": "BULLETPROOF" + }, + { + "count": 29, + "key": "IPV6" + } + ] + }, + "cert_issuer": { + "total": 2178, + "buckets": [ + { + "count": 237, + "key": "YE2" + }, + { + "count": 222, + "key": "YE1" + }, + { + "count": 112, + "key": "invalid2.invalid" + }, + { + "count": 99, + "key": "YR2" + }, + { + "count": 83, + "key": "YR1" + }, + { + "count": 60, + "key": "windows-DE-Fran" + }, + { + "count": 57, + "key": "172.86.93" + }, + { + "count": 52, + "key": "GoGetSSL RSA DV CA" + }, + { + "count": 51, + "key": "windows-Frankfu" + }, + { + "count": 27, + "key": "localhost" + }, + { + "count": 25, + "key": "WIN-8OA3CCQAE4D" + }, + { + "count": 24, + "key": "Plesk" + }, + { + "count": 22, + "key": "Apple Public EV Server RSA CA 1 - G1" + }, + { + "count": 21, + "key": "DigiCert Global G2 TLS RSA SHA256 2020 CA1" + }, + { + "count": 21, + "key": "RapidSSL TLS RSA CA G1" + } + ] + }, + "os": { + "total": 2178, + "buckets": [ + { + "count": 1080, + "key": "linux" + }, + { + "count": 159, + "key": "windows" + }, + { + "count": 20, + "key": "proxmox" + }, + { + "count": 19, + "key": "routeros" + }, + { + "count": 15, + "key": "ubuntu" + }, + { + "count": 14, + "key": "debian_linux" + }, + { + "count": 9, + "key": "centos" + }, + { + "count": 6, + "key": "freebsd" + }, + { + "count": 3, + "key": "adaptive_security_appliance_software" + }, + { + "count": 3, + "key": "megarac_spx" + }, + { + "count": 3, + "key": "windows_server" + }, + { + "count": 1, + "key": "ios" + }, + { + "count": 1, + "key": "linux_kernel" + }, + { + "count": 1, + "key": "vmware_esxi_server" + } + ] + } + }, + "errors": [] + }, + { + "asn": "AS140666", + "name": "ADPL-AS-AP", + "fields": { + "port": { + "total": 6562, + "buckets": [ + { + "count": 4367, + "key": "443" + }, + { + "count": 4199, + "key": "80" + }, + { + "count": 2445, + "key": "22" + }, + { + "count": 1504, + "key": "4667" + }, + { + "count": 510, + "key": "0" + }, + { + "count": 376, + "key": "6004" + }, + { + "count": 376, + "key": "6011" + }, + { + "count": 375, + "key": "6001" + }, + { + "count": 375, + "key": "6006" + }, + { + "count": 375, + "key": "6007" + }, + { + "count": 375, + "key": "6010" + }, + { + "count": 375, + "key": "6012" + }, + { + "count": 375, + "key": "6013" + }, + { + "count": 375, + "key": "6014" + }, + { + "count": 375, + "key": "6016" + } + ] + }, + "software": { + "total": 6562, + "buckets": [ + { + "count": 8935, + "key": "nginx" + }, + { + "count": 3801, + "key": "openssh" + }, + { + "count": 140, + "key": "openresty" + }, + { + "count": 125, + "key": "http_api" + }, + { + "count": 80, + "key": "jquery" + }, + { + "count": 76, + "key": "internet_information_services" + }, + { + "count": 56, + "key": "tengine" + }, + { + "count": 52, + "key": "bootstrap" + }, + { + "count": 41, + "key": "node_exporter" + }, + { + "count": 36, + "key": "express" + }, + { + "count": 34, + "key": "app_and_api_protector" + }, + { + "count": 34, + "key": "ghost" + }, + { + "count": 34, + "key": "wordpress" + }, + { + "count": 29, + "key": "python" + }, + { + "count": 28, + "key": "http_server" + } + ] + }, + "labels": { + "total": 6562, + "buckets": [ + { + "count": 6562, + "key": "BULLETPROOF" + } + ] + }, + "cert_issuer": { + "total": 6562, + "buckets": [ + { + "count": 3804, + "key": "USDTCDN" + }, + { + "count": 347, + "key": "Sectigo Public Server Authentication CA DV R36" + }, + { + "count": 182, + "key": "NONE" + }, + { + "count": 132, + "key": "RapidSSL TLS RSA CA G1" + }, + { + "count": 123, + "key": "tudog_node_agent._reserved.bytefcdn.com" + }, + { + "count": 108, + "key": "RTCTS" + }, + { + "count": 97, + "key": "GeoTrust TLS RSA CA G1" + }, + { + "count": 97, + "key": "QY" + }, + { + "count": 65, + "key": "RapidSSL TLS ECC CA G1" + }, + { + "count": 61, + "key": "tls.internal.ypc.org" + }, + { + "count": 48, + "key": "SG CA" + }, + { + "count": 47, + "key": "GlobalSign GCC R3 OV TLS CA 2024" + }, + { + "count": 34, + "key": "YR1" + }, + { + "count": 33, + "key": "Root CA" + }, + { + "count": 32, + "key": "GlobalSign GCC R46 OV TLS CA 2025" + } + ] + }, + "os": { + "total": 6562, + "buckets": [ + { + "count": 1100, + "key": "linux" + }, + { + "count": 94, + "key": "windows" + }, + { + "count": 13, + "key": "ubuntu" + }, + { + "count": 3, + "key": "routeros" + }, + { + "count": 2, + "key": "adaptive_security_appliance_software" + }, + { + "count": 2, + "key": "debian_linux" + }, + { + "count": 2, + "key": "windows_server_2008_r2" + }, + { + "count": 1, + "key": "linux_kernel" + }, + { + "count": 1, + "key": "proxmox" + } + ] + } + }, + "errors": [] + }, + { + "asn": "AS214351", + "name": "FEMOIT", + "fields": { + "port": { + "total": 744, + "buckets": [ + { + "count": 564, + "key": "80" + }, + { + "count": 559, + "key": "22" + }, + { + "count": 363, + "key": "443" + }, + { + "count": 103, + "key": "21" + }, + { + "count": 99, + "key": "53" + }, + { + "count": 97, + "key": "25" + }, + { + "count": 90, + "key": "587" + }, + { + "count": 89, + "key": "143" + }, + { + "count": 89, + "key": "993" + }, + { + "count": 87, + "key": "8085" + }, + { + "count": 86, + "key": "110" + }, + { + "count": 86, + "key": "22509" + }, + { + "count": 78, + "key": "3389" + }, + { + "count": 49, + "key": "8888" + }, + { + "count": 41, + "key": "7777" + } + ] + }, + "software": { + "total": 744, + "buckets": [ + { + "count": 841, + "key": "nginx" + }, + { + "count": 610, + "key": "openssh" + }, + { + "count": 296, + "key": "express" + }, + { + "count": 228, + "key": "dovecot" + }, + { + "count": 173, + "key": "fastpanel" + }, + { + "count": 155, + "key": "exim" + }, + { + "count": 107, + "key": "next.js" + }, + { + "count": 84, + "key": "http_server" + }, + { + "count": 62, + "key": "proftpd" + }, + { + "count": 40, + "key": "http_api" + }, + { + "count": 29, + "key": "bootstrap" + }, + { + "count": 25, + "key": "php" + }, + { + "count": 25, + "key": "uvicorn" + }, + { + "count": 21, + "key": "jquery" + }, + { + "count": 20, + "key": "bind" + } + ] + }, + "labels": { + "total": 744, + "buckets": [ + { + "count": 744, + "key": "BULLETPROOF" + } + ] + }, + "cert_issuer": { + "total": 744, + "buckets": [ + { + "count": 110, + "key": "etc" + }, + { + "count": 58, + "key": "YR1" + }, + { + "count": 55, + "key": "YR2" + }, + { + "count": 52, + "key": "vm4660.defhost.co" + }, + { + "count": 45, + "key": "FASTPANEL" + }, + { + "count": 43, + "key": "parking" + }, + { + "count": 39, + "key": "YE2" + }, + { + "count": 34, + "key": "YE1" + }, + { + "count": 30, + "key": "misp.goodip" + }, + { + "count": 14, + "key": "vm4980.defhost.co" + }, + { + "count": 12, + "key": "tech0.test" + }, + { + "count": 10, + "key": "localhost" + }, + { + "count": 9, + "key": "amgel.yop.nail" + }, + { + "count": 9, + "key": "def.host.vm" + }, + { + "count": 9, + "key": "info.devser.loc" + } + ] + }, + "os": { + "total": 744, + "buckets": [ + { + "count": 538, + "key": "linux" + }, + { + "count": 34, + "key": "windows" + }, + { + "count": 6, + "key": "linux_kernel" + }, + { + "count": 3, + "key": "ubuntu" + }, + { + "count": 1, + "key": "centos" + }, + { + "count": 1, + "key": "debian_linux" + }, + { + "count": 1, + "key": "windows_server" + } + ] + } + }, + "errors": [] + }, + { + "asn": "AS198953", + "name": "PROTON66", + "fields": { + "port": { + "total": 359, + "buckets": [ + { + "count": 167, + "key": "22" + }, + { + "count": 163, + "key": "3389" + }, + { + "count": 84, + "key": "80" + }, + { + "count": 81, + "key": "443" + }, + { + "count": 53, + "key": "135" + }, + { + "count": 42, + "key": "137" + }, + { + "count": 38, + "key": "53" + }, + { + "count": 37, + "key": "5985" + }, + { + "count": 36, + "key": "139" + }, + { + "count": 24, + "key": "21" + }, + { + "count": 24, + "key": "123" + }, + { + "count": 24, + "key": "47001" + }, + { + "count": 22, + "key": "25" + }, + { + "count": 20, + "key": "993" + }, + { + "count": 19, + "key": "110" + } + ] + }, + "software": { + "total": 359, + "buckets": [ + { + "count": 125, + "key": "openssh" + }, + { + "count": 124, + "key": "nginx" + }, + { + "count": 60, + "key": "dovecot" + }, + { + "count": 43, + "key": "http_api" + }, + { + "count": 33, + "key": "express" + }, + { + "count": 31, + "key": "fastpanel" + }, + { + "count": 30, + "key": "http_server" + }, + { + "count": 24, + "key": "exim" + }, + { + "count": 23, + "key": "requirejs" + }, + { + "count": 20, + "key": "parallels_plesk_panel" + }, + { + "count": 20, + "key": "prototype" + }, + { + "count": 17, + "key": "proftpd" + }, + { + "count": 14, + "key": "plesk" + }, + { + "count": 12, + "key": "bind" + }, + { + "count": 11, + "key": "postfix" + } + ] + }, + "labels": { + "total": 359, + "buckets": [ + { + "count": 359, + "key": "BULLETPROOF" + } + ] + }, + "cert_issuer": { + "total": 359, + "buckets": [ + { + "count": 23, + "key": "Plesk" + }, + { + "count": 19, + "key": "YR1" + }, + { + "count": 19, + "key": "etc" + }, + { + "count": 11, + "key": "localhost" + }, + { + "count": 9, + "key": "AnyDesk Client" + }, + { + "count": 9, + "key": "R11" + }, + { + "count": 8, + "key": "FASTPANEL" + }, + { + "count": 8, + "key": "R12" + }, + { + "count": 8, + "key": "parking" + }, + { + "count": 7, + "key": "YR2" + }, + { + "count": 7, + "key": "dev-1.secure.host" + }, + { + "count": 6, + "key": "akrud-1.example.com" + }, + { + "count": 6, + "key": "mail.the-slasher.com" + }, + { + "count": 6, + "key": "xmoney-1.example.com" + }, + { + "count": 5, + "key": "DESKTOP-TCRDU4C" + } + ] + }, + "os": { + "total": 359, + "buckets": [ + { + "count": 118, + "key": "linux" + }, + { + "count": 40, + "key": "windows" + }, + { + "count": 2, + "key": "debian_linux" + }, + { + "count": 2, + "key": "proxmox" + }, + { + "count": 2, + "key": "ubuntu" + }, + { + "count": 1, + "key": "adaptive_security_appliance_software" + }, + { + "count": 1, + "key": "freenas_firmware" + }, + { + "count": 1, + "key": "linux_kernel" + }, + { + "count": 1, + "key": "routeros" + }, + { + "count": 1, + "key": "vmware_esxi_server" + }, + { + "count": 1, + "key": "windows_server" + } + ] + } + }, + "errors": [] + }, + { + "asn": "AS200593", + "name": "PROSPERO-AS", + "fields": { + "port": { + "total": 340, + "buckets": [ + { + "count": 193, + "key": "22" + }, + { + "count": 133, + "key": "3389" + }, + { + "count": 107, + "key": "80" + }, + { + "count": 80, + "key": "443" + }, + { + "count": 38, + "key": "53" + }, + { + "count": 29, + "key": "135" + }, + { + "count": 26, + "key": "5985" + }, + { + "count": 22, + "key": "21" + }, + { + "count": 21, + "key": "25" + }, + { + "count": 21, + "key": "143" + }, + { + "count": 21, + "key": "993" + }, + { + "count": 19, + "key": "110" + }, + { + "count": 17, + "key": "137" + }, + { + "count": 17, + "key": "139" + }, + { + "count": 16, + "key": "8443" + } + ] + }, + "software": { + "total": 340, + "buckets": [ + { + "count": 141, + "key": "nginx" + }, + { + "count": 133, + "key": "openssh" + }, + { + "count": 59, + "key": "dovecot" + }, + { + "count": 34, + "key": "http_server" + }, + { + "count": 32, + "key": "parallels_plesk_panel" + }, + { + "count": 32, + "key": "prototype" + }, + { + "count": 32, + "key": "requirejs" + }, + { + "count": 29, + "key": "http_api" + }, + { + "count": 27, + "key": "express" + }, + { + "count": 22, + "key": "plesk" + }, + { + "count": 21, + "key": "exim" + }, + { + "count": 15, + "key": "cpanel" + }, + { + "count": 14, + "key": "proftpd" + }, + { + "count": 11, + "key": "postfix" + }, + { + "count": 10, + "key": "authoritative_server" + } + ] + }, + "labels": { + "total": 340, + "buckets": [ + { + "count": 340, + "key": "BULLETPROOF" + } + ] + }, + "cert_issuer": { + "total": 340, + "buckets": [ + { + "count": 37, + "key": "Plesk" + }, + { + "count": 36, + "key": "YR1" + }, + { + "count": 27, + "key": "YR2" + }, + { + "count": 9, + "key": "TRAEFIK DEFAULT CERT" + }, + { + "count": 9, + "key": "YE1" + }, + { + "count": 8, + "key": "R13" + }, + { + "count": 8, + "key": "blankilamalice-4.example.com" + }, + { + "count": 8, + "key": "devin-coo-1.example.com" + }, + { + "count": 7, + "key": "DESKTOP-GKGI28A" + }, + { + "count": 7, + "key": "R12" + }, + { + "count": 7, + "key": "ads-grab-2.example.com" + }, + { + "count": 7, + "key": "ckicksp-1.example.com" + }, + { + "count": 5, + "key": "benjamin-b-2.example.com" + }, + { + "count": 4, + "key": "AnyDesk Client" + }, + { + "count": 4, + "key": "etc" + } + ] + }, + "os": { + "total": 340, + "buckets": [ + { + "count": 133, + "key": "linux" + }, + { + "count": 25, + "key": "windows" + }, + { + "count": 3, + "key": "proxmox" + }, + { + "count": 2, + "key": "debian_linux" + }, + { + "count": 2, + "key": "ubuntu" + } + ] + } + }, + "errors": [] + }, + { + "asn": "AS214940", + "name": "KPRONET", + "fields": { + "port": { + "total": 0, + "buckets": [] + }, + "software": { + "total": 0, + "buckets": [] + }, + "labels": { + "total": 0, + "buckets": [] + }, + "cert_issuer": { + "total": 0, + "buckets": [] + }, + "os": { + "total": 0, + "buckets": [] + } + }, + "errors": [] + }, + { + "asn": "AS206728", + "name": "MEDIALAND-AS", + "fields": { + "port": { + "total": 15, + "buckets": [ + { + "count": 5, + "key": "443" + }, + { + "count": 3, + "key": "22" + }, + { + "count": 2, + "key": "80" + }, + { + "count": 1, + "key": "111" + }, + { + "count": 1, + "key": "137" + }, + { + "count": 1, + "key": "3389" + }, + { + "count": 1, + "key": "5900" + }, + { + "count": 1, + "key": "5902" + }, + { + "count": 1, + "key": "5903" + }, + { + "count": 1, + "key": "8080" + } + ] + }, + "software": { + "total": 15, + "buckets": [ + { + "count": 4, + "key": "nginx" + }, + { + "count": 2, + "key": "openssh" + } + ] + }, + "labels": { + "total": 15, + "buckets": [ + { + "count": 15, + "key": "BULLETPROOF" + }, + { + "count": 5, + "key": "IPV6" + } + ] + }, + "cert_issuer": { + "total": 15, + "buckets": [ + { + "count": 2, + "key": "GlobalSign RSA OV SSL CA 2018" + }, + { + "count": 1, + "key": "WIN-UKID351J32A" + }, + { + "count": 1, + "key": "YE1" + }, + { + "count": 1, + "key": "invalid2.invalid" + } + ] + }, + "os": { + "total": 15, + "buckets": [ + { + "count": 1, + "key": "linux" + }, + { + "count": 1, + "key": "routeros" + } + ] + } + }, + "errors": [] + }, + { + "asn": "AS211720", + "name": "Datashield", + "fields": { + "port": { + "total": 49, + "buckets": [ + { + "count": 28, + "key": "22" + }, + { + "count": 18, + "key": "3389" + }, + { + "count": 14, + "key": "179" + }, + { + "count": 9, + "key": "80" + }, + { + "count": 7, + "key": "443" + }, + { + "count": 6, + "key": "111" + }, + { + "count": 6, + "key": "5985" + }, + { + "count": 3, + "key": "8080" + }, + { + "count": 3, + "key": "8081" + }, + { + "count": 2, + "key": "135" + }, + { + "count": 2, + "key": "137" + }, + { + "count": 2, + "key": "5357" + }, + { + "count": 1, + "key": "53" + }, + { + "count": 1, + "key": "139" + }, + { + "count": 1, + "key": "445" + } + ] + }, + "software": { + "total": 49, + "buckets": [ + { + "count": 25, + "key": "openssh" + }, + { + "count": 11, + "key": "nginx" + }, + { + "count": 6, + "key": "http_api" + }, + { + "count": 2, + "key": "next.js" + }, + { + "count": 2, + "key": "tor" + }, + { + "count": 1, + "key": "caddy" + }, + { + "count": 1, + "key": "dropbear_ssh" + }, + { + "count": 1, + "key": "gunicorn" + }, + { + "count": 1, + "key": "http_server" + }, + { + "count": 1, + "key": "libupnp" + }, + { + "count": 1, + "key": "mariadb" + } + ] + }, + "labels": { + "total": 49, + "buckets": [ + { + "count": 49, + "key": "BULLETPROOF" + } + ] + }, + "cert_issuer": { + "total": 49, + "buckets": [ + { + "count": 3, + "key": "IPMI" + }, + { + "count": 2, + "key": "FREE" + }, + { + "count": 2, + "key": "YE1" + }, + { + "count": 1, + "key": "WIN-JDCEOBUFJUS" + }, + { + "count": 1, + "key": "WIN-JP7KUDECHOR" + }, + { + "count": 1, + "key": "YE2" + }, + { + "count": 1, + "key": "YR2" + }, + { + "count": 1, + "key": "agent-ca@1757674441" + }, + { + "count": 1, + "key": "agent-ca@1757925038" + }, + { + "count": 1, + "key": "agent-ca@1759158944" + }, + { + "count": 1, + "key": "bad-raven-crab" + }, + { + "count": 1, + "key": "bright-magenta-" + }, + { + "count": 1, + "key": "eth0" + }, + { + "count": 1, + "key": "gentle-red-bee" + }, + { + "count": 1, + "key": "greedy-cream-ha" + } + ] + }, + "os": { + "total": 49, + "buckets": [ + { + "count": 10, + "key": "linux" + }, + { + "count": 4, + "key": "windows" + }, + { + "count": 1, + "key": "debian_linux" + } + ] + } + }, + "errors": [] + }, + { + "asn": "AS216309", + "name": "INVISIONTECH-GROUP-SRL", + "fields": { + "port": { + "total": 37, + "buckets": [ + { + "count": 35, + "key": "22" + }, + { + "count": 13, + "key": "80" + }, + { + "count": 8, + "key": "443" + }, + { + "count": 4, + "key": "111" + }, + { + "count": 2, + "key": "25" + }, + { + "count": 2, + "key": "53" + }, + { + "count": 2, + "key": "110" + }, + { + "count": 2, + "key": "143" + }, + { + "count": 2, + "key": "161" + }, + { + "count": 2, + "key": "993" + }, + { + "count": 2, + "key": "3306" + }, + { + "count": 2, + "key": "4190" + }, + { + "count": 2, + "key": "5060" + }, + { + "count": 2, + "key": "8087" + }, + { + "count": 2, + "key": "8443" + } + ] + }, + "software": { + "total": 37, + "buckets": [ + { + "count": 25, + "key": "openssh" + }, + { + "count": 16, + "key": "nginx" + }, + { + "count": 10, + "key": "http_server" + }, + { + "count": 9, + "key": "express" + }, + { + "count": 7, + "key": "dovecot" + }, + { + "count": 6, + "key": "bootstrap" + }, + { + "count": 6, + "key": "php" + }, + { + "count": 5, + "key": "prototype" + }, + { + "count": 4, + "key": "jquery" + }, + { + "count": 4, + "key": "openssl" + }, + { + "count": 3, + "key": "parallels_plesk_panel" + }, + { + "count": 3, + "key": "requirejs" + }, + { + "count": 2, + "key": "lodash" + }, + { + "count": 2, + "key": "plesk" + }, + { + "count": 2, + "key": "pve" + } + ] + }, + "labels": { + "total": 37, + "buckets": [ + { + "count": 37, + "key": "BULLETPROOF" + } + ] + }, + "cert_issuer": { + "total": 37, + "buckets": [ + { + "count": 11, + "key": "YR2" + }, + { + "count": 4, + "key": "Plesk" + }, + { + "count": 3, + "key": "YR1" + }, + { + "count": 2, + "key": "YE1" + }, + { + "count": 2, + "key": "YE2" + }, + { + "count": 2, + "key": "pbx.invisiontech.eu" + }, + { + "count": 1, + "key": "MySQL_Server_8.0.42_Auto_Generated_CA_Certificate" + }, + { + "count": 1, + "key": "OpenWrt" + }, + { + "count": 1, + "key": "www.fxzjqfcj6dilr.com" + } + ] + }, + "os": { + "total": 37, + "buckets": [ + { + "count": 12, + "key": "linux" + }, + { + "count": 2, + "key": "debian_linux" + }, + { + "count": 1, + "key": "centos" + }, + { + "count": 1, + "key": "proxmox" + } + ] + } + }, + "errors": [] + }, + { + "asn": "AS58854", + "name": "KAOPY", + "fields": { + "port": { + "total": 614, + "buckets": [ + { + "count": 181, + "key": "8887" + }, + { + "count": 175, + "key": "80" + }, + { + "count": 158, + "key": "443" + }, + { + "count": 113, + "key": "0" + }, + { + "count": 85, + "key": "18893" + }, + { + "count": 84, + "key": "18891" + }, + { + "count": 79, + "key": "111" + }, + { + "count": 78, + "key": "8888" + }, + { + "count": 77, + "key": "8081" + }, + { + "count": 74, + "key": "18890" + }, + { + "count": 74, + "key": "18892" + }, + { + "count": 74, + "key": "25001" + }, + { + "count": 73, + "key": "16257" + }, + { + "count": 73, + "key": "16259" + }, + { + "count": 73, + "key": "26257" + } + ] + }, + "software": { + "total": 614, + "buckets": [ + { + "count": 1191, + "key": "mysql" + }, + { + "count": 402, + "key": "nginx" + }, + { + "count": 291, + "key": "python" + }, + { + "count": 173, + "key": "wsgiserver" + }, + { + "count": 165, + "key": "jquery" + }, + { + "count": 155, + "key": "bootstrap" + }, + { + "count": 115, + "key": "simplehttp" + }, + { + "count": 103, + "key": "node_exporter" + }, + { + "count": 79, + "key": "openssh" + }, + { + "count": 77, + "key": "kestrel_web_server" + }, + { + "count": 76, + "key": "cadvisor" + }, + { + "count": 41, + "key": "http_api" + }, + { + "count": 36, + "key": "tengine" + }, + { + "count": 24, + "key": "openresty" + }, + { + "count": 16, + "key": "internet_information_services" + } + ] + }, + "labels": { + "total": 614, + "buckets": [ + { + "count": 614, + "key": "BULLETPROOF" + } + ] + }, + "cert_issuer": { + "total": 614, + "buckets": [ + { + "count": 47, + "key": "GlobalSign RSA OV SSL CA 2018" + }, + { + "count": 12, + "key": "TrustAsia DV TLS RSA CA 2025" + }, + { + "count": 11, + "key": "YR1" + }, + { + "count": 10, + "key": "FtpServer" + }, + { + "count": 8, + "key": "RapidSSL TLS RSA CA G1" + }, + { + "count": 7, + "key": "TrustAsia DV TLS RSA CA 2024" + }, + { + "count": 5, + "key": "IPMI" + }, + { + "count": 5, + "key": "WIN-RIK6D08VRRQ" + }, + { + "count": 4, + "key": "Firecloud Root Client Certification Authority" + }, + { + "count": 4, + "key": "Sectigo Public Server Authentication CA DV R36" + }, + { + "count": 4, + "key": "宝塔面板" + }, + { + "count": 3, + "key": "DigiCert Basic OV G2 TLS CN RSA4096 SHA256 2022 CA1" + }, + { + "count": 3, + "key": "TrustAsia TLS RSA CA" + }, + { + "count": 3, + "key": "WIN-M7O7840CVAH" + }, + { + "count": 2, + "key": "Certum DV TLS G2 R39 CA" + } + ] + }, + "os": { + "total": 614, + "buckets": [ + { + "count": 33, + "key": "linux" + }, + { + "count": 27, + "key": "windows" + }, + { + "count": 13, + "key": "ubuntu" + }, + { + "count": 2, + "key": "routeros" + }, + { + "count": 1, + "key": "centos" + } + ] + } + }, + "errors": [] + }, + { + "asn": "AS202685", + "name": "TR-ARKEL", + "fields": { + "port": { + "total": 4, + "buckets": [ + { + "count": 4, + "key": "80" + }, + { + "count": 2, + "key": "443" + } + ] + }, + "software": { + "total": 4, + "buckets": [ + { + "count": 4, + "key": "internet_information_services" + }, + { + "count": 2, + "key": "asp.net" + }, + { + "count": 2, + "key": "http_api" + } + ] + }, + "labels": { + "total": 4, + "buckets": [ + { + "count": 4, + "key": "BULLETPROOF" + } + ] + }, + "cert_issuer": { + "total": 4, + "buckets": [ + { + "count": 1, + "key": "GeoTrust TLS RSA CA G1" + }, + { + "count": 1, + "key": "YR1" + } + ] + }, + "os": { + "total": 4, + "buckets": [ + { + "count": 4, + "key": "windows" + } + ] + } + }, + "errors": [] + }, + { + "asn": "AS394711", + "name": "KORGRID", + "fields": { + "port": { + "total": 3, + "buckets": [ + { + "count": 2, + "key": "80" + }, + { + "count": 2, + "key": "443" + }, + { + "count": 1, + "key": "3389" + } + ] + }, + "software": { + "total": 3, + "buckets": [ + { + "count": 4, + "key": "bootstrap" + } + ] + }, + "labels": { + "total": 3, + "buckets": [ + { + "count": 3, + "key": "BULLETPROOF" + } + ] + }, + "cert_issuer": { + "total": 3, + "buckets": [ + { + "count": 2, + "key": "vergeos.local.root" + }, + { + "count": 1, + "key": "pcmrp-test" + } + ] + }, + "os": { + "total": 3, + "buckets": [] + } + }, + "errors": [] + } +] \ No newline at end of file diff --git a/kevlar/2026-09-07/censys/aggregations-AS138915.ndjson b/kevlar/2026-09-07/censys/aggregations-AS138915.ndjson new file mode 100644 index 0000000..210f587 --- /dev/null +++ b/kevlar/2026-09-07/censys/aggregations-AS138915.ndjson @@ -0,0 +1,5 @@ +{"asn":"AS138915","field":"host.services.port","total":12308,"buckets":[{"count":6621,"key":"22"},{"count":2412,"key":"32080"},{"count":2381,"key":"443"},{"count":2357,"key":"43080"},{"count":2255,"key":"80"},{"count":2242,"key":"40003"},{"count":2236,"key":"40801"},{"count":2233,"key":"40803"},{"count":2228,"key":"40804"},{"count":2198,"key":"40810"},{"count":872,"key":"123"},{"count":559,"key":"8080"},{"count":502,"key":"3389"},{"count":477,"key":"135"},{"count":475,"key":"3081"}]} +{"asn":"AS138915","field":"host.services.software.product","total":12308,"buckets":[{"count":7058,"key":"openssh"},{"count":6333,"key":"openresty"},{"count":4660,"key":"tengine"},{"count":2975,"key":"nginx"},{"count":866,"key":"http_api"},{"count":452,"key":"http_server"},{"count":384,"key":"express"},{"count":344,"key":"jquery"},{"count":249,"key":"bootstrap"},{"count":246,"key":"openvpn_access_server"},{"count":208,"key":"python"},{"count":205,"key":"squid"},{"count":199,"key":"node_exporter"},{"count":188,"key":"litespeed_web_server"},{"count":185,"key":"moment"}]} +{"asn":"AS138915","field":"host.labels.value","total":12308,"buckets":[{"count":12308,"key":"BULLETPROOF"},{"count":100,"key":"IPV6"}]} +{"asn":"AS138915","field":"host.services.cert.parsed.issuer.common_name","total":12308,"buckets":[{"count":4572,"key":"GlobalSign GCC R3 OV TLS CA 2024"},{"count":2333,"key":"localhost"},{"count":2290,"key":"prod-vpn.example.com"},{"count":2266,"key":"GlobalSign RSA OV SSL CA 2018"},{"count":2123,"key":"GlobalSign GCC R46 OV TLS CA 2025"},{"count":1190,"key":"Sectigo Public Server Authentication CA DV R36"},{"count":427,"key":"NONE"},{"count":412,"key":"WoTrus RSA DV SSL CA 2"},{"count":313,"key":"WIN-9QFKHJ39QE9"},{"count":312,"key":"YR1"},{"count":277,"key":"QY"},{"count":232,"key":"YR2"},{"count":211,"key":"YE1"},{"count":209,"key":"YE2"},{"count":172,"key":"tls.internal.ypc.org"}]} +{"asn":"AS138915","field":"host.operating_system.product","total":12308,"buckets":[{"count":5600,"key":"linux"},{"count":538,"key":"windows"},{"count":86,"key":"routeros"},{"count":30,"key":"ubuntu"},{"count":22,"key":"centos"},{"count":19,"key":"debian_linux"},{"count":11,"key":"adaptive_security_appliance_software"},{"count":10,"key":"proxmox"},{"count":4,"key":"linux_kernel"},{"count":1,"key":"freebsd"},{"count":1,"key":"ios"},{"count":1,"key":"junos"},{"count":1,"key":"netscaler"},{"count":1,"key":"pulse_connect_secure"},{"count":1,"key":"usg6655e_firmware"}]} diff --git a/kevlar/2026-09-07/censys/aggregations-AS140666.ndjson b/kevlar/2026-09-07/censys/aggregations-AS140666.ndjson new file mode 100644 index 0000000..31c88fb --- /dev/null +++ b/kevlar/2026-09-07/censys/aggregations-AS140666.ndjson @@ -0,0 +1,5 @@ +{"asn":"AS140666","field":"host.services.port","total":6562,"buckets":[{"count":4367,"key":"443"},{"count":4199,"key":"80"},{"count":2445,"key":"22"},{"count":1504,"key":"4667"},{"count":510,"key":"0"},{"count":376,"key":"6004"},{"count":376,"key":"6011"},{"count":375,"key":"6001"},{"count":375,"key":"6006"},{"count":375,"key":"6007"},{"count":375,"key":"6010"},{"count":375,"key":"6012"},{"count":375,"key":"6013"},{"count":375,"key":"6014"},{"count":375,"key":"6016"}]} +{"asn":"AS140666","field":"host.services.software.product","total":6562,"buckets":[{"count":8935,"key":"nginx"},{"count":3801,"key":"openssh"},{"count":140,"key":"openresty"},{"count":125,"key":"http_api"},{"count":80,"key":"jquery"},{"count":76,"key":"internet_information_services"},{"count":56,"key":"tengine"},{"count":52,"key":"bootstrap"},{"count":41,"key":"node_exporter"},{"count":36,"key":"express"},{"count":34,"key":"app_and_api_protector"},{"count":34,"key":"ghost"},{"count":34,"key":"wordpress"},{"count":29,"key":"python"},{"count":28,"key":"http_server"}]} +{"asn":"AS140666","field":"host.labels.value","total":6562,"buckets":[{"count":6562,"key":"BULLETPROOF"}]} +{"asn":"AS140666","field":"host.services.cert.parsed.issuer.common_name","total":6562,"buckets":[{"count":3804,"key":"USDTCDN"},{"count":347,"key":"Sectigo Public Server Authentication CA DV R36"},{"count":182,"key":"NONE"},{"count":132,"key":"RapidSSL TLS RSA CA G1"},{"count":123,"key":"tudog_node_agent._reserved.bytefcdn.com"},{"count":108,"key":"RTCTS"},{"count":97,"key":"GeoTrust TLS RSA CA G1"},{"count":97,"key":"QY"},{"count":65,"key":"RapidSSL TLS ECC CA G1"},{"count":61,"key":"tls.internal.ypc.org"},{"count":48,"key":"SG CA"},{"count":47,"key":"GlobalSign GCC R3 OV TLS CA 2024"},{"count":34,"key":"YR1"},{"count":33,"key":"Root CA"},{"count":32,"key":"GlobalSign GCC R46 OV TLS CA 2025"}]} +{"asn":"AS140666","field":"host.operating_system.product","total":6562,"buckets":[{"count":1100,"key":"linux"},{"count":94,"key":"windows"},{"count":13,"key":"ubuntu"},{"count":3,"key":"routeros"},{"count":2,"key":"adaptive_security_appliance_software"},{"count":2,"key":"debian_linux"},{"count":2,"key":"windows_server_2008_r2"},{"count":1,"key":"linux_kernel"},{"count":1,"key":"proxmox"}]} diff --git a/kevlar/2026-09-07/censys/aggregations-AS14956.ndjson b/kevlar/2026-09-07/censys/aggregations-AS14956.ndjson new file mode 100644 index 0000000..315f15c --- /dev/null +++ b/kevlar/2026-09-07/censys/aggregations-AS14956.ndjson @@ -0,0 +1,5 @@ +{"asn":"AS14956","field":"host.services.port","total":25632,"buckets":[{"count":15454,"key":"22"},{"count":8555,"key":"443"},{"count":7568,"key":"80"},{"count":7553,"key":"3389"},{"count":1143,"key":"5985"},{"count":1122,"key":"2096"},{"count":951,"key":"135"},{"count":870,"key":"8443"},{"count":812,"key":"445"},{"count":782,"key":"53"},{"count":666,"key":"25"},{"count":615,"key":"139"},{"count":599,"key":"8080"},{"count":582,"key":"21"},{"count":545,"key":"111"}]} +{"asn":"AS14956","field":"host.services.software.product","total":25632,"buckets":[{"count":14517,"key":"openssh"},{"count":10237,"key":"nginx"},{"count":2654,"key":"express"},{"count":1598,"key":"http_server"},{"count":1224,"key":"dovecot"},{"count":1155,"key":"http_api"},{"count":997,"key":"next.js"},{"count":906,"key":"google_web_services"},{"count":895,"key":"web_server"},{"count":751,"key":"caddy"},{"count":690,"key":"jquery"},{"count":599,"key":"internet_information_services"},{"count":570,"key":"php"},{"count":566,"key":"bootstrap"},{"count":503,"key":"python"}]} +{"asn":"AS14956","field":"host.labels.value","total":25632,"buckets":[{"count":25632,"key":"BULLETPROOF"},{"count":206,"key":"IPV6"}]} +{"asn":"AS14956","field":"host.services.cert.parsed.issuer.common_name","total":25632,"buckets":[{"count":2338,"key":"YE2"},{"count":1976,"key":"YE1"},{"count":993,"key":"windows-Dallas0"},{"count":985,"key":"YR1"},{"count":933,"key":"YR2"},{"count":915,"key":"invalid2.invalid"},{"count":481,"key":"windows-Utah-4g"},{"count":389,"key":"windows-Amsterd"},{"count":379,"key":"www.example.com"},{"count":351,"key":"windows-Utah-4H"},{"count":341,"key":"TRAEFIK DEFAULT CERT"},{"count":320,"key":"windows-Utah-2g"},{"count":288,"key":"AnyDesk Client"},{"count":278,"key":"Plesk"},{"count":238,"key":"windows-LasVega"}]} +{"asn":"AS14956","field":"host.operating_system.product","total":25632,"buckets":[{"count":13719,"key":"linux"},{"count":5476,"key":"windows"},{"count":210,"key":"ubuntu"},{"count":135,"key":"debian_linux"},{"count":97,"key":"routeros"},{"count":30,"key":"freebsd"},{"count":21,"key":"windows_server"},{"count":19,"key":"linux_kernel"},{"count":8,"key":"adaptive_security_appliance_software"},{"count":7,"key":"centos"},{"count":6,"key":"enterprise_linux"},{"count":6,"key":"proxmox"},{"count":3,"key":"windows_server_2012_r2"},{"count":2,"key":"openbsd"},{"count":1,"key":"linux_ami"}]} diff --git a/kevlar/2026-09-07/censys/aggregations-AS198953.ndjson b/kevlar/2026-09-07/censys/aggregations-AS198953.ndjson new file mode 100644 index 0000000..38b73cf --- /dev/null +++ b/kevlar/2026-09-07/censys/aggregations-AS198953.ndjson @@ -0,0 +1,5 @@ +{"asn":"AS198953","field":"host.services.port","total":359,"buckets":[{"count":167,"key":"22"},{"count":163,"key":"3389"},{"count":84,"key":"80"},{"count":81,"key":"443"},{"count":53,"key":"135"},{"count":42,"key":"137"},{"count":38,"key":"53"},{"count":37,"key":"5985"},{"count":36,"key":"139"},{"count":24,"key":"21"},{"count":24,"key":"123"},{"count":24,"key":"47001"},{"count":22,"key":"25"},{"count":20,"key":"993"},{"count":19,"key":"110"}]} +{"asn":"AS198953","field":"host.services.software.product","total":359,"buckets":[{"count":125,"key":"openssh"},{"count":124,"key":"nginx"},{"count":60,"key":"dovecot"},{"count":43,"key":"http_api"},{"count":33,"key":"express"},{"count":31,"key":"fastpanel"},{"count":30,"key":"http_server"},{"count":24,"key":"exim"},{"count":23,"key":"requirejs"},{"count":20,"key":"parallels_plesk_panel"},{"count":20,"key":"prototype"},{"count":17,"key":"proftpd"},{"count":14,"key":"plesk"},{"count":12,"key":"bind"},{"count":11,"key":"postfix"}]} +{"asn":"AS198953","field":"host.labels.value","total":359,"buckets":[{"count":359,"key":"BULLETPROOF"}]} +{"asn":"AS198953","field":"host.services.cert.parsed.issuer.common_name","total":359,"buckets":[{"count":23,"key":"Plesk"},{"count":19,"key":"YR1"},{"count":19,"key":"etc"},{"count":11,"key":"localhost"},{"count":9,"key":"AnyDesk Client"},{"count":9,"key":"R11"},{"count":8,"key":"FASTPANEL"},{"count":8,"key":"R12"},{"count":8,"key":"parking"},{"count":7,"key":"YR2"},{"count":7,"key":"dev-1.secure.host"},{"count":6,"key":"akrud-1.example.com"},{"count":6,"key":"mail.the-slasher.com"},{"count":6,"key":"xmoney-1.example.com"},{"count":5,"key":"DESKTOP-TCRDU4C"}]} +{"asn":"AS198953","field":"host.operating_system.product","total":359,"buckets":[{"count":118,"key":"linux"},{"count":40,"key":"windows"},{"count":2,"key":"debian_linux"},{"count":2,"key":"proxmox"},{"count":2,"key":"ubuntu"},{"count":1,"key":"adaptive_security_appliance_software"},{"count":1,"key":"freenas_firmware"},{"count":1,"key":"linux_kernel"},{"count":1,"key":"routeros"},{"count":1,"key":"vmware_esxi_server"},{"count":1,"key":"windows_server"}]} diff --git a/kevlar/2026-09-07/censys/aggregations-AS200593.ndjson b/kevlar/2026-09-07/censys/aggregations-AS200593.ndjson new file mode 100644 index 0000000..041390f --- /dev/null +++ b/kevlar/2026-09-07/censys/aggregations-AS200593.ndjson @@ -0,0 +1,5 @@ +{"asn":"AS200593","field":"host.services.port","total":340,"buckets":[{"count":193,"key":"22"},{"count":133,"key":"3389"},{"count":107,"key":"80"},{"count":80,"key":"443"},{"count":38,"key":"53"},{"count":29,"key":"135"},{"count":26,"key":"5985"},{"count":22,"key":"21"},{"count":21,"key":"25"},{"count":21,"key":"143"},{"count":21,"key":"993"},{"count":19,"key":"110"},{"count":17,"key":"137"},{"count":17,"key":"139"},{"count":16,"key":"8443"}]} +{"asn":"AS200593","field":"host.services.software.product","total":340,"buckets":[{"count":141,"key":"nginx"},{"count":133,"key":"openssh"},{"count":59,"key":"dovecot"},{"count":34,"key":"http_server"},{"count":32,"key":"parallels_plesk_panel"},{"count":32,"key":"prototype"},{"count":32,"key":"requirejs"},{"count":29,"key":"http_api"},{"count":27,"key":"express"},{"count":22,"key":"plesk"},{"count":21,"key":"exim"},{"count":15,"key":"cpanel"},{"count":14,"key":"proftpd"},{"count":11,"key":"postfix"},{"count":10,"key":"authoritative_server"}]} +{"asn":"AS200593","field":"host.labels.value","total":340,"buckets":[{"count":340,"key":"BULLETPROOF"}]} +{"asn":"AS200593","field":"host.services.cert.parsed.issuer.common_name","total":340,"buckets":[{"count":37,"key":"Plesk"},{"count":36,"key":"YR1"},{"count":27,"key":"YR2"},{"count":9,"key":"TRAEFIK DEFAULT CERT"},{"count":9,"key":"YE1"},{"count":8,"key":"R13"},{"count":8,"key":"blankilamalice-4.example.com"},{"count":8,"key":"devin-coo-1.example.com"},{"count":7,"key":"DESKTOP-GKGI28A"},{"count":7,"key":"R12"},{"count":7,"key":"ads-grab-2.example.com"},{"count":7,"key":"ckicksp-1.example.com"},{"count":5,"key":"benjamin-b-2.example.com"},{"count":4,"key":"AnyDesk Client"},{"count":4,"key":"etc"}]} +{"asn":"AS200593","field":"host.operating_system.product","total":340,"buckets":[{"count":133,"key":"linux"},{"count":25,"key":"windows"},{"count":3,"key":"proxmox"},{"count":2,"key":"debian_linux"},{"count":2,"key":"ubuntu"}]} diff --git a/kevlar/2026-09-07/censys/aggregations-AS200651.ndjson b/kevlar/2026-09-07/censys/aggregations-AS200651.ndjson new file mode 100644 index 0000000..d9cdd01 --- /dev/null +++ b/kevlar/2026-09-07/censys/aggregations-AS200651.ndjson @@ -0,0 +1,5 @@ +{"asn":"AS200651","field":"host.services.port","total":3824,"buckets":[{"count":2849,"key":"22"},{"count":2126,"key":"443"},{"count":1919,"key":"80"},{"count":385,"key":"53"},{"count":281,"key":"25"},{"count":235,"key":"587"},{"count":222,"key":"993"},{"count":192,"key":"111"},{"count":185,"key":"143"},{"count":167,"key":"110"},{"count":162,"key":"8080"},{"count":144,"key":"2096"},{"count":143,"key":"8443"},{"count":135,"key":"21"},{"count":97,"key":"9001"}]} +{"asn":"AS200651","field":"host.services.software.product","total":3824,"buckets":[{"count":2797,"key":"nginx"},{"count":2571,"key":"openssh"},{"count":554,"key":"dovecot"},{"count":449,"key":"http_server"},{"count":357,"key":"cpanel"},{"count":288,"key":"express"},{"count":270,"key":"caddy"},{"count":255,"key":"exim"},{"count":251,"key":"openresty"},{"count":197,"key":"authoritative_server"},{"count":183,"key":"next.js"},{"count":166,"key":"jquery"},{"count":159,"key":"postfix"},{"count":157,"key":"webmail"},{"count":133,"key":"traefik_proxy"}]} +{"asn":"AS200651","field":"host.labels.value","total":3824,"buckets":[{"count":3824,"key":"BULLETPROOF"},{"count":130,"key":"IPV6"}]} +{"asn":"AS200651","field":"host.services.cert.parsed.issuer.common_name","total":3824,"buckets":[{"count":705,"key":"YE1"},{"count":650,"key":"YE2"},{"count":599,"key":"YR2"},{"count":580,"key":"YR1"},{"count":133,"key":"TRAEFIK DEFAULT CERT"},{"count":102,"key":"invalid2.invalid"},{"count":59,"key":"localhost"},{"count":41,"key":"www.example.com"},{"count":40,"key":"GlobalSign Atlas R46 DV TLS CA 2026 Q3"},{"count":34,"key":"fin01.m-cr.org"},{"count":30,"key":"Sectigo Public Server Authentication CA DV R36"},{"count":28,"key":"GlobalSign RSA OV SSL CA 2018"},{"count":26,"key":"protect@DDoS-Filter.domain"},{"count":25,"key":"E7"},{"count":25,"key":"Proxmox Virtual Environment"}]} +{"asn":"AS200651","field":"host.operating_system.product","total":3824,"buckets":[{"count":2155,"key":"linux"},{"count":65,"key":"ubuntu"},{"count":45,"key":"debian_linux"},{"count":30,"key":"proxmox"},{"count":24,"key":"windows"},{"count":10,"key":"freebsd"},{"count":8,"key":"routeros"},{"count":6,"key":"enterprise_linux"},{"count":6,"key":"openbsd"},{"count":5,"key":"centos"},{"count":3,"key":"windows_server_2008_r2"},{"count":1,"key":"ilo_3"},{"count":1,"key":"linux_kernel"},{"count":1,"key":"openmediavault"},{"count":1,"key":"sonicos"}]} diff --git a/kevlar/2026-09-07/censys/aggregations-AS202685.ndjson b/kevlar/2026-09-07/censys/aggregations-AS202685.ndjson new file mode 100644 index 0000000..b19c59b --- /dev/null +++ b/kevlar/2026-09-07/censys/aggregations-AS202685.ndjson @@ -0,0 +1,5 @@ +{"asn":"AS202685","field":"host.services.port","total":4,"buckets":[{"count":4,"key":"80"},{"count":2,"key":"443"}]} +{"asn":"AS202685","field":"host.services.software.product","total":4,"buckets":[{"count":4,"key":"internet_information_services"},{"count":2,"key":"asp.net"},{"count":2,"key":"http_api"}]} +{"asn":"AS202685","field":"host.labels.value","total":4,"buckets":[{"count":4,"key":"BULLETPROOF"}]} +{"asn":"AS202685","field":"host.services.cert.parsed.issuer.common_name","total":4,"buckets":[{"count":1,"key":"GeoTrust TLS RSA CA G1"},{"count":1,"key":"YR1"}]} +{"asn":"AS202685","field":"host.operating_system.product","total":4,"buckets":[{"count":4,"key":"windows"}]} diff --git a/kevlar/2026-09-07/censys/aggregations-AS206728.ndjson b/kevlar/2026-09-07/censys/aggregations-AS206728.ndjson new file mode 100644 index 0000000..edc1abc --- /dev/null +++ b/kevlar/2026-09-07/censys/aggregations-AS206728.ndjson @@ -0,0 +1,5 @@ +{"asn":"AS206728","field":"host.services.port","total":15,"buckets":[{"count":5,"key":"443"},{"count":3,"key":"22"},{"count":2,"key":"80"},{"count":1,"key":"111"},{"count":1,"key":"137"},{"count":1,"key":"3389"},{"count":1,"key":"5900"},{"count":1,"key":"5902"},{"count":1,"key":"5903"},{"count":1,"key":"8080"}]} +{"asn":"AS206728","field":"host.services.software.product","total":15,"buckets":[{"count":4,"key":"nginx"},{"count":2,"key":"openssh"}]} +{"asn":"AS206728","field":"host.labels.value","total":15,"buckets":[{"count":15,"key":"BULLETPROOF"},{"count":5,"key":"IPV6"}]} +{"asn":"AS206728","field":"host.services.cert.parsed.issuer.common_name","total":15,"buckets":[{"count":2,"key":"GlobalSign RSA OV SSL CA 2018"},{"count":1,"key":"WIN-UKID351J32A"},{"count":1,"key":"YE1"},{"count":1,"key":"invalid2.invalid"}]} +{"asn":"AS206728","field":"host.operating_system.product","total":15,"buckets":[{"count":1,"key":"linux"},{"count":1,"key":"routeros"}]} diff --git a/kevlar/2026-09-07/censys/aggregations-AS209847.ndjson b/kevlar/2026-09-07/censys/aggregations-AS209847.ndjson new file mode 100644 index 0000000..f4ea3cd --- /dev/null +++ b/kevlar/2026-09-07/censys/aggregations-AS209847.ndjson @@ -0,0 +1,5 @@ +{"asn":"AS209847","field":"host.services.port","total":1458,"buckets":[{"count":884,"key":"22"},{"count":423,"key":"443"},{"count":413,"key":"8080"},{"count":404,"key":"53"},{"count":370,"key":"1030"},{"count":370,"key":"1050"},{"count":370,"key":"24442"},{"count":368,"key":"1234"},{"count":368,"key":"1235"},{"count":337,"key":"80"},{"count":207,"key":"1500"},{"count":200,"key":"21"},{"count":182,"key":"1501"},{"count":109,"key":"2096"},{"count":92,"key":"25"}]} +{"asn":"AS209847","field":"host.services.software.product","total":1458,"buckets":[{"count":1126,"key":"python"},{"count":1116,"key":"openssh"},{"count":1112,"key":"aiohttp"},{"count":670,"key":"nginx"},{"count":357,"key":"bind"},{"count":291,"key":"dovecot"},{"count":204,"key":"exim"},{"count":195,"key":"proftpd"},{"count":133,"key":"google_web_services"},{"count":133,"key":"web_server"},{"count":45,"key":"app_and_api_protector"},{"count":45,"key":"express"},{"count":45,"key":"ghost"},{"count":42,"key":"bootstrap"},{"count":38,"key":"http_server"}]} +{"asn":"AS209847","field":"host.labels.value","total":1458,"buckets":[{"count":1458,"key":"BULLETPROOF"},{"count":5,"key":"IPV6"}]} +{"asn":"AS209847","field":"host.services.cert.parsed.issuer.common_name","total":1458,"buckets":[{"count":217,"key":"YR2"},{"count":184,"key":"YR1"},{"count":133,"key":"invalid2.invalid"},{"count":127,"key":"YE2"},{"count":116,"key":"YE1"},{"count":34,"key":"server"},{"count":24,"key":"GlobalSign RSA OV SSL CA 2018"},{"count":20,"key":"GeoTrust TLS RSA CA G1"},{"count":15,"key":"Sectigo Public Server Authentication CA DV E36"},{"count":14,"key":"GlobalSign Atlas R46 DV TLS CA 2026 Q3"},{"count":14,"key":"Microsoft TLS G2 RSA CA OCSP 04"},{"count":13,"key":"vm15882839.example.com"},{"count":11,"key":"DigiCert Global G2 TLS RSA SHA256 2020 CA1"},{"count":10,"key":"R13"},{"count":9,"key":"dmitrievd1.example.com"}]} +{"asn":"AS209847","field":"host.operating_system.product","total":1458,"buckets":[{"count":1098,"key":"linux"},{"count":14,"key":"windows"},{"count":7,"key":"ubuntu"},{"count":5,"key":"routeros"},{"count":2,"key":"linux_kernel"},{"count":1,"key":"adaptive_security_appliance_software"},{"count":1,"key":"debian_linux"}]} diff --git a/kevlar/2026-09-07/censys/aggregations-AS210644.ndjson b/kevlar/2026-09-07/censys/aggregations-AS210644.ndjson new file mode 100644 index 0000000..dc95421 --- /dev/null +++ b/kevlar/2026-09-07/censys/aggregations-AS210644.ndjson @@ -0,0 +1,5 @@ +{"asn":"AS210644","field":"host.services.port","total":71701,"buckets":[{"count":62026,"key":"22"},{"count":35342,"key":"443"},{"count":18338,"key":"80"},{"count":12259,"key":"2096"},{"count":8310,"key":"8443"},{"count":6116,"key":"8080"},{"count":3493,"key":"2053"},{"count":2001,"key":"2222"},{"count":1715,"key":"3389"},{"count":1172,"key":"53"},{"count":1165,"key":"51821"},{"count":1085,"key":"25"},{"count":1068,"key":"3000"},{"count":1062,"key":"8000"},{"count":862,"key":"9443"}]} +{"asn":"AS210644","field":"host.services.software.product","total":71701,"buckets":[{"count":61391,"key":"openssh"},{"count":30077,"key":"nginx"},{"count":7276,"key":"google_web_services"},{"count":7275,"key":"web_server"},{"count":5365,"key":"ghost"},{"count":5360,"key":"app_and_api_protector"},{"count":4102,"key":"express"},{"count":3511,"key":"caddy"},{"count":3140,"key":"waf"},{"count":2924,"key":"cloudflare_load_balancer"},{"count":2008,"key":"uvicorn"},{"count":1919,"key":"next.js"},{"count":1629,"key":"http_server"},{"count":1582,"key":"python"},{"count":1578,"key":"jquery"}]} +{"asn":"AS210644","field":"host.labels.value","total":71701,"buckets":[{"count":71701,"key":"BULLETPROOF"},{"count":499,"key":"IPV6"}]} +{"asn":"AS210644","field":"host.services.cert.parsed.issuer.common_name","total":71701,"buckets":[{"count":14987,"key":"YE2"},{"count":12936,"key":"YE1"},{"count":7359,"key":"invalid2.invalid"},{"count":3525,"key":"HARICA DV TLS RSA"},{"count":3217,"key":"YR1"},{"count":2129,"key":"GeoTrust TLS RSA CA G1"},{"count":1981,"key":"YR2"},{"count":1750,"key":"GlobalSign RSA OV SSL CA 2018"},{"count":1301,"key":"Microsoft TLS G2 RSA CA OCSP 04"},{"count":1278,"key":"GlobalSign ECC OV SSL CA 2018"},{"count":1025,"key":"Apple Public EV Server RSA CA 1 - G1"},{"count":965,"key":"DigiCert Global G2 TLS RSA SHA256 2020 CA1"},{"count":916,"key":"TRAEFIK DEFAULT CERT"},{"count":774,"key":"GlobalSign Atlas R46 DV TLS CA 2026 Q3"},{"count":760,"key":"Sectigo Public Server Authentication CA DV E36"}]} +{"asn":"AS210644","field":"host.operating_system.product","total":71701,"buckets":[{"count":59980,"key":"linux"},{"count":740,"key":"ubuntu"},{"count":561,"key":"windows"},{"count":201,"key":"debian_linux"},{"count":92,"key":"routeros"},{"count":90,"key":"linux_kernel"},{"count":33,"key":"adaptive_security_appliance_software"},{"count":16,"key":"linux_ami"},{"count":14,"key":"centos"},{"count":11,"key":"windows_server"},{"count":7,"key":"freebsd"},{"count":3,"key":"dsm"},{"count":2,"key":"enterprise_linux"},{"count":1,"key":"ios"},{"count":1,"key":"macos"}]} diff --git a/kevlar/2026-09-07/censys/aggregations-AS211720.ndjson b/kevlar/2026-09-07/censys/aggregations-AS211720.ndjson new file mode 100644 index 0000000..5821b8d --- /dev/null +++ b/kevlar/2026-09-07/censys/aggregations-AS211720.ndjson @@ -0,0 +1,5 @@ +{"asn":"AS211720","field":"host.services.port","total":49,"buckets":[{"count":28,"key":"22"},{"count":18,"key":"3389"},{"count":14,"key":"179"},{"count":9,"key":"80"},{"count":7,"key":"443"},{"count":6,"key":"111"},{"count":6,"key":"5985"},{"count":3,"key":"8080"},{"count":3,"key":"8081"},{"count":2,"key":"135"},{"count":2,"key":"137"},{"count":2,"key":"5357"},{"count":1,"key":"53"},{"count":1,"key":"139"},{"count":1,"key":"445"}]} +{"asn":"AS211720","field":"host.services.software.product","total":49,"buckets":[{"count":25,"key":"openssh"},{"count":11,"key":"nginx"},{"count":6,"key":"http_api"},{"count":2,"key":"next.js"},{"count":2,"key":"tor"},{"count":1,"key":"caddy"},{"count":1,"key":"dropbear_ssh"},{"count":1,"key":"gunicorn"},{"count":1,"key":"http_server"},{"count":1,"key":"libupnp"},{"count":1,"key":"mariadb"}]} +{"asn":"AS211720","field":"host.labels.value","total":49,"buckets":[{"count":49,"key":"BULLETPROOF"}]} +{"asn":"AS211720","field":"host.services.cert.parsed.issuer.common_name","total":49,"buckets":[{"count":3,"key":"IPMI"},{"count":2,"key":"FREE"},{"count":2,"key":"YE1"},{"count":1,"key":"WIN-JDCEOBUFJUS"},{"count":1,"key":"WIN-JP7KUDECHOR"},{"count":1,"key":"YE2"},{"count":1,"key":"YR2"},{"count":1,"key":"agent-ca@1757674441"},{"count":1,"key":"agent-ca@1757925038"},{"count":1,"key":"agent-ca@1759158944"},{"count":1,"key":"bad-raven-crab"},{"count":1,"key":"bright-magenta-"},{"count":1,"key":"eth0"},{"count":1,"key":"gentle-red-bee"},{"count":1,"key":"greedy-cream-ha"}]} +{"asn":"AS211720","field":"host.operating_system.product","total":49,"buckets":[{"count":10,"key":"linux"},{"count":4,"key":"windows"},{"count":1,"key":"debian_linux"}]} diff --git a/kevlar/2026-09-07/censys/aggregations-AS213702.ndjson b/kevlar/2026-09-07/censys/aggregations-AS213702.ndjson new file mode 100644 index 0000000..2093aed --- /dev/null +++ b/kevlar/2026-09-07/censys/aggregations-AS213702.ndjson @@ -0,0 +1,5 @@ +{"asn":"AS213702","field":"host.services.port","total":7681,"buckets":[{"count":6701,"key":"22"},{"count":4574,"key":"443"},{"count":2232,"key":"2222"},{"count":2163,"key":"80"},{"count":775,"key":"8443"},{"count":678,"key":"2096"},{"count":371,"key":"3389"},{"count":236,"key":"8080"},{"count":199,"key":"2053"},{"count":171,"key":"9443"},{"count":129,"key":"3000"},{"count":124,"key":"4443"},{"count":93,"key":"8000"},{"count":89,"key":"445"},{"count":81,"key":"2083"}]} +{"asn":"AS213702","field":"host.services.software.product","total":7681,"buckets":[{"count":6428,"key":"openssh"},{"count":3432,"key":"nginx"},{"count":643,"key":"caddy"},{"count":479,"key":"google_web_services"},{"count":479,"key":"web_server"},{"count":449,"key":"app_and_api_protector"},{"count":449,"key":"ghost"},{"count":297,"key":"waf"},{"count":285,"key":"cloudflare_load_balancer"},{"count":261,"key":"express"},{"count":235,"key":"next.js"},{"count":200,"key":"openresty"},{"count":188,"key":"uvicorn"},{"count":132,"key":"http_server"},{"count":127,"key":"bootstrap"}]} +{"asn":"AS213702","field":"host.labels.value","total":7681,"buckets":[{"count":7681,"key":"BULLETPROOF"},{"count":18,"key":"IPV6"}]} +{"asn":"AS213702","field":"host.services.cert.parsed.issuer.common_name","total":7681,"buckets":[{"count":1384,"key":"YE2"},{"count":1093,"key":"YE1"},{"count":775,"key":"2LqvyXLUXjAf2MoZx6VEPgJuz1349naDyLo"},{"count":498,"key":"invalid2.invalid"},{"count":310,"key":"NvJhHp68p5mjSuW_EK9Lab6bH9"},{"count":300,"key":"GlobalSign Atlas R3 DV TLS CA 2026 Q2"},{"count":235,"key":"YR1"},{"count":227,"key":"GeoTrust TLS RSA CA G1"},{"count":220,"key":"zAqJHcz8C2V0TC9uVVmwYr8jbL2sjgaT_5"},{"count":188,"key":"YR2"},{"count":181,"key":"HARICA DV TLS RSA"},{"count":145,"key":"GlobalSign RSA OV SSL CA 2018"},{"count":139,"key":"WR1"},{"count":122,"key":"Apple Public EV Server RSA CA 1 - G1"},{"count":110,"key":"GlobalSign ECC OV SSL CA 2018"}]} +{"asn":"AS213702","field":"host.operating_system.product","total":7681,"buckets":[{"count":6310,"key":"linux"},{"count":65,"key":"ubuntu"},{"count":65,"key":"windows"},{"count":12,"key":"debian_linux"},{"count":10,"key":"linux_kernel"},{"count":2,"key":"enterprise_linux"},{"count":1,"key":"linux_ami"}]} diff --git a/kevlar/2026-09-07/censys/aggregations-AS214351.ndjson b/kevlar/2026-09-07/censys/aggregations-AS214351.ndjson new file mode 100644 index 0000000..fc70f00 --- /dev/null +++ b/kevlar/2026-09-07/censys/aggregations-AS214351.ndjson @@ -0,0 +1,5 @@ +{"asn":"AS214351","field":"host.services.port","total":744,"buckets":[{"count":564,"key":"80"},{"count":559,"key":"22"},{"count":363,"key":"443"},{"count":103,"key":"21"},{"count":99,"key":"53"},{"count":97,"key":"25"},{"count":90,"key":"587"},{"count":89,"key":"143"},{"count":89,"key":"993"},{"count":87,"key":"8085"},{"count":86,"key":"110"},{"count":86,"key":"22509"},{"count":78,"key":"3389"},{"count":49,"key":"8888"},{"count":41,"key":"7777"}]} +{"asn":"AS214351","field":"host.services.software.product","total":744,"buckets":[{"count":841,"key":"nginx"},{"count":610,"key":"openssh"},{"count":296,"key":"express"},{"count":228,"key":"dovecot"},{"count":173,"key":"fastpanel"},{"count":155,"key":"exim"},{"count":107,"key":"next.js"},{"count":84,"key":"http_server"},{"count":62,"key":"proftpd"},{"count":40,"key":"http_api"},{"count":29,"key":"bootstrap"},{"count":25,"key":"php"},{"count":25,"key":"uvicorn"},{"count":21,"key":"jquery"},{"count":20,"key":"bind"}]} +{"asn":"AS214351","field":"host.labels.value","total":744,"buckets":[{"count":744,"key":"BULLETPROOF"}]} +{"asn":"AS214351","field":"host.services.cert.parsed.issuer.common_name","total":744,"buckets":[{"count":110,"key":"etc"},{"count":58,"key":"YR1"},{"count":55,"key":"YR2"},{"count":52,"key":"vm4660.defhost.co"},{"count":45,"key":"FASTPANEL"},{"count":43,"key":"parking"},{"count":39,"key":"YE2"},{"count":34,"key":"YE1"},{"count":30,"key":"misp.goodip"},{"count":14,"key":"vm4980.defhost.co"},{"count":12,"key":"tech0.test"},{"count":10,"key":"localhost"},{"count":9,"key":"amgel.yop.nail"},{"count":9,"key":"def.host.vm"},{"count":9,"key":"info.devser.loc"}]} +{"asn":"AS214351","field":"host.operating_system.product","total":744,"buckets":[{"count":538,"key":"linux"},{"count":34,"key":"windows"},{"count":6,"key":"linux_kernel"},{"count":3,"key":"ubuntu"},{"count":1,"key":"centos"},{"count":1,"key":"debian_linux"},{"count":1,"key":"windows_server"}]} diff --git a/kevlar/2026-09-07/censys/aggregations-AS214940.ndjson b/kevlar/2026-09-07/censys/aggregations-AS214940.ndjson new file mode 100644 index 0000000..70f8e12 --- /dev/null +++ b/kevlar/2026-09-07/censys/aggregations-AS214940.ndjson @@ -0,0 +1,5 @@ +{"asn":"AS214940","field":"host.services.port","total":0,"buckets":[]} +{"asn":"AS214940","field":"host.services.software.product","total":0,"buckets":[]} +{"asn":"AS214940","field":"host.labels.value","total":0,"buckets":[]} +{"asn":"AS214940","field":"host.services.cert.parsed.issuer.common_name","total":0,"buckets":[]} +{"asn":"AS214940","field":"host.operating_system.product","total":0,"buckets":[]} diff --git a/kevlar/2026-09-07/censys/aggregations-AS216139.ndjson b/kevlar/2026-09-07/censys/aggregations-AS216139.ndjson new file mode 100644 index 0000000..5847748 --- /dev/null +++ b/kevlar/2026-09-07/censys/aggregations-AS216139.ndjson @@ -0,0 +1,5 @@ +{"asn":"AS216139","field":"host.services.port","total":8797,"buckets":[{"count":5381,"key":"22"},{"count":3417,"key":"443"},{"count":2110,"key":"80"},{"count":928,"key":"51821"},{"count":787,"key":"53"},{"count":641,"key":"21"},{"count":606,"key":"2096"},{"count":463,"key":"25"},{"count":455,"key":"993"},{"count":444,"key":"143"},{"count":428,"key":"3306"},{"count":416,"key":"110"},{"count":399,"key":"587"},{"count":369,"key":"8443"},{"count":348,"key":"1500"}]} +{"asn":"AS216139","field":"host.services.software.product","total":8797,"buckets":[{"count":4419,"key":"openssh"},{"count":3457,"key":"nginx"},{"count":1467,"key":"dovecot"},{"count":932,"key":"exim"},{"count":901,"key":"wg-easy"},{"count":711,"key":"express"},{"count":656,"key":"google_web_services"},{"count":656,"key":"web_server"},{"count":553,"key":"ddos-guard"},{"count":429,"key":"http_server"},{"count":390,"key":"bind"},{"count":338,"key":"app_and_api_protector"},{"count":338,"key":"ghost"},{"count":292,"key":"php"},{"count":283,"key":"mysql"}]} +{"asn":"AS216139","field":"host.labels.value","total":8797,"buckets":[{"count":8797,"key":"BULLETPROOF"},{"count":4,"key":"IPV6"}]} +{"asn":"AS216139","field":"host.services.cert.parsed.issuer.common_name","total":8797,"buckets":[{"count":751,"key":"YE2"},{"count":710,"key":"invalid2.invalid"},{"count":618,"key":"YE1"},{"count":459,"key":"GlobalSign GCC R6 AlphaSSL CA 2025"},{"count":262,"key":"idrac"},{"count":231,"key":"YR1"},{"count":219,"key":"YR2"},{"count":216,"key":"isp13.eurobyte.ru"},{"count":193,"key":"MySQL_Server_5.7.22-22_Auto_Generated_CA_Certificate"},{"count":141,"key":"DigiCert Global G2 TLS RSA SHA256 2020 CA1"},{"count":140,"key":"vps1.dev.mchost.ru"},{"count":116,"key":"vps1.dev.eurobyte.ru"},{"count":113,"key":"etc"},{"count":98,"key":"isp15.eurobyte.ru"},{"count":94,"key":"GeoTrust TLS RSA CA G1"}]} +{"asn":"AS216139","field":"host.operating_system.product","total":8797,"buckets":[{"count":3705,"key":"linux"},{"count":190,"key":"ubuntu"},{"count":67,"key":"routeros"},{"count":53,"key":"enterprise_linux"},{"count":39,"key":"debian_linux"},{"count":26,"key":"centos"},{"count":11,"key":"adaptive_security_appliance_software"},{"count":6,"key":"freebsd"},{"count":3,"key":"linux_ami"},{"count":2,"key":"linux_kernel"},{"count":2,"key":"windows"}]} diff --git a/kevlar/2026-09-07/censys/aggregations-AS216246.ndjson b/kevlar/2026-09-07/censys/aggregations-AS216246.ndjson new file mode 100644 index 0000000..7f3584b --- /dev/null +++ b/kevlar/2026-09-07/censys/aggregations-AS216246.ndjson @@ -0,0 +1,5 @@ +{"asn":"AS216246","field":"host.services.port","total":6960,"buckets":[{"count":5620,"key":"22"},{"count":4211,"key":"443"},{"count":3289,"key":"80"},{"count":688,"key":"8443"},{"count":657,"key":"2096"},{"count":389,"key":"8080"},{"count":331,"key":"2222"},{"count":305,"key":"3389"},{"count":194,"key":"3000"},{"count":172,"key":"3478"},{"count":162,"key":"25"},{"count":162,"key":"53"},{"count":130,"key":"2053"},{"count":128,"key":"993"},{"count":127,"key":"5985"}]} +{"asn":"AS216246","field":"host.services.software.product","total":6960,"buckets":[{"count":5168,"key":"openssh"},{"count":4990,"key":"nginx"},{"count":672,"key":"caddy"},{"count":498,"key":"express"},{"count":455,"key":"next.js"},{"count":271,"key":"dovecot"},{"count":240,"key":"ghost"},{"count":239,"key":"app_and_api_protector"},{"count":235,"key":"traefik_proxy"},{"count":183,"key":"fastpanel"},{"count":182,"key":"waf"},{"count":177,"key":"http_server"},{"count":175,"key":"uvicorn"},{"count":174,"key":"google_web_services"},{"count":174,"key":"web_server"}]} +{"asn":"AS216246","field":"host.labels.value","total":6960,"buckets":[{"count":6960,"key":"BULLETPROOF"},{"count":133,"key":"IPV6"}]} +{"asn":"AS216246","field":"host.services.cert.parsed.issuer.common_name","total":6960,"buckets":[{"count":1428,"key":"YE2"},{"count":1332,"key":"YE1"},{"count":261,"key":"YR1"},{"count":235,"key":"TRAEFIK DEFAULT CERT"},{"count":231,"key":"GlobalSign ECC OV SSL CA 2018"},{"count":224,"key":"HARICA DV TLS RSA"},{"count":180,"key":"invalid2.invalid"},{"count":176,"key":"YR2"},{"count":143,"key":"GlobalSign RSA OV SSL CA 2018"},{"count":128,"key":"WR1"},{"count":86,"key":"GeoTrust TLS RSA CA G1"},{"count":85,"key":"etc"},{"count":81,"key":"WIN-4NFSE1QOBMS"},{"count":69,"key":"Microsoft TLS G2 RSA CA OCSP 04"},{"count":58,"key":"GlobalSign GCC R46 OV TLS CA 2025"}]} +{"asn":"AS216246","field":"host.operating_system.product","total":6960,"buckets":[{"count":5015,"key":"linux"},{"count":246,"key":"ubuntu"},{"count":134,"key":"windows"},{"count":31,"key":"debian_linux"},{"count":8,"key":"routeros"},{"count":7,"key":"linux_kernel"},{"count":3,"key":"proxmox"},{"count":2,"key":"adaptive_security_appliance_software"},{"count":2,"key":"windows_server"},{"count":1,"key":"centos"},{"count":1,"key":"freebsd"},{"count":1,"key":"megarac_spx"},{"count":1,"key":"windows_server_2012_r2"}]} diff --git a/kevlar/2026-09-07/censys/aggregations-AS216309.ndjson b/kevlar/2026-09-07/censys/aggregations-AS216309.ndjson new file mode 100644 index 0000000..3ee6d0b --- /dev/null +++ b/kevlar/2026-09-07/censys/aggregations-AS216309.ndjson @@ -0,0 +1,5 @@ +{"asn":"AS216309","field":"host.services.port","total":37,"buckets":[{"count":35,"key":"22"},{"count":13,"key":"80"},{"count":8,"key":"443"},{"count":4,"key":"111"},{"count":2,"key":"25"},{"count":2,"key":"53"},{"count":2,"key":"110"},{"count":2,"key":"143"},{"count":2,"key":"161"},{"count":2,"key":"993"},{"count":2,"key":"3306"},{"count":2,"key":"4190"},{"count":2,"key":"5060"},{"count":2,"key":"8087"},{"count":2,"key":"8443"}]} +{"asn":"AS216309","field":"host.services.software.product","total":37,"buckets":[{"count":25,"key":"openssh"},{"count":16,"key":"nginx"},{"count":10,"key":"http_server"},{"count":9,"key":"express"},{"count":7,"key":"dovecot"},{"count":6,"key":"bootstrap"},{"count":6,"key":"php"},{"count":5,"key":"prototype"},{"count":4,"key":"jquery"},{"count":4,"key":"openssl"},{"count":3,"key":"parallels_plesk_panel"},{"count":3,"key":"requirejs"},{"count":2,"key":"lodash"},{"count":2,"key":"plesk"},{"count":2,"key":"pve"}]} +{"asn":"AS216309","field":"host.labels.value","total":37,"buckets":[{"count":37,"key":"BULLETPROOF"}]} +{"asn":"AS216309","field":"host.services.cert.parsed.issuer.common_name","total":37,"buckets":[{"count":11,"key":"YR2"},{"count":4,"key":"Plesk"},{"count":3,"key":"YR1"},{"count":2,"key":"YE1"},{"count":2,"key":"YE2"},{"count":2,"key":"pbx.invisiontech.eu"},{"count":1,"key":"MySQL_Server_8.0.42_Auto_Generated_CA_Certificate"},{"count":1,"key":"OpenWrt"},{"count":1,"key":"www.fxzjqfcj6dilr.com"}]} +{"asn":"AS216309","field":"host.operating_system.product","total":37,"buckets":[{"count":12,"key":"linux"},{"count":2,"key":"debian_linux"},{"count":1,"key":"centos"},{"count":1,"key":"proxmox"}]} diff --git a/kevlar/2026-09-07/censys/aggregations-AS30823.ndjson b/kevlar/2026-09-07/censys/aggregations-AS30823.ndjson new file mode 100644 index 0000000..d8bcc20 --- /dev/null +++ b/kevlar/2026-09-07/censys/aggregations-AS30823.ndjson @@ -0,0 +1,5 @@ +{"asn":"AS30823","field":"host.services.port","total":2178,"buckets":[{"count":1274,"key":"22"},{"count":855,"key":"443"},{"count":651,"key":"80"},{"count":476,"key":"53"},{"count":379,"key":"27015"},{"count":300,"key":"3389"},{"count":122,"key":"8443"},{"count":120,"key":"25"},{"count":99,"key":"2096"},{"count":80,"key":"8080"},{"count":63,"key":"135"},{"count":61,"key":"111"},{"count":61,"key":"5985"},{"count":55,"key":"445"},{"count":52,"key":"2222"}]} +{"asn":"AS30823","field":"host.services.software.product","total":2178,"buckets":[{"count":1148,"key":"openssh"},{"count":850,"key":"nginx"},{"count":201,"key":"express"},{"count":134,"key":"http_server"},{"count":104,"key":"google_web_services"},{"count":104,"key":"web_server"},{"count":100,"key":"http_api"},{"count":92,"key":"dovecot"},{"count":73,"key":"next.js"},{"count":70,"key":"caddy"},{"count":70,"key":"postfix"},{"count":69,"key":"app_and_api_protector"},{"count":69,"key":"ghost"},{"count":67,"key":"cloudflare_load_balancer"},{"count":67,"key":"waf"}]} +{"asn":"AS30823","field":"host.labels.value","total":2178,"buckets":[{"count":2178,"key":"BULLETPROOF"},{"count":29,"key":"IPV6"}]} +{"asn":"AS30823","field":"host.services.cert.parsed.issuer.common_name","total":2178,"buckets":[{"count":237,"key":"YE2"},{"count":222,"key":"YE1"},{"count":112,"key":"invalid2.invalid"},{"count":99,"key":"YR2"},{"count":83,"key":"YR1"},{"count":60,"key":"windows-DE-Fran"},{"count":57,"key":"172.86.93"},{"count":52,"key":"GoGetSSL RSA DV CA"},{"count":51,"key":"windows-Frankfu"},{"count":27,"key":"localhost"},{"count":25,"key":"WIN-8OA3CCQAE4D"},{"count":24,"key":"Plesk"},{"count":22,"key":"Apple Public EV Server RSA CA 1 - G1"},{"count":21,"key":"DigiCert Global G2 TLS RSA SHA256 2020 CA1"},{"count":21,"key":"RapidSSL TLS RSA CA G1"}]} +{"asn":"AS30823","field":"host.operating_system.product","total":2178,"buckets":[{"count":1080,"key":"linux"},{"count":159,"key":"windows"},{"count":20,"key":"proxmox"},{"count":19,"key":"routeros"},{"count":15,"key":"ubuntu"},{"count":14,"key":"debian_linux"},{"count":9,"key":"centos"},{"count":6,"key":"freebsd"},{"count":3,"key":"adaptive_security_appliance_software"},{"count":3,"key":"megarac_spx"},{"count":3,"key":"windows_server"},{"count":1,"key":"ios"},{"count":1,"key":"linux_kernel"},{"count":1,"key":"vmware_esxi_server"}]} diff --git a/kevlar/2026-09-07/censys/aggregations-AS33993.ndjson b/kevlar/2026-09-07/censys/aggregations-AS33993.ndjson new file mode 100644 index 0000000..d370d69 --- /dev/null +++ b/kevlar/2026-09-07/censys/aggregations-AS33993.ndjson @@ -0,0 +1,5 @@ +{"asn":"AS33993","field":"host.services.port","total":4692,"buckets":[{"count":3082,"key":"22"},{"count":1914,"key":"443"},{"count":1900,"key":"80"},{"count":1295,"key":"53"},{"count":654,"key":"21"},{"count":592,"key":"3000"},{"count":506,"key":"1500"},{"count":497,"key":"25"},{"count":489,"key":"65534"},{"count":475,"key":"993"},{"count":466,"key":"143"},{"count":463,"key":"587"},{"count":457,"key":"110"},{"count":427,"key":"1501"},{"count":288,"key":"2096"}]} +{"asn":"AS33993","field":"host.services.software.product","total":4692,"buckets":[{"count":3541,"key":"nginx"},{"count":3202,"key":"openssh"},{"count":1488,"key":"dovecot"},{"count":1026,"key":"bind"},{"count":1015,"key":"exim"},{"count":514,"key":"proftpd"},{"count":363,"key":"express"},{"count":291,"key":"python"},{"count":227,"key":"aiohttp"},{"count":209,"key":"caddy"},{"count":180,"key":"http_server"},{"count":163,"key":"bootstrap"},{"count":143,"key":"jquery"},{"count":130,"key":"next.js"},{"count":116,"key":"traefik_proxy"}]} +{"asn":"AS33993","field":"host.labels.value","total":4692,"buckets":[{"count":4692,"key":"BULLETPROOF"},{"count":10,"key":"IPV6"}]} +{"asn":"AS33993","field":"host.services.cert.parsed.issuer.common_name","total":4692,"buckets":[{"count":598,"key":"YR1"},{"count":553,"key":"YR2"},{"count":552,"key":"YE2"},{"count":480,"key":"YE1"},{"count":309,"key":"ssl.by"},{"count":238,"key":"Sectigo Public Server Authentication CA DV E36"},{"count":191,"key":"HARICA DV TLS RSA"},{"count":155,"key":"issssrt.ru"},{"count":116,"key":"TRAEFIK DEFAULT CERT"},{"count":98,"key":"invalid2.invalid"},{"count":82,"key":"GlobalSign RSA OV SSL CA 2018"},{"count":81,"key":"GlobalSign ECC OV SSL CA 2018"},{"count":53,"key":"GlobalSign GCC R46 OV TLS CA 2025"},{"count":49,"key":"etc"},{"count":46,"key":"Microsoft TLS G2 RSA CA OCSP 04"}]} +{"asn":"AS33993","field":"host.operating_system.product","total":4692,"buckets":[{"count":2914,"key":"linux"},{"count":57,"key":"windows"},{"count":52,"key":"ubuntu"},{"count":38,"key":"enterprise_linux"},{"count":25,"key":"debian_linux"},{"count":20,"key":"routeros"},{"count":8,"key":"freebsd"},{"count":4,"key":"centos"},{"count":4,"key":"windows_server"},{"count":3,"key":"adaptive_security_appliance_software"},{"count":3,"key":"linux_kernel"},{"count":2,"key":"proxmox"},{"count":1,"key":"ios"}]} diff --git a/kevlar/2026-09-07/censys/aggregations-AS394711.ndjson b/kevlar/2026-09-07/censys/aggregations-AS394711.ndjson new file mode 100644 index 0000000..a88a572 --- /dev/null +++ b/kevlar/2026-09-07/censys/aggregations-AS394711.ndjson @@ -0,0 +1,5 @@ +{"asn":"AS394711","field":"host.services.port","total":3,"buckets":[{"count":2,"key":"80"},{"count":2,"key":"443"},{"count":1,"key":"3389"}]} +{"asn":"AS394711","field":"host.services.software.product","total":3,"buckets":[{"count":4,"key":"bootstrap"}]} +{"asn":"AS394711","field":"host.labels.value","total":3,"buckets":[{"count":3,"key":"BULLETPROOF"}]} +{"asn":"AS394711","field":"host.services.cert.parsed.issuer.common_name","total":3,"buckets":[{"count":2,"key":"vergeos.local.root"},{"count":1,"key":"pcmrp-test"}]} +{"asn":"AS394711","field":"host.operating_system.product","total":3,"buckets":[]} diff --git a/kevlar/2026-09-07/censys/aggregations-AS400992.ndjson b/kevlar/2026-09-07/censys/aggregations-AS400992.ndjson new file mode 100644 index 0000000..5458c33 --- /dev/null +++ b/kevlar/2026-09-07/censys/aggregations-AS400992.ndjson @@ -0,0 +1,5 @@ +{"asn":"AS400992","field":"host.services.port","total":7982,"buckets":[{"count":6772,"key":"22"},{"count":3333,"key":"443"},{"count":1402,"key":"80"},{"count":1044,"key":"2096"},{"count":513,"key":"8443"},{"count":200,"key":"2222"},{"count":192,"key":"8080"},{"count":180,"key":"2053"},{"count":179,"key":"3389"},{"count":144,"key":"25"},{"count":115,"key":"53"},{"count":85,"key":"8000"},{"count":83,"key":"500"},{"count":82,"key":"1080"},{"count":79,"key":"587"}]} +{"asn":"AS400992","field":"host.services.software.product","total":7982,"buckets":[{"count":5827,"key":"openssh"},{"count":2076,"key":"nginx"},{"count":939,"key":"google_web_services"},{"count":937,"key":"web_server"},{"count":421,"key":"app_and_api_protector"},{"count":421,"key":"ghost"},{"count":281,"key":"waf"},{"count":274,"key":"caddy"},{"count":268,"key":"cloudflare_load_balancer"},{"count":219,"key":"express"},{"count":217,"key":"traffic_server"},{"count":157,"key":"http_server"},{"count":134,"key":"bootstrap"},{"count":134,"key":"jquery"},{"count":130,"key":"dovecot"}]} +{"asn":"AS400992","field":"host.labels.value","total":7982,"buckets":[{"count":7982,"key":"BULLETPROOF"},{"count":41,"key":"IPV6"}]} +{"asn":"AS400992","field":"host.services.cert.parsed.issuer.common_name","total":7982,"buckets":[{"count":1110,"key":"YE2"},{"count":944,"key":"invalid2.invalid"},{"count":925,"key":"YE1"},{"count":281,"key":"YR1"},{"count":260,"key":"DigiCert Global G2 TLS RSA SHA256 2020 CA1"},{"count":189,"key":"YR2"},{"count":127,"key":"GeoTrust TLS RSA CA G1"},{"count":103,"key":"GlobalSign ECC OV SSL CA 2018"},{"count":99,"key":"GlobalSign Atlas R46 DV TLS CA 2026 Q3"},{"count":98,"key":"Sectigo Public Server Authentication CA DV E36"},{"count":96,"key":"Microsoft TLS G2 RSA CA OCSP 04"},{"count":93,"key":"Apple Public EV Server RSA CA 1 - G1"},{"count":82,"key":"GlobalSign RSA OV SSL CA 2018"},{"count":81,"key":"HARICA DV TLS RSA"},{"count":68,"key":"TRAEFIK DEFAULT CERT"}]} +{"asn":"AS400992","field":"host.operating_system.product","total":7982,"buckets":[{"count":5596,"key":"linux"},{"count":84,"key":"ubuntu"},{"count":47,"key":"windows"},{"count":27,"key":"debian_linux"},{"count":17,"key":"routeros"},{"count":9,"key":"adaptive_security_appliance_software"},{"count":5,"key":"freebsd"},{"count":5,"key":"linux_kernel"},{"count":4,"key":"centos"},{"count":1,"key":"linux_ami"},{"count":1,"key":"windows_server_2012"}]} diff --git a/kevlar/2026-09-07/censys/aggregations-AS51396.ndjson b/kevlar/2026-09-07/censys/aggregations-AS51396.ndjson new file mode 100644 index 0000000..1b72d5a --- /dev/null +++ b/kevlar/2026-09-07/censys/aggregations-AS51396.ndjson @@ -0,0 +1,5 @@ +{"asn":"AS51396","field":"host.services.port","total":2005,"buckets":[{"count":841,"key":"22"},{"count":357,"key":"80"},{"count":275,"key":"443"},{"count":121,"key":"3389"},{"count":100,"key":"1407"},{"count":99,"key":"11407"},{"count":87,"key":"135"},{"count":85,"key":"445"},{"count":80,"key":"5985"},{"count":79,"key":"139"},{"count":74,"key":"53"},{"count":73,"key":"8080"},{"count":69,"key":"2096"},{"count":64,"key":"47001"},{"count":61,"key":"6239"}]} +{"asn":"AS51396","field":"host.services.software.product","total":2005,"buckets":[{"count":753,"key":"openssh"},{"count":398,"key":"nginx"},{"count":185,"key":"http_server"},{"count":110,"key":"http_api"},{"count":102,"key":"express"},{"count":72,"key":"php"},{"count":56,"key":"python"},{"count":43,"key":"dovecot"},{"count":43,"key":"pve"},{"count":42,"key":"next.js"},{"count":42,"key":"virtual_environment"},{"count":35,"key":"node_exporter"},{"count":35,"key":"simplehttp"},{"count":30,"key":"drupal"},{"count":30,"key":"tinyproxy"}]} +{"asn":"AS51396","field":"host.labels.value","total":2005,"buckets":[{"count":2005,"key":"BULLETPROOF"},{"count":15,"key":"IPV6"}]} +{"asn":"AS51396","field":"host.services.cert.parsed.issuer.common_name","total":2005,"buckets":[{"count":124,"key":"YE1"},{"count":109,"key":"YE2"},{"count":49,"key":"YR2"},{"count":31,"key":"YR1"},{"count":27,"key":"WIN-9QL4SDRB93L"},{"count":21,"key":"TRAEFIK DEFAULT CERT"},{"count":18,"key":"Proxmox Virtual Environment"},{"count":17,"key":"WIN-IK7N6SD2UBU"},{"count":17,"key":"localhost"},{"count":11,"key":"Cloudbase-Init WinRM"},{"count":11,"key":"invalid2.invalid"},{"count":10,"key":"hosting12.coolsshservers.com"},{"count":9,"key":"WIN-OU0SUKQBJN2"},{"count":9,"key":"imap.example.com"},{"count":9,"key":"srv1.dedusapp.icu"}]} +{"asn":"AS51396","field":"host.operating_system.product","total":2005,"buckets":[{"count":678,"key":"linux"},{"count":82,"key":"windows"},{"count":36,"key":"debian_linux"},{"count":19,"key":"proxmox"},{"count":14,"key":"ubuntu"},{"count":5,"key":"centos"},{"count":2,"key":"routeros"},{"count":1,"key":"vmware_esxi_server"}]} diff --git a/kevlar/2026-09-07/censys/aggregations-AS51852.ndjson b/kevlar/2026-09-07/censys/aggregations-AS51852.ndjson new file mode 100644 index 0000000..c9487c4 --- /dev/null +++ b/kevlar/2026-09-07/censys/aggregations-AS51852.ndjson @@ -0,0 +1,5 @@ +{"asn":"AS51852","field":"host.services.port","total":8634,"buckets":[{"count":4334,"key":"443"},{"count":4041,"key":"22"},{"count":3586,"key":"161"},{"count":2811,"key":"80"},{"count":1892,"key":"123"},{"count":1547,"key":"53"},{"count":845,"key":"500"},{"count":794,"key":"21"},{"count":793,"key":"143"},{"count":786,"key":"993"},{"count":783,"key":"110"},{"count":771,"key":"25"},{"count":660,"key":"1194"},{"count":627,"key":"587"},{"count":587,"key":"8082"}]} +{"asn":"AS51852","field":"host.services.software.product","total":8634,"buckets":[{"count":4673,"key":"nginx"},{"count":4060,"key":"openssh"},{"count":2414,"key":"dovecot"},{"count":1224,"key":"exim"},{"count":837,"key":"cpanel"},{"count":815,"key":"openvpn_access_server"},{"count":760,"key":"http_server"},{"count":757,"key":"bind"},{"count":601,"key":"ceph"},{"count":517,"key":"webmail"},{"count":374,"key":"php"},{"count":359,"key":"proftpd"},{"count":336,"key":"express"},{"count":326,"key":"virtual_environment"},{"count":324,"key":"pve"}]} +{"asn":"AS51852","field":"host.labels.value","total":8634,"buckets":[{"count":8634,"key":"BULLETPROOF"},{"count":38,"key":"IPV6"}]} +{"asn":"AS51852","field":"host.services.cert.parsed.issuer.common_name","total":8634,"buckets":[{"count":1716,"key":"server"},{"count":1497,"key":"YR2"},{"count":894,"key":"Hydra Authentication RSA SubCA #154"},{"count":861,"key":"YR1"},{"count":773,"key":"server.domain.com"},{"count":523,"key":"YE2"},{"count":416,"key":"YE1"},{"count":342,"key":"server.ibras.eu"},{"count":278,"key":"''"},{"count":261,"key":"invalid2.invalid"},{"count":163,"key":"Proxmox Virtual Environment"},{"count":160,"key":"Hydra Authentication RSA SubCA #156"},{"count":142,"key":"Plesk"},{"count":110,"key":"server.xtreme-results.net"},{"count":99,"key":"Hydra Authentication RSA SubCA #155"}]} +{"asn":"AS51852","field":"host.operating_system.product","total":8634,"buckets":[{"count":3027,"key":"linux"},{"count":201,"key":"windows"},{"count":156,"key":"proxmox"},{"count":129,"key":"enterprise_linux"},{"count":49,"key":"ubuntu"},{"count":41,"key":"debian_linux"},{"count":35,"key":"freebsd"},{"count":25,"key":"centos"},{"count":21,"key":"routeros"},{"count":17,"key":"vmware_esxi_server"},{"count":4,"key":"idrac_linux"},{"count":3,"key":"adaptive_security_appliance_software"},{"count":3,"key":"linux_kernel"},{"count":3,"key":"windows_server"},{"count":3,"key":"windows_server_2012_r2"}]} diff --git a/kevlar/2026-09-07/censys/aggregations-AS57043.ndjson b/kevlar/2026-09-07/censys/aggregations-AS57043.ndjson new file mode 100644 index 0000000..d179938 --- /dev/null +++ b/kevlar/2026-09-07/censys/aggregations-AS57043.ndjson @@ -0,0 +1,5 @@ +{"asn":"AS57043","field":"host.services.port","total":101919,"buckets":[{"count":77184,"key":"22"},{"count":50237,"key":"443"},{"count":33035,"key":"80"},{"count":14781,"key":"2096"},{"count":8370,"key":"8443"},{"count":4740,"key":"111"},{"count":2942,"key":"8080"},{"count":2599,"key":"2222"},{"count":2592,"key":"2053"},{"count":2487,"key":"53"},{"count":2409,"key":"9100"},{"count":1869,"key":"2212"},{"count":1864,"key":"6767"},{"count":1840,"key":"21"},{"count":1838,"key":"1881"}]} +{"asn":"AS57043","field":"host.services.software.product","total":101918,"buckets":[{"count":76988,"key":"openssh"},{"count":61500,"key":"nginx"},{"count":8740,"key":"google_web_services"},{"count":8740,"key":"web_server"},{"count":6293,"key":"ghost"},{"count":6289,"key":"app_and_api_protector"},{"count":5413,"key":"express"},{"count":4095,"key":"caddy"},{"count":3938,"key":"dovecot"},{"count":3609,"key":"waf"},{"count":3453,"key":"cloudflare_load_balancer"},{"count":3042,"key":"http_server"},{"count":3024,"key":"next.js"},{"count":2218,"key":"uvicorn"},{"count":2008,"key":"bootstrap"}]} +{"asn":"AS57043","field":"host.labels.value","total":101918,"buckets":[{"count":101918,"key":"BULLETPROOF"},{"count":7,"key":"IPV6"}]} +{"asn":"AS57043","field":"host.services.cert.parsed.issuer.common_name","total":101918,"buckets":[{"count":15470,"key":"YE2"},{"count":13541,"key":"YE1"},{"count":8815,"key":"invalid2.invalid"},{"count":7505,"key":"YR1"},{"count":3903,"key":"YR2"},{"count":2294,"key":"GeoTrust TLS RSA CA G1"},{"count":2053,"key":"TRAEFIK DEFAULT CERT"},{"count":1922,"key":"hypervisor.hv"},{"count":1821,"key":"DigiCert Global G2 TLS RSA SHA256 2020 CA1"},{"count":1535,"key":"Microsoft TLS G2 RSA CA OCSP 04"},{"count":1269,"key":"Apple Public EV Server RSA CA 1 - G1"},{"count":1221,"key":"GlobalSign ECC OV SSL CA 2018"},{"count":1163,"key":"GlobalSign RSA OV SSL CA 2018"},{"count":1007,"key":"HARICA DV TLS RSA"},{"count":996,"key":"Sectigo Public Server Authentication CA DV E36"}]} +{"asn":"AS57043","field":"host.operating_system.product","total":101918,"buckets":[{"count":72787,"key":"linux"},{"count":834,"key":"ubuntu"},{"count":572,"key":"windows"},{"count":299,"key":"routeros"},{"count":271,"key":"debian_linux"},{"count":175,"key":"proxmox"},{"count":133,"key":"linux_kernel"},{"count":112,"key":"adaptive_security_appliance_software"},{"count":54,"key":"freebsd"},{"count":43,"key":"centos"},{"count":40,"key":"ios"},{"count":38,"key":"vmware_esxi_server"},{"count":21,"key":"enterprise_linux"},{"count":10,"key":"windows_server"},{"count":8,"key":"linux_ami"}]} diff --git a/kevlar/2026-09-07/censys/aggregations-AS58854.ndjson b/kevlar/2026-09-07/censys/aggregations-AS58854.ndjson new file mode 100644 index 0000000..8b18094 --- /dev/null +++ b/kevlar/2026-09-07/censys/aggregations-AS58854.ndjson @@ -0,0 +1,5 @@ +{"asn":"AS58854","field":"host.services.port","total":614,"buckets":[{"count":181,"key":"8887"},{"count":175,"key":"80"},{"count":158,"key":"443"},{"count":113,"key":"0"},{"count":85,"key":"18893"},{"count":84,"key":"18891"},{"count":79,"key":"111"},{"count":78,"key":"8888"},{"count":77,"key":"8081"},{"count":74,"key":"18890"},{"count":74,"key":"18892"},{"count":74,"key":"25001"},{"count":73,"key":"16257"},{"count":73,"key":"16259"},{"count":73,"key":"26257"}]} +{"asn":"AS58854","field":"host.services.software.product","total":614,"buckets":[{"count":1191,"key":"mysql"},{"count":402,"key":"nginx"},{"count":291,"key":"python"},{"count":173,"key":"wsgiserver"},{"count":165,"key":"jquery"},{"count":155,"key":"bootstrap"},{"count":115,"key":"simplehttp"},{"count":103,"key":"node_exporter"},{"count":79,"key":"openssh"},{"count":77,"key":"kestrel_web_server"},{"count":76,"key":"cadvisor"},{"count":41,"key":"http_api"},{"count":36,"key":"tengine"},{"count":24,"key":"openresty"},{"count":16,"key":"internet_information_services"}]} +{"asn":"AS58854","field":"host.labels.value","total":614,"buckets":[{"count":614,"key":"BULLETPROOF"}]} +{"asn":"AS58854","field":"host.services.cert.parsed.issuer.common_name","total":614,"buckets":[{"count":47,"key":"GlobalSign RSA OV SSL CA 2018"},{"count":12,"key":"TrustAsia DV TLS RSA CA 2025"},{"count":11,"key":"YR1"},{"count":10,"key":"FtpServer"},{"count":8,"key":"RapidSSL TLS RSA CA G1"},{"count":7,"key":"TrustAsia DV TLS RSA CA 2024"},{"count":5,"key":"IPMI"},{"count":5,"key":"WIN-RIK6D08VRRQ"},{"count":4,"key":"Firecloud Root Client Certification Authority"},{"count":4,"key":"Sectigo Public Server Authentication CA DV R36"},{"count":4,"key":"宝塔面板"},{"count":3,"key":"DigiCert Basic OV G2 TLS CN RSA4096 SHA256 2022 CA1"},{"count":3,"key":"TrustAsia TLS RSA CA"},{"count":3,"key":"WIN-M7O7840CVAH"},{"count":2,"key":"Certum DV TLS G2 R39 CA"}]} +{"asn":"AS58854","field":"host.operating_system.product","total":614,"buckets":[{"count":33,"key":"linux"},{"count":27,"key":"windows"},{"count":13,"key":"ubuntu"},{"count":2,"key":"routeros"},{"count":1,"key":"centos"}]} diff --git a/kevlar/2026-09-07/censys/enrichment-summary.json b/kevlar/2026-09-07/censys/enrichment-summary.json new file mode 100644 index 0000000..a6382d2 --- /dev/null +++ b/kevlar/2026-09-07/censys/enrichment-summary.json @@ -0,0 +1,217 @@ +[ + { + "ip": "176.120.22.61", + "asn": "AS198953", + "name": "PROTON66", + "labels": [ + "BULLETPROOF" + ], + "ports": [ + "135/tcp", + "137/udp", + "139/tcp", + "3389/tcp", + "47001/tcp", + "5985/tcp" + ], + "nPorts": 6, + "software": [ + "?", + "http_api:2.0" + ], + "banners": [ + "137: �؄\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000 CKAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\u0000\u0000!\u0000\u0001\u0000\u0000\u0000\u0000\u0000/\u0000<��p", + "139: �\u0000\u0000\u0001�", + "47001: HTTP/1.1 404 Not Found\r\nContent-Type: text/html; charset=us-" + ], + "os": "windows", + "location": "Saint Petersburg, Russia" + }, + { + "ip": "204.76.203.222", + "asn": "AS51396", + "name": "PFCLOUD", + "labels": [ + "BULLETPROOF" + ], + "ports": [ + "22/tcp" + ], + "nPorts": 1, + "software": [ + "?", + "openssh:8.9p1" + ], + "banners": [ + "22: SSH-2.0-OpenSSH_8.9p1 Ubuntu-3ubuntu0.17" + ], + "os": "linux", + "location": "Eygelshoven, Netherlands" + }, + { + "ip": "204.76.203.221", + "asn": "AS51396", + "name": "PFCLOUD", + "labels": [ + "BULLETPROOF" + ], + "ports": [ + "22/tcp" + ], + "nPorts": 1, + "software": [ + "?", + "openssh:8.9p1" + ], + "banners": [ + "22: SSH-2.0-OpenSSH_8.9p1 Ubuntu-3ubuntu0.17" + ], + "os": "linux", + "location": "Eygelshoven, Netherlands" + }, + { + "ip": "204.76.203.213", + "asn": "AS51396", + "name": "PFCLOUD", + "labels": [ + "BULLETPROOF" + ], + "ports": [ + "22/tcp" + ], + "nPorts": 1, + "software": [ + "?", + "openssh:8.9p1" + ], + "banners": [ + "22: SSH-2.0-OpenSSH_8.9p1 Ubuntu-3ubuntu0.17" + ], + "os": "linux", + "location": "Eygelshoven, Netherlands" + }, + { + "ip": "185.246.217.150", + "asn": "AS210644", + "name": "AEZA-AS", + "labels": [ + "BULLETPROOF" + ], + "ports": [ + "22/tcp" + ], + "nPorts": 1, + "software": [ + "?", + "openssh:10.2p1" + ], + "banners": [ + "22: SSH-2.0-OpenSSH_10.2p1 Ubuntu-2ubuntu3.6" + ], + "os": "linux", + "location": "Amsterdam, Netherlands" + }, + { + "ip": "45.61.157.82", + "asn": "AS14956", + "name": "ROUTERHOSTING", + "labels": [ + "BULLETPROOF" + ], + "ports": [ + "3389/tcp", + "47001/tcp" + ], + "nPorts": 2, + "software": [ + "?", + "http_api:2.0" + ], + "banners": [ + "47001: HTTP/1.1 404 Not Found\r\nContent-Type: text/html; charset=us-" + ], + "os": "windows", + "location": "Las Vegas, United States" + }, + { + "ip": "185.100.87.136", + "asn": "AS200651", + "name": "FLOKINET", + "labels": [ + "BULLETPROOF" + ], + "ports": [ + "7288/tcp", + "80/tcp", + "9001/tcp" + ], + "nPorts": 3, + "software": [ + "tor", + "?", + "openssh:9.9" + ], + "banners": [ + "80: HTTP/1.0 200 OK\r\nDate: \r\nContent-Type: text/html\r", + "7288: SSH-2.0-OpenSSH_9.9" + ], + "os": "", + "location": "Bucharest, Romania" + }, + { + "ip": "144.172.108.79", + "asn": "AS14956", + "name": "ROUTERHOSTING", + "labels": [ + "BULLETPROOF" + ], + "ports": [ + "1433/tcp", + "3389/tcp", + "47001/tcp", + "80/tcp" + ], + "nPorts": 4, + "software": [ + "http_api:2.0", + "?", + "sql_server:10.0.1600" + ], + "banners": [ + "80: HTTP/1.1 404 Not Found\r\nContent-Type: text/html; charset=us-", + "47001: HTTP/1.1 404 Not Found\r\nContent-Type: text/html; charset=us-" + ], + "os": "windows", + "location": "Ogden, United States" + }, + { + "ip": "193.143.1.66", + "asn": "AS198953", + "name": "PROTON66", + "labels": [], + "ports": [], + "nPorts": 0, + "software": [], + "banners": [], + "os": "", + "location": "?, ?" + }, + { + "ip": "144.172.99.200", + "asn": "AS14956", + "name": "ROUTERHOSTING", + "labels": [ + "BULLETPROOF" + ], + "ports": [ + "3389/tcp" + ], + "nPorts": 1, + "software": [ + "?" + ], + "banners": [], + "os": "", + "location": "Ogden, United States" + } +] \ No newline at end of file diff --git a/kevlar/2026-09-07/censys/fleet-correlation.csv b/kevlar/2026-09-07/censys/fleet-correlation.csv new file mode 100644 index 0000000..4c38a9e --- /dev/null +++ b/kevlar/2026-09-07/censys/fleet-correlation.csv @@ -0,0 +1,7 @@ +linkage_type,ips,indicator,asn,notes +cloned-image,204.76.203.213; 204.76.203.221; 204.76.203.222,identical SSH algorithm selection + banner comment "Ubuntu-3ubuntu0.17" + OpenSSH 8.9p1 single-service profile,AS51396,PFCLOUD /29 scanner fleet in Eygelshoven NL; 1100+ Honeylabs events each; BULLETPROOF-labeled +identical-service-config,45.61.157.82; 144.172.108.79; 144.172.99.200,Windows RDP (3389) + HTTP API 2.0 on 47001; 144.172.108.79 also MSSQL 2008 (10.0.1600) on 1433,AS14956,ROUTERHOSTING RDP-access fleet Las Vegas/Ogden US; BULLETPROOF-labeled +remote-access-node,176.120.22.61,Windows + RDP 3389 + WinRM 5985 + DCERPC 135,AS198953,PROTON66 St Petersburg RU; 1597 Honeylabs events; Censys BULLETPROOF label +scan-only-node,193.143.1.66,zero open ports visible to Censys,AS198953,PROTON66; 24 Honeylabs events but no exposed services +tor-exit,185.100.87.136,Censys TOR label + SSH 9.9 on non-standard port 7288,AS200651,FLOKINET Bucharest RO; 24 Honeylabs events; BULLETPROOF-labeled +ssh-fingerprint-family,204.76.203.213; 204.76.203.221; 204.76.203.222; 185.246.217.150,identical SSH algorithm selection (curve25519-sha256@libssh.org / ecdsa-sha2-nistp256 / aes128-ctr / hmac-sha2-256),AS51396; AS210644,shared SSH hardening baseline across PFCLOUD and AEZA fleets diff --git a/kevlar/2026-09-07/censys/ip-enrichments.ndjson b/kevlar/2026-09-07/censys/ip-enrichments.ndjson new file mode 100644 index 0000000..b0d739e --- /dev/null +++ b/kevlar/2026-09-07/censys/ip-enrichments.ndjson @@ -0,0 +1,10 @@ +{"ip":"176.120.22.61","asn":"AS198953","name":"PROTON66","honeylabs_events":1597,"host":{"result":{"extensions":{},"resource":{"autonomous_system":{"asn":198953,"bgp_prefix":"176.120.22.0/24","country_code":"RU","description":"proton66 - Proton66 OOO","name":"proton66 - Proton66 OOO"},"dns":{"reverse_dns":{"resolve_time":"2026-09-02T21:19:43Z"}},"ip":"176.120.22.61","labels":[{"confidence":0.75,"source":"censys","value":"BULLETPROOF"}],"location":{"city":"Saint Petersburg","continent":"Europe","coordinates":{"latitude":59.93863,"longitude":30.31413},"country":"Russia","country_code":"RU","postal_code":"195213","province":"St.-Petersburg","timezone":"Europe/Moscow"},"network":[{"hosting":true,"source":"IPINFO"}],"operating_system":{"confidence":0.25,"cpe":"cpe:2.3:o:microsoft:windows:*:*:*:*:*:*:*:*","evidence":[{"data_path":"http.headers.server"}],"part":"o","product":"windows","source":"recog","vendor":"microsoft"},"privacy":[{"source":"IPINFO"}],"reputation":{"evidence":[{},{},{},{},{}],"model_version":"2.0.0","score":0.526},"service_count":6,"services":[{"banner_hash_sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","dcerpc":{"could_bind":true,"could_query_epm":true,"endpoints":[{"bindings":["ncacn_ip_tcp:176.120.22.61[1032]","ncalrpc:[samss lpc]","ncalrpc:[SidKey Local End Point]","ncalrpc:[protected_storage]","ncalrpc:[lsasspirpc]","ncalrpc:[lsapolicylookup]","ncalrpc:[LSA_EAS_ENDPOINT]","ncalrpc:[lsacap]","ncalrpc:[LSARPC_ENDPOINT]","ncalrpc:[securityevent]","ncalrpc:[audit]","ncacn_np:\\\\M051108[\\pipe\\lsass]"],"executable":"N/A","explained_uuid":"b25a52bf-e5dd-4f4a-aea6-8ca7272a0e86 v2.0 KeyIso","protocol":"N/A"},{"bindings":["ncalrpc:[WMsgKRpc0289BF2]"],"executable":"winlogon.exe","explained_uuid":"12e65dd8-887f-41ef-91bf-8d816c42c2e7 v1.0 Secure Desktop LRPC interface","protocol":"N/A"},{"bindings":["ncalrpc:[dabrpc]","ncalrpc:[LRPC-7563631bf11d56b19e]","ncacn_np:\\\\M051108[\\pipe\\LSM_API_service]","ncalrpc:[LSMApi]","ncalrpc:[LRPC-87c422f6707b03390f]","ncalrpc:[actkernel]","ncalrpc:[umpo]"],"executable":"N/A","explained_uuid":"9b008953-f195-4bf9-bde0-4471971e58ed v1.0","protocol":"N/A"},{"bindings":["ncalrpc:[dhcpcsvc6]","ncalrpc:[dhcpcsvc]","ncalrpc:[LRPC-8dc8f5673df46eb52d]","ncacn_ip_tcp:176.120.22.61[1026]","ncacn_np:\\\\M051108[\\pipe\\eventlog]","ncalrpc:[eventlog]"],"executable":"dhcpcsvc6.dll","explained_uuid":"3c4728c5-f0ab-448b-bda1-6ce01eb0a6d6 v1.0 DHCPv6 Client LRPC Endpoint","protocol":"N/A"},{"bindings":["ncalrpc:[LRPC-8dc8f5673df46eb52d]","ncacn_ip_tcp:176.120.22.61[1026]","ncacn_np:\\\\M051108[\\pipe\\eventlog]","ncalrpc:[eventlog]"],"executable":"N/A","explained_uuid":"abfb6ca3-0c5e-4734-9285-0aee72fe8d1c v1.0 Wcm Service","protocol":"N/A"},{"bindings":["ncalrpc:[LRPC-a2f1d3b7cddc139c78]"],"executable":"gpsvc.dll","explained_uuid":"2eb08e3e-639f-4fba-97b1-14f878961076 v1.0 Group Policy RPC Interface","protocol":"N/A"},{"bindings":["ncalrpc:[LRPC-75133026b353cf66c2]","ncalrpc:[LRPC-8116c31a18a2af404a]"],"executable":"MPSSVC.dll","explained_uuid":"7f9d11bf-7fb9-436b-a812-b2d50c5d4c03 v1.0 Fw APIs","protocol":"N/A"},{"bindings":["ncacn_ip_tcp:176.120.22.61[1028]","ncalrpc:[LRPC-697e8331bb546929eb]"],"executable":"spoolsv.exe","explained_uuid":"12345678-1234-abcd-ef00-0123456789ab v1.0","protocol":"[MS-RPRN]: Print System Remote Protocol"},{"bindings":["ncacn_ip_tcp:176.120.22.61[1029]"],"executable":"services.exe","explained_uuid":"367abb81-9844-35f1-ad32-98f038001003 v2.0","protocol":"[MS-SCMR]: Service Control Manager Remote Protocol"},{"bindings":["ncacn_ip_tcp:176.120.22.61[1032]","ncalrpc:[samss lpc]","ncalrpc:[SidKey Local End Point]","ncalrpc:[protected_storage]","ncalrpc:[lsasspirpc]","ncalrpc:[lsapolicylookup]","ncalrpc:[LSA_EAS_ENDPOINT]","ncalrpc:[lsacap]","ncalrpc:[LSARPC_ENDPOINT]","ncalrpc:[securityevent]","ncalrpc:[audit]","ncacn_np:\\\\M051108[\\pipe\\lsass]"],"executable":"samsrv.dll","explained_uuid":"12345778-1234-abcd-ef00-0123456789ac v1.0","protocol":"[MS-SAMR]: Security Account Manager (SAM) Remote Protocol"},{"bindings":["ncalrpc:[LRPC-7563631bf11d56b19e]","ncacn_np:\\\\M051108[\\pipe\\LSM_API_service]","ncalrpc:[LSMApi]","ncalrpc:[LRPC-87c422f6707b03390f]","ncalrpc:[actkernel]","ncalrpc:[umpo]"],"executable":"N/A","explained_uuid":"697dcda9-3ba9-4eb2-9247-e11f1901b0d2 v1.0","protocol":"N/A"},{"bindings":["ncalrpc:[actkernel]","ncalrpc:[umpo]"],"executable":"N/A","explained_uuid":"085b0334-e454-4d91-9b8c-4134f9e793f3 v1.0","protocol":"N/A"},{"bindings":["ncacn_ip_tcp:176.120.22.61[1027]","ncalrpc:[ubpmtaskhostchannel]","ncacn_np:\\\\M051108[\\PIPE\\atsvc]","ncalrpc:[senssvc]","ncalrpc:[OLECCD6EA245DBE3DB48EB998DFA810]","ncalrpc:[IUserProfile2]"],"executable":"N/A","explained_uuid":"3a9ef155-691d-4449-8d05-09ad57031823 v1.0","protocol":"N/A"},{"bindings":["ncacn_ip_tcp:176.120.22.61[1028]","ncalrpc:[LRPC-697e8331bb546929eb]"],"executable":"spoolsv.exe","explained_uuid":"ae33069b-a2a8-46ee-a235-ddfd339be281 v1.0","protocol":"[MS-PAN]: Print System Asynchronous Notification Protocol"},{"bindings":["ncacn_ip_tcp:176.120.22.61[1028]","ncalrpc:[LRPC-697e8331bb546929eb]"],"executable":"spoolsv.exe","explained_uuid":"0b6edbfa-4a24-4fc6-8a23-942b1eca65d1 v1.0","protocol":"[MS-PAN]: Print System Asynchronous Notification Protocol"},{"bindings":["ncalrpc:[LRPC-5b3c020788ba8cdd19]","ncalrpc:[LRPC-5b3c020788ba8cdd19]","ncalrpc:[LRPC-5b3c020788ba8cdd19]"],"executable":"msdtcprx.dll","explained_uuid":"906b0ce0-c70b-1067-b317-00dd010662da v1.0","protocol":"[MS-CMPO]: MSDTC Connection Manager:"},{"bindings":["ncalrpc:[actkernel]","ncalrpc:[umpo]"],"executable":"N/A","explained_uuid":"8782d3b9-ebbd-4644-a3d8-e8725381919b v1.0","protocol":"N/A"},{"bindings":["ncacn_ip_tcp:176.120.22.61[1027]","ncalrpc:[ubpmtaskhostchannel]","ncacn_np:\\\\M051108[\\PIPE\\atsvc]","ncalrpc:[senssvc]","ncalrpc:[OLECCD6EA245DBE3DB48EB998DFA810]","ncalrpc:[IUserProfile2]"],"executable":"N/A","explained_uuid":"2e6035b2-e8f1-41a7-a044-656b439c4c34 v1.0 Proxy Manager provider server endpoint","protocol":"N/A"},{"bindings":["ncacn_np:\\\\M051108[\\PIPE\\W32TIME_ALT]","ncalrpc:[W32TIME_ALT]","ncalrpc:[LRPC-1f4f400a89fd304001]","ncalrpc:[OLE3F68D0A5E28727226273257A66A5]"],"executable":"N/A","explained_uuid":"3473dd4d-2e88-4006-9cba-22570909dd10 v5.1 WinHttp Auto-Proxy Service","protocol":"N/A"},{"bindings":["ncalrpc:[LRPC-75133026b353cf66c2]","ncalrpc:[LRPC-8116c31a18a2af404a]"],"executable":"N/A","explained_uuid":"f47433c3-3e9d-4157-aad4-83aa1f5c2d4c v1.0 Fw APIs","protocol":"N/A"},{"bindings":["ncacn_ip_tcp:176.120.22.61[1025]","ncalrpc:[WindowsShutdown]","ncacn_np:\\\\M051108[\\PIPE\\InitShutdown]","ncalrpc:[WMsgKRpc068920]"],"executable":"wininit.exe","explained_uuid":"d95afe70-a6d5-4259-822e-2c84da1ddb0d v1.0","protocol":"[MS-RSP]: Remote Shutdown Protocol"},{"bindings":["ncalrpc:[actkernel]","ncalrpc:[umpo]"],"executable":"N/A","explained_uuid":"0d3e2735-cea0-4ecc-a9e2-41a2d81aed4e v1.0","protocol":"N/A"},{"bindings":["ncalrpc:[actkernel]","ncalrpc:[umpo]"],"executable":"N/A","explained_uuid":"c605f9fb-f0a3-4e2a-a073-73560f8d9e3e v1.0","protocol":"N/A"},{"bindings":["ncalrpc:[LRPC-729277d6e71e759854]","ncacn_np:\\\\M051108[\\PIPE\\srvsvc]","ncacn_ip_tcp:176.120.22.61[1027]","ncalrpc:[ubpmtaskhostchannel]","ncacn_np:\\\\M051108[\\PIPE\\atsvc]","ncalrpc:[senssvc]","ncalrpc:[OLECCD6EA245DBE3DB48EB998DFA810]","ncalrpc:[IUserProfile2]"],"executable":"certprop.dll","explained_uuid":"30b044a5-a225-43f0-b3a4-e060df91f9c1 v1.0","protocol":"N/A"},{"bindings":["ncacn_ip_tcp:176.120.22.61[1027]","ncalrpc:[ubpmtaskhostchannel]","ncacn_np:\\\\M051108[\\PIPE\\atsvc]","ncalrpc:[senssvc]","ncalrpc:[OLECCD6EA245DBE3DB48EB998DFA810]","ncalrpc:[IUserProfile2]"],"executable":"iphlpsvc.dll","explained_uuid":"552d076a-cb29-4e44-8b6a-d15e59e2c0af v1.0 IP Transition Configuration endpoint","protocol":"N/A"},{"bindings":["ncacn_ip_tcp:176.120.22.61[1027]","ncalrpc:[ubpmtaskhostchannel]","ncacn_np:\\\\M051108[\\PIPE\\atsvc]","ncalrpc:[senssvc]","ncalrpc:[OLECCD6EA245DBE3DB48EB998DFA810]","ncalrpc:[IUserProfile2]"],"executable":"IKEEXT.DLL","explained_uuid":"a398e520-d59a-4bdd-aa7a-3c1e0303a511 v1.0 IKE/Authip API","protocol":"N/A"},{"bindings":["ncacn_ip_tcp:176.120.22.61[1027]","ncalrpc:[ubpmtaskhostchannel]","ncacn_np:\\\\M051108[\\PIPE\\atsvc]","ncalrpc:[senssvc]","ncalrpc:[OLECCD6EA245DBE3DB48EB998DFA810]","ncalrpc:[IUserProfile2]"],"executable":"schedsvc.dll","explained_uuid":"86d35949-83c9-4044-b424-db363231fd0c v1.0","protocol":"[MS-TSCH]: Task Scheduler Service Remoting Protocol"},{"bindings":["ncalrpc:[LRPC-75133026b353cf66c2]","ncalrpc:[LRPC-8116c31a18a2af404a]"],"executable":"MPSSVC.dll","explained_uuid":"2fb92682-6599-42dc-ae13-bd2ca89bd11c v1.0 Fw APIs","protocol":"N/A"},{"bindings":["ncalrpc:[actkernel]","ncalrpc:[umpo]"],"executable":"N/A","explained_uuid":"8bfc3be1-6def-4e2d-af74-7c47cd0ade4a v1.0","protocol":"N/A"},{"bindings":["ncalrpc:[actkernel]","ncalrpc:[umpo]"],"executable":"N/A","explained_uuid":"3b338d89-6cfa-44b8-847e-531531bc9992 v1.0","protocol":"N/A"},{"bindings":["ncacn_ip_tcp:176.120.22.61[1027]","ncalrpc:[ubpmtaskhostchannel]","ncacn_np:\\\\M051108[\\PIPE\\atsvc]","ncalrpc:[senssvc]","ncalrpc:[OLECCD6EA245DBE3DB48EB998DFA810]","ncalrpc:[IUserProfile2]"],"executable":"srvsvc.dll","explained_uuid":"98716d03-89ac-44c7-bb8c-285824e51c4a v1.0 XactSrv service","protocol":"N/A"},{"bindings":["ncacn_np:\\\\M051108[\\PIPE\\atsvc]","ncalrpc:[senssvc]","ncalrpc:[OLECCD6EA245DBE3DB48EB998DFA810]","ncalrpc:[IUserProfile2]"],"executable":"taskcomp.dll","explained_uuid":"1ff70682-0a51-30e8-076d-740be8cee98b v1.0","protocol":"[MS-TSCH]: Task Scheduler Service Remoting Protocol"},{"bindings":["ncalrpc:[senssvc]","ncalrpc:[OLECCD6EA245DBE3DB48EB998DFA810]","ncalrpc:[IUserProfile2]"],"executable":"schedsvc.dll","explained_uuid":"0a74ef1c-41a4-4e06-83ae-dc74fb1cdd53 v1.0","protocol":"N/A"},{"bindings":["ncalrpc:[LRPC-1f4f400a89fd304001]","ncalrpc:[OLE3F68D0A5E28727226273257A66A5]"],"executable":"nsisvc.dll","explained_uuid":"7ea70bcf-48af-4f6a-8968-6a440754d5fa v1.0 NSI server endpoint","protocol":"N/A"},{"bindings":["ncacn_ip_tcp:176.120.22.61[1028]","ncalrpc:[LRPC-697e8331bb546929eb]"],"executable":"spoolsv.exe","explained_uuid":"76f03f96-cdfd-44fc-a22c-64950a001209 v1.0","protocol":"[MS-PAR]: Print System Asynchronous Remote Protocol"},{"bindings":["ncalrpc:[actkernel]","ncalrpc:[umpo]"],"executable":"N/A","explained_uuid":"1b37ca91-76b1-4f5e-a3c7-2abfc61f2bb0 v1.0","protocol":"N/A"},{"bindings":["ncalrpc:[actkernel]","ncalrpc:[umpo]"],"executable":"N/A","explained_uuid":"bdaa0970-413b-4a3e-9e5d-f6dc9d7e0760 v1.0","protocol":"N/A"},{"bindings":["ncalrpc:[actkernel]","ncalrpc:[umpo]"],"executable":"N/A","explained_uuid":"4bec6bb8-b5c2-4b6f-b2c1-5da5cf92d0d9 v1.0","protocol":"N/A"},{"bindings":["ncalrpc:[dhcpcsvc]","ncalrpc:[LRPC-8dc8f5673df46eb52d]","ncacn_ip_tcp:176.120.22.61[1026]","ncacn_np:\\\\M051108[\\pipe\\eventlog]","ncalrpc:[eventlog]"],"executable":"dhcpcsvc.dll","explained_uuid":"3c4728c5-f0ab-448b-bda1-6ce01eb0a6d5 v1.0 DHCP Client LRPC Endpoint","protocol":"N/A"},{"bindings":["ncacn_ip_tcp:176.120.22.61[1026]","ncacn_np:\\\\M051108[\\pipe\\eventlog]","ncalrpc:[eventlog]"],"executable":"wevtsvc.dll","explained_uuid":"f6beaff7-1e19-4fbb-9f8f-b89e2018337c v1.0 Event log TCPIP","protocol":"[MS-EVEN6]: EventLog Remoting Protocol"},{"bindings":["ncacn_ip_tcp:176.120.22.61[1027]","ncalrpc:[ubpmtaskhostchannel]","ncacn_np:\\\\M051108[\\PIPE\\atsvc]","ncalrpc:[senssvc]","ncalrpc:[OLECCD6EA245DBE3DB48EB998DFA810]","ncalrpc:[IUserProfile2]"],"executable":"N/A","explained_uuid":"1a0d010f-1c33-432c-b0f5-8cf4e8053099 v1.0 IdSegSrv service","protocol":"N/A"},{"bindings":["ncacn_ip_tcp:176.120.22.61[1027]","ncalrpc:[ubpmtaskhostchannel]","ncacn_np:\\\\M051108[\\PIPE\\atsvc]","ncalrpc:[senssvc]","ncalrpc:[OLECCD6EA245DBE3DB48EB998DFA810]","ncalrpc:[IUserProfile2]"],"executable":"N/A","explained_uuid":"c36be077-e14b-4fe9-8abc-e856ef4f048b v1.0 Proxy Manager client server endpoint","protocol":"N/A"},{"bindings":["ncacn_np:\\\\M051108[\\PIPE\\atsvc]","ncalrpc:[senssvc]","ncalrpc:[OLECCD6EA245DBE3DB48EB998DFA810]","ncalrpc:[IUserProfile2]"],"executable":"taskcomp.dll","explained_uuid":"378e52b0-c0a9-11cf-822d-00aa0051e40f v1.0","protocol":"[MS-TSCH]: Task Scheduler Service Remoting Protocol"},{"bindings":["ncalrpc:[WindowsShutdown]","ncacn_np:\\\\M051108[\\PIPE\\InitShutdown]","ncalrpc:[WMsgKRpc068920]","ncalrpc:[WMsgKRpc0BA091]","ncalrpc:[WMsgKRpc0289BF2]"],"executable":"winlogon.exe","explained_uuid":"76f226c3-ec14-4325-8a99-6a46348418af v1.0","protocol":"N/A"},{"bindings":["ncalrpc:[LRPC-87c422f6707b03390f]","ncalrpc:[actkernel]","ncalrpc:[umpo]","ncacn_np:\\\\M051108[\\PIPE\\srvsvc]","ncacn_ip_tcp:176.120.22.61[1027]","ncalrpc:[ubpmtaskhostchannel]","ncacn_np:\\\\M051108[\\PIPE\\atsvc]","ncalrpc:[senssvc]","ncalrpc:[OLECCD6EA245DBE3DB48EB998DFA810]","ncalrpc:[IUserProfile2]","ncalrpc:[senssvc]","ncalrpc:[OLECCD6EA245DBE3DB48EB998DFA810]","ncalrpc:[IUserProfile2]","ncalrpc:[OLECCD6EA245DBE3DB48EB998DFA810]","ncalrpc:[IUserProfile2]","ncalrpc:[IUserProfile2]"],"executable":"sysntfy.dll","explained_uuid":"c9ac6db5-82b7-4e55-ae8a-e464ed7b4277 v1.0 Impl friendly name","protocol":"N/A"},{"bindings":["ncalrpc:[actkernel]","ncalrpc:[umpo]"],"executable":"N/A","explained_uuid":"2d98a740-581d-41b9-aa0d-a88b9d5ce938 v1.0","protocol":"N/A"},{"bindings":["ncalrpc:[LRPC-8dc8f5673df46eb52d]","ncacn_ip_tcp:176.120.22.61[1026]","ncacn_np:\\\\M051108[\\pipe\\eventlog]","ncalrpc:[eventlog]"],"executable":"nrpsrv.dll","explained_uuid":"30adc50c-5cbc-46ce-9a0e-91914789e23c v1.0 NRP server endpoint","protocol":"N/A"},{"bindings":["ncalrpc:[LRPC-8116c31a18a2af404a]"],"executable":"BFE.DLL","explained_uuid":"dd490425-5325-4565-b774-7e27d6c09c24 v1.0 Base Firewall Engine API","protocol":"N/A"},{"bindings":["ncacn_np:\\\\M051108[\\PIPE\\wkssvc]","ncalrpc:[LRPC-43ef2ed6ee1c17eb27]","ncalrpc:[DNSResolver]"],"executable":"N/A","explained_uuid":"7f1343fe-50a9-4927-a778-0c5859517bac v1.0 DfsDs service","protocol":"N/A"},{"bindings":["ncalrpc:[LRPC-43ef2ed6ee1c17eb27]","ncalrpc:[DNSResolver]"],"executable":"N/A","explained_uuid":"f2c9b409-c1c9-4100-8639-d8ab1486694a v1.0 Witness Client Upcall Server","protocol":"N/A"},{"bindings":["ncacn_ip_tcp:176.120.22.61[1030]"],"executable":"FwRemoteSvr.dll","explained_uuid":"6b5bdd1e-528c-422c-af8c-a4079be4fe48 v1.0 Remote Fw APIs","protocol":"[MS-FASP]: Firewall and Advanced Security Protocol"},{"bindings":["ncacn_ip_tcp:176.120.22.61[1027]","ncalrpc:[ubpmtaskhostchannel]","ncacn_np:\\\\M051108[\\PIPE\\atsvc]","ncalrpc:[senssvc]","ncalrpc:[OLECCD6EA245DBE3DB48EB998DFA810]","ncalrpc:[IUserProfile2]"],"executable":"N/A","explained_uuid":"c49a5a70-8a7f-4e70-ba16-1e8f1f193ef1 v1.0 Adh APIs","protocol":"N/A"},{"bindings":["ncalrpc:[LRPC-ddacc17bdd42921044]"],"executable":"N/A","explained_uuid":"b2507c30-b126-494a-92ac-ee32b6eeb039 v1.0","protocol":"N/A"},{"bindings":["ncalrpc:[LRPC-43ef2ed6ee1c17eb27]","ncalrpc:[DNSResolver]"],"executable":"N/A","explained_uuid":"eb081a0d-10ee-478a-a1dd-50995283e7a8 v3.0 Witness Client Test Interface","protocol":"N/A"},{"bindings":["ncacn_ip_tcp:176.120.22.61[1028]","ncalrpc:[LRPC-697e8331bb546929eb]"],"executable":"spoolsv.exe","explained_uuid":"4a452661-8290-4b36-8fbe-7f4093a94978 v1.0","protocol":"N/A"}]},"exposures":[{"confidence":1,"evidence":[{"data_path":"protocol","found_value":"DCERPC","literal_match":"DCERPC"}],"id":"CENSYS-2022-1025","metrics":{},"name":"Exposed DCERPC Service","risk_source":"censys","severity":"high","source":"censys","year":2022}],"ip":"176.120.22.61","ja4tscan":{"fingerprint":"8192_2-1-3-4-8_1460_8_3-6","scan_time":"2026-09-06T16:42:06Z"},"labels":[{"confidence":1,"evidence":[{"data_path":"protocol","found_value":"DCERPC","literal_match":"DCERPC"}],"source":"censys","value":"REMOTE_ACCESS"}],"port":135,"protocol":"DCERPC","scan_time":"2026-09-06T15:36:11Z","software":[{"confidence":1,"evidence":[{"data_path":"protocol","found_value":"DCERPC","literal_match":"DCERPC"}],"part":"a","source":"censys","type":["REMOTE_ACCESS"]}],"transport_protocol":"tcp"},{"banner":"�؄\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000 CKAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\u0000\u0000!\u0000\u0001\u0000\u0000\u0000\u0000\u0000/\u0000<��p�p\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000","banner_hash_sha256":"3eafb65f29d04699ee533a5329edd7fcc03a4a623be0e41032afe81389e2e9cc","banner_hex":"e5d88400000000010000000020434b414141414141414141414141414141414141414141414141414141414141000021000100000000002f003cecef70ab7000000000000000000000000000000000000000000000000000000000000000000000000000000000","exposures":[{"confidence":1,"evidence":[{"data_path":"protocol","found_value":"NETBIOS","literal_match":"NETBIOS"}],"id":"CENSYS-2022-1048","metrics":{},"name":"Exposed NetBIOS Service","risk_source":"censys","severity":"high","source":"censys","year":2022}],"ip":"176.120.22.61","port":137,"protocol":"NETBIOS","scan_time":"2026-09-07T02:28:50Z","transport_protocol":"udp"},{"banner":"�\u0000\u0000\u0001�","banner_hash_sha256":"ffda6a629d2fc268bbf42019878a56c91ba8a0ca8162c9caa291fff957623e04","banner_hex":"8300000182","exposures":[{"confidence":1,"evidence":[{"data_path":"protocol","found_value":"NETBIOS","literal_match":"NETBIOS"}],"id":"CENSYS-2022-1048","metrics":{},"name":"Exposed NetBIOS Service","risk_source":"censys","severity":"high","source":"censys","year":2022}],"ip":"176.120.22.61","ja4tscan":{"fingerprint":"8192_2-1-3-4-8_1460_8_3-6","scan_time":"2026-09-04T09:30:36Z"},"port":139,"protocol":"NETBIOS","scan_time":"2026-09-07T09:45:55Z","transport_protocol":"tcp"},{"cert":{"added_at":"2026-08-15T08:45:19Z","ever_seen_in_scan":true,"fingerprint_md5":"d1c6245ff53529256936944f02bbb799","fingerprint_sha1":"8ed826c5a4d251e4114c41bd805cadbaaa453d28","fingerprint_sha256":"5675a959342e713a3f29e67f65da3bdbada9488cfc1cdb49e763c1471f84bbf9","modified_at":"2026-08-15T08:45:19Z","names":["M051108"],"parse_status":"success","parsed":{"extensions":{"extended_key_usage":{"server_auth":true},"key_usage":{"data_encipherment":true,"key_encipherment":true,"value":12}},"issuer":{"common_name":["M051108"]},"issuer_dn":"CN=M051108","ja4x":"7022c563de38_7022c563de38_e73b053161df","serial_number":"41589344625908147176989412798876321205","serial_number_hex":"1f49d100c949abb941aa0fb62bdf85b5","signature":{"self_signed":true,"signature_algorithm":{"name":"SHA1-RSA","oid":"1.2.840.113549.1.1.5"},"valid":true,"value":"a2791bf8c3e14d5e9d6d6191107e6b53091d530ea61818324cf2a5408a78f93f47e57affe03bef889623fec3a4eec5dbf83674136fc2fc606b8801632edea7d14e1fe4ca0662e9e348890d27e373566aa1c61cbadfb1ef25c3f4fd38c3d6937620d92bb991076fdf80f3f19c42d6d8abd23e1a509f94dceca872f332eb78d0fa3816c5847fc0260f054ccdf108c53ef3a5082e0742d0fe683bb3ea74c08af50e860732275bc9034891546862afe8eb5ef7afd7f6111bcece21d6b5c4ca59170a2175a74cf77125861369b2047c9e30d5668ffbbbce785325e9756c3edd1332d6cdd3e02a878211ed41a07b8bd9df80d5899a64fb04520d63cfd106a34f7aa8c0"},"subject":{"common_name":["M051108"]},"subject_dn":"CN=M051108","subject_key_info":{"fingerprint_sha256":"b9df7ebb8ef6601132112b543ac023199a9fe33e8fce6ef03ee2250c5d2728e6","key_algorithm":{"name":"RSA","oid":"1.2.840.113549.1.1.1"},"rsa":{"exponent":65537,"length":2048,"modulus":"e337f4e05615c11cf4743f38b87a0cc4b3313f7abc5c642901fbd3843349e724d9d0deb581fadecbd8bb02d9c9122303d6bbf2498e2a827a77b6126ab0cbe62e986aa62e2e96cd936d30213e2180f4f71e5b8fa57ac322aab66a5c879e2008c31e1ebe195681834ed90d36b3255530d9b25f079cad7b8f39ee5f21feb7b05051dfd1bc310de0efbb1ba3276d73d1968e98e8c2cfbc12ebf2663d771ea61fe7e11c648478adbf97b65dd773097d00cb21ace23d760a0fcf9933203469d6f0dcc933ed3f74edc8263934fcdccb48405d4ef6e1242645a59e05741d809b4d8ac8773f73f7b6c7c5f3f2533c17a20b15ff98107571b4de52051e0b5bdfe94402d4ff"}},"validity_period":{"length_seconds":15811201,"not_after":"2027-02-12T17:38:09Z","not_before":"2026-08-13T17:38:09Z"},"version":3},"revocation":{"crl":{},"ocsp":{}},"spki_fingerprint_sha256":"327d02d5dbdacd30babf1821153434758680ab53c94a9eceb40becc86dd8fbf5","spki_subject_fingerprint_sha256":"327d02d5dbdacd30babf1821153434758680ab53c94a9eceb40becc86dd8fbf5","tbs_fingerprint_sha256":"1440f978a4d1acb56c72be659a2289ab3a2c5d9f3f3964c2edda1776dabefaa2","tbs_no_ct_fingerprint_sha256":"1440f978a4d1acb56c72be659a2289ab3a2c5d9f3f3964c2edda1776dabefaa2","validated_at":"2026-09-06T21:52:42Z","validation":{"apple":{},"chrome":{},"microsoft":{},"nss":{}},"zlint":{"errors_present":true,"failed_lints":["e_ext_san_missing","e_sub_cert_aia_does_not_contain_ocsp_url","e_sub_cert_aia_missing","e_sub_cert_cert_policy_empty","e_sub_cert_certificate_policies_missing","e_sub_cert_or_sub_ca_using_sha1","e_subject_common_name_not_exactly_from_san","n_subject_common_name_included","w_ext_key_usage_not_critical","w_ext_subject_key_identifier_missing_sub_cert","w_sub_cert_sha1_expiration_too_long"],"notices_present":true,"timestamp":"2026-08-15T08:45:19Z","version":3,"warnings_present":true}},"exposures":[{"confidence":1,"evidence":[{"data_path":"protocol","found_value":"RDP","literal_match":"RDP"}],"id":"CENSYS-2022-1054","metrics":{},"name":"Exposed RDP Service","risk_source":"censys","severity":"high","source":"censys","year":2022}],"ip":"176.120.22.61","ja4tscan":{"fingerprint":"64000_2-1-3-4-8_1460_0_3-6","scan_time":"2026-09-07T09:38:24Z"},"jarm":{"cipher_and_version_fingerprint":"26d26d16d26d26d22c26d26d26d26d","fingerprint":"26d26d16d26d26d22c26d26d26d26dd7fc4c7c6ef19b77a4ca0787979cdc13","ip":"176.120.22.61","is_success":true,"port":3389,"scan_time":"2026-09-05T11:16:24Z","tls_extensions_sha256":"d7fc4c7c6ef19b77a4ca0787979cdc13","transport_protocol":"tcp"},"labels":[{"confidence":1,"evidence":[{"data_path":"protocol","found_value":"RDP","literal_match":"RDP"}],"source":"censys","value":"REMOTE_ACCESS"}],"misconfigs":[{"confidence":0.5,"evidence":[{"data_path":"service.tls.cipher_selected","found_value":"TLS_RSA_WITH_AES_256_GCM_SHA384","literal_match":"TLS_RSA_WITH_AES_256_GCM_SHA384"}],"id":"CENSYS-2026-1193","metrics":{},"name":"Weak TLS Cipher Selected","risk_source":"censys","severity":"medium","source":"censys","year":2026},{"confidence":1,"evidence":[{"data_path":"cert.parsed.signature.self_signed","found_value":"true"}],"id":"CENSYS-2026-1196","metrics":{},"name":"Self-Signed Certificate","risk_source":"censys","severity":"low","source":"censys","year":2026}],"port":3389,"protocol":"RDP","rdp":{"certificate_info":{},"connect_response":{"domain_parameters":{"domain_protocol_version":2,"max_channel_ids":34,"max_mcspdu_size":65528,"max_provider_height":1,"max_user_id_channels":3,"num_priorities":1}},"protocol_flags":{"dynvc_graphics_pipeline":true,"extended_client_data_supported":true,"neg_resp_reserved":true,"restricted_admin_mode":true},"selected_security_protocol":{"raw_value":1,"standard_rdp":true,"tls":true},"version":{"major":5,"raw":"00000000"},"x224_cc_pdu_dstref":51966,"x224_cc_pdu_srcref":13330},"scan_time":"2026-09-07T01:41:33Z","screenshots":[{"extracted_text":"","handle":"efd2d3c6a3734d9ea87930e03e64110e","phash":"0000000000000000"}],"software":[{"confidence":1,"evidence":[{"data_path":"protocol","found_value":"RDP","literal_match":"RDP"}],"part":"a","source":"censys","type":["REMOTE_ACCESS"]}],"tls":{"cipher_selected":"TLS_RSA_WITH_AES_256_GCM_SHA384","fingerprint_sha256":"5675a959342e713a3f29e67f65da3bdbada9488cfc1cdb49e763c1471f84bbf9","ja3s":"f75082535b4a79c07b31bdd0e2b7eb87","ja4s":"t120100_009d_bc98f8e001b5","version_selected":"tlsv1_2","versions":[{"ja3s":"f75082535b4a79c07b31bdd0e2b7eb87","ja4s":"t120100_009d_bc98f8e001b5","version":"tlsv1_2"},{"ja3s":"1308be477c8afb355e2860ab89378ae5","ja4s":"t110100_c014_bc98f8e001b5","version":"tlsv1_1"},{"ja3s":"bcf3a836c82d12ee988005fb0c011445","ja4s":"t100100_c014_bc98f8e001b5","version":"tlsv1_0"}]},"transport_protocol":"tcp"},{"banner_hash_sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","exposures":[{"confidence":1,"evidence":[{"data_path":"protocol","found_value":"WINRM","literal_match":"WINRM"}],"id":"CENSYS-2025-1027","metrics":{},"name":"Exposed WINRM Service","risk_source":"censys","severity":"high","source":"censys","year":2025}],"ip":"176.120.22.61","ja4tscan":{"fingerprint":"8192_2-1-3-4-8_1460_8_3-6","scan_time":"2026-09-05T09:49:46Z"},"labels":[{"confidence":1,"evidence":[{"data_path":"protocol","found_value":"WINRM","literal_match":"WINRM"}],"source":"censys","value":"REMOTE_ACCESS"}],"port":5985,"protocol":"WINRM","scan_time":"2026-09-03T22:08:29Z","software":[{"confidence":1,"evidence":[{"data_path":"protocol","found_value":"WINRM","literal_match":"WINRM"}],"part":"a","source":"censys","type":["REMOTE_ACCESS"]}],"transport_protocol":"tcp","winrm":{"auth_types":["Negotiate"],"ntlm_info":{"always_sign_supported":true,"challenge_type":3,"dns_domain_name":"M051108","dns_server_name":"M051108","encryption_128bit_supported":true,"encryption_56bit_supported":true,"netbios_computer_name":"M051108","netbios_domain_name":"M051108","ntlm1_supported":true,"ntlm2_supported":true,"ntlm_version":15,"os_version":"6.3.9600","target_name":"M051108"}}},{"banner":"HTTP/1.1 404 Not Found\r\nContent-Type: text/html; charset=us-ascii\r\nServer: Microsoft-HTTPAPI/2.0\r\nDate: \r\nConnection: close\r\nContent-Length: 315\r\n","banner_hash_sha256":"d7de42c1e8c09cf951e3ad6248fda3ab48a60ca3eac8b25effd4b3067df8f362","endpoints":[{"banner":"HTTP/1.1 404 Not Found\r\nContent-Type: text/html; charset=us-ascii\r\nServer: Microsoft-HTTPAPI/2.0\r\nDate: \r\nConnection: close\r\nContent-Length: 315\r\n","banner_hash_sha256":"d7de42c1e8c09cf951e3ad6248fda3ab48a60ca3eac8b25effd4b3067df8f362","endpoint_type":"HTTP","hostname":"176.120.22.61","http":{"body":"\r\nNot Found\r\n\r\n

Not Found

\r\n

HTTP Error 404. The requested resource is not found.

\r\n\r\n","body_hash_sha1":"a66898b36c94c53766e66c1a7aaeb149447ec083","body_hash_sha256":"ce7127c38e30e92a021ed2bd09287713c6a923db9ffdb43f126e8965d777fbf0","body_hash_tlsh":"8be07d6d9856aac542a0f4bc75d193b48115038fd4e547d90051b21714891bcc1f0dcf","body_size":315,"headers":{"Connection":{"headers":["close"]},"Content-Length":{"headers":["315"]},"Content-Type":{"headers":["text/html; charset=us-ascii"]},"Date":{"headers":[""]},"Server":{"headers":["Microsoft-HTTPAPI/2.0"]}},"html_tags":["Not Found",""],"html_title":"Not Found","protocol":"HTTP/1.1","status_code":404,"status_reason":"Not Found","supported_versions":["HTTP/1.1"],"uri":"http://176.120.22.61:47001/"},"ip":"176.120.22.61","path":"/","port":47001,"scan_time":"2026-09-07T08:04:01Z","transport_protocol":"tcp"}],"ip":"176.120.22.61","ja4tscan":{"fingerprint":"8192_2-1-3-4-8_1460_8_3-6","scan_time":"2026-09-05T09:40:40Z"},"operating_systems":[{"confidence":0.25,"cpe":"cpe:2.3:o:microsoft:windows:*:*:*:*:*:*:*:*","evidence":[{"data_path":"http.headers.server"}],"part":"o","product":"windows","source":"recog","vendor":"microsoft"}],"port":47001,"protocol":"HTTP","scan_time":"2026-09-07T08:04:01Z","software":[{"confidence":0.25,"cpe":"cpe:2.3:a:microsoft:http_api:2.0:*:*:*:*:*:*:*","evidence":[{"data_path":"http.headers.server"}],"part":"a","product":"http_api","source":"recog","vendor":"microsoft","version":"2.0"}],"transport_protocol":"tcp"}],"whois":{"network":{"cidrs":["176.120.22.0/24"],"created":"2024-08-27T00:00:00Z","handle":"RU-PROTON66-20240827","name":"Proton66 OOO","updated":"2024-08-27T00:00:00Z"},"organization":{"abuse_contacts":[{"email":"abuse@proton66.ru","handle":"AR70098-RIPE","name":"Abuse-C Role"}],"address":"DISTRICT No. 54, ISKROVSKY PR-KT, D. 21, LIT. U, kv.218\\n193230\\nST. PETERSBURG\\nRUSSIAN FEDERATION","admin_contacts":[{"email":"mail@proton66.ru","handle":"TD6653-RIPE","name":"Tech dept."}],"handle":"ORG-PO84-RIPE","name":"Proton66 OOO"}}}}},"services":{"result":{"next_page_token":"02d52b35a517b30b2b695fbb:gh0JPwvaJkzKw4pU+j7uvr6ac7UjnIeezU0WAjXWRNq+6Sl4BPacLsiWU9V6W+cKLav69TTbJu1uTaWrPsUtx8loj5Gbc8SL9J4VB9gAcBJwL9hMUmO1IQSfgD21O33HYkFi3HhamhtkHcvQAAPMrNrPDkengOPbpEDNJ1nFqznfvarwpnxWy9362afBeoIKsgD34DRY+FXqAt5TjeRjUSqJr/WbwFZeydyCBFtjA7WFqaAoXrRtDpOL6wvMHAhjMP6DodMIz3wI155dtm49Jz/r44kahbRGjcCzttbEymzC9/WtEVfn7jZXDHkfo0otS2sKopN0icLkzc0Bl48vwQft5GTvT8FMYq4sNHf1qxsNtda2U3ljTrFhXSZu2+OTBOBRQ6Fr0kgcGplYwLOY0Jd72G/PMTmz8Fa5Yi7vWPXrOAzLgnurUnHVXU/9Gvr3PodmZEUw+B9wVAyTglxr/6+G5YtWel5zf1FG7gS6ZTuNrT5El3rF/B9wsk96hzS1VnU9Y56jVn84q6uqG2uk5DOuCPGI2Wq05MKFT/Ca4Bqen4u7b8+YW+y/ZeJSMz6++V4NMh9JhsfdGMhSZEvdNGADxFq+fLIkG45MoOLmM6ETXuYBBZkSBatKCwskWwS7uV0RQsEnkJRfX2uIngZvjdAtcgyTFbU4opKnxBknXamvIRk9qWfXGHpGuTzbM8THish/lyHeaTt6Q6QpnvZMm2gMTAXwJuWcBAT6i4jDpZv6L0/XYY5S1xGrC9uLr7nrjcE6RPf4","ranges":[{"end_time":"2026-09-07T01:41:34.02976Z","ip":"176.120.22.61","port":"3389","protocol":"RDP","start_time":"2026-08-06T19:47:31.859886Z","transport_protocol":"TCP"},{"end_time":"2026-09-06T16:36:46.224868Z","ip":"176.120.22.61","port":"137","protocol":"NETBIOS","start_time":"2026-08-20T07:42:14.372647Z","transport_protocol":"UDP"},{"end_time":"2026-09-06T15:36:12.257911Z","ip":"176.120.22.61","port":"135","protocol":"DCERPC","start_time":"2026-08-06T02:43:46.311271Z","transport_protocol":"TCP"},{"end_time":"2026-09-06T08:33:01.67775Z","ip":"176.120.22.61","port":"139","protocol":"NETBIOS","start_time":"2026-09-02T02:12:44.871529Z","transport_protocol":"TCP"},{"end_time":"2026-09-06T05:55:16.624856Z","ip":"176.120.22.61","port":"47001","protocol":"HTTP","start_time":"2026-08-06T02:43:52.747803Z","transport_protocol":"TCP"},{"end_time":"2026-09-06T04:01:47.692342Z","ip":"176.120.22.61","port":"5985","protocol":"HTTP","start_time":"2026-08-06T02:44:01.749124Z","transport_protocol":"TCP"},{"end_time":"2026-09-03T22:08:30.585154Z","ip":"176.120.22.61","port":"5985","protocol":"WINRM","start_time":"2026-09-03T22:08:29.585154Z","transport_protocol":"TCP"},{"end_time":"2026-09-01T05:35:21.503535Z","ip":"176.120.22.61","port":"139","protocol":"UNKNOWN","start_time":"2026-09-01T05:34:56.997486Z","transport_protocol":"TCP"},{"end_time":"2026-09-01T05:34:29.380106Z","ip":"176.120.22.61","port":"139","protocol":"UNKNOWN","start_time":"2026-08-31T05:20:25.159832Z","transport_protocol":"TCP"},{"end_time":"2026-08-30T10:32:06.311402Z","ip":"176.120.22.61","port":"139","protocol":"NETBIOS","start_time":"2026-08-27T12:18:02.047257Z","transport_protocol":"TCP"},{"end_time":"2026-08-27T08:43:41.570019Z","ip":"176.120.22.61","port":"139","protocol":"UNKNOWN","start_time":"2026-08-27T08:43:40.570019Z","transport_protocol":"TCP"},{"end_time":"2026-08-26T10:21:46.760391Z","ip":"176.120.22.61","port":"139","protocol":"NETBIOS","start_time":"2026-08-26T10:20:25.67231Z","transport_protocol":"TCP"},{"end_time":"2026-08-26T08:13:36.504647Z","ip":"176.120.22.61","port":"139","protocol":"UNKNOWN","start_time":"2026-08-26T08:13:35.504647Z","transport_protocol":"TCP"},{"end_time":"2026-08-26T08:13:12.42251Z","ip":"176.120.22.61","port":"139","protocol":"UNKNOWN","start_time":"2026-08-25T04:43:30.494382Z","transport_protocol":"TCP"},{"end_time":"2026-08-25T17:34:19.531526Z","ip":"176.120.22.61","port":"5985","protocol":"WINRM","start_time":"2026-08-08T19:17:33.821091Z","transport_protocol":"TCP"},{"end_time":"2026-08-24T07:36:40.054527Z","ip":"176.120.22.61","port":"139","protocol":"NETBIOS","start_time":"2026-08-23T06:50:12.773792Z","transport_protocol":"TCP"},{"end_time":"2026-08-22T15:23:44.11493Z","ip":"176.120.22.61","port":"139","protocol":"UNKNOWN","start_time":"2026-08-22T08:38:09.523732Z","transport_protocol":"TCP"},{"end_time":"2026-08-22T08:37:33.581826Z","ip":"176.120.22.61","port":"139","protocol":"UNKNOWN","start_time":"2026-08-21T07:41:17.778311Z","transport_protocol":"TCP"},{"end_time":"2026-08-21T07:38:14.917603Z","ip":"176.120.22.61","port":"139","protocol":"UNKNOWN","start_time":"2026-08-21T07:38:13.917603Z","transport_protocol":"TCP"},{"end_time":"2026-08-21T07:19:00.451075Z","ip":"176.120.22.61","port":"139","protocol":"NETBIOS","start_time":"2026-08-21T07:18:59.451075Z","transport_protocol":"TCP"},{"end_time":"2026-08-20T06:44:17.276544Z","ip":"176.120.22.61","port":"139","protocol":"UNKNOWN","start_time":"2026-08-20T06:44:16.276544Z","transport_protocol":"TCP"},{"end_time":"2026-08-19T07:50:18.707543Z","ip":"176.120.22.61","port":"139","protocol":"NETBIOS","start_time":"2026-08-18T11:41:13.716445Z","transport_protocol":"TCP"},{"end_time":"2026-08-19T02:49:51.723149Z","ip":"176.120.22.61","port":"137","protocol":"NETBIOS","start_time":"2026-08-09T20:06:57.477747Z","transport_protocol":"UDP"},{"end_time":"2026-08-17T14:01:55.895553Z","ip":"176.120.22.61","port":"139","protocol":"UNKNOWN","start_time":"2026-08-17T14:01:53.811806Z","transport_protocol":"TCP"},{"end_time":"2026-08-17T14:01:48.234317Z","ip":"176.120.22.61","port":"139","protocol":"UNKNOWN","start_time":"2026-08-17T14:01:47.234317Z","transport_protocol":"TCP"},{"end_time":"2026-08-17T14:01:34.438545Z","ip":"176.120.22.61","port":"139","protocol":"UNKNOWN","start_time":"2026-08-16T07:32:40.445243Z","transport_protocol":"TCP"},{"end_time":"2026-08-15T13:38:22.298154Z","ip":"176.120.22.61","port":"139","protocol":"NETBIOS","start_time":"2026-08-06T18:41:27.264213Z","transport_protocol":"TCP"},{"end_time":"2026-08-05T01:37:40.529844Z","ip":"176.120.22.61","port":"139","protocol":"NETBIOS","start_time":"2026-08-05T01:37:39.529844Z","transport_protocol":"TCP"},{"end_time":"2026-08-04T18:00:08.854314Z","ip":"176.120.22.61","port":"3389","protocol":"RDP","start_time":"2026-08-04T18:00:07.854314Z","transport_protocol":"TCP"},{"end_time":"2026-08-04T00:07:25.545518Z","ip":"176.120.22.61","port":"135","protocol":"DCERPC","start_time":"2026-08-04T00:07:24.545518Z","transport_protocol":"TCP"},{"end_time":"2026-06-11T18:17:40.953526Z","ip":"176.120.22.61","port":"139","protocol":"UNKNOWN","start_time":"2026-06-11T18:17:39.953526Z","transport_protocol":"TCP"},{"end_time":"2026-06-11T17:13:52.184593Z","ip":"176.120.22.61","port":"139","protocol":"NETBIOS","start_time":"2026-06-11T17:13:51.184593Z","transport_protocol":"TCP"},{"end_time":"2026-06-03T05:21:47.778097Z","ip":"176.120.22.61","port":"47001","protocol":"UNKNOWN","start_time":"2026-06-03T05:21:46.778097Z","transport_protocol":"TCP"},{"end_time":"2026-06-01T13:21:45.552973Z","ip":"176.120.22.61","port":"47001","protocol":"UNKNOWN","start_time":"2026-06-01T13:21:44.552973Z","transport_protocol":"TCP"},{"end_time":"2026-05-31T11:59:37.716174Z","ip":"176.120.22.61","port":"139","protocol":"NETBIOS","start_time":"2026-05-31T11:59:36.716174Z","transport_protocol":"TCP"},{"end_time":"2026-05-31T04:38:06.680817Z","ip":"176.120.22.61","port":"47001","protocol":"UNKNOWN","start_time":"2026-05-31T04:38:05.680817Z","transport_protocol":"TCP"},{"end_time":"2026-05-29T22:14:19.208939Z","ip":"176.120.22.61","port":"139","protocol":"NETBIOS","start_time":"2026-05-29T22:14:18.208939Z","transport_protocol":"TCP"},{"end_time":"2026-05-29T07:02:58.389854Z","ip":"176.120.22.61","port":"139","protocol":"NETBIOS","start_time":"2026-05-29T07:02:57.389854Z","transport_protocol":"TCP"},{"end_time":"2026-05-29T04:05:25.20307Z","ip":"176.120.22.61","port":"47001","protocol":"UNKNOWN","start_time":"2026-05-29T04:05:24.20307Z","transport_protocol":"TCP"},{"end_time":"2026-05-28T17:28:28.787203Z","ip":"176.120.22.61","port":"3389","protocol":"UNKNOWN","start_time":"2026-05-28T17:28:27.787203Z","transport_protocol":"TCP"},{"end_time":"2026-05-27T13:13:50.268721Z","ip":"176.120.22.61","port":"139","protocol":"NETBIOS","start_time":"2026-05-27T01:07:49.294913Z","transport_protocol":"TCP"},{"end_time":"2026-05-21T11:39:31.149123Z","ip":"176.120.22.61","port":"47001","protocol":"UNKNOWN","start_time":"2026-05-21T11:39:30.149123Z","transport_protocol":"TCP"},{"end_time":"2026-05-20T06:35:47.601788Z","ip":"176.120.22.61","port":"47001","protocol":"UNKNOWN","start_time":"2026-05-18T05:24:08.392658Z","transport_protocol":"TCP"},{"end_time":"2026-05-17T01:18:18.028105Z","ip":"176.120.22.61","port":"47001","protocol":"UNKNOWN","start_time":"2026-05-17T01:18:17.028105Z","transport_protocol":"TCP"},{"end_time":"2026-05-15T15:31:29.175412Z","ip":"176.120.22.61","port":"5985","protocol":"UNKNOWN","start_time":"2026-05-15T15:31:28.175412Z","transport_protocol":"TCP"},{"end_time":"2026-05-15T04:14:16.791927Z","ip":"176.120.22.61","port":"135","protocol":"DCERPC","start_time":"2026-05-15T04:14:15.791927Z","transport_protocol":"TCP"},{"end_time":"2026-05-15T03:55:36.848816Z","ip":"176.120.22.61","port":"47001","protocol":"UNKNOWN","start_time":"2026-05-15T03:55:35.848816Z","transport_protocol":"TCP"},{"end_time":"2026-05-14T14:56:17.761063Z","ip":"176.120.22.61","port":"5985","protocol":"UNKNOWN","start_time":"2026-05-14T14:56:16.761063Z","transport_protocol":"TCP"},{"end_time":"2026-05-13T15:08:00.800876Z","ip":"176.120.22.61","port":"47001","protocol":"UNKNOWN","start_time":"2026-05-13T15:07:59.800876Z","transport_protocol":"TCP"},{"end_time":"2026-05-13T03:26:28.627729Z","ip":"176.120.22.61","port":"135","protocol":"DCERPC","start_time":"2026-05-12T07:50:34.962837Z","transport_protocol":"TCP"},{"end_time":"2026-05-13T02:20:49.751824Z","ip":"176.120.22.61","port":"5985","protocol":"UNKNOWN","start_time":"2026-05-13T02:20:48.751824Z","transport_protocol":"TCP"},{"end_time":"2026-05-12T18:40:14.353273Z","ip":"176.120.22.61","port":"5985","protocol":"UNKNOWN","start_time":"2026-05-12T18:40:13.353273Z","transport_protocol":"TCP"},{"end_time":"2026-05-11T18:48:39.930699Z","ip":"176.120.22.61","port":"47001","protocol":"UNKNOWN","start_time":"2026-05-11T18:48:38.930699Z","transport_protocol":"TCP"},{"end_time":"2026-05-11T02:01:01.410146Z","ip":"176.120.22.61","port":"139","protocol":"NETBIOS","start_time":"2026-05-10T02:24:06.195117Z","transport_protocol":"TCP"},{"end_time":"2026-05-10T22:31:35.377374Z","ip":"176.120.22.61","port":"5985","protocol":"UNKNOWN","start_time":"2026-05-10T22:31:34.377374Z","transport_protocol":"TCP"},{"end_time":"2026-05-10T05:37:23.559231Z","ip":"176.120.22.61","port":"47001","protocol":"UNKNOWN","start_time":"2026-05-10T05:37:22.559231Z","transport_protocol":"TCP"},{"end_time":"2026-05-09T21:37:43.506453Z","ip":"176.120.22.61","port":"5985","protocol":"UNKNOWN","start_time":"2026-05-09T21:37:42.506453Z","transport_protocol":"TCP"},{"end_time":"2026-05-09T21:37:29.450271Z","ip":"176.120.22.61","port":"5985","protocol":"UNKNOWN","start_time":"2026-05-09T21:37:28.450271Z","transport_protocol":"TCP"},{"end_time":"2026-05-09T19:54:50.330648Z","ip":"176.120.22.61","port":"139","protocol":"UNKNOWN","start_time":"2026-05-09T19:54:49.330648Z","transport_protocol":"TCP"},{"end_time":"2026-05-08T21:15:58.311145Z","ip":"176.120.22.61","port":"5985","protocol":"UNKNOWN","start_time":"2026-05-07T22:59:54.997321Z","transport_protocol":"TCP"},{"end_time":"2026-05-08T21:15:51.999282Z","ip":"176.120.22.61","port":"47001","protocol":"UNKNOWN","start_time":"2026-05-08T21:15:50.999282Z","transport_protocol":"TCP"},{"end_time":"2026-05-07T18:31:48.72907Z","ip":"176.120.22.61","port":"5985","protocol":"UNKNOWN","start_time":"2026-05-06T17:48:21.177639Z","transport_protocol":"TCP"},{"end_time":"2026-05-05T02:28:47.751376Z","ip":"176.120.22.61","port":"137","protocol":"NETBIOS","start_time":"2026-05-05T02:28:46.751376Z","transport_protocol":"UDP"},{"end_time":"2026-05-04T08:28:18.641295Z","ip":"176.120.22.61","port":"47001","protocol":"HTTP","start_time":"2026-05-04T08:28:17.641295Z","transport_protocol":"TCP"},{"end_time":"2026-05-03T02:16:38.304547Z","ip":"176.120.22.61","port":"137","protocol":"NETBIOS","start_time":"2026-05-03T02:16:37.304547Z","transport_protocol":"UDP"},{"end_time":"2026-05-02T04:21:56.385586Z","ip":"176.120.22.61","port":"47001","protocol":"HTTP","start_time":"2026-05-02T04:21:55.385586Z","transport_protocol":"TCP"},{"end_time":"2026-05-01T11:51:04.381131Z","ip":"176.120.22.61","port":"5985","protocol":"HTTP","start_time":"2026-04-30T11:09:07.220963Z","transport_protocol":"TCP"},{"end_time":"2026-04-30T22:59:39.760584Z","ip":"176.120.22.61","port":"47001","protocol":"HTTP","start_time":"2026-04-29T21:47:33.085667Z","transport_protocol":"TCP"},{"end_time":"2026-04-30T00:32:19.26696Z","ip":"176.120.22.61","port":"135","protocol":"DCERPC","start_time":"2026-04-27T23:16:37.032761Z","transport_protocol":"TCP"},{"end_time":"2026-04-29T12:17:13.960929Z","ip":"176.120.22.61","port":"3389","protocol":"UNKNOWN","start_time":"2026-04-29T12:17:12.960929Z","transport_protocol":"TCP"},{"end_time":"2026-04-29T06:41:09.172449Z","ip":"176.120.22.61","port":"5985","protocol":"HTTP","start_time":"2026-04-29T06:41:08.172449Z","transport_protocol":"TCP"},{"end_time":"2026-04-28T22:32:55.762689Z","ip":"176.120.22.61","port":"137","protocol":"NETBIOS","start_time":"2026-04-27T01:40:45.637947Z","transport_protocol":"UDP"},{"end_time":"2026-04-28T21:27:04.225648Z","ip":"176.120.22.61","port":"3389","protocol":"UNKNOWN","start_time":"2026-04-28T21:27:03.225648Z","transport_protocol":"TCP"},{"end_time":"2026-04-28T16:35:18.810593Z","ip":"176.120.22.61","port":"3389","protocol":"RDP","start_time":"2026-04-28T16:35:17.810593Z","transport_protocol":"TCP"},{"end_time":"2026-04-28T12:48:34.982189Z","ip":"176.120.22.61","port":"47001","protocol":"HTTP","start_time":"2026-04-27T11:58:42.4909Z","transport_protocol":"TCP"},{"end_time":"2026-04-28T08:44:26.059079Z","ip":"176.120.22.61","port":"139","protocol":"UNKNOWN","start_time":"2026-04-28T08:44:25.059079Z","transport_protocol":"TCP"},{"end_time":"2026-04-27T22:15:41.662264Z","ip":"176.120.22.61","port":"5985","protocol":"HTTP","start_time":"2026-04-27T22:15:40.662264Z","transport_protocol":"TCP"},{"end_time":"2026-04-27T16:13:54.947103Z","ip":"176.120.22.61","port":"3389","protocol":"UNKNOWN","start_time":"2026-04-27T16:13:53.947103Z","transport_protocol":"TCP"},{"end_time":"2026-04-27T07:45:54.375223Z","ip":"176.120.22.61","port":"139","protocol":"UNKNOWN","start_time":"2026-04-27T07:45:53.375223Z","transport_protocol":"TCP"},{"end_time":"2026-04-26T13:58:08.231706Z","ip":"176.120.22.61","port":"5985","protocol":"HTTP","start_time":"2026-04-26T13:58:07.231706Z","transport_protocol":"TCP"},{"end_time":"2026-04-26T02:15:30.006463Z","ip":"176.120.22.61","port":"3389","protocol":"UNKNOWN","start_time":"2026-04-26T02:15:29.006463Z","transport_protocol":"TCP"},{"end_time":"2026-04-25T18:53:50.934945Z","ip":"176.120.22.61","port":"47001","protocol":"HTTP","start_time":"2026-04-21T15:02:44.256579Z","transport_protocol":"TCP"},{"end_time":"2026-04-24T21:16:57.206015Z","ip":"176.120.22.61","port":"3389","protocol":"RDP","start_time":"2026-04-24T21:16:56.206015Z","transport_protocol":"TCP"},{"end_time":"2026-04-24T21:08:12.467422Z","ip":"176.120.22.61","port":"5985","protocol":"HTTP","start_time":"2026-04-23T19:45:59.138797Z","transport_protocol":"TCP"},{"end_time":"2026-04-24T12:41:05.027246Z","ip":"176.120.22.61","port":"135","protocol":"DCERPC","start_time":"2026-04-24T12:41:04.027246Z","transport_protocol":"TCP"},{"end_time":"2026-04-24T12:33:52.933439Z","ip":"176.120.22.61","port":"139","protocol":"UNKNOWN","start_time":"2026-04-23T12:17:21.241554Z","transport_protocol":"TCP"},{"end_time":"2026-04-22T18:51:16.543959Z","ip":"176.120.22.61","port":"139","protocol":"NETBIOS","start_time":"2026-04-22T18:51:15.543959Z","transport_protocol":"TCP"},{"end_time":"2026-04-22T15:36:46.004145Z","ip":"176.120.22.61","port":"135","protocol":"DCERPC","start_time":"2026-04-22T15:36:45.004145Z","transport_protocol":"TCP"},{"end_time":"2026-04-22T11:21:05.741384Z","ip":"176.120.22.61","port":"5985","protocol":"HTTP","start_time":"2026-04-22T11:21:04.741384Z","transport_protocol":"TCP"},{"end_time":"2026-04-21T10:32:12.509336Z","ip":"176.120.22.61","port":"135","protocol":"DCERPC","start_time":"2026-04-18T07:58:05.149909Z","transport_protocol":"TCP"},{"end_time":"2026-04-21T04:32:24.241526Z","ip":"176.120.22.61","port":"3389","protocol":"RDP","start_time":"2026-04-19T02:57:17.731764Z","transport_protocol":"TCP"},{"end_time":"2026-04-20T23:16:25.20814Z","ip":"176.120.22.61","port":"5985","protocol":"UNKNOWN","start_time":"2026-04-20T23:16:24.20814Z","transport_protocol":"TCP"},{"end_time":"2026-04-20T19:17:26.020854Z","ip":"176.120.22.61","port":"5985","protocol":"HTTP","start_time":"2026-04-20T19:17:25.020854Z","transport_protocol":"TCP"},{"end_time":"2026-04-20T10:05:01.609157Z","ip":"176.120.22.61","port":"47001","protocol":"HTTP","start_time":"2026-04-20T10:05:00.609157Z","transport_protocol":"TCP"},{"end_time":"2026-04-20T02:35:39.603981Z","ip":"176.120.22.61","port":"5985","protocol":"UNKNOWN","start_time":"2026-04-19T01:36:31.641712Z","transport_protocol":"TCP"},{"end_time":"2026-04-19T04:53:03.044811Z","ip":"176.120.22.61","port":"47001","protocol":"HTTP","start_time":"2026-04-17T02:48:43.238301Z","transport_protocol":"TCP"},{"end_time":"2026-04-19T01:36:00.433291Z","ip":"176.120.22.61","port":"5985","protocol":"UNKNOWN","start_time":"2026-04-18T00:53:03.996167Z","transport_protocol":"TCP"},{"end_time":"2026-04-17T19:42:29.956391Z","ip":"176.120.22.61","port":"5985","protocol":"UNKNOWN","start_time":"2026-04-17T19:42:28.956391Z","transport_protocol":"TCP"},{"end_time":"2026-04-17T13:37:34.38622Z","ip":"176.120.22.61","port":"3389","protocol":"RDP","start_time":"2026-04-16T12:40:28.151909Z","transport_protocol":"TCP"},{"end_time":"2026-04-17T02:45:51.877095Z","ip":"176.120.22.61","port":"135","protocol":"DCERPC","start_time":"2026-04-17T02:45:50.877095Z","transport_protocol":"TCP"}]}}} +{"ip":"204.76.203.222","asn":"AS51396","name":"PFCLOUD","honeylabs_events":1159,"host":{"result":{"extensions":{},"resource":{"autonomous_system":{"asn":51396,"bgp_prefix":"204.76.203.0/24","country_code":"DE","description":"PFCLOUD - Pfcloud UG (haftungsbeschrankt)","name":"PFCLOUD - Pfcloud UG (haftungsbeschrankt)"},"dns":{"reverse_dns":{"names":["204.76.203.222.ptr.pfcloud.network"],"resolve_time":"2026-09-03T08:05:36Z"}},"ip":"204.76.203.222","labels":[{"confidence":0.75,"source":"censys","value":"BULLETPROOF"}],"location":{"city":"Eygelshoven","continent":"Europe","coordinates":{"latitude":50.89394,"longitude":6.0587},"country":"Netherlands","country_code":"NL","postal_code":"6471","province":"Limburg","timezone":"Europe/Amsterdam"},"network":[{"hosting":true,"source":"IPINFO"}],"operating_system":{"confidence":0.25,"cpe":"cpe:2.3:o:canonical:linux:*:*:*:*:*:*:*:*","evidence":[{"data_path":"ssh.endpoint_id.raw"}],"part":"o","product":"linux","source":"recog","vendor":"canonical"},"privacy":[{"source":"IPINFO"}],"reputation":{"evidence":[{},{},{},{},{}],"model_version":"2.0.0","score":0.118},"service_count":1,"services":[{"banner":"SSH-2.0-OpenSSH_8.9p1 Ubuntu-3ubuntu0.17","banner_hash_sha256":"75d49f84712e2426329e23d0aeccb5d8ef06fc439a357b916432d6502dc709ba","banner_hex":"5353482d322e302d4f70656e5353485f382e397031205562756e74752d337562756e7475302e3137","exposures":[{"confidence":1,"evidence":[{"data_path":"protocol","found_value":"SSH","literal_match":"SSH"}],"id":"CENSYS-2022-1066","metrics":{},"name":"Exposed SSH Service","risk_source":"censys","severity":"medium","source":"censys","year":2022}],"ip":"204.76.203.222","ja4tscan":{"fingerprint":"65535_2-4-8-1-3_1460_9_1","scan_time":"2026-09-06T01:52:43Z"},"labels":[{"confidence":1,"evidence":[{"data_path":"protocol","found_value":"SSH","literal_match":"SSH"}],"source":"censys","value":"REMOTE_ACCESS"}],"operating_systems":[{"confidence":0.25,"cpe":"cpe:2.3:o:canonical:linux:*:*:*:*:*:*:*:*","evidence":[{"data_path":"ssh.endpoint_id.raw"}],"part":"o","product":"linux","source":"recog","vendor":"canonical"}],"port":22,"protocol":"SSH","scan_time":"2026-09-06T12:39:40Z","software":[{"confidence":1,"evidence":[{"data_path":"protocol","found_value":"SSH","literal_match":"SSH"}],"part":"a","source":"censys","type":["REMOTE_ACCESS"]},{"confidence":0.25,"cpe":"cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*","evidence":[{"data_path":"ssh.endpoint_id.raw"}],"part":"a","product":"openssh","source":"recog","vendor":"openbsd","version":"8.9p1"}],"ssh":{"algorithm_selection":{"client_to_server_alg_group":{"cipher":"aes128-ctr","compression":"none","mac":"hmac-sha2-256"},"host_key_algorithm":"ecdsa-sha2-nistp256","kex_algorithm":"curve25519-sha256@libssh.org","server_to_client_alg_group":{"cipher":"aes128-ctr","compression":"none","mac":"hmac-sha2-256"}},"endpoint_id":{"comment":"Ubuntu-3ubuntu0.17","protocol_version":"2.0","raw":"SSH-2.0-OpenSSH_8.9p1 Ubuntu-3ubuntu0.17","software_version":"OpenSSH_8.9p1"},"hassh_fingerprint":"41ff3ecd1458b0bf86e1b4891636213e","kex_init_message":{"client_to_server_ciphers":["chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","aes256-gcm@openssh.com"],"client_to_server_compression":["none","zlib@openssh.com"],"client_to_server_macs":["umac-64-etm@openssh.com","umac-128-etm@openssh.com","hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","umac-64@openssh.com","umac-128@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"host_key_algorithms":["rsa-sha2-512","rsa-sha2-256","ecdsa-sha2-nistp256","ssh-ed25519"],"kex_algorithms":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","sntrup761x25519-sha512@openssh.com","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","kex-strict-s-v00@openssh.com"],"server_to_client_ciphers":["chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","aes256-gcm@openssh.com"],"server_to_client_compression":["none","zlib@openssh.com"],"server_to_client_macs":["umac-64-etm@openssh.com","umac-128-etm@openssh.com","hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","umac-64@openssh.com","umac-128@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"]},"server_host_key":{"ecdsa_public_key":{"b":"WsY12Ko6k+ez671VdpiGvGUdBrDMU7D2O848PifSYEs=","curve":"P-256","gx":"axfR8uEsQkf4vOblY6RA8ncDfYEt6zOg9KE5RdiYwpY=","gy":"T+NC4v4af5uO5+tKfA+eFivOM1drMV7Oy7ZAaDe/UfU=","length":256,"n":"/////wAAAAD//////////7zm+q2nF56E87nKwvxjJVE=","p":"/////wAAAAEAAAAAAAAAAAAAAAD///////////////8=","x":"r2aB+bUEhpoaxZU4BXrNYBVGkOhewR1m8uptkXU7XOg=","y":"lJo95H1LTs29+VRYVCZ4iRpeKK9iXWvdFQMf1qPeopw="},"fingerprint_sha256":"27c4af41372096a86b44300cce230144d9dec17b871fdf920c624bb8349adc2e"}},"transport_protocol":"tcp","vulns":[{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*","semver_expression":">=8.9 && <9.3"}],"id":"CVE-2023-28531","metrics":{"cvss_v31":{"components":{"attack_complexity":"low","attack_vector":"network","availability":"high","confidentiality":"high","integrity":"high","privileges_required":"none","scope":"unchanged","user_interaction":"none"},"score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"epss":{"percentile":0.817,"score":0.023}},"name":"CVE-2023-28531","risk_source":"cve","severity":"critical","source":"third_party","year":2023},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*","semver_expression":"<9.3"}],"id":"CVE-2023-38408","kev":[{"date_added":"2023-07-26T00:00:00Z","source":"third_party"}],"metrics":{"cvss_v31":{"components":{"attack_complexity":"low","attack_vector":"network","availability":"high","confidentiality":"high","integrity":"high","privileges_required":"none","scope":"unchanged","user_interaction":"none"},"score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"epss":{"percentile":0.996,"score":0.797}},"name":"CVE-2023-38408","risk_source":"cve","severity":"critical","source":"third_party","year":2023},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*","semver_expression":"<9.6"}],"id":"CVE-2023-48795","kev":[{"date_added":"2025-02-05T00:00:00Z","source":"third_party"}],"metrics":{"cvss_v31":{"components":{"attack_complexity":"high","attack_vector":"network","availability":"none","confidentiality":"none","integrity":"high","privileges_required":"none","scope":"unchanged","user_interaction":"none"},"score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N"},"epss":{"percentile":0.998,"score":0.933}},"name":"CVE-2023-48795","risk_source":"cve","severity":"medium","source":"third_party","year":2023},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*","semver_expression":">=8.9 && <9.6"}],"id":"CVE-2023-51384","metrics":{"cvss_v31":{"components":{"attack_complexity":"low","attack_vector":"local","availability":"none","confidentiality":"high","integrity":"none","privileges_required":"low","scope":"unchanged","user_interaction":"none"},"score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"},"epss":{"percentile":0.356,"score":0.004}},"name":"CVE-2023-51384","risk_source":"cve","severity":"medium","source":"third_party","year":2023},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*","semver_expression":"<9.6"}],"id":"CVE-2023-51385","metrics":{"cvss_v31":{"components":{"attack_complexity":"low","attack_vector":"network","availability":"none","confidentiality":"low","integrity":"low","privileges_required":"none","scope":"unchanged","user_interaction":"none"},"score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"},"epss":{"percentile":0.973,"score":0.198}},"name":"CVE-2023-51385","risk_source":"cve","severity":"medium","source":"third_party","year":2023},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*","semver_expression":">=8.5p1 && <=9.7p1"},{"found_value":"cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*","semver_expression":">=8.6 && <=9.8"}],"id":"CVE-2024-6387","kev":[{"date_added":"2024-07-17T00:00:00Z","source":"third_party"}],"metrics":{"cvss_v31":{"components":{"attack_complexity":"high","attack_vector":"network","availability":"high","confidentiality":"high","integrity":"high","privileges_required":"none","scope":"unchanged","user_interaction":"none"},"score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"},"epss":{"percentile":0.999,"score":0.995}},"name":"CVE-2024-6387","risk_source":"cve","severity":"high","source":"third_party","year":2024},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*","semver_expression":">=6.8p1 && <=9.9p1"},{"found_value":"cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*","semver_expression":">=6.9 && <=9.8"}],"id":"CVE-2025-26465","metrics":{"cvss_v31":{"components":{"attack_complexity":"high","attack_vector":"network","availability":"none","confidentiality":"high","integrity":"high","privileges_required":"none","scope":"unchanged","user_interaction":"required"},"score":6.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N"},"epss":{"percentile":0.942,"score":0.076}},"name":"CVE-2025-26465","risk_source":"cve","severity":"medium","source":"third_party","year":2025},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*","semver_expression":">=7.4 && <10.0"}],"id":"CVE-2025-32728","metrics":{"cvss_v31":{"components":{"attack_complexity":"low","attack_vector":"local","availability":"none","confidentiality":"none","integrity":"low","privileges_required":"none","scope":"changed","user_interaction":"none"},"score":4.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N"},"epss":{"percentile":0.085,"score":0.002}},"name":"CVE-2025-32728","risk_source":"cve","severity":"medium","source":"third_party","year":2025},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*","semver_expression":"<10.3"}],"id":"CVE-2026-35385","metrics":{"cvss_v31":{"components":{"attack_complexity":"high","attack_vector":"network","availability":"high","confidentiality":"high","integrity":"high","privileges_required":"none","scope":"unchanged","user_interaction":"required"},"score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H"},"epss":{"percentile":0.445,"score":0.006}},"name":"CVE-2026-35385","risk_source":"cve","severity":"high","source":"third_party","year":2026},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*","semver_expression":"<10.3"}],"id":"CVE-2026-35386","metrics":{"cvss_v31":{"components":{"attack_complexity":"high","attack_vector":"local","availability":"none","confidentiality":"low","integrity":"low","privileges_required":"low","scope":"unchanged","user_interaction":"none"},"score":3.6,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N"},"epss":{"percentile":0.243,"score":0.003}},"name":"CVE-2026-35386","risk_source":"cve","severity":"low","source":"third_party","year":2026},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*","semver_expression":"<10.3"}],"id":"CVE-2026-35387","metrics":{"cvss_v31":{"components":{"attack_complexity":"high","attack_vector":"network","availability":"none","confidentiality":"none","integrity":"low","privileges_required":"low","scope":"unchanged","user_interaction":"none"},"score":3.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N"},"epss":{"percentile":0.146,"score":0.002}},"name":"CVE-2026-35387","risk_source":"cve","severity":"low","source":"third_party","year":2026},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*","semver_expression":"<10.3"}],"id":"CVE-2026-35388","metrics":{"cvss_v31":{"components":{"attack_complexity":"high","attack_vector":"local","availability":"none","confidentiality":"none","integrity":"low","privileges_required":"none","scope":"unchanged","user_interaction":"required"},"score":2.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N"},"epss":{"percentile":0.029,"score":0.001}},"name":"CVE-2026-35388","risk_source":"cve","severity":"low","source":"third_party","year":2026},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*","semver_expression":"<10.3"}],"id":"CVE-2026-35414","metrics":{"cvss_v31":{"components":{"attack_complexity":"high","attack_vector":"network","availability":"none","confidentiality":"low","integrity":"low","privileges_required":"low","scope":"unchanged","user_interaction":"none"},"score":4.2,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N"},"epss":{"percentile":0.072,"score":0.002}},"name":"CVE-2026-35414","risk_source":"cve","severity":"medium","source":"third_party","year":2026},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*","semver_expression":"<10.4"}],"id":"CVE-2026-59995","metrics":{"cvss_v31":{"components":{"attack_complexity":"high","attack_vector":"network","availability":"low","confidentiality":"none","integrity":"low","privileges_required":"none","scope":"unchanged","user_interaction":"required"},"score":4.2,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L"},"epss":{"percentile":0.163,"score":0.002}},"name":"CVE-2026-59995","risk_source":"cve","severity":"medium","source":"third_party","year":2026},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*","semver_expression":"<10.4"}],"id":"CVE-2026-59996","metrics":{"cvss_v31":{"components":{"attack_complexity":"high","attack_vector":"network","availability":"low","confidentiality":"none","integrity":"low","privileges_required":"none","scope":"unchanged","user_interaction":"required"},"score":4.2,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L"},"epss":{"percentile":0.163,"score":0.002}},"name":"CVE-2026-59996","risk_source":"cve","severity":"medium","source":"third_party","year":2026},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*","semver_expression":"<10.4"}],"id":"CVE-2026-59997","metrics":{"cvss_v31":{"components":{"attack_complexity":"high","attack_vector":"network","availability":"none","confidentiality":"low","integrity":"low","privileges_required":"none","scope":"unchanged","user_interaction":"required"},"score":4.2,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N"},"epss":{"percentile":0.07,"score":0.002}},"name":"CVE-2026-59997","risk_source":"cve","severity":"medium","source":"third_party","year":2026},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*","semver_expression":"<10.4"}],"id":"CVE-2026-59998","metrics":{"cvss_v31":{"components":{"attack_complexity":"high","attack_vector":"network","availability":"none","confidentiality":"low","integrity":"low","privileges_required":"none","scope":"unchanged","user_interaction":"none"},"score":4.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"},"epss":{"percentile":0.076,"score":0.002}},"name":"CVE-2026-59998","risk_source":"cve","severity":"medium","source":"third_party","year":2026},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*","semver_expression":"<10.4"}],"id":"CVE-2026-59999","metrics":{"cvss_v31":{"components":{"attack_complexity":"high","attack_vector":"network","availability":"none","confidentiality":"none","integrity":"high","privileges_required":"none","scope":"unchanged","user_interaction":"none"},"score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N"},"epss":{"percentile":0.054,"score":0.002}},"name":"CVE-2026-59999","risk_source":"cve","severity":"medium","source":"third_party","year":2026},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*","semver_expression":"<10.4"}],"id":"CVE-2026-60000","metrics":{"cvss_v31":{"components":{"attack_complexity":"high","attack_vector":"network","availability":"low","confidentiality":"none","integrity":"none","privileges_required":"none","scope":"unchanged","user_interaction":"none"},"score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"},"epss":{"percentile":0.369,"score":0.004}},"name":"CVE-2026-60000","risk_source":"cve","severity":"low","source":"third_party","year":2026},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*","semver_expression":"<10.4"}],"id":"CVE-2026-60001","metrics":{"cvss_v31":{"components":{"attack_complexity":"low","attack_vector":"network","availability":"low","confidentiality":"none","integrity":"low","privileges_required":"none","scope":"unchanged","user_interaction":"none"},"score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"},"epss":{"percentile":0.213,"score":0.003}},"name":"CVE-2026-60001","risk_source":"cve","severity":"medium","source":"third_party","year":2026},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*","semver_expression":"<10.4"}],"id":"CVE-2026-60002","metrics":{"cvss_v31":{"components":{"attack_complexity":"high","attack_vector":"network","availability":"low","confidentiality":"high","integrity":"high","privileges_required":"none","scope":"unchanged","user_interaction":"none"},"score":7.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L"},"epss":{"percentile":0.222,"score":0.003}},"name":"CVE-2026-60002","risk_source":"cve","severity":"high","source":"third_party","year":2026},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*","semver_expression":"<10.5"}],"id":"CVE-2026-73281","metrics":{"cvss_v31":{"components":{"attack_complexity":"high","attack_vector":"network","availability":"none","confidentiality":"none","integrity":"low","privileges_required":"low","scope":"changed","user_interaction":"none"},"score":3.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N"},"epss":{"percentile":0.053,"score":0.002}},"name":"CVE-2026-73281","risk_source":"cve","severity":"low","source":"third_party","year":2026},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*","semver_expression":"<10.5"}],"id":"CVE-2026-73282","metrics":{"cvss_v31":{"components":{"attack_complexity":"high","attack_vector":"network","availability":"none","confidentiality":"low","integrity":"low","privileges_required":"none","scope":"unchanged","user_interaction":"none"},"score":4.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"},"epss":{"percentile":0.058,"score":0.002}},"name":"CVE-2026-73282","risk_source":"cve","severity":"medium","source":"third_party","year":2026},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*","semver_expression":"<10.5"}],"id":"CVE-2026-73283","metrics":{"cvss_v31":{"components":{"attack_complexity":"high","attack_vector":"local","availability":"none","confidentiality":"none","integrity":"low","privileges_required":"low","scope":"unchanged","user_interaction":"none"},"score":2.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N"},"epss":{"percentile":0.005,"score":0.001}},"name":"CVE-2026-73283","risk_source":"cve","severity":"low","source":"third_party","year":2026}]}],"whois":{"network":{"allocation_type":"ALLOCATION","cidrs":["204.76.203.0/24"],"created":"2025-01-15T00:00:00Z","handle":"INTEL-NET1-25","name":"Intelligence Hosting LLC","updated":"2025-08-05T00:00:00Z"},"organization":{"abuse_contacts":[{"email":"abuse@pfcloud.io","handle":"ABUSE8542-ARIN","name":"Abuse"}],"admin_contacts":[{"email":"admin@pfcloud.io","handle":"ADMIN8226-ARIN","name":"Admin"}],"city":"Eygelshoven","country":"NL","handle":"IHL-76","name":"Intelligence Hosting LLC","postal_code":"6471WV","street":"Bart van Slobbestraat 16B","tech_contacts":[{"email":"admin@pfcloud.io","handle":"TECH1363-ARIN","name":"Tech"}]}}}}},"services":{"result":{"next_page_token":"","ranges":[{"end_time":"2026-09-06T12:39:41.689695Z","ip":"204.76.203.222","port":"22","protocol":"SSH","start_time":"2026-06-02T05:41:32.394Z","transport_protocol":"TCP"},{"end_time":"2026-09-02T10:46:14.93478Z","ip":"204.76.203.222","port":"67","protocol":"HTTP","start_time":"2026-08-22T19:08:14.446773Z","transport_protocol":"TCP"},{"end_time":"2026-08-23T11:57:30.772986Z","ip":"204.76.203.222","port":"9191","protocol":"HTTP","start_time":"2026-08-03T16:23:25.207379Z","transport_protocol":"TCP"},{"end_time":"2026-08-01T22:04:38.778346Z","ip":"204.76.203.222","port":"9191","protocol":"HTTP","start_time":"2026-06-02T02:59:26.327593Z","transport_protocol":"TCP"},{"end_time":"2026-06-14T12:23:22.168316Z","ip":"204.76.203.222","port":"666","protocol":"HTTP","start_time":"2026-06-02T02:42:54.382087Z","transport_protocol":"TCP"},{"end_time":"2026-06-14T12:22:50.500211Z","ip":"204.76.203.222","port":"666","protocol":"HTTP","start_time":"2026-06-02T02:42:51.353662Z","transport_protocol":"TCP"},{"end_time":"2026-04-09T12:40:08.094069Z","ip":"204.76.203.222","port":"22","protocol":"SSH","start_time":"2026-03-10T19:33:16.341751Z","transport_protocol":"TCP"},{"end_time":"2025-12-26T20:41:41.855735Z","ip":"204.76.203.222","port":"27015","protocol":"VALVE","start_time":"2025-12-25T19:50:39.369707Z","transport_protocol":"UDP"},{"end_time":"2025-11-14T14:49:34.962727Z","ip":"204.76.203.222","port":"80","protocol":"HTTP","start_time":"2025-11-08T16:56:37.952227Z","transport_protocol":"TCP"},{"end_time":"2025-11-14T02:37:36.078766Z","ip":"204.76.203.222","port":"22","protocol":"SSH","start_time":"2025-11-02T16:25:52.557356Z","transport_protocol":"TCP"},{"end_time":"2025-11-14T01:53:18.915475Z","ip":"204.76.203.222","port":"25","protocol":"SMTP","start_time":"2025-11-09T10:25:39.200602Z","transport_protocol":"TCP"},{"end_time":"2025-11-09T18:55:07.570045Z","ip":"204.76.203.222","port":"8080","protocol":"HTTP","start_time":"2025-11-08T17:16:02.424874Z","transport_protocol":"TCP"},{"end_time":"2025-11-09T18:48:31.240446Z","ip":"204.76.203.222","port":"3128","protocol":"HTTP","start_time":"2025-11-08T16:46:49.894088Z","transport_protocol":"TCP"},{"end_time":"2025-11-09T18:43:58.158957Z","ip":"204.76.203.222","port":"443","protocol":"HTTP","start_time":"2025-11-08T17:32:06.024704Z","transport_protocol":"TCP"},{"end_time":"2025-11-09T18:37:42.094604Z","ip":"204.76.203.222","port":"25","protocol":"HTTP","start_time":"2025-11-08T17:24:12.669007Z","transport_protocol":"TCP"},{"end_time":"2025-11-09T17:07:53.199674Z","ip":"204.76.203.222","port":"110","protocol":"HTTP","start_time":"2025-11-08T14:47:46.739142Z","transport_protocol":"TCP"},{"end_time":"2025-11-09T16:20:49.229546Z","ip":"204.76.203.222","port":"143","protocol":"HTTP","start_time":"2025-11-08T14:08:41.926986Z","transport_protocol":"TCP"},{"end_time":"2025-11-09T14:56:34.02391Z","ip":"204.76.203.222","port":"3389","protocol":"HTTP","start_time":"2025-11-08T13:44:50.629124Z","transport_protocol":"TCP"},{"end_time":"2025-10-14T13:06:24.280379Z","ip":"204.76.203.222","port":"139","protocol":"NETBIOS","start_time":"2025-10-10T17:44:57.963724Z","transport_protocol":"TCP"},{"end_time":"2025-10-14T12:52:12.544169Z","ip":"204.76.203.222","port":"5357","protocol":"HTTP","start_time":"2025-10-08T07:49:57.916094Z","transport_protocol":"TCP"},{"end_time":"2025-10-14T09:39:04.243743Z","ip":"204.76.203.222","port":"445","protocol":"SMB","start_time":"2025-10-10T17:37:57.211989Z","transport_protocol":"TCP"},{"end_time":"2025-10-14T08:44:09.470349Z","ip":"204.76.203.222","port":"5985","protocol":"WINRM","start_time":"2025-10-08T08:34:30.904217Z","transport_protocol":"TCP"},{"end_time":"2025-10-14T07:46:48.22387Z","ip":"204.76.203.222","port":"47001","protocol":"HTTP","start_time":"2025-10-10T17:36:03.428026Z","transport_protocol":"TCP"},{"end_time":"2025-10-13T22:30:28.361543Z","ip":"204.76.203.222","port":"137","protocol":"NETBIOS","start_time":"2025-10-07T22:09:44.223632Z","transport_protocol":"UDP"},{"end_time":"2025-10-13T18:31:27.159773Z","ip":"204.76.203.222","port":"3389","protocol":"RDP","start_time":"2025-10-07T22:59:36.401285Z","transport_protocol":"TCP"},{"end_time":"2025-10-13T14:32:09.469151Z","ip":"204.76.203.222","port":"135","protocol":"DCERPC","start_time":"2025-10-10T17:36:08.514572Z","transport_protocol":"TCP"},{"end_time":"2025-10-04T19:23:12.042373Z","ip":"204.76.203.222","port":"3389","protocol":"RDP","start_time":"2025-10-02T17:41:35.929601Z","transport_protocol":"TCP"},{"end_time":"2025-10-03T19:01:09.512006Z","ip":"204.76.203.222","port":"5985","protocol":"WINRM","start_time":"2025-10-02T17:43:33.167121Z","transport_protocol":"TCP"},{"end_time":"2025-10-03T18:35:31.43832Z","ip":"204.76.203.222","port":"47001","protocol":"HTTP","start_time":"2025-10-02T11:39:18.577069Z","transport_protocol":"TCP"},{"end_time":"2025-10-03T17:38:48.359586Z","ip":"204.76.203.222","port":"137","protocol":"NETBIOS","start_time":"2025-10-02T16:34:22.052524Z","transport_protocol":"UDP"},{"end_time":"2025-10-03T12:32:38.251236Z","ip":"204.76.203.222","port":"445","protocol":"SMB","start_time":"2025-10-02T11:46:13.66808Z","transport_protocol":"TCP"},{"end_time":"2025-10-02T09:29:43.273887Z","ip":"204.76.203.222","port":"135","protocol":"DCERPC","start_time":"2025-09-27T00:49:43.669932Z","transport_protocol":"TCP"},{"end_time":"2025-10-02T07:03:54.096497Z","ip":"204.76.203.222","port":"47001","protocol":"HTTP","start_time":"2025-09-27T00:50:03.370604Z","transport_protocol":"TCP"},{"end_time":"2025-10-02T06:07:50.018474Z","ip":"204.76.203.222","port":"139","protocol":"NETBIOS","start_time":"2025-09-27T00:49:43.728869Z","transport_protocol":"TCP"},{"end_time":"2025-10-01T21:30:56.86317Z","ip":"204.76.203.222","port":"445","protocol":"SMB","start_time":"2025-09-27T00:49:44.943185Z","transport_protocol":"TCP"},{"end_time":"2025-10-01T17:29:19.342834Z","ip":"204.76.203.222","port":"5985","protocol":"WINRM","start_time":"2025-09-27T00:49:46.01324Z","transport_protocol":"TCP"},{"end_time":"2025-10-01T17:06:37.955937Z","ip":"204.76.203.222","port":"3389","protocol":"RDP","start_time":"2025-09-24T22:13:42.890905Z","transport_protocol":"TCP"},{"end_time":"2025-10-01T15:31:25.773843Z","ip":"204.76.203.222","port":"137","protocol":"NETBIOS","start_time":"2025-09-27T00:50:55.274143Z","transport_protocol":"UDP"},{"end_time":"2025-09-30T14:34:28.817436Z","ip":"204.76.203.222","port":"6000","protocol":"X11","start_time":"2025-09-29T13:45:07.259993Z","transport_protocol":"TCP"}]}}} +{"ip":"204.76.203.221","asn":"AS51396","name":"PFCLOUD","honeylabs_events":1154,"host":{"result":{"extensions":{},"resource":{"autonomous_system":{"asn":51396,"bgp_prefix":"204.76.203.0/24","country_code":"DE","description":"PFCLOUD - Pfcloud UG (haftungsbeschrankt)","name":"PFCLOUD - Pfcloud UG (haftungsbeschrankt)"},"dns":{"reverse_dns":{"names":["204.76.203.221.ptr.pfcloud.network"],"resolve_time":"2026-09-01T08:58:36Z"}},"ip":"204.76.203.221","labels":[{"confidence":0.75,"source":"censys","value":"BULLETPROOF"}],"location":{"city":"Eygelshoven","continent":"Europe","coordinates":{"latitude":50.89394,"longitude":6.0587},"country":"Netherlands","country_code":"NL","postal_code":"6471","province":"Limburg","timezone":"Europe/Amsterdam"},"network":[{"hosting":true,"source":"IPINFO"}],"operating_system":{"confidence":0.25,"cpe":"cpe:2.3:o:canonical:linux:*:*:*:*:*:*:*:*","evidence":[{"data_path":"ssh.endpoint_id.raw"}],"part":"o","product":"linux","source":"recog","vendor":"canonical"},"privacy":[{"source":"IPINFO"}],"reputation":{"evidence":[{},{},{},{},{}],"model_version":"2.0.0","score":0.118},"service_count":1,"services":[{"banner":"SSH-2.0-OpenSSH_8.9p1 Ubuntu-3ubuntu0.17","banner_hash_sha256":"75d49f84712e2426329e23d0aeccb5d8ef06fc439a357b916432d6502dc709ba","banner_hex":"5353482d322e302d4f70656e5353485f382e397031205562756e74752d337562756e7475302e3137","exposures":[{"confidence":1,"evidence":[{"data_path":"protocol","found_value":"SSH","literal_match":"SSH"}],"id":"CENSYS-2022-1066","metrics":{},"name":"Exposed SSH Service","risk_source":"censys","severity":"medium","source":"censys","year":2022}],"ip":"204.76.203.221","ja4tscan":{"fingerprint":"65535_2-4-8-1-3_1460_9_1","scan_time":"2026-09-07T08:17:47Z"},"labels":[{"confidence":1,"evidence":[{"data_path":"protocol","found_value":"SSH","literal_match":"SSH"}],"source":"censys","value":"REMOTE_ACCESS"}],"operating_systems":[{"confidence":0.25,"cpe":"cpe:2.3:o:canonical:linux:*:*:*:*:*:*:*:*","evidence":[{"data_path":"ssh.endpoint_id.raw"}],"part":"o","product":"linux","source":"recog","vendor":"canonical"}],"port":22,"protocol":"SSH","scan_time":"2026-09-06T10:34:20Z","software":[{"confidence":1,"evidence":[{"data_path":"protocol","found_value":"SSH","literal_match":"SSH"}],"part":"a","source":"censys","type":["REMOTE_ACCESS"]},{"confidence":0.25,"cpe":"cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*","evidence":[{"data_path":"ssh.endpoint_id.raw"}],"part":"a","product":"openssh","source":"recog","vendor":"openbsd","version":"8.9p1"}],"ssh":{"algorithm_selection":{"client_to_server_alg_group":{"cipher":"aes128-ctr","compression":"none","mac":"hmac-sha2-256"},"host_key_algorithm":"ecdsa-sha2-nistp256","kex_algorithm":"curve25519-sha256@libssh.org","server_to_client_alg_group":{"cipher":"aes128-ctr","compression":"none","mac":"hmac-sha2-256"}},"endpoint_id":{"comment":"Ubuntu-3ubuntu0.17","protocol_version":"2.0","raw":"SSH-2.0-OpenSSH_8.9p1 Ubuntu-3ubuntu0.17","software_version":"OpenSSH_8.9p1"},"hassh_fingerprint":"41ff3ecd1458b0bf86e1b4891636213e","kex_init_message":{"client_to_server_ciphers":["chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","aes256-gcm@openssh.com"],"client_to_server_compression":["none","zlib@openssh.com"],"client_to_server_macs":["umac-64-etm@openssh.com","umac-128-etm@openssh.com","hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","umac-64@openssh.com","umac-128@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"host_key_algorithms":["rsa-sha2-512","rsa-sha2-256","ecdsa-sha2-nistp256","ssh-ed25519"],"kex_algorithms":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","sntrup761x25519-sha512@openssh.com","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","kex-strict-s-v00@openssh.com"],"server_to_client_ciphers":["chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","aes256-gcm@openssh.com"],"server_to_client_compression":["none","zlib@openssh.com"],"server_to_client_macs":["umac-64-etm@openssh.com","umac-128-etm@openssh.com","hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","umac-64@openssh.com","umac-128@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"]},"server_host_key":{"ecdsa_public_key":{"b":"WsY12Ko6k+ez671VdpiGvGUdBrDMU7D2O848PifSYEs=","curve":"P-256","gx":"axfR8uEsQkf4vOblY6RA8ncDfYEt6zOg9KE5RdiYwpY=","gy":"T+NC4v4af5uO5+tKfA+eFivOM1drMV7Oy7ZAaDe/UfU=","length":256,"n":"/////wAAAAD//////////7zm+q2nF56E87nKwvxjJVE=","p":"/////wAAAAEAAAAAAAAAAAAAAAD///////////////8=","x":"r2aB+bUEhpoaxZU4BXrNYBVGkOhewR1m8uptkXU7XOg=","y":"lJo95H1LTs29+VRYVCZ4iRpeKK9iXWvdFQMf1qPeopw="},"fingerprint_sha256":"27c4af41372096a86b44300cce230144d9dec17b871fdf920c624bb8349adc2e"}},"transport_protocol":"tcp","vulns":[{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*","semver_expression":">=8.9 && <9.3"}],"id":"CVE-2023-28531","metrics":{"cvss_v31":{"components":{"attack_complexity":"low","attack_vector":"network","availability":"high","confidentiality":"high","integrity":"high","privileges_required":"none","scope":"unchanged","user_interaction":"none"},"score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"epss":{"percentile":0.818,"score":0.023}},"name":"CVE-2023-28531","risk_source":"cve","severity":"critical","source":"third_party","year":2023},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*","semver_expression":"<9.3"}],"id":"CVE-2023-38408","kev":[{"date_added":"2023-07-26T00:00:00Z","source":"third_party"}],"metrics":{"cvss_v31":{"components":{"attack_complexity":"low","attack_vector":"network","availability":"high","confidentiality":"high","integrity":"high","privileges_required":"none","scope":"unchanged","user_interaction":"none"},"score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"epss":{"percentile":0.996,"score":0.797}},"name":"CVE-2023-38408","risk_source":"cve","severity":"critical","source":"third_party","year":2023},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*","semver_expression":"<9.6"}],"id":"CVE-2023-48795","kev":[{"date_added":"2025-02-05T00:00:00Z","source":"third_party"}],"metrics":{"cvss_v31":{"components":{"attack_complexity":"high","attack_vector":"network","availability":"none","confidentiality":"none","integrity":"high","privileges_required":"none","scope":"unchanged","user_interaction":"none"},"score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N"},"epss":{"percentile":0.998,"score":0.933}},"name":"CVE-2023-48795","risk_source":"cve","severity":"medium","source":"third_party","year":2023},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*","semver_expression":">=8.9 && <9.6"}],"id":"CVE-2023-51384","metrics":{"cvss_v31":{"components":{"attack_complexity":"low","attack_vector":"local","availability":"none","confidentiality":"high","integrity":"none","privileges_required":"low","scope":"unchanged","user_interaction":"none"},"score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"},"epss":{"percentile":0.356,"score":0.004}},"name":"CVE-2023-51384","risk_source":"cve","severity":"medium","source":"third_party","year":2023},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*","semver_expression":"<9.6"}],"id":"CVE-2023-51385","metrics":{"cvss_v31":{"components":{"attack_complexity":"low","attack_vector":"network","availability":"none","confidentiality":"low","integrity":"low","privileges_required":"none","scope":"unchanged","user_interaction":"none"},"score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"},"epss":{"percentile":0.972,"score":0.198}},"name":"CVE-2023-51385","risk_source":"cve","severity":"medium","source":"third_party","year":2023},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*","semver_expression":">=8.5p1 && <=9.7p1"},{"found_value":"cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*","semver_expression":">=8.6 && <=9.8"}],"id":"CVE-2024-6387","kev":[{"date_added":"2024-07-17T00:00:00Z","source":"third_party"}],"metrics":{"cvss_v31":{"components":{"attack_complexity":"high","attack_vector":"network","availability":"high","confidentiality":"high","integrity":"high","privileges_required":"none","scope":"unchanged","user_interaction":"none"},"score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"},"epss":{"percentile":0.999,"score":0.995}},"name":"CVE-2024-6387","risk_source":"cve","severity":"high","source":"third_party","year":2024},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*","semver_expression":">=6.8p1 && <=9.9p1"},{"found_value":"cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*","semver_expression":">=6.9 && <=9.8"}],"id":"CVE-2025-26465","metrics":{"cvss_v31":{"components":{"attack_complexity":"high","attack_vector":"network","availability":"none","confidentiality":"high","integrity":"high","privileges_required":"none","scope":"unchanged","user_interaction":"required"},"score":6.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N"},"epss":{"percentile":0.941,"score":0.076}},"name":"CVE-2025-26465","risk_source":"cve","severity":"medium","source":"third_party","year":2025},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*","semver_expression":">=7.4 && <10.0"}],"id":"CVE-2025-32728","metrics":{"cvss_v31":{"components":{"attack_complexity":"low","attack_vector":"local","availability":"none","confidentiality":"none","integrity":"low","privileges_required":"none","scope":"changed","user_interaction":"none"},"score":4.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N"},"epss":{"percentile":0.085,"score":0.002}},"name":"CVE-2025-32728","risk_source":"cve","severity":"medium","source":"third_party","year":2025},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*","semver_expression":"<10.3"}],"id":"CVE-2026-35385","metrics":{"cvss_v31":{"components":{"attack_complexity":"high","attack_vector":"network","availability":"high","confidentiality":"high","integrity":"high","privileges_required":"none","scope":"unchanged","user_interaction":"required"},"score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H"},"epss":{"percentile":0.446,"score":0.006}},"name":"CVE-2026-35385","risk_source":"cve","severity":"high","source":"third_party","year":2026},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*","semver_expression":"<10.3"}],"id":"CVE-2026-35386","metrics":{"cvss_v31":{"components":{"attack_complexity":"high","attack_vector":"local","availability":"none","confidentiality":"low","integrity":"low","privileges_required":"low","scope":"unchanged","user_interaction":"none"},"score":3.6,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N"},"epss":{"percentile":0.243,"score":0.003}},"name":"CVE-2026-35386","risk_source":"cve","severity":"low","source":"third_party","year":2026},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*","semver_expression":"<10.3"}],"id":"CVE-2026-35387","metrics":{"cvss_v31":{"components":{"attack_complexity":"high","attack_vector":"network","availability":"none","confidentiality":"none","integrity":"low","privileges_required":"low","scope":"unchanged","user_interaction":"none"},"score":3.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N"},"epss":{"percentile":0.146,"score":0.002}},"name":"CVE-2026-35387","risk_source":"cve","severity":"low","source":"third_party","year":2026},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*","semver_expression":"<10.3"}],"id":"CVE-2026-35388","metrics":{"cvss_v31":{"components":{"attack_complexity":"high","attack_vector":"local","availability":"none","confidentiality":"none","integrity":"low","privileges_required":"none","scope":"unchanged","user_interaction":"required"},"score":2.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N"},"epss":{"percentile":0.029,"score":0.001}},"name":"CVE-2026-35388","risk_source":"cve","severity":"low","source":"third_party","year":2026},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*","semver_expression":"<10.3"}],"id":"CVE-2026-35414","metrics":{"cvss_v31":{"components":{"attack_complexity":"high","attack_vector":"network","availability":"none","confidentiality":"low","integrity":"low","privileges_required":"low","scope":"unchanged","user_interaction":"none"},"score":4.2,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N"},"epss":{"percentile":0.072,"score":0.002}},"name":"CVE-2026-35414","risk_source":"cve","severity":"medium","source":"third_party","year":2026},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*","semver_expression":"<10.4"}],"id":"CVE-2026-59995","metrics":{"cvss_v31":{"components":{"attack_complexity":"high","attack_vector":"network","availability":"low","confidentiality":"none","integrity":"low","privileges_required":"none","scope":"unchanged","user_interaction":"required"},"score":4.2,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L"},"epss":{"percentile":0.162,"score":0.002}},"name":"CVE-2026-59995","risk_source":"cve","severity":"medium","source":"third_party","year":2026},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*","semver_expression":"<10.4"}],"id":"CVE-2026-59996","metrics":{"cvss_v31":{"components":{"attack_complexity":"high","attack_vector":"network","availability":"low","confidentiality":"none","integrity":"low","privileges_required":"none","scope":"unchanged","user_interaction":"required"},"score":4.2,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L"},"epss":{"percentile":0.162,"score":0.002}},"name":"CVE-2026-59996","risk_source":"cve","severity":"medium","source":"third_party","year":2026},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*","semver_expression":"<10.4"}],"id":"CVE-2026-59997","metrics":{"cvss_v31":{"components":{"attack_complexity":"high","attack_vector":"network","availability":"none","confidentiality":"low","integrity":"low","privileges_required":"none","scope":"unchanged","user_interaction":"required"},"score":4.2,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N"},"epss":{"percentile":0.07,"score":0.002}},"name":"CVE-2026-59997","risk_source":"cve","severity":"medium","source":"third_party","year":2026},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*","semver_expression":"<10.4"}],"id":"CVE-2026-59998","metrics":{"cvss_v31":{"components":{"attack_complexity":"high","attack_vector":"network","availability":"none","confidentiality":"low","integrity":"low","privileges_required":"none","scope":"unchanged","user_interaction":"none"},"score":4.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"},"epss":{"percentile":0.075,"score":0.002}},"name":"CVE-2026-59998","risk_source":"cve","severity":"medium","source":"third_party","year":2026},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*","semver_expression":"<10.4"}],"id":"CVE-2026-59999","metrics":{"cvss_v31":{"components":{"attack_complexity":"high","attack_vector":"network","availability":"none","confidentiality":"none","integrity":"high","privileges_required":"none","scope":"unchanged","user_interaction":"none"},"score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N"},"epss":{"percentile":0.054,"score":0.002}},"name":"CVE-2026-59999","risk_source":"cve","severity":"medium","source":"third_party","year":2026},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*","semver_expression":"<10.4"}],"id":"CVE-2026-60000","metrics":{"cvss_v31":{"components":{"attack_complexity":"high","attack_vector":"network","availability":"low","confidentiality":"none","integrity":"none","privileges_required":"none","scope":"unchanged","user_interaction":"none"},"score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"},"epss":{"percentile":0.369,"score":0.004}},"name":"CVE-2026-60000","risk_source":"cve","severity":"low","source":"third_party","year":2026},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*","semver_expression":"<10.4"}],"id":"CVE-2026-60001","metrics":{"cvss_v31":{"components":{"attack_complexity":"low","attack_vector":"network","availability":"low","confidentiality":"none","integrity":"low","privileges_required":"none","scope":"unchanged","user_interaction":"none"},"score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"},"epss":{"percentile":0.212,"score":0.003}},"name":"CVE-2026-60001","risk_source":"cve","severity":"medium","source":"third_party","year":2026},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*","semver_expression":"<10.4"}],"id":"CVE-2026-60002","metrics":{"cvss_v31":{"components":{"attack_complexity":"high","attack_vector":"network","availability":"low","confidentiality":"high","integrity":"high","privileges_required":"none","scope":"unchanged","user_interaction":"none"},"score":7.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L"},"epss":{"percentile":0.222,"score":0.003}},"name":"CVE-2026-60002","risk_source":"cve","severity":"high","source":"third_party","year":2026},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*","semver_expression":"<10.5"}],"id":"CVE-2026-73281","metrics":{"cvss_v31":{"components":{"attack_complexity":"high","attack_vector":"network","availability":"none","confidentiality":"none","integrity":"low","privileges_required":"low","scope":"changed","user_interaction":"none"},"score":3.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N"},"epss":{"percentile":0.053,"score":0.002}},"name":"CVE-2026-73281","risk_source":"cve","severity":"low","source":"third_party","year":2026},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*","semver_expression":"<10.5"}],"id":"CVE-2026-73282","metrics":{"cvss_v31":{"components":{"attack_complexity":"high","attack_vector":"network","availability":"none","confidentiality":"low","integrity":"low","privileges_required":"none","scope":"unchanged","user_interaction":"none"},"score":4.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"},"epss":{"percentile":0.058,"score":0.002}},"name":"CVE-2026-73282","risk_source":"cve","severity":"medium","source":"third_party","year":2026},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*","semver_expression":"<10.5"}],"id":"CVE-2026-73283","metrics":{"cvss_v31":{"components":{"attack_complexity":"high","attack_vector":"local","availability":"none","confidentiality":"none","integrity":"low","privileges_required":"low","scope":"unchanged","user_interaction":"none"},"score":2.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N"},"epss":{"percentile":0.003,"score":0.001}},"name":"CVE-2026-73283","risk_source":"cve","severity":"low","source":"third_party","year":2026}]}],"whois":{"network":{"allocation_type":"ALLOCATION","cidrs":["204.76.203.0/24"],"created":"2025-01-15T00:00:00Z","handle":"INTEL-NET1-25","name":"Intelligence Hosting LLC","updated":"2025-08-05T00:00:00Z"},"organization":{"abuse_contacts":[{"email":"abuse@pfcloud.io","handle":"ABUSE8542-ARIN","name":"Abuse"}],"admin_contacts":[{"email":"admin@pfcloud.io","handle":"ADMIN8226-ARIN","name":"Admin"}],"city":"Eygelshoven","country":"NL","handle":"IHL-76","name":"Intelligence Hosting LLC","postal_code":"6471WV","street":"Bart van Slobbestraat 16B","tech_contacts":[{"email":"admin@pfcloud.io","handle":"TECH1363-ARIN","name":"Tech"}]}}}}},"services":{"result":{"next_page_token":"","ranges":[{"end_time":"2026-09-06T10:34:21.770801Z","ip":"204.76.203.221","port":"22","protocol":"SSH","start_time":"2026-06-03T01:42:00.622493Z","transport_protocol":"TCP"},{"end_time":"2026-09-02T10:46:09.030538Z","ip":"204.76.203.221","port":"67","protocol":"HTTP","start_time":"2026-08-22T19:08:41.66154Z","transport_protocol":"TCP"},{"end_time":"2026-08-23T11:56:48.67344Z","ip":"204.76.203.221","port":"9191","protocol":"HTTP","start_time":"2026-08-03T16:18:50.253453Z","transport_protocol":"TCP"},{"end_time":"2026-08-01T21:42:46.334404Z","ip":"204.76.203.221","port":"9191","protocol":"HTTP","start_time":"2026-06-02T01:46:29.990534Z","transport_protocol":"TCP"},{"end_time":"2026-06-14T10:56:50.458314Z","ip":"204.76.203.221","port":"666","protocol":"HTTP","start_time":"2026-06-02T02:12:19.839021Z","transport_protocol":"TCP"},{"end_time":"2026-06-14T10:56:05.5247Z","ip":"204.76.203.221","port":"666","protocol":"HTTP","start_time":"2026-06-02T02:12:08.205176Z","transport_protocol":"TCP"},{"end_time":"2025-11-18T10:47:33.189899Z","ip":"204.76.203.221","port":"4085","protocol":"HTTP","start_time":"2025-11-16T17:37:46.5025Z","transport_protocol":"TCP"},{"end_time":"2025-11-18T09:38:02.481763Z","ip":"204.76.203.221","port":"5902","protocol":"VNC","start_time":"2025-11-16T16:26:35.581182Z","transport_protocol":"TCP"},{"end_time":"2025-11-17T23:00:58.146943Z","ip":"204.76.203.221","port":"4082","protocol":"HTTP","start_time":"2025-11-16T15:19:39.660248Z","transport_protocol":"TCP"},{"end_time":"2025-11-17T23:00:20.19446Z","ip":"204.76.203.221","port":"4084","protocol":"HTTP","start_time":"2025-11-16T16:21:47.601236Z","transport_protocol":"TCP"},{"end_time":"2025-11-17T20:47:18.560129Z","ip":"204.76.203.221","port":"4083","protocol":"HTTP","start_time":"2025-11-16T17:42:21.614573Z","transport_protocol":"TCP"},{"end_time":"2025-11-17T13:21:20.689292Z","ip":"204.76.203.221","port":"22","protocol":"SSH","start_time":"2025-11-16T09:19:25.147118Z","transport_protocol":"TCP"},{"end_time":"2025-11-17T11:50:15.353021Z","ip":"204.76.203.221","port":"5903","protocol":"VNC","start_time":"2025-11-16T11:07:22.595649Z","transport_protocol":"TCP"},{"end_time":"2025-11-17T09:37:33.237394Z","ip":"204.76.203.221","port":"4085","protocol":"UNKNOWN","start_time":"2025-11-16T21:50:37.048599Z","transport_protocol":"TCP"},{"end_time":"2025-11-16T19:06:43.214522Z","ip":"204.76.203.221","port":"4083","protocol":"UNKNOWN","start_time":"2025-11-16T19:06:42.214522Z","transport_protocol":"TCP"},{"end_time":"2025-11-16T02:51:37.869772Z","ip":"204.76.203.221","port":"5903","protocol":"VNC","start_time":"2025-10-26T05:34:47.035623Z","transport_protocol":"TCP"},{"end_time":"2025-11-16T01:24:36.71023Z","ip":"204.76.203.221","port":"22","protocol":"SSH","start_time":"2025-10-25T21:39:35.88889Z","transport_protocol":"TCP"},{"end_time":"2025-11-15T15:28:28.289133Z","ip":"204.76.203.221","port":"4084","protocol":"HTTP","start_time":"2025-10-25T06:58:09.593489Z","transport_protocol":"TCP"},{"end_time":"2025-11-15T13:50:03.76277Z","ip":"204.76.203.221","port":"4082","protocol":"HTTP","start_time":"2025-10-25T11:49:36.44012Z","transport_protocol":"TCP"},{"end_time":"2025-11-15T13:30:20.446965Z","ip":"204.76.203.221","port":"4085","protocol":"HTTP","start_time":"2025-10-25T06:09:23.440522Z","transport_protocol":"TCP"},{"end_time":"2025-11-15T13:29:31.161169Z","ip":"204.76.203.221","port":"4085","protocol":"UNKNOWN","start_time":"2025-10-25T06:09:02.301978Z","transport_protocol":"TCP"},{"end_time":"2025-11-15T13:03:58.259723Z","ip":"204.76.203.221","port":"4083","protocol":"HTTP","start_time":"2025-10-25T14:44:52.622209Z","transport_protocol":"TCP"},{"end_time":"2025-11-15T11:46:16.687351Z","ip":"204.76.203.221","port":"5902","protocol":"VNC","start_time":"2025-10-25T02:11:15.444257Z","transport_protocol":"TCP"},{"end_time":"2025-11-11T19:32:37.322003Z","ip":"204.76.203.221","port":"4083","protocol":"UNKNOWN","start_time":"2025-10-25T14:44:38.14463Z","transport_protocol":"TCP"},{"end_time":"2025-10-24T20:14:23.461096Z","ip":"204.76.203.221","port":"4082","protocol":"HTTP","start_time":"2025-10-03T06:52:51.849196Z","transport_protocol":"TCP"},{"end_time":"2025-10-24T19:56:28.664434Z","ip":"204.76.203.221","port":"5903","protocol":"VNC","start_time":"2025-10-02T20:19:49.3742Z","transport_protocol":"TCP"},{"end_time":"2025-10-24T19:00:09.28638Z","ip":"204.76.203.221","port":"4085","protocol":"HTTP","start_time":"2025-10-03T07:59:42.948156Z","transport_protocol":"TCP"},{"end_time":"2025-10-24T15:14:44.575091Z","ip":"204.76.203.221","port":"4084","protocol":"HTTP","start_time":"2025-10-03T06:21:11.80278Z","transport_protocol":"TCP"},{"end_time":"2025-10-24T13:22:08.425446Z","ip":"204.76.203.221","port":"4085","protocol":"UNKNOWN","start_time":"2025-10-22T08:10:31.475304Z","transport_protocol":"TCP"},{"end_time":"2025-10-24T09:01:45.041238Z","ip":"204.76.203.221","port":"4083","protocol":"HTTP","start_time":"2025-10-03T06:33:11.146401Z","transport_protocol":"TCP"},{"end_time":"2025-10-24T09:01:16.207092Z","ip":"204.76.203.221","port":"4083","protocol":"UNKNOWN","start_time":"2025-10-23T08:47:16.838109Z","transport_protocol":"TCP"},{"end_time":"2025-10-24T08:31:54.552702Z","ip":"204.76.203.221","port":"22","protocol":"SSH","start_time":"2025-10-03T01:40:40.421355Z","transport_protocol":"TCP"},{"end_time":"2025-10-23T09:34:08.925846Z","ip":"204.76.203.221","port":"5902","protocol":"VNC","start_time":"2025-10-02T21:49:00.406377Z","transport_protocol":"TCP"},{"end_time":"2025-10-02T08:06:05.901521Z","ip":"204.76.203.221","port":"4082","protocol":"HTTP","start_time":"2025-09-10T09:07:00.890855Z","transport_protocol":"TCP"},{"end_time":"2025-10-02T07:36:38.404741Z","ip":"204.76.203.221","port":"4085","protocol":"HTTP","start_time":"2025-09-10T08:14:51.765612Z","transport_protocol":"TCP"},{"end_time":"2025-10-02T06:00:35.005462Z","ip":"204.76.203.221","port":"4083","protocol":"HTTP","start_time":"2025-09-10T05:07:24.798472Z","transport_protocol":"TCP"},{"end_time":"2025-10-02T05:35:11.670717Z","ip":"204.76.203.221","port":"4084","protocol":"HTTP","start_time":"2025-09-10T09:14:06.90757Z","transport_protocol":"TCP"},{"end_time":"2025-10-02T01:13:40.623702Z","ip":"204.76.203.221","port":"22","protocol":"SSH","start_time":"2025-09-10T07:38:35.672012Z","transport_protocol":"TCP"},{"end_time":"2025-10-01T20:56:02.272686Z","ip":"204.76.203.221","port":"5902","protocol":"VNC","start_time":"2025-09-10T15:34:00.563975Z","transport_protocol":"TCP"},{"end_time":"2025-10-01T20:08:25.742367Z","ip":"204.76.203.221","port":"5903","protocol":"VNC","start_time":"2025-09-10T10:17:21.049767Z","transport_protocol":"TCP"},{"end_time":"2025-09-09T16:42:30.887078Z","ip":"204.76.203.221","port":"5903","protocol":"VNC","start_time":"2025-08-21T14:01:27.222303Z","transport_protocol":"TCP"},{"end_time":"2025-09-09T14:34:45.271796Z","ip":"204.76.203.221","port":"5902","protocol":"VNC","start_time":"2025-08-26T13:43:23.326874Z","transport_protocol":"TCP"},{"end_time":"2025-09-09T09:13:17.61131Z","ip":"204.76.203.221","port":"4082","protocol":"HTTP","start_time":"2025-08-25T21:52:38.784757Z","transport_protocol":"TCP"},{"end_time":"2025-09-09T08:17:35.18683Z","ip":"204.76.203.221","port":"4084","protocol":"HTTP","start_time":"2025-08-18T13:02:39.529457Z","transport_protocol":"TCP"},{"end_time":"2025-09-09T07:01:34.088124Z","ip":"204.76.203.221","port":"22","protocol":"SSH","start_time":"2025-08-26T11:09:44.140382Z","transport_protocol":"TCP"},{"end_time":"2025-09-09T06:49:54.778998Z","ip":"204.76.203.221","port":"4085","protocol":"HTTP","start_time":"2025-08-19T05:51:03.993422Z","transport_protocol":"TCP"},{"end_time":"2025-09-09T03:50:46.472401Z","ip":"204.76.203.221","port":"4083","protocol":"HTTP","start_time":"2025-08-18T18:01:29.391642Z","transport_protocol":"TCP"}]}}} +{"ip":"204.76.203.213","asn":"AS51396","name":"PFCLOUD","honeylabs_events":1123,"host":{"result":{"extensions":{},"resource":{"autonomous_system":{"asn":51396,"bgp_prefix":"204.76.203.0/24","country_code":"DE","description":"PFCLOUD - Pfcloud UG (haftungsbeschrankt)","name":"PFCLOUD - Pfcloud UG (haftungsbeschrankt)"},"dns":{"reverse_dns":{"names":["204.76.203.213.ptr.pfcloud.network"],"resolve_time":"2026-09-05T08:21:38Z"}},"ip":"204.76.203.213","labels":[{"confidence":0.75,"source":"censys","value":"BULLETPROOF"}],"location":{"city":"Eygelshoven","continent":"Europe","coordinates":{"latitude":50.89394,"longitude":6.0587},"country":"Netherlands","country_code":"NL","postal_code":"6471","province":"Limburg","timezone":"Europe/Amsterdam"},"network":[{"hosting":true,"source":"IPINFO"}],"operating_system":{"confidence":0.25,"cpe":"cpe:2.3:o:canonical:linux:*:*:*:*:*:*:*:*","evidence":[{"data_path":"ssh.endpoint_id.raw"}],"part":"o","product":"linux","source":"recog","vendor":"canonical"},"privacy":[{"source":"IPINFO"}],"reputation":{"evidence":[{},{},{},{},{}],"model_version":"2.0.0","score":0.118},"service_count":1,"services":[{"banner":"SSH-2.0-OpenSSH_8.9p1 Ubuntu-3ubuntu0.17","banner_hash_sha256":"75d49f84712e2426329e23d0aeccb5d8ef06fc439a357b916432d6502dc709ba","banner_hex":"5353482d322e302d4f70656e5353485f382e397031205562756e74752d337562756e7475302e3137","exposures":[{"confidence":1,"evidence":[{"data_path":"protocol","found_value":"SSH","literal_match":"SSH"}],"id":"CENSYS-2022-1066","metrics":{},"name":"Exposed SSH Service","risk_source":"censys","severity":"medium","source":"censys","year":2022}],"ip":"204.76.203.213","ja4tscan":{"fingerprint":"65535_2-4-8-1-3_1460_9_1","scan_time":"2026-09-05T01:39:42Z"},"labels":[{"confidence":1,"evidence":[{"data_path":"protocol","found_value":"SSH","literal_match":"SSH"}],"source":"censys","value":"REMOTE_ACCESS"}],"operating_systems":[{"confidence":0.25,"cpe":"cpe:2.3:o:canonical:linux:*:*:*:*:*:*:*:*","evidence":[{"data_path":"ssh.endpoint_id.raw"}],"part":"o","product":"linux","source":"recog","vendor":"canonical"}],"port":22,"protocol":"SSH","scan_time":"2026-09-07T07:46:44Z","software":[{"confidence":1,"evidence":[{"data_path":"protocol","found_value":"SSH","literal_match":"SSH"}],"part":"a","source":"censys","type":["REMOTE_ACCESS"]},{"confidence":0.25,"cpe":"cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*","evidence":[{"data_path":"ssh.endpoint_id.raw"}],"part":"a","product":"openssh","source":"recog","vendor":"openbsd","version":"8.9p1"}],"ssh":{"algorithm_selection":{"client_to_server_alg_group":{"cipher":"aes128-ctr","compression":"none","mac":"hmac-sha2-256"},"host_key_algorithm":"ecdsa-sha2-nistp256","kex_algorithm":"curve25519-sha256@libssh.org","server_to_client_alg_group":{"cipher":"aes128-ctr","compression":"none","mac":"hmac-sha2-256"}},"endpoint_id":{"comment":"Ubuntu-3ubuntu0.17","protocol_version":"2.0","raw":"SSH-2.0-OpenSSH_8.9p1 Ubuntu-3ubuntu0.17","software_version":"OpenSSH_8.9p1"},"hassh_fingerprint":"41ff3ecd1458b0bf86e1b4891636213e","kex_init_message":{"client_to_server_ciphers":["chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","aes256-gcm@openssh.com"],"client_to_server_compression":["none","zlib@openssh.com"],"client_to_server_macs":["umac-64-etm@openssh.com","umac-128-etm@openssh.com","hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","umac-64@openssh.com","umac-128@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"host_key_algorithms":["rsa-sha2-512","rsa-sha2-256","ecdsa-sha2-nistp256","ssh-ed25519"],"kex_algorithms":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","sntrup761x25519-sha512@openssh.com","diffie-hellman-group-exchange-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","diffie-hellman-group14-sha256","kex-strict-s-v00@openssh.com"],"server_to_client_ciphers":["chacha20-poly1305@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr","aes128-gcm@openssh.com","aes256-gcm@openssh.com"],"server_to_client_compression":["none","zlib@openssh.com"],"server_to_client_macs":["umac-64-etm@openssh.com","umac-128-etm@openssh.com","hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","umac-64@openssh.com","umac-128@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"]},"server_host_key":{"ecdsa_public_key":{"b":"WsY12Ko6k+ez671VdpiGvGUdBrDMU7D2O848PifSYEs=","curve":"P-256","gx":"axfR8uEsQkf4vOblY6RA8ncDfYEt6zOg9KE5RdiYwpY=","gy":"T+NC4v4af5uO5+tKfA+eFivOM1drMV7Oy7ZAaDe/UfU=","length":256,"n":"/////wAAAAD//////////7zm+q2nF56E87nKwvxjJVE=","p":"/////wAAAAEAAAAAAAAAAAAAAAD///////////////8=","x":"r2aB+bUEhpoaxZU4BXrNYBVGkOhewR1m8uptkXU7XOg=","y":"lJo95H1LTs29+VRYVCZ4iRpeKK9iXWvdFQMf1qPeopw="},"fingerprint_sha256":"27c4af41372096a86b44300cce230144d9dec17b871fdf920c624bb8349adc2e"}},"transport_protocol":"tcp","vulns":[{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*","semver_expression":">=8.9 && <9.3"}],"id":"CVE-2023-28531","metrics":{"cvss_v31":{"components":{"attack_complexity":"low","attack_vector":"network","availability":"high","confidentiality":"high","integrity":"high","privileges_required":"none","scope":"unchanged","user_interaction":"none"},"score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"epss":{"percentile":0.817,"score":0.023}},"name":"CVE-2023-28531","risk_source":"cve","severity":"critical","source":"third_party","year":2023},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*","semver_expression":"<9.3"}],"id":"CVE-2023-38408","kev":[{"date_added":"2023-07-26T00:00:00Z","source":"third_party"}],"metrics":{"cvss_v31":{"components":{"attack_complexity":"low","attack_vector":"network","availability":"high","confidentiality":"high","integrity":"high","privileges_required":"none","scope":"unchanged","user_interaction":"none"},"score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"epss":{"percentile":0.996,"score":0.797}},"name":"CVE-2023-38408","risk_source":"cve","severity":"critical","source":"third_party","year":2023},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*","semver_expression":"<9.6"}],"id":"CVE-2023-48795","kev":[{"date_added":"2025-02-05T00:00:00Z","source":"third_party"}],"metrics":{"cvss_v31":{"components":{"attack_complexity":"high","attack_vector":"network","availability":"none","confidentiality":"none","integrity":"high","privileges_required":"none","scope":"unchanged","user_interaction":"none"},"score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N"},"epss":{"percentile":0.998,"score":0.933}},"name":"CVE-2023-48795","risk_source":"cve","severity":"medium","source":"third_party","year":2023},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*","semver_expression":">=8.9 && <9.6"}],"id":"CVE-2023-51384","metrics":{"cvss_v31":{"components":{"attack_complexity":"low","attack_vector":"local","availability":"none","confidentiality":"high","integrity":"none","privileges_required":"low","scope":"unchanged","user_interaction":"none"},"score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"},"epss":{"percentile":0.356,"score":0.004}},"name":"CVE-2023-51384","risk_source":"cve","severity":"medium","source":"third_party","year":2023},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*","semver_expression":"<9.6"}],"id":"CVE-2023-51385","metrics":{"cvss_v31":{"components":{"attack_complexity":"low","attack_vector":"network","availability":"none","confidentiality":"low","integrity":"low","privileges_required":"none","scope":"unchanged","user_interaction":"none"},"score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"},"epss":{"percentile":0.973,"score":0.198}},"name":"CVE-2023-51385","risk_source":"cve","severity":"medium","source":"third_party","year":2023},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*","semver_expression":">=8.5p1 && <=9.7p1"},{"found_value":"cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*","semver_expression":">=8.6 && <=9.8"}],"id":"CVE-2024-6387","kev":[{"date_added":"2024-07-17T00:00:00Z","source":"third_party"}],"metrics":{"cvss_v31":{"components":{"attack_complexity":"high","attack_vector":"network","availability":"high","confidentiality":"high","integrity":"high","privileges_required":"none","scope":"unchanged","user_interaction":"none"},"score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"},"epss":{"percentile":0.999,"score":0.995}},"name":"CVE-2024-6387","risk_source":"cve","severity":"high","source":"third_party","year":2024},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*","semver_expression":">=6.8p1 && <=9.9p1"},{"found_value":"cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*","semver_expression":">=6.9 && <=9.8"}],"id":"CVE-2025-26465","metrics":{"cvss_v31":{"components":{"attack_complexity":"high","attack_vector":"network","availability":"none","confidentiality":"high","integrity":"high","privileges_required":"none","scope":"unchanged","user_interaction":"required"},"score":6.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N"},"epss":{"percentile":0.942,"score":0.076}},"name":"CVE-2025-26465","risk_source":"cve","severity":"medium","source":"third_party","year":2025},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*","semver_expression":">=7.4 && <10.0"}],"id":"CVE-2025-32728","metrics":{"cvss_v31":{"components":{"attack_complexity":"low","attack_vector":"local","availability":"none","confidentiality":"none","integrity":"low","privileges_required":"none","scope":"changed","user_interaction":"none"},"score":4.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N"},"epss":{"percentile":0.085,"score":0.002}},"name":"CVE-2025-32728","risk_source":"cve","severity":"medium","source":"third_party","year":2025},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*","semver_expression":"<10.3"}],"id":"CVE-2026-35385","metrics":{"cvss_v31":{"components":{"attack_complexity":"high","attack_vector":"network","availability":"high","confidentiality":"high","integrity":"high","privileges_required":"none","scope":"unchanged","user_interaction":"required"},"score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H"},"epss":{"percentile":0.445,"score":0.006}},"name":"CVE-2026-35385","risk_source":"cve","severity":"high","source":"third_party","year":2026},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*","semver_expression":"<10.3"}],"id":"CVE-2026-35386","metrics":{"cvss_v31":{"components":{"attack_complexity":"high","attack_vector":"local","availability":"none","confidentiality":"low","integrity":"low","privileges_required":"low","scope":"unchanged","user_interaction":"none"},"score":3.6,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N"},"epss":{"percentile":0.243,"score":0.003}},"name":"CVE-2026-35386","risk_source":"cve","severity":"low","source":"third_party","year":2026},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*","semver_expression":"<10.3"}],"id":"CVE-2026-35387","metrics":{"cvss_v31":{"components":{"attack_complexity":"high","attack_vector":"network","availability":"none","confidentiality":"none","integrity":"low","privileges_required":"low","scope":"unchanged","user_interaction":"none"},"score":3.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N"},"epss":{"percentile":0.146,"score":0.002}},"name":"CVE-2026-35387","risk_source":"cve","severity":"low","source":"third_party","year":2026},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*","semver_expression":"<10.3"}],"id":"CVE-2026-35388","metrics":{"cvss_v31":{"components":{"attack_complexity":"high","attack_vector":"local","availability":"none","confidentiality":"none","integrity":"low","privileges_required":"none","scope":"unchanged","user_interaction":"required"},"score":2.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N"},"epss":{"percentile":0.029,"score":0.001}},"name":"CVE-2026-35388","risk_source":"cve","severity":"low","source":"third_party","year":2026},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*","semver_expression":"<10.3"}],"id":"CVE-2026-35414","metrics":{"cvss_v31":{"components":{"attack_complexity":"high","attack_vector":"network","availability":"none","confidentiality":"low","integrity":"low","privileges_required":"low","scope":"unchanged","user_interaction":"none"},"score":4.2,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N"},"epss":{"percentile":0.072,"score":0.002}},"name":"CVE-2026-35414","risk_source":"cve","severity":"medium","source":"third_party","year":2026},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*","semver_expression":"<10.4"}],"id":"CVE-2026-59995","metrics":{"cvss_v31":{"components":{"attack_complexity":"high","attack_vector":"network","availability":"low","confidentiality":"none","integrity":"low","privileges_required":"none","scope":"unchanged","user_interaction":"required"},"score":4.2,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L"},"epss":{"percentile":0.163,"score":0.002}},"name":"CVE-2026-59995","risk_source":"cve","severity":"medium","source":"third_party","year":2026},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*","semver_expression":"<10.4"}],"id":"CVE-2026-59996","metrics":{"cvss_v31":{"components":{"attack_complexity":"high","attack_vector":"network","availability":"low","confidentiality":"none","integrity":"low","privileges_required":"none","scope":"unchanged","user_interaction":"required"},"score":4.2,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L"},"epss":{"percentile":0.163,"score":0.002}},"name":"CVE-2026-59996","risk_source":"cve","severity":"medium","source":"third_party","year":2026},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*","semver_expression":"<10.4"}],"id":"CVE-2026-59997","metrics":{"cvss_v31":{"components":{"attack_complexity":"high","attack_vector":"network","availability":"none","confidentiality":"low","integrity":"low","privileges_required":"none","scope":"unchanged","user_interaction":"required"},"score":4.2,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N"},"epss":{"percentile":0.07,"score":0.002}},"name":"CVE-2026-59997","risk_source":"cve","severity":"medium","source":"third_party","year":2026},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*","semver_expression":"<10.4"}],"id":"CVE-2026-59998","metrics":{"cvss_v31":{"components":{"attack_complexity":"high","attack_vector":"network","availability":"none","confidentiality":"low","integrity":"low","privileges_required":"none","scope":"unchanged","user_interaction":"none"},"score":4.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"},"epss":{"percentile":0.076,"score":0.002}},"name":"CVE-2026-59998","risk_source":"cve","severity":"medium","source":"third_party","year":2026},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*","semver_expression":"<10.4"}],"id":"CVE-2026-59999","metrics":{"cvss_v31":{"components":{"attack_complexity":"high","attack_vector":"network","availability":"none","confidentiality":"none","integrity":"high","privileges_required":"none","scope":"unchanged","user_interaction":"none"},"score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N"},"epss":{"percentile":0.054,"score":0.002}},"name":"CVE-2026-59999","risk_source":"cve","severity":"medium","source":"third_party","year":2026},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*","semver_expression":"<10.4"}],"id":"CVE-2026-60000","metrics":{"cvss_v31":{"components":{"attack_complexity":"high","attack_vector":"network","availability":"low","confidentiality":"none","integrity":"none","privileges_required":"none","scope":"unchanged","user_interaction":"none"},"score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"},"epss":{"percentile":0.369,"score":0.004}},"name":"CVE-2026-60000","risk_source":"cve","severity":"low","source":"third_party","year":2026},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*","semver_expression":"<10.4"}],"id":"CVE-2026-60001","metrics":{"cvss_v31":{"components":{"attack_complexity":"low","attack_vector":"network","availability":"low","confidentiality":"none","integrity":"low","privileges_required":"none","scope":"unchanged","user_interaction":"none"},"score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"},"epss":{"percentile":0.213,"score":0.003}},"name":"CVE-2026-60001","risk_source":"cve","severity":"medium","source":"third_party","year":2026},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*","semver_expression":"<10.4"}],"id":"CVE-2026-60002","metrics":{"cvss_v31":{"components":{"attack_complexity":"high","attack_vector":"network","availability":"low","confidentiality":"high","integrity":"high","privileges_required":"none","scope":"unchanged","user_interaction":"none"},"score":7.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L"},"epss":{"percentile":0.222,"score":0.003}},"name":"CVE-2026-60002","risk_source":"cve","severity":"high","source":"third_party","year":2026},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*","semver_expression":"<10.5"}],"id":"CVE-2026-73281","metrics":{"cvss_v31":{"components":{"attack_complexity":"high","attack_vector":"network","availability":"none","confidentiality":"none","integrity":"low","privileges_required":"low","scope":"changed","user_interaction":"none"},"score":3.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N"},"epss":{"percentile":0.053,"score":0.002}},"name":"CVE-2026-73281","risk_source":"cve","severity":"low","source":"third_party","year":2026},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*","semver_expression":"<10.5"}],"id":"CVE-2026-73282","metrics":{"cvss_v31":{"components":{"attack_complexity":"high","attack_vector":"network","availability":"none","confidentiality":"low","integrity":"low","privileges_required":"none","scope":"unchanged","user_interaction":"none"},"score":4.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"},"epss":{"percentile":0.058,"score":0.002}},"name":"CVE-2026-73282","risk_source":"cve","severity":"medium","source":"third_party","year":2026},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:8.9p1:*:*:*:*:*:*:*","semver_expression":"<10.5"}],"id":"CVE-2026-73283","metrics":{"cvss_v31":{"components":{"attack_complexity":"high","attack_vector":"local","availability":"none","confidentiality":"none","integrity":"low","privileges_required":"low","scope":"unchanged","user_interaction":"none"},"score":2.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N"},"epss":{"percentile":0.005,"score":0.001}},"name":"CVE-2026-73283","risk_source":"cve","severity":"low","source":"third_party","year":2026}]}],"whois":{"network":{"allocation_type":"ALLOCATION","cidrs":["204.76.203.0/24"],"created":"2025-01-15T00:00:00Z","handle":"INTEL-NET1-25","name":"Intelligence Hosting LLC","updated":"2025-08-05T00:00:00Z"},"organization":{"abuse_contacts":[{"email":"abuse@pfcloud.io","handle":"ABUSE8542-ARIN","name":"Abuse"}],"admin_contacts":[{"email":"admin@pfcloud.io","handle":"ADMIN8226-ARIN","name":"Admin"}],"city":"Eygelshoven","country":"NL","handle":"IHL-76","name":"Intelligence Hosting LLC","postal_code":"6471WV","street":"Bart van Slobbestraat 16B","tech_contacts":[{"email":"admin@pfcloud.io","handle":"TECH1363-ARIN","name":"Tech"}]}}}}},"services":{"result":{"next_page_token":"","ranges":[{"end_time":"2026-09-06T06:20:02.37053Z","ip":"204.76.203.213","port":"22","protocol":"SSH","start_time":"2026-06-02T06:09:21.954228Z","transport_protocol":"TCP"},{"end_time":"2026-09-02T10:45:50.412574Z","ip":"204.76.203.213","port":"67","protocol":"HTTP","start_time":"2026-08-22T16:22:15.394174Z","transport_protocol":"TCP"},{"end_time":"2026-08-23T11:57:40.481024Z","ip":"204.76.203.213","port":"9191","protocol":"HTTP","start_time":"2026-08-03T16:48:59.641133Z","transport_protocol":"TCP"},{"end_time":"2026-08-01T22:24:18.626104Z","ip":"204.76.203.213","port":"9191","protocol":"HTTP","start_time":"2026-06-02T00:33:06.621771Z","transport_protocol":"TCP"},{"end_time":"2026-06-14T10:57:49.354509Z","ip":"204.76.203.213","port":"666","protocol":"HTTP","start_time":"2026-06-02T00:28:10.739429Z","transport_protocol":"TCP"},{"end_time":"2026-06-14T10:57:16.480892Z","ip":"204.76.203.213","port":"666","protocol":"HTTP","start_time":"2026-06-02T00:28:05.405631Z","transport_protocol":"TCP"},{"end_time":"2026-01-14T06:32:12.533854Z","ip":"204.76.203.213","port":"22","protocol":"SSH","start_time":"2025-12-31T09:14:13.738025Z","transport_protocol":"TCP"},{"end_time":"2025-12-30T14:30:50.497886Z","ip":"204.76.203.213","port":"22","protocol":"SSH","start_time":"2025-12-16T17:14:17.210439Z","transport_protocol":"TCP"},{"end_time":"2025-10-20T00:07:55.584802Z","ip":"204.76.203.213","port":"80","protocol":"HTTP","start_time":"2025-10-03T01:25:36.903683Z","transport_protocol":"TCP"},{"end_time":"2025-10-02T03:46:53.817728Z","ip":"204.76.203.213","port":"80","protocol":"HTTP","start_time":"2025-09-20T20:14:26.451254Z","transport_protocol":"TCP"}]}}} +{"ip":"185.246.217.150","asn":"AS210644","name":"AEZA-AS","honeylabs_events":51,"host":{"result":{"extensions":{},"resource":{"autonomous_system":{"asn":210644,"bgp_prefix":"185.246.217.0/24","country_code":"RU","description":"AEZA-AS - AEZA GROUP LLC","name":"AEZA-AS - AEZA GROUP LLC"},"dns":{"reverse_dns":{"resolve_time":"2026-09-06T13:42:52Z"}},"greynoise":{"actor":"unknown","classification":"malicious","last_observed_time":"2026-09-01T00:00:00Z","tags":[{"name":"Apache HTTP Server Path Traversal Attempt"},{"name":"Apache HTTP Server Path Traversal CVE-2021-41773 RCE Attempt"},{"name":"CGI Script Scanner"},{"name":"Docker Scanner"},{"name":"Generic IoT Default Password Attempt"},{"name":"Generic Path Traversal Attempt"},{"name":"Generic Sensitive File Access Attempt"},{"name":"Generic Suspicious Linux Command in Request"},{"name":"PHP CGI CVE-2012-1823 Remote Code Execution Attempt"},{"name":"PHP CVE-2024-4577 RCE Attempt"},{"name":"PHP InvokeFunction Attacker"},{"name":"PHPUnit CVE-2017-9841 RCE Attempt"},{"name":"SSH Alternative Port Crawler"},{"name":"SSH Connection Attempt"},{"name":"TLS/SSL Crawler"},{"name":"Telnet Bruteforcer"},{"name":"Telnet Login Attempt"},{"name":"Telnet Protocol"},{"name":"ThinkPHP Code Execution CVE-2019-9082"},{"name":"ThinkPHP Framework LFI CVE-2022-47945 Attempt"},{"name":"ThinkPHP RCE Attempt"},{"name":"Web Crawler"}]},"ip":"185.246.217.150","labels":[{"confidence":0.75,"source":"censys","value":"BULLETPROOF"}],"location":{"city":"Amsterdam","continent":"Europe","coordinates":{"latitude":52.37403,"longitude":4.88969},"country":"Netherlands","country_code":"NL","postal_code":"1012","province":"North Holland","timezone":"Europe/Amsterdam"},"network":[{"hosting":true,"source":"IPINFO"}],"operating_system":{"confidence":0.25,"cpe":"cpe:2.3:o:canonical:linux:*:*:*:*:*:*:*:*","evidence":[{"data_path":"ssh.endpoint_id.raw"}],"part":"o","product":"linux","source":"recog","vendor":"canonical"},"privacy":[{"anonymous":true,"source":"IPINFO","vpn":true}],"reputation":{"evidence":[{},{},{},{},{}],"model_version":"2.0.0","score":0.884},"service_count":1,"services":[{"banner":"SSH-2.0-OpenSSH_10.2p1 Ubuntu-2ubuntu3.6","banner_hash_sha256":"2273abc4876744fd39fbca4340aba60bfa05a980df8e117c11bd8c4dd41f4486","banner_hex":"5353482d322e302d4f70656e5353485f31302e327031205562756e74752d327562756e7475332e36","exposures":[{"confidence":1,"evidence":[{"data_path":"protocol","found_value":"SSH","literal_match":"SSH"}],"id":"CENSYS-2022-1066","metrics":{},"name":"Exposed SSH Service","risk_source":"censys","severity":"medium","source":"censys","year":2022}],"ip":"185.246.217.150","ja4tscan":{"fingerprint":"65160_2-4-8-1-3_1320_11_1-2-4-8-16","scan_time":"2026-09-06T08:38:48Z"},"labels":[{"confidence":1,"evidence":[{"data_path":"protocol","found_value":"SSH","literal_match":"SSH"}],"source":"censys","value":"REMOTE_ACCESS"}],"operating_systems":[{"confidence":0.25,"cpe":"cpe:2.3:o:canonical:linux:*:*:*:*:*:*:*:*","evidence":[{"data_path":"ssh.endpoint_id.raw"}],"part":"o","product":"linux","source":"recog","vendor":"canonical"}],"port":22,"protocol":"SSH","scan_time":"2026-09-06T20:15:25Z","software":[{"confidence":1,"evidence":[{"data_path":"protocol","found_value":"SSH","literal_match":"SSH"}],"part":"a","source":"censys","type":["REMOTE_ACCESS"]},{"confidence":0.25,"cpe":"cpe:2.3:a:openbsd:openssh:10.2p1:*:*:*:*:*:*:*","evidence":[{"data_path":"ssh.endpoint_id.raw"}],"part":"a","product":"openssh","source":"recog","vendor":"openbsd","version":"10.2p1"}],"ssh":{"algorithm_selection":{"client_to_server_alg_group":{"cipher":"aes128-ctr","compression":"none","mac":"hmac-sha2-256"},"host_key_algorithm":"ecdsa-sha2-nistp256","kex_algorithm":"curve25519-sha256@libssh.org","server_to_client_alg_group":{"cipher":"aes128-ctr","compression":"none","mac":"hmac-sha2-256"}},"endpoint_id":{"comment":"Ubuntu-2ubuntu3.6","protocol_version":"2.0","raw":"SSH-2.0-OpenSSH_10.2p1 Ubuntu-2ubuntu3.6","software_version":"OpenSSH_10.2p1"},"hassh_fingerprint":"671c5858369db8e0a60108d866bbf8ec","kex_init_message":{"client_to_server_ciphers":["chacha20-poly1305@openssh.com","aes128-gcm@openssh.com","aes256-gcm@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"client_to_server_compression":["none","zlib@openssh.com"],"client_to_server_macs":["umac-64-etm@openssh.com","umac-128-etm@openssh.com","hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","umac-64@openssh.com","umac-128@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"],"host_key_algorithms":["rsa-sha2-512","rsa-sha2-256","ecdsa-sha2-nistp256","ssh-ed25519"],"kex_algorithms":["mlkem768x25519-sha256","sntrup761x25519-sha512","sntrup761x25519-sha512@openssh.com","curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","ext-info-s","kex-strict-s-v00@openssh.com"],"server_to_client_ciphers":["chacha20-poly1305@openssh.com","aes128-gcm@openssh.com","aes256-gcm@openssh.com","aes128-ctr","aes192-ctr","aes256-ctr"],"server_to_client_compression":["none","zlib@openssh.com"],"server_to_client_macs":["umac-64-etm@openssh.com","umac-128-etm@openssh.com","hmac-sha2-256-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha1-etm@openssh.com","umac-64@openssh.com","umac-128@openssh.com","hmac-sha2-256","hmac-sha2-512","hmac-sha1"]},"server_host_key":{"ecdsa_public_key":{"b":"WsY12Ko6k+ez671VdpiGvGUdBrDMU7D2O848PifSYEs=","curve":"P-256","gx":"axfR8uEsQkf4vOblY6RA8ncDfYEt6zOg9KE5RdiYwpY=","gy":"T+NC4v4af5uO5+tKfA+eFivOM1drMV7Oy7ZAaDe/UfU=","length":256,"n":"/////wAAAAD//////////7zm+q2nF56E87nKwvxjJVE=","p":"/////wAAAAEAAAAAAAAAAAAAAAD///////////////8=","x":"jlggM4O0YYvsMAO7iXsRVvq45AR7hbu6gyyujJqWzIs=","y":"cOo4b1uge9uSm1UPf67GzTnJp73503RFxbjyYdh1q4c="},"fingerprint_sha256":"408d8e8896afad45eb74acbf94672a5ec60acd3a71cbdbdba54f2a1b04ef482e"}},"transport_protocol":"tcp","vulns":[{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:10.2p1:*:*:*:*:*:*:*","semver_expression":"<10.3"}],"id":"CVE-2026-35385","metrics":{"cvss_v31":{"components":{"attack_complexity":"high","attack_vector":"network","availability":"high","confidentiality":"high","integrity":"high","privileges_required":"none","scope":"unchanged","user_interaction":"required"},"score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H"},"epss":{"percentile":0.445,"score":0.006}},"name":"CVE-2026-35385","risk_source":"cve","severity":"high","source":"third_party","year":2026},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:10.2p1:*:*:*:*:*:*:*","semver_expression":"<10.3"},{"found_value":"cpe:2.3:a:openbsd:openssh:10.2p1:*:*:*:*:*:*:*","semver_expression":">=10.0 && <10.3"}],"id":"CVE-2026-35386","metrics":{"cvss_v31":{"components":{"attack_complexity":"high","attack_vector":"local","availability":"none","confidentiality":"low","integrity":"low","privileges_required":"low","scope":"unchanged","user_interaction":"none"},"score":3.6,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N"},"epss":{"percentile":0.243,"score":0.003}},"name":"CVE-2026-35386","risk_source":"cve","severity":"low","source":"third_party","year":2026},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:10.2p1:*:*:*:*:*:*:*","semver_expression":"<10.3"}],"id":"CVE-2026-35387","metrics":{"cvss_v31":{"components":{"attack_complexity":"high","attack_vector":"network","availability":"none","confidentiality":"none","integrity":"low","privileges_required":"low","scope":"unchanged","user_interaction":"none"},"score":3.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N"},"epss":{"percentile":0.146,"score":0.002}},"name":"CVE-2026-35387","risk_source":"cve","severity":"low","source":"third_party","year":2026},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:10.2p1:*:*:*:*:*:*:*","semver_expression":"<10.3"}],"id":"CVE-2026-35388","metrics":{"cvss_v31":{"components":{"attack_complexity":"high","attack_vector":"local","availability":"none","confidentiality":"none","integrity":"low","privileges_required":"none","scope":"unchanged","user_interaction":"required"},"score":2.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N"},"epss":{"percentile":0.029,"score":0.001}},"name":"CVE-2026-35388","risk_source":"cve","severity":"low","source":"third_party","year":2026},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:10.2p1:*:*:*:*:*:*:*","semver_expression":"<10.3"}],"id":"CVE-2026-35414","metrics":{"cvss_v31":{"components":{"attack_complexity":"high","attack_vector":"network","availability":"none","confidentiality":"low","integrity":"low","privileges_required":"low","scope":"unchanged","user_interaction":"none"},"score":4.2,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N"},"epss":{"percentile":0.072,"score":0.002}},"name":"CVE-2026-35414","risk_source":"cve","severity":"medium","source":"third_party","year":2026},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:10.2p1:*:*:*:*:*:*:*","semver_expression":"<10.4"}],"id":"CVE-2026-59995","metrics":{"cvss_v31":{"components":{"attack_complexity":"high","attack_vector":"network","availability":"low","confidentiality":"none","integrity":"low","privileges_required":"none","scope":"unchanged","user_interaction":"required"},"score":4.2,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L"},"epss":{"percentile":0.163,"score":0.002}},"name":"CVE-2026-59995","risk_source":"cve","severity":"medium","source":"third_party","year":2026},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:10.2p1:*:*:*:*:*:*:*","semver_expression":"<10.4"}],"id":"CVE-2026-59996","metrics":{"cvss_v31":{"components":{"attack_complexity":"high","attack_vector":"network","availability":"low","confidentiality":"none","integrity":"low","privileges_required":"none","scope":"unchanged","user_interaction":"required"},"score":4.2,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L"},"epss":{"percentile":0.163,"score":0.002}},"name":"CVE-2026-59996","risk_source":"cve","severity":"medium","source":"third_party","year":2026},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:10.2p1:*:*:*:*:*:*:*","semver_expression":"<10.4"}],"id":"CVE-2026-59997","metrics":{"cvss_v31":{"components":{"attack_complexity":"high","attack_vector":"network","availability":"none","confidentiality":"low","integrity":"low","privileges_required":"none","scope":"unchanged","user_interaction":"required"},"score":4.2,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N"},"epss":{"percentile":0.07,"score":0.002}},"name":"CVE-2026-59997","risk_source":"cve","severity":"medium","source":"third_party","year":2026},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:10.2p1:*:*:*:*:*:*:*","semver_expression":"<10.4"}],"id":"CVE-2026-59998","metrics":{"cvss_v31":{"components":{"attack_complexity":"high","attack_vector":"network","availability":"none","confidentiality":"low","integrity":"low","privileges_required":"none","scope":"unchanged","user_interaction":"none"},"score":4.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"},"epss":{"percentile":0.076,"score":0.002}},"name":"CVE-2026-59998","risk_source":"cve","severity":"medium","source":"third_party","year":2026},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:10.2p1:*:*:*:*:*:*:*","semver_expression":"<10.4"}],"id":"CVE-2026-59999","metrics":{"cvss_v31":{"components":{"attack_complexity":"high","attack_vector":"network","availability":"none","confidentiality":"none","integrity":"high","privileges_required":"none","scope":"unchanged","user_interaction":"none"},"score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N"},"epss":{"percentile":0.054,"score":0.002}},"name":"CVE-2026-59999","risk_source":"cve","severity":"medium","source":"third_party","year":2026},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:10.2p1:*:*:*:*:*:*:*","semver_expression":"<10.4"}],"id":"CVE-2026-60000","metrics":{"cvss_v31":{"components":{"attack_complexity":"high","attack_vector":"network","availability":"low","confidentiality":"none","integrity":"none","privileges_required":"none","scope":"unchanged","user_interaction":"none"},"score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"},"epss":{"percentile":0.369,"score":0.004}},"name":"CVE-2026-60000","risk_source":"cve","severity":"low","source":"third_party","year":2026},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:10.2p1:*:*:*:*:*:*:*","semver_expression":"<10.4"}],"id":"CVE-2026-60001","metrics":{"cvss_v31":{"components":{"attack_complexity":"low","attack_vector":"network","availability":"low","confidentiality":"none","integrity":"low","privileges_required":"none","scope":"unchanged","user_interaction":"none"},"score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"},"epss":{"percentile":0.213,"score":0.003}},"name":"CVE-2026-60001","risk_source":"cve","severity":"medium","source":"third_party","year":2026},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:10.2p1:*:*:*:*:*:*:*","semver_expression":"<10.4"}],"id":"CVE-2026-60002","metrics":{"cvss_v31":{"components":{"attack_complexity":"high","attack_vector":"network","availability":"low","confidentiality":"high","integrity":"high","privileges_required":"none","scope":"unchanged","user_interaction":"none"},"score":7.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L"},"epss":{"percentile":0.222,"score":0.003}},"name":"CVE-2026-60002","risk_source":"cve","severity":"high","source":"third_party","year":2026},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:10.2p1:*:*:*:*:*:*:*","semver_expression":"<10.5"}],"id":"CVE-2026-73281","metrics":{"cvss_v31":{"components":{"attack_complexity":"high","attack_vector":"network","availability":"none","confidentiality":"none","integrity":"low","privileges_required":"low","scope":"changed","user_interaction":"none"},"score":3.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N"},"epss":{"percentile":0.053,"score":0.002}},"name":"CVE-2026-73281","risk_source":"cve","severity":"low","source":"third_party","year":2026},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:10.2p1:*:*:*:*:*:*:*","semver_expression":"<10.5"}],"id":"CVE-2026-73282","metrics":{"cvss_v31":{"components":{"attack_complexity":"high","attack_vector":"network","availability":"none","confidentiality":"low","integrity":"low","privileges_required":"none","scope":"unchanged","user_interaction":"none"},"score":4.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"},"epss":{"percentile":0.058,"score":0.002}},"name":"CVE-2026-73282","risk_source":"cve","severity":"medium","source":"third_party","year":2026},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:10.2p1:*:*:*:*:*:*:*","semver_expression":"<10.5"}],"id":"CVE-2026-73283","metrics":{"cvss_v31":{"components":{"attack_complexity":"high","attack_vector":"local","availability":"none","confidentiality":"none","integrity":"low","privileges_required":"low","scope":"unchanged","user_interaction":"none"},"score":2.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N"},"epss":{"percentile":0.005,"score":0.001}},"name":"CVE-2026-73283","risk_source":"cve","severity":"low","source":"third_party","year":2026}]}],"whois":{"network":{"cidrs":["185.246.217.0/24"],"created":"2025-06-30T00:00:00Z","handle":"NETCRAFTERS","name":"NetCrafters OU","updated":"2026-08-06T00:00:00Z"},"organization":{"abuse_contacts":[{"email":"ripe@netcrafters.host","handle":"ACRO62610-RIPE","name":"Abuse contact role object"}],"address":"Ida-Viru maakond, Kohtla-Järve linn, Sompa linnaosa, Tulika tn 6, 30721","handle":"ORG-NO63-RIPE","name":"NetCrafters OU"}}}}},"services":{"result":{"next_page_token":"","ranges":[{"end_time":"2026-09-06T20:15:26.130072Z","ip":"185.246.217.150","port":"22","protocol":"SSH","start_time":"2026-09-04T13:16:01.856056Z","transport_protocol":"TCP"},{"end_time":"2026-09-03T06:15:24.207063Z","ip":"185.246.217.150","port":"8000","protocol":"HTTP","start_time":"2026-08-30T19:18:43.517726Z","transport_protocol":"TCP"},{"end_time":"2026-09-03T05:45:52.372336Z","ip":"185.246.217.150","port":"2096","protocol":"HTTP","start_time":"2026-08-06T23:12:30.652927Z","transport_protocol":"TCP"},{"end_time":"2026-09-02T17:35:04.958144Z","ip":"185.246.217.150","port":"80","protocol":"HTTP","start_time":"2026-08-05T23:59:08.290999Z","transport_protocol":"TCP"},{"end_time":"2026-09-02T16:06:13.331855Z","ip":"185.246.217.150","port":"22","protocol":"SSH","start_time":"2026-08-06T22:03:51.516619Z","transport_protocol":"TCP"},{"end_time":"2026-09-02T09:36:56.940525Z","ip":"185.246.217.150","port":"2375","protocol":"HTTP","start_time":"2026-09-02T00:19:30.485699Z","transport_protocol":"TCP"},{"end_time":"2026-08-31T18:06:09.324897Z","ip":"185.246.217.150","port":"2375","protocol":"HTTP","start_time":"2026-08-28T07:45:45.101812Z","transport_protocol":"TCP"},{"end_time":"2026-08-31T01:17:19.891341Z","ip":"185.246.217.150","port":"2096","protocol":"UNKNOWN","start_time":"2026-08-06T23:11:55.709959Z","transport_protocol":"TCP"},{"end_time":"2026-08-05T16:31:11.563696Z","ip":"185.246.217.150","port":"2375","protocol":"HTTP","start_time":"2026-08-05T16:31:10.563696Z","transport_protocol":"TCP"},{"end_time":"2026-07-06T16:22:29.716999Z","ip":"185.246.217.150","port":"500","protocol":"IKE","start_time":"2026-06-05T00:39:23.563989Z","transport_protocol":"UDP"},{"end_time":"2026-07-06T02:22:08.738443Z","ip":"185.246.217.150","port":"22","protocol":"SSH","start_time":"2026-06-06T19:21:45.939039Z","transport_protocol":"TCP"},{"end_time":"2025-11-12T21:15:22.922969Z","ip":"185.246.217.150","port":"31053","protocol":"HTTP","start_time":"2025-11-05T10:56:45.816243Z","transport_protocol":"TCP"},{"end_time":"2025-11-12T20:47:25.993807Z","ip":"185.246.217.150","port":"22","protocol":"SSH","start_time":"2025-11-10T19:26:47.896459Z","transport_protocol":"TCP"},{"end_time":"2025-11-12T20:32:35.534824Z","ip":"185.246.217.150","port":"443","protocol":"HTTP","start_time":"2025-11-10T09:22:21.944299Z","transport_protocol":"TCP"},{"end_time":"2025-11-11T18:30:48.140841Z","ip":"185.246.217.150","port":"31053","protocol":"UNKNOWN","start_time":"2025-11-02T14:49:40.37092Z","transport_protocol":"TCP"},{"end_time":"2025-11-10T14:57:33.32334Z","ip":"185.246.217.150","port":"22","protocol":"SSH","start_time":"2025-11-09T12:54:32.901561Z","transport_protocol":"TCP"},{"end_time":"2025-11-10T01:22:04.459076Z","ip":"185.246.217.150","port":"443","protocol":"HTTP","start_time":"2025-11-04T03:19:54.947211Z","transport_protocol":"TCP"},{"end_time":"2025-11-09T08:32:13.84649Z","ip":"185.246.217.150","port":"22","protocol":"SSH","start_time":"2025-11-03T18:19:41.086518Z","transport_protocol":"TCP"},{"end_time":"2025-11-05T10:50:16.960735Z","ip":"185.246.217.150","port":"31053","protocol":"HTTP","start_time":"2025-10-31T15:11:10.212765Z","transport_protocol":"TCP"},{"end_time":"2025-11-03T19:19:29.784417Z","ip":"185.246.217.150","port":"443","protocol":"HTTP","start_time":"2025-10-25T04:35:43.820828Z","transport_protocol":"TCP"},{"end_time":"2025-11-03T06:06:10.556761Z","ip":"185.246.217.150","port":"22","protocol":"SSH","start_time":"2025-11-03T01:32:17.825609Z","transport_protocol":"TCP"},{"end_time":"2025-11-02T07:48:17.100526Z","ip":"185.246.217.150","port":"22","protocol":"SSH","start_time":"2025-10-31T09:11:28.04361Z","transport_protocol":"TCP"},{"end_time":"2025-10-31T08:51:04.348198Z","ip":"185.246.217.150","port":"22","protocol":"SSH","start_time":"2025-10-31T05:43:21.873551Z","transport_protocol":"TCP"},{"end_time":"2025-10-31T07:34:02.599765Z","ip":"185.246.217.150","port":"31053","protocol":"HTTP","start_time":"2025-10-31T05:02:08.598011Z","transport_protocol":"TCP"},{"end_time":"2025-10-30T15:30:39.983256Z","ip":"185.246.217.150","port":"22","protocol":"SSH","start_time":"2025-10-27T09:54:57.848415Z","transport_protocol":"TCP"},{"end_time":"2025-10-30T10:27:10.511285Z","ip":"185.246.217.150","port":"31053","protocol":"HTTP","start_time":"2025-10-26T04:01:15.032632Z","transport_protocol":"TCP"},{"end_time":"2025-10-27T05:41:55.276185Z","ip":"185.246.217.150","port":"22","protocol":"SSH","start_time":"2025-10-26T05:06:24.164276Z","transport_protocol":"TCP"},{"end_time":"2025-10-26T00:38:56.019669Z","ip":"185.246.217.150","port":"22","protocol":"SSH","start_time":"2025-10-24T23:57:44.330955Z","transport_protocol":"TCP"},{"end_time":"2025-10-23T11:21:31.026885Z","ip":"185.246.217.150","port":"443","protocol":"HTTP","start_time":"2025-10-23T11:21:30.026885Z","transport_protocol":"TCP"},{"end_time":"2025-10-23T11:21:03.103064Z","ip":"185.246.217.150","port":"443","protocol":"HTTP","start_time":"2025-10-23T11:21:02.103064Z","transport_protocol":"TCP"},{"end_time":"2025-10-23T08:57:16.640174Z","ip":"185.246.217.150","port":"22","protocol":"SSH","start_time":"2025-10-23T08:57:15.640174Z","transport_protocol":"TCP"},{"end_time":"2025-10-23T05:14:07.020065Z","ip":"185.246.217.150","port":"22","protocol":"SSH","start_time":"2025-10-22T02:41:11.702961Z","transport_protocol":"TCP"},{"end_time":"2025-10-23T00:00:03.446783Z","ip":"185.246.217.150","port":"443","protocol":"HTTP","start_time":"2025-10-20T22:50:20.390947Z","transport_protocol":"TCP"},{"end_time":"2025-10-22T08:25:35.237939Z","ip":"185.246.217.150","port":"31053","protocol":"HTTP","start_time":"2025-10-21T07:43:43.443458Z","transport_protocol":"TCP"},{"end_time":"2025-10-21T23:31:52.393019Z","ip":"185.246.217.150","port":"22","protocol":"SSH","start_time":"2025-10-20T22:07:53.202277Z","transport_protocol":"TCP"},{"end_time":"2025-10-20T00:35:42.382978Z","ip":"185.246.217.150","port":"31053","protocol":"HTTP","start_time":"2025-10-18T23:10:34.3167Z","transport_protocol":"TCP"},{"end_time":"2025-10-19T04:56:51.268252Z","ip":"185.246.217.150","port":"443","protocol":"HTTP","start_time":"2025-10-18T02:32:49.94938Z","transport_protocol":"TCP"},{"end_time":"2025-10-19T00:22:12.263415Z","ip":"185.246.217.150","port":"22","protocol":"SSH","start_time":"2025-10-17T23:22:44.397481Z","transport_protocol":"TCP"},{"end_time":"2025-10-16T14:40:53.085523Z","ip":"185.246.217.150","port":"31053","protocol":"HTTP","start_time":"2025-10-15T04:07:37.98329Z","transport_protocol":"TCP"},{"end_time":"2025-10-16T06:08:18.485867Z","ip":"185.246.217.150","port":"22","protocol":"SSH","start_time":"2025-10-15T04:54:42.838868Z","transport_protocol":"TCP"},{"end_time":"2025-10-15T22:52:59.568857Z","ip":"185.246.217.150","port":"443","protocol":"HTTP","start_time":"2025-10-14T22:41:40.190485Z","transport_protocol":"TCP"},{"end_time":"2025-10-15T00:34:21.832891Z","ip":"185.246.217.150","port":"22","protocol":"SSH","start_time":"2025-10-11T00:52:37.748432Z","transport_protocol":"TCP"},{"end_time":"2025-10-15T00:15:44.573013Z","ip":"185.246.217.150","port":"31053","protocol":"HTTP","start_time":"2025-10-13T23:43:50.713324Z","transport_protocol":"TCP"},{"end_time":"2025-10-14T13:58:57.709139Z","ip":"185.246.217.150","port":"443","protocol":"HTTP","start_time":"2025-10-13T05:04:07.876428Z","transport_protocol":"TCP"},{"end_time":"2025-10-13T08:20:19.188412Z","ip":"185.246.217.150","port":"31053","protocol":"HTTP","start_time":"2025-10-07T15:49:29.594439Z","transport_protocol":"TCP"},{"end_time":"2025-10-12T20:23:47.018515Z","ip":"185.246.217.150","port":"443","protocol":"HTTP","start_time":"2025-10-11T19:39:56.077607Z","transport_protocol":"TCP"},{"end_time":"2025-10-11T15:50:52.359194Z","ip":"185.246.217.150","port":"443","protocol":"HTTP","start_time":"2025-10-09T20:33:46.777118Z","transport_protocol":"TCP"},{"end_time":"2025-10-10T20:13:28.271856Z","ip":"185.246.217.150","port":"22","protocol":"SSH","start_time":"2025-10-09T18:40:24.145521Z","transport_protocol":"TCP"},{"end_time":"2025-10-09T11:48:18.404862Z","ip":"185.246.217.150","port":"443","protocol":"HTTP","start_time":"2025-10-02T20:52:44.239023Z","transport_protocol":"TCP"},{"end_time":"2025-10-09T05:31:52.161261Z","ip":"185.246.217.150","port":"22","protocol":"SSH","start_time":"2025-10-03T15:47:18.881195Z","transport_protocol":"TCP"},{"end_time":"2025-10-07T07:22:43.801868Z","ip":"185.246.217.150","port":"31053","protocol":"HTTP","start_time":"2025-10-02T11:55:56.046037Z","transport_protocol":"TCP"},{"end_time":"2025-10-03T11:31:15.47426Z","ip":"185.246.217.150","port":"22","protocol":"SSH","start_time":"2025-10-02T10:35:12.26799Z","transport_protocol":"TCP"},{"end_time":"2025-10-01T12:31:10.317513Z","ip":"185.246.217.150","port":"22","protocol":"SSH","start_time":"2025-09-30T10:27:45.115947Z","transport_protocol":"TCP"},{"end_time":"2025-10-01T11:47:58.501614Z","ip":"185.246.217.150","port":"443","protocol":"HTTP","start_time":"2025-09-28T07:04:28.249128Z","transport_protocol":"TCP"},{"end_time":"2025-10-01T11:29:37.91748Z","ip":"185.246.217.150","port":"31053","protocol":"HTTP","start_time":"2025-10-01T11:29:36.91748Z","transport_protocol":"TCP"},{"end_time":"2025-10-01T07:22:09.714259Z","ip":"185.246.217.150","port":"31053","protocol":"HTTP","start_time":"2025-09-27T12:45:12.738351Z","transport_protocol":"TCP"},{"end_time":"2025-09-30T06:35:16.394719Z","ip":"185.246.217.150","port":"22","protocol":"SSH","start_time":"2025-09-29T05:48:38.454473Z","transport_protocol":"TCP"},{"end_time":"2025-09-29T01:45:07.609045Z","ip":"185.246.217.150","port":"22","protocol":"SSH","start_time":"2025-09-28T01:12:24.798366Z","transport_protocol":"TCP"},{"end_time":"2025-09-28T02:49:02.540332Z","ip":"185.246.217.150","port":"443","protocol":"HTTP","start_time":"2025-09-25T04:44:38.244544Z","transport_protocol":"TCP"},{"end_time":"2025-09-27T20:31:54.855534Z","ip":"185.246.217.150","port":"22","protocol":"SSH","start_time":"2025-09-17T04:48:36.620228Z","transport_protocol":"TCP"},{"end_time":"2025-09-27T08:29:24.571014Z","ip":"185.246.217.150","port":"31053","protocol":"HTTP","start_time":"2025-09-24T14:34:06.461087Z","transport_protocol":"TCP"},{"end_time":"2025-09-25T00:51:42.177622Z","ip":"185.246.217.150","port":"443","protocol":"HTTP","start_time":"2025-09-20T05:56:23.203021Z","transport_protocol":"TCP"},{"end_time":"2025-09-24T10:37:35.886782Z","ip":"185.246.217.150","port":"31053","protocol":"HTTP","start_time":"2025-09-18T06:28:56.900038Z","transport_protocol":"TCP"},{"end_time":"2025-09-19T10:52:15.187437Z","ip":"185.246.217.150","port":"443","protocol":"HTTP","start_time":"2025-09-16T23:01:55.72855Z","transport_protocol":"TCP"},{"end_time":"2025-09-18T02:57:11.424483Z","ip":"185.246.217.150","port":"31053","protocol":"HTTP","start_time":"2025-09-17T02:04:15.779875Z","transport_protocol":"TCP"},{"end_time":"2025-09-16T16:32:19.426001Z","ip":"185.246.217.150","port":"22","protocol":"SSH","start_time":"2025-09-10T15:31:17.369913Z","transport_protocol":"TCP"},{"end_time":"2025-09-16T07:21:04.577443Z","ip":"185.246.217.150","port":"31053","protocol":"HTTP","start_time":"2025-09-10T07:43:44.745046Z","transport_protocol":"TCP"},{"end_time":"2025-09-16T00:22:14.719409Z","ip":"185.246.217.150","port":"443","protocol":"HTTP","start_time":"2025-09-10T01:48:03.073862Z","transport_protocol":"TCP"},{"end_time":"2025-09-09T14:31:44.026213Z","ip":"185.246.217.150","port":"22","protocol":"SSH","start_time":"2025-08-18T22:17:02.299728Z","transport_protocol":"TCP"},{"end_time":"2025-09-09T11:19:04.453788Z","ip":"185.246.217.150","port":"31053","protocol":"HTTP","start_time":"2025-08-19T09:39:43.080163Z","transport_protocol":"TCP"},{"end_time":"2025-09-09T08:59:18.444225Z","ip":"185.246.217.150","port":"443","protocol":"HTTP","start_time":"2025-08-18T18:16:12.28019Z","transport_protocol":"TCP"}]}}} +{"ip":"45.61.157.82","asn":"AS14956","name":"ROUTERHOSTING","honeylabs_events":32,"host":{"result":{"extensions":{},"resource":{"autonomous_system":{"asn":14956,"bgp_prefix":"45.61.156.0/23","country_code":"US","description":"ROUTERHOSTING - RouterHosting LLC","name":"ROUTERHOSTING - RouterHosting LLC"},"dns":{"forward_dns":{"cldz.abdorahmanamani.ir":{"name":"cldz.abdorahmanamani.ir","record_type":"a","resolve_time":"2026-09-06T14:46:49Z"},"golagen1.lol":{"name":"golagen1.lol","record_type":"a","resolve_time":"2026-09-06T13:01:20Z"},"hansinitoin.click":{"name":"hansinitoin.click","record_type":"a","resolve_time":"2026-09-06T19:34:19Z"},"sandarter.click":{"name":"sandarter.click","record_type":"a","resolve_time":"2026-09-07T01:56:13Z"},"usbailnk.one":{"name":"usbailnk.one","record_type":"a","resolve_time":"2026-09-07T08:58:28Z"},"usbalnk.live":{"name":"usbalnk.live","record_type":"a","resolve_time":"2026-09-07T08:38:20Z"},"vacsu.sbs":{"name":"vacsu.sbs","record_type":"a","resolve_time":"2026-09-06T21:06:10Z"},"www.golagen1.lol":{"name":"www.golagen1.lol","record_type":"a","resolve_time":"2026-09-06T15:38:43Z"},"www.hansinitoin.click":{"name":"www.hansinitoin.click","record_type":"a","resolve_time":"2026-09-07T08:54:26Z"},"www.sandarter.click":{"name":"www.sandarter.click","record_type":"a","resolve_time":"2026-09-06T21:07:26Z"},"www.usbailnk.one":{"name":"www.usbailnk.one","record_type":"a","resolve_time":"2026-09-06T13:08:49Z"},"www.usbalnk.live":{"name":"www.usbalnk.live","record_type":"a","resolve_time":"2026-09-07T03:04:38Z"},"www.vacsu.sbs":{"name":"www.vacsu.sbs","record_type":"a","resolve_time":"2026-09-06T14:14:55Z"}},"names":["cldz.abdorahmanamani.ir","golagen1.lol","hansinitoin.click","sandarter.click","usbailnk.one","usbalnk.live","vacsu.sbs","www.golagen1.lol","www.hansinitoin.click","www.sandarter.click","www.usbailnk.one","www.usbalnk.live","www.vacsu.sbs"],"reverse_dns":{"names":["82.157.61.45.static.cloudzy.com"],"resolve_time":"2026-08-31T14:20:46Z"}},"ip":"45.61.157.82","labels":[{"confidence":0.75,"source":"censys","value":"BULLETPROOF"}],"location":{"city":"Las Vegas","continent":"North America","coordinates":{"latitude":36.1008,"longitude":-115.1365},"country":"United States","country_code":"US","postal_code":"89119","province":"Nevada","timezone":"America/Los_Angeles"},"network":[{"hosting":true,"source":"IPINFO"}],"operating_system":{"confidence":0.25,"cpe":"cpe:2.3:o:microsoft:windows:*:*:*:*:*:*:*:*","evidence":[{"data_path":"http.headers.server"}],"part":"o","product":"windows","source":"recog","vendor":"microsoft"},"privacy":[{"source":"IPINFO"}],"reputation":{"evidence":[{},{},{},{},{}],"model_version":"2.0.0","score":0.504},"service_count":2,"services":[{"cert":{"added_at":"2026-08-04T18:32:54Z","ever_seen_in_scan":true,"fingerprint_md5":"2ac861116f676b05a73a58bbd61e28cd","fingerprint_sha1":"afe246d55b3ffae584b44511d866ff535da0e292","fingerprint_sha256":"de69af101d75f3f928e6e9d336602e5a0ee3bfe3251b49da4f1392fd77a56986","modified_at":"2026-08-04T18:32:54Z","names":["ubuntu-LasVegas"],"parse_status":"success","parsed":{"extensions":{"extended_key_usage":{"server_auth":true},"key_usage":{"data_encipherment":true,"key_encipherment":true,"value":12}},"issuer":{"common_name":["ubuntu-LasVegas"]},"issuer_dn":"CN=ubuntu-LasVegas","ja4x":"7022c563de38_7022c563de38_e73b053161df","serial_number":"118999415673907554624953375300177860427","serial_number_hex":"5986742c4f0336b0472ee80fa5bb974b","signature":{"self_signed":true,"signature_algorithm":{"name":"SHA1-RSA","oid":"1.2.840.113549.1.1.5"},"valid":true,"value":"6891ce86caedfe1db6c096145cf9cdeb1f64c7cfd138470b649d130cca789cd080aab78d2c2c7531eda6e2469e37128616f05cef14bff7ef6ff0d51d9a11c306041812e94c2c6ba64e17debb4fc02abfed62a91d6741503269e670875c89edbc4ee5b6ee89e7ff04b48de66c5985e84ffdde2f021f485853e94518200735705501c5bbb0263c7c6075c689c647ca572293bcdf440a63ca5d8956c9223c99871f8011dc6e1287959dd33dd3c8f8ec693232f33c9b05cac4fe0ad1e49e2edaf5b4bf9cd401b6ba20bf6cecdef164bf3e59941fb96ad473a77478e107f7904a409c087b3d66a4027a95118e90d8fe52c1146a7ceceea236ed52a7afff8bd06f34f3"},"subject":{"common_name":["ubuntu-LasVegas"]},"subject_dn":"CN=ubuntu-LasVegas","subject_key_info":{"fingerprint_sha256":"01e258525bfb44566da7c16431ffd6d6eb3e28cde5799fd00a50156d2a74977d","key_algorithm":{"name":"RSA","oid":"1.2.840.113549.1.1.1"},"rsa":{"exponent":65537,"length":2048,"modulus":"a5d2899c0616dc88692b38055c49962f7a4ab2ddf5a9cb832ac09b71539debfadb1c30c941bd0605af9b3b92cbfb0b924b8979cd32fd8bef193acbbd1a994fe4f6f930ddf58a2917eac01b002eb8142a7036acf5e46e1f318af540d8e7b6333842944d285177108054c827bb4a1deae8ede57167fd25abd75f564758420efcc1723ca7d9d78e15c828049e35cae5727b3c3ed84d59c3046238b47fd6f2332b6c84f8c60a084d94e357033cab1b285b951852762e88daeb82a99d27d2e7ebe25a9e716db697ac2d30730d25842357d095e5e4601677b3998e7af79fedb4f7ebf24ec3d700615918951ac5f83d5c845e1da44a5fc13216acafbdfcc1c55fc1323f"}},"validity_period":{"length_seconds":15811201,"not_after":"2027-02-02T17:31:06Z","not_before":"2026-08-03T17:31:06Z"},"version":3},"revocation":{"crl":{},"ocsp":{}},"spki_fingerprint_sha256":"f5f97b53d902cccd32aa6310e93fd16d0e3340763c0a30c9b4082355c8d5758a","spki_subject_fingerprint_sha256":"f5f97b53d902cccd32aa6310e93fd16d0e3340763c0a30c9b4082355c8d5758a","tbs_fingerprint_sha256":"4abf4451c0761d67c1f89ffe99d1af527e6cbaed7dbe5189fb4edf2fef74bbbf","tbs_no_ct_fingerprint_sha256":"4abf4451c0761d67c1f89ffe99d1af527e6cbaed7dbe5189fb4edf2fef74bbbf","validated_at":"2026-09-06T18:28:13Z","validation":{"apple":{},"chrome":{},"microsoft":{},"nss":{}},"zlint":{"errors_present":true,"failed_lints":["e_ext_san_missing","e_sub_cert_aia_does_not_contain_ocsp_url","e_sub_cert_aia_missing","e_sub_cert_cert_policy_empty","e_sub_cert_certificate_policies_missing","e_sub_cert_or_sub_ca_using_sha1","e_subject_common_name_not_exactly_from_san","n_subject_common_name_included","w_ext_key_usage_not_critical","w_ext_subject_key_identifier_missing_sub_cert","w_sub_cert_sha1_expiration_too_long"],"notices_present":true,"timestamp":"2026-08-04T18:32:54Z","version":3,"warnings_present":true}},"exposures":[{"confidence":1,"evidence":[{"data_path":"protocol","found_value":"RDP","literal_match":"RDP"}],"id":"CENSYS-2022-1054","metrics":{},"name":"Exposed RDP Service","risk_source":"censys","severity":"high","source":"censys","year":2022}],"ip":"45.61.157.82","ja4tscan":{"fingerprint":"8192_2-1-3-4-8_1460_8_3-6","scan_time":"2026-09-04T08:40:08Z"},"jarm":{"cipher_and_version_fingerprint":"06b06b00006b06b06b06b06b06b06b","fingerprint":"06b06b00006b06b06b06b06b06b06be3b0c44298fc1c149afbf4c8996fb924","ip":"45.61.157.82","is_success":true,"port":3389,"scan_time":"2026-09-03T19:07:13Z","tls_extensions_sha256":"e3b0c44298fc1c149afbf4c8996fb924","transport_protocol":"tcp"},"labels":[{"confidence":1,"evidence":[{"data_path":"protocol","found_value":"RDP","literal_match":"RDP"}],"source":"censys","value":"REMOTE_ACCESS"}],"misconfigs":[{"confidence":0.5,"evidence":[{"data_path":"service.tls.cipher_selected","found_value":"TLS_RSA_WITH_AES_128_CBC_SHA","literal_match":"TLS_RSA_WITH_AES_128_CBC_SHA"}],"id":"CENSYS-2026-1193","metrics":{},"name":"Weak TLS Cipher Selected","risk_source":"censys","severity":"medium","source":"censys","year":2026},{"confidence":1,"evidence":[{"data_path":"cert.parsed.signature.self_signed","found_value":"true"}],"id":"CENSYS-2026-1196","metrics":{},"name":"Self-Signed Certificate","risk_source":"censys","severity":"low","source":"censys","year":2026}],"port":3389,"protocol":"RDP","rdp":{"certificate_info":{},"connect_response":{"domain_parameters":{"domain_protocol_version":2,"max_channel_ids":34,"max_mcspdu_size":65528,"max_provider_height":1,"max_user_id_channels":3,"num_priorities":1}},"protocol_flags":{"extended_client_data_supported":true},"selected_security_protocol":{"raw_value":1,"standard_rdp":true,"tls":true},"version":{"major":5,"raw":"00000000"},"x224_cc_pdu_dstref":51966,"x224_cc_pdu_srcref":13330},"scan_time":"2026-09-06T11:35:04Z","screenshots":[{"extracted_text":"Administrator Logged on Password ↑ Cancel Windows Server 2008 R2 Standard","handle":"f6e40afdee8140da9dc59388fad30255","phash":"cc227733cc0cdb33"}],"software":[{"confidence":1,"evidence":[{"data_path":"protocol","found_value":"RDP","literal_match":"RDP"}],"part":"a","source":"censys","type":["REMOTE_ACCESS"]}],"tls":{"cipher_selected":"TLS_RSA_WITH_AES_128_CBC_SHA","fingerprint_sha256":"de69af101d75f3f928e6e9d336602e5a0ee3bfe3251b49da4f1392fd77a56986","ja3s":"18e962e106761869a61045bed0e81c2c","ja4s":"t100000_002f_e3b0c44298fc","version_selected":"tlsv1_0","versions":[{"ja3s":"18e962e106761869a61045bed0e81c2c","ja4s":"t100000_002f_e3b0c44298fc","version":"tlsv1_0"}]},"transport_protocol":"tcp"},{"banner":"HTTP/1.1 404 Not Found\r\nContent-Type: text/html; charset=us-ascii\r\nServer: Microsoft-HTTPAPI/2.0\r\nDate: \r\nConnection: close\r\nContent-Length: 315\r\n","banner_hash_sha256":"d7de42c1e8c09cf951e3ad6248fda3ab48a60ca3eac8b25effd4b3067df8f362","endpoints":[{"banner":"HTTP/1.1 404 Not Found\r\nContent-Type: text/html; charset=us-ascii\r\nServer: Microsoft-HTTPAPI/2.0\r\nDate: \r\nConnection: close\r\nContent-Length: 315\r\n","banner_hash_sha256":"d7de42c1e8c09cf951e3ad6248fda3ab48a60ca3eac8b25effd4b3067df8f362","endpoint_type":"HTTP","hostname":"45.61.157.82","http":{"body":"\r\nNot Found\r\n\r\n

Not Found

\r\n

HTTP Error 404. The requested resource is not found.

\r\n\r\n","body_hash_sha1":"a66898b36c94c53766e66c1a7aaeb149447ec083","body_hash_sha256":"ce7127c38e30e92a021ed2bd09287713c6a923db9ffdb43f126e8965d777fbf0","body_hash_tlsh":"8be07d6d9856aac542a0f4bc75d193b48115038fd4e547d90051b21714891bcc1f0dcf","body_size":315,"headers":{"Connection":{"headers":["close"]},"Content-Length":{"headers":["315"]},"Content-Type":{"headers":["text/html; charset=us-ascii"]},"Date":{"headers":[""]},"Server":{"headers":["Microsoft-HTTPAPI/2.0"]}},"html_tags":["Not Found",""],"html_title":"Not Found","protocol":"HTTP/1.1","status_code":404,"status_reason":"Not Found","supported_versions":["HTTP/1.1"],"uri":"http://45.61.157.82:47001/"},"ip":"45.61.157.82","path":"/","port":47001,"scan_time":"2026-09-06T16:00:35Z","transport_protocol":"tcp"}],"ip":"45.61.157.82","ja4tscan":{"fingerprint":"8192_2-4-8_1460_0_3-6","scan_time":"2026-09-07T01:06:52Z"},"operating_systems":[{"confidence":0.25,"cpe":"cpe:2.3:o:microsoft:windows:*:*:*:*:*:*:*:*","evidence":[{"data_path":"http.headers.server"}],"part":"o","product":"windows","source":"recog","vendor":"microsoft"}],"port":47001,"protocol":"HTTP","scan_time":"2026-09-06T16:00:35Z","software":[{"confidence":0.25,"cpe":"cpe:2.3:a:microsoft:http_api:2.0:*:*:*:*:*:*:*","evidence":[{"data_path":"http.headers.server"}],"part":"a","product":"http_api","source":"recog","vendor":"microsoft","version":"2.0"}],"transport_protocol":"tcp"}],"whois":{"network":{"allocation_type":"REALLOCATION","cidrs":["45.61.156.0/23"],"created":"2024-04-06T00:00:00Z","handle":"ROUTERHOSTING","name":"RouterHosting LLC","updated":"2024-04-06T00:00:00Z"},"organization":{"abuse_contacts":[{"email":"abuse-reports@cloudzy.com","handle":"ABUSE8459-ARIN","name":"abuse"}],"admin_contacts":[{"email":"abuse-reports@cloudzy.com","handle":"ABUSE8459-ARIN","name":"abuse"}],"city":"Sheridan","country":"US","handle":"RL-896","name":"RouterHosting LLC","postal_code":"82801","state":"WY","street":"1309 Coffeen Avenue STE 1200\\nSheridan, WY 82801","tech_contacts":[{"email":"abuse-reports@cloudzy.com","handle":"ABUSE8459-ARIN","name":"abuse"}]}}}}},"services":{"result":{"next_page_token":"0a159073e7622c2db7674259:Cn7vcPfLETg7M0oPSa8X/Ku7B6Zs9TaCuZjwYEHnK9eHPNQaQMY6YDaVJe4I8UakPTrSMjX93LYTT2n8FWSc6EPGF8FaeSJIdYxe9Kv5ioUFIwwIKGnEwftuwDsMpVAv1rw6Zl1I3TieH2Wt3NM/u3b+8/oA63iudEYRMyKrI0tuApEImTjshy1y/cEg2WNC3KqY94CQ5Z8DiZ3Rf6KcybZwG8qshhA4hHrsomt8QAWWatKWpJTiUL9nVMDP3RIibnGm2pcbc2ktBQlRQ24IEOSqp62w42ZllS6PL/lT1GRBTd+9UPZwbE/bVhIVDz6QGKPQQ8mhaHnjb47J/PkeRLlYx3IDSz61D8yJWog6J9wvXThq2LSLpNUxb8eAQCVRG3Nhdvkn3yQ5xAIxl9DlD0RkHLQArXWjistC9R2QAIiOclK1pKuI2fShkwZJHyIJQgpFBnhb8YvmpSkriYq8EUl20SItLnQx3DcnvgaOpz3D16DGf0mEbKjocIzCngUIxrE32LDOs8IC+0jjc4pJcNVwoUjM52Knl2iPiWEoqIyCb0L28Ie1jlALnhwre6Z6fz1If8SZwquPQD4ahZbE5lClL8Ulml6Z+JCVzAPmyL+JiYTcKKDIHvh5zIDmvRKfqBS/VPGO/jWf73c9iquODmwNyXqmaaMshxDhaoSmKFo92qzZ1OY6D/nqxHIFmL6TeKjf/bvvp01vitaUD7WyhF1a4vcpcjYXxUnptQEJ9G1I+xsqGX1R6WTGTjvOt1s2NphNDvEG","ranges":[{"end_time":"2026-09-06T16:00:36.963491Z","ip":"45.61.157.82","port":"47001","protocol":"HTTP","start_time":"2026-09-03T04:14:52.114975Z","transport_protocol":"TCP"},{"end_time":"2026-09-06T11:35:05.80638Z","ip":"45.61.157.82","port":"3389","protocol":"RDP","start_time":"2026-09-03T18:09:14.349917Z","transport_protocol":"TCP"},{"end_time":"2026-08-31T03:41:44.113082Z","ip":"45.61.157.82","port":"3389","protocol":"RDP","start_time":"2026-08-09T13:33:11.098531Z","transport_protocol":"TCP"},{"end_time":"2026-08-30T08:06:33.000646Z","ip":"45.61.157.82","port":"47001","protocol":"HTTP","start_time":"2026-08-05T12:28:21.292647Z","transport_protocol":"TCP"},{"end_time":"2026-08-08T13:07:32.626259Z","ip":"45.61.157.82","port":"3389","protocol":"UNKNOWN","start_time":"2026-08-08T13:07:31.626259Z","transport_protocol":"TCP"},{"end_time":"2026-08-08T01:49:18.517131Z","ip":"45.61.157.82","port":"3389","protocol":"RDP","start_time":"2026-08-05T23:38:42.474099Z","transport_protocol":"TCP"},{"end_time":"2026-08-04T22:42:52.275462Z","ip":"45.61.157.82","port":"3389","protocol":"UNKNOWN","start_time":"2026-08-04T22:42:51.275462Z","transport_protocol":"TCP"},{"end_time":"2026-08-04T18:32:44.086139Z","ip":"45.61.157.82","port":"3389","protocol":"RDP","start_time":"2026-08-01T14:23:52.495786Z","transport_protocol":"TCP"},{"end_time":"2026-08-04T11:34:04.918053Z","ip":"45.61.157.82","port":"22","protocol":"SSH","start_time":"2026-07-31T18:41:15.92357Z","transport_protocol":"TCP"},{"end_time":"2026-07-30T19:31:44.339231Z","ip":"45.61.157.82","port":"22","protocol":"SSH","start_time":"2026-07-30T19:31:43.339231Z","transport_protocol":"TCP"},{"end_time":"2026-07-29T07:49:43.563151Z","ip":"45.61.157.82","port":"465","protocol":"SMTP","start_time":"2026-07-29T07:49:42.563151Z","transport_protocol":"TCP"},{"end_time":"2026-07-29T07:28:51.871698Z","ip":"45.61.157.82","port":"143","protocol":"IMAP","start_time":"2026-05-12T15:26:34.956793Z","transport_protocol":"TCP"},{"end_time":"2026-07-29T03:54:51.495771Z","ip":"45.61.157.82","port":"8888","protocol":"HTTP","start_time":"2026-05-23T22:22:31.089115Z","transport_protocol":"TCP"},{"end_time":"2026-07-29T03:35:34.322615Z","ip":"45.61.157.82","port":"8888","protocol":"UNKNOWN","start_time":"2026-05-01T21:10:50.023096Z","transport_protocol":"TCP"},{"end_time":"2026-07-29T03:31:12.144586Z","ip":"45.61.157.82","port":"110","protocol":"POP3","start_time":"2026-05-12T15:08:33.444333Z","transport_protocol":"TCP"},{"end_time":"2026-07-29T02:04:59.994977Z","ip":"45.61.157.82","port":"995","protocol":"POP3","start_time":"2026-07-28T22:05:37.687088Z","transport_protocol":"TCP"},{"end_time":"2026-07-29T01:48:25.975556Z","ip":"45.61.157.82","port":"80","protocol":"HTTP","start_time":"2026-05-23T22:15:09.163694Z","transport_protocol":"TCP"},{"end_time":"2026-07-28T20:40:24.418049Z","ip":"45.61.157.82","port":"993","protocol":"IMAP","start_time":"2026-05-13T02:56:32.081295Z","transport_protocol":"TCP"},{"end_time":"2026-07-28T19:07:50.589784Z","ip":"45.61.157.82","port":"22","protocol":"SSH","start_time":"2026-05-12T15:14:01.431905Z","transport_protocol":"TCP"},{"end_time":"2026-07-28T15:06:59.574712Z","ip":"45.61.157.82","port":"7777","protocol":"HTTP","start_time":"2026-05-12T14:23:45.72071Z","transport_protocol":"TCP"},{"end_time":"2026-07-28T14:31:59.705222Z","ip":"45.61.157.82","port":"21","protocol":"FTP","start_time":"2026-07-27T09:17:41.963753Z","transport_protocol":"TCP"},{"end_time":"2026-07-28T12:34:25.938046Z","ip":"45.61.157.82","port":"587","protocol":"SMTP","start_time":"2026-05-12T13:50:47.462026Z","transport_protocol":"TCP"},{"end_time":"2026-07-28T11:50:15.023298Z","ip":"45.61.157.82","port":"443","protocol":"HTTP","start_time":"2026-05-24T00:40:21.73953Z","transport_protocol":"TCP"},{"end_time":"2026-07-28T09:50:44.819511Z","ip":"45.61.157.82","port":"25","protocol":"SMTP","start_time":"2026-05-24T01:02:46.585605Z","transport_protocol":"TCP"},{"end_time":"2026-07-27T19:16:36.869242Z","ip":"45.61.157.82","port":"465","protocol":"SMTP","start_time":"2026-07-27T19:16:35.869242Z","transport_protocol":"TCP"},{"end_time":"2026-07-27T18:58:09.79946Z","ip":"45.61.157.82","port":"995","protocol":"POP3","start_time":"2026-07-27T18:58:08.79946Z","transport_protocol":"TCP"},{"end_time":"2026-07-26T04:30:28.006271Z","ip":"45.61.157.82","port":"21","protocol":"FTP","start_time":"2026-05-12T13:07:15.070464Z","transport_protocol":"TCP"},{"end_time":"2026-07-26T02:34:09.324997Z","ip":"45.61.157.82","port":"465","protocol":"SMTP","start_time":"2026-07-26T02:34:08.324997Z","transport_protocol":"TCP"},{"end_time":"2026-07-25T09:59:53.367913Z","ip":"45.61.157.82","port":"995","protocol":"POP3","start_time":"2026-07-25T09:59:52.367913Z","transport_protocol":"TCP"},{"end_time":"2026-07-24T16:09:13.599292Z","ip":"45.61.157.82","port":"465","protocol":"SMTP","start_time":"2026-07-24T16:09:12.599292Z","transport_protocol":"TCP"},{"end_time":"2026-07-23T22:17:05.931893Z","ip":"45.61.157.82","port":"995","protocol":"POP3","start_time":"2026-07-23T22:17:04.931893Z","transport_protocol":"TCP"},{"end_time":"2026-07-23T17:12:37.955822Z","ip":"45.61.157.82","port":"465","protocol":"SMTP","start_time":"2026-07-23T17:12:36.955822Z","transport_protocol":"TCP"},{"end_time":"2026-07-22T22:26:12.320666Z","ip":"45.61.157.82","port":"995","protocol":"POP3","start_time":"2026-07-22T22:26:11.320666Z","transport_protocol":"TCP"},{"end_time":"2026-07-22T16:03:10.997998Z","ip":"45.61.157.82","port":"465","protocol":"SMTP","start_time":"2026-07-22T16:03:09.997998Z","transport_protocol":"TCP"},{"end_time":"2026-07-22T10:14:48.452197Z","ip":"45.61.157.82","port":"465","protocol":"SMTP","start_time":"2026-07-21T09:31:58.106743Z","transport_protocol":"TCP"},{"end_time":"2026-07-20T19:00:41.973626Z","ip":"45.61.157.82","port":"995","protocol":"POP3","start_time":"2026-07-20T13:16:38.224417Z","transport_protocol":"TCP"},{"end_time":"2026-07-20T03:28:13.759923Z","ip":"45.61.157.82","port":"465","protocol":"SMTP","start_time":"2026-07-19T18:21:57.8624Z","transport_protocol":"TCP"},{"end_time":"2026-07-18T17:23:17.858032Z","ip":"45.61.157.82","port":"465","protocol":"SMTP","start_time":"2026-07-18T17:23:16.858032Z","transport_protocol":"TCP"},{"end_time":"2026-07-18T17:09:11.209972Z","ip":"45.61.157.82","port":"995","protocol":"POP3","start_time":"2026-07-18T17:09:10.209972Z","transport_protocol":"TCP"},{"end_time":"2026-07-17T17:07:04.368521Z","ip":"45.61.157.82","port":"465","protocol":"SMTP","start_time":"2026-07-17T17:07:03.368521Z","transport_protocol":"TCP"},{"end_time":"2026-07-17T04:24:18.458634Z","ip":"45.61.157.82","port":"995","protocol":"POP3","start_time":"2026-07-16T05:29:54.315256Z","transport_protocol":"TCP"},{"end_time":"2026-07-15T16:32:36.098525Z","ip":"45.61.157.82","port":"465","protocol":"SMTP","start_time":"2026-07-15T16:32:35.098525Z","transport_protocol":"TCP"},{"end_time":"2026-07-14T11:41:38.004811Z","ip":"45.61.157.82","port":"465","protocol":"SMTP","start_time":"2026-07-13T16:26:46.248639Z","transport_protocol":"TCP"},{"end_time":"2026-07-13T18:21:05.621937Z","ip":"45.61.157.82","port":"995","protocol":"POP3","start_time":"2026-07-13T16:26:46.418087Z","transport_protocol":"TCP"},{"end_time":"2026-07-12T09:51:58.604193Z","ip":"45.61.157.82","port":"465","protocol":"SMTP","start_time":"2026-07-12T09:51:57.604193Z","transport_protocol":"TCP"},{"end_time":"2026-07-11T17:30:08.60141Z","ip":"45.61.157.82","port":"995","protocol":"POP3","start_time":"2026-07-11T17:30:07.60141Z","transport_protocol":"TCP"},{"end_time":"2026-07-10T10:17:08.786974Z","ip":"45.61.157.82","port":"995","protocol":"POP3","start_time":"2026-07-09T12:49:32.663845Z","transport_protocol":"TCP"},{"end_time":"2026-07-09T21:40:51.0641Z","ip":"45.61.157.82","port":"465","protocol":"SMTP","start_time":"2026-07-09T05:11:19.511674Z","transport_protocol":"TCP"},{"end_time":"2026-07-08T18:25:23.290736Z","ip":"45.61.157.82","port":"995","protocol":"POP3","start_time":"2026-07-08T18:25:22.290736Z","transport_protocol":"TCP"},{"end_time":"2026-07-08T05:40:45.442823Z","ip":"45.61.157.82","port":"465","protocol":"SMTP","start_time":"2026-07-08T05:40:44.442823Z","transport_protocol":"TCP"},{"end_time":"2026-07-07T20:19:56.544584Z","ip":"45.61.157.82","port":"995","protocol":"POP3","start_time":"2026-07-07T20:19:55.544584Z","transport_protocol":"TCP"},{"end_time":"2026-07-06T05:00:34.974409Z","ip":"45.61.157.82","port":"465","protocol":"SMTP","start_time":"2026-07-05T19:52:01.232206Z","transport_protocol":"TCP"},{"end_time":"2026-07-05T23:28:06.908242Z","ip":"45.61.157.82","port":"995","protocol":"POP3","start_time":"2026-07-01T16:22:25.554024Z","transport_protocol":"TCP"},{"end_time":"2026-07-04T14:12:24.551306Z","ip":"45.61.157.82","port":"465","protocol":"SMTP","start_time":"2026-07-02T16:33:18.094646Z","transport_protocol":"TCP"},{"end_time":"2026-06-30T11:28:25.426166Z","ip":"45.61.157.82","port":"465","protocol":"SMTP","start_time":"2026-06-28T12:53:15.027839Z","transport_protocol":"TCP"},{"end_time":"2026-06-29T20:27:42.1222Z","ip":"45.61.157.82","port":"995","protocol":"POP3","start_time":"2026-06-28T15:48:10.881985Z","transport_protocol":"TCP"},{"end_time":"2026-06-27T15:55:20.967873Z","ip":"45.61.157.82","port":"465","protocol":"SMTP","start_time":"2026-06-27T15:55:19.967873Z","transport_protocol":"TCP"},{"end_time":"2026-06-27T05:27:35.172255Z","ip":"45.61.157.82","port":"995","protocol":"POP3","start_time":"2026-06-24T16:06:51.450676Z","transport_protocol":"TCP"},{"end_time":"2026-06-25T22:21:44.312542Z","ip":"45.61.157.82","port":"465","protocol":"SMTP","start_time":"2026-06-25T09:04:40.894404Z","transport_protocol":"TCP"},{"end_time":"2026-06-23T10:01:09.946858Z","ip":"45.61.157.82","port":"465","protocol":"SMTP","start_time":"2026-06-23T10:01:08.946858Z","transport_protocol":"TCP"},{"end_time":"2026-06-22T22:29:49.305436Z","ip":"45.61.157.82","port":"995","protocol":"POP3","start_time":"2026-06-21T03:28:51.139229Z","transport_protocol":"TCP"},{"end_time":"2026-06-22T02:45:16.115575Z","ip":"45.61.157.82","port":"465","protocol":"SMTP","start_time":"2026-06-20T17:38:17.104254Z","transport_protocol":"TCP"},{"end_time":"2026-06-20T16:01:33.147287Z","ip":"45.61.157.82","port":"995","protocol":"POP3","start_time":"2026-06-20T16:01:32.147287Z","transport_protocol":"TCP"},{"end_time":"2026-06-19T17:05:06.277824Z","ip":"45.61.157.82","port":"465","protocol":"SMTP","start_time":"2026-06-19T17:05:05.277824Z","transport_protocol":"TCP"},{"end_time":"2026-06-18T23:38:54.595481Z","ip":"45.61.157.82","port":"465","protocol":"SMTP","start_time":"2026-06-17T23:09:48.833428Z","transport_protocol":"TCP"},{"end_time":"2026-06-18T23:38:54.536629Z","ip":"45.61.157.82","port":"995","protocol":"POP3","start_time":"2026-06-17T18:23:07.187995Z","transport_protocol":"TCP"},{"end_time":"2026-06-17T17:18:16.37188Z","ip":"45.61.157.82","port":"995","protocol":"POP3","start_time":"2026-06-17T17:18:15.37188Z","transport_protocol":"TCP"},{"end_time":"2026-06-16T08:25:28.479863Z","ip":"45.61.157.82","port":"465","protocol":"SMTP","start_time":"2026-06-14T17:30:12.206355Z","transport_protocol":"TCP"},{"end_time":"2026-06-15T23:37:49.258672Z","ip":"45.61.157.82","port":"995","protocol":"POP3","start_time":"2026-06-15T23:37:48.258672Z","transport_protocol":"TCP"},{"end_time":"2026-06-15T20:59:09.675012Z","ip":"45.61.157.82","port":"995","protocol":"POP3","start_time":"2026-06-14T22:20:16.856639Z","transport_protocol":"TCP"},{"end_time":"2026-06-13T06:10:12.754778Z","ip":"45.61.157.82","port":"995","protocol":"POP3","start_time":"2026-06-11T14:15:24.146022Z","transport_protocol":"TCP"},{"end_time":"2026-06-12T04:08:36.569285Z","ip":"45.61.157.82","port":"465","protocol":"SMTP","start_time":"2026-06-11T08:21:27.240139Z","transport_protocol":"TCP"},{"end_time":"2026-06-11T00:42:32.983806Z","ip":"45.61.157.82","port":"995","protocol":"POP3","start_time":"2026-06-10T10:37:37.552609Z","transport_protocol":"TCP"},{"end_time":"2026-06-10T07:28:24.351845Z","ip":"45.61.157.82","port":"465","protocol":"SMTP","start_time":"2026-06-08T19:15:09.743367Z","transport_protocol":"TCP"},{"end_time":"2026-06-07T18:40:09.882649Z","ip":"45.61.157.82","port":"995","protocol":"POP3","start_time":"2026-06-07T18:40:08.882649Z","transport_protocol":"TCP"},{"end_time":"2026-06-07T00:20:50.783956Z","ip":"45.61.157.82","port":"465","protocol":"SMTP","start_time":"2026-06-07T00:20:49.783956Z","transport_protocol":"TCP"},{"end_time":"2026-06-05T14:57:08.729925Z","ip":"45.61.157.82","port":"995","protocol":"POP3","start_time":"2026-06-04T18:30:01.586734Z","transport_protocol":"TCP"},{"end_time":"2026-06-03T21:53:56.248975Z","ip":"45.61.157.82","port":"465","protocol":"SMTP","start_time":"2026-06-03T06:04:56.312935Z","transport_protocol":"TCP"},{"end_time":"2026-06-02T12:31:45.978299Z","ip":"45.61.157.82","port":"995","protocol":"POP3","start_time":"2026-06-02T12:31:44.978299Z","transport_protocol":"TCP"},{"end_time":"2026-06-01T23:01:19.32168Z","ip":"45.61.157.82","port":"465","protocol":"SMTP","start_time":"2026-06-01T23:01:18.32168Z","transport_protocol":"TCP"},{"end_time":"2026-06-01T09:55:51.867033Z","ip":"45.61.157.82","port":"995","protocol":"POP3","start_time":"2026-05-30T08:42:56.958068Z","transport_protocol":"TCP"},{"end_time":"2026-05-31T11:35:52.423135Z","ip":"45.61.157.82","port":"465","protocol":"SMTP","start_time":"2026-05-30T00:19:08.047027Z","transport_protocol":"TCP"},{"end_time":"2026-05-29T13:05:56.105467Z","ip":"45.61.157.82","port":"995","protocol":"POP3","start_time":"2026-05-29T13:05:55.105467Z","transport_protocol":"TCP"},{"end_time":"2026-05-28T20:08:22.056824Z","ip":"45.61.157.82","port":"465","protocol":"SMTP","start_time":"2026-05-28T20:08:21.056824Z","transport_protocol":"TCP"},{"end_time":"2026-05-28T16:17:45.026165Z","ip":"45.61.157.82","port":"995","protocol":"POP3","start_time":"2026-05-28T16:17:44.026165Z","transport_protocol":"TCP"},{"end_time":"2026-05-27T23:20:22.501442Z","ip":"45.61.157.82","port":"995","protocol":"POP3","start_time":"2026-05-27T23:20:21.501442Z","transport_protocol":"TCP"},{"end_time":"2026-05-27T19:25:27.652471Z","ip":"45.61.157.82","port":"995","protocol":"POP3","start_time":"2026-05-27T19:25:26.652471Z","transport_protocol":"TCP"},{"end_time":"2026-05-27T08:27:05.313996Z","ip":"45.61.157.82","port":"465","protocol":"SMTP","start_time":"2026-05-27T02:32:10.341446Z","transport_protocol":"TCP"},{"end_time":"2026-05-26T11:50:20.186912Z","ip":"45.61.157.82","port":"995","protocol":"POP3","start_time":"2026-05-24T17:19:30.564629Z","transport_protocol":"TCP"},{"end_time":"2026-05-25T23:00:09.136586Z","ip":"45.61.157.82","port":"465","protocol":"SMTP","start_time":"2026-05-25T21:09:17.738936Z","transport_protocol":"TCP"},{"end_time":"2026-05-24T17:07:52.165095Z","ip":"45.61.157.82","port":"465","protocol":"SMTP","start_time":"2026-05-24T15:29:07.149419Z","transport_protocol":"TCP"},{"end_time":"2026-05-23T15:52:41.544059Z","ip":"45.61.157.82","port":"80","protocol":"HTTP","start_time":"2026-05-13T09:03:18.626694Z","transport_protocol":"TCP"},{"end_time":"2026-05-23T11:16:40.904583Z","ip":"45.61.157.82","port":"443","protocol":"HTTP","start_time":"2026-05-12T15:23:10.012714Z","transport_protocol":"TCP"},{"end_time":"2026-05-22T20:19:13.318491Z","ip":"45.61.157.82","port":"8888","protocol":"HTTP","start_time":"2026-05-12T15:24:16.351254Z","transport_protocol":"TCP"},{"end_time":"2026-05-22T20:16:01.320179Z","ip":"45.61.157.82","port":"465","protocol":"SMTP","start_time":"2026-05-22T20:16:00.320179Z","transport_protocol":"TCP"},{"end_time":"2026-05-22T19:56:08.539341Z","ip":"45.61.157.82","port":"25","protocol":"SMTP","start_time":"2026-05-12T16:10:14.041319Z","transport_protocol":"TCP"},{"end_time":"2026-05-22T16:32:50.307183Z","ip":"45.61.157.82","port":"995","protocol":"POP3","start_time":"2026-05-22T16:32:49.307183Z","transport_protocol":"TCP"},{"end_time":"2026-05-22T16:17:54.639777Z","ip":"45.61.157.82","port":"465","protocol":"SMTP","start_time":"2026-05-22T16:17:53.639777Z","transport_protocol":"TCP"},{"end_time":"2026-05-21T09:32:42.290039Z","ip":"45.61.157.82","port":"465","protocol":"SMTP","start_time":"2026-05-20T02:30:35.826316Z","transport_protocol":"TCP"},{"end_time":"2026-05-21T09:32:42.129233Z","ip":"45.61.157.82","port":"995","protocol":"POP3","start_time":"2026-05-19T16:21:10.636272Z","transport_protocol":"TCP"}]}}} +{"ip":"185.100.87.136","asn":"AS200651","name":"FLOKINET","honeylabs_events":24,"host":{"result":{"extensions":{},"resource":{"autonomous_system":{"asn":200651,"bgp_prefix":"185.100.87.0/24","country_code":"IS","description":"FlokiNET - FlokiNET ehf","name":"FlokiNET - FlokiNET ehf"},"dns":{"reverse_dns":{"resolve_time":"2026-08-30T19:27:56Z"}},"greynoise":{"actor":"unknown","classification":"malicious","last_observed_time":"2026-09-01T00:00:00Z","tags":[{"name":"DNS Protocol"},{"name":"Generic Suspicious Linux Command in Request"},{"name":"ICMPv4 Protocol"},{"name":"Looks Like Debian server"},{"name":"Looks Like Windows 11 laptop"},{"name":"Ping Scanner"},{"name":"QUIC Protocol"},{"name":"SSH Alternative Port Crawler"},{"name":"SSH Connection Attempt"},{"name":"SparkRAT Client Update Scanner"},{"name":"TLS/SSL Crawler"},{"name":"Web Crawler"}]},"ip":"185.100.87.136","labels":[{"confidence":0.75,"source":"censys","value":"BULLETPROOF"}],"location":{"city":"Bucharest","continent":"Europe","coordinates":{"latitude":44.43225,"longitude":26.10626},"country":"Romania","country_code":"RO","postal_code":"050011","province":"Bucharest","timezone":"Europe/Bucharest"},"network":[{"hosting":true,"source":"IPINFO"}],"privacy":[{"anonymous":true,"source":"IPINFO","tor":true},{"source":"ONIONOO","tor":true,"tor_info":{"relays":[{"advertised_bandwidth":92160,"bandwidth_burst":122880,"bandwidth_rate":92160,"consensus_weight":3,"consensus_weight_fraction":1.5237209e-8,"effective_family":["9366185B4ECB1CC3634F475D20FDDFE7A302BAF2"],"exit_addresses":["185.100.87.136"],"exit_policy":["reject 0.0.0.0/8:*","reject 169.254.0.0/16:*","reject 127.0.0.0/8:*","reject 192.168.0.0/16:*","reject 10.0.0.0/8:*","reject 172.16.0.0/12:*","reject 185.100.87.136:*","accept *:20-21","accept *:43","accept *:53","accept *:80","accept *:443","accept *:989-990","accept *:1194","accept *:4321","accept *:5222-5223","accept *:11371","accept *:64738","reject *:*"],"exit_policy_summary":{"accept":["20-21","43","53","80","443","989-990","1194","4321","5222-5223","11371","64738"]},"exit_probability":4.649127e-8,"fingerprint":"9366185B4ECB1CC3634F475D20FDDFE7A302BAF2","flags":["Exit","Running","Valid"],"guard_probability":0,"measured":true,"middle_probability":0,"nickname":"PremiumTorExit","observed_bandwidth":126796,"or_addresses":["185.100.87.136:9001"],"platform":"Tor 0.4.9.11 on Linux","recommended_version":true,"version":"0.4.9.11","version_status":"recommended"}]}},{"tor":true}],"reputation":{"evidence":[{},{},{},{},{}],"model_version":"2.0.0","score":0.896},"service_count":3,"services":[{"banner":"HTTP/1.0 200 OK\r\nDate: \r\nContent-Type: text/html\r\nX-Your-Address-Is: 66.132.172.100\r\nContent-Encoding: identity\r\nContent-Length: 17557\r\nExpires: Sun, 06 Sep 2026 23:06:48 GMT\r\n","banner_hash_sha256":"770a86aff34e7fec758afc88c18c6367ceccdef226a4fae6b09e417fd07ca6ba","endpoints":[{"banner":"HTTP/1.0 200 OK\r\nDate: \r\nContent-Type: text/html\r\nX-Your-Address-Is: 66.132.172.100\r\nContent-Encoding: identity\r\nContent-Length: 17557\r\nExpires: Sun, 06 Sep 2026 23:06:48 GMT\r\n","banner_hash_sha256":"770a86aff34e7fec758afc88c18c6367ceccdef226a4fae6b09e417fd07ca6ba","endpoint_type":"HTTP","hostname":"185.100.87.136","http":{"body":"\n\n\n\n\nThis is a Tor Exit Router\n\n\n\n\n\n\n

This is a\nTor Exit Router

\n\n

\nMost likely you are accessing this website because you had some issue with\nthe traffic coming from this IP. This router is part of the Tor Anonymity Network, which is\ndedicated to providing\nprivacy to people who need it most: average computer users. This\nrouter IP should be generating no other traffic, unless it has been\ncompromised.

\n\n

\n\n\n

\n\n

\nTor sees use by many\nimportant segments of the population, including whistle blowers,\njournalists, Chinese dissidents skirting the Great Firewall and oppressive\ncensorship, abuse victims, stalker targets, the US military, and law\nenforcement, just to name a few. While Tor is not designed for malicious\ncomputer users, it is true that they can use the network for malicious ends.\nIn reality however, the actual amount of abuse is quite low. This\nis largely because criminals and hackers have significantly better access to\nprivacy and anonymity than do the regular users whom they prey upon. Criminals\ncan and do build,\nsell, and trade far larger and more\npowerful networks than Tor on a daily basis. Thus, in the mind of this\noperator, the social need for easily accessible censorship-resistant private,\nanonymous communication trumps the risk of unskilled bad actors, who are\nalmost always more easily uncovered by traditional police work than by\nextensive monitoring and surveillance anyway.

\n\n

\nIn terms of applicable law, the best way to understand Tor is to consider it a\nnetwork of routers operating as common carriers, much like the Internet\nbackbone. However, unlike the Internet backbone routers, Tor routers\nexplicitly do not contain identifiable routing information about the source of\na packet, and no single Tor node can determine both the origin and destination\nof a given transmission.

\n\n

\nAs such, there is little the operator of this router can do to help you track\nthe connection further. This router maintains no logs of any of the Tor\ntraffic, so there is little that can be done to trace either legitimate or\nillegitimate traffic (or to filter one from the other). Attempts to\nseize this router will accomplish nothing.

\n\n\n\n

\nFurthermore, this machine also serves as a carrier of email, which means that\nits contents are further protected under the ECPA. 18\nUSC 2707 explicitly allows for civil remedies ($1000/account\nplus legal fees)\nin the event of a seizure executed without good faith or probable cause (it\nshould be clear at this point that traffic with an originating IP address of\nFIXME_DNS_NAME should not constitute probable cause to seize the\nmachine). Similar considerations exist for 1st amendment content on this\nmachine.

\n\n\n\n

\nIf you are a representative of a company who feels that this router is being\nused to violate the DMCA, please be aware that this machine does not host or\ncontain any illegal content. Also be aware that network infrastructure\nmaintainers are not liable for the type of content that passes over their\nequipment, in accordance with DMCA\n\"safe harbor\" provisions. In other words, you will have just as much luck\nsending a takedown notice to the Internet backbone providers. Please consult\nEFF's prepared\nresponse for more information on this matter.

\n\n

For more information, please consult the following documentation:

\n\n
    \n
  1. Tor Overview
    2. \n
  2. Tor Abuse FAQ
    3. \n
  3. Tor Legal FAQ
    4. \n
\n\n

\nThat being said, if you still have a complaint about the router, you may\nemail the maintainer. If\ncomplaints are related to a particular service that is being abused, I will\nconsider removing that service from my exit policy, which would prevent my\nrouter from allowing that traffic to exit through it. I can only do this on an\nIP+destination port basis, however. Common P2P ports are\nalready blocked.

\n\n

\nYou also have the option of blocking this IP address and others on\nthe Tor network if you so desire. The Tor project provides a web service\nto fetch a list of all IP addresses of Tor exit nodes that allow exiting to a\nspecified IP:port combination, and an official DNSRBL is also available to\ndetermine if a given IP address is actually a Tor exit server. Please\nbe considerate\nwhen using these options. It would be unfortunate to deny all Tor users access\nto your site indefinitely simply because of a few bad apples.

\n\n\n\n","body_hash_sha1":"c97a4d30857969d907bc4d2addc000a84be8ca12","body_hash_sha256":"a32c833ad1733a12a271d9d108a5801a72f8a45637e324b7d566899a98e31bb2","body_hash_tlsh":"9e72ae77a34973361340c290762472dcff53c17ab3c57ae2746ac516b288aa683752eb","body_size":17557,"headers":{"Connection":{"headers":["close"]},"Content-Encoding":{"headers":["identity"]},"Content-Length":{"headers":["17557"]},"Content-Type":{"headers":["text/html"]},"Date":{"headers":[""]},"Expires":{"headers":["Sun, 06 Sep 2026 23:06:48 GMT"]},"X-Your-Address-Is":{"headers":["66.132.172.100"]}},"html_tags":["This is a Tor Exit Router",""],"html_title":"This is a Tor Exit Router","protocol":"HTTP/1.0","status_code":200,"status_reason":"OK","supported_versions":["HTTP/1.0"],"uri":"http://185.100.87.136/"},"ip":"185.100.87.136","path":"/","port":80,"scan_time":"2026-09-06T22:46:51Z","transport_protocol":"tcp"},{"banner":"HTTP/1.0 200 OK\r\nDate: \r\nContent-Type: text/plain\r\nX-Your-Address-Is: 66.132.172.197\r\nContent-Encoding: identity\r\nContent-Length: 28\r\nExpires: Mon, 07 Sep 2026 14:47:24 GMT\r\n","banner_hash_sha256":"061b47d1004a9d5bb01c2f9577ee9f949f115f37482f5e678d8695b667dd3ba0","endpoint_type":"HTTP","hostname":"185.100.87.136","http":{"body":"User-agent: *\r\nDisallow: /\r\n","body_hash_sha1":"88a8390db1c2c7a883f0590d8e50eed4bac2ef63","body_hash_sha256":"a8f31103361fca68bef71fc69cff844b7c23bd3d64d2b872d74690cbda656bfc","body_size":28,"headers":{"Connection":{"headers":["close"]},"Content-Encoding":{"headers":["identity"]},"Content-Length":{"headers":["28"]},"Content-Type":{"headers":["text/plain"]},"Date":{"headers":[""]},"Expires":{"headers":["Mon, 07 Sep 2026 14:47:24 GMT"]},"X-Your-Address-Is":{"headers":["66.132.172.197"]}},"protocol":"HTTP/1.0","status_code":200,"status_reason":"OK","supported_versions":["HTTP/1.0"],"uri":"http://185.100.87.136/robots.txt"},"ip":"185.100.87.136","path":"/robots.txt","port":80,"scan_time":"2026-09-06T14:47:05Z","transport_protocol":"tcp"}],"ip":"185.100.87.136","ja4tscan":{"fingerprint":"65160_2-4-8-1-3_1460_7_1-2-4-9-16","scan_time":"2026-09-07T03:13:37Z"},"labels":[{"confidence":0.75,"evidence":[{"data_path":"http.html_title","found_value":"This is a Tor Exit Router","literal_match":"This is a Tor Exit Router"}],"source":"censys","value":"PROXY_SERVER"}],"port":80,"protocol":"HTTP","scan_time":"2026-09-06T22:46:51Z","software":[{"confidence":0.75,"cpe":"cpe:2.3:a:torproject:tor:*:*:*:*:*:*:*:*","evidence":[{"data_path":"http.html_title","found_value":"This is a Tor Exit Router","literal_match":"This is a Tor Exit Router"}],"part":"a","product":"tor","source":"censys","type":["PROXY_SERVER"],"vendor":"torproject"}],"transport_protocol":"tcp"},{"banner":"SSH-2.0-OpenSSH_9.9","banner_hash_sha256":"607685352506d4de6404d09cb1ff43b3304d3845dbe6c3b04c291a88ae21fb8b","banner_hex":"5353482d322e302d4f70656e5353485f392e39","exposures":[{"confidence":1,"evidence":[{"data_path":"protocol","found_value":"SSH","literal_match":"SSH"}],"id":"CENSYS-2022-1066","metrics":{},"name":"Exposed SSH Service","risk_source":"censys","severity":"medium","source":"censys","year":2022}],"ip":"185.100.87.136","ja4tscan":{"fingerprint":"65160_2-4-8-1-3_1460_7_1-2-4-8-16","scan_time":"2026-09-07T02:04:41Z"},"labels":[{"confidence":1,"evidence":[{"data_path":"protocol","found_value":"SSH","literal_match":"SSH"}],"source":"censys","value":"REMOTE_ACCESS"}],"port":7288,"protocol":"SSH","scan_time":"2026-09-07T01:37:21Z","software":[{"confidence":1,"evidence":[{"data_path":"protocol","found_value":"SSH","literal_match":"SSH"}],"part":"a","source":"censys","type":["REMOTE_ACCESS"]},{"confidence":0.25,"cpe":"cpe:2.3:a:openbsd:openssh:9.9:*:*:*:*:*:*:*","evidence":[{"data_path":"ssh.endpoint_id.raw"}],"part":"a","product":"openssh","source":"recog","vendor":"openbsd","version":"9.9"}],"ssh":{"algorithm_selection":{"client_to_server_alg_group":{"cipher":"aes128-ctr","compression":"none","mac":"hmac-sha2-256"},"host_key_algorithm":"ecdsa-sha2-nistp256","kex_algorithm":"curve25519-sha256@libssh.org","server_to_client_alg_group":{"cipher":"aes128-ctr","compression":"none","mac":"hmac-sha2-256"}},"endpoint_id":{"protocol_version":"2.0","raw":"SSH-2.0-OpenSSH_9.9","software_version":"OpenSSH_9.9"},"hassh_fingerprint":"b1bff636ebbdbaa9dd2ad97fd173c956","kex_init_message":{"client_to_server_ciphers":["aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes256-ctr","aes128-gcm@openssh.com","aes128-ctr"],"client_to_server_compression":["none","zlib@openssh.com"],"client_to_server_macs":["hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","umac-128-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha1","umac-128@openssh.com","hmac-sha2-512"],"host_key_algorithms":["rsa-sha2-512","rsa-sha2-256","ecdsa-sha2-nistp256","ssh-ed25519"],"kex_algorithms":["curve25519-sha256","curve25519-sha256@libssh.org","ecdh-sha2-nistp256","ecdh-sha2-nistp384","ecdh-sha2-nistp521","diffie-hellman-group-exchange-sha256","diffie-hellman-group14-sha256","diffie-hellman-group16-sha512","diffie-hellman-group18-sha512","ext-info-s","kex-strict-s-v00@openssh.com"],"server_to_client_ciphers":["aes256-gcm@openssh.com","chacha20-poly1305@openssh.com","aes256-ctr","aes128-gcm@openssh.com","aes128-ctr"],"server_to_client_compression":["none","zlib@openssh.com"],"server_to_client_macs":["hmac-sha2-256-etm@openssh.com","hmac-sha1-etm@openssh.com","umac-128-etm@openssh.com","hmac-sha2-512-etm@openssh.com","hmac-sha2-256","hmac-sha1","umac-128@openssh.com","hmac-sha2-512"]},"server_host_key":{"ecdsa_public_key":{"b":"WsY12Ko6k+ez671VdpiGvGUdBrDMU7D2O848PifSYEs=","curve":"P-256","gx":"axfR8uEsQkf4vOblY6RA8ncDfYEt6zOg9KE5RdiYwpY=","gy":"T+NC4v4af5uO5+tKfA+eFivOM1drMV7Oy7ZAaDe/UfU=","length":256,"n":"/////wAAAAD//////////7zm+q2nF56E87nKwvxjJVE=","p":"/////wAAAAEAAAAAAAAAAAAAAAD///////////////8=","x":"UUoBOoUINl0JCxNInaB38OEbyY23Lh6GJvidyx+7IA==","y":"+Nb8x05vRmvKPIFofduYn2OlA60GchNP5ACrqQo1QjM="},"fingerprint_sha256":"148e3493937499b0630b4bcb1cbbf6b77d6be4e712b0c566dfe9676b5feb2e6a"}},"transport_protocol":"tcp","vulns":[{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:9.9:*:*:*:*:*:*:*","semver_expression":"==9.9"},{"found_value":"cpe:2.3:a:openbsd:openssh:9.9:*:*:*:*:*:*:*","semver_expression":">=6.8p1 && <=9.9p1"}],"id":"CVE-2025-26465","metrics":{"cvss_v31":{"components":{"attack_complexity":"high","attack_vector":"network","availability":"none","confidentiality":"high","integrity":"high","privileges_required":"none","scope":"unchanged","user_interaction":"required"},"score":6.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N"},"epss":{"percentile":0.942,"score":0.076}},"name":"CVE-2025-26465","risk_source":"cve","severity":"medium","source":"third_party","year":2025},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:9.9:*:*:*:*:*:*:*","semver_expression":"==9.9"},{"found_value":"cpe:2.3:a:openbsd:openssh:9.9:*:*:*:*:*:*:*","semver_expression":">=9.5p1 && <=9.9p1"}],"id":"CVE-2025-26466","metrics":{"cvss_v31":{"components":{"attack_complexity":"high","attack_vector":"network","availability":"high","confidentiality":"none","integrity":"none","privileges_required":"none","scope":"unchanged","user_interaction":"none"},"score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"},"epss":{"percentile":0.986,"score":0.398}},"name":"CVE-2025-26466","risk_source":"cve","severity":"medium","source":"third_party","year":2025},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:9.9:*:*:*:*:*:*:*","semver_expression":">=7.4 && <10.0"}],"id":"CVE-2025-32728","metrics":{"cvss_v31":{"components":{"attack_complexity":"low","attack_vector":"local","availability":"none","confidentiality":"none","integrity":"low","privileges_required":"none","scope":"changed","user_interaction":"none"},"score":4.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N"},"epss":{"percentile":0.085,"score":0.002}},"name":"CVE-2025-32728","risk_source":"cve","severity":"medium","source":"third_party","year":2025},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:9.9:*:*:*:*:*:*:*","semver_expression":"<10.3"}],"id":"CVE-2026-35385","metrics":{"cvss_v31":{"components":{"attack_complexity":"high","attack_vector":"network","availability":"high","confidentiality":"high","integrity":"high","privileges_required":"none","scope":"unchanged","user_interaction":"required"},"score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H"},"epss":{"percentile":0.445,"score":0.006}},"name":"CVE-2026-35385","risk_source":"cve","severity":"high","source":"third_party","year":2026},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:9.9:*:*:*:*:*:*:*","semver_expression":"<10.3"}],"id":"CVE-2026-35386","metrics":{"cvss_v31":{"components":{"attack_complexity":"high","attack_vector":"local","availability":"none","confidentiality":"low","integrity":"low","privileges_required":"low","scope":"unchanged","user_interaction":"none"},"score":3.6,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N"},"epss":{"percentile":0.243,"score":0.003}},"name":"CVE-2026-35386","risk_source":"cve","severity":"low","source":"third_party","year":2026},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:9.9:*:*:*:*:*:*:*","semver_expression":"<10.3"}],"id":"CVE-2026-35387","metrics":{"cvss_v31":{"components":{"attack_complexity":"high","attack_vector":"network","availability":"none","confidentiality":"none","integrity":"low","privileges_required":"low","scope":"unchanged","user_interaction":"none"},"score":3.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N"},"epss":{"percentile":0.146,"score":0.002}},"name":"CVE-2026-35387","risk_source":"cve","severity":"low","source":"third_party","year":2026},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:9.9:*:*:*:*:*:*:*","semver_expression":"<10.3"}],"id":"CVE-2026-35388","metrics":{"cvss_v31":{"components":{"attack_complexity":"high","attack_vector":"local","availability":"none","confidentiality":"none","integrity":"low","privileges_required":"none","scope":"unchanged","user_interaction":"required"},"score":2.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N"},"epss":{"percentile":0.029,"score":0.001}},"name":"CVE-2026-35388","risk_source":"cve","severity":"low","source":"third_party","year":2026},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:9.9:*:*:*:*:*:*:*","semver_expression":"<10.3"}],"id":"CVE-2026-35414","metrics":{"cvss_v31":{"components":{"attack_complexity":"high","attack_vector":"network","availability":"none","confidentiality":"low","integrity":"low","privileges_required":"low","scope":"unchanged","user_interaction":"none"},"score":4.2,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N"},"epss":{"percentile":0.072,"score":0.002}},"name":"CVE-2026-35414","risk_source":"cve","severity":"medium","source":"third_party","year":2026},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:9.9:*:*:*:*:*:*:*","semver_expression":"<10.4"}],"id":"CVE-2026-59995","metrics":{"cvss_v31":{"components":{"attack_complexity":"high","attack_vector":"network","availability":"low","confidentiality":"none","integrity":"low","privileges_required":"none","scope":"unchanged","user_interaction":"required"},"score":4.2,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L"},"epss":{"percentile":0.163,"score":0.002}},"name":"CVE-2026-59995","risk_source":"cve","severity":"medium","source":"third_party","year":2026},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:9.9:*:*:*:*:*:*:*","semver_expression":"<10.4"}],"id":"CVE-2026-59996","metrics":{"cvss_v31":{"components":{"attack_complexity":"high","attack_vector":"network","availability":"low","confidentiality":"none","integrity":"low","privileges_required":"none","scope":"unchanged","user_interaction":"required"},"score":4.2,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L"},"epss":{"percentile":0.163,"score":0.002}},"name":"CVE-2026-59996","risk_source":"cve","severity":"medium","source":"third_party","year":2026},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:9.9:*:*:*:*:*:*:*","semver_expression":"<10.4"}],"id":"CVE-2026-59997","metrics":{"cvss_v31":{"components":{"attack_complexity":"high","attack_vector":"network","availability":"none","confidentiality":"low","integrity":"low","privileges_required":"none","scope":"unchanged","user_interaction":"required"},"score":4.2,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N"},"epss":{"percentile":0.07,"score":0.002}},"name":"CVE-2026-59997","risk_source":"cve","severity":"medium","source":"third_party","year":2026},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:9.9:*:*:*:*:*:*:*","semver_expression":"<10.4"}],"id":"CVE-2026-59998","metrics":{"cvss_v31":{"components":{"attack_complexity":"high","attack_vector":"network","availability":"none","confidentiality":"low","integrity":"low","privileges_required":"none","scope":"unchanged","user_interaction":"none"},"score":4.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"},"epss":{"percentile":0.076,"score":0.002}},"name":"CVE-2026-59998","risk_source":"cve","severity":"medium","source":"third_party","year":2026},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:9.9:*:*:*:*:*:*:*","semver_expression":"<10.4"}],"id":"CVE-2026-59999","metrics":{"cvss_v31":{"components":{"attack_complexity":"high","attack_vector":"network","availability":"none","confidentiality":"none","integrity":"high","privileges_required":"none","scope":"unchanged","user_interaction":"none"},"score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N"},"epss":{"percentile":0.054,"score":0.002}},"name":"CVE-2026-59999","risk_source":"cve","severity":"medium","source":"third_party","year":2026},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:9.9:*:*:*:*:*:*:*","semver_expression":"<10.4"}],"id":"CVE-2026-60000","metrics":{"cvss_v31":{"components":{"attack_complexity":"high","attack_vector":"network","availability":"low","confidentiality":"none","integrity":"none","privileges_required":"none","scope":"unchanged","user_interaction":"none"},"score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"},"epss":{"percentile":0.369,"score":0.004}},"name":"CVE-2026-60000","risk_source":"cve","severity":"low","source":"third_party","year":2026},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:9.9:*:*:*:*:*:*:*","semver_expression":"<10.4"}],"id":"CVE-2026-60001","metrics":{"cvss_v31":{"components":{"attack_complexity":"low","attack_vector":"network","availability":"low","confidentiality":"none","integrity":"low","privileges_required":"none","scope":"unchanged","user_interaction":"none"},"score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"},"epss":{"percentile":0.213,"score":0.003}},"name":"CVE-2026-60001","risk_source":"cve","severity":"medium","source":"third_party","year":2026},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:9.9:*:*:*:*:*:*:*","semver_expression":"<10.4"}],"id":"CVE-2026-60002","metrics":{"cvss_v31":{"components":{"attack_complexity":"high","attack_vector":"network","availability":"low","confidentiality":"high","integrity":"high","privileges_required":"none","scope":"unchanged","user_interaction":"none"},"score":7.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L"},"epss":{"percentile":0.222,"score":0.003}},"name":"CVE-2026-60002","risk_source":"cve","severity":"high","source":"third_party","year":2026},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:9.9:*:*:*:*:*:*:*","semver_expression":"<10.5"}],"id":"CVE-2026-73281","metrics":{"cvss_v31":{"components":{"attack_complexity":"high","attack_vector":"network","availability":"none","confidentiality":"none","integrity":"low","privileges_required":"low","scope":"changed","user_interaction":"none"},"score":3.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N"},"epss":{"percentile":0.053,"score":0.002}},"name":"CVE-2026-73281","risk_source":"cve","severity":"low","source":"third_party","year":2026},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:9.9:*:*:*:*:*:*:*","semver_expression":"<10.5"}],"id":"CVE-2026-73282","metrics":{"cvss_v31":{"components":{"attack_complexity":"high","attack_vector":"network","availability":"none","confidentiality":"low","integrity":"low","privileges_required":"none","scope":"unchanged","user_interaction":"none"},"score":4.8,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N"},"epss":{"percentile":0.058,"score":0.002}},"name":"CVE-2026-73282","risk_source":"cve","severity":"medium","source":"third_party","year":2026},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:openbsd:openssh:9.9:*:*:*:*:*:*:*","semver_expression":"<10.5"}],"id":"CVE-2026-73283","metrics":{"cvss_v31":{"components":{"attack_complexity":"high","attack_vector":"local","availability":"none","confidentiality":"none","integrity":"low","privileges_required":"low","scope":"unchanged","user_interaction":"none"},"score":2.5,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N"},"epss":{"percentile":0.005,"score":0.001}},"name":"CVE-2026-73283","risk_source":"cve","severity":"low","source":"third_party","year":2026}]},{"cert":{"added_at":"2026-09-07T03:08:36Z","ever_seen_in_scan":true,"fingerprint_md5":"9564dca0a9450bf1532448f1cd101c3c","fingerprint_sha1":"2c759100780362c62eaec65f9355272d7dc5f16f","fingerprint_sha256":"dd7fc450edd33765b7e484a7ac4d6d3449e65a6031e1158fce7dd9820743291d","modified_at":"2026-09-07T03:08:36Z","names":["www.ocydpjp6pm4t6.net"],"parse_status":"success","parsed":{"extensions":{},"issuer":{"common_name":["www.rh52bxijqzz3owdru.com"]},"issuer_dn":"CN=www.rh52bxijqzz3owdru.com","ja4x":"7022c563de38_7022c563de38_e3b0c44298fc","serial_number":"14209954343118186666","serial_number_hex":"c533e630001428aa","signature":{"signature_algorithm":{"name":"SHA256-RSA","oid":"1.2.840.113549.1.1.11"},"value":"7ec7f740de424b48976f3d08f27f1d5b6d899f3f8ffc83b178776480fa82a3be5c3ff6e2d388c1eba2852ecbf3b2812c662debc49379734fd6e7aeb49ea6ea1fdcf70a936b01dce1ea1f0e08e7878682633453f14c4ed95d1e77ed364033b132d51a163d018e872569e35fc798117b99bb4b914d989f767eaa11e27347ff9db3"},"subject":{"common_name":["www.ocydpjp6pm4t6.net"]},"subject_dn":"CN=www.ocydpjp6pm4t6.net","subject_key_info":{"fingerprint_sha256":"75d7ef1389b96f776600730fae4deb2117a501cbd8802f6af280b7c9bed63085","key_algorithm":{"name":"RSA","oid":"1.2.840.113549.1.1.1"},"rsa":{"exponent":65537,"length":2048,"modulus":"91ccb515cb229208206fff106c617999f5af7027fe825217f9f814aae6cdfa39c32ca443c766905b8c12932663412b35514660a33a20706e5cdf2485a06e390b9e2521a4a5da211e81c4298d3a5078201fb8555d3d446e8610d9c3f8e26fab17914f77e80752e6f18b5881cf0f50bff070d5ce71c787ea2625321c78399e7ce81df3794acaf993dbd111b1e31bb0665f4adc3ea33300b3c4730b9b5343f06b8b8116d7b6311ebd63deb41a895c6affb3ba44af11ff35576d8df4feb1d891d2c1284039b9f343fedcc2cf2a28ee18b60d27c9ecd16e002670bfa2e59f1e6a2487c9e78cb7412e5aca0864363219fc16b71037f66748837a473cedd6de651ed41f"}},"validity_period":{"length_seconds":18403200,"not_after":"2026-11-24T23:59:59Z","not_before":"2026-04-26T00:00:00Z"},"version":3},"revocation":{"crl":{},"ocsp":{}},"spki_fingerprint_sha256":"3dba2c17aded0b13bf0920a76316e89c78f58de4a3b2b223e2eb75276d4755d2","spki_subject_fingerprint_sha256":"3dba2c17aded0b13bf0920a76316e89c78f58de4a3b2b223e2eb75276d4755d2","tbs_fingerprint_sha256":"1d094e544fc21f4eeda225c1b969d37d8643f4245e405c812c749802e59219de","tbs_no_ct_fingerprint_sha256":"baaf6035a22c75a6ac0ba2ec52c33b34cc6d1125190152a825a7f48720b986c3","validated_at":"2026-09-07T03:08:36Z","validation":{"apple":{},"chrome":{},"microsoft":{},"nss":{}},"zlint":{"errors_present":true,"failed_lints":["e_ext_authority_key_identifier_missing","e_ext_authority_key_identifier_no_key_identifier","e_ext_san_missing","e_sub_cert_aia_does_not_contain_ocsp_url","e_sub_cert_aia_missing","e_sub_cert_cert_policy_empty","e_sub_cert_certificate_policies_missing","e_sub_cert_eku_missing","e_subject_common_name_not_exactly_from_san","n_subject_common_name_included","w_ct_sct_policy_count_unsatisfied","w_ext_subject_key_identifier_missing_sub_cert","w_sub_cert_aia_does_not_contain_issuing_ca_url"],"notices_present":true,"timestamp":"2026-09-07T03:08:36Z","version":3,"warnings_present":true}},"ip":"185.100.87.136","ja4tscan":{"fingerprint":"65160_2-4-8-1-3_1460_7_1-2-4-8-16","scan_time":"2026-09-04T03:44:52Z"},"jarm":{"cipher_and_version_fingerprint":"2ad2ad16d2ad2ad00042d42d000000","fingerprint":"2ad2ad16d2ad2ad00042d42d000000332dc9cd7d90589195193c8bb05d84fa","ip":"185.100.87.136","is_success":true,"port":9001,"scan_time":"2026-09-07T04:04:38Z","tls_extensions_sha256":"332dc9cd7d90589195193c8bb05d84fa","transport_protocol":"tcp"},"port":9001,"protocol":"UNKNOWN","scan_time":"2026-09-07T03:08:30Z","tls":{"cipher_selected":"TLS_AES_256_GCM_SHA384","fingerprint_sha256":"dd7fc450edd33765b7e484a7ac4d6d3449e65a6031e1158fce7dd9820743291d","ja3s":"15af977ce25de452b96affa2addb1036","ja4s":"t130200_1302_a56c5b993250","version_selected":"tlsv1_3","versions":[{"ja3s":"15af977ce25de452b96affa2addb1036","ja4s":"t130200_1302_a56c5b993250","version":"tlsv1_3"},{"ja3s":"0debd3853f330c574b05e0b6d882dc27","ja4s":"t120200_c030_344b4dce5a52","version":"tlsv1_2"}]},"transport_protocol":"tcp"}],"whois":{"network":{"cidrs":["185.100.87.0/24"],"created":"2015-12-15T00:00:00Z","handle":"FLOKINET-ROMANIA","name":"FlokiNET Ltd","updated":"2026-06-15T00:00:00Z"},"organization":{"abuse_contacts":[{"email":"abuse@flokinet.is","handle":"AR74596-RIPE","name":"Abuse-C Role"}],"address":"Skólavörðustíg 12\\n101\\nReykjavík\\nICELAND","admin_contacts":[{"email":"noc@flokinet.is","handle":"FN3741-RIPE","name":"FlokiNET NOC"}],"handle":"ORG-FE72-RIPE","name":"FlokiNET ehf"}}}}},"services":{"result":{"next_page_token":"","ranges":[{"end_time":"2026-09-07T01:37:22.032143Z","ip":"185.100.87.136","port":"7288","protocol":"SSH","start_time":"2025-12-31T09:36:43.701571Z","transport_protocol":"TCP"},{"end_time":"2026-09-07T01:31:09.69269Z","ip":"185.100.87.136","port":"9001","protocol":"UNKNOWN","start_time":"2026-08-08T00:20:38.52518Z","transport_protocol":"TCP"},{"end_time":"2026-09-06T22:46:52.306682Z","ip":"185.100.87.136","port":"80","protocol":"HTTP","start_time":"2026-08-07T17:57:35.464663Z","transport_protocol":"TCP"},{"end_time":"2026-08-06T05:55:29.397231Z","ip":"185.100.87.136","port":"80","protocol":"HTTP","start_time":"2025-12-31T09:32:57.1497Z","transport_protocol":"TCP"},{"end_time":"2026-08-05T09:46:17.155811Z","ip":"185.100.87.136","port":"9001","protocol":"UNKNOWN","start_time":"2026-06-26T19:52:25.060425Z","transport_protocol":"TCP"},{"end_time":"2026-06-11T09:37:59.385172Z","ip":"185.100.87.136","port":"9001","protocol":"UNKNOWN","start_time":"2025-12-31T16:36:12.707731Z","transport_protocol":"TCP"},{"end_time":"2025-12-30T20:50:24.759082Z","ip":"185.100.87.136","port":"80","protocol":"HTTP","start_time":"2025-12-09T00:48:01.16086Z","transport_protocol":"TCP"},{"end_time":"2025-12-30T15:39:10.177935Z","ip":"185.100.87.136","port":"9001","protocol":"UNKNOWN","start_time":"2025-12-30T15:39:09.177935Z","transport_protocol":"TCP"},{"end_time":"2025-12-30T11:39:54.904189Z","ip":"185.100.87.136","port":"9001","protocol":"UNKNOWN","start_time":"2025-12-15T18:40:02.751495Z","transport_protocol":"TCP"},{"end_time":"2025-12-30T08:43:36.01245Z","ip":"185.100.87.136","port":"7288","protocol":"SSH","start_time":"2025-12-09T10:37:50.563227Z","transport_protocol":"TCP"},{"end_time":"2025-12-15T14:41:57.240706Z","ip":"185.100.87.136","port":"9001","protocol":"UNKNOWN","start_time":"2025-12-09T08:37:05.924993Z","transport_protocol":"TCP"},{"end_time":"2025-12-08T15:45:58.627135Z","ip":"185.100.87.136","port":"80","protocol":"HTTP","start_time":"2025-11-16T14:01:55.180009Z","transport_protocol":"TCP"},{"end_time":"2025-12-08T09:35:22.076607Z","ip":"185.100.87.136","port":"7288","protocol":"SSH","start_time":"2025-11-16T09:08:07.828315Z","transport_protocol":"TCP"},{"end_time":"2025-12-08T08:22:42.591586Z","ip":"185.100.87.136","port":"9001","protocol":"UNKNOWN","start_time":"2025-11-16T19:32:51.344364Z","transport_protocol":"TCP"},{"end_time":"2025-11-15T17:48:05.866132Z","ip":"185.100.87.136","port":"9001","protocol":"UNKNOWN","start_time":"2025-10-25T04:03:10.427389Z","transport_protocol":"TCP"},{"end_time":"2025-11-15T10:47:18.073154Z","ip":"185.100.87.136","port":"80","protocol":"HTTP","start_time":"2025-10-25T00:41:32.460808Z","transport_protocol":"TCP"},{"end_time":"2025-11-15T08:03:47.411418Z","ip":"185.100.87.136","port":"7288","protocol":"SSH","start_time":"2025-10-25T23:38:41.947418Z","transport_protocol":"TCP"},{"end_time":"2025-10-24T12:58:59.103129Z","ip":"185.100.87.136","port":"80","protocol":"HTTP","start_time":"2025-10-02T15:47:33.36523Z","transport_protocol":"TCP"},{"end_time":"2025-10-24T10:51:19.856866Z","ip":"185.100.87.136","port":"7288","protocol":"SSH","start_time":"2025-10-02T10:44:46.6807Z","transport_protocol":"TCP"},{"end_time":"2025-10-23T10:47:19.350366Z","ip":"185.100.87.136","port":"9001","protocol":"UNKNOWN","start_time":"2025-10-02T21:42:45.464936Z","transport_protocol":"TCP"},{"end_time":"2025-10-02T04:32:40.05703Z","ip":"185.100.87.136","port":"80","protocol":"HTTP","start_time":"2025-09-10T11:18:22.074061Z","transport_protocol":"TCP"},{"end_time":"2025-10-01T20:52:37.627564Z","ip":"185.100.87.136","port":"9001","protocol":"UNKNOWN","start_time":"2025-09-23T12:38:53.521099Z","transport_protocol":"TCP"},{"end_time":"2025-10-01T09:38:39.027858Z","ip":"185.100.87.136","port":"7288","protocol":"SSH","start_time":"2025-09-10T08:50:26.939053Z","transport_protocol":"TCP"},{"end_time":"2025-09-23T08:42:52.136165Z","ip":"185.100.87.136","port":"9001","protocol":"UNKNOWN","start_time":"2025-09-10T06:49:10.93404Z","transport_protocol":"TCP"},{"end_time":"2025-09-09T23:12:02.195513Z","ip":"185.100.87.136","port":"80","protocol":"HTTP","start_time":"2025-08-19T04:47:41.790999Z","transport_protocol":"TCP"},{"end_time":"2025-09-09T08:04:48.768015Z","ip":"185.100.87.136","port":"7288","protocol":"SSH","start_time":"2025-08-18T13:05:39.244997Z","transport_protocol":"TCP"},{"end_time":"2025-09-09T05:44:54.57181Z","ip":"185.100.87.136","port":"9001","protocol":"UNKNOWN","start_time":"2025-08-19T09:40:09.305937Z","transport_protocol":"TCP"}]}}} +{"ip":"144.172.108.79","asn":"AS14956","name":"ROUTERHOSTING","honeylabs_events":24,"host":{"result":{"extensions":{},"resource":{"autonomous_system":{"asn":14956,"bgp_prefix":"144.172.108.0/24","country_code":"US","description":"ROUTERHOSTING - RouterHosting LLC","name":"ROUTERHOSTING - RouterHosting LLC"},"dns":{"forward_dns":{"egress.akunpy.com":{"name":"egress.akunpy.com","record_type":"a","resolve_time":"2026-09-06T21:07:52Z"}},"names":["egress.akunpy.com"],"reverse_dns":{"names":["79.108.172.144.static.cloudzy.com"],"resolve_time":"2026-09-04T19:27:40Z"}},"ip":"144.172.108.79","labels":[{"confidence":0.75,"source":"censys","value":"BULLETPROOF"}],"location":{"city":"Ogden","continent":"North America","coordinates":{"latitude":41.223,"longitude":-111.97383},"country":"United States","country_code":"US","postal_code":"84401","province":"Utah","timezone":"America/Denver"},"network":[{"hosting":true,"source":"IPINFO"}],"operating_system":{"confidence":0.25,"cpe":"cpe:2.3:o:microsoft:windows:*:*:*:*:*:*:*:*","evidence":[{"data_path":"http.headers.server"}],"part":"o","product":"windows","source":"recog","vendor":"microsoft"},"privacy":[{"source":"IPINFO"}],"reputation":{"evidence":[{},{},{},{},{}],"model_version":"2.0.0","score":0.472},"service_count":4,"services":[{"banner":"HTTP/1.1 404 Not Found\r\nContent-Type: text/html; charset=us-ascii\r\nServer: Microsoft-HTTPAPI/2.0\r\nDate: \r\nConnection: close\r\nContent-Length: 315\r\n","banner_hash_sha256":"d7de42c1e8c09cf951e3ad6248fda3ab48a60ca3eac8b25effd4b3067df8f362","endpoints":[{"banner":"HTTP/1.1 404 Not Found\r\nContent-Type: text/html; charset=us-ascii\r\nServer: Microsoft-HTTPAPI/2.0\r\nDate: \r\nConnection: close\r\nContent-Length: 315\r\n","banner_hash_sha256":"d7de42c1e8c09cf951e3ad6248fda3ab48a60ca3eac8b25effd4b3067df8f362","endpoint_type":"HTTP","hostname":"144.172.108.79","http":{"body":"\r\nNot Found\r\n\r\n

Not Found

\r\n

HTTP Error 404. The requested resource is not found.

\r\n\r\n","body_hash_sha1":"a66898b36c94c53766e66c1a7aaeb149447ec083","body_hash_sha256":"ce7127c38e30e92a021ed2bd09287713c6a923db9ffdb43f126e8965d777fbf0","body_hash_tlsh":"8be07d6d9856aac542a0f4bc75d193b48115038fd4e547d90051b21714891bcc1f0dcf","body_size":315,"headers":{"Connection":{"headers":["close"]},"Content-Length":{"headers":["315"]},"Content-Type":{"headers":["text/html; charset=us-ascii"]},"Date":{"headers":[""]},"Server":{"headers":["Microsoft-HTTPAPI/2.0"]}},"html_tags":["Not Found",""],"html_title":"Not Found","protocol":"HTTP/1.1","status_code":404,"status_reason":"Not Found","supported_versions":["HTTP/1.1"],"uri":"http://144.172.108.79/"},"ip":"144.172.108.79","path":"/","port":80,"scan_time":"2026-09-07T09:44:08Z","transport_protocol":"tcp"}],"ip":"144.172.108.79","ja4tscan":{"fingerprint":"8192_2-1-3-4-8_1460_8_3-6","scan_time":"2026-09-04T16:34:40Z"},"operating_systems":[{"confidence":0.25,"cpe":"cpe:2.3:o:microsoft:windows:*:*:*:*:*:*:*:*","evidence":[{"data_path":"http.headers.server"}],"part":"o","product":"windows","source":"recog","vendor":"microsoft"}],"port":80,"protocol":"HTTP","scan_time":"2026-09-07T09:44:08Z","software":[{"confidence":0.25,"cpe":"cpe:2.3:a:microsoft:http_api:2.0:*:*:*:*:*:*:*","evidence":[{"data_path":"http.headers.server"}],"part":"a","product":"http_api","source":"recog","vendor":"microsoft","version":"2.0"}],"transport_protocol":"tcp"},{"exposures":[{"confidence":1,"evidence":[{"data_path":"protocol","found_value":"MSSQL","literal_match":"MSSQL"}],"id":"CENSYS-2022-1046","metrics":{},"name":"Exposed MSSQL Service","risk_source":"censys","severity":"high","source":"censys","year":2022}],"ip":"144.172.108.79","ja4tscan":{"fingerprint":"8192_2-1-3-4-8_1460_8_3-6","scan_time":"2026-09-05T00:06:15Z"},"labels":[{"confidence":1,"evidence":[{"data_path":"protocol","found_value":"MSSQL","literal_match":"MSSQL"}],"source":"censys","value":"DATABASE"}],"mssql":{"encrypt_mode":"ENCRYPT_ON","prelogin_options":{"encrypt_mode":"ENCRYPT_ON","mars":false,"server_version":{"build_number":1600,"major":10}},"version":"10.0.1600"},"port":1433,"protocol":"MSSQL","scan_time":"2026-09-06T13:40:15Z","software":[{"confidence":1,"evidence":[{"data_path":"protocol","found_value":"MSSQL","literal_match":"MSSQL"}],"part":"a","source":"censys","type":["DATABASE"]},{"confidence":0.75,"cpe":"cpe:2.3:a:microsoft:sql_server:10.0.1600:*:*:*:*:*:*:*","evidence":[{"data_path":"mssql.version","found_value":"10.0.1600"}],"part":"a","product":"sql_server","source":"censys","vendor":"microsoft","version":"10.0.1600"}],"transport_protocol":"tcp","vulns":[{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:microsoft:sql_server:10.0.1600:*:*:*:*:*:*:*","semver_expression":">=10.0.0 && <10.0.6814.4"},{"found_value":"cpe:2.3:a:microsoft:sql_server:10.0.1600:*:*:*:*:*:*:*","semver_expression":">=10.0.0 && <10.50.6785.2"}],"id":"CVE-2023-21528","metrics":{"cvss_v31":{"components":{"attack_complexity":"low","attack_vector":"local","availability":"high","confidentiality":"high","integrity":"high","privileges_required":"low","scope":"unchanged","user_interaction":"none"},"score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"epss":{"percentile":0.325,"score":0.004}},"name":"CVE-2023-21528","risk_source":"cve","severity":"high","source":"third_party","year":2023},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:microsoft:sql_server:10.0.1600:*:*:*:*:*:*:*","semver_expression":">=10.0.0 && <10.0.6814.4"},{"found_value":"cpe:2.3:a:microsoft:sql_server:10.0.1600:*:*:*:*:*:*:*","semver_expression":">=10.0.0 && <10.50.6785.2"}],"id":"CVE-2023-21718","metrics":{"cvss_v31":{"components":{"attack_complexity":"low","attack_vector":"local","availability":"high","confidentiality":"high","integrity":"high","privileges_required":"none","scope":"unchanged","user_interaction":"required"},"score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},"epss":{"percentile":0.522,"score":0.007}},"name":"CVE-2023-21718","risk_source":"cve","severity":"high","source":"third_party","year":2023},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:microsoft:sql_server:10.0.1600:*:*:*:*:*:*:*","semver_expression":">=10.0.0 && <10.0.6814.4"},{"found_value":"cpe:2.3:a:microsoft:sql_server:10.0.1600:*:*:*:*:*:*:*","semver_expression":">=10.0.0 && <10.50.6785.2"}],"id":"CVE-2023-23384","metrics":{"cvss_v31":{"components":{"attack_complexity":"low","attack_vector":"network","availability":"low","confidentiality":"low","integrity":"low","privileges_required":"none","scope":"unchanged","user_interaction":"none"},"score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"},"epss":{"percentile":0.565,"score":0.009}},"name":"CVE-2023-23384","risk_source":"cve","severity":"high","source":"third_party","year":2023},{"confidence":0.25,"evidence":[{"found_value":"cpe:2.3:a:microsoft:sql_server:10.0.1600:*:*:*:*:*:*:*","semver_expression":"<16.0.4100.1"}],"id":"CVE-2024-0056","metrics":{"cvss_v31":{"components":{"attack_complexity":"high","attack_vector":"network","availability":"none","confidentiality":"high","integrity":"high","privileges_required":"none","scope":"changed","user_interaction":"none"},"score":8.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N"},"epss":{"percentile":0.653,"score":0.012}},"name":"CVE-2024-0056","risk_source":"cve","severity":"high","source":"third_party","year":2024}]},{"cert":{"added_at":"2026-08-19T02:46:48Z","ever_seen_in_scan":true,"fingerprint_md5":"5732798bb452f4e6aa595c507075503e","fingerprint_sha1":"75d885ffeba6a5a9590779927a9c076d848fe2f7","fingerprint_sha256":"6647814dc6e63d48a1fc5798d664dc359c033e18ec6f87b3d77a0cceeaba34c2","modified_at":"2026-08-19T02:46:48Z","names":["windows-Utah-8g"],"parse_status":"success","parsed":{"extensions":{"extended_key_usage":{"server_auth":true},"key_usage":{"data_encipherment":true,"key_encipherment":true,"value":12}},"issuer":{"common_name":["windows-Utah-8g"]},"issuer_dn":"CN=windows-Utah-8g","ja4x":"7022c563de38_7022c563de38_e73b053161df","serial_number":"43549124598608788025244499971269866447","serial_number_hex":"20c3419da39957be4052d4479c6633cf","signature":{"self_signed":true,"signature_algorithm":{"name":"SHA1-RSA","oid":"1.2.840.113549.1.1.5"},"valid":true,"value":"2fc95115b2bdbcb629f432fcbc9a90adde61661be1e0c10c6b04bc8ed06a286a0a655319c3d899e2050aea8d0ec6157e36835ace0d0d8a25da0c26a03cd0e8b4bf493604014f77ba772bc49b413f98f52809af0170671822d9b1dd3b161ee3a3672f045b7cf159302fda9757aae0cfaa1cda62374b8e780700c6820b007a506d9e5549f7e79641677eba475f520d66e2e27b5195a001d1e4528df1dc7a39bcb559948bb08f7d7aaba8ff90b8c5b99674d86b4ebb6b90d6bb3928b20a7c1d4ebce54437abee52687b04d75591933d03ed501b8bdec2bb5c853c4ec08e83face75630fec30df582653f335014acd0640bbae578629e08b372126e29b5838653086"},"subject":{"common_name":["windows-Utah-8g"]},"subject_dn":"CN=windows-Utah-8g","subject_key_info":{"fingerprint_sha256":"ab44108ea092a469fa1f78fce4e9c12628dd53d11c8cef447826693d6b4f83ff","key_algorithm":{"name":"RSA","oid":"1.2.840.113549.1.1.1"},"rsa":{"exponent":65537,"length":2048,"modulus":"b2ef1557b59a53feb8035c8e844b03ec48775c8f41da72a282bc5282cbb95c6fc1e9dbea4872d1061f11d9efbe4a25985c826a4f024e7628f05f0372e471805dbef1e3baa82c86f47f85866bb303e3e7e9c5ae7e6f66976f6e4e466c1f826cf4b30505e62f500663393b6660e42eb9874a4df632dc90d686cadf6a2c56e8dbf2338c6806758a06446309f101dfb548ca69fa2a0ecf5431f2fca12db1456177c94c4542c69cfc4368ef1a3b832eb4954e341570dbd8f2e0f8c15d41bea1b809cfcb4e3b3dc988cbda19928bc07840bbca76405e8ffcc57a7a18d35bcffd055415cea5d493dc25903cae4bbb3830e780249fa4eff984726fbefcfeb23210805287"}},"validity_period":{"length_seconds":15811201,"not_after":"2027-02-15T06:21:54Z","not_before":"2026-08-16T06:21:54Z"},"version":3},"revocation":{"crl":{},"ocsp":{}},"spki_fingerprint_sha256":"4787b44148c732fb38910f312ca04bf119f24ec52a1acad22282e2937b8775e9","spki_subject_fingerprint_sha256":"4787b44148c732fb38910f312ca04bf119f24ec52a1acad22282e2937b8775e9","tbs_fingerprint_sha256":"d2abc76a417ce90f29bdc1bcb22e279bacf400cfaa7ad18cd10c4b082cc67b38","tbs_no_ct_fingerprint_sha256":"d2abc76a417ce90f29bdc1bcb22e279bacf400cfaa7ad18cd10c4b082cc67b38","validated_at":"2026-09-06T19:43:54Z","validation":{"apple":{},"chrome":{},"microsoft":{},"nss":{}},"zlint":{"errors_present":true,"failed_lints":["e_ext_san_missing","e_sub_cert_aia_does_not_contain_ocsp_url","e_sub_cert_aia_missing","e_sub_cert_cert_policy_empty","e_sub_cert_certificate_policies_missing","e_sub_cert_or_sub_ca_using_sha1","e_subject_common_name_not_exactly_from_san","n_subject_common_name_included","w_ext_key_usage_not_critical","w_ext_subject_key_identifier_missing_sub_cert","w_sub_cert_sha1_expiration_too_long"],"notices_present":true,"timestamp":"2026-08-19T02:46:48Z","version":3,"warnings_present":true}},"exposures":[{"confidence":1,"evidence":[{"data_path":"protocol","found_value":"RDP","literal_match":"RDP"}],"id":"CENSYS-2022-1054","metrics":{},"name":"Exposed RDP Service","risk_source":"censys","severity":"high","source":"censys","year":2022}],"ip":"144.172.108.79","ja4tscan":{"fingerprint":"8192_2-1-3-4-8_1460_8_3-6","scan_time":"2026-09-05T00:42:21Z"},"jarm":{"cipher_and_version_fingerprint":"00006b00006b06b06b06b06b06b06b","fingerprint":"00006b00006b06b06b06b06b06b06be3b0c44298fc1c149afbf4c8996fb924","ip":"144.172.108.79","is_success":true,"port":3389,"scan_time":"2026-09-02T04:17:45Z","tls_extensions_sha256":"e3b0c44298fc1c149afbf4c8996fb924","transport_protocol":"tcp"},"labels":[{"confidence":1,"evidence":[{"data_path":"protocol","found_value":"RDP","literal_match":"RDP"}],"source":"censys","value":"REMOTE_ACCESS"}],"misconfigs":[{"confidence":0.5,"evidence":[{"data_path":"service.tls.cipher_selected","found_value":"TLS_RSA_WITH_AES_128_CBC_SHA","literal_match":"TLS_RSA_WITH_AES_128_CBC_SHA"}],"id":"CENSYS-2026-1193","metrics":{},"name":"Weak TLS Cipher Selected","risk_source":"censys","severity":"medium","source":"censys","year":2026},{"confidence":1,"evidence":[{"data_path":"cert.parsed.signature.self_signed","found_value":"true"}],"id":"CENSYS-2026-1196","metrics":{},"name":"Self-Signed Certificate","risk_source":"censys","severity":"low","source":"censys","year":2026}],"operating_systems":[{"confidence":0.25,"cpe":"cpe:2.3:o:microsoft:windows:*:*:*:*:*:*:*:*","evidence":[{"data_path":"cert.parsed.subject_dn"}],"part":"o","product":"windows","source":"recog","vendor":"microsoft"}],"port":3389,"protocol":"RDP","rdp":{"certificate_info":{},"connect_response":{"domain_parameters":{"domain_protocol_version":2,"max_channel_ids":34,"max_mcspdu_size":65528,"max_provider_height":1,"max_user_id_channels":3,"num_priorities":1}},"protocol_flags":{"extended_client_data_supported":true},"selected_security_protocol":{"raw_value":1,"standard_rdp":true,"tls":true},"version":{"major":5,"raw":"00000000"},"x224_cc_pdu_dstref":51966,"x224_cc_pdu_srcref":13330},"scan_time":"2026-09-06T19:35:57Z","screenshots":[{"extracted_text":"","handle":"7fedb6bef0e04b93b649e8301ac6f091","phash":"0000000000000000"}],"software":[{"confidence":1,"evidence":[{"data_path":"protocol","found_value":"RDP","literal_match":"RDP"}],"part":"a","source":"censys","type":["REMOTE_ACCESS"]}],"tls":{"cipher_selected":"TLS_RSA_WITH_AES_128_CBC_SHA","fingerprint_sha256":"6647814dc6e63d48a1fc5798d664dc359c033e18ec6f87b3d77a0cceeaba34c2","ja3s":"18e962e106761869a61045bed0e81c2c","ja4s":"t100000_002f_e3b0c44298fc","version_selected":"tlsv1_0","versions":[{"ja3s":"18e962e106761869a61045bed0e81c2c","ja4s":"t100000_002f_e3b0c44298fc","version":"tlsv1_0"}]},"transport_protocol":"tcp"},{"banner":"HTTP/1.1 404 Not Found\r\nContent-Type: text/html; charset=us-ascii\r\nServer: Microsoft-HTTPAPI/2.0\r\nDate: \r\nConnection: close\r\nContent-Length: 315\r\n","banner_hash_sha256":"d7de42c1e8c09cf951e3ad6248fda3ab48a60ca3eac8b25effd4b3067df8f362","endpoints":[{"banner":"HTTP/1.1 404 Not Found\r\nContent-Type: text/html; charset=us-ascii\r\nServer: Microsoft-HTTPAPI/2.0\r\nDate: \r\nConnection: close\r\nContent-Length: 315\r\n","banner_hash_sha256":"d7de42c1e8c09cf951e3ad6248fda3ab48a60ca3eac8b25effd4b3067df8f362","endpoint_type":"HTTP","hostname":"144.172.108.79","http":{"body":"\r\nNot Found\r\n\r\n

Not Found

\r\n

HTTP Error 404. The requested resource is not found.

\r\n\r\n","body_hash_sha1":"a66898b36c94c53766e66c1a7aaeb149447ec083","body_hash_sha256":"ce7127c38e30e92a021ed2bd09287713c6a923db9ffdb43f126e8965d777fbf0","body_hash_tlsh":"8be07d6d9856aac542a0f4bc75d193b48115038fd4e547d90051b21714891bcc1f0dcf","body_size":315,"headers":{"Connection":{"headers":["close"]},"Content-Length":{"headers":["315"]},"Content-Type":{"headers":["text/html; charset=us-ascii"]},"Date":{"headers":[""]},"Server":{"headers":["Microsoft-HTTPAPI/2.0"]}},"html_tags":["Not Found",""],"html_title":"Not Found","protocol":"HTTP/1.1","status_code":404,"status_reason":"Not Found","supported_versions":["HTTP/1.1"],"uri":"http://144.172.108.79:47001/"},"ip":"144.172.108.79","path":"/","port":47001,"scan_time":"2026-09-07T06:49:24Z","transport_protocol":"tcp"}],"ip":"144.172.108.79","ja4tscan":{"fingerprint":"8192_2-1-3-4-8_1460_8_3-6","scan_time":"2026-09-04T16:16:59Z"},"operating_systems":[{"confidence":0.25,"cpe":"cpe:2.3:o:microsoft:windows:*:*:*:*:*:*:*:*","evidence":[{"data_path":"http.headers.server"}],"part":"o","product":"windows","source":"recog","vendor":"microsoft"}],"port":47001,"protocol":"HTTP","scan_time":"2026-09-07T06:49:24Z","software":[{"confidence":0.25,"cpe":"cpe:2.3:a:microsoft:http_api:2.0:*:*:*:*:*:*:*","evidence":[{"data_path":"http.headers.server"}],"part":"a","product":"http_api","source":"recog","vendor":"microsoft","version":"2.0"}],"transport_protocol":"tcp"}],"whois":{"network":{"allocation_type":"REALLOCATION","cidrs":["144.172.108.0/24"],"created":"2025-05-17T00:00:00Z","handle":"ROUTERHOSTING","name":"RouterHosting LLC","updated":"2025-05-17T00:00:00Z"},"organization":{"abuse_contacts":[{"email":"abuse-reports@cloudzy.com","handle":"ABUSE8459-ARIN","name":"abuse"}],"admin_contacts":[{"email":"abuse-reports@cloudzy.com","handle":"ABUSE8459-ARIN","name":"abuse"}],"city":"Sheridan","country":"US","handle":"RL-896","name":"RouterHosting LLC","postal_code":"82801","state":"WY","street":"1309 Coffeen Avenue STE 1200\\nSheridan, WY 82801","tech_contacts":[{"email":"abuse-reports@cloudzy.com","handle":"ABUSE8459-ARIN","name":"abuse"}]}}}}},"services":{"result":{"next_page_token":"","ranges":[{"end_time":"2026-09-06T19:35:58.727024Z","ip":"144.172.108.79","port":"3389","protocol":"RDP","start_time":"2026-09-02T03:58:15.580519Z","transport_protocol":"TCP"},{"end_time":"2026-09-06T15:01:31.973243Z","ip":"144.172.108.79","port":"47001","protocol":"HTTP","start_time":"2026-08-18T16:54:58.484047Z","transport_protocol":"TCP"},{"end_time":"2026-09-06T13:40:16.101933Z","ip":"144.172.108.79","port":"1433","protocol":"MSSQL","start_time":"2026-08-18T20:24:47.368396Z","transport_protocol":"TCP"},{"end_time":"2026-09-06T03:59:27.610106Z","ip":"144.172.108.79","port":"80","protocol":"HTTP","start_time":"2026-08-18T14:49:20.893613Z","transport_protocol":"TCP"},{"end_time":"2026-09-02T00:51:02.802488Z","ip":"144.172.108.79","port":"3389","protocol":"UNKNOWN","start_time":"2026-09-02T00:51:01.802488Z","transport_protocol":"TCP"},{"end_time":"2026-09-01T03:28:18.151299Z","ip":"144.172.108.79","port":"3389","protocol":"RDP","start_time":"2026-08-26T10:49:11.488469Z","transport_protocol":"TCP"},{"end_time":"2026-08-26T03:43:19.627126Z","ip":"144.172.108.79","port":"3389","protocol":"UNKNOWN","start_time":"2026-08-25T03:35:16.807295Z","transport_protocol":"TCP"},{"end_time":"2026-08-24T04:43:13.034598Z","ip":"144.172.108.79","port":"3389","protocol":"RDP","start_time":"2026-08-24T00:43:01.327804Z","transport_protocol":"TCP"},{"end_time":"2026-08-23T00:29:26.379935Z","ip":"144.172.108.79","port":"3389","protocol":"UNKNOWN","start_time":"2026-08-22T10:20:03.859227Z","transport_protocol":"TCP"},{"end_time":"2026-08-22T07:33:52.904817Z","ip":"144.172.108.79","port":"3389","protocol":"RDP","start_time":"2026-08-22T07:33:51.904817Z","transport_protocol":"TCP"},{"end_time":"2026-08-22T04:25:21.993702Z","ip":"144.172.108.79","port":"3389","protocol":"UNKNOWN","start_time":"2026-08-22T04:25:20.993702Z","transport_protocol":"TCP"},{"end_time":"2026-08-21T06:56:55.626294Z","ip":"144.172.108.79","port":"3389","protocol":"RDP","start_time":"2026-08-21T06:56:54.626294Z","transport_protocol":"TCP"},{"end_time":"2026-08-20T05:56:02.040133Z","ip":"144.172.108.79","port":"3389","protocol":"UNKNOWN","start_time":"2026-08-20T05:56:01.040133Z","transport_protocol":"TCP"},{"end_time":"2026-08-20T03:50:59.753086Z","ip":"144.172.108.79","port":"3389","protocol":"RDP","start_time":"2026-08-19T02:46:44.339408Z","transport_protocol":"TCP"},{"end_time":"2026-08-17T18:58:33.178992Z","ip":"144.172.108.79","port":"445","protocol":"SMB","start_time":"2026-08-17T18:58:32.178992Z","transport_protocol":"TCP"},{"end_time":"2026-08-10T03:33:49.320735Z","ip":"144.172.108.79","port":"22","protocol":"SSH","start_time":"2026-07-09T13:37:39.936831Z","transport_protocol":"TCP"},{"end_time":"2026-08-10T00:50:15.071097Z","ip":"144.172.108.79","port":"443","protocol":"HTTP","start_time":"2026-07-10T13:19:55.857956Z","transport_protocol":"TCP"},{"end_time":"2026-08-09T08:57:32.081455Z","ip":"144.172.108.79","port":"80","protocol":"HTTP","start_time":"2026-07-09T23:12:14.061472Z","transport_protocol":"TCP"},{"end_time":"2026-06-11T12:46:36.514836Z","ip":"144.172.108.79","port":"22","protocol":"SSH","start_time":"2026-06-11T12:46:35.514836Z","transport_protocol":"TCP"},{"end_time":"2026-06-10T22:58:13.238364Z","ip":"144.172.108.79","port":"22","protocol":"SSH","start_time":"2026-06-06T07:49:03.109175Z","transport_protocol":"TCP"},{"end_time":"2026-06-04T20:02:36.5399Z","ip":"144.172.108.79","port":"22","protocol":"SSH","start_time":"2026-05-29T09:31:58.852695Z","transport_protocol":"TCP"},{"end_time":"2026-06-04T08:14:57.340482Z","ip":"144.172.108.79","port":"5000","protocol":"HTTP","start_time":"2026-06-04T08:14:56.340482Z","transport_protocol":"TCP"},{"end_time":"2026-05-27T21:25:13.844373Z","ip":"144.172.108.79","port":"22","protocol":"SSH","start_time":"2026-05-27T17:49:15.672097Z","transport_protocol":"TCP"},{"end_time":"2026-05-27T13:38:55.693696Z","ip":"144.172.108.79","port":"22","protocol":"UNKNOWN","start_time":"2026-05-27T13:38:01.53542Z","transport_protocol":"TCP"},{"end_time":"2026-05-27T13:36:14.181109Z","ip":"144.172.108.79","port":"22","protocol":"SSH","start_time":"2026-05-27T13:36:13.181109Z","transport_protocol":"TCP"},{"end_time":"2026-05-27T13:36:09.354487Z","ip":"144.172.108.79","port":"22","protocol":"UNKNOWN","start_time":"2026-05-26T13:07:01.003156Z","transport_protocol":"TCP"},{"end_time":"2026-05-26T03:07:56.95296Z","ip":"144.172.108.79","port":"22","protocol":"SSH","start_time":"2026-05-11T07:36:36.369406Z","transport_protocol":"TCP"},{"end_time":"2026-05-10T06:43:56.012367Z","ip":"144.172.108.79","port":"22","protocol":"UNKNOWN","start_time":"2026-05-10T06:43:55.012367Z","transport_protocol":"TCP"},{"end_time":"2026-05-09T10:32:23.687506Z","ip":"144.172.108.79","port":"22","protocol":"SSH","start_time":"2026-05-06T05:24:02.983289Z","transport_protocol":"TCP"},{"end_time":"2026-05-06T04:27:49.916565Z","ip":"144.172.108.79","port":"22","protocol":"UNKNOWN","start_time":"2026-05-06T04:27:48.916565Z","transport_protocol":"TCP"},{"end_time":"2026-05-05T18:33:09.789724Z","ip":"144.172.108.79","port":"22","protocol":"SSH","start_time":"2026-03-27T21:33:01.320022Z","transport_protocol":"TCP"},{"end_time":"2026-03-26T16:20:11.425027Z","ip":"144.172.108.79","port":"3389","protocol":"RDP","start_time":"2026-03-23T13:19:35.689748Z","transport_protocol":"TCP"},{"end_time":"2026-03-12T11:57:23.138713Z","ip":"144.172.108.79","port":"443","protocol":"HTTP","start_time":"2026-02-16T01:18:15.578913Z","transport_protocol":"TCP"},{"end_time":"2026-03-12T05:56:33.38736Z","ip":"144.172.108.79","port":"10050","protocol":"UNKNOWN","start_time":"2026-02-16T01:20:19.508345Z","transport_protocol":"TCP"},{"end_time":"2026-03-11T15:55:07.28716Z","ip":"144.172.108.79","port":"80","protocol":"HTTP","start_time":"2026-02-16T04:40:31.682759Z","transport_protocol":"TCP"},{"end_time":"2026-03-11T15:49:52.740486Z","ip":"144.172.108.79","port":"22","protocol":"SSH","start_time":"2026-02-13T11:49:09.770692Z","transport_protocol":"TCP"},{"end_time":"2026-02-05T00:32:10.712362Z","ip":"144.172.108.79","port":"22","protocol":"SSH","start_time":"2025-12-31T21:13:33.767753Z","transport_protocol":"TCP"},{"end_time":"2026-02-04T21:47:20.441163Z","ip":"144.172.108.79","port":"80","protocol":"HTTP","start_time":"2025-12-31T22:45:42.714961Z","transport_protocol":"TCP"},{"end_time":"2026-02-04T17:53:50.063568Z","ip":"144.172.108.79","port":"443","protocol":"HTTP","start_time":"2025-12-31T08:05:06.601742Z","transport_protocol":"TCP"},{"end_time":"2025-12-31T01:30:57.850745Z","ip":"144.172.108.79","port":"22","protocol":"SSH","start_time":"2025-12-09T07:31:00.720191Z","transport_protocol":"TCP"},{"end_time":"2025-12-30T23:01:06.466157Z","ip":"144.172.108.79","port":"443","protocol":"HTTP","start_time":"2025-12-09T00:54:22.276685Z","transport_protocol":"TCP"},{"end_time":"2025-12-30T21:52:25.383351Z","ip":"144.172.108.79","port":"80","protocol":"HTTP","start_time":"2025-12-08T20:44:22.852167Z","transport_protocol":"TCP"},{"end_time":"2025-12-08T06:31:15.873921Z","ip":"144.172.108.79","port":"22","protocol":"SSH","start_time":"2025-12-04T17:08:43.863221Z","transport_protocol":"TCP"},{"end_time":"2025-12-08T01:06:30.038478Z","ip":"144.172.108.79","port":"80","protocol":"HTTP","start_time":"2025-12-07T21:54:25.919436Z","transport_protocol":"TCP"},{"end_time":"2025-12-08T00:41:14.761906Z","ip":"144.172.108.79","port":"443","protocol":"HTTP","start_time":"2025-12-08T00:34:22.258486Z","transport_protocol":"TCP"},{"end_time":"2025-12-07T22:55:44.98817Z","ip":"144.172.108.79","port":"443","protocol":"HTTP","start_time":"2025-12-04T16:53:17.878809Z","transport_protocol":"TCP"},{"end_time":"2025-12-07T15:55:15.05588Z","ip":"144.172.108.79","port":"2096","protocol":"HTTP","start_time":"2025-12-04T06:30:06.452886Z","transport_protocol":"TCP"},{"end_time":"2025-11-27T13:35:11.155215Z","ip":"144.172.108.79","port":"3389","protocol":"RDP","start_time":"2025-11-16T21:18:06.173329Z","transport_protocol":"TCP"},{"end_time":"2025-11-15T22:34:30.4677Z","ip":"144.172.108.79","port":"3389","protocol":"RDP","start_time":"2025-11-02T23:19:20.810476Z","transport_protocol":"TCP"},{"end_time":"2025-11-02T10:09:15.290795Z","ip":"144.172.108.79","port":"3389","protocol":"UNKNOWN","start_time":"2025-11-02T10:09:14.290795Z","transport_protocol":"TCP"},{"end_time":"2025-11-01T09:53:52.687506Z","ip":"144.172.108.79","port":"3389","protocol":"RDP","start_time":"2025-10-25T04:50:20.119179Z","transport_protocol":"TCP"},{"end_time":"2025-10-24T10:48:32.696299Z","ip":"144.172.108.79","port":"3389","protocol":"RDP","start_time":"2025-10-02T21:23:20.011506Z","transport_protocol":"TCP"},{"end_time":"2025-10-02T07:53:41.489072Z","ip":"144.172.108.79","port":"3389","protocol":"RDP","start_time":"2025-09-10T02:38:22.812699Z","transport_protocol":"TCP"},{"end_time":"2025-09-09T02:20:10.297531Z","ip":"144.172.108.79","port":"3389","protocol":"RDP","start_time":"2025-09-05T22:58:01.034395Z","transport_protocol":"TCP"}]}}} +{"ip":"193.143.1.66","asn":"AS198953","name":"PROTON66","honeylabs_events":24,"host":{"err":"{\"result\":{\"extensions\":{},\"resource\":{\"autonomous_system\":{\"asn\":198953,\"bgp_prefix\":\"193.143.1.0/2"},"services":{"result":{"next_page_token":"35d55dcf2355a8ffc254daad:+VjfEuLhU+OspTvWWMJ4h1ViS0ucG/bcMl3+vti1D4Y+3Bc9dfk2T32Y1JjucMOULaSu300Ahq/ZQO90aZFpkAy6jMCvoDmwrMryzQPHgRtRYF3+L6aNc1FExW9yQZkA4CesENeVfDobWSuwDnhjIbdDJi2QuCW1vDm73saoRGw9UdWL6lsd0j07aZxlnxNRiR6KMPrXpcWmH4crZdV+qtj6sXnktMlXHSQVmzEiwVJFhjvVghjpP0yclM/c2frVigThtrNB2jwO8qCKnVdqb6YqGAAUrncd2KRySGTcHAAQT2fGBImmVe08Frj8JABRwG5zcyDli/gD4EG25sa0BT355Jv2HzepiQph/Ry8fXyIkbGrrMc+31j3eJEibvtdNyE7B+HU/nDZuhqigtZJ64f2ybVLGIOD8aRMTGIzs7g/6w4pOGTU6M960F9AuHsKCZVMIEx2ANCVD4GsZ7NztuTmnaFF3BbXWUJchEV3yWRNgoSjZAwMMaDmsvVPO8ae0r50lyOAPra3KF8P9A7rwGPOxezJcDrELYbPb1GgI4ipesJ0JVHLL/EZvOhquYMyS7IzNIWLFLBEFCRb68IcQUwe+2Q/fU0q6EJTUo9wXVHf6s4q1kEDmfQaEN1e2Vja+OPBzoQAQBqRlySfzDovBVZT6DWrpt6UI+BCK/SUEp9rg67LRh+/BY9o2tuF27lUk0EUvCKxs+gMMBZmbZayjnp0+pRRooNdf9Fw/Jz6HdoTKxTyuBXHXYL5BYEl0IlwJfVx+S2y","ranges":[{"end_time":"2026-09-07T01:35:43.612628Z","ip":"193.143.1.66","port":"139","protocol":"NETBIOS","start_time":"2026-09-04T17:07:04.768455Z","transport_protocol":"TCP"},{"end_time":"2026-09-07T01:34:37.658266Z","ip":"193.143.1.66","port":"5985","protocol":"WINRM","start_time":"2026-09-04T12:58:22.413892Z","transport_protocol":"TCP"},{"end_time":"2026-09-06T23:39:18.762254Z","ip":"193.143.1.66","port":"3389","protocol":"RDP","start_time":"2026-09-04T20:08:55.223952Z","transport_protocol":"TCP"},{"end_time":"2026-09-06T22:54:21.428656Z","ip":"193.143.1.66","port":"9090","protocol":"HTTP","start_time":"2026-09-04T09:39:20.661948Z","transport_protocol":"TCP"},{"end_time":"2026-09-06T20:38:30.102283Z","ip":"193.143.1.66","port":"137","protocol":"NETBIOS","start_time":"2026-09-03T18:19:49.37029Z","transport_protocol":"UDP"},{"end_time":"2026-09-06T13:57:24.709929Z","ip":"193.143.1.66","port":"135","protocol":"DCERPC","start_time":"2026-09-04T09:29:16.868419Z","transport_protocol":"TCP"},{"end_time":"2026-09-06T13:14:06.860998Z","ip":"193.143.1.66","port":"8050","protocol":"HTTP","start_time":"2026-08-26T09:09:43.908292Z","transport_protocol":"TCP"},{"end_time":"2026-09-06T01:02:27.570169Z","ip":"193.143.1.66","port":"47001","protocol":"HTTP","start_time":"2026-09-04T12:10:21.068874Z","transport_protocol":"TCP"},{"end_time":"2026-09-03T09:54:44.61244Z","ip":"193.143.1.66","port":"139","protocol":"NETBIOS","start_time":"2026-08-30T06:18:29.247996Z","transport_protocol":"TCP"},{"end_time":"2026-09-03T08:35:41.455302Z","ip":"193.143.1.66","port":"9090","protocol":"HTTP","start_time":"2026-08-18T21:29:43.809474Z","transport_protocol":"TCP"},{"end_time":"2026-09-03T08:35:28.036746Z","ip":"193.143.1.66","port":"9090","protocol":"UNKNOWN","start_time":"2026-09-03T08:35:27.036746Z","transport_protocol":"TCP"},{"end_time":"2026-09-03T06:03:28.138118Z","ip":"193.143.1.66","port":"5985","protocol":"WINRM","start_time":"2026-08-31T17:24:12.584999Z","transport_protocol":"TCP"},{"end_time":"2026-09-03T06:02:25.877937Z","ip":"193.143.1.66","port":"3389","protocol":"RDP","start_time":"2026-08-07T00:47:44.100933Z","transport_protocol":"TCP"},{"end_time":"2026-09-03T01:39:28.852479Z","ip":"193.143.1.66","port":"135","protocol":"DCERPC","start_time":"2026-08-08T05:49:58.401209Z","transport_protocol":"TCP"},{"end_time":"2026-09-02T22:07:41.979172Z","ip":"193.143.1.66","port":"47001","protocol":"HTTP","start_time":"2026-08-28T14:09:51.162359Z","transport_protocol":"TCP"},{"end_time":"2026-09-02T00:52:16.098712Z","ip":"193.143.1.66","port":"137","protocol":"NETBIOS","start_time":"2026-08-09T23:56:02.280172Z","transport_protocol":"UDP"},{"end_time":"2026-08-30T12:35:08.914766Z","ip":"193.143.1.66","port":"5985","protocol":"WINRM","start_time":"2026-08-30T12:35:07.914766Z","transport_protocol":"TCP"},{"end_time":"2026-08-29T16:41:47.97546Z","ip":"193.143.1.66","port":"139","protocol":"UNKNOWN","start_time":"2026-08-29T16:41:46.892237Z","transport_protocol":"TCP"},{"end_time":"2026-08-29T16:41:05.796153Z","ip":"193.143.1.66","port":"139","protocol":"UNKNOWN","start_time":"2026-08-29T16:41:04.796153Z","transport_protocol":"TCP"},{"end_time":"2026-08-29T16:41:02.922899Z","ip":"193.143.1.66","port":"139","protocol":"UNKNOWN","start_time":"2026-08-28T15:36:06.900731Z","transport_protocol":"TCP"},{"end_time":"2026-08-29T07:58:06.585542Z","ip":"193.143.1.66","port":"5985","protocol":"WINRM","start_time":"2026-08-27T22:15:56.325742Z","transport_protocol":"TCP"},{"end_time":"2026-08-28T15:35:43.787558Z","ip":"193.143.1.66","port":"139","protocol":"NETBIOS","start_time":"2026-08-25T09:42:36.238855Z","transport_protocol":"TCP"},{"end_time":"2026-08-27T11:49:26.197763Z","ip":"193.143.1.66","port":"47001","protocol":"HTTP","start_time":"2026-08-06T21:58:58.894719Z","transport_protocol":"TCP"},{"end_time":"2026-08-26T17:48:08.152599Z","ip":"193.143.1.66","port":"5985","protocol":"WINRM","start_time":"2026-08-09T03:11:34.174544Z","transport_protocol":"TCP"},{"end_time":"2026-08-25T22:50:47.654382Z","ip":"193.143.1.66","port":"8050","protocol":"HTTP","start_time":"2026-08-25T14:34:50.836785Z","transport_protocol":"TCP"},{"end_time":"2026-08-25T05:04:41.068833Z","ip":"193.143.1.66","port":"139","protocol":"UNKNOWN","start_time":"2026-08-25T05:04:40.068833Z","transport_protocol":"TCP"},{"end_time":"2026-08-24T06:11:20.401666Z","ip":"193.143.1.66","port":"139","protocol":"NETBIOS","start_time":"2026-08-22T03:59:38.056653Z","transport_protocol":"TCP"},{"end_time":"2026-08-24T04:51:06.013531Z","ip":"193.143.1.66","port":"8050","protocol":"HTTP","start_time":"2026-08-13T20:46:43.391901Z","transport_protocol":"TCP"},{"end_time":"2026-08-21T07:41:11.048836Z","ip":"193.143.1.66","port":"139","protocol":"UNKNOWN","start_time":"2026-08-21T07:41:08.066765Z","transport_protocol":"TCP"},{"end_time":"2026-08-21T07:38:39.199409Z","ip":"193.143.1.66","port":"139","protocol":"UNKNOWN","start_time":"2026-08-20T06:59:53.11178Z","transport_protocol":"TCP"},{"end_time":"2026-08-19T22:36:58.940817Z","ip":"193.143.1.66","port":"139","protocol":"NETBIOS","start_time":"2026-08-09T06:16:11.064479Z","transport_protocol":"TCP"},{"end_time":"2026-08-19T19:20:22.500126Z","ip":"193.143.1.66","port":"9090","protocol":"UNKNOWN","start_time":"2026-08-03T14:22:48.413706Z","transport_protocol":"TCP"},{"end_time":"2026-08-16T04:05:57.916075Z","ip":"193.143.1.66","port":"9090","protocol":"HTTP","start_time":"2026-08-07T05:52:49.821608Z","transport_protocol":"TCP"},{"end_time":"2026-08-12T08:29:58.519067Z","ip":"193.143.1.66","port":"8050","protocol":"HTTP","start_time":"2026-08-08T00:55:39.69008Z","transport_protocol":"TCP"},{"end_time":"2026-08-03T14:22:59.475037Z","ip":"193.143.1.66","port":"9090","protocol":"HTTP","start_time":"2026-08-03T14:22:58.475037Z","transport_protocol":"TCP"},{"end_time":"2026-05-31T22:42:21.024176Z","ip":"193.143.1.66","port":"3389","protocol":"UNKNOWN","start_time":"2026-05-31T22:42:20.024176Z","transport_protocol":"TCP"},{"end_time":"2026-05-30T18:42:16.245613Z","ip":"193.143.1.66","port":"139","protocol":"UNKNOWN","start_time":"2026-05-30T18:42:15.245613Z","transport_protocol":"TCP"},{"end_time":"2026-05-30T10:43:44.936073Z","ip":"193.143.1.66","port":"139","protocol":"NETBIOS","start_time":"2026-05-30T10:43:43.936073Z","transport_protocol":"TCP"},{"end_time":"2026-05-29T18:34:02.748312Z","ip":"193.143.1.66","port":"47001","protocol":"UNKNOWN","start_time":"2026-05-28T17:42:56.17522Z","transport_protocol":"TCP"},{"end_time":"2026-05-29T09:47:02.779064Z","ip":"193.143.1.66","port":"139","protocol":"UNKNOWN","start_time":"2026-05-29T09:47:01.779064Z","transport_protocol":"TCP"},{"end_time":"2026-05-26T16:15:20.796192Z","ip":"193.143.1.66","port":"47001","protocol":"UNKNOWN","start_time":"2026-05-26T16:15:19.796192Z","transport_protocol":"TCP"},{"end_time":"2026-05-26T16:13:27.625759Z","ip":"193.143.1.66","port":"3389","protocol":"RDP","start_time":"2026-05-26T16:13:26.625759Z","transport_protocol":"TCP"},{"end_time":"2026-05-25T10:01:02.529001Z","ip":"193.143.1.66","port":"139","protocol":"NETBIOS","start_time":"2026-05-25T10:01:01.529001Z","transport_protocol":"TCP"},{"end_time":"2026-05-23T21:16:33.718151Z","ip":"193.143.1.66","port":"139","protocol":"NETBIOS","start_time":"2026-05-23T21:16:32.718151Z","transport_protocol":"TCP"},{"end_time":"2026-05-20T01:34:45.325764Z","ip":"193.143.1.66","port":"139","protocol":"UNKNOWN","start_time":"2026-05-18T08:13:12.573011Z","transport_protocol":"TCP"},{"end_time":"2026-05-15T21:39:20.616594Z","ip":"193.143.1.66","port":"3389","protocol":"RDP","start_time":"2026-05-15T21:39:19.616594Z","transport_protocol":"TCP"},{"end_time":"2026-05-11T22:33:01.672725Z","ip":"193.143.1.66","port":"80","protocol":"HTTP","start_time":"2026-05-11T22:33:00.672725Z","transport_protocol":"TCP"},{"end_time":"2026-05-11T02:34:01.973858Z","ip":"193.143.1.66","port":"8443","protocol":"HTTP","start_time":"2026-05-11T02:34:00.973858Z","transport_protocol":"TCP"},{"end_time":"2026-05-10T22:01:57.394612Z","ip":"193.143.1.66","port":"80","protocol":"UNKNOWN","start_time":"2026-05-10T22:01:56.394612Z","transport_protocol":"TCP"},{"end_time":"2026-05-10T01:45:14.159691Z","ip":"193.143.1.66","port":"8443","protocol":"UNKNOWN","start_time":"2026-05-10T01:45:13.159691Z","transport_protocol":"TCP"},{"end_time":"2026-05-09T16:42:44.276507Z","ip":"193.143.1.66","port":"80","protocol":"UNKNOWN","start_time":"2026-05-09T16:42:43.276507Z","transport_protocol":"TCP"},{"end_time":"2026-05-08T21:11:31.654974Z","ip":"193.143.1.66","port":"8443","protocol":"UNKNOWN","start_time":"2026-05-08T21:11:30.654974Z","transport_protocol":"TCP"},{"end_time":"2026-05-04T08:30:00.030608Z","ip":"193.143.1.66","port":"80","protocol":"HTTP","start_time":"2026-05-04T08:29:59.030608Z","transport_protocol":"TCP"},{"end_time":"2026-05-02T22:48:53.414442Z","ip":"193.143.1.66","port":"80","protocol":"HTTP","start_time":"2026-05-01T22:34:46.68277Z","transport_protocol":"TCP"},{"end_time":"2026-05-01T18:33:17.013725Z","ip":"193.143.1.66","port":"80","protocol":"HTTP","start_time":"2026-05-01T18:33:09.994957Z","transport_protocol":"TCP"},{"end_time":"2026-04-30T17:33:14.790325Z","ip":"193.143.1.66","port":"80","protocol":"UNKNOWN","start_time":"2026-04-30T17:33:11.249967Z","transport_protocol":"TCP"},{"end_time":"2026-04-29T16:59:19.448061Z","ip":"193.143.1.66","port":"80","protocol":"UNKNOWN","start_time":"2026-04-14T17:04:13.64869Z","transport_protocol":"TCP"},{"end_time":"2026-04-26T23:41:04.52868Z","ip":"193.143.1.66","port":"8443","protocol":"HTTP","start_time":"2026-04-26T23:41:03.52868Z","transport_protocol":"TCP"},{"end_time":"2026-04-26T09:32:02.043214Z","ip":"193.143.1.66","port":"135","protocol":"DCERPC","start_time":"2026-04-24T07:57:33.87038Z","transport_protocol":"TCP"},{"end_time":"2026-04-25T14:03:56.670139Z","ip":"193.143.1.66","port":"8443","protocol":"HTTP","start_time":"2026-04-24T13:44:03.187993Z","transport_protocol":"TCP"},{"end_time":"2026-04-24T22:49:11.748724Z","ip":"193.143.1.66","port":"80","protocol":"HTTP","start_time":"2026-04-24T22:49:10.748724Z","transport_protocol":"TCP"},{"end_time":"2026-04-23T14:00:31.788962Z","ip":"193.143.1.66","port":"80","protocol":"HTTP","start_time":"2026-04-21T07:41:23.847256Z","transport_protocol":"TCP"},{"end_time":"2026-04-23T02:31:23.752673Z","ip":"193.143.1.66","port":"135","protocol":"DCERPC","start_time":"2026-04-21T01:18:39.850522Z","transport_protocol":"TCP"},{"end_time":"2026-04-22T12:46:42.135144Z","ip":"193.143.1.66","port":"8443","protocol":"HTTP","start_time":"2026-04-21T12:02:11.359464Z","transport_protocol":"TCP"},{"end_time":"2026-04-20T02:53:44.933691Z","ip":"193.143.1.66","port":"80","protocol":"HTTP","start_time":"2026-04-18T00:52:42.034927Z","transport_protocol":"TCP"},{"end_time":"2026-04-19T10:58:48.150649Z","ip":"193.143.1.66","port":"8443","protocol":"HTTP","start_time":"2026-04-19T10:58:47.150649Z","transport_protocol":"TCP"},{"end_time":"2026-04-19T08:45:20.003859Z","ip":"193.143.1.66","port":"135","protocol":"DCERPC","start_time":"2026-04-19T08:45:19.003859Z","transport_protocol":"TCP"},{"end_time":"2026-04-18T05:51:23.390285Z","ip":"193.143.1.66","port":"8443","protocol":"HTTP","start_time":"2026-04-17T05:43:22.051071Z","transport_protocol":"TCP"},{"end_time":"2026-04-18T04:36:31.67985Z","ip":"193.143.1.66","port":"3389","protocol":"UNKNOWN","start_time":"2026-04-17T03:59:39.416911Z","transport_protocol":"TCP"},{"end_time":"2026-04-18T04:07:45.45165Z","ip":"193.143.1.66","port":"135","protocol":"DCERPC","start_time":"2026-04-17T02:20:28.795831Z","transport_protocol":"TCP"},{"end_time":"2026-04-16T19:34:02.13616Z","ip":"193.143.1.66","port":"3389","protocol":"RDP","start_time":"2026-04-16T19:32:55.328918Z","transport_protocol":"TCP"},{"end_time":"2026-04-16T17:54:42.775725Z","ip":"193.143.1.66","port":"80","protocol":"HTTP","start_time":"2026-04-15T00:24:50.352802Z","transport_protocol":"TCP"},{"end_time":"2026-04-16T01:03:16.643574Z","ip":"193.143.1.66","port":"8443","protocol":"HTTP","start_time":"2026-04-16T01:03:15.643574Z","transport_protocol":"TCP"},{"end_time":"2026-04-15T22:20:26.391495Z","ip":"193.143.1.66","port":"135","protocol":"DCERPC","start_time":"2026-04-15T22:20:25.391495Z","transport_protocol":"TCP"},{"end_time":"2026-04-15T18:37:15.079377Z","ip":"193.143.1.66","port":"3389","protocol":"UNKNOWN","start_time":"2026-04-15T18:37:14.079377Z","transport_protocol":"TCP"},{"end_time":"2026-04-14T20:41:16.185987Z","ip":"193.143.1.66","port":"8443","protocol":"HTTP","start_time":"2026-04-14T20:41:15.185987Z","transport_protocol":"TCP"},{"end_time":"2026-04-14T09:41:05.341217Z","ip":"193.143.1.66","port":"3389","protocol":"UNKNOWN","start_time":"2026-04-14T09:41:04.341217Z","transport_protocol":"TCP"},{"end_time":"2026-04-13T21:28:16.20156Z","ip":"193.143.1.66","port":"135","protocol":"DCERPC","start_time":"2026-04-13T21:28:15.20156Z","transport_protocol":"TCP"},{"end_time":"2026-04-13T10:52:50.21427Z","ip":"193.143.1.66","port":"80","protocol":"HTTP","start_time":"2026-04-12T10:14:46.851715Z","transport_protocol":"TCP"},{"end_time":"2026-04-13T10:16:12.90948Z","ip":"193.143.1.66","port":"3389","protocol":"RDP","start_time":"2026-04-13T10:16:11.90948Z","transport_protocol":"TCP"},{"end_time":"2026-04-13T07:51:20.436738Z","ip":"193.143.1.66","port":"8443","protocol":"HTTP","start_time":"2026-04-13T07:51:19.436738Z","transport_protocol":"TCP"},{"end_time":"2026-04-13T01:38:26.659442Z","ip":"193.143.1.66","port":"8443","protocol":"UNKNOWN","start_time":"2026-04-13T01:38:25.659442Z","transport_protocol":"TCP"},{"end_time":"2026-04-12T05:23:56.543152Z","ip":"193.143.1.66","port":"135","protocol":"DCERPC","start_time":"2026-04-12T05:23:55.543152Z","transport_protocol":"TCP"},{"end_time":"2026-04-12T01:21:21.24045Z","ip":"193.143.1.66","port":"8443","protocol":"UNKNOWN","start_time":"2026-04-12T01:21:20.24045Z","transport_protocol":"TCP"},{"end_time":"2026-04-11T23:12:09.270239Z","ip":"193.143.1.66","port":"8443","protocol":"HTTP","start_time":"2026-04-11T23:12:08.270239Z","transport_protocol":"TCP"},{"end_time":"2026-04-11T21:42:24.606813Z","ip":"193.143.1.66","port":"3389","protocol":"RDP","start_time":"2026-04-11T21:42:23.606813Z","transport_protocol":"TCP"},{"end_time":"2026-04-10T16:55:59.3963Z","ip":"193.143.1.66","port":"3389","protocol":"RDP","start_time":"2026-04-10T16:55:58.3963Z","transport_protocol":"TCP"},{"end_time":"2026-04-10T05:51:18.963916Z","ip":"193.143.1.66","port":"8443","protocol":"HTTP","start_time":"2026-04-10T05:51:17.963916Z","transport_protocol":"TCP"},{"end_time":"2026-04-10T04:18:30.398983Z","ip":"193.143.1.66","port":"135","protocol":"DCERPC","start_time":"2026-04-10T04:18:29.398983Z","transport_protocol":"TCP"},{"end_time":"2026-04-09T12:07:07.411847Z","ip":"193.143.1.66","port":"3389","protocol":"RDP","start_time":"2026-04-09T12:07:06.411847Z","transport_protocol":"TCP"},{"end_time":"2026-04-09T01:06:41.126821Z","ip":"193.143.1.66","port":"8443","protocol":"HTTP","start_time":"2026-04-05T22:01:40.517984Z","transport_protocol":"TCP"},{"end_time":"2026-04-08T23:34:27.684598Z","ip":"193.143.1.66","port":"135","protocol":"DCERPC","start_time":"2026-04-07T22:45:23.88789Z","transport_protocol":"TCP"},{"end_time":"2026-04-07T23:06:36.609241Z","ip":"193.143.1.66","port":"3389","protocol":"RDP","start_time":"2026-04-07T23:06:35.609241Z","transport_protocol":"TCP"},{"end_time":"2026-04-06T08:52:45.880888Z","ip":"193.143.1.66","port":"135","protocol":"DCERPC","start_time":"2026-04-06T08:52:44.880888Z","transport_protocol":"TCP"},{"end_time":"2026-04-06T02:35:09.073603Z","ip":"193.143.1.66","port":"3389","protocol":"RDP","start_time":"2026-04-05T02:17:03.772209Z","transport_protocol":"TCP"},{"end_time":"2026-04-05T03:50:00.750144Z","ip":"193.143.1.66","port":"135","protocol":"DCERPC","start_time":"2026-04-05T03:49:59.750144Z","transport_protocol":"TCP"},{"end_time":"2026-04-04T16:58:05.633695Z","ip":"193.143.1.66","port":"8443","protocol":"HTTP","start_time":"2026-04-04T16:58:04.633695Z","transport_protocol":"TCP"},{"end_time":"2026-04-03T16:49:10.444128Z","ip":"193.143.1.66","port":"3389","protocol":"RDP","start_time":"2026-04-03T16:49:09.444128Z","transport_protocol":"TCP"},{"end_time":"2026-04-03T11:08:44.94217Z","ip":"193.143.1.66","port":"135","protocol":"DCERPC","start_time":"2026-04-03T11:08:43.94217Z","transport_protocol":"TCP"},{"end_time":"2026-04-02T20:30:08.980103Z","ip":"193.143.1.66","port":"8443","protocol":"HTTP","start_time":"2026-04-02T20:30:07.980103Z","transport_protocol":"TCP"}]}}} +{"ip":"144.172.99.200","asn":"AS14956","name":"ROUTERHOSTING","honeylabs_events":16,"host":{"result":{"extensions":{},"resource":{"autonomous_system":{"asn":14956,"bgp_prefix":"144.172.99.0/24","country_code":"US","description":"ROUTERHOSTING - RouterHosting LLC","name":"ROUTERHOSTING - RouterHosting LLC"},"dns":{"reverse_dns":{"names":["200.99.172.144.static.cloudzy.com"],"resolve_time":"2026-09-04T23:12:08Z"}},"ip":"144.172.99.200","labels":[{"confidence":0.75,"source":"censys","value":"BULLETPROOF"}],"location":{"city":"Ogden","continent":"North America","coordinates":{"latitude":41.223,"longitude":-111.97383},"country":"United States","country_code":"US","postal_code":"84401","province":"Utah","timezone":"America/Denver"},"network":[{"hosting":true,"source":"IPINFO"}],"privacy":[{"source":"IPINFO"}],"reputation":{"evidence":[{},{},{},{},{}],"model_version":"2.0.0","score":0.568},"service_count":1,"services":[{"cert":{"added_at":"2026-08-26T03:25:59Z","ever_seen_in_scan":true,"fingerprint_md5":"1b9133b537f0870b27909ee5c2256018","fingerprint_sha1":"7f0064f774506e9c629188241a6116da8840f902","fingerprint_sha256":"b89e8e07f901f4ea249fee100f5e5bf8c500ddc7b5789553bf81933745c132a9","modified_at":"2026-08-26T03:25:59Z","names":["ubuntu-Utah-2gb"],"parse_status":"success","parsed":{"extensions":{"extended_key_usage":{"server_auth":true},"key_usage":{"data_encipherment":true,"key_encipherment":true,"value":12}},"issuer":{"common_name":["ubuntu-Utah-2gb"]},"issuer_dn":"CN=ubuntu-Utah-2gb","ja4x":"7022c563de38_7022c563de38_e73b053161df","serial_number":"158455660151971640403772937517763029869","serial_number_hex":"7735733813fa47a246d559e259426b6d","signature":{"self_signed":true,"signature_algorithm":{"name":"SHA1-RSA","oid":"1.2.840.113549.1.1.5"},"valid":true,"value":"9068cfd9f3e9be827c9e8dad70efdaa627f9e65433cb33c02e028cf1d25bf00c512df04b1d3695282efda5898b249b78e8f5727fba82703ce12c66bd698cf6a9ae7ce311370f1cc5c96ca209884a6e27382cfe919b4f87a36c93d22c48e0d63ee7e4edfdacf8daf4304615e324b1ed9aa7906a33ef6daa8b738fc2c7f4bd613b2ad87c9e0ad0b04499bb3c1264f318e800211ba761a0e834c65cdb4668bed18998f8f8d3815ff132ce2bb7e80b46cf68fbe97efcff2a66fd2f34af0df10565335d28467acb361307fc976eaa228edcfcc55788e6df5f57ef43ef607f29eb4ffff96f6d092409342946945170900d96a6d2f12f05aae5073c587019f06ac473e7"},"subject":{"common_name":["ubuntu-Utah-2gb"]},"subject_dn":"CN=ubuntu-Utah-2gb","subject_key_info":{"fingerprint_sha256":"57de34d90942fbadb75d04ff9111230db00dd38912c1fcda28651c81145522be","key_algorithm":{"name":"RSA","oid":"1.2.840.113549.1.1.1"},"rsa":{"exponent":65537,"length":2048,"modulus":"a2ef1211a0107c3d0dd9eb42112c4f5d478dd3c9dc23b81a9ea6c9954c375cbb9ed16628725c328e8e242ccfae983e148736c771d02da666ef905ccf3e00abee0e015a044b6d9a5a2f8a841b542e1815270b0129ad30ebd4782ab73885786bab20b0cb7f95ef9ef1a73a64aa82e1cc36b6216d34a29ff34bf32322be74958c9f0d8ba5346914edf03f877eb98bd8994f546f7010e2e835e4f75a214188cc842f9a33faef8a3486ec4a564387fa7866cdaebb87e1b84c7c405b0b308d2e8387bd135fac6465ee78c98abdc56b76e866c9ab71fb0ae5ffb492cced165de21833b9d6c823938fbda323ab7ea2bd08ec847e548c52b50cd5a41a9d39d1d9c773bed7"}},"validity_period":{"length_seconds":15811201,"not_after":"2027-02-23T17:53:44Z","not_before":"2026-08-24T17:53:44Z"},"version":3},"revocation":{"crl":{},"ocsp":{}},"spki_fingerprint_sha256":"38c920c6580e90da9488ac7ad52c9581ec4e9ee57b067c9d98fb598bee896809","spki_subject_fingerprint_sha256":"38c920c6580e90da9488ac7ad52c9581ec4e9ee57b067c9d98fb598bee896809","tbs_fingerprint_sha256":"4d14e6afc62ed26bca4e87a1ef38b39a1002abecf4ce381b452eaa3b07dbf89a","tbs_no_ct_fingerprint_sha256":"4d14e6afc62ed26bca4e87a1ef38b39a1002abecf4ce381b452eaa3b07dbf89a","validated_at":"2026-09-06T22:37:36Z","validation":{"apple":{},"chrome":{},"microsoft":{},"nss":{}},"zlint":{"errors_present":true,"failed_lints":["e_ext_san_missing","e_sub_cert_aia_does_not_contain_ocsp_url","e_sub_cert_aia_missing","e_sub_cert_cert_policy_empty","e_sub_cert_certificate_policies_missing","e_sub_cert_or_sub_ca_using_sha1","e_subject_common_name_not_exactly_from_san","n_subject_common_name_included","w_ext_key_usage_not_critical","w_ext_subject_key_identifier_missing_sub_cert","w_sub_cert_sha1_expiration_too_long"],"notices_present":true,"timestamp":"2026-08-26T03:25:59Z","version":3,"warnings_present":true}},"exposures":[{"confidence":1,"evidence":[{"data_path":"protocol","found_value":"RDP","literal_match":"RDP"}],"id":"CENSYS-2022-1054","metrics":{},"name":"Exposed RDP Service","risk_source":"censys","severity":"high","source":"censys","year":2022}],"ip":"144.172.99.200","ja4tscan":{"fingerprint":"8192_2-1-3-4-8_1460_8_3-6","scan_time":"2026-09-05T09:48:29Z"},"jarm":{"cipher_and_version_fingerprint":"06b06b00006b06b06b06b06b06b06b","fingerprint":"06b06b00006b06b06b06b06b06b06be3b0c44298fc1c149afbf4c8996fb924","ip":"144.172.99.200","is_success":true,"port":3389,"scan_time":"2026-09-04T19:04:54Z","tls_extensions_sha256":"e3b0c44298fc1c149afbf4c8996fb924","transport_protocol":"tcp"},"labels":[{"confidence":1,"evidence":[{"data_path":"protocol","found_value":"RDP","literal_match":"RDP"}],"source":"censys","value":"REMOTE_ACCESS"}],"misconfigs":[{"confidence":0.5,"evidence":[{"data_path":"service.tls.cipher_selected","found_value":"TLS_RSA_WITH_AES_128_CBC_SHA","literal_match":"TLS_RSA_WITH_AES_128_CBC_SHA"}],"id":"CENSYS-2026-1193","metrics":{},"name":"Weak TLS Cipher Selected","risk_source":"censys","severity":"medium","source":"censys","year":2026},{"confidence":1,"evidence":[{"data_path":"cert.parsed.signature.self_signed","found_value":"true"}],"id":"CENSYS-2026-1196","metrics":{},"name":"Self-Signed Certificate","risk_source":"censys","severity":"low","source":"censys","year":2026}],"port":3389,"protocol":"RDP","rdp":{"certificate_info":{},"connect_response":{"domain_parameters":{"domain_protocol_version":2,"max_channel_ids":34,"max_mcspdu_size":65528,"max_provider_height":1,"max_user_id_channels":3,"num_priorities":1}},"protocol_flags":{"extended_client_data_supported":true},"selected_security_protocol":{"raw_value":1,"standard_rdp":true,"tls":true},"version":{"major":5,"raw":"00000000"},"x224_cc_pdu_dstref":51966,"x224_cc_pdu_srcref":13330},"scan_time":"2026-09-07T07:46:04Z","screenshots":[{"extracted_text":"","handle":"fa5b97ca12ee43ee983c371d904cdde0","phash":"0000000000000000"}],"software":[{"confidence":1,"evidence":[{"data_path":"protocol","found_value":"RDP","literal_match":"RDP"}],"part":"a","source":"censys","type":["REMOTE_ACCESS"]}],"tls":{"cipher_selected":"TLS_RSA_WITH_AES_128_CBC_SHA","fingerprint_sha256":"b89e8e07f901f4ea249fee100f5e5bf8c500ddc7b5789553bf81933745c132a9","ja3s":"18e962e106761869a61045bed0e81c2c","ja4s":"t100000_002f_e3b0c44298fc","version_selected":"tlsv1_0","versions":[{"ja3s":"18e962e106761869a61045bed0e81c2c","ja4s":"t100000_002f_e3b0c44298fc","version":"tlsv1_0"}]},"transport_protocol":"tcp"}],"whois":{"network":{"allocation_type":"REALLOCATION","cidrs":["144.172.99.0/24"],"created":"2026-03-09T00:00:00Z","handle":"ROUTERHOSTING","name":"RouterHosting LLC","updated":"2026-03-09T00:00:00Z"},"organization":{"abuse_contacts":[{"email":"abuse-reports@cloudzy.com","handle":"ABUSE8459-ARIN","name":"abuse"}],"admin_contacts":[{"email":"abuse-reports@cloudzy.com","handle":"ABUSE8459-ARIN","name":"abuse"}],"city":"Sheridan","country":"US","handle":"RL-896","name":"RouterHosting LLC","postal_code":"82801","state":"WY","street":"1309 Coffeen Avenue STE 1200\\nSheridan, WY 82801","tech_contacts":[{"email":"abuse-reports@cloudzy.com","handle":"ABUSE8459-ARIN","name":"abuse"}]}}}}},"services":{"result":{"next_page_token":"","ranges":[{"end_time":"2026-09-06T05:31:31.391628Z","ip":"144.172.99.200","port":"3389","protocol":"RDP","start_time":"2026-09-04T18:45:07.119227Z","transport_protocol":"TCP"},{"end_time":"2026-09-03T03:13:39.075931Z","ip":"144.172.99.200","port":"3389","protocol":"RDP","start_time":"2026-08-28T20:59:35.640925Z","transport_protocol":"TCP"},{"end_time":"2026-08-28T14:14:20.309699Z","ip":"144.172.99.200","port":"3389","protocol":"UNKNOWN","start_time":"2026-08-27T23:27:41.005255Z","transport_protocol":"TCP"},{"end_time":"2026-08-27T07:12:49.991603Z","ip":"144.172.99.200","port":"3389","protocol":"RDP","start_time":"2026-08-26T03:25:36.279979Z","transport_protocol":"TCP"},{"end_time":"2026-08-25T20:14:44.068321Z","ip":"144.172.99.200","port":"135","protocol":"DCERPC","start_time":"2026-08-25T20:14:43.068321Z","transport_protocol":"TCP"},{"end_time":"2026-08-17T20:40:33.981853Z","ip":"144.172.99.200","port":"3389","protocol":"RDP","start_time":"2026-08-17T02:54:59.079101Z","transport_protocol":"TCP"},{"end_time":"2026-08-17T12:54:31.193073Z","ip":"144.172.99.200","port":"445","protocol":"SMB","start_time":"2026-08-16T07:06:29.510465Z","transport_protocol":"TCP"},{"end_time":"2026-08-17T05:46:54.34858Z","ip":"144.172.99.200","port":"135","protocol":"DCERPC","start_time":"2026-08-16T10:32:15.604317Z","transport_protocol":"TCP"},{"end_time":"2026-08-10T16:34:31.942615Z","ip":"144.172.99.200","port":"135","protocol":"DCERPC","start_time":"2026-08-07T16:01:28.514065Z","transport_protocol":"TCP"},{"end_time":"2026-08-10T09:35:30.792975Z","ip":"144.172.99.200","port":"3389","protocol":"RDP","start_time":"2026-08-07T19:07:39.879492Z","transport_protocol":"TCP"},{"end_time":"2026-08-09T20:31:24.661625Z","ip":"144.172.99.200","port":"445","protocol":"SMB","start_time":"2026-08-03T12:14:54.866528Z","transport_protocol":"TCP"},{"end_time":"2026-08-06T09:39:23.546787Z","ip":"144.172.99.200","port":"135","protocol":"DCERPC","start_time":"2026-08-03T17:07:04.743357Z","transport_protocol":"TCP"},{"end_time":"2026-08-06T01:10:18.462747Z","ip":"144.172.99.200","port":"3389","protocol":"RDP","start_time":"2026-07-30T10:07:36.836955Z","transport_protocol":"TCP"},{"end_time":"2026-08-02T03:14:37.676159Z","ip":"144.172.99.200","port":"135","protocol":"DCERPC","start_time":"2026-07-27T08:10:33.637398Z","transport_protocol":"TCP"},{"end_time":"2026-08-02T02:37:47.688601Z","ip":"144.172.99.200","port":"445","protocol":"SMB","start_time":"2026-07-27T10:38:43.752172Z","transport_protocol":"TCP"},{"end_time":"2026-07-29T05:18:49.909324Z","ip":"144.172.99.200","port":"3389","protocol":"RDP","start_time":"2026-07-27T08:23:56.727333Z","transport_protocol":"TCP"},{"end_time":"2026-07-25T19:34:23.081087Z","ip":"144.172.99.200","port":"135","protocol":"DCERPC","start_time":"2026-07-13T17:50:41.676436Z","transport_protocol":"TCP"},{"end_time":"2026-07-25T10:34:57.743666Z","ip":"144.172.99.200","port":"3389","protocol":"RDP","start_time":"2026-07-13T08:01:36.944334Z","transport_protocol":"TCP"},{"end_time":"2026-07-25T09:57:09.664184Z","ip":"144.172.99.200","port":"445","protocol":"SMB","start_time":"2026-07-18T11:43:01.631573Z","transport_protocol":"TCP"},{"end_time":"2026-07-16T15:34:01.662279Z","ip":"144.172.99.200","port":"445","protocol":"SMB","start_time":"2026-07-14T07:46:01.543092Z","transport_protocol":"TCP"},{"end_time":"2026-07-10T17:35:04.406476Z","ip":"144.172.99.200","port":"3389","protocol":"RDP","start_time":"2026-07-07T10:52:46.02117Z","transport_protocol":"TCP"},{"end_time":"2026-07-10T15:34:40.900645Z","ip":"144.172.99.200","port":"135","protocol":"DCERPC","start_time":"2026-06-18T01:36:40.756877Z","transport_protocol":"TCP"},{"end_time":"2026-07-10T09:34:41.943864Z","ip":"144.172.99.200","port":"445","protocol":"SMB","start_time":"2026-07-03T08:48:24.859834Z","transport_protocol":"TCP"},{"end_time":"2026-07-06T19:01:25.441212Z","ip":"144.172.99.200","port":"3389","protocol":"RDP","start_time":"2026-05-26T19:48:18.738634Z","transport_protocol":"TCP"},{"end_time":"2026-07-02T06:40:50.078216Z","ip":"144.172.99.200","port":"445","protocol":"SMB","start_time":"2026-06-18T01:36:40.596668Z","transport_protocol":"TCP"},{"end_time":"2026-05-12T03:02:40.136776Z","ip":"144.172.99.200","port":"22","protocol":"SSH","start_time":"2026-04-28T13:06:04.660627Z","transport_protocol":"TCP"},{"end_time":"2026-04-17T18:27:31.973241Z","ip":"144.172.99.200","port":"3389","protocol":"RDP","start_time":"2026-03-17T05:12:25.133769Z","transport_protocol":"TCP"}]}}} \ No newline at end of file diff --git a/kevlar/2026-09-07/changes/anomalies.csv b/kevlar/2026-09-07/changes/anomalies.csv new file mode 100644 index 0000000..6e8c8d1 --- /dev/null +++ b/kevlar/2026-09-07/changes/anomalies.csv @@ -0,0 +1,48 @@ +asn,name,severity,type,detail +"AS57043","HOSTKEY-AS","high","volume_spike","Sponge sessions 6 -> 196 (32.7x)" +"AS57043","HOSTKEY-AS","medium","new_ports","new dst ports: 80,443,3102,9443,6881" +"AS210644","AEZA-AS","high","volume_collapse","Sponge sessions 80345 -> 97 (-100%)" +"AS210644","AEZA-AS","medium","new_ports","new dst ports: 443,8888,22,4145,3128,2080,3125,5678,8254,808,999,1080" +"AS138915","KAOPU-HK","medium","new_ports","new dst ports: 28591,53,50001,50002,50003,9999,20002,20004,5686" +"AS14956","ROUTERHOSTING","high","volume_collapse","Sponge sessions 1859 -> 270 (-85%)" +"AS14956","ROUTERHOSTING","medium","new_ports","new dst ports: 8545,8546,8547,8548,8549,587,7860,8899,8900,445,1723,0" +"AS51852","PLI-AS","high","volume_collapse","Sponge sessions 737 -> 97 (-87%)" +"AS51852","PLI-AS","medium","new_ports","new dst ports: 443,8443,5960,6051,7070,7080,8000,8050,2087,5860,6060,2096" +"AS400992","ZHOUYISAT","medium","new_ports","new dst ports: 2883,2880,2881,2882,2887,2877,2878,2886,2879,2884,2885,25565" +"AS51396","PFCLOUD","high","volume_spike","Sponge sessions 34932 -> 87938 (2.5x)" +"AS51396","PFCLOUD","medium","new_ports","new dst ports: 1081,888,1090,1086,1088" +"AS200651","FLOKINET","medium","new_ports","new dst ports: 8080" +"AS198953","PROTON66","medium","new_ports","new dst ports: 11443,8443,222,1100,1111,1112,1200" +"AS214940","KPRONET","medium","new_ports","new dst ports: 2525" +"AS216309","INVISIONTECH-GROUP-SRL","medium","new_activity","first observed activity: 26 sessions" +"AS57043","HOSTKEY-AS","medium","new_fingerprints","hassh:98ddc5604ef6a1006a2b49a58759fbe6" +"AS210644","AEZA-AS","medium","new_fingerprints","ja4:t13i170900_5b57614c22b0_78e6aca7449b, ja4h:ge11nn0500_7992432eef13, ja4h:ge11nn0700_3161ce9d7233, ja4h:po11nn0700_3161ce9d7233, ja4h:ge11nn0500_3012a89e1aee" +"AS14956","ROUTERHOSTING","medium","new_fingerprints","ja4:t13i181000_85036bcba153_d41ae481755e, ja4h:ge11nn0400_8fd06a127c33, ja4h:ge11nn0400_c3abebcf3d28" +"AS51852","PLI-AS","medium","new_fingerprints","ja4:t13i190800_9dc949149365_97f8aa674fd9, ja4h:po11nn0500_c5c1780925fe, ja4h:ge11nn0300_0db47b7d240d, ja4h:ge11nn0400_88d30a62b7ad, ja4:t13i131000_f57a46bbacb6_ab7e3b40a677" +"AS216246","RU-AEZA-AS","medium","new_fingerprints","ja4:t13i181000_85036bcba153_d41ae481755e, ja4h:po11nn0600_def5433ae821" +"AS198953","PROTON66","medium","new_fingerprints","ja4:t12i210600_76e208dd3e22_f28add8e7af0, ja4h:ge11nn0200_549fad093d6b, ja4h:ge11nn0300_80168362a4ec" +"AS57043","HOSTKEY-AS","low","censys_host_count_change","visible hosts +908 (now 101919)" +"AS57043","HOSTKEY-AS","medium","new_cert_issuers","hypervisor.hv, Apple Public EV Server RSA CA 1 - G1, GlobalSign ECC OV SSL CA 2018, GlobalSign RSA OV SSL CA 2018, HARICA DV TLS RSA" +"AS209847","THE","medium","new_cert_issuers","GlobalSign Atlas R46 DV TLS CA 2026 Q3, Microsoft TLS G2 RSA CA OCSP 04, vm15882839.example.com, DigiCert Global G2 TLS RSA SHA256 2020 CA1, R13" +"AS210644","AEZA-AS","medium","new_cert_issuers","HARICA DV TLS RSA, Apple Public EV Server RSA CA 1 - G1, DigiCert Global G2 TLS RSA SHA256 2020 CA1, TRAEFIK DEFAULT CERT, GlobalSign Atlas R46 DV TLS CA 2026 Q3" +"AS138915","KAOPU-HK","low","censys_host_count_change","visible hosts -1246 (now 12308)" +"AS138915","KAOPU-HK","medium","new_cert_issuers","QY, tls.internal.ypc.org" +"AS14956","ROUTERHOSTING","medium","new_cert_issuers","windows-Utah-4H, windows-Utah-2g, AnyDesk Client, Plesk, windows-LasVega" +"AS216139","IRONHOST","medium","new_cert_issuers","isp13.eurobyte.ru, vps1.dev.mchost.ru, vps1.dev.eurobyte.ru, isp15.eurobyte.ru, GeoTrust TLS RSA CA G1" +"AS51852","PLI-AS","medium","new_cert_issuers","Hydra Authentication RSA SubCA #154, Proxmox Virtual Environment, Hydra Authentication RSA SubCA #156, Plesk, server.xtreme-results.net" +"AS400992","ZHOUYISAT","medium","new_cert_issuers","GlobalSign Atlas R46 DV TLS CA 2026 Q3, Microsoft TLS G2 RSA CA OCSP 04, Apple Public EV Server RSA CA 1 - G1, GlobalSign RSA OV SSL CA 2018, HARICA DV TLS RSA" +"AS33993","UFO-AS","medium","new_cert_issuers","HARICA DV TLS RSA, GlobalSign RSA OV SSL CA 2018, GlobalSign ECC OV SSL CA 2018, GlobalSign GCC R46 OV TLS CA 2025, Microsoft TLS G2 RSA CA OCSP 04" +"AS51396","PFCLOUD","medium","new_cert_issuers","Cloudbase-Init WinRM, hosting12.coolsshservers.com, WIN-OU0SUKQBJN2, imap.example.com, srv1.dedusapp.icu" +"AS213702","QWINS-LTD","medium","new_cert_issuers","GlobalSign Atlas R3 DV TLS CA 2026 Q2, HARICA DV TLS RSA, GlobalSign RSA OV SSL CA 2018, WR1, Apple Public EV Server RSA CA 1 - G1" +"AS216246","RU-AEZA-AS","medium","new_cert_issuers","HARICA DV TLS RSA, GeoTrust TLS RSA CA G1, WIN-4NFSE1QOBMS, Microsoft TLS G2 RSA CA OCSP 04, GlobalSign GCC R46 OV TLS CA 2025" +"AS200651","FLOKINET","medium","new_cert_issuers","GlobalSign Atlas R46 DV TLS CA 2026 Q3, fin01.m-cr.org, Sectigo Public Server Authentication CA DV R36, GlobalSign RSA OV SSL CA 2018, protect@DDoS-Filter.domain" +"AS30823","AUROLOGIC","medium","new_cert_issuers","WIN-8OA3CCQAE4D, Plesk, Apple Public EV Server RSA CA 1 - G1, DigiCert Global G2 TLS RSA SHA256 2020 CA1, RapidSSL TLS RSA CA G1" +"AS140666","ADPL-AS-AP","low","censys_host_count_change","visible hosts +3757 (now 6562)" +"AS140666","ADPL-AS-AP","medium","new_cert_issuers","USDTCDN, SG CA, Root CA, GlobalSign GCC R46 OV TLS CA 2025" +"AS214351","FEMOIT","medium","new_cert_issuers","vm4980.defhost.co, amgel.yop.nail, def.host.vm, info.devser.loc" +"AS198953","PROTON66","medium","new_cert_issuers","FASTPANEL, dev-1.secure.host, akrud-1.example.com, mail.the-slasher.com, xmoney-1.example.com" +"AS200593","PROSPERO-AS","medium","new_cert_issuers","blankilamalice-4.example.com, ads-grab-2.example.com, benjamin-b-2.example.com, AnyDesk Client" +"AS206728","MEDIALAND-AS","medium","new_cert_issuers","WIN-UKID351J32A" +"AS211720","Datashield","medium","new_cert_issuers","bad-raven-crab, bright-magenta-, eth0, gentle-red-bee, greedy-cream-ha" +"AS216309","INVISIONTECH-GROUP-SRL","medium","new_cert_issuers","www.fxzjqfcj6dilr.com" +"AS58854","KAOPY","medium","new_cert_issuers","宝塔面板, DigiCert Basic OV G2 TLS CN RSA4096 SHA256 2022 CA1, TrustAsia TLS RSA CA, WIN-M7O7840CVAH, Certum DV TLS G2 R39 CA" \ No newline at end of file diff --git a/kevlar/2026-09-07/changes/censys-software-changes.csv b/kevlar/2026-09-07/changes/censys-software-changes.csv new file mode 100644 index 0000000..9ee8d46 --- /dev/null +++ b/kevlar/2026-09-07/changes/censys-software-changes.csv @@ -0,0 +1,22 @@ +asn,name,new_software +"AS57043","HOSTKEY-AS","dovecot, http_server, next.js, uvicorn, bootstrap" +"AS209847","THE","app_and_api_protector, express, ghost, bootstrap, http_server" +"AS210644","AEZA-AS","uvicorn, next.js, http_server, python, jquery" +"AS138915","KAOPU-HK","python, squid, node_exporter, litespeed_web_server, moment" +"AS14956","ROUTERHOSTING","next.js, internet_information_services, php, bootstrap, python" +"AS216139","IRONHOST","http_server, app_and_api_protector, ghost, php, mysql" +"AS51852","PLI-AS","php, proftpd, express, virtual_environment, pve" +"AS400992","ZHOUYISAT","traffic_server, http_server, bootstrap, jquery, dovecot" +"AS33993","UFO-AS","caddy, http_server, jquery, next.js, traefik_proxy" +"AS51396","PFCLOUD","dovecot, next.js, node_exporter, simplehttp, drupal, tinyproxy" +"AS213702","QWINS-LTD","next.js, openresty, uvicorn, http_server, bootstrap" +"AS216246","RU-AEZA-AS","fastpanel, waf, http_server, uvicorn, google_web_services, web_server" +"AS200651","FLOKINET","next.js, jquery, postfix, webmail, traefik_proxy" +"AS30823","AUROLOGIC","next.js, postfix, app_and_api_protector, ghost, waf" +"AS140666","ADPL-AS-AP","app_and_api_protector, ghost, wordpress, python, http_server" +"AS214351","FEMOIT","bootstrap, php, uvicorn, jquery, bind" +"AS198953","PROTON66","prototype, proftpd, plesk, bind, postfix" +"AS200593","PROSPERO-AS","exim, cpanel, proftpd, postfix, authoritative_server" +"AS211720","Datashield","next.js" +"AS216309","INVISIONTECH-GROUP-SRL","parallels_plesk_panel, requirejs, lodash, plesk, pve" +"AS58854","KAOPY","simplehttp, http_api, tengine, openresty, internet_information_services" \ No newline at end of file diff --git a/kevlar/2026-09-07/changes/diff-vs-prior-week.csv b/kevlar/2026-09-07/changes/diff-vs-prior-week.csv new file mode 100644 index 0000000..bc7b7a9 --- /dev/null +++ b/kevlar/2026-09-07/changes/diff-vs-prior-week.csv @@ -0,0 +1,26 @@ +asn,name,cur_week_sessions,prior_week_sessions,delta_pct,new_source_ips,gone_source_ips,new_ports,gone_ports +"AS57043","HOSTKEY-AS","196","6","3167%","82.38.67.164 5.39.217.86 31.207.46.105 66.151.40.231 82.21.150.241","66.248.207.253 185.130.227.19","80;443;3102;9443;6881","445" +"AS209847","THE","3","41","-93%","","45.140.147.124","","443;2053;8443" +"AS210644","AEZA-AS","97","80345","-100%","77.110.110.145 138.124.102.8 46.226.167.103 85.192.24.119","81.19.137.20 138.124.91.58 213.165.46.78 213.165.46.83 147.45.71.214 213.176.114.183 217.144.190.138 77.221.157.79 185.125.102.59 176.124.203.177","443;8888;22;4145;3128;2080;3125;5678;8254;808;999;1080;1111;4153;6588;8006;8008;8085;8090;8181","1883;50000;20002;2376;4190;2628;64738;801;8787;8822;8844;15000;25565;21;53;82;85;88;110;111" +"AS138915","KAOPU-HK","47859","62991","-24%","38.60.227.250 38.54.2.235 38.54.2.22 38.54.2.233 38.54.2.55 38.54.2.71 38.54.2.146","38.54.2.152 38.54.2.148 38.54.40.83 154.205.139.152 38.54.2.133 38.60.176.11 38.54.126.84","28591;53;50001;50002;50003;9999;20002;20004;5686","47604;51350;43998;22222;34569;58467;16516;5601;25565" +"AS14956","ROUTERHOSTING","270","1859","-85%","144.172.104.123 144.172.102.126 144.172.97.249 144.172.104.147 167.88.168.121 107.189.22.128 216.126.227.187 45.61.149.189 172.86.89.217 107.189.26.103 144.172.91.28 144.172.98.217 45.59.117.222 45.61.129.23 45.61.151.41 144.172.84.178 144.172.102.30","216.126.227.184 216.126.225.6 45.59.117.74 104.194.157.233 144.172.88.96 144.172.117.54 216.126.239.150 107.189.17.69 216.126.239.185 216.126.239.163 172.86.117.85 144.172.94.243 107.189.17.181 144.172.93.238 216.126.239.178 144.172.107.203 144.172.110.233","8545;8546;8547;8548;8549;587;7860;8899;8900;445;1723;0;11211","8888;7500;8161;8008;8081;5001;7443;8088;9080;8000;8085;10000;8001" +"AS216139","IRONHOST","0","0","0%","","","","" +"AS51852","PLI-AS","97","737","-87%","179.43.186.220 46.19.142.226 179.43.189.73","179.43.139.58 179.43.182.200 179.43.133.154 179.43.167.2 81.17.28.131 46.19.137.194 141.255.165.66 46.19.138.45 141.255.165.70 46.19.138.42 46.19.138.44 141.255.165.104 179.43.172.83","443;8443;5960;6051;7070;7080;8000;8050;2087;5860;6060;2096;3128;8006;8008;8082;32400","22;23;139;9000;9090;1723;5080;7680;80;1521;8007;60000;0;7001;8181;9091;9200" +"AS400992","ZHOUYISAT","226","257","-12%","194.48.142.88 194.48.142.134","193.46.218.239","2883;2880;2881;2882;2887;2877;2878;2886;2879;2884;2885;25565","" +"AS33993","UFO-AS","0","0","0%","","","","" +"AS51396","PFCLOUD","87938","34932","152%","204.76.203.4 204.76.203.214 204.76.203.222 204.76.203.221 204.76.203.213 45.135.194.24 176.65.148.93","45.135.194.26 176.65.149.64 176.65.149.224 176.65.149.230 176.65.149.55 176.65.149.212 176.65.149.220","1081;888;1090;1086;1088","23;0;25566;25564;8181" +"AS213702","QWINS-LTD","0","0","0%","","","","" +"AS216246","RU-AEZA-AS","0","2","-100%","","185.221.199.82 194.26.229.20","","80" +"AS200651","FLOKINET","76","62","23%","185.100.85.48","185.247.225.201 37.228.129.67","8080","6882;2222;0" +"AS30823","AUROLOGIC","2","9","-78%","172.86.92.151","45.153.243.249","5060","22" +"AS140666","ADPL-AS-AP","0","0","0%","","","","" +"AS214351","FEMOIT","0","4","-100%","","62.60.226.150","","1723" +"AS198953","PROTON66","1469","2327","-37%","176.120.22.240 176.120.22.147","176.120.22.43 193.143.1.66 37.77.150.241","11443;8443;222;1100;1111;1112;1200","2222;22222;8001;5678;6000;6001;7788" +"AS200593","PROSPERO-AS","1","2","-50%","91.215.85.104","91.215.85.142","443","22" +"AS214940","KPRONET","59","151","-61%","77.83.39.144","77.83.39.6 77.83.39.112 77.83.39.239 77.83.39.17 77.83.39.60 77.83.39.4 77.83.39.118 77.83.39.147 77.83.39.101 77.83.39.217 77.83.39.99 77.83.39.226 77.83.39.89 77.83.39.122 77.83.39.95 77.83.39.119 77.83.39.151 77.83.39.235","2525","2222;465;25" +"AS206728","MEDIALAND-AS","0","0","0%","","","","" +"AS211720","Datashield","20","51","-61%","","","","21;30443;40443" +"AS216309","INVISIONTECH-GROUP-SRL","26","0","new","67.219.214.53 67.219.214.90 67.219.214.127 67.219.214.145 67.219.214.154 67.219.214.247 67.219.214.1 67.219.214.2 67.219.214.17 67.219.214.19 67.219.214.27 67.219.214.32 67.219.214.33 67.219.214.36 67.219.214.50 67.219.214.52 67.219.214.55 67.219.214.57 67.219.214.58 67.219.214.60","","80","" +"AS58854","KAOPY","0","0","0%","","","","" +"AS202685","TR-ARKEL","0","0","0%","","","","" +"AS394711","KORGRID","0","0","0%","","","","" \ No newline at end of file diff --git a/kevlar/2026-09-07/changes/numbers-table.json b/kevlar/2026-09-07/changes/numbers-table.json new file mode 100644 index 0000000..83cf2cb --- /dev/null +++ b/kevlar/2026-09-07/changes/numbers-table.json @@ -0,0 +1,277 @@ +[ + { + "asn": "AS57043", + "name": "HOSTKEY-AS", + "sponge_ips": 5, + "sess": 196, + "hl_ips": 2, + "hl_ev": 12, + "hosts": 101919, + "top_port": "80 (HTTP)", + "delta": 3167 + }, + { + "asn": "AS209847", + "name": "THE", + "sponge_ips": 1, + "sess": 3, + "hl_ips": 0, + "hl_ev": 0, + "hosts": 1458, + "top_port": "3389 (RDP)", + "delta": -93 + }, + { + "asn": "AS210644", + "name": "AEZA-AS", + "sponge_ips": 5, + "sess": 97, + "hl_ips": 1, + "hl_ev": 51, + "hosts": 71701, + "top_port": "443 (HTTPS)", + "delta": -100 + }, + { + "asn": "AS138915", + "name": "KAOPU-HK", + "sponge_ips": 20, + "sess": 47859, + "hl_ips": 0, + "hl_ev": 0, + "hosts": 12308, + "top_port": "80 (HTTP)", + "delta": -24 + }, + { + "asn": "AS14956", + "name": "ROUTERHOSTING", + "sponge_ips": 20, + "sess": 270, + "hl_ips": 12, + "hl_ev": 95, + "hosts": 25632, + "top_port": "22 (SSH)", + "delta": -85 + }, + { + "asn": "AS216139", + "name": "IRONHOST", + "sponge_ips": 0, + "sess": 0, + "hl_ips": 0, + "hl_ev": 0, + "hosts": 8797, + "top_port": "-", + "delta": 0 + }, + { + "asn": "AS51852", + "name": "PLI-AS", + "sponge_ips": 8, + "sess": 97, + "hl_ips": 5, + "hl_ev": 32, + "hosts": 8634, + "top_port": "443 (HTTPS)", + "delta": -87 + }, + { + "asn": "AS400992", + "name": "ZHOUYISAT", + "sponge_ips": 4, + "sess": 226, + "hl_ips": 0, + "hl_ev": 0, + "hosts": 7982, + "top_port": "443 (HTTPS)", + "delta": -12 + }, + { + "asn": "AS33993", + "name": "UFO-AS", + "sponge_ips": 0, + "sess": 0, + "hl_ips": 0, + "hl_ev": 0, + "hosts": 4692, + "top_port": "-", + "delta": 0 + }, + { + "asn": "AS51396", + "name": "PFCLOUD", + "sponge_ips": 20, + "sess": 87938, + "hl_ips": 20, + "hl_ev": 100, + "hosts": 2005, + "top_port": "22 (SSH)", + "delta": 152 + }, + { + "asn": "AS213702", + "name": "QWINS-LTD", + "sponge_ips": 0, + "sess": 0, + "hl_ips": 0, + "hl_ev": 0, + "hosts": 7681, + "top_port": "-", + "delta": 0 + }, + { + "asn": "AS216246", + "name": "RU-AEZA-AS", + "sponge_ips": 0, + "sess": 0, + "hl_ips": 2, + "hl_ev": 2, + "hosts": 6960, + "top_port": "-", + "delta": -100 + }, + { + "asn": "AS200651", + "name": "FLOKINET", + "sponge_ips": 2, + "sess": 76, + "hl_ips": 1, + "hl_ev": 24, + "hosts": 3824, + "top_port": "443 (HTTPS)", + "delta": 23 + }, + { + "asn": "AS30823", + "name": "AUROLOGIC", + "sponge_ips": 1, + "sess": 2, + "hl_ips": 0, + "hl_ev": 0, + "hosts": 2178, + "top_port": "5060 (SIP)", + "delta": -78 + }, + { + "asn": "AS140666", + "name": "ADPL-AS-AP", + "sponge_ips": 0, + "sess": 0, + "hl_ips": 0, + "hl_ev": 0, + "hosts": 6562, + "top_port": "-", + "delta": 0 + }, + { + "asn": "AS214351", + "name": "FEMOIT", + "sponge_ips": 0, + "sess": 0, + "hl_ips": 0, + "hl_ev": 0, + "hosts": 744, + "top_port": "-", + "delta": -100 + }, + { + "asn": "AS198953", + "name": "PROTON66", + "sponge_ips": 4, + "sess": 1469, + "hl_ips": 4, + "hl_ev": 100, + "hosts": 359, + "top_port": "4443 (HTTPS-alt)", + "delta": -37 + }, + { + "asn": "AS200593", + "name": "PROSPERO-AS", + "sponge_ips": 1, + "sess": 1, + "hl_ips": 0, + "hl_ev": 0, + "hosts": 340, + "top_port": "443 (HTTPS)", + "delta": -50 + }, + { + "asn": "AS214940", + "name": "KPRONET", + "sponge_ips": 3, + "sess": 59, + "hl_ips": 0, + "hl_ev": 0, + "hosts": 0, + "top_port": "80 (HTTP)", + "delta": -61 + }, + { + "asn": "AS206728", + "name": "MEDIALAND-AS", + "sponge_ips": 0, + "sess": 0, + "hl_ips": 0, + "hl_ev": 0, + "hosts": 15, + "top_port": "-", + "delta": 0 + }, + { + "asn": "AS211720", + "name": "Datashield", + "sponge_ips": 1, + "sess": 20, + "hl_ips": 0, + "hl_ev": 0, + "hosts": 49, + "top_port": "50443 (HTTPS-alt)", + "delta": -61 + }, + { + "asn": "AS216309", + "name": "INVISIONTECH-GROUP-SRL", + "sponge_ips": 20, + "sess": 26, + "hl_ips": 0, + "hl_ev": 0, + "hosts": 37, + "top_port": "80 (HTTP)", + "delta": null + }, + { + "asn": "AS58854", + "name": "KAOPY", + "sponge_ips": 0, + "sess": 0, + "hl_ips": 0, + "hl_ev": 0, + "hosts": 614, + "top_port": "-", + "delta": 0 + }, + { + "asn": "AS202685", + "name": "TR-ARKEL", + "sponge_ips": 0, + "sess": 0, + "hl_ips": 0, + "hl_ev": 0, + "hosts": 4, + "top_port": "-", + "delta": 0 + }, + { + "asn": "AS394711", + "name": "KORGRID", + "sponge_ips": 0, + "sess": 0, + "hl_ips": 0, + "hl_ev": 0, + "hosts": 3, + "top_port": "-", + "delta": 0 + } +] \ No newline at end of file diff --git a/kevlar/2026-09-07/changes/prior-window-2026-08-24_31.json b/kevlar/2026-09-07/changes/prior-window-2026-08-24_31.json new file mode 100644 index 0000000..313b2ec --- /dev/null +++ b/kevlar/2026-09-07/changes/prior-window-2026-08-24_31.json @@ -0,0 +1,1319 @@ +{ + "AS57043": { + "name": "HOSTKEY-AS", + "ips": [ + { + "doc_count": 4, + "key": "66.248.207.253" + }, + { + "doc_count": 2, + "key": "185.130.227.19" + } + ], + "ports": [ + { + "doc_count": 4, + "key": 22 + }, + { + "doc_count": 2, + "key": 445 + } + ] + }, + "AS209847": { + "name": "THE", + "ips": [ + { + "doc_count": 37, + "key": "77.91.122.2" + }, + { + "doc_count": 4, + "key": "45.140.147.124" + } + ], + "ports": [ + { + "doc_count": 37, + "key": 3389 + }, + { + "doc_count": 2, + "key": 443 + }, + { + "doc_count": 1, + "key": 2053 + }, + { + "doc_count": 1, + "key": 8443 + } + ] + }, + "AS210644": { + "name": "AEZA-AS", + "ips": [ + { + "doc_count": 26958, + "key": "81.19.137.20" + }, + { + "doc_count": 26454, + "key": "138.124.91.58" + }, + { + "doc_count": 25907, + "key": "213.165.46.78" + }, + { + "doc_count": 876, + "key": "213.165.46.83" + }, + { + "doc_count": 53, + "key": "147.45.71.214" + }, + { + "doc_count": 43, + "key": "213.176.114.183" + }, + { + "doc_count": 30, + "key": "217.144.190.138" + }, + { + "doc_count": 17, + "key": "77.221.157.79" + }, + { + "doc_count": 3, + "key": "185.125.102.59" + }, + { + "doc_count": 2, + "key": "176.124.203.177" + }, + { + "doc_count": 2, + "key": "213.165.32.131" + } + ], + "ports": [ + { + "doc_count": 230, + "key": 1883 + }, + { + "doc_count": 230, + "key": 50000 + }, + { + "doc_count": 223, + "key": 20002 + }, + { + "doc_count": 221, + "key": 2376 + }, + { + "doc_count": 219, + "key": 4190 + }, + { + "doc_count": 218, + "key": 2628 + }, + { + "doc_count": 218, + "key": 64738 + }, + { + "doc_count": 217, + "key": 801 + }, + { + "doc_count": 217, + "key": 8787 + }, + { + "doc_count": 217, + "key": 8822 + }, + { + "doc_count": 217, + "key": 8844 + }, + { + "doc_count": 217, + "key": 15000 + }, + { + "doc_count": 217, + "key": 25565 + }, + { + "doc_count": 216, + "key": 21 + }, + { + "doc_count": 216, + "key": 53 + }, + { + "doc_count": 216, + "key": 82 + }, + { + "doc_count": 216, + "key": 85 + }, + { + "doc_count": 216, + "key": 88 + }, + { + "doc_count": 216, + "key": 110 + }, + { + "doc_count": 216, + "key": 111 + } + ] + }, + "AS138915": { + "name": "KAOPU-HK", + "ips": [ + { + "doc_count": 44479, + "key": "38.54.2.209" + }, + { + "doc_count": 13022, + "key": "38.54.2.232" + }, + { + "doc_count": 1031, + "key": "38.54.2.13" + }, + { + "doc_count": 848, + "key": "38.54.2.75" + }, + { + "doc_count": 771, + "key": "38.54.2.152" + }, + { + "doc_count": 715, + "key": "38.54.2.221" + }, + { + "doc_count": 673, + "key": "38.54.2.168" + }, + { + "doc_count": 673, + "key": "38.54.2.170" + }, + { + "doc_count": 313, + "key": "38.54.2.204" + }, + { + "doc_count": 142, + "key": "38.54.2.148" + }, + { + "doc_count": 94, + "key": "38.54.40.83" + }, + { + "doc_count": 47, + "key": "38.54.2.203" + }, + { + "doc_count": 44, + "key": "38.54.2.4" + }, + { + "doc_count": 39, + "key": "154.205.139.152" + }, + { + "doc_count": 19, + "key": "38.54.2.133" + }, + { + "doc_count": 19, + "key": "38.54.2.195" + }, + { + "doc_count": 18, + "key": "38.60.176.11" + }, + { + "doc_count": 16, + "key": "38.54.2.9" + }, + { + "doc_count": 16, + "key": "38.54.2.91" + }, + { + "doc_count": 12, + "key": "38.54.126.84" + } + ], + "ports": [ + { + "doc_count": 15077, + "key": 123 + }, + { + "doc_count": 11481, + "key": 80 + }, + { + "doc_count": 8036, + "key": 443 + }, + { + "doc_count": 5164, + "key": 5355 + }, + { + "doc_count": 4991, + "key": 137 + }, + { + "doc_count": 3794, + "key": 1900 + }, + { + "doc_count": 3247, + "key": 5353 + }, + { + "doc_count": 2203, + "key": 5678 + }, + { + "doc_count": 1603, + "key": 138 + }, + { + "doc_count": 782, + "key": 47604 + }, + { + "doc_count": 182, + "key": 0 + }, + { + "doc_count": 141, + "key": 67 + }, + { + "doc_count": 129, + "key": 51350 + }, + { + "doc_count": 111, + "key": 43998 + }, + { + "doc_count": 104, + "key": 22222 + }, + { + "doc_count": 96, + "key": 34569 + }, + { + "doc_count": 55, + "key": 58467 + }, + { + "doc_count": 45, + "key": 16516 + }, + { + "doc_count": 40, + "key": 5601 + }, + { + "doc_count": 29, + "key": 25565 + } + ] + }, + "AS14956": { + "name": "ROUTERHOSTING", + "ips": [ + { + "doc_count": 967, + "key": "216.126.227.184" + }, + { + "doc_count": 250, + "key": "216.126.225.6" + }, + { + "doc_count": 221, + "key": "45.59.117.74" + }, + { + "doc_count": 211, + "key": "107.189.27.179" + }, + { + "doc_count": 39, + "key": "104.194.157.233" + }, + { + "doc_count": 38, + "key": "144.172.88.96" + }, + { + "doc_count": 35, + "key": "144.172.115.90" + }, + { + "doc_count": 14, + "key": "144.172.117.54" + }, + { + "doc_count": 14, + "key": "216.126.239.150" + }, + { + "doc_count": 13, + "key": "107.189.17.69" + }, + { + "doc_count": 12, + "key": "216.126.239.185" + }, + { + "doc_count": 9, + "key": "216.126.239.163" + }, + { + "doc_count": 7, + "key": "172.86.117.85" + }, + { + "doc_count": 6, + "key": "144.172.117.61" + }, + { + "doc_count": 5, + "key": "144.172.94.243" + }, + { + "doc_count": 4, + "key": "107.189.17.181" + }, + { + "doc_count": 4, + "key": "144.172.93.238" + }, + { + "doc_count": 4, + "key": "216.126.239.178" + }, + { + "doc_count": 3, + "key": "144.172.107.203" + }, + { + "doc_count": 3, + "key": "144.172.110.233" + } + ], + "ports": [ + { + "doc_count": 375, + "key": 22 + }, + { + "doc_count": 216, + "key": 8022 + }, + { + "doc_count": 104, + "key": 22222 + }, + { + "doc_count": 36, + "key": 80 + }, + { + "doc_count": 36, + "key": 443 + }, + { + "doc_count": 29, + "key": 8080 + }, + { + "doc_count": 25, + "key": 8888 + }, + { + "doc_count": 24, + "key": 7500 + }, + { + "doc_count": 24, + "key": 8161 + }, + { + "doc_count": 23, + "key": 8008 + }, + { + "doc_count": 23, + "key": 8081 + }, + { + "doc_count": 22, + "key": 5001 + }, + { + "doc_count": 22, + "key": 7443 + }, + { + "doc_count": 22, + "key": 8088 + }, + { + "doc_count": 22, + "key": 9080 + }, + { + "doc_count": 21, + "key": 8000 + }, + { + "doc_count": 21, + "key": 8085 + }, + { + "doc_count": 20, + "key": 10000 + }, + { + "doc_count": 18, + "key": 5060 + }, + { + "doc_count": 18, + "key": 8001 + } + ] + }, + "AS216139": { + "name": "IRONHOST", + "ips": [], + "ports": [] + }, + "AS51852": { + "name": "PLI-AS", + "ips": [ + { + "doc_count": 212, + "key": "179.43.139.58" + }, + { + "doc_count": 205, + "key": "179.43.182.200" + }, + { + "doc_count": 86, + "key": "179.43.133.154" + }, + { + "doc_count": 78, + "key": "179.43.167.2" + }, + { + "doc_count": 41, + "key": "81.17.28.131" + }, + { + "doc_count": 30, + "key": "46.19.138.10" + }, + { + "doc_count": 26, + "key": "179.43.150.26" + }, + { + "doc_count": 19, + "key": "46.19.137.194" + }, + { + "doc_count": 11, + "key": "179.43.146.27" + }, + { + "doc_count": 9, + "key": "141.255.165.67" + }, + { + "doc_count": 9, + "key": "141.255.165.69" + }, + { + "doc_count": 3, + "key": "141.255.165.66" + }, + { + "doc_count": 2, + "key": "46.19.138.45" + }, + { + "doc_count": 2, + "key": "141.255.165.70" + }, + { + "doc_count": 1, + "key": "46.19.138.42" + }, + { + "doc_count": 1, + "key": "46.19.138.44" + }, + { + "doc_count": 1, + "key": "141.255.165.104" + }, + { + "doc_count": 1, + "key": "179.43.172.83" + } + ], + "ports": [ + { + "doc_count": 298, + "key": 22 + }, + { + "doc_count": 205, + "key": 23 + }, + { + "doc_count": 118, + "key": 5060 + }, + { + "doc_count": 35, + "key": 139 + }, + { + "doc_count": 15, + "key": 1701 + }, + { + "doc_count": 13, + "key": 9000 + }, + { + "doc_count": 13, + "key": 9090 + }, + { + "doc_count": 8, + "key": 1723 + }, + { + "doc_count": 6, + "key": 5080 + }, + { + "doc_count": 6, + "key": 7680 + }, + { + "doc_count": 5, + "key": 80 + }, + { + "doc_count": 3, + "key": 5062 + }, + { + "doc_count": 2, + "key": 1521 + }, + { + "doc_count": 2, + "key": 8007 + }, + { + "doc_count": 2, + "key": 60000 + }, + { + "doc_count": 1, + "key": 0 + }, + { + "doc_count": 1, + "key": 7001 + }, + { + "doc_count": 1, + "key": 8181 + }, + { + "doc_count": 1, + "key": 9091 + }, + { + "doc_count": 1, + "key": 9200 + } + ] + }, + "AS400992": { + "name": "ZHOUYISAT-COMMUNICATIONS", + "ips": [ + { + "doc_count": 179, + "key": "23.172.217.87" + }, + { + "doc_count": 44, + "key": "193.46.218.239" + }, + { + "doc_count": 34, + "key": "23.172.217.77" + } + ], + "ports": [ + { + "doc_count": 130, + "key": 443 + }, + { + "doc_count": 127, + "key": 80 + } + ] + }, + "AS33993": { + "name": "UFO-AS", + "ips": [], + "ports": [] + }, + "AS51396": { + "name": "PFCLOUD", + "ips": [ + { + "doc_count": 14856, + "key": "204.76.203.18" + }, + { + "doc_count": 3537, + "key": "176.65.148.84" + }, + { + "doc_count": 3175, + "key": "45.156.87.13" + }, + { + "doc_count": 1595, + "key": "45.153.34.181" + }, + { + "doc_count": 1572, + "key": "45.156.87.93" + }, + { + "doc_count": 1448, + "key": "176.65.148.243" + }, + { + "doc_count": 1435, + "key": "45.156.87.166" + }, + { + "doc_count": 1293, + "key": "45.135.194.26" + }, + { + "doc_count": 1085, + "key": "204.76.203.7" + }, + { + "doc_count": 795, + "key": "45.153.34.149" + }, + { + "doc_count": 581, + "key": "204.76.203.49" + }, + { + "doc_count": 569, + "key": "45.135.193.198" + }, + { + "doc_count": 474, + "key": "45.135.193.193" + }, + { + "doc_count": 440, + "key": "176.65.149.67" + }, + { + "doc_count": 364, + "key": "176.65.149.64" + }, + { + "doc_count": 356, + "key": "176.65.149.224" + }, + { + "doc_count": 351, + "key": "176.65.149.230" + }, + { + "doc_count": 342, + "key": "176.65.149.55" + }, + { + "doc_count": 332, + "key": "176.65.149.212" + }, + { + "doc_count": 332, + "key": "176.65.149.220" + } + ], + "ports": [ + { + "doc_count": 15114, + "key": 80 + }, + { + "doc_count": 8674, + "key": 22 + }, + { + "doc_count": 1297, + "key": 23 + }, + { + "doc_count": 486, + "key": 8080 + }, + { + "doc_count": 399, + "key": 27017 + }, + { + "doc_count": 292, + "key": 3306 + }, + { + "doc_count": 216, + "key": 25565 + }, + { + "doc_count": 215, + "key": 0 + }, + { + "doc_count": 204, + "key": 8888 + }, + { + "doc_count": 202, + "key": 8000 + }, + { + "doc_count": 177, + "key": 443 + }, + { + "doc_count": 135, + "key": 3128 + }, + { + "doc_count": 111, + "key": 8545 + }, + { + "doc_count": 94, + "key": 25566 + }, + { + "doc_count": 92, + "key": 9999 + }, + { + "doc_count": 90, + "key": 25564 + }, + { + "doc_count": 88, + "key": 8181 + }, + { + "doc_count": 87, + "key": 1080 + }, + { + "doc_count": 86, + "key": 4145 + }, + { + "doc_count": 85, + "key": 53 + } + ] + }, + "AS213702": { + "name": "QWINS-LTD", + "ips": [], + "ports": [] + }, + "AS216246": { + "name": "RU-AEZA-AS", + "ips": [ + { + "doc_count": 1, + "key": "185.221.199.82" + }, + { + "doc_count": 1, + "key": "194.26.229.20" + } + ], + "ports": [ + { + "doc_count": 2, + "key": 80 + } + ] + }, + "AS200651": { + "name": "FLOKINET", + "ips": [ + { + "doc_count": 49, + "key": "185.100.87.136" + }, + { + "doc_count": 12, + "key": "185.247.225.201" + }, + { + "doc_count": 1, + "key": "37.228.129.67" + } + ], + "ports": [ + { + "doc_count": 25, + "key": 443 + }, + { + "doc_count": 12, + "key": 6882 + }, + { + "doc_count": 10, + "key": 8443 + }, + { + "doc_count": 8, + "key": 22 + }, + { + "doc_count": 6, + "key": 2222 + }, + { + "doc_count": 1, + "key": 0 + } + ] + }, + "AS30823": { + "name": "AUROLOGIC", + "ips": [ + { + "doc_count": 9, + "key": "45.153.243.249" + } + ], + "ports": [ + { + "doc_count": 9, + "key": 22 + } + ] + }, + "AS140666": { + "name": "ADPL-AS-AP", + "ips": [], + "ports": [] + }, + "AS214351": { + "name": "FEMOIT", + "ips": [ + { + "doc_count": 4, + "key": "62.60.226.150" + } + ], + "ports": [ + { + "doc_count": 4, + "key": 1723 + } + ] + }, + "AS198953": { + "name": "PROTON66", + "ips": [ + { + "doc_count": 2192, + "key": "176.120.22.61" + }, + { + "doc_count": 91, + "key": "176.120.22.43" + }, + { + "doc_count": 28, + "key": "193.143.1.66" + }, + { + "doc_count": 13, + "key": "176.120.22.123" + }, + { + "doc_count": 3, + "key": "37.77.150.241" + } + ], + "ports": [ + { + "doc_count": 795, + "key": 2222 + }, + { + "doc_count": 795, + "key": 22222 + }, + { + "doc_count": 41, + "key": 443 + }, + { + "doc_count": 26, + "key": 4433 + }, + { + "doc_count": 25, + "key": 4443 + }, + { + "doc_count": 25, + "key": 10443 + }, + { + "doc_count": 22, + "key": 8001 + }, + { + "doc_count": 21, + "key": 1433 + }, + { + "doc_count": 21, + "key": 1434 + }, + { + "doc_count": 21, + "key": 1500 + }, + { + "doc_count": 21, + "key": 1501 + }, + { + "doc_count": 21, + "key": 1800 + }, + { + "doc_count": 21, + "key": 2008 + }, + { + "doc_count": 21, + "key": 3005 + }, + { + "doc_count": 21, + "key": 3333 + }, + { + "doc_count": 21, + "key": 5000 + }, + { + "doc_count": 21, + "key": 5678 + }, + { + "doc_count": 21, + "key": 6000 + }, + { + "doc_count": 21, + "key": 6001 + }, + { + "doc_count": 21, + "key": 7788 + } + ] + }, + "AS200593": { + "name": "PROSPERO-AS", + "ips": [ + { + "doc_count": 2, + "key": "91.215.85.142" + } + ], + "ports": [ + { + "doc_count": 2, + "key": 22 + } + ] + }, + "AS214940": { + "name": "KPRONET", + "ips": [ + { + "doc_count": 39, + "key": "77.83.39.6" + }, + { + "doc_count": 26, + "key": "77.83.39.94" + }, + { + "doc_count": 17, + "key": "77.83.39.112" + }, + { + "doc_count": 10, + "key": "77.83.39.239" + }, + { + "doc_count": 9, + "key": "77.83.39.17" + }, + { + "doc_count": 7, + "key": "77.83.39.60" + }, + { + "doc_count": 6, + "key": "77.83.39.4" + }, + { + "doc_count": 6, + "key": "77.83.39.118" + }, + { + "doc_count": 6, + "key": "77.83.39.147" + }, + { + "doc_count": 5, + "key": "77.83.39.101" + }, + { + "doc_count": 5, + "key": "77.83.39.217" + }, + { + "doc_count": 3, + "key": "77.83.39.99" + }, + { + "doc_count": 3, + "key": "77.83.39.226" + }, + { + "doc_count": 2, + "key": "77.83.39.89" + }, + { + "doc_count": 2, + "key": "77.83.39.122" + }, + { + "doc_count": 1, + "key": "77.83.39.95" + }, + { + "doc_count": 1, + "key": "77.83.39.108" + }, + { + "doc_count": 1, + "key": "77.83.39.119" + }, + { + "doc_count": 1, + "key": "77.83.39.151" + }, + { + "doc_count": 1, + "key": "77.83.39.235" + } + ], + "ports": [ + { + "doc_count": 80, + "key": 2222 + }, + { + "doc_count": 33, + "key": 443 + }, + { + "doc_count": 32, + "key": 80 + }, + { + "doc_count": 7, + "key": 465 + }, + { + "doc_count": 1, + "key": 25 + } + ] + }, + "AS206728": { + "name": "MEDIALAND-AS", + "ips": [], + "ports": [] + }, + "AS211720": { + "name": "Datashield", + "ips": [ + { + "doc_count": 51, + "key": "185.231.33.46" + } + ], + "ports": [ + { + "doc_count": 6, + "key": 21 + }, + { + "doc_count": 6, + "key": 30443 + }, + { + "doc_count": 6, + "key": 40443 + }, + { + "doc_count": 3, + "key": 4430 + }, + { + "doc_count": 3, + "key": 4444 + }, + { + "doc_count": 3, + "key": 5443 + }, + { + "doc_count": 3, + "key": 6443 + }, + { + "doc_count": 3, + "key": 9443 + }, + { + "doc_count": 3, + "key": 60443 + }, + { + "doc_count": 2, + "key": 443 + }, + { + "doc_count": 2, + "key": 4433 + }, + { + "doc_count": 2, + "key": 4443 + }, + { + "doc_count": 2, + "key": 7443 + }, + { + "doc_count": 2, + "key": 8443 + }, + { + "doc_count": 2, + "key": 10443 + }, + { + "doc_count": 2, + "key": 50443 + }, + { + "doc_count": 1, + "key": 444 + } + ] + }, + "AS216309": { + "name": "INVISIONTECH-GROUP-SRL", + "ips": [], + "ports": [] + }, + "AS58854": { + "name": "KAOPY", + "ips": [], + "ports": [] + }, + "AS202685": { + "name": "TR-ARKEL", + "ips": [], + "ports": [] + }, + "AS394711": { + "name": "KORGRID", + "ips": [], + "ports": [] + } +} \ No newline at end of file diff --git a/kevlar/2026-09-07/honeylabs/asn-enrichments.json b/kevlar/2026-09-07/honeylabs/asn-enrichments.json new file mode 100644 index 0000000..7e50be2 --- /dev/null +++ b/kevlar/2026-09-07/honeylabs/asn-enrichments.json @@ -0,0 +1,314 @@ +[ + { + "asn": "AS51396", + "name": "PFCLOUD", + "res": { + "asn_number": 51396, + "org_name": "Pfcloud UG (haftungsbeschrankt)", + "total_events": 8500, + "unique_ips": 49, + "first_seen": "2026-08-31T00:00:25", + "last_seen": "2026-09-06T23:58:26", + "top_ports": [ + 8080, + 8888, + 3128, + 25565, + 1081, + 888, + 1080, + 80, + 4145, + 8000 + ], + "top_protocols": [ + "", + "tls" + ], + "source_countries": [ + "NL", + "DE", + "UA" + ], + "top_source_ips": [ + { + "source_ip": "204.76.203.222", + "events": 1159 + }, + { + "source_ip": "204.76.203.221", + "events": 1154 + }, + { + "source_ip": "204.76.203.213", + "events": 1123 + }, + { + "source_ip": "204.76.203.214", + "events": 1091 + }, + { + "source_ip": "204.76.203.49", + "events": 836 + }, + { + "source_ip": "176.65.148.153", + "events": 453 + }, + { + "source_ip": "204.76.203.7", + "events": 446 + }, + { + "source_ip": "45.135.193.193", + "events": 400 + }, + { + "source_ip": "45.135.194.113", + "events": 220 + }, + { + "source_ip": "45.135.193.198", + "events": 200 + } + ] + } + }, + { + "asn": "AS198953", + "name": "PROTON66", + "res": { + "asn_number": 198953, + "org_name": "Proton66 OOO", + "total_events": 1669, + "unique_ips": 4, + "first_seen": "2026-08-31T09:44:36", + "last_seen": "2026-09-06T14:40:21", + "top_ports": [ + 4443, + 3389, + 8443, + 10443, + 35366, + 25366, + 5539, + 37628, + 16433, + 55366 + ], + "top_protocols": [ + "", + "tls" + ], + "source_countries": [ + "RU" + ], + "top_source_ips": [ + { + "source_ip": "176.120.22.61", + "events": 1597 + }, + { + "source_ip": "176.120.22.240", + "events": 45 + }, + { + "source_ip": "193.143.1.66", + "events": 24 + }, + { + "source_ip": "176.120.22.147", + "events": 3 + } + ] + } + }, + { + "asn": "AS14956", + "name": "ROUTERHOSTING", + "res": { + "asn_number": 14956, + "org_name": "RouterHosting LLC", + "total_events": 95, + "unique_ips": 12, + "first_seen": "2026-09-01T07:55:37", + "last_seen": "2026-09-06T15:51:16", + "top_ports": [ + 445, + 8008, + 2095, + 443, + 1723, + 7860, + 5061 + ], + "top_protocols": [ + "", + "tls" + ], + "source_countries": [ + "US" + ], + "top_source_ips": [ + { + "source_ip": "45.61.157.82", + "events": 32 + }, + { + "source_ip": "144.172.108.79", + "events": 24 + }, + { + "source_ip": "144.172.99.200", + "events": 16 + }, + { + "source_ip": "216.126.239.215", + "events": 8 + }, + { + "source_ip": "167.88.168.121", + "events": 4 + }, + { + "source_ip": "45.61.183.10", + "events": 4 + }, + { + "source_ip": "144.172.112.11", + "events": 2 + }, + { + "source_ip": "216.126.227.187", + "events": 1 + }, + { + "source_ip": "45.61.149.189", + "events": 1 + }, + { + "source_ip": "144.172.99.12", + "events": 1 + } + ] + } + }, + { + "asn": "AS210644", + "name": "AEZA-AS", + "res": { + "asn_number": 210644, + "org_name": "Aeza Group LLC", + "total_events": 51, + "unique_ips": 1, + "first_seen": "2026-08-31T22:44:34", + "last_seen": "2026-09-02T15:29:27", + "top_ports": [ + 443, + 2222, + 2375 + ], + "top_protocols": [ + "tls", + "" + ], + "source_countries": [ + "NL" + ], + "top_source_ips": [ + { + "source_ip": "185.246.217.150", + "events": 51 + } + ] + } + }, + { + "asn": "AS51852", + "name": "PLI-AS", + "res": { + "asn_number": 51852, + "org_name": "Private Layer INC", + "total_events": 32, + "unique_ips": 5, + "first_seen": "2026-08-31T15:32:52", + "last_seen": "2026-09-04T19:27:10", + "top_ports": [ + 8443, + 2087, + 1723, + 80, + 32400, + 443, + 8085 + ], + "top_protocols": [ + "", + "tls" + ], + "source_countries": [ + "CH" + ], + "top_source_ips": [ + { + "source_ip": "179.43.150.26", + "events": 16 + }, + { + "source_ip": "46.19.142.226", + "events": 6 + }, + { + "source_ip": "141.255.165.66", + "events": 5 + }, + { + "source_ip": "179.43.186.220", + "events": 3 + }, + { + "source_ip": "179.43.146.27", + "events": 2 + } + ] + } + }, + { + "asn": "AS57043", + "name": "HOSTKEY-AS", + "res": { + "asn_number": 57043, + "org_name": "Hostkey B.v.", + "total_events": 12, + "unique_ips": 2, + "first_seen": "2026-08-31T15:39:39", + "last_seen": "2026-09-03T03:47:57", + "top_ports": [ + 22, + 19571, + 42481, + 5070, + 44981, + 20271, + 14603 + ], + "top_protocols": [ + "" + ], + "source_countries": [ + "GB", + "DE" + ], + "top_source_ips": [ + { + "source_ip": "163.5.16.6", + "events": 8 + }, + { + "source_ip": "82.39.165.100", + "events": 4 + } + ] + } + } +] \ No newline at end of file diff --git a/kevlar/2026-09-07/honeylabs/events-AS138915.ndjson b/kevlar/2026-09-07/honeylabs/events-AS138915.ndjson new file mode 100644 index 0000000..e69de29 diff --git a/kevlar/2026-09-07/honeylabs/events-AS140666.ndjson b/kevlar/2026-09-07/honeylabs/events-AS140666.ndjson new file mode 100644 index 0000000..e69de29 diff --git a/kevlar/2026-09-07/honeylabs/events-AS14956.ndjson b/kevlar/2026-09-07/honeylabs/events-AS14956.ndjson new file mode 100644 index 0000000..455e751 --- /dev/null +++ b/kevlar/2026-09-07/honeylabs/events-AS14956.ndjson @@ -0,0 +1,95 @@ +{"timestamp":"2026-09-06T15:51:16","event_id":"60a28c68-17ac-4150-93c5-9686d637062e","source_ip":"45.61.149.189","source_port":58528,"source_domain":"189.149.61.45.static.cloudzy.com","country_code":"US","country_name":"United States","city_name":"Las Vegas","asn_number":14956,"asn_org":"RouterHosting LLC","dest_port":443,"network_protocol":"tls","application_protocol":"http","http_method":"GET","user_agent":"Python-urllib/3.13","url_path":"/webclient/","url_domain":"","http_request_headers":"{\"accept-encoding\":\"identity\",\"connection\":\"close\",\"host\":\":443\",\"user-agent\":\"Python-urllib/3.13\"}","ssh_client_hassh":"","tls_client_ja4":"t13i181000_85036bcba153_d41ae481755e","tls_client_ja3":"8a9d5d0f12f7d43ee3af1c51d2998d99","tls_client_version":"TLSv1.3","tls_client_cipher":"TLS_AES_128_GCM_SHA256","http_request_ja4h":"ge11nn0400_8fd06a127c33","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":132,"dest_bytes":78,"network_bytes":210,"event_summary":""} +{"timestamp":"2026-09-06T06:25:29","event_id":"bd943251-32d5-4e1d-90d5-01656ab58633","source_ip":"45.61.183.10","source_port":37524,"source_domain":"10.183.61.45.static.cloudzy.com","country_code":"US","country_name":"United States","city_name":"Las Vegas","asn_number":14956,"asn_org":"RouterHosting LLC","dest_port":445,"network_protocol":"","application_protocol":"smbv23","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":142,"dest_bytes":12,"network_bytes":154,"event_summary":"\u0000\u0000\u0000��SMB@\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000@\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000$\u0000\u0003\u0000\u0001\u0000\u0000\u0000\u0004\u0000\u0000\u0000\u0002�\\��[���5tP/\r��p\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0010\u0002\u0000\u0003\u0002\u0003\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0004\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0001\u0000\u0002\u0000\u0006\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0002\u0000\u0001\u0000"} +{"timestamp":"2026-09-06T02:17:58","event_id":"70e2b966-aa82-4a04-a97d-1af22a9b0b98","source_ip":"45.61.183.10","source_port":52936,"source_domain":"10.183.61.45.static.cloudzy.com","country_code":"US","country_name":"United States","city_name":"Las Vegas","asn_number":14956,"asn_org":"RouterHosting LLC","dest_port":445,"network_protocol":"","application_protocol":"smbv23","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":142,"dest_bytes":12,"network_bytes":154,"event_summary":"\u0000\u0000\u0000��SMB@\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000@\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000$\u0000\u0003\u0000\u0001\u0000\u0000\u0000\u0004\u0000\u0000\u0000�2�0�|c�z�'�F�B�p\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0010\u0002\u0000\u0003\u0002\u0003\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0004\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0001\u0000\u0002\u0000\u0006\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0002\u0000\u0001\u0000"} +{"timestamp":"2026-09-06T01:13:22","event_id":"41d0618e-ab40-43ae-ae62-97316c0d5916","source_ip":"45.61.183.10","source_port":41348,"source_domain":"10.183.61.45.static.cloudzy.com","country_code":"US","country_name":"United States","city_name":"Las Vegas","asn_number":14956,"asn_org":"RouterHosting LLC","dest_port":445,"network_protocol":"","application_protocol":"smbv23","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":142,"dest_bytes":12,"network_bytes":154,"event_summary":"\u0000\u0000\u0000��SMB@\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000@\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000$\u0000\u0003\u0000\u0001\u0000\u0000\u0000\u0004\u0000\u0000\u0000�\u001fS\u0010�1��c�\t�fsC\u0004p\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0010\u0002\u0000\u0003\u0002\u0003\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0004\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0001\u0000\u0002\u0000\u0006\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0002\u0000\u0001\u0000"} +{"timestamp":"2026-09-06T01:13:05","event_id":"6ced3596-6160-4283-b0c0-81164d97d976","source_ip":"45.61.183.10","source_port":53466,"source_domain":"10.183.61.45.static.cloudzy.com","country_code":"US","country_name":"United States","city_name":"Las Vegas","asn_number":14956,"asn_org":"RouterHosting LLC","dest_port":445,"network_protocol":"","application_protocol":"smbv23","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":142,"dest_bytes":12,"network_bytes":154,"event_summary":"\u0000\u0000\u0000��SMB@\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000@\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000$\u0000\u0003\u0000\u0001\u0000\u0000\u0000\u0004\u0000\u0000\u00008\u0006�/�XYjGr��X�6Dp\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0010\u0002\u0000\u0003\u0002\u0003\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0004\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0001\u0000\u0002\u0000\u0006\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0002\u0000\u0001\u0000"} +{"timestamp":"2026-09-06T00:12:34","event_id":"374ee997-5a95-4cf5-95f2-8178c771afb2","source_ip":"216.126.239.215","source_port":62508,"source_domain":"215.239.126.216.static.cloudzy.com","country_code":"US","country_name":"United States","city_name":"Ogden","asn_number":14956,"asn_org":"RouterHosting LLC","dest_port":445,"network_protocol":"","application_protocol":"smbv1","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":4,"event_duration":497000000,"source_bytes":455,"dest_bytes":60,"network_bytes":515,"event_summary":"\u0000\u0000\u0000N�SMB2\u0000\u0000\u0000\u0000\u0018\u0007�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000��\u0000\u0000A\u0000\u000f\f\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u00014�\u0000\u0000\u0000\f\u0000B\u0000\u0000\u0000N\u0000\u0001\u0000\u000e\u0000\r\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000"} +{"timestamp":"2026-09-06T00:12:34","event_id":"374ee997-5a95-4cf5-95f2-8178c771afb2","source_ip":"216.126.239.215","source_port":62508,"source_domain":"215.239.126.216.static.cloudzy.com","country_code":"US","country_name":"United States","city_name":"Ogden","asn_number":14956,"asn_org":"RouterHosting LLC","dest_port":445,"network_protocol":"","application_protocol":"smbv1","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":3,"event_duration":364000000,"source_bytes":373,"dest_bytes":45,"network_bytes":418,"event_summary":"\u0000\u0000\u0000\\�SMBu\u0000\u0000\u0000\u0000\u0018\u0007�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000��\u0000\u0000@\u0000\u0004�\u0000\\\u0000\b\u0000\u0001\u00001\u0000\u0000\\\u0000\\\u00001\u00009\u00002\u0000.\u00001\u00006\u00008\u0000.\u00005\u00006\u0000.\u00002\u00000\u0000\\\u0000I\u0000P\u0000C\u0000$\u0000\u0000\u0000?????\u0000"} +{"timestamp":"2026-09-06T00:12:34","event_id":"374ee997-5a95-4cf5-95f2-8178c771afb2","source_ip":"216.126.239.215","source_port":62508,"source_domain":"215.239.126.216.static.cloudzy.com","country_code":"US","country_name":"United States","city_name":"Ogden","asn_number":14956,"asn_org":"RouterHosting LLC","dest_port":445,"network_protocol":"","application_protocol":"smbv1","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":2,"event_duration":232000000,"source_bytes":277,"dest_bytes":30,"network_bytes":307,"event_summary":"\u0000\u0000\u0000��SMBs\u0000\u0000\u0000\u0000\u0018\u0007�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000��\u0000\u0000@\u0000\r�\u0000�\u0000\u0004\u0011\n\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000�\u0000\u0000\u0000K\u0000\u0000\u0000\u0000\u0000\u0000W\u0000i\u0000n\u0000d\u0000o\u0000w\u0000s\u0000 \u00002\u00000\u00000\u00000\u0000 \u00002\u00001\u00009\u00005\u0000\u0000\u0000W\u0000i\u0000n\u0000d\u0000o\u0000w\u0000s\u0000 \u00002\u00000\u00000\u00000\u0000 \u00005\u0000.\u00000\u0000\u0000\u0000"} +{"timestamp":"2026-09-06T00:12:34","event_id":"374ee997-5a95-4cf5-95f2-8178c771afb2","source_ip":"216.126.239.215","source_port":62508,"source_domain":"215.239.126.216.static.cloudzy.com","country_code":"US","country_name":"United States","city_name":"Ogden","asn_number":14956,"asn_org":"RouterHosting LLC","dest_port":445,"network_protocol":"","application_protocol":"","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":137,"dest_bytes":15,"network_bytes":152,"event_summary":"\u0000\u0000\u0000��SMBr\u0000\u0000\u0000\u0000\u0018S�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000��\u0000\u0000@\u0000\u0000b\u0000\u0002PC NETWORK PROGRAM 1.0\u0000\u0002LANMAN1.0\u0000\u0002Windows for Workgroups 3.1a\u0000\u0002LM1.2X002\u0000\u0002LANMAN2.1\u0000\u0002NT LM 0.12\u0000"} +{"timestamp":"2026-09-06T00:12:31","event_id":"f593bc88-9d56-4927-8715-6bcfa06c951c","source_ip":"216.126.239.215","source_port":61658,"source_domain":"215.239.126.216.static.cloudzy.com","country_code":"US","country_name":"United States","city_name":"Ogden","asn_number":14956,"asn_org":"RouterHosting LLC","dest_port":445,"network_protocol":"","application_protocol":"smbv1","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":4,"event_duration":575000000,"source_bytes":364,"dest_bytes":60,"network_bytes":424,"event_summary":"\u0000\u0000\u0000J�SMB%\u0000\u0000\u0000\u0000\u0018\u0001(\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0010\u0000\u0000\u0000\u0000����\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000J\u0000\u0000\u0000J\u0000\u0002\u0000#\u0000\u0000\u0000\u0007\u0000\\PIPE\\\u0000"} +{"timestamp":"2026-09-06T00:12:30","event_id":"f593bc88-9d56-4927-8715-6bcfa06c951c","source_ip":"216.126.239.215","source_port":61658,"source_domain":"215.239.126.216.static.cloudzy.com","country_code":"US","country_name":"United States","city_name":"Ogden","asn_number":14956,"asn_org":"RouterHosting LLC","dest_port":445,"network_protocol":"","application_protocol":"smbv1","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":3,"event_duration":443000000,"source_bytes":286,"dest_bytes":45,"network_bytes":331,"event_summary":"\u0000\u0000\u0000[�SMBu\u0000\u0000\u0000\u0000\u0018\u0001 \u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000/K\u0000\u0000�^\u0004�\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u001c\u0000\u0000\\\\216.126.239.170\\IPC$\u0000?????\u0000TH_REPLACE__?????\u0000"} +{"timestamp":"2026-09-06T00:12:30","event_id":"f593bc88-9d56-4927-8715-6bcfa06c951c","source_ip":"216.126.239.215","source_port":61658,"source_domain":"215.239.126.216.static.cloudzy.com","country_code":"US","country_name":"United States","city_name":"Ogden","asn_number":14956,"asn_org":"RouterHosting LLC","dest_port":445,"network_protocol":"","application_protocol":"smbv1","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":2,"event_duration":232000000,"source_bytes":191,"dest_bytes":30,"network_bytes":221,"event_summary":"\u0000\u0000\u0000c�SMBs\u0000\u0000\u0000\u0000\u0018\u0001 \u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000/K\u0000\u0000�^\r�\u0000\u0000\u0000��\u0002\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000@\u0000\u0000\u0000&\u0000\u0000.\u0000Windows 2000 2195\u0000Windows 2000 5.0\u0000"} +{"timestamp":"2026-09-06T00:12:30","event_id":"f593bc88-9d56-4927-8715-6bcfa06c951c","source_ip":"216.126.239.215","source_port":61658,"source_domain":"215.239.126.216.static.cloudzy.com","country_code":"US","country_name":"United States","city_name":"Ogden","asn_number":14956,"asn_org":"RouterHosting LLC","dest_port":445,"network_protocol":"","application_protocol":"","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":88,"dest_bytes":15,"network_bytes":103,"event_summary":"\u0000\u0000\u0000T�SMBr\u0000\u0000\u0000\u0000\u0018\u0001(\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000/K\u0000\u0000�^\u00001\u0000\u0002LANMAN1.0\u0000\u0002LM1.2X002\u0000\u0002NT LANMAN 1.0\u0000\u0002NT LM 0.12\u0000"} +{"timestamp":"2026-09-05T02:54:19","event_id":"51632da8-f7f7-4da2-b0b4-0c8d814f1af6","source_ip":"144.172.108.79","source_port":53083,"source_domain":"79.108.172.144.static.cloudzy.com","country_code":"US","country_name":"United States","city_name":"Las Vegas","asn_number":14956,"asn_org":"RouterHosting LLC","dest_port":445,"network_protocol":"","application_protocol":"smbv1","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":4,"event_duration":498000000,"source_bytes":455,"dest_bytes":56,"network_bytes":511,"event_summary":"\u0000\u0000\u0000N�SMB2\u0000\u0000\u0000\u0000\u0018\u0007�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000��\u0000\u0000A\u0000\u000f\f\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u00014�\u0000\u0000\u0000\f\u0000B\u0000\u0000\u0000N\u0000\u0001\u0000\u000e\u0000\r\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000"} +{"timestamp":"2026-09-05T02:54:19","event_id":"51632da8-f7f7-4da2-b0b4-0c8d814f1af6","source_ip":"144.172.108.79","source_port":53083,"source_domain":"79.108.172.144.static.cloudzy.com","country_code":"US","country_name":"United States","city_name":"Las Vegas","asn_number":14956,"asn_org":"RouterHosting LLC","dest_port":445,"network_protocol":"","application_protocol":"smbv1","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":3,"event_duration":366000000,"source_bytes":373,"dest_bytes":42,"network_bytes":415,"event_summary":"\u0000\u0000\u0000\\�SMBu\u0000\u0000\u0000\u0000\u0018\u0007�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000��\u0000\u0000@\u0000\u0004�\u0000\\\u0000\b\u0000\u0001\u00001\u0000\u0000\\\u0000\\\u00001\u00009\u00002\u0000.\u00001\u00006\u00008\u0000.\u00005\u00006\u0000.\u00002\u00000\u0000\\\u0000I\u0000P\u0000C\u0000$\u0000\u0000\u0000?????\u0000"} +{"timestamp":"2026-09-05T02:54:19","event_id":"51632da8-f7f7-4da2-b0b4-0c8d814f1af6","source_ip":"144.172.108.79","source_port":53083,"source_domain":"79.108.172.144.static.cloudzy.com","country_code":"US","country_name":"United States","city_name":"Las Vegas","asn_number":14956,"asn_org":"RouterHosting LLC","dest_port":445,"network_protocol":"","application_protocol":"smbv1","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":2,"event_duration":233000000,"source_bytes":277,"dest_bytes":28,"network_bytes":305,"event_summary":"\u0000\u0000\u0000��SMBs\u0000\u0000\u0000\u0000\u0018\u0007�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000��\u0000\u0000@\u0000\r�\u0000�\u0000\u0004\u0011\n\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000�\u0000\u0000\u0000K\u0000\u0000\u0000\u0000\u0000\u0000W\u0000i\u0000n\u0000d\u0000o\u0000w\u0000s\u0000 \u00002\u00000\u00000\u00000\u0000 \u00002\u00001\u00009\u00005\u0000\u0000\u0000W\u0000i\u0000n\u0000d\u0000o\u0000w\u0000s\u0000 \u00002\u00000\u00000\u00000\u0000 \u00005\u0000.\u00000\u0000\u0000\u0000"} +{"timestamp":"2026-09-05T02:54:19","event_id":"51632da8-f7f7-4da2-b0b4-0c8d814f1af6","source_ip":"144.172.108.79","source_port":53083,"source_domain":"79.108.172.144.static.cloudzy.com","country_code":"US","country_name":"United States","city_name":"Las Vegas","asn_number":14956,"asn_org":"RouterHosting LLC","dest_port":445,"network_protocol":"","application_protocol":"","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":137,"dest_bytes":14,"network_bytes":151,"event_summary":"\u0000\u0000\u0000��SMBr\u0000\u0000\u0000\u0000\u0018S�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000��\u0000\u0000@\u0000\u0000b\u0000\u0002PC NETWORK PROGRAM 1.0\u0000\u0002LANMAN1.0\u0000\u0002Windows for Workgroups 3.1a\u0000\u0002LM1.2X002\u0000\u0002LANMAN2.1\u0000\u0002NT LM 0.12\u0000"} +{"timestamp":"2026-09-05T02:54:16","event_id":"ef0d1806-55ce-4c77-82b9-5492b2b7647f","source_ip":"144.172.108.79","source_port":52284,"source_domain":"79.108.172.144.static.cloudzy.com","country_code":"US","country_name":"United States","city_name":"Las Vegas","asn_number":14956,"asn_org":"RouterHosting LLC","dest_port":445,"network_protocol":"","application_protocol":"smbv1","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":4,"event_duration":501000000,"source_bytes":364,"dest_bytes":56,"network_bytes":420,"event_summary":"\u0000\u0000\u0000J�SMB%\u0000\u0000\u0000\u0000\u0018\u0001(\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0010\u0000\u0000\u0000\u0000����\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000J\u0000\u0000\u0000J\u0000\u0002\u0000#\u0000\u0000\u0000\u0007\u0000\\PIPE\\\u0000"} +{"timestamp":"2026-09-05T02:54:15","event_id":"ef0d1806-55ce-4c77-82b9-5492b2b7647f","source_ip":"144.172.108.79","source_port":52284,"source_domain":"79.108.172.144.static.cloudzy.com","country_code":"US","country_name":"United States","city_name":"Las Vegas","asn_number":14956,"asn_org":"RouterHosting LLC","dest_port":445,"network_protocol":"","application_protocol":"smbv1","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":3,"event_duration":366000000,"source_bytes":286,"dest_bytes":42,"network_bytes":328,"event_summary":"\u0000\u0000\u0000[�SMBu\u0000\u0000\u0000\u0000\u0018\u0001 \u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000/K\u0003x�^\u0004�\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u001c\u0000\u0000\\\\144.172.108.181\\IPC$\u0000?????\u0000TH_REPLACE__?????\u0000"} +{"timestamp":"2026-09-05T02:54:15","event_id":"ef0d1806-55ce-4c77-82b9-5492b2b7647f","source_ip":"144.172.108.79","source_port":52284,"source_domain":"79.108.172.144.static.cloudzy.com","country_code":"US","country_name":"United States","city_name":"Las Vegas","asn_number":14956,"asn_org":"RouterHosting LLC","dest_port":445,"network_protocol":"","application_protocol":"smbv1","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":2,"event_duration":233000000,"source_bytes":191,"dest_bytes":28,"network_bytes":219,"event_summary":"\u0000\u0000\u0000c�SMBs\u0000\u0000\u0000\u0000\u0018\u0001 \u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000/K\u0000\u0000�^\r�\u0000\u0000\u0000��\u0002\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000@\u0000\u0000\u0000&\u0000\u0000.\u0000Windows 2000 2195\u0000Windows 2000 5.0\u0000"} +{"timestamp":"2026-09-05T02:54:15","event_id":"ef0d1806-55ce-4c77-82b9-5492b2b7647f","source_ip":"144.172.108.79","source_port":52284,"source_domain":"79.108.172.144.static.cloudzy.com","country_code":"US","country_name":"United States","city_name":"Las Vegas","asn_number":14956,"asn_org":"RouterHosting LLC","dest_port":445,"network_protocol":"","application_protocol":"","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":88,"dest_bytes":14,"network_bytes":102,"event_summary":"\u0000\u0000\u0000T�SMBr\u0000\u0000\u0000\u0000\u0018\u0001(\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000/K\u0000\u0000�^\u00001\u0000\u0002LANMAN1.0\u0000\u0002LM1.2X002\u0000\u0002NT LANMAN 1.0\u0000\u0002NT LM 0.12\u0000"} +{"timestamp":"2026-09-04T23:12:54","event_id":"fea24ceb-573f-45a5-8ab6-bf1e2b61af69","source_ip":"144.172.108.79","source_port":53115,"source_domain":"79.108.172.144.static.cloudzy.com","country_code":"US","country_name":"United States","city_name":"Las Vegas","asn_number":14956,"asn_org":"RouterHosting LLC","dest_port":445,"network_protocol":"","application_protocol":"smbv1","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":4,"event_duration":498000000,"source_bytes":455,"dest_bytes":56,"network_bytes":511,"event_summary":"\u0000\u0000\u0000N�SMB2\u0000\u0000\u0000\u0000\u0018\u0007�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000��\u0000\u0000A\u0000\u000f\f\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u00014�\u0000\u0000\u0000\f\u0000B\u0000\u0000\u0000N\u0000\u0001\u0000\u000e\u0000\r\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000"} +{"timestamp":"2026-09-04T23:12:54","event_id":"fea24ceb-573f-45a5-8ab6-bf1e2b61af69","source_ip":"144.172.108.79","source_port":53115,"source_domain":"79.108.172.144.static.cloudzy.com","country_code":"US","country_name":"United States","city_name":"Las Vegas","asn_number":14956,"asn_org":"RouterHosting LLC","dest_port":445,"network_protocol":"","application_protocol":"smbv1","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":3,"event_duration":365000000,"source_bytes":373,"dest_bytes":42,"network_bytes":415,"event_summary":"\u0000\u0000\u0000\\�SMBu\u0000\u0000\u0000\u0000\u0018\u0007�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000��\u0000\u0000@\u0000\u0004�\u0000\\\u0000\b\u0000\u0001\u00001\u0000\u0000\\\u0000\\\u00001\u00009\u00002\u0000.\u00001\u00006\u00008\u0000.\u00005\u00006\u0000.\u00002\u00000\u0000\\\u0000I\u0000P\u0000C\u0000$\u0000\u0000\u0000?????\u0000"} +{"timestamp":"2026-09-04T23:12:53","event_id":"fea24ceb-573f-45a5-8ab6-bf1e2b61af69","source_ip":"144.172.108.79","source_port":53115,"source_domain":"79.108.172.144.static.cloudzy.com","country_code":"US","country_name":"United States","city_name":"Las Vegas","asn_number":14956,"asn_org":"RouterHosting LLC","dest_port":445,"network_protocol":"","application_protocol":"smbv1","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":2,"event_duration":233000000,"source_bytes":277,"dest_bytes":28,"network_bytes":305,"event_summary":"\u0000\u0000\u0000��SMBs\u0000\u0000\u0000\u0000\u0018\u0007�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000��\u0000\u0000@\u0000\r�\u0000�\u0000\u0004\u0011\n\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000�\u0000\u0000\u0000K\u0000\u0000\u0000\u0000\u0000\u0000W\u0000i\u0000n\u0000d\u0000o\u0000w\u0000s\u0000 \u00002\u00000\u00000\u00000\u0000 \u00002\u00001\u00009\u00005\u0000\u0000\u0000W\u0000i\u0000n\u0000d\u0000o\u0000w\u0000s\u0000 \u00002\u00000\u00000\u00000\u0000 \u00005\u0000.\u00000\u0000\u0000\u0000"} +{"timestamp":"2026-09-04T23:12:53","event_id":"fea24ceb-573f-45a5-8ab6-bf1e2b61af69","source_ip":"144.172.108.79","source_port":53115,"source_domain":"79.108.172.144.static.cloudzy.com","country_code":"US","country_name":"United States","city_name":"Las Vegas","asn_number":14956,"asn_org":"RouterHosting LLC","dest_port":445,"network_protocol":"","application_protocol":"","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":137,"dest_bytes":14,"network_bytes":151,"event_summary":"\u0000\u0000\u0000��SMBr\u0000\u0000\u0000\u0000\u0018S�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000��\u0000\u0000@\u0000\u0000b\u0000\u0002PC NETWORK PROGRAM 1.0\u0000\u0002LANMAN1.0\u0000\u0002Windows for Workgroups 3.1a\u0000\u0002LM1.2X002\u0000\u0002LANMAN2.1\u0000\u0002NT LM 0.12\u0000"} +{"timestamp":"2026-09-04T23:12:50","event_id":"9ca8884d-0c99-49d9-9f7b-52f17a154c52","source_ip":"144.172.108.79","source_port":52278,"source_domain":"79.108.172.144.static.cloudzy.com","country_code":"US","country_name":"United States","city_name":"Las Vegas","asn_number":14956,"asn_org":"RouterHosting LLC","dest_port":445,"network_protocol":"","application_protocol":"smbv1","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":4,"event_duration":499000000,"source_bytes":364,"dest_bytes":56,"network_bytes":420,"event_summary":"\u0000\u0000\u0000J�SMB%\u0000\u0000\u0000\u0000\u0018\u0001(\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0010\u0000\u0000\u0000\u0000����\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000J\u0000\u0000\u0000J\u0000\u0002\u0000#\u0000\u0000\u0000\u0007\u0000\\PIPE\\\u0000"} +{"timestamp":"2026-09-04T23:12:50","event_id":"9ca8884d-0c99-49d9-9f7b-52f17a154c52","source_ip":"144.172.108.79","source_port":52278,"source_domain":"79.108.172.144.static.cloudzy.com","country_code":"US","country_name":"United States","city_name":"Las Vegas","asn_number":14956,"asn_org":"RouterHosting LLC","dest_port":445,"network_protocol":"","application_protocol":"smbv1","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":3,"event_duration":365000000,"source_bytes":286,"dest_bytes":42,"network_bytes":328,"event_summary":"\u0000\u0000\u0000[�SMBu\u0000\u0000\u0000\u0000\u0018\u0001 \u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000/K\u0003x�^\u0004�\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u001c\u0000\u0000\\\\144.172.108.181\\IPC$\u0000?????\u0000TH_REPLACE__?????\u0000"} +{"timestamp":"2026-09-04T23:12:50","event_id":"9ca8884d-0c99-49d9-9f7b-52f17a154c52","source_ip":"144.172.108.79","source_port":52278,"source_domain":"79.108.172.144.static.cloudzy.com","country_code":"US","country_name":"United States","city_name":"Las Vegas","asn_number":14956,"asn_org":"RouterHosting LLC","dest_port":445,"network_protocol":"","application_protocol":"smbv1","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":2,"event_duration":233000000,"source_bytes":191,"dest_bytes":28,"network_bytes":219,"event_summary":"\u0000\u0000\u0000c�SMBs\u0000\u0000\u0000\u0000\u0018\u0001 \u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000/K\u0000\u0000�^\r�\u0000\u0000\u0000��\u0002\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000@\u0000\u0000\u0000&\u0000\u0000.\u0000Windows 2000 2195\u0000Windows 2000 5.0\u0000"} +{"timestamp":"2026-09-04T23:12:50","event_id":"9ca8884d-0c99-49d9-9f7b-52f17a154c52","source_ip":"144.172.108.79","source_port":52278,"source_domain":"79.108.172.144.static.cloudzy.com","country_code":"US","country_name":"United States","city_name":"Las Vegas","asn_number":14956,"asn_org":"RouterHosting LLC","dest_port":445,"network_protocol":"","application_protocol":"","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":88,"dest_bytes":14,"network_bytes":102,"event_summary":"\u0000\u0000\u0000T�SMBr\u0000\u0000\u0000\u0000\u0018\u0001(\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000/K\u0000\u0000�^\u00001\u0000\u0002LANMAN1.0\u0000\u0002LM1.2X002\u0000\u0002NT LANMAN 1.0\u0000\u0002NT LM 0.12\u0000"} +{"timestamp":"2026-09-04T20:03:03","event_id":"016a1ac2-b401-4143-8727-fa7b70814ba5","source_ip":"144.172.108.79","source_port":62111,"source_domain":"79.108.172.144.static.cloudzy.com","country_code":"US","country_name":"United States","city_name":"Las Vegas","asn_number":14956,"asn_org":"RouterHosting LLC","dest_port":445,"network_protocol":"","application_protocol":"smbv1","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":4,"event_duration":498000000,"source_bytes":455,"dest_bytes":56,"network_bytes":511,"event_summary":"\u0000\u0000\u0000N�SMB2\u0000\u0000\u0000\u0000\u0018\u0007�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000��\u0000\u0000A\u0000\u000f\f\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u00014�\u0000\u0000\u0000\f\u0000B\u0000\u0000\u0000N\u0000\u0001\u0000\u000e\u0000\r\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000"} +{"timestamp":"2026-09-04T20:03:02","event_id":"016a1ac2-b401-4143-8727-fa7b70814ba5","source_ip":"144.172.108.79","source_port":62111,"source_domain":"79.108.172.144.static.cloudzy.com","country_code":"US","country_name":"United States","city_name":"Las Vegas","asn_number":14956,"asn_org":"RouterHosting LLC","dest_port":445,"network_protocol":"","application_protocol":"smbv1","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":3,"event_duration":365000000,"source_bytes":373,"dest_bytes":42,"network_bytes":415,"event_summary":"\u0000\u0000\u0000\\�SMBu\u0000\u0000\u0000\u0000\u0018\u0007�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000��\u0000\u0000@\u0000\u0004�\u0000\\\u0000\b\u0000\u0001\u00001\u0000\u0000\\\u0000\\\u00001\u00009\u00002\u0000.\u00001\u00006\u00008\u0000.\u00005\u00006\u0000.\u00002\u00000\u0000\\\u0000I\u0000P\u0000C\u0000$\u0000\u0000\u0000?????\u0000"} +{"timestamp":"2026-09-04T20:03:02","event_id":"016a1ac2-b401-4143-8727-fa7b70814ba5","source_ip":"144.172.108.79","source_port":62111,"source_domain":"79.108.172.144.static.cloudzy.com","country_code":"US","country_name":"United States","city_name":"Las Vegas","asn_number":14956,"asn_org":"RouterHosting LLC","dest_port":445,"network_protocol":"","application_protocol":"smbv1","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":2,"event_duration":233000000,"source_bytes":277,"dest_bytes":28,"network_bytes":305,"event_summary":"\u0000\u0000\u0000��SMBs\u0000\u0000\u0000\u0000\u0018\u0007�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000��\u0000\u0000@\u0000\r�\u0000�\u0000\u0004\u0011\n\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000�\u0000\u0000\u0000K\u0000\u0000\u0000\u0000\u0000\u0000W\u0000i\u0000n\u0000d\u0000o\u0000w\u0000s\u0000 \u00002\u00000\u00000\u00000\u0000 \u00002\u00001\u00009\u00005\u0000\u0000\u0000W\u0000i\u0000n\u0000d\u0000o\u0000w\u0000s\u0000 \u00002\u00000\u00000\u00000\u0000 \u00005\u0000.\u00000\u0000\u0000\u0000"} +{"timestamp":"2026-09-04T20:03:02","event_id":"016a1ac2-b401-4143-8727-fa7b70814ba5","source_ip":"144.172.108.79","source_port":62111,"source_domain":"79.108.172.144.static.cloudzy.com","country_code":"US","country_name":"United States","city_name":"Las Vegas","asn_number":14956,"asn_org":"RouterHosting LLC","dest_port":445,"network_protocol":"","application_protocol":"","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":137,"dest_bytes":14,"network_bytes":151,"event_summary":"\u0000\u0000\u0000��SMBr\u0000\u0000\u0000\u0000\u0018S�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000��\u0000\u0000@\u0000\u0000b\u0000\u0002PC NETWORK PROGRAM 1.0\u0000\u0002LANMAN1.0\u0000\u0002Windows for Workgroups 3.1a\u0000\u0002LM1.2X002\u0000\u0002LANMAN2.1\u0000\u0002NT LM 0.12\u0000"} +{"timestamp":"2026-09-04T20:02:59","event_id":"99957f6a-3b9d-4808-b8ee-294566417c12","source_ip":"144.172.108.79","source_port":61317,"source_domain":"79.108.172.144.static.cloudzy.com","country_code":"US","country_name":"United States","city_name":"Las Vegas","asn_number":14956,"asn_org":"RouterHosting LLC","dest_port":445,"network_protocol":"","application_protocol":"smbv1","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":4,"event_duration":498000000,"source_bytes":364,"dest_bytes":56,"network_bytes":420,"event_summary":"\u0000\u0000\u0000J�SMB%\u0000\u0000\u0000\u0000\u0018\u0001(\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0010\u0000\u0000\u0000\u0000����\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000J\u0000\u0000\u0000J\u0000\u0002\u0000#\u0000\u0000\u0000\u0007\u0000\\PIPE\\\u0000"} +{"timestamp":"2026-09-04T20:02:59","event_id":"99957f6a-3b9d-4808-b8ee-294566417c12","source_ip":"144.172.108.79","source_port":61317,"source_domain":"79.108.172.144.static.cloudzy.com","country_code":"US","country_name":"United States","city_name":"Las Vegas","asn_number":14956,"asn_org":"RouterHosting LLC","dest_port":445,"network_protocol":"","application_protocol":"smbv1","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":3,"event_duration":366000000,"source_bytes":286,"dest_bytes":42,"network_bytes":328,"event_summary":"\u0000\u0000\u0000[�SMBu\u0000\u0000\u0000\u0000\u0018\u0001 \u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000/K\u0003x�^\u0004�\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u001c\u0000\u0000\\\\144.172.108.181\\IPC$\u0000?????\u0000TH_REPLACE__?????\u0000"} +{"timestamp":"2026-09-04T20:02:59","event_id":"99957f6a-3b9d-4808-b8ee-294566417c12","source_ip":"144.172.108.79","source_port":61317,"source_domain":"79.108.172.144.static.cloudzy.com","country_code":"US","country_name":"United States","city_name":"Las Vegas","asn_number":14956,"asn_org":"RouterHosting LLC","dest_port":445,"network_protocol":"","application_protocol":"smbv1","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":2,"event_duration":233000000,"source_bytes":191,"dest_bytes":28,"network_bytes":219,"event_summary":"\u0000\u0000\u0000c�SMBs\u0000\u0000\u0000\u0000\u0018\u0001 \u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000/K\u0000\u0000�^\r�\u0000\u0000\u0000��\u0002\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000@\u0000\u0000\u0000&\u0000\u0000.\u0000Windows 2000 2195\u0000Windows 2000 5.0\u0000"} +{"timestamp":"2026-09-04T20:02:59","event_id":"99957f6a-3b9d-4808-b8ee-294566417c12","source_ip":"144.172.108.79","source_port":61317,"source_domain":"79.108.172.144.static.cloudzy.com","country_code":"US","country_name":"United States","city_name":"Las Vegas","asn_number":14956,"asn_org":"RouterHosting LLC","dest_port":445,"network_protocol":"","application_protocol":"","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":88,"dest_bytes":14,"network_bytes":102,"event_summary":"\u0000\u0000\u0000T�SMBr\u0000\u0000\u0000\u0000\u0018\u0001(\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000/K\u0000\u0000�^\u00001\u0000\u0002LANMAN1.0\u0000\u0002LM1.2X002\u0000\u0002NT LANMAN 1.0\u0000\u0002NT LM 0.12\u0000"} +{"timestamp":"2026-09-04T19:38:08","event_id":"c1253a1c-e27a-4026-8baa-98ff52909b27","source_ip":"167.88.168.121","source_port":37030,"source_domain":"121.168.88.167.static.cloudzy.com","country_code":"US","country_name":"United States","city_name":"Dallas","asn_number":14956,"asn_org":"RouterHosting LLC","dest_port":8008,"network_protocol":"","application_protocol":"http","http_method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0","url_path":"/","url_domain":"","http_request_headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\":8008\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0\"}","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"ge11nn0400_9c3956fad5da","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":169,"dest_bytes":79,"network_bytes":248,"event_summary":""} +{"timestamp":"2026-09-04T18:55:37","event_id":"a0ba0e8f-c0f9-438e-9d72-053d2a8254e4","source_ip":"167.88.168.121","source_port":55602,"source_domain":"121.168.88.167.static.cloudzy.com","country_code":"US","country_name":"United States","city_name":"Dallas","asn_number":14956,"asn_org":"RouterHosting LLC","dest_port":8008,"network_protocol":"","application_protocol":"http","http_method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0","url_path":"/","url_domain":"","http_request_headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\":8008\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0\"}","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"ge11nn0400_9c3956fad5da","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":169,"dest_bytes":79,"network_bytes":248,"event_summary":""} +{"timestamp":"2026-09-04T18:11:24","event_id":"584cca12-5f02-47db-99e3-a7678476ad26","source_ip":"144.172.112.11","source_port":52407,"source_domain":"11.112.172.144.static.cloudzy.com","country_code":"US","country_name":"United States","city_name":"Ogden","asn_number":14956,"asn_org":"RouterHosting LLC","dest_port":445,"network_protocol":"","application_protocol":"","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":51,"dest_bytes":14,"network_bytes":65,"event_summary":"\u0000\u0000\u0000/�SMBr\u0000\u0000\u0000\u0000\u0018\u0001H\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000���\u000e\u0000\u0000\u0000\u0000\u0000\f\u0000\u0002NT LM 0.12\u0000"} +{"timestamp":"2026-09-04T18:11:24","event_id":"2217b76e-7f86-4e72-ab0c-d53cd817cc94","source_ip":"144.172.112.11","source_port":52436,"source_domain":"11.112.172.144.static.cloudzy.com","country_code":"US","country_name":"United States","city_name":"Ogden","asn_number":14956,"asn_org":"RouterHosting LLC","dest_port":445,"network_protocol":"","application_protocol":"","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":51,"dest_bytes":14,"network_bytes":65,"event_summary":"\u0000\u0000\u0000/�SMBr\u0000\u0000\u0000\u0000\u0018\u0001H\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000���\u000e\u0000\u0000\u0000\u0000\u0000\f\u0000\u0002NT LM 0.12\u0000"} +{"timestamp":"2026-09-04T06:30:09","event_id":"41f43d38-4394-4a54-ace7-995325f3819d","source_ip":"45.61.157.82","source_port":50749,"source_domain":"82.157.61.45.static.cloudzy.com","country_code":"US","country_name":"United States","city_name":"Las Vegas","asn_number":14956,"asn_org":"RouterHosting LLC","dest_port":445,"network_protocol":"","application_protocol":"smbv1","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":4,"event_duration":554000000,"source_bytes":455,"dest_bytes":48,"network_bytes":503,"event_summary":"\u0000\u0000\u0000N�SMB2\u0000\u0000\u0000\u0000\u0018\u0007�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000��\u0000\u0000A\u0000\u000f\f\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u00014�\u0000\u0000\u0000\f\u0000B\u0000\u0000\u0000N\u0000\u0001\u0000\u000e\u0000\r\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000"} +{"timestamp":"2026-09-04T06:30:08","event_id":"41f43d38-4394-4a54-ace7-995325f3819d","source_ip":"45.61.157.82","source_port":50749,"source_domain":"82.157.61.45.static.cloudzy.com","country_code":"US","country_name":"United States","city_name":"Las Vegas","asn_number":14956,"asn_org":"RouterHosting LLC","dest_port":445,"network_protocol":"","application_protocol":"smbv1","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":3,"event_duration":403000000,"source_bytes":373,"dest_bytes":36,"network_bytes":409,"event_summary":"\u0000\u0000\u0000\\�SMBu\u0000\u0000\u0000\u0000\u0018\u0007�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000��\u0000\u0000@\u0000\u0004�\u0000\\\u0000\b\u0000\u0001\u00001\u0000\u0000\\\u0000\\\u00001\u00009\u00002\u0000.\u00001\u00006\u00008\u0000.\u00005\u00006\u0000.\u00002\u00000\u0000\\\u0000I\u0000P\u0000C\u0000$\u0000\u0000\u0000?????\u0000"} +{"timestamp":"2026-09-04T06:30:08","event_id":"41f43d38-4394-4a54-ace7-995325f3819d","source_ip":"45.61.157.82","source_port":50749,"source_domain":"82.157.61.45.static.cloudzy.com","country_code":"US","country_name":"United States","city_name":"Las Vegas","asn_number":14956,"asn_org":"RouterHosting LLC","dest_port":445,"network_protocol":"","application_protocol":"smbv1","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":2,"event_duration":252000000,"source_bytes":277,"dest_bytes":24,"network_bytes":301,"event_summary":"\u0000\u0000\u0000��SMBs\u0000\u0000\u0000\u0000\u0018\u0007�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000��\u0000\u0000@\u0000\r�\u0000�\u0000\u0004\u0011\n\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000�\u0000\u0000\u0000K\u0000\u0000\u0000\u0000\u0000\u0000W\u0000i\u0000n\u0000d\u0000o\u0000w\u0000s\u0000 \u00002\u00000\u00000\u00000\u0000 \u00002\u00001\u00009\u00005\u0000\u0000\u0000W\u0000i\u0000n\u0000d\u0000o\u0000w\u0000s\u0000 \u00002\u00000\u00000\u00000\u0000 \u00005\u0000.\u00000\u0000\u0000\u0000"} +{"timestamp":"2026-09-04T06:30:08","event_id":"41f43d38-4394-4a54-ace7-995325f3819d","source_ip":"45.61.157.82","source_port":50749,"source_domain":"82.157.61.45.static.cloudzy.com","country_code":"US","country_name":"United States","city_name":"Las Vegas","asn_number":14956,"asn_org":"RouterHosting LLC","dest_port":445,"network_protocol":"","application_protocol":"","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":137,"dest_bytes":12,"network_bytes":149,"event_summary":"\u0000\u0000\u0000��SMBr\u0000\u0000\u0000\u0000\u0018S�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000��\u0000\u0000@\u0000\u0000b\u0000\u0002PC NETWORK PROGRAM 1.0\u0000\u0002LANMAN1.0\u0000\u0002Windows for Workgroups 3.1a\u0000\u0002LM1.2X002\u0000\u0002LANMAN2.1\u0000\u0002NT LM 0.12\u0000"} +{"timestamp":"2026-09-04T06:30:05","event_id":"923c4ae1-281d-4564-a0d4-8b94466f8838","source_ip":"45.61.157.82","source_port":49934,"source_domain":"82.157.61.45.static.cloudzy.com","country_code":"US","country_name":"United States","city_name":"Las Vegas","asn_number":14956,"asn_org":"RouterHosting LLC","dest_port":445,"network_protocol":"","application_protocol":"smbv1","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":4,"event_duration":554000000,"source_bytes":364,"dest_bytes":48,"network_bytes":412,"event_summary":"\u0000\u0000\u0000J�SMB%\u0000\u0000\u0000\u0000\u0018\u0001(\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0010\u0000\u0000\u0000\u0000����\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000J\u0000\u0000\u0000J\u0000\u0002\u0000#\u0000\u0000\u0000\u0007\u0000\\PIPE\\\u0000"} +{"timestamp":"2026-09-04T06:30:05","event_id":"923c4ae1-281d-4564-a0d4-8b94466f8838","source_ip":"45.61.157.82","source_port":49934,"source_domain":"82.157.61.45.static.cloudzy.com","country_code":"US","country_name":"United States","city_name":"Las Vegas","asn_number":14956,"asn_org":"RouterHosting LLC","dest_port":445,"network_protocol":"","application_protocol":"smbv1","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":3,"event_duration":403000000,"source_bytes":286,"dest_bytes":36,"network_bytes":322,"event_summary":"\u0000\u0000\u0000[�SMBu\u0000\u0000\u0000\u0000\u0018\u0001 \u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000/K\u0000\u0000�^\u0004�\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u001c\u0000\u0000\\\\45.61.157.16\\IPC$\u0000?????\u0000EPATH_REPLACE__?????\u0000"} +{"timestamp":"2026-09-04T06:30:05","event_id":"923c4ae1-281d-4564-a0d4-8b94466f8838","source_ip":"45.61.157.82","source_port":49934,"source_domain":"82.157.61.45.static.cloudzy.com","country_code":"US","country_name":"United States","city_name":"Las Vegas","asn_number":14956,"asn_org":"RouterHosting LLC","dest_port":445,"network_protocol":"","application_protocol":"smbv1","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":2,"event_duration":251000000,"source_bytes":191,"dest_bytes":24,"network_bytes":215,"event_summary":"\u0000\u0000\u0000c�SMBs\u0000\u0000\u0000\u0000\u0018\u0001 \u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000/K\u0000\u0000�^\r�\u0000\u0000\u0000��\u0002\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000@\u0000\u0000\u0000&\u0000\u0000.\u0000Windows 2000 2195\u0000Windows 2000 5.0\u0000"} +{"timestamp":"2026-09-04T06:30:04","event_id":"923c4ae1-281d-4564-a0d4-8b94466f8838","source_ip":"45.61.157.82","source_port":49934,"source_domain":"82.157.61.45.static.cloudzy.com","country_code":"US","country_name":"United States","city_name":"Las Vegas","asn_number":14956,"asn_org":"RouterHosting LLC","dest_port":445,"network_protocol":"","application_protocol":"","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":88,"dest_bytes":12,"network_bytes":100,"event_summary":"\u0000\u0000\u0000T�SMBr\u0000\u0000\u0000\u0000\u0018\u0001(\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000/K\u0000\u0000�^\u00001\u0000\u0002LANMAN1.0\u0000\u0002LM1.2X002\u0000\u0002NT LANMAN 1.0\u0000\u0002NT LM 0.12\u0000"} +{"timestamp":"2026-09-04T04:39:13","event_id":"a31f1233-0fef-4fbe-8b22-df72be99e3e9","source_ip":"45.61.157.82","source_port":62738,"source_domain":"82.157.61.45.static.cloudzy.com","country_code":"US","country_name":"United States","city_name":"Las Vegas","asn_number":14956,"asn_org":"RouterHosting LLC","dest_port":445,"network_protocol":"","application_protocol":"smbv1","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":4,"event_duration":555000000,"source_bytes":455,"dest_bytes":48,"network_bytes":503,"event_summary":"\u0000\u0000\u0000N�SMB2\u0000\u0000\u0000\u0000\u0018\u0007�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000��\u0000\u0000A\u0000\u000f\f\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u00014�\u0000\u0000\u0000\f\u0000B\u0000\u0000\u0000N\u0000\u0001\u0000\u000e\u0000\r\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000"} +{"timestamp":"2026-09-04T04:39:13","event_id":"a31f1233-0fef-4fbe-8b22-df72be99e3e9","source_ip":"45.61.157.82","source_port":62738,"source_domain":"82.157.61.45.static.cloudzy.com","country_code":"US","country_name":"United States","city_name":"Las Vegas","asn_number":14956,"asn_org":"RouterHosting LLC","dest_port":445,"network_protocol":"","application_protocol":"smbv1","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":3,"event_duration":403000000,"source_bytes":373,"dest_bytes":36,"network_bytes":409,"event_summary":"\u0000\u0000\u0000\\�SMBu\u0000\u0000\u0000\u0000\u0018\u0007�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000��\u0000\u0000@\u0000\u0004�\u0000\\\u0000\b\u0000\u0001\u00001\u0000\u0000\\\u0000\\\u00001\u00009\u00002\u0000.\u00001\u00006\u00008\u0000.\u00005\u00006\u0000.\u00002\u00000\u0000\\\u0000I\u0000P\u0000C\u0000$\u0000\u0000\u0000?????\u0000"} +{"timestamp":"2026-09-04T04:39:13","event_id":"a31f1233-0fef-4fbe-8b22-df72be99e3e9","source_ip":"45.61.157.82","source_port":62738,"source_domain":"82.157.61.45.static.cloudzy.com","country_code":"US","country_name":"United States","city_name":"Las Vegas","asn_number":14956,"asn_org":"RouterHosting LLC","dest_port":445,"network_protocol":"","application_protocol":"smbv1","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":2,"event_duration":252000000,"source_bytes":277,"dest_bytes":24,"network_bytes":301,"event_summary":"\u0000\u0000\u0000��SMBs\u0000\u0000\u0000\u0000\u0018\u0007�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000��\u0000\u0000@\u0000\r�\u0000�\u0000\u0004\u0011\n\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000�\u0000\u0000\u0000K\u0000\u0000\u0000\u0000\u0000\u0000W\u0000i\u0000n\u0000d\u0000o\u0000w\u0000s\u0000 \u00002\u00000\u00000\u00000\u0000 \u00002\u00001\u00009\u00005\u0000\u0000\u0000W\u0000i\u0000n\u0000d\u0000o\u0000w\u0000s\u0000 \u00002\u00000\u00000\u00000\u0000 \u00005\u0000.\u00000\u0000\u0000\u0000"} +{"timestamp":"2026-09-04T04:39:13","event_id":"a31f1233-0fef-4fbe-8b22-df72be99e3e9","source_ip":"45.61.157.82","source_port":62738,"source_domain":"82.157.61.45.static.cloudzy.com","country_code":"US","country_name":"United States","city_name":"Las Vegas","asn_number":14956,"asn_org":"RouterHosting LLC","dest_port":445,"network_protocol":"","application_protocol":"","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":137,"dest_bytes":12,"network_bytes":149,"event_summary":"\u0000\u0000\u0000��SMBr\u0000\u0000\u0000\u0000\u0018S�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000��\u0000\u0000@\u0000\u0000b\u0000\u0002PC NETWORK PROGRAM 1.0\u0000\u0002LANMAN1.0\u0000\u0002Windows for Workgroups 3.1a\u0000\u0002LM1.2X002\u0000\u0002LANMAN2.1\u0000\u0002NT LM 0.12\u0000"} +{"timestamp":"2026-09-04T04:39:10","event_id":"2908ae00-9d4a-4c25-a636-9cf3d31835f0","source_ip":"45.61.157.82","source_port":61929,"source_domain":"82.157.61.45.static.cloudzy.com","country_code":"US","country_name":"United States","city_name":"Las Vegas","asn_number":14956,"asn_org":"RouterHosting LLC","dest_port":445,"network_protocol":"","application_protocol":"smbv1","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":4,"event_duration":554000000,"source_bytes":364,"dest_bytes":48,"network_bytes":412,"event_summary":"\u0000\u0000\u0000J�SMB%\u0000\u0000\u0000\u0000\u0018\u0001(\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0010\u0000\u0000\u0000\u0000����\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000J\u0000\u0000\u0000J\u0000\u0002\u0000#\u0000\u0000\u0000\u0007\u0000\\PIPE\\\u0000"} +{"timestamp":"2026-09-04T04:39:09","event_id":"2908ae00-9d4a-4c25-a636-9cf3d31835f0","source_ip":"45.61.157.82","source_port":61929,"source_domain":"82.157.61.45.static.cloudzy.com","country_code":"US","country_name":"United States","city_name":"Las Vegas","asn_number":14956,"asn_org":"RouterHosting LLC","dest_port":445,"network_protocol":"","application_protocol":"smbv1","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":3,"event_duration":402000000,"source_bytes":286,"dest_bytes":36,"network_bytes":322,"event_summary":"\u0000\u0000\u0000[�SMBu\u0000\u0000\u0000\u0000\u0018\u0001 \u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000/K\u0000\u0000�^\u0004�\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u001c\u0000\u0000\\\\45.61.157.16\\IPC$\u0000?????\u0000EPATH_REPLACE__?????\u0000"} +{"timestamp":"2026-09-04T04:39:09","event_id":"2908ae00-9d4a-4c25-a636-9cf3d31835f0","source_ip":"45.61.157.82","source_port":61929,"source_domain":"82.157.61.45.static.cloudzy.com","country_code":"US","country_name":"United States","city_name":"Las Vegas","asn_number":14956,"asn_org":"RouterHosting LLC","dest_port":445,"network_protocol":"","application_protocol":"smbv1","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":2,"event_duration":251000000,"source_bytes":191,"dest_bytes":24,"network_bytes":215,"event_summary":"\u0000\u0000\u0000c�SMBs\u0000\u0000\u0000\u0000\u0018\u0001 \u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000/K\u0000\u0000�^\r�\u0000\u0000\u0000��\u0002\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000@\u0000\u0000\u0000&\u0000\u0000.\u0000Windows 2000 2195\u0000Windows 2000 5.0\u0000"} +{"timestamp":"2026-09-04T04:39:09","event_id":"2908ae00-9d4a-4c25-a636-9cf3d31835f0","source_ip":"45.61.157.82","source_port":61929,"source_domain":"82.157.61.45.static.cloudzy.com","country_code":"US","country_name":"United States","city_name":"Las Vegas","asn_number":14956,"asn_org":"RouterHosting LLC","dest_port":445,"network_protocol":"","application_protocol":"","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":88,"dest_bytes":12,"network_bytes":100,"event_summary":"\u0000\u0000\u0000T�SMBr\u0000\u0000\u0000\u0000\u0018\u0001(\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000/K\u0000\u0000�^\u00001\u0000\u0002LANMAN1.0\u0000\u0002LM1.2X002\u0000\u0002NT LANMAN 1.0\u0000\u0002NT LM 0.12\u0000"} +{"timestamp":"2026-09-04T02:30:36","event_id":"bcb35be1-77bb-4d87-a3f9-79c14c4d8d9a","source_ip":"45.61.157.82","source_port":58786,"source_domain":"82.157.61.45.static.cloudzy.com","country_code":"US","country_name":"United States","city_name":"Las Vegas","asn_number":14956,"asn_org":"RouterHosting LLC","dest_port":445,"network_protocol":"","application_protocol":"smbv1","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":4,"event_duration":554000000,"source_bytes":455,"dest_bytes":48,"network_bytes":503,"event_summary":"\u0000\u0000\u0000N�SMB2\u0000\u0000\u0000\u0000\u0018\u0007�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000��\u0000\u0000A\u0000\u000f\f\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u00014�\u0000\u0000\u0000\f\u0000B\u0000\u0000\u0000N\u0000\u0001\u0000\u000e\u0000\r\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000"} +{"timestamp":"2026-09-04T02:30:36","event_id":"bcb35be1-77bb-4d87-a3f9-79c14c4d8d9a","source_ip":"45.61.157.82","source_port":58786,"source_domain":"82.157.61.45.static.cloudzy.com","country_code":"US","country_name":"United States","city_name":"Las Vegas","asn_number":14956,"asn_org":"RouterHosting LLC","dest_port":445,"network_protocol":"","application_protocol":"smbv1","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":3,"event_duration":402000000,"source_bytes":373,"dest_bytes":36,"network_bytes":409,"event_summary":"\u0000\u0000\u0000\\�SMBu\u0000\u0000\u0000\u0000\u0018\u0007�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000��\u0000\u0000@\u0000\u0004�\u0000\\\u0000\b\u0000\u0001\u00001\u0000\u0000\\\u0000\\\u00001\u00009\u00002\u0000.\u00001\u00006\u00008\u0000.\u00005\u00006\u0000.\u00002\u00000\u0000\\\u0000I\u0000P\u0000C\u0000$\u0000\u0000\u0000?????\u0000"} +{"timestamp":"2026-09-04T02:30:35","event_id":"bcb35be1-77bb-4d87-a3f9-79c14c4d8d9a","source_ip":"45.61.157.82","source_port":58786,"source_domain":"82.157.61.45.static.cloudzy.com","country_code":"US","country_name":"United States","city_name":"Las Vegas","asn_number":14956,"asn_org":"RouterHosting LLC","dest_port":445,"network_protocol":"","application_protocol":"smbv1","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":2,"event_duration":251000000,"source_bytes":277,"dest_bytes":24,"network_bytes":301,"event_summary":"\u0000\u0000\u0000��SMBs\u0000\u0000\u0000\u0000\u0018\u0007�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000��\u0000\u0000@\u0000\r�\u0000�\u0000\u0004\u0011\n\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000�\u0000\u0000\u0000K\u0000\u0000\u0000\u0000\u0000\u0000W\u0000i\u0000n\u0000d\u0000o\u0000w\u0000s\u0000 \u00002\u00000\u00000\u00000\u0000 \u00002\u00001\u00009\u00005\u0000\u0000\u0000W\u0000i\u0000n\u0000d\u0000o\u0000w\u0000s\u0000 \u00002\u00000\u00000\u00000\u0000 \u00005\u0000.\u00000\u0000\u0000\u0000"} +{"timestamp":"2026-09-04T02:30:35","event_id":"bcb35be1-77bb-4d87-a3f9-79c14c4d8d9a","source_ip":"45.61.157.82","source_port":58786,"source_domain":"82.157.61.45.static.cloudzy.com","country_code":"US","country_name":"United States","city_name":"Las Vegas","asn_number":14956,"asn_org":"RouterHosting LLC","dest_port":445,"network_protocol":"","application_protocol":"","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":137,"dest_bytes":12,"network_bytes":149,"event_summary":"\u0000\u0000\u0000��SMBr\u0000\u0000\u0000\u0000\u0018S�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000��\u0000\u0000@\u0000\u0000b\u0000\u0002PC NETWORK PROGRAM 1.0\u0000\u0002LANMAN1.0\u0000\u0002Windows for Workgroups 3.1a\u0000\u0002LM1.2X002\u0000\u0002LANMAN2.1\u0000\u0002NT LM 0.12\u0000"} +{"timestamp":"2026-09-04T02:30:32","event_id":"51bae7b7-1b45-4aa4-b366-ca6bb47a8b6e","source_ip":"45.61.157.82","source_port":57806,"source_domain":"82.157.61.45.static.cloudzy.com","country_code":"US","country_name":"United States","city_name":"Las Vegas","asn_number":14956,"asn_org":"RouterHosting LLC","dest_port":445,"network_protocol":"","application_protocol":"smbv1","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":4,"event_duration":555000000,"source_bytes":364,"dest_bytes":48,"network_bytes":412,"event_summary":"\u0000\u0000\u0000J�SMB%\u0000\u0000\u0000\u0000\u0018\u0001(\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0010\u0000\u0000\u0000\u0000����\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000J\u0000\u0000\u0000J\u0000\u0002\u0000#\u0000\u0000\u0000\u0007\u0000\\PIPE\\\u0000"} +{"timestamp":"2026-09-04T02:30:32","event_id":"51bae7b7-1b45-4aa4-b366-ca6bb47a8b6e","source_ip":"45.61.157.82","source_port":57806,"source_domain":"82.157.61.45.static.cloudzy.com","country_code":"US","country_name":"United States","city_name":"Las Vegas","asn_number":14956,"asn_org":"RouterHosting LLC","dest_port":445,"network_protocol":"","application_protocol":"smbv1","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":3,"event_duration":404000000,"source_bytes":286,"dest_bytes":36,"network_bytes":322,"event_summary":"\u0000\u0000\u0000[�SMBu\u0000\u0000\u0000\u0000\u0018\u0001 \u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000/K\u0000\u0000�^\u0004�\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u001c\u0000\u0000\\\\45.61.157.16\\IPC$\u0000?????\u0000EPATH_REPLACE__?????\u0000"} +{"timestamp":"2026-09-04T02:30:32","event_id":"51bae7b7-1b45-4aa4-b366-ca6bb47a8b6e","source_ip":"45.61.157.82","source_port":57806,"source_domain":"82.157.61.45.static.cloudzy.com","country_code":"US","country_name":"United States","city_name":"Las Vegas","asn_number":14956,"asn_org":"RouterHosting LLC","dest_port":445,"network_protocol":"","application_protocol":"smbv1","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":2,"event_duration":252000000,"source_bytes":191,"dest_bytes":24,"network_bytes":215,"event_summary":"\u0000\u0000\u0000c�SMBs\u0000\u0000\u0000\u0000\u0018\u0001 \u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000/K\u0000\u0000�^\r�\u0000\u0000\u0000��\u0002\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000@\u0000\u0000\u0000&\u0000\u0000.\u0000Windows 2000 2195\u0000Windows 2000 5.0\u0000"} +{"timestamp":"2026-09-04T02:30:32","event_id":"51bae7b7-1b45-4aa4-b366-ca6bb47a8b6e","source_ip":"45.61.157.82","source_port":57806,"source_domain":"82.157.61.45.static.cloudzy.com","country_code":"US","country_name":"United States","city_name":"Las Vegas","asn_number":14956,"asn_org":"RouterHosting LLC","dest_port":445,"network_protocol":"","application_protocol":"","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":88,"dest_bytes":12,"network_bytes":100,"event_summary":"\u0000\u0000\u0000T�SMBr\u0000\u0000\u0000\u0000\u0018\u0001(\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000/K\u0000\u0000�^\u00001\u0000\u0002LANMAN1.0\u0000\u0002LM1.2X002\u0000\u0002NT LANMAN 1.0\u0000\u0002NT LM 0.12\u0000"} +{"timestamp":"2026-09-04T01:15:16","event_id":"1ed9a151-9080-48ac-ba95-d3966b1a3f42","source_ip":"45.61.157.82","source_port":50609,"source_domain":"82.157.61.45.static.cloudzy.com","country_code":"US","country_name":"United States","city_name":"Las Vegas","asn_number":14956,"asn_org":"RouterHosting LLC","dest_port":445,"network_protocol":"","application_protocol":"smbv1","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":4,"event_duration":553000000,"source_bytes":455,"dest_bytes":48,"network_bytes":503,"event_summary":"\u0000\u0000\u0000N�SMB2\u0000\u0000\u0000\u0000\u0018\u0007�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000��\u0000\u0000A\u0000\u000f\f\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u00014�\u0000\u0000\u0000\f\u0000B\u0000\u0000\u0000N\u0000\u0001\u0000\u000e\u0000\r\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000"} +{"timestamp":"2026-09-04T01:15:16","event_id":"1ed9a151-9080-48ac-ba95-d3966b1a3f42","source_ip":"45.61.157.82","source_port":50609,"source_domain":"82.157.61.45.static.cloudzy.com","country_code":"US","country_name":"United States","city_name":"Las Vegas","asn_number":14956,"asn_org":"RouterHosting LLC","dest_port":445,"network_protocol":"","application_protocol":"smbv1","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":3,"event_duration":402000000,"source_bytes":373,"dest_bytes":36,"network_bytes":409,"event_summary":"\u0000\u0000\u0000\\�SMBu\u0000\u0000\u0000\u0000\u0018\u0007�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000��\u0000\u0000@\u0000\u0004�\u0000\\\u0000\b\u0000\u0001\u00001\u0000\u0000\\\u0000\\\u00001\u00009\u00002\u0000.\u00001\u00006\u00008\u0000.\u00005\u00006\u0000.\u00002\u00000\u0000\\\u0000I\u0000P\u0000C\u0000$\u0000\u0000\u0000?????\u0000"} +{"timestamp":"2026-09-04T01:15:16","event_id":"1ed9a151-9080-48ac-ba95-d3966b1a3f42","source_ip":"45.61.157.82","source_port":50609,"source_domain":"82.157.61.45.static.cloudzy.com","country_code":"US","country_name":"United States","city_name":"Las Vegas","asn_number":14956,"asn_org":"RouterHosting LLC","dest_port":445,"network_protocol":"","application_protocol":"smbv1","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":2,"event_duration":251000000,"source_bytes":277,"dest_bytes":24,"network_bytes":301,"event_summary":"\u0000\u0000\u0000��SMBs\u0000\u0000\u0000\u0000\u0018\u0007�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000��\u0000\u0000@\u0000\r�\u0000�\u0000\u0004\u0011\n\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000�\u0000\u0000\u0000K\u0000\u0000\u0000\u0000\u0000\u0000W\u0000i\u0000n\u0000d\u0000o\u0000w\u0000s\u0000 \u00002\u00000\u00000\u00000\u0000 \u00002\u00001\u00009\u00005\u0000\u0000\u0000W\u0000i\u0000n\u0000d\u0000o\u0000w\u0000s\u0000 \u00002\u00000\u00000\u00000\u0000 \u00005\u0000.\u00000\u0000\u0000\u0000"} +{"timestamp":"2026-09-04T01:15:16","event_id":"1ed9a151-9080-48ac-ba95-d3966b1a3f42","source_ip":"45.61.157.82","source_port":50609,"source_domain":"82.157.61.45.static.cloudzy.com","country_code":"US","country_name":"United States","city_name":"Las Vegas","asn_number":14956,"asn_org":"RouterHosting LLC","dest_port":445,"network_protocol":"","application_protocol":"","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":137,"dest_bytes":12,"network_bytes":149,"event_summary":"\u0000\u0000\u0000��SMBr\u0000\u0000\u0000\u0000\u0018S�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000��\u0000\u0000@\u0000\u0000b\u0000\u0002PC NETWORK PROGRAM 1.0\u0000\u0002LANMAN1.0\u0000\u0002Windows for Workgroups 3.1a\u0000\u0002LM1.2X002\u0000\u0002LANMAN2.1\u0000\u0002NT LM 0.12\u0000"} +{"timestamp":"2026-09-04T01:15:13","event_id":"1786a3f2-2fe2-44c8-8705-5a952b3cd908","source_ip":"45.61.157.82","source_port":49822,"source_domain":"82.157.61.45.static.cloudzy.com","country_code":"US","country_name":"United States","city_name":"Las Vegas","asn_number":14956,"asn_org":"RouterHosting LLC","dest_port":445,"network_protocol":"","application_protocol":"smbv1","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":4,"event_duration":553000000,"source_bytes":364,"dest_bytes":48,"network_bytes":412,"event_summary":"\u0000\u0000\u0000J�SMB%\u0000\u0000\u0000\u0000\u0018\u0001(\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0010\u0000\u0000\u0000\u0000����\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000J\u0000\u0000\u0000J\u0000\u0002\u0000#\u0000\u0000\u0000\u0007\u0000\\PIPE\\\u0000"} +{"timestamp":"2026-09-04T01:15:13","event_id":"1786a3f2-2fe2-44c8-8705-5a952b3cd908","source_ip":"45.61.157.82","source_port":49822,"source_domain":"82.157.61.45.static.cloudzy.com","country_code":"US","country_name":"United States","city_name":"Las Vegas","asn_number":14956,"asn_org":"RouterHosting LLC","dest_port":445,"network_protocol":"","application_protocol":"smbv1","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":3,"event_duration":402000000,"source_bytes":286,"dest_bytes":36,"network_bytes":322,"event_summary":"\u0000\u0000\u0000[�SMBu\u0000\u0000\u0000\u0000\u0018\u0001 \u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000/K\u0000\u0000�^\u0004�\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u001c\u0000\u0000\\\\45.61.157.16\\IPC$\u0000?????\u0000EPATH_REPLACE__?????\u0000"} +{"timestamp":"2026-09-04T01:15:12","event_id":"1786a3f2-2fe2-44c8-8705-5a952b3cd908","source_ip":"45.61.157.82","source_port":49822,"source_domain":"82.157.61.45.static.cloudzy.com","country_code":"US","country_name":"United States","city_name":"Las Vegas","asn_number":14956,"asn_org":"RouterHosting LLC","dest_port":445,"network_protocol":"","application_protocol":"smbv1","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":2,"event_duration":251000000,"source_bytes":191,"dest_bytes":24,"network_bytes":215,"event_summary":"\u0000\u0000\u0000c�SMBs\u0000\u0000\u0000\u0000\u0018\u0001 \u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000/K\u0000\u0000�^\r�\u0000\u0000\u0000��\u0002\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000@\u0000\u0000\u0000&\u0000\u0000.\u0000Windows 2000 2195\u0000Windows 2000 5.0\u0000"} +{"timestamp":"2026-09-04T01:15:12","event_id":"1786a3f2-2fe2-44c8-8705-5a952b3cd908","source_ip":"45.61.157.82","source_port":49822,"source_domain":"82.157.61.45.static.cloudzy.com","country_code":"US","country_name":"United States","city_name":"Las Vegas","asn_number":14956,"asn_org":"RouterHosting LLC","dest_port":445,"network_protocol":"","application_protocol":"","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":88,"dest_bytes":12,"network_bytes":100,"event_summary":"\u0000\u0000\u0000T�SMBr\u0000\u0000\u0000\u0000\u0018\u0001(\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000/K\u0000\u0000�^\u00001\u0000\u0002LANMAN1.0\u0000\u0002LM1.2X002\u0000\u0002NT LANMAN 1.0\u0000\u0002NT LM 0.12\u0000"} +{"timestamp":"2026-09-03T17:01:38","event_id":"15af6305-9d5b-4964-91ac-c88074751ba6","source_ip":"216.126.227.187","source_port":55802,"source_domain":"187.227.126.216.static.cloudzy.com","country_code":"US","country_name":"United States","city_name":"Ogden","asn_number":14956,"asn_org":"RouterHosting LLC","dest_port":7860,"network_protocol":"","application_protocol":"http","http_method":"GET","user_agent":"Python/3.13 aiohttp/3.13.5","url_path":"/api/v1/version","url_domain":"","http_request_headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate\",\"host\":\":7860\",\"user-agent\":\"Python/3.13 aiohttp/3.13.5\"}","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"ge11nn0400_c3abebcf3d28","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":142,"dest_bytes":80,"network_bytes":222,"event_summary":""} +{"timestamp":"2026-09-03T06:57:25","event_id":"74b4b901-bc2a-4e2d-8182-092ed8770b7f","source_ip":"167.88.168.121","source_port":57714,"source_domain":"121.168.88.167.static.cloudzy.com","country_code":"US","country_name":"United States","city_name":"Dallas","asn_number":14956,"asn_org":"RouterHosting LLC","dest_port":2095,"network_protocol":"","application_protocol":"http","http_method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0","url_path":"/","url_domain":"","http_request_headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\":2095\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0\"}","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"ge11nn0400_9c3956fad5da","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":101000000,"source_bytes":169,"dest_bytes":79,"network_bytes":248,"event_summary":""} +{"timestamp":"2026-09-03T06:47:31","event_id":"d7c504a0-df38-4cd9-b95e-5355dd56f993","source_ip":"167.88.168.121","source_port":48929,"source_domain":"121.168.88.167.static.cloudzy.com","country_code":"US","country_name":"United States","city_name":"Dallas","asn_number":14956,"asn_org":"RouterHosting LLC","dest_port":2095,"network_protocol":"","application_protocol":"http","http_method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0","url_path":"/","url_domain":"","http_request_headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\":2095\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0\"}","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"ge11nn0400_9c3956fad5da","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":169,"dest_bytes":79,"network_bytes":248,"event_summary":""} +{"timestamp":"2026-09-02T07:32:32","event_id":"1581fc5f-2cbd-4cc8-b736-4ef59604cf61","source_ip":"144.172.100.114","source_port":46306,"source_domain":"114.100.172.144.static.cloudzy.com","country_code":"US","country_name":"United States","city_name":"Las Vegas","asn_number":14956,"asn_org":"RouterHosting LLC","dest_port":1723,"network_protocol":"","application_protocol":"pptp","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":156,"dest_bytes":15,"network_bytes":171,"event_summary":"\u0000�\u0000\u0001\u001a+","http_request_headers":"{\"connection\":\"keep-alive\",\"host\":\"\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36\"}","ssh_client_hassh":"","tls_client_ja4":"t13i100900_61a7ad8aa9b6_88aa062a14c8","tls_client_ja3":"92e3065cf9444ba90adc1bce4206011c","tls_client_version":"TLSv1.3","tls_client_cipher":"TLS_CHACHA20_POLY1305_SHA256","http_request_ja4h":"ge11nn0300_7fd797acd99d","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":191,"dest_bytes":78,"network_bytes":269,"event_summary":""} +{"timestamp":"2026-09-01T09:05:26","event_id":"f4d3dcbe-b794-4846-b640-4e7b1e632904","source_ip":"144.172.115.222","source_port":39444,"source_domain":"222.115.172.144.static.cloudzy.com","country_code":"US","country_name":"United States","city_name":"Ogden","asn_number":14956,"asn_org":"RouterHosting LLC","dest_port":5061,"network_protocol":"tls","application_protocol":"sip","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"t13i311000_e8f1e7e78f70_d41ae481755e","tls_client_ja3":"004556e859f3c26c5d19746b3a957c74","tls_client_version":"TLSv1.3","tls_client_cipher":"TLS_CHACHA20_POLY1305_SHA256","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":380000000,"source_bytes":635,"dest_bytes":15,"network_bytes":650,"event_summary":"INVITE sip:00972567158234@:5061 SIP/2.0\r\nVia: SIP/2.0/TLS 0.0.0.0:39444;branch=z9hG4bK8eae81b4e3;rport\r\nFrom: ;tag=36a03fb3\r\nTo: :5061>\r\nCall-ID: 52609705-565c-4841-8f7a-bc67985faa02@0.0.0.0\r\nCSeq: 1 INVITE\r\nContact: \r\nMax-Forwards: 70\r\nUser-Agent: 1001/GOLIATH\r\nAccept: application/sdp\r\nContent-Type: application/sdp\r\nContent-Length: 201\r\n\r\nv=0\r\no=- 1788253526 1788253526 IN IP4 0.0.0.0\r\ns=Call\r\nc=IN IP4 0.0.0.0\r\nt=0 0\r\nm=audio 7078 RTP/AVP 0 8 101\r\na=rtpmap:0 PCMU/8000\r\na=rtpmap:8 PCMA/8000\r\na=rtpmap:101 telephone-event/8000\r\na=sendrecv\r\n"} +{"timestamp":"2026-09-01T08:57:36","event_id":"bb04fa8e-6ada-44c8-910a-f0bb5b322711","source_ip":"144.172.99.200","source_port":51647,"source_domain":"200.99.172.144.static.cloudzy.com","country_code":"US","country_name":"United States","city_name":"Staten Island","asn_number":14956,"asn_org":"RouterHosting LLC","dest_port":445,"network_protocol":"","application_protocol":"smbv1","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":4,"event_duration":497000000,"source_bytes":455,"dest_bytes":56,"network_bytes":511,"event_summary":"\u0000\u0000\u0000N�SMB2\u0000\u0000\u0000\u0000\u0018\u0007�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000��\u0000\u0000A\u0000\u000f\f\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u00014�\u0000\u0000\u0000\f\u0000B\u0000\u0000\u0000N\u0000\u0001\u0000\u000e\u0000\r\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000"} +{"timestamp":"2026-09-01T08:57:36","event_id":"bb04fa8e-6ada-44c8-910a-f0bb5b322711","source_ip":"144.172.99.200","source_port":51647,"source_domain":"200.99.172.144.static.cloudzy.com","country_code":"US","country_name":"United States","city_name":"Staten Island","asn_number":14956,"asn_org":"RouterHosting LLC","dest_port":445,"network_protocol":"","application_protocol":"smbv1","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":3,"event_duration":365000000,"source_bytes":373,"dest_bytes":42,"network_bytes":415,"event_summary":"\u0000\u0000\u0000\\�SMBu\u0000\u0000\u0000\u0000\u0018\u0007�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000��\u0000\u0000@\u0000\u0004�\u0000\\\u0000\b\u0000\u0001\u00001\u0000\u0000\\\u0000\\\u00001\u00009\u00002\u0000.\u00001\u00006\u00008\u0000.\u00005\u00006\u0000.\u00002\u00000\u0000\\\u0000I\u0000P\u0000C\u0000$\u0000\u0000\u0000?????\u0000"} +{"timestamp":"2026-09-01T08:57:36","event_id":"bb04fa8e-6ada-44c8-910a-f0bb5b322711","source_ip":"144.172.99.200","source_port":51647,"source_domain":"200.99.172.144.static.cloudzy.com","country_code":"US","country_name":"United States","city_name":"Staten Island","asn_number":14956,"asn_org":"RouterHosting LLC","dest_port":445,"network_protocol":"","application_protocol":"smbv1","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":2,"event_duration":233000000,"source_bytes":277,"dest_bytes":28,"network_bytes":305,"event_summary":"\u0000\u0000\u0000��SMBs\u0000\u0000\u0000\u0000\u0018\u0007�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000��\u0000\u0000@\u0000\r�\u0000�\u0000\u0004\u0011\n\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000�\u0000\u0000\u0000K\u0000\u0000\u0000\u0000\u0000\u0000W\u0000i\u0000n\u0000d\u0000o\u0000w\u0000s\u0000 \u00002\u00000\u00000\u00000\u0000 \u00002\u00001\u00009\u00005\u0000\u0000\u0000W\u0000i\u0000n\u0000d\u0000o\u0000w\u0000s\u0000 \u00002\u00000\u00000\u00000\u0000 \u00005\u0000.\u00000\u0000\u0000\u0000"} +{"timestamp":"2026-09-01T08:57:36","event_id":"bb04fa8e-6ada-44c8-910a-f0bb5b322711","source_ip":"144.172.99.200","source_port":51647,"source_domain":"200.99.172.144.static.cloudzy.com","country_code":"US","country_name":"United States","city_name":"Staten Island","asn_number":14956,"asn_org":"RouterHosting LLC","dest_port":445,"network_protocol":"","application_protocol":"","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":137,"dest_bytes":14,"network_bytes":151,"event_summary":"\u0000\u0000\u0000��SMBr\u0000\u0000\u0000\u0000\u0018S�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000��\u0000\u0000@\u0000\u0000b\u0000\u0002PC NETWORK PROGRAM 1.0\u0000\u0002LANMAN1.0\u0000\u0002Windows for Workgroups 3.1a\u0000\u0002LM1.2X002\u0000\u0002LANMAN2.1\u0000\u0002NT LM 0.12\u0000"} +{"timestamp":"2026-09-01T08:57:33","event_id":"af19a649-31dd-4d6a-8d0f-17aac046f0e5","source_ip":"144.172.99.200","source_port":50607,"source_domain":"200.99.172.144.static.cloudzy.com","country_code":"US","country_name":"United States","city_name":"Staten Island","asn_number":14956,"asn_org":"RouterHosting LLC","dest_port":445,"network_protocol":"","application_protocol":"smbv1","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":4,"event_duration":498000000,"source_bytes":364,"dest_bytes":56,"network_bytes":420,"event_summary":"\u0000\u0000\u0000J�SMB%\u0000\u0000\u0000\u0000\u0018\u0001(\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0010\u0000\u0000\u0000\u0000����\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000J\u0000\u0000\u0000J\u0000\u0002\u0000#\u0000\u0000\u0000\u0007\u0000\\PIPE\\\u0000"} +{"timestamp":"2026-09-01T08:57:33","event_id":"af19a649-31dd-4d6a-8d0f-17aac046f0e5","source_ip":"144.172.99.200","source_port":50607,"source_domain":"200.99.172.144.static.cloudzy.com","country_code":"US","country_name":"United States","city_name":"Staten Island","asn_number":14956,"asn_org":"RouterHosting LLC","dest_port":445,"network_protocol":"","application_protocol":"smbv1","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":3,"event_duration":366000000,"source_bytes":286,"dest_bytes":42,"network_bytes":328,"event_summary":"\u0000\u0000\u0000[�SMBu\u0000\u0000\u0000\u0000\u0018\u0001 \u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000/K\u0002��^\u0004�\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u001c\u0000\u0000\\\\144.172.99.25\\IPC$\u0000?????\u0000PATH_REPLACE__?????\u0000"} +{"timestamp":"2026-09-01T08:57:32","event_id":"af19a649-31dd-4d6a-8d0f-17aac046f0e5","source_ip":"144.172.99.200","source_port":50607,"source_domain":"200.99.172.144.static.cloudzy.com","country_code":"US","country_name":"United States","city_name":"Staten Island","asn_number":14956,"asn_org":"RouterHosting LLC","dest_port":445,"network_protocol":"","application_protocol":"smbv1","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":2,"event_duration":233000000,"source_bytes":191,"dest_bytes":28,"network_bytes":219,"event_summary":"\u0000\u0000\u0000c�SMBs\u0000\u0000\u0000\u0000\u0018\u0001 \u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000/K\u0000\u0000�^\r�\u0000\u0000\u0000��\u0002\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000@\u0000\u0000\u0000&\u0000\u0000.\u0000Windows 2000 2195\u0000Windows 2000 5.0\u0000"} +{"timestamp":"2026-09-01T08:57:32","event_id":"af19a649-31dd-4d6a-8d0f-17aac046f0e5","source_ip":"144.172.99.200","source_port":50607,"source_domain":"200.99.172.144.static.cloudzy.com","country_code":"US","country_name":"United States","city_name":"Staten Island","asn_number":14956,"asn_org":"RouterHosting LLC","dest_port":445,"network_protocol":"","application_protocol":"","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":101000000,"source_bytes":88,"dest_bytes":14,"network_bytes":102,"event_summary":"\u0000\u0000\u0000T�SMBr\u0000\u0000\u0000\u0000\u0018\u0001(\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000/K\u0000\u0000�^\u00001\u0000\u0002LANMAN1.0\u0000\u0002LM1.2X002\u0000\u0002NT LANMAN 1.0\u0000\u0002NT LM 0.12\u0000"} +{"timestamp":"2026-09-01T07:55:41","event_id":"93739a42-1fa4-4724-8837-fe1ecfa17156","source_ip":"144.172.99.200","source_port":62794,"source_domain":"200.99.172.144.static.cloudzy.com","country_code":"US","country_name":"United States","city_name":"Staten Island","asn_number":14956,"asn_org":"RouterHosting LLC","dest_port":445,"network_protocol":"","application_protocol":"smbv1","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":4,"event_duration":499000000,"source_bytes":455,"dest_bytes":56,"network_bytes":511,"event_summary":"\u0000\u0000\u0000N�SMB2\u0000\u0000\u0000\u0000\u0018\u0007�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000��\u0000\u0000A\u0000\u000f\f\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u00014�\u0000\u0000\u0000\f\u0000B\u0000\u0000\u0000N\u0000\u0001\u0000\u000e\u0000\r\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000"} +{"timestamp":"2026-09-01T07:55:41","event_id":"93739a42-1fa4-4724-8837-fe1ecfa17156","source_ip":"144.172.99.200","source_port":62794,"source_domain":"200.99.172.144.static.cloudzy.com","country_code":"US","country_name":"United States","city_name":"Staten Island","asn_number":14956,"asn_org":"RouterHosting LLC","dest_port":445,"network_protocol":"","application_protocol":"smbv1","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":3,"event_duration":366000000,"source_bytes":373,"dest_bytes":42,"network_bytes":415,"event_summary":"\u0000\u0000\u0000\\�SMBu\u0000\u0000\u0000\u0000\u0018\u0007�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000��\u0000\u0000@\u0000\u0004�\u0000\\\u0000\b\u0000\u0001\u00001\u0000\u0000\\\u0000\\\u00001\u00009\u00002\u0000.\u00001\u00006\u00008\u0000.\u00005\u00006\u0000.\u00002\u00000\u0000\\\u0000I\u0000P\u0000C\u0000$\u0000\u0000\u0000?????\u0000"} +{"timestamp":"2026-09-01T07:55:40","event_id":"93739a42-1fa4-4724-8837-fe1ecfa17156","source_ip":"144.172.99.200","source_port":62794,"source_domain":"200.99.172.144.static.cloudzy.com","country_code":"US","country_name":"United States","city_name":"Staten Island","asn_number":14956,"asn_org":"RouterHosting LLC","dest_port":445,"network_protocol":"","application_protocol":"smbv1","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":2,"event_duration":233000000,"source_bytes":277,"dest_bytes":28,"network_bytes":305,"event_summary":"\u0000\u0000\u0000��SMBs\u0000\u0000\u0000\u0000\u0018\u0007�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000��\u0000\u0000@\u0000\r�\u0000�\u0000\u0004\u0011\n\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000�\u0000\u0000\u0000K\u0000\u0000\u0000\u0000\u0000\u0000W\u0000i\u0000n\u0000d\u0000o\u0000w\u0000s\u0000 \u00002\u00000\u00000\u00000\u0000 \u00002\u00001\u00009\u00005\u0000\u0000\u0000W\u0000i\u0000n\u0000d\u0000o\u0000w\u0000s\u0000 \u00002\u00000\u00000\u00000\u0000 \u00005\u0000.\u00000\u0000\u0000\u0000"} +{"timestamp":"2026-09-01T07:55:40","event_id":"93739a42-1fa4-4724-8837-fe1ecfa17156","source_ip":"144.172.99.200","source_port":62794,"source_domain":"200.99.172.144.static.cloudzy.com","country_code":"US","country_name":"United States","city_name":"Staten Island","asn_number":14956,"asn_org":"RouterHosting LLC","dest_port":445,"network_protocol":"","application_protocol":"","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":137,"dest_bytes":14,"network_bytes":151,"event_summary":"\u0000\u0000\u0000��SMBr\u0000\u0000\u0000\u0000\u0018S�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000��\u0000\u0000@\u0000\u0000b\u0000\u0002PC NETWORK PROGRAM 1.0\u0000\u0002LANMAN1.0\u0000\u0002Windows for Workgroups 3.1a\u0000\u0002LM1.2X002\u0000\u0002LANMAN2.1\u0000\u0002NT LM 0.12\u0000"} +{"timestamp":"2026-09-01T07:55:37","event_id":"6d21ae31-0dcf-4993-b276-5e20d5838ede","source_ip":"144.172.99.200","source_port":61904,"source_domain":"200.99.172.144.static.cloudzy.com","country_code":"US","country_name":"United States","city_name":"Staten Island","asn_number":14956,"asn_org":"RouterHosting LLC","dest_port":445,"network_protocol":"","application_protocol":"smbv1","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":4,"event_duration":499000000,"source_bytes":364,"dest_bytes":56,"network_bytes":420,"event_summary":"\u0000\u0000\u0000J�SMB%\u0000\u0000\u0000\u0000\u0018\u0001(\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0010\u0000\u0000\u0000\u0000����\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000J\u0000\u0000\u0000J\u0000\u0002\u0000#\u0000\u0000\u0000\u0007\u0000\\PIPE\\\u0000"} +{"timestamp":"2026-09-01T07:55:37","event_id":"6d21ae31-0dcf-4993-b276-5e20d5838ede","source_ip":"144.172.99.200","source_port":61904,"source_domain":"200.99.172.144.static.cloudzy.com","country_code":"US","country_name":"United States","city_name":"Staten Island","asn_number":14956,"asn_org":"RouterHosting LLC","dest_port":445,"network_protocol":"","application_protocol":"smbv1","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":3,"event_duration":367000000,"source_bytes":286,"dest_bytes":42,"network_bytes":328,"event_summary":"\u0000\u0000\u0000[�SMBu\u0000\u0000\u0000\u0000\u0018\u0001 \u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000/K\u0002��^\u0004�\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u001c\u0000\u0000\\\\144.172.99.25\\IPC$\u0000?????\u0000PATH_REPLACE__?????\u0000"} +{"timestamp":"2026-09-01T07:55:37","event_id":"6d21ae31-0dcf-4993-b276-5e20d5838ede","source_ip":"144.172.99.200","source_port":61904,"source_domain":"200.99.172.144.static.cloudzy.com","country_code":"US","country_name":"United States","city_name":"Staten Island","asn_number":14956,"asn_org":"RouterHosting LLC","dest_port":445,"network_protocol":"","application_protocol":"smbv1","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":2,"event_duration":234000000,"source_bytes":191,"dest_bytes":28,"network_bytes":219,"event_summary":"\u0000\u0000\u0000c�SMBs\u0000\u0000\u0000\u0000\u0018\u0001 \u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000/K\u0000\u0000�^\r�\u0000\u0000\u0000��\u0002\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000@\u0000\u0000\u0000&\u0000\u0000.\u0000Windows 2000 2195\u0000Windows 2000 5.0\u0000"} +{"timestamp":"2026-09-01T07:55:37","event_id":"6d21ae31-0dcf-4993-b276-5e20d5838ede","source_ip":"144.172.99.200","source_port":61904,"source_domain":"200.99.172.144.static.cloudzy.com","country_code":"US","country_name":"United States","city_name":"Staten Island","asn_number":14956,"asn_org":"RouterHosting LLC","dest_port":445,"network_protocol":"","application_protocol":"","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":101000000,"source_bytes":88,"dest_bytes":14,"network_bytes":102,"event_summary":"\u0000\u0000\u0000T�SMBr\u0000\u0000\u0000\u0000\u0018\u0001(\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000/K\u0000\u0000�^\u00001\u0000\u0002LANMAN1.0\u0000\u0002LM1.2X002\u0000\u0002NT LANMAN 1.0\u0000\u0002NT LM 0.12\u0000"} \ No newline at end of file diff --git a/kevlar/2026-09-07/honeylabs/events-AS198953.ndjson b/kevlar/2026-09-07/honeylabs/events-AS198953.ndjson new file mode 100644 index 0000000..4e32815 --- /dev/null +++ b/kevlar/2026-09-07/honeylabs/events-AS198953.ndjson @@ -0,0 +1,100 @@ +{"timestamp":"2026-09-06T14:40:21","event_id":"c6b4f133-cacf-48b8-a3ed-dd85ed1463f2","source_ip":"176.120.22.240","source_port":17914,"source_domain":"","country_code":"RU","country_name":"Russia","city_name":"","asn_number":198953,"asn_org":"Proton66 OOO","dest_port":4443,"network_protocol":"tls","application_protocol":"http","http_method":"GET","user_agent":"","url_path":"/remote/login?lang=en","url_domain":"","http_request_headers":"{\"accept-encoding\":\"gzip\",\"host\":\":4443\"}","ssh_client_hassh":"","tls_client_ja4":"t12i210600_76e208dd3e22_f28add8e7af0","tls_client_ja3":"c12f54a3f91dc7bafd92cb59fe009a35","tls_client_version":"TLSv1.2","tls_client_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","http_request_ja4h":"ge11nn0200_549fad093d6b","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":2,"event_duration":1582000000,"source_bytes":198,"dest_bytes":158,"network_bytes":356,"event_summary":""} +{"timestamp":"2026-09-06T14:40:19","event_id":"c6b4f133-cacf-48b8-a3ed-dd85ed1463f2","source_ip":"176.120.22.240","source_port":17914,"source_domain":"","country_code":"RU","country_name":"Russia","city_name":"","asn_number":198953,"asn_org":"Proton66 OOO","dest_port":4443,"network_protocol":"tls","application_protocol":"http","http_method":"GET","user_agent":"","url_path":"/remote/login?lang=en","url_domain":"","http_request_headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"Keep-Alive\",\"host\":\":4443\"}","ssh_client_hassh":"","tls_client_ja4":"t12i210600_76e208dd3e22_f28add8e7af0","tls_client_ja3":"c12f54a3f91dc7bafd92cb59fe009a35","tls_client_version":"TLSv1.2","tls_client_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","http_request_ja4h":"ge11nn0300_80168362a4ec","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":165000000,"source_bytes":111,"dest_bytes":79,"network_bytes":190,"event_summary":""} +{"timestamp":"2026-09-06T13:42:24","event_id":"8df6bcd3-93dc-4308-a50f-e49130ee0c56","source_ip":"176.120.22.240","source_port":43708,"source_domain":"","country_code":"RU","country_name":"Russia","city_name":"","asn_number":198953,"asn_org":"Proton66 OOO","dest_port":4443,"network_protocol":"tls","application_protocol":"http","http_method":"GET","user_agent":"","url_path":"/remote/login?lang=en","url_domain":"","http_request_headers":"{\"accept-encoding\":\"gzip\",\"host\":\":4443\"}","ssh_client_hassh":"","tls_client_ja4":"t12i210600_76e208dd3e22_f28add8e7af0","tls_client_ja3":"c12f54a3f91dc7bafd92cb59fe009a35","tls_client_version":"TLSv1.2","tls_client_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","http_request_ja4h":"ge11nn0200_549fad093d6b","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":2,"event_duration":3573000000,"source_bytes":196,"dest_bytes":158,"network_bytes":354,"event_summary":""} +{"timestamp":"2026-09-06T13:42:21","event_id":"8df6bcd3-93dc-4308-a50f-e49130ee0c56","source_ip":"176.120.22.240","source_port":43708,"source_domain":"","country_code":"RU","country_name":"Russia","city_name":"","asn_number":198953,"asn_org":"Proton66 OOO","dest_port":4443,"network_protocol":"tls","application_protocol":"http","http_method":"GET","user_agent":"","url_path":"/remote/login?lang=en","url_domain":"","http_request_headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"Keep-Alive\",\"host\":\":4443\"}","ssh_client_hassh":"","tls_client_ja4":"t12i210600_76e208dd3e22_f28add8e7af0","tls_client_ja3":"c12f54a3f91dc7bafd92cb59fe009a35","tls_client_version":"TLSv1.2","tls_client_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","http_request_ja4h":"ge11nn0300_80168362a4ec","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":750000000,"source_bytes":110,"dest_bytes":79,"network_bytes":189,"event_summary":""} +{"timestamp":"2026-09-06T13:42:21","event_id":"f7973a55-d5f8-443f-a644-22e7cfa408f3","source_ip":"176.120.22.240","source_port":43778,"source_domain":"","country_code":"RU","country_name":"Russia","city_name":"","asn_number":198953,"asn_org":"Proton66 OOO","dest_port":4443,"network_protocol":"tls","application_protocol":"http","http_method":"GET","user_agent":"","url_path":"/remote/login?lang=en","url_domain":"","http_request_headers":"{\"accept-encoding\":\"gzip\",\"host\":\":4443\"}","ssh_client_hassh":"","tls_client_ja4":"t12i210600_76e208dd3e22_f28add8e7af0","tls_client_ja3":"c12f54a3f91dc7bafd92cb59fe009a35","tls_client_version":"TLSv1.2","tls_client_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","http_request_ja4h":"ge11nn0200_549fad093d6b","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":2,"event_duration":1108000000,"source_bytes":196,"dest_bytes":158,"network_bytes":354,"event_summary":""} +{"timestamp":"2026-09-06T13:42:21","event_id":"f7973a55-d5f8-443f-a644-22e7cfa408f3","source_ip":"176.120.22.240","source_port":43778,"source_domain":"","country_code":"RU","country_name":"Russia","city_name":"","asn_number":198953,"asn_org":"Proton66 OOO","dest_port":4443,"network_protocol":"tls","application_protocol":"http","http_method":"GET","user_agent":"","url_path":"/remote/login?lang=en","url_domain":"","http_request_headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"Keep-Alive\",\"host\":\":4443\"}","ssh_client_hassh":"","tls_client_ja4":"t12i210600_76e208dd3e22_f28add8e7af0","tls_client_ja3":"c12f54a3f91dc7bafd92cb59fe009a35","tls_client_version":"TLSv1.2","tls_client_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","http_request_ja4h":"ge11nn0300_80168362a4ec","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":608000000,"source_bytes":110,"dest_bytes":79,"network_bytes":189,"event_summary":""} +{"timestamp":"2026-09-06T12:52:46","event_id":"515790ec-c5a5-4431-bb51-83c808dde8e5","source_ip":"176.120.22.240","source_port":27076,"source_domain":"","country_code":"RU","country_name":"Russia","city_name":"","asn_number":198953,"asn_org":"Proton66 OOO","dest_port":4443,"network_protocol":"tls","application_protocol":"http","http_method":"GET","user_agent":"","url_path":"/remote/login?lang=en","url_domain":"","http_request_headers":"{\"accept-encoding\":\"gzip\",\"host\":\":4443\"}","ssh_client_hassh":"","tls_client_ja4":"t12i210600_76e208dd3e22_f28add8e7af0","tls_client_ja3":"c12f54a3f91dc7bafd92cb59fe009a35","tls_client_version":"TLSv1.2","tls_client_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","http_request_ja4h":"ge11nn0200_549fad093d6b","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":2,"event_duration":1013000000,"source_bytes":200,"dest_bytes":158,"network_bytes":358,"event_summary":""} +{"timestamp":"2026-09-06T12:52:46","event_id":"515790ec-c5a5-4431-bb51-83c808dde8e5","source_ip":"176.120.22.240","source_port":27076,"source_domain":"","country_code":"RU","country_name":"Russia","city_name":"","asn_number":198953,"asn_org":"Proton66 OOO","dest_port":4443,"network_protocol":"tls","application_protocol":"http","http_method":"GET","user_agent":"","url_path":"/remote/login?lang=en","url_domain":"","http_request_headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"Keep-Alive\",\"host\":\":4443\"}","ssh_client_hassh":"","tls_client_ja4":"t12i210600_76e208dd3e22_f28add8e7af0","tls_client_ja3":"c12f54a3f91dc7bafd92cb59fe009a35","tls_client_version":"TLSv1.2","tls_client_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","http_request_ja4h":"ge11nn0300_80168362a4ec","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":640000000,"source_bytes":112,"dest_bytes":79,"network_bytes":191,"event_summary":""} +{"timestamp":"2026-09-04T23:21:09","event_id":"2efbcd64-1acc-417d-90e5-5f308cb5761d","source_ip":"176.120.22.240","source_port":15501,"source_domain":"","country_code":"RU","country_name":"Russia","city_name":"","asn_number":198953,"asn_org":"Proton66 OOO","dest_port":10443,"network_protocol":"tls","application_protocol":"http","http_method":"GET","user_agent":"","url_path":"/remote/login?lang=en","url_domain":"","http_request_headers":"{\"accept-encoding\":\"gzip\",\"host\":\":10443\"}","ssh_client_hassh":"","tls_client_ja4":"t12i210600_76e208dd3e22_f28add8e7af0","tls_client_ja3":"c12f54a3f91dc7bafd92cb59fe009a35","tls_client_version":"TLSv1.2","tls_client_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","http_request_ja4h":"ge11nn0200_549fad093d6b","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":172000000,"source_bytes":88,"dest_bytes":79,"network_bytes":167,"event_summary":""} +{"timestamp":"2026-09-04T23:21:09","event_id":"3ee16f48-c66d-4efe-991b-38a8c2a5b284","source_ip":"176.120.22.240","source_port":6995,"source_domain":"","country_code":"RU","country_name":"Russia","city_name":"","asn_number":198953,"asn_org":"Proton66 OOO","dest_port":4443,"network_protocol":"tls","application_protocol":"http","http_method":"GET","user_agent":"","url_path":"/remote/login?lang=en","url_domain":"","http_request_headers":"{\"accept-encoding\":\"gzip\",\"host\":\":4443\"}","ssh_client_hassh":"","tls_client_ja4":"t12i210600_76e208dd3e22_f28add8e7af0","tls_client_ja3":"c12f54a3f91dc7bafd92cb59fe009a35","tls_client_version":"TLSv1.2","tls_client_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","http_request_ja4h":"ge11nn0200_549fad093d6b","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":181000000,"source_bytes":87,"dest_bytes":79,"network_bytes":166,"event_summary":""} +{"timestamp":"2026-09-04T23:21:09","event_id":"e6bf592d-f101-412d-b0ac-52c1e44f54f9","source_ip":"176.120.22.240","source_port":35419,"source_domain":"","country_code":"RU","country_name":"Russia","city_name":"","asn_number":198953,"asn_org":"Proton66 OOO","dest_port":8443,"network_protocol":"tls","application_protocol":"http","http_method":"GET","user_agent":"","url_path":"/remote/login?lang=en","url_domain":"","http_request_headers":"{\"accept-encoding\":\"gzip\",\"host\":\":8443\"}","ssh_client_hassh":"","tls_client_ja4":"t12i210600_76e208dd3e22_f28add8e7af0","tls_client_ja3":"c12f54a3f91dc7bafd92cb59fe009a35","tls_client_version":"TLSv1.2","tls_client_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","http_request_ja4h":"ge11nn0200_549fad093d6b","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":179000000,"source_bytes":87,"dest_bytes":79,"network_bytes":166,"event_summary":""} +{"timestamp":"2026-09-04T23:19:57","event_id":"6261eeb4-451f-49a6-8585-a2e7c01410e2","source_ip":"176.120.22.240","source_port":6074,"source_domain":"","country_code":"RU","country_name":"Russia","city_name":"","asn_number":198953,"asn_org":"Proton66 OOO","dest_port":10443,"network_protocol":"tls","application_protocol":"http","http_method":"GET","user_agent":"","url_path":"/remote/login?lang=en","url_domain":"","http_request_headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"Keep-Alive\",\"host\":\":10443\"}","ssh_client_hassh":"","tls_client_ja4":"t12i210600_76e208dd3e22_f28add8e7af0","tls_client_ja3":"c12f54a3f91dc7bafd92cb59fe009a35","tls_client_version":"TLSv1.2","tls_client_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","http_request_ja4h":"ge11nn0300_80168362a4ec","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":18663000000,"source_bytes":112,"dest_bytes":79,"network_bytes":191,"event_summary":""} +{"timestamp":"2026-09-04T23:19:57","event_id":"209ef126-d18b-4619-9602-2635a29990d6","source_ip":"176.120.22.240","source_port":6062,"source_domain":"","country_code":"RU","country_name":"Russia","city_name":"","asn_number":198953,"asn_org":"Proton66 OOO","dest_port":4443,"network_protocol":"tls","application_protocol":"http","http_method":"GET","user_agent":"","url_path":"/remote/login?lang=en","url_domain":"","http_request_headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"Keep-Alive\",\"host\":\":4443\"}","ssh_client_hassh":"","tls_client_ja4":"t12i210600_76e208dd3e22_f28add8e7af0","tls_client_ja3":"c12f54a3f91dc7bafd92cb59fe009a35","tls_client_version":"TLSv1.2","tls_client_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","http_request_ja4h":"ge11nn0300_80168362a4ec","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":18715000000,"source_bytes":111,"dest_bytes":79,"network_bytes":190,"event_summary":""} +{"timestamp":"2026-09-04T23:19:57","event_id":"b2fe911a-58a4-4c9f-9f8b-e52f22a00378","source_ip":"176.120.22.240","source_port":63317,"source_domain":"","country_code":"RU","country_name":"Russia","city_name":"","asn_number":198953,"asn_org":"Proton66 OOO","dest_port":8443,"network_protocol":"tls","application_protocol":"http","http_method":"GET","user_agent":"","url_path":"/remote/login?lang=en","url_domain":"","http_request_headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"Keep-Alive\",\"host\":\":8443\"}","ssh_client_hassh":"","tls_client_ja4":"t12i210600_76e208dd3e22_f28add8e7af0","tls_client_ja3":"c12f54a3f91dc7bafd92cb59fe009a35","tls_client_version":"TLSv1.2","tls_client_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","http_request_ja4h":"ge11nn0300_80168362a4ec","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":19767000000,"source_bytes":111,"dest_bytes":79,"network_bytes":190,"event_summary":""} +{"timestamp":"2026-09-04T21:27:35","event_id":"3d51b233-b72a-4e3d-9374-22f7b72a698f","source_ip":"193.143.1.66","source_port":13521,"source_domain":"","country_code":"RU","country_name":"Russia","city_name":"Moscow","asn_number":198953,"asn_org":"Proton66 OOO","dest_port":33894,"network_protocol":"","application_protocol":"rdp","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":44,"dest_bytes":12,"network_bytes":56,"event_summary":"\u0003\u0000\u0000,'�\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Domain\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000"} +{"timestamp":"2026-09-04T21:27:34","event_id":"02cd9693-c407-470a-8c96-b06ee169f0b3","source_ip":"193.143.1.66","source_port":13197,"source_domain":"","country_code":"RU","country_name":"Russia","city_name":"Moscow","asn_number":198953,"asn_org":"Proton66 OOO","dest_port":33894,"network_protocol":"","application_protocol":"rdp","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":44,"dest_bytes":12,"network_bytes":56,"event_summary":"\u0003\u0000\u0000,'�\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Domain\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000"} +{"timestamp":"2026-09-04T21:27:34","event_id":"5f5ce89b-5827-4158-bd0a-09255f73689f","source_ip":"193.143.1.66","source_port":12902,"source_domain":"","country_code":"RU","country_name":"Russia","city_name":"Moscow","asn_number":198953,"asn_org":"Proton66 OOO","dest_port":33894,"network_protocol":"","application_protocol":"rdp","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":44,"dest_bytes":12,"network_bytes":56,"event_summary":"\u0003\u0000\u0000,'�\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Domain\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000"} +{"timestamp":"2026-09-04T20:33:55","event_id":"0b8506bb-db78-4f84-ba0a-a6bd071ff84f","source_ip":"193.143.1.66","source_port":56343,"source_domain":"","country_code":"RU","country_name":"Russia","city_name":"Moscow","asn_number":198953,"asn_org":"Proton66 OOO","dest_port":3389,"network_protocol":"","application_protocol":"rdp","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":44,"dest_bytes":12,"network_bytes":56,"event_summary":"\u0003\u0000\u0000,'�\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Domain\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000"} +{"timestamp":"2026-09-04T20:33:55","event_id":"d3b97721-5efa-4457-999c-a156974d0b58","source_ip":"193.143.1.66","source_port":55780,"source_domain":"","country_code":"RU","country_name":"Russia","city_name":"Moscow","asn_number":198953,"asn_org":"Proton66 OOO","dest_port":3389,"network_protocol":"","application_protocol":"rdp","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":44,"dest_bytes":12,"network_bytes":56,"event_summary":"\u0003\u0000\u0000,'�\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Domain\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000"} +{"timestamp":"2026-09-04T20:33:55","event_id":"6f9e066e-5ff1-4447-a687-c3a1057484f1","source_ip":"193.143.1.66","source_port":55298,"source_domain":"","country_code":"RU","country_name":"Russia","city_name":"Moscow","asn_number":198953,"asn_org":"Proton66 OOO","dest_port":3389,"network_protocol":"","application_protocol":"rdp","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":44,"dest_bytes":12,"network_bytes":56,"event_summary":"\u0003\u0000\u0000,'�\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=Domain\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000"} +{"timestamp":"2026-09-04T15:44:29","event_id":"78cbc648-75e1-4221-b03c-fa76c30a7012","source_ip":"176.120.22.240","source_port":27106,"source_domain":"","country_code":"RU","country_name":"Russia","city_name":"","asn_number":198953,"asn_org":"Proton66 OOO","dest_port":8443,"network_protocol":"tls","application_protocol":"http","http_method":"GET","user_agent":"","url_path":"/remote/login?lang=en","url_domain":"","http_request_headers":"{\"accept-encoding\":\"gzip\",\"host\":\":8443\"}","ssh_client_hassh":"","tls_client_ja4":"t12i210600_76e208dd3e22_f28add8e7af0","tls_client_ja3":"c12f54a3f91dc7bafd92cb59fe009a35","tls_client_version":"TLSv1.2","tls_client_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","http_request_ja4h":"ge11nn0200_549fad093d6b","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":2,"event_duration":13905000000,"source_bytes":196,"dest_bytes":158,"network_bytes":354,"event_summary":""} +{"timestamp":"2026-09-04T15:44:29","event_id":"19e11de3-0718-4b96-8006-f3b54582be18","source_ip":"176.120.22.240","source_port":27135,"source_domain":"","country_code":"RU","country_name":"Russia","city_name":"","asn_number":198953,"asn_org":"Proton66 OOO","dest_port":8443,"network_protocol":"tls","application_protocol":"http","http_method":"GET","user_agent":"","url_path":"/remote/login?lang=en","url_domain":"","http_request_headers":"{\"accept-encoding\":\"gzip\",\"host\":\":8443\"}","ssh_client_hassh":"","tls_client_ja4":"t12i210600_76e208dd3e22_f28add8e7af0","tls_client_ja3":"c12f54a3f91dc7bafd92cb59fe009a35","tls_client_version":"TLSv1.2","tls_client_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","http_request_ja4h":"ge11nn0200_549fad093d6b","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":2,"event_duration":14281000000,"source_bytes":196,"dest_bytes":158,"network_bytes":354,"event_summary":""} +{"timestamp":"2026-09-04T15:44:15","event_id":"78cbc648-75e1-4221-b03c-fa76c30a7012","source_ip":"176.120.22.240","source_port":27106,"source_domain":"","country_code":"RU","country_name":"Russia","city_name":"","asn_number":198953,"asn_org":"Proton66 OOO","dest_port":8443,"network_protocol":"tls","application_protocol":"http","http_method":"GET","user_agent":"","url_path":"/remote/login?lang=en","url_domain":"","http_request_headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"Keep-Alive\",\"host\":\":8443\"}","ssh_client_hassh":"","tls_client_ja4":"t12i210600_76e208dd3e22_f28add8e7af0","tls_client_ja3":"c12f54a3f91dc7bafd92cb59fe009a35","tls_client_version":"TLSv1.2","tls_client_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","http_request_ja4h":"ge11nn0300_80168362a4ec","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":562000000,"source_bytes":110,"dest_bytes":79,"network_bytes":189,"event_summary":""} +{"timestamp":"2026-09-04T15:44:15","event_id":"19e11de3-0718-4b96-8006-f3b54582be18","source_ip":"176.120.22.240","source_port":27135,"source_domain":"","country_code":"RU","country_name":"Russia","city_name":"","asn_number":198953,"asn_org":"Proton66 OOO","dest_port":8443,"network_protocol":"tls","application_protocol":"http","http_method":"GET","user_agent":"","url_path":"/remote/login?lang=en","url_domain":"","http_request_headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"Keep-Alive\",\"host\":\":8443\"}","ssh_client_hassh":"","tls_client_ja4":"t12i210600_76e208dd3e22_f28add8e7af0","tls_client_ja3":"c12f54a3f91dc7bafd92cb59fe009a35","tls_client_version":"TLSv1.2","tls_client_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","http_request_ja4h":"ge11nn0300_80168362a4ec","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":602000000,"source_bytes":110,"dest_bytes":79,"network_bytes":189,"event_summary":""} +{"timestamp":"2026-09-04T15:30:28","event_id":"3ff413eb-9ed9-47a0-a1fa-a4ae8bd38d83","source_ip":"176.120.22.240","source_port":41882,"source_domain":"","country_code":"RU","country_name":"Russia","city_name":"","asn_number":198953,"asn_org":"Proton66 OOO","dest_port":4443,"network_protocol":"tls","application_protocol":"http","http_method":"GET","user_agent":"","url_path":"/remote/login?lang=en","url_domain":"","http_request_headers":"{\"accept-encoding\":\"gzip\",\"host\":\":4443\"}","ssh_client_hassh":"","tls_client_ja4":"t12i210600_76e208dd3e22_f28add8e7af0","tls_client_ja3":"c12f54a3f91dc7bafd92cb59fe009a35","tls_client_version":"TLSv1.2","tls_client_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","http_request_ja4h":"ge11nn0200_549fad093d6b","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":2,"event_duration":17602000000,"source_bytes":200,"dest_bytes":158,"network_bytes":358,"event_summary":""} +{"timestamp":"2026-09-04T15:30:28","event_id":"7073c07c-b02f-48b3-8099-23c8cb6e379d","source_ip":"176.120.22.240","source_port":41853,"source_domain":"","country_code":"RU","country_name":"Russia","city_name":"","asn_number":198953,"asn_org":"Proton66 OOO","dest_port":8443,"network_protocol":"tls","application_protocol":"http","http_method":"GET","user_agent":"","url_path":"/remote/login?lang=en","url_domain":"","http_request_headers":"{\"accept-encoding\":\"gzip\",\"host\":\":8443\"}","ssh_client_hassh":"","tls_client_ja4":"t12i210600_76e208dd3e22_f28add8e7af0","tls_client_ja3":"c12f54a3f91dc7bafd92cb59fe009a35","tls_client_version":"TLSv1.2","tls_client_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","http_request_ja4h":"ge11nn0200_549fad093d6b","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":2,"event_duration":17598000000,"source_bytes":200,"dest_bytes":158,"network_bytes":358,"event_summary":""} +{"timestamp":"2026-09-04T15:30:16","event_id":"3ff413eb-9ed9-47a0-a1fa-a4ae8bd38d83","source_ip":"176.120.22.240","source_port":41882,"source_domain":"","country_code":"RU","country_name":"Russia","city_name":"","asn_number":198953,"asn_org":"Proton66 OOO","dest_port":4443,"network_protocol":"tls","application_protocol":"http","http_method":"GET","user_agent":"","url_path":"/remote/login?lang=en","url_domain":"","http_request_headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"Keep-Alive\",\"host\":\":4443\"}","ssh_client_hassh":"","tls_client_ja4":"t12i210600_76e208dd3e22_f28add8e7af0","tls_client_ja3":"c12f54a3f91dc7bafd92cb59fe009a35","tls_client_version":"TLSv1.2","tls_client_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","http_request_ja4h":"ge11nn0300_80168362a4ec","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":6383000000,"source_bytes":112,"dest_bytes":79,"network_bytes":191,"event_summary":""} +{"timestamp":"2026-09-04T15:30:16","event_id":"7073c07c-b02f-48b3-8099-23c8cb6e379d","source_ip":"176.120.22.240","source_port":41853,"source_domain":"","country_code":"RU","country_name":"Russia","city_name":"","asn_number":198953,"asn_org":"Proton66 OOO","dest_port":8443,"network_protocol":"tls","application_protocol":"http","http_method":"GET","user_agent":"","url_path":"/remote/login?lang=en","url_domain":"","http_request_headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"Keep-Alive\",\"host\":\":8443\"}","ssh_client_hassh":"","tls_client_ja4":"t12i210600_76e208dd3e22_f28add8e7af0","tls_client_ja3":"c12f54a3f91dc7bafd92cb59fe009a35","tls_client_version":"TLSv1.2","tls_client_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","http_request_ja4h":"ge11nn0300_80168362a4ec","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":6304000000,"source_bytes":112,"dest_bytes":79,"network_bytes":191,"event_summary":""} +{"timestamp":"2026-09-04T13:58:36","event_id":"316dbfe6-366f-4b78-bd09-72b3b411d78f","source_ip":"176.120.22.240","source_port":62250,"source_domain":"","country_code":"RU","country_name":"Russia","city_name":"","asn_number":198953,"asn_org":"Proton66 OOO","dest_port":4443,"network_protocol":"tls","application_protocol":"http","http_method":"GET","user_agent":"","url_path":"/remote/login?lang=en","url_domain":"","http_request_headers":"{\"accept-encoding\":\"gzip\",\"host\":\":4443\"}","ssh_client_hassh":"","tls_client_ja4":"t12i210600_76e208dd3e22_f28add8e7af0","tls_client_ja3":"c12f54a3f91dc7bafd92cb59fe009a35","tls_client_version":"TLSv1.2","tls_client_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","http_request_ja4h":"ge11nn0200_549fad093d6b","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":2,"event_duration":7323000000,"source_bytes":198,"dest_bytes":158,"network_bytes":356,"event_summary":""} +{"timestamp":"2026-09-04T13:58:30","event_id":"316dbfe6-366f-4b78-bd09-72b3b411d78f","source_ip":"176.120.22.240","source_port":62250,"source_domain":"","country_code":"RU","country_name":"Russia","city_name":"","asn_number":198953,"asn_org":"Proton66 OOO","dest_port":4443,"network_protocol":"tls","application_protocol":"http","http_method":"GET","user_agent":"","url_path":"/remote/login?lang=en","url_domain":"","http_request_headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"Keep-Alive\",\"host\":\":4443\"}","ssh_client_hassh":"","tls_client_ja4":"t12i210600_76e208dd3e22_f28add8e7af0","tls_client_ja3":"c12f54a3f91dc7bafd92cb59fe009a35","tls_client_version":"TLSv1.2","tls_client_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","http_request_ja4h":"ge11nn0300_80168362a4ec","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":1116000000,"source_bytes":111,"dest_bytes":79,"network_bytes":190,"event_summary":""} +{"timestamp":"2026-09-04T12:25:21","event_id":"98aeb392-8479-47ea-8f51-d29b0c51188d","source_ip":"176.120.22.240","source_port":9818,"source_domain":"","country_code":"RU","country_name":"Russia","city_name":"","asn_number":198953,"asn_org":"Proton66 OOO","dest_port":4443,"network_protocol":"tls","application_protocol":"http","http_method":"GET","user_agent":"","url_path":"/remote/login?lang=en","url_domain":"","http_request_headers":"{\"accept-encoding\":\"gzip\",\"host\":\":4443\"}","ssh_client_hassh":"","tls_client_ja4":"t12i210600_76e208dd3e22_f28add8e7af0","tls_client_ja3":"c12f54a3f91dc7bafd92cb59fe009a35","tls_client_version":"TLSv1.2","tls_client_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","http_request_ja4h":"ge11nn0200_549fad093d6b","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":2,"event_duration":985000000,"source_bytes":196,"dest_bytes":158,"network_bytes":354,"event_summary":""} +{"timestamp":"2026-09-04T12:25:21","event_id":"dab757f4-21a9-4941-b2b9-e52e9232f922","source_ip":"176.120.22.240","source_port":9815,"source_domain":"","country_code":"RU","country_name":"Russia","city_name":"","asn_number":198953,"asn_org":"Proton66 OOO","dest_port":4443,"network_protocol":"tls","application_protocol":"http","http_method":"GET","user_agent":"","url_path":"/remote/login?lang=en","url_domain":"","http_request_headers":"{\"accept-encoding\":\"gzip\",\"host\":\":4443\"}","ssh_client_hassh":"","tls_client_ja4":"t12i210600_76e208dd3e22_f28add8e7af0","tls_client_ja3":"c12f54a3f91dc7bafd92cb59fe009a35","tls_client_version":"TLSv1.2","tls_client_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","http_request_ja4h":"ge11nn0200_549fad093d6b","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":2,"event_duration":1194000000,"source_bytes":196,"dest_bytes":158,"network_bytes":354,"event_summary":""} +{"timestamp":"2026-09-04T12:25:20","event_id":"98aeb392-8479-47ea-8f51-d29b0c51188d","source_ip":"176.120.22.240","source_port":9818,"source_domain":"","country_code":"RU","country_name":"Russia","city_name":"","asn_number":198953,"asn_org":"Proton66 OOO","dest_port":4443,"network_protocol":"tls","application_protocol":"http","http_method":"GET","user_agent":"","url_path":"/remote/login?lang=en","url_domain":"","http_request_headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"Keep-Alive\",\"host\":\":4443\"}","ssh_client_hassh":"","tls_client_ja4":"t12i210600_76e208dd3e22_f28add8e7af0","tls_client_ja3":"c12f54a3f91dc7bafd92cb59fe009a35","tls_client_version":"TLSv1.2","tls_client_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","http_request_ja4h":"ge11nn0300_80168362a4ec","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":582000000,"source_bytes":110,"dest_bytes":79,"network_bytes":189,"event_summary":""} +{"timestamp":"2026-09-04T12:25:20","event_id":"dab757f4-21a9-4941-b2b9-e52e9232f922","source_ip":"176.120.22.240","source_port":9815,"source_domain":"","country_code":"RU","country_name":"Russia","city_name":"","asn_number":198953,"asn_org":"Proton66 OOO","dest_port":4443,"network_protocol":"tls","application_protocol":"http","http_method":"GET","user_agent":"","url_path":"/remote/login?lang=en","url_domain":"","http_request_headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"Keep-Alive\",\"host\":\":4443\"}","ssh_client_hassh":"","tls_client_ja4":"t12i210600_76e208dd3e22_f28add8e7af0","tls_client_ja3":"c12f54a3f91dc7bafd92cb59fe009a35","tls_client_version":"TLSv1.2","tls_client_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","http_request_ja4h":"ge11nn0300_80168362a4ec","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":729000000,"source_bytes":110,"dest_bytes":79,"network_bytes":189,"event_summary":""} +{"timestamp":"2026-09-04T11:31:53","event_id":"8d98cfbf-f75d-4faa-a0d4-0722f2749080","source_ip":"176.120.22.240","source_port":12439,"source_domain":"","country_code":"RU","country_name":"Russia","city_name":"","asn_number":198953,"asn_org":"Proton66 OOO","dest_port":4443,"network_protocol":"tls","application_protocol":"http","http_method":"GET","user_agent":"","url_path":"/remote/login?lang=en","url_domain":"","http_request_headers":"{\"accept-encoding\":\"gzip\",\"host\":\":4443\"}","ssh_client_hassh":"","tls_client_ja4":"t12i210600_76e208dd3e22_f28add8e7af0","tls_client_ja3":"c12f54a3f91dc7bafd92cb59fe009a35","tls_client_version":"TLSv1.2","tls_client_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","http_request_ja4h":"ge11nn0200_549fad093d6b","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":2,"event_duration":1483000000,"source_bytes":200,"dest_bytes":158,"network_bytes":358,"event_summary":""} +{"timestamp":"2026-09-04T11:31:53","event_id":"8d98cfbf-f75d-4faa-a0d4-0722f2749080","source_ip":"176.120.22.240","source_port":12439,"source_domain":"","country_code":"RU","country_name":"Russia","city_name":"","asn_number":198953,"asn_org":"Proton66 OOO","dest_port":4443,"network_protocol":"tls","application_protocol":"http","http_method":"GET","user_agent":"","url_path":"/remote/login?lang=en","url_domain":"","http_request_headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"Keep-Alive\",\"host\":\":4443\"}","ssh_client_hassh":"","tls_client_ja4":"t12i210600_76e208dd3e22_f28add8e7af0","tls_client_ja3":"c12f54a3f91dc7bafd92cb59fe009a35","tls_client_version":"TLSv1.2","tls_client_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","http_request_ja4h":"ge11nn0300_80168362a4ec","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":1160000000,"source_bytes":112,"dest_bytes":79,"network_bytes":191,"event_summary":""} +{"timestamp":"2026-09-04T10:20:48","event_id":"a8427ab9-3afa-43f6-b66d-38f3ba237750","source_ip":"176.120.22.61","source_port":12948,"source_domain":"","country_code":"RU","country_name":"Russia","city_name":"","asn_number":198953,"asn_org":"Proton66 OOO","dest_port":1800,"network_protocol":"","application_protocol":"mssql-tds","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":26,"dest_bytes":13,"network_bytes":39,"event_summary":"\u0012\u0001\u0000\u001a\u0000\u0000\u0001\u0000\u0000\u0000\u000b\u0000\u0006\u0001\u0000\u0011\u0000\u0001�\u000f\u0000\u0007�\u0000\u0000\u0002"} +{"timestamp":"2026-09-04T10:20:48","event_id":"a2830b10-93e6-46b3-b472-781538ff3a6d","source_ip":"176.120.22.61","source_port":12708,"source_domain":"","country_code":"RU","country_name":"Russia","city_name":"","asn_number":198953,"asn_org":"Proton66 OOO","dest_port":3000,"network_protocol":"","application_protocol":"mssql-tds","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":26,"dest_bytes":13,"network_bytes":39,"event_summary":"\u0012\u0001\u0000\u001a\u0000\u0000\u0001\u0000\u0000\u0000\u000b\u0000\u0006\u0001\u0000\u0011\u0000\u0001�\u000f\u0000\u0007�\u0000\u0000\u0002"} +{"timestamp":"2026-09-04T10:20:48","event_id":"73a246f9-3d46-46e9-8a75-c9fa2a5e5bd5","source_ip":"176.120.22.61","source_port":11952,"source_domain":"","country_code":"RU","country_name":"Russia","city_name":"","asn_number":198953,"asn_org":"Proton66 OOO","dest_port":4433,"network_protocol":"","application_protocol":"mssql-tds","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":104000000,"source_bytes":26,"dest_bytes":13,"network_bytes":39,"event_summary":"\u0012\u0001\u0000\u001a\u0000\u0000\u0001\u0000\u0000\u0000\u000b\u0000\u0006\u0001\u0000\u0011\u0000\u0001�\u000f\u0000\u0007�\u0000\u0000\u0002"} +{"timestamp":"2026-09-04T10:20:48","event_id":"f13b11b1-a9da-4a61-8a1f-f1743ef4e8c9","source_ip":"176.120.22.61","source_port":11865,"source_domain":"","country_code":"RU","country_name":"Russia","city_name":"","asn_number":198953,"asn_org":"Proton66 OOO","dest_port":1440,"network_protocol":"","application_protocol":"mssql-tds","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":26,"dest_bytes":13,"network_bytes":39,"event_summary":"\u0012\u0001\u0000\u001a\u0000\u0000\u0001\u0000\u0000\u0000\u000b\u0000\u0006\u0001\u0000\u0011\u0000\u0001�\u000f\u0000\u0007�\u0000\u0000\u0002"} +{"timestamp":"2026-09-04T10:20:48","event_id":"483854e6-3fed-454f-9fb3-be5af86d71a7","source_ip":"176.120.22.61","source_port":11413,"source_domain":"","country_code":"RU","country_name":"Russia","city_name":"","asn_number":198953,"asn_org":"Proton66 OOO","dest_port":2017,"network_protocol":"","application_protocol":"mssql-tds","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":101000000,"source_bytes":26,"dest_bytes":13,"network_bytes":39,"event_summary":"\u0012\u0001\u0000\u001a\u0000\u0000\u0001\u0000\u0000\u0000\u000b\u0000\u0006\u0001\u0000\u0011\u0000\u0001�\u000f\u0000\u0007�\u0000\u0000\u0002"} +{"timestamp":"2026-09-04T10:20:48","event_id":"eaf68c53-27c4-43cf-a1fa-5728178f0992","source_ip":"176.120.22.61","source_port":10858,"source_domain":"","country_code":"RU","country_name":"Russia","city_name":"","asn_number":198953,"asn_org":"Proton66 OOO","dest_port":8888,"network_protocol":"","application_protocol":"mssql-tds","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":26,"dest_bytes":13,"network_bytes":39,"event_summary":"\u0012\u0001\u0000\u001a\u0000\u0000\u0001\u0000\u0000\u0000\u000b\u0000\u0006\u0001\u0000\u0011\u0000\u0001�\u000f\u0000\u0007�\u0000\u0000\u0002"} +{"timestamp":"2026-09-04T10:20:48","event_id":"99ac8188-a367-4fd0-83f7-94a4099af177","source_ip":"176.120.22.61","source_port":9298,"source_domain":"","country_code":"RU","country_name":"Russia","city_name":"","asn_number":198953,"asn_org":"Proton66 OOO","dest_port":23341,"network_protocol":"","application_protocol":"mssql-tds","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":26,"dest_bytes":13,"network_bytes":39,"event_summary":"\u0012\u0001\u0000\u001a\u0000\u0000\u0001\u0000\u0000\u0000\u000b\u0000\u0006\u0001\u0000\u0011\u0000\u0001�\u000f\u0000\u0007�\u0000\u0000\u0002"} +{"timestamp":"2026-09-04T10:20:48","event_id":"a140dd13-f085-4d38-817a-922a733fd77e","source_ip":"176.120.22.61","source_port":8888,"source_domain":"","country_code":"RU","country_name":"Russia","city_name":"","asn_number":198953,"asn_org":"Proton66 OOO","dest_port":14334,"network_protocol":"","application_protocol":"mssql-tds","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":26,"dest_bytes":13,"network_bytes":39,"event_summary":"\u0012\u0001\u0000\u001a\u0000\u0000\u0001\u0000\u0000\u0000\u000b\u0000\u0006\u0001\u0000\u0011\u0000\u0001�\u000f\u0000\u0007�\u0000\u0000\u0002"} +{"timestamp":"2026-09-04T10:20:48","event_id":"621060ba-c577-47b6-acff-785b51011e13","source_ip":"176.120.22.61","source_port":8816,"source_domain":"","country_code":"RU","country_name":"Russia","city_name":"","asn_number":198953,"asn_org":"Proton66 OOO","dest_port":6802,"network_protocol":"","application_protocol":"mssql-tds","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":26,"dest_bytes":13,"network_bytes":39,"event_summary":"\u0012\u0001\u0000\u001a\u0000\u0000\u0001\u0000\u0000\u0000\u000b\u0000\u0006\u0001\u0000\u0011\u0000\u0001�\u000f\u0000\u0007�\u0000\u0000\u0002"} +{"timestamp":"2026-09-04T10:20:48","event_id":"b67eb01f-fb27-44cd-9f48-fd4429b059bb","source_ip":"176.120.22.61","source_port":8553,"source_domain":"","country_code":"RU","country_name":"Russia","city_name":"","asn_number":198953,"asn_org":"Proton66 OOO","dest_port":35366,"network_protocol":"","application_protocol":"mssql-tds","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":26,"dest_bytes":13,"network_bytes":39,"event_summary":"\u0012\u0001\u0000\u001a\u0000\u0000\u0001\u0000\u0000\u0000\u000b\u0000\u0006\u0001\u0000\u0011\u0000\u0001�\u000f\u0000\u0007�\u0000\u0000\u0002"} +{"timestamp":"2026-09-04T10:20:48","event_id":"8b17de74-63d9-464b-8467-5861e5735bcb","source_ip":"176.120.22.61","source_port":8541,"source_domain":"","country_code":"RU","country_name":"Russia","city_name":"","asn_number":198953,"asn_org":"Proton66 OOO","dest_port":5001,"network_protocol":"","application_protocol":"targusdataspeed","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":26,"dest_bytes":13,"network_bytes":39,"event_summary":"\u0012\u0001\u0000\u001a\u0000\u0000\u0001\u0000\u0000\u0000\u000b\u0000\u0006\u0001\u0000\u0011\u0000\u0001�\u000f\u0000\u0007�\u0000\u0000\u0002"} +{"timestamp":"2026-09-04T10:20:48","event_id":"a1486c2b-40b3-457d-9e5f-f8b3b6aaf180","source_ip":"176.120.22.61","source_port":7634,"source_domain":"","country_code":"RU","country_name":"Russia","city_name":"","asn_number":198953,"asn_org":"Proton66 OOO","dest_port":22020,"network_protocol":"","application_protocol":"mssql-tds","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":26,"dest_bytes":13,"network_bytes":39,"event_summary":"\u0012\u0001\u0000\u001a\u0000\u0000\u0001\u0000\u0000\u0000\u000b\u0000\u0006\u0001\u0000\u0011\u0000\u0001�\u000f\u0000\u0007�\u0000\u0000\u0002"} +{"timestamp":"2026-09-04T10:20:48","event_id":"41d2ac12-97da-40ab-9fe7-856ea326c9ce","source_ip":"176.120.22.61","source_port":7540,"source_domain":"","country_code":"RU","country_name":"Russia","city_name":"","asn_number":198953,"asn_org":"Proton66 OOO","dest_port":9898,"network_protocol":"","application_protocol":"mssql-tds","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":26,"dest_bytes":13,"network_bytes":39,"event_summary":"\u0012\u0001\u0000\u001a\u0000\u0000\u0001\u0000\u0000\u0000\u000b\u0000\u0006\u0001\u0000\u0011\u0000\u0001�\u000f\u0000\u0007�\u0000\u0000\u0002"} +{"timestamp":"2026-09-04T10:20:48","event_id":"0684d3d9-ab38-443c-abf0-a33ca6b9c1ef","source_ip":"176.120.22.61","source_port":7374,"source_domain":"","country_code":"RU","country_name":"Russia","city_name":"","asn_number":198953,"asn_org":"Proton66 OOO","dest_port":9090,"network_protocol":"","application_protocol":"mssql-tds","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":101000000,"source_bytes":26,"dest_bytes":13,"network_bytes":39,"event_summary":"\u0012\u0001\u0000\u001a\u0000\u0000\u0001\u0000\u0000\u0000\u000b\u0000\u0006\u0001\u0000\u0011\u0000\u0001�\u000f\u0000\u0007�\u0000\u0000\u0002"} +{"timestamp":"2026-09-04T10:20:48","event_id":"67a22ac6-ba60-4fdc-a81d-acc4d8792d46","source_ip":"176.120.22.61","source_port":7154,"source_domain":"","country_code":"RU","country_name":"Russia","city_name":"","asn_number":198953,"asn_org":"Proton66 OOO","dest_port":49160,"network_protocol":"","application_protocol":"mssql-tds","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":26,"dest_bytes":13,"network_bytes":39,"event_summary":"\u0012\u0001\u0000\u001a\u0000\u0000\u0001\u0000\u0000\u0000\u000b\u0000\u0006\u0001\u0000\u0011\u0000\u0001�\u000f\u0000\u0007�\u0000\u0000\u0002"} +{"timestamp":"2026-09-04T10:20:48","event_id":"e322d632-ef38-496c-9068-c4cdc34ecf28","source_ip":"176.120.22.61","source_port":6429,"source_domain":"","country_code":"RU","country_name":"Russia","city_name":"","asn_number":198953,"asn_org":"Proton66 OOO","dest_port":4404,"network_protocol":"","application_protocol":"mssql-tds","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":26,"dest_bytes":13,"network_bytes":39,"event_summary":"\u0012\u0001\u0000\u001a\u0000\u0000\u0001\u0000\u0000\u0000\u000b\u0000\u0006\u0001\u0000\u0011\u0000\u0001�\u000f\u0000\u0007�\u0000\u0000\u0002"} +{"timestamp":"2026-09-04T10:20:48","event_id":"20ad0940-8e99-4990-a45f-a7c2fe6505a8","source_ip":"176.120.22.61","source_port":5921,"source_domain":"","country_code":"RU","country_name":"Russia","city_name":"","asn_number":198953,"asn_org":"Proton66 OOO","dest_port":4000,"network_protocol":"","application_protocol":"mssql-tds","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":26,"dest_bytes":13,"network_bytes":39,"event_summary":"\u0012\u0001\u0000\u001a\u0000\u0000\u0001\u0000\u0000\u0000\u000b\u0000\u0006\u0001\u0000\u0011\u0000\u0001�\u000f\u0000\u0007�\u0000\u0000\u0002"} +{"timestamp":"2026-09-04T10:20:48","event_id":"4b75f0f1-a284-48a8-b2ae-ac2da37dfa9a","source_ip":"176.120.22.61","source_port":5865,"source_domain":"","country_code":"RU","country_name":"Russia","city_name":"","asn_number":198953,"asn_org":"Proton66 OOO","dest_port":7979,"network_protocol":"","application_protocol":"mssql-tds","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":26,"dest_bytes":13,"network_bytes":39,"event_summary":"\u0012\u0001\u0000\u001a\u0000\u0000\u0001\u0000\u0000\u0000\u000b\u0000\u0006\u0001\u0000\u0011\u0000\u0001�\u000f\u0000\u0007�\u0000\u0000\u0002"} +{"timestamp":"2026-09-04T10:20:48","event_id":"4fed8360-19ae-4dab-8e9f-96e05d38bc3a","source_ip":"176.120.22.61","source_port":5655,"source_domain":"","country_code":"RU","country_name":"Russia","city_name":"","asn_number":198953,"asn_org":"Proton66 OOO","dest_port":1588,"network_protocol":"","application_protocol":"mssql-tds","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":26,"dest_bytes":13,"network_bytes":39,"event_summary":"\u0012\u0001\u0000\u001a\u0000\u0000\u0001\u0000\u0000\u0000\u000b\u0000\u0006\u0001\u0000\u0011\u0000\u0001�\u000f\u0000\u0007�\u0000\u0000\u0002"} +{"timestamp":"2026-09-04T10:20:48","event_id":"0b036645-c174-460d-a42f-d4a40a8cf9f8","source_ip":"176.120.22.61","source_port":5450,"source_domain":"","country_code":"RU","country_name":"Russia","city_name":"","asn_number":198953,"asn_org":"Proton66 OOO","dest_port":1333,"network_protocol":"","application_protocol":"mssql-tds","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":26,"dest_bytes":13,"network_bytes":39,"event_summary":"\u0012\u0001\u0000\u001a\u0000\u0000\u0001\u0000\u0000\u0000\u000b\u0000\u0006\u0001\u0000\u0011\u0000\u0001�\u000f\u0000\u0007�\u0000\u0000\u0002"} +{"timestamp":"2026-09-04T10:20:48","event_id":"d8baa34d-f832-4696-acbb-7c4298ecc2e7","source_ip":"176.120.22.61","source_port":5419,"source_domain":"","country_code":"RU","country_name":"Russia","city_name":"","asn_number":198953,"asn_org":"Proton66 OOO","dest_port":5005,"network_protocol":"","application_protocol":"mssql-tds","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":26,"dest_bytes":13,"network_bytes":39,"event_summary":"\u0012\u0001\u0000\u001a\u0000\u0000\u0001\u0000\u0000\u0000\u000b\u0000\u0006\u0001\u0000\u0011\u0000\u0001�\u000f\u0000\u0007�\u0000\u0000\u0002"} +{"timestamp":"2026-09-04T10:20:48","event_id":"5b328763-1118-433c-8938-93bbad7c422d","source_ip":"176.120.22.61","source_port":5345,"source_domain":"","country_code":"RU","country_name":"Russia","city_name":"","asn_number":198953,"asn_org":"Proton66 OOO","dest_port":8989,"network_protocol":"","application_protocol":"mssql-tds","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":101000000,"source_bytes":26,"dest_bytes":13,"network_bytes":39,"event_summary":"\u0012\u0001\u0000\u001a\u0000\u0000\u0001\u0000\u0000\u0000\u000b\u0000\u0006\u0001\u0000\u0011\u0000\u0001�\u000f\u0000\u0007�\u0000\u0000\u0002"} +{"timestamp":"2026-09-04T10:20:48","event_id":"e1f99dfc-4de0-4ffe-84b1-8795d654cd62","source_ip":"176.120.22.61","source_port":5173,"source_domain":"","country_code":"RU","country_name":"Russia","city_name":"","asn_number":198953,"asn_org":"Proton66 OOO","dest_port":2580,"network_protocol":"","application_protocol":"mssql-tds","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":26,"dest_bytes":13,"network_bytes":39,"event_summary":"\u0012\u0001\u0000\u001a\u0000\u0000\u0001\u0000\u0000\u0000\u000b\u0000\u0006\u0001\u0000\u0011\u0000\u0001�\u000f\u0000\u0007�\u0000\u0000\u0002"} +{"timestamp":"2026-09-04T10:20:48","event_id":"64274e39-df26-434a-b310-10554dd5e05b","source_ip":"176.120.22.61","source_port":5181,"source_domain":"","country_code":"RU","country_name":"Russia","city_name":"","asn_number":198953,"asn_org":"Proton66 OOO","dest_port":1444,"network_protocol":"","application_protocol":"mssql-tds","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":26,"dest_bytes":13,"network_bytes":39,"event_summary":"\u0012\u0001\u0000\u001a\u0000\u0000\u0001\u0000\u0000\u0000\u000b\u0000\u0006\u0001\u0000\u0011\u0000\u0001�\u000f\u0000\u0007�\u0000\u0000\u0002"} +{"timestamp":"2026-09-04T10:20:48","event_id":"05abb9dd-9409-40b6-ad39-65a43de70b77","source_ip":"176.120.22.61","source_port":4625,"source_domain":"","country_code":"RU","country_name":"Russia","city_name":"","asn_number":198953,"asn_org":"Proton66 OOO","dest_port":2433,"network_protocol":"","application_protocol":"mssql-tds","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":26,"dest_bytes":13,"network_bytes":39,"event_summary":"\u0012\u0001\u0000\u001a\u0000\u0000\u0001\u0000\u0000\u0000\u000b\u0000\u0006\u0001\u0000\u0011\u0000\u0001�\u000f\u0000\u0007�\u0000\u0000\u0002"} +{"timestamp":"2026-09-04T10:20:48","event_id":"fb181ba9-4efd-4b60-b254-0a0829baa300","source_ip":"176.120.22.61","source_port":4369,"source_domain":"","country_code":"RU","country_name":"Russia","city_name":"","asn_number":198953,"asn_org":"Proton66 OOO","dest_port":1441,"network_protocol":"","application_protocol":"mssql-tds","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":26,"dest_bytes":13,"network_bytes":39,"event_summary":"\u0012\u0001\u0000\u001a\u0000\u0000\u0001\u0000\u0000\u0000\u000b\u0000\u0006\u0001\u0000\u0011\u0000\u0001�\u000f\u0000\u0007�\u0000\u0000\u0002"} +{"timestamp":"2026-09-04T10:20:48","event_id":"ae04e9a7-18a7-46b6-bf8d-ee2d09f53287","source_ip":"176.120.22.61","source_port":4212,"source_domain":"","country_code":"RU","country_name":"Russia","city_name":"","asn_number":198953,"asn_org":"Proton66 OOO","dest_port":22222,"network_protocol":"","application_protocol":"mssql-tds","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":26,"dest_bytes":13,"network_bytes":39,"event_summary":"\u0012\u0001\u0000\u001a\u0000\u0000\u0001\u0000\u0000\u0000\u000b\u0000\u0006\u0001\u0000\u0011\u0000\u0001�\u000f\u0000\u0007�\u0000\u0000\u0002"} +{"timestamp":"2026-09-04T10:20:48","event_id":"212b9010-1bc3-4bd2-9f65-31be7afdf75a","source_ip":"176.120.22.61","source_port":3874,"source_domain":"","country_code":"RU","country_name":"Russia","city_name":"","asn_number":198953,"asn_org":"Proton66 OOO","dest_port":60000,"network_protocol":"","application_protocol":"mssql-tds","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":26,"dest_bytes":13,"network_bytes":39,"event_summary":"\u0012\u0001\u0000\u001a\u0000\u0000\u0001\u0000\u0000\u0000\u000b\u0000\u0006\u0001\u0000\u0011\u0000\u0001�\u000f\u0000\u0007�\u0000\u0000\u0002"} +{"timestamp":"2026-09-04T10:20:48","event_id":"61d23173-d243-4c6a-9ee3-dd9a4a11d269","source_ip":"176.120.22.61","source_port":3375,"source_domain":"","country_code":"RU","country_name":"Russia","city_name":"","asn_number":198953,"asn_org":"Proton66 OOO","dest_port":3309,"network_protocol":"","application_protocol":"mssql-tds","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":26,"dest_bytes":13,"network_bytes":39,"event_summary":"\u0012\u0001\u0000\u001a\u0000\u0000\u0001\u0000\u0000\u0000\u000b\u0000\u0006\u0001\u0000\u0011\u0000\u0001�\u000f\u0000\u0007�\u0000\u0000\u0002"} +{"timestamp":"2026-09-04T10:20:48","event_id":"f85dcdba-515d-48fb-8867-9821ee078058","source_ip":"176.120.22.61","source_port":3362,"source_domain":"","country_code":"RU","country_name":"Russia","city_name":"","asn_number":198953,"asn_org":"Proton66 OOO","dest_port":5367,"network_protocol":"","application_protocol":"mssql-tds","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":26,"dest_bytes":13,"network_bytes":39,"event_summary":"\u0012\u0001\u0000\u001a\u0000\u0000\u0001\u0000\u0000\u0000\u000b\u0000\u0006\u0001\u0000\u0011\u0000\u0001�\u000f\u0000\u0007�\u0000\u0000\u0002"} +{"timestamp":"2026-09-04T10:20:48","event_id":"af844aa1-718e-43f0-b9f9-c40908f997af","source_ip":"176.120.22.61","source_port":3096,"source_domain":"","country_code":"RU","country_name":"Russia","city_name":"","asn_number":198953,"asn_org":"Proton66 OOO","dest_port":54321,"network_protocol":"","application_protocol":"mssql-tds","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":26,"dest_bytes":13,"network_bytes":39,"event_summary":"\u0012\u0001\u0000\u001a\u0000\u0000\u0001\u0000\u0000\u0000\u000b\u0000\u0006\u0001\u0000\u0011\u0000\u0001�\u000f\u0000\u0007�\u0000\u0000\u0002"} +{"timestamp":"2026-09-04T10:20:48","event_id":"a876ab42-e929-4f5b-b7f8-f1e9744189c9","source_ip":"176.120.22.61","source_port":2762,"source_domain":"","country_code":"RU","country_name":"Russia","city_name":"","asn_number":198953,"asn_org":"Proton66 OOO","dest_port":7433,"network_protocol":"","application_protocol":"mssql-tds","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":101000000,"source_bytes":26,"dest_bytes":13,"network_bytes":39,"event_summary":"\u0012\u0001\u0000\u001a\u0000\u0000\u0001\u0000\u0000\u0000\u000b\u0000\u0006\u0001\u0000\u0011\u0000\u0001�\u000f\u0000\u0007�\u0000\u0000\u0002"} +{"timestamp":"2026-09-04T10:20:47","event_id":"c16122d5-9cdf-4285-b180-cc78cc82b30b","source_ip":"176.120.22.61","source_port":2186,"source_domain":"","country_code":"RU","country_name":"Russia","city_name":"","asn_number":198953,"asn_org":"Proton66 OOO","dest_port":9002,"network_protocol":"","application_protocol":"mssql-tds","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":26,"dest_bytes":13,"network_bytes":39,"event_summary":"\u0012\u0001\u0000\u001a\u0000\u0000\u0001\u0000\u0000\u0000\u000b\u0000\u0006\u0001\u0000\u0011\u0000\u0001�\u000f\u0000\u0007�\u0000\u0000\u0002"} +{"timestamp":"2026-09-04T10:20:47","event_id":"d5872c50-a9e6-4d8e-b153-5ef00c8f314e","source_ip":"176.120.22.61","source_port":1722,"source_domain":"","country_code":"RU","country_name":"Russia","city_name":"","asn_number":198953,"asn_org":"Proton66 OOO","dest_port":5555,"network_protocol":"","application_protocol":"mssql-tds","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":26,"dest_bytes":13,"network_bytes":39,"event_summary":"\u0012\u0001\u0000\u001a\u0000\u0000\u0001\u0000\u0000\u0000\u000b\u0000\u0006\u0001\u0000\u0011\u0000\u0001�\u000f\u0000\u0007�\u0000\u0000\u0002"} +{"timestamp":"2026-09-04T10:20:47","event_id":"76e1a80b-1ec6-4130-8188-fe823bb7f780","source_ip":"176.120.22.61","source_port":1431,"source_domain":"","country_code":"RU","country_name":"Russia","city_name":"","asn_number":198953,"asn_org":"Proton66 OOO","dest_port":55366,"network_protocol":"","application_protocol":"mssql-tds","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":26,"dest_bytes":13,"network_bytes":39,"event_summary":"\u0012\u0001\u0000\u001a\u0000\u0000\u0001\u0000\u0000\u0000\u000b\u0000\u0006\u0001\u0000\u0011\u0000\u0001�\u000f\u0000\u0007�\u0000\u0000\u0002"} +{"timestamp":"2026-09-04T10:20:47","event_id":"dd0b13b5-3c31-479a-82d4-bdbef40cfe35","source_ip":"176.120.22.61","source_port":1136,"source_domain":"","country_code":"RU","country_name":"Russia","city_name":"","asn_number":198953,"asn_org":"Proton66 OOO","dest_port":14332,"network_protocol":"","application_protocol":"mssql-tds","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":26,"dest_bytes":13,"network_bytes":39,"event_summary":"\u0012\u0001\u0000\u001a\u0000\u0000\u0001\u0000\u0000\u0000\u000b\u0000\u0006\u0001\u0000\u0011\u0000\u0001�\u000f\u0000\u0007�\u0000\u0000\u0002"} +{"timestamp":"2026-09-04T10:20:47","event_id":"e35b4820-1bf0-472c-ad2f-800bf91a2f49","source_ip":"176.120.22.61","source_port":59915,"source_domain":"","country_code":"RU","country_name":"Russia","city_name":"","asn_number":198953,"asn_org":"Proton66 OOO","dest_port":8005,"network_protocol":"","application_protocol":"mssql-tds","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":101000000,"source_bytes":26,"dest_bytes":13,"network_bytes":39,"event_summary":"\u0012\u0001\u0000\u001a\u0000\u0000\u0001\u0000\u0000\u0000\u000b\u0000\u0006\u0001\u0000\u0011\u0000\u0001�\u000f\u0000\u0007�\u0000\u0000\u0002"} +{"timestamp":"2026-09-04T10:20:47","event_id":"a2777441-2fa7-4cfb-9e01-e4771fa20149","source_ip":"176.120.22.61","source_port":59756,"source_domain":"","country_code":"RU","country_name":"Russia","city_name":"","asn_number":198953,"asn_org":"Proton66 OOO","dest_port":45366,"network_protocol":"","application_protocol":"mssql-tds","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":26,"dest_bytes":13,"network_bytes":39,"event_summary":"\u0012\u0001\u0000\u001a\u0000\u0000\u0001\u0000\u0000\u0000\u000b\u0000\u0006\u0001\u0000\u0011\u0000\u0001�\u000f\u0000\u0007�\u0000\u0000\u0002"} +{"timestamp":"2026-09-04T10:20:47","event_id":"a3f2393c-ac19-42a9-926c-0470915128c3","source_ip":"176.120.22.61","source_port":59525,"source_domain":"","country_code":"RU","country_name":"Russia","city_name":"","asn_number":198953,"asn_org":"Proton66 OOO","dest_port":1433,"network_protocol":"","application_protocol":"mssql-tds","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":26,"dest_bytes":13,"network_bytes":39,"event_summary":"\u0012\u0001\u0000\u001a\u0000\u0000\u0001\u0000\u0000\u0000\u000b\u0000\u0006\u0001\u0000\u0011\u0000\u0001�\u000f\u0000\u0007�\u0000\u0000\u0002"} +{"timestamp":"2026-09-04T10:20:47","event_id":"c121be8a-07c0-4aa4-8272-5090829ce4da","source_ip":"176.120.22.61","source_port":58701,"source_domain":"","country_code":"RU","country_name":"Russia","city_name":"","asn_number":198953,"asn_org":"Proton66 OOO","dest_port":8000,"network_protocol":"","application_protocol":"mssql-tds","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":26,"dest_bytes":13,"network_bytes":39,"event_summary":"\u0012\u0001\u0000\u001a\u0000\u0000\u0001\u0000\u0000\u0000\u000b\u0000\u0006\u0001\u0000\u0011\u0000\u0001�\u000f\u0000\u0007�\u0000\u0000\u0002"} +{"timestamp":"2026-09-04T10:20:47","event_id":"b85224dc-88b3-4d85-b740-a72908a9f50e","source_ip":"176.120.22.61","source_port":58359,"source_domain":"","country_code":"RU","country_name":"Russia","city_name":"","asn_number":198953,"asn_org":"Proton66 OOO","dest_port":55555,"network_protocol":"","application_protocol":"mssql-tds","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":26,"dest_bytes":13,"network_bytes":39,"event_summary":"\u0012\u0001\u0000\u001a\u0000\u0000\u0001\u0000\u0000\u0000\u000b\u0000\u0006\u0001\u0000\u0011\u0000\u0001�\u000f\u0000\u0007�\u0000\u0000\u0002"} +{"timestamp":"2026-09-04T10:20:47","event_id":"3ecf7b2d-7f3b-4da0-9caa-949376389452","source_ip":"176.120.22.61","source_port":58085,"source_domain":"","country_code":"RU","country_name":"Russia","city_name":"","asn_number":198953,"asn_org":"Proton66 OOO","dest_port":20433,"network_protocol":"","application_protocol":"mssql-tds","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":26,"dest_bytes":13,"network_bytes":39,"event_summary":"\u0012\u0001\u0000\u001a\u0000\u0000\u0001\u0000\u0000\u0000\u000b\u0000\u0006\u0001\u0000\u0011\u0000\u0001�\u000f\u0000\u0007�\u0000\u0000\u0002"} +{"timestamp":"2026-09-04T10:20:47","event_id":"1d7df42d-6e4f-4982-9033-7dd05aa92ac3","source_ip":"176.120.22.61","source_port":57876,"source_domain":"","country_code":"RU","country_name":"Russia","city_name":"","asn_number":198953,"asn_org":"Proton66 OOO","dest_port":8777,"network_protocol":"","application_protocol":"mssql-tds","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":26,"dest_bytes":13,"network_bytes":39,"event_summary":"\u0012\u0001\u0000\u001a\u0000\u0000\u0001\u0000\u0000\u0000\u000b\u0000\u0006\u0001\u0000\u0011\u0000\u0001�\u000f\u0000\u0007�\u0000\u0000\u0002"} +{"timestamp":"2026-09-04T10:20:47","event_id":"5b524760-6858-4634-9665-407c1b1c37ee","source_ip":"176.120.22.61","source_port":57715,"source_domain":"","country_code":"RU","country_name":"Russia","city_name":"","asn_number":198953,"asn_org":"Proton66 OOO","dest_port":1489,"network_protocol":"","application_protocol":"mssql-tds","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":26,"dest_bytes":13,"network_bytes":39,"event_summary":"\u0012\u0001\u0000\u001a\u0000\u0000\u0001\u0000\u0000\u0000\u000b\u0000\u0006\u0001\u0000\u0011\u0000\u0001�\u000f\u0000\u0007�\u0000\u0000\u0002"} +{"timestamp":"2026-09-04T10:20:47","event_id":"b1837eea-705f-4f96-9535-12557997d62e","source_ip":"176.120.22.61","source_port":57672,"source_domain":"","country_code":"RU","country_name":"Russia","city_name":"","asn_number":198953,"asn_org":"Proton66 OOO","dest_port":1744,"network_protocol":"","application_protocol":"mssql-tds","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":26,"dest_bytes":13,"network_bytes":39,"event_summary":"\u0012\u0001\u0000\u001a\u0000\u0000\u0001\u0000\u0000\u0000\u000b\u0000\u0006\u0001\u0000\u0011\u0000\u0001�\u000f\u0000\u0007�\u0000\u0000\u0002"} +{"timestamp":"2026-09-04T10:20:47","event_id":"751d20a8-acfd-4bb1-bffa-dd3d1e6b548c","source_ip":"176.120.22.61","source_port":57130,"source_domain":"","country_code":"RU","country_name":"Russia","city_name":"","asn_number":198953,"asn_org":"Proton66 OOO","dest_port":15433,"network_protocol":"","application_protocol":"mssql-tds","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":26,"dest_bytes":13,"network_bytes":39,"event_summary":"\u0012\u0001\u0000\u001a\u0000\u0000\u0001\u0000\u0000\u0000\u000b\u0000\u0006\u0001\u0000\u0011\u0000\u0001�\u000f\u0000\u0007�\u0000\u0000\u0002"} +{"timestamp":"2026-09-04T10:20:47","event_id":"32cfedd3-e70f-4cfb-bbd7-145300fabc78","source_ip":"176.120.22.61","source_port":57010,"source_domain":"","country_code":"RU","country_name":"Russia","city_name":"","asn_number":198953,"asn_org":"Proton66 OOO","dest_port":1544,"network_protocol":"","application_protocol":"mssql-tds","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":26,"dest_bytes":13,"network_bytes":39,"event_summary":"\u0012\u0001\u0000\u001a\u0000\u0000\u0001\u0000\u0000\u0000\u000b\u0000\u0006\u0001\u0000\u0011\u0000\u0001�\u000f\u0000\u0007�\u0000\u0000\u0002"} +{"timestamp":"2026-09-04T10:20:47","event_id":"27d2e25c-051f-42a5-a8aa-37e44f6b029c","source_ip":"176.120.22.61","source_port":56996,"source_domain":"","country_code":"RU","country_name":"Russia","city_name":"","asn_number":198953,"asn_org":"Proton66 OOO","dest_port":6602,"network_protocol":"","application_protocol":"mssql-tds","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":26,"dest_bytes":13,"network_bytes":39,"event_summary":"\u0012\u0001\u0000\u001a\u0000\u0000\u0001\u0000\u0000\u0000\u000b\u0000\u0006\u0001\u0000\u0011\u0000\u0001�\u000f\u0000\u0007�\u0000\u0000\u0002"} +{"timestamp":"2026-09-04T10:20:47","event_id":"49c1e17a-bf72-479a-93c2-7404d2f7076c","source_ip":"176.120.22.61","source_port":56768,"source_domain":"","country_code":"RU","country_name":"Russia","city_name":"","asn_number":198953,"asn_org":"Proton66 OOO","dest_port":3123,"network_protocol":"","application_protocol":"mssql-tds","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":101000000,"source_bytes":26,"dest_bytes":13,"network_bytes":39,"event_summary":"\u0012\u0001\u0000\u001a\u0000\u0000\u0001\u0000\u0000\u0000\u000b\u0000\u0006\u0001\u0000\u0011\u0000\u0001�\u000f\u0000\u0007�\u0000\u0000\u0002"} +{"timestamp":"2026-09-04T10:20:47","event_id":"7ec527a5-0ad4-4039-a72b-61230c367686","source_ip":"176.120.22.61","source_port":56514,"source_domain":"","country_code":"RU","country_name":"Russia","city_name":"","asn_number":198953,"asn_org":"Proton66 OOO","dest_port":42130,"network_protocol":"","application_protocol":"mssql-tds","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":26,"dest_bytes":13,"network_bytes":39,"event_summary":"\u0012\u0001\u0000\u001a\u0000\u0000\u0001\u0000\u0000\u0000\u000b\u0000\u0006\u0001\u0000\u0011\u0000\u0001�\u000f\u0000\u0007�\u0000\u0000\u0002"} +{"timestamp":"2026-09-04T10:20:47","event_id":"5a55204b-1ba7-4efb-8769-1b0aa46f9433","source_ip":"176.120.22.61","source_port":55987,"source_domain":"","country_code":"RU","country_name":"Russia","city_name":"","asn_number":198953,"asn_org":"Proton66 OOO","dest_port":14330,"network_protocol":"","application_protocol":"mssql-tds","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":26,"dest_bytes":13,"network_bytes":39,"event_summary":"\u0012\u0001\u0000\u001a\u0000\u0000\u0001\u0000\u0000\u0000\u000b\u0000\u0006\u0001\u0000\u0011\u0000\u0001�\u000f\u0000\u0007�\u0000\u0000\u0002"} +{"timestamp":"2026-09-04T10:20:47","event_id":"36f47e97-5f50-4f0a-877d-df1728aee6ad","source_ip":"176.120.22.61","source_port":55843,"source_domain":"","country_code":"RU","country_name":"Russia","city_name":"","asn_number":198953,"asn_org":"Proton66 OOO","dest_port":1488,"network_protocol":"","application_protocol":"mssql-tds","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":26,"dest_bytes":13,"network_bytes":39,"event_summary":"\u0012\u0001\u0000\u001a\u0000\u0000\u0001\u0000\u0000\u0000\u000b\u0000\u0006\u0001\u0000\u0011\u0000\u0001�\u000f\u0000\u0007�\u0000\u0000\u0002"} +{"timestamp":"2026-09-04T10:20:47","event_id":"73a624d5-5551-4a44-a6ca-f5092a47a18a","source_ip":"176.120.22.61","source_port":55466,"source_domain":"","country_code":"RU","country_name":"Russia","city_name":"","asn_number":198953,"asn_org":"Proton66 OOO","dest_port":3307,"network_protocol":"","application_protocol":"mssql-tds","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":26,"dest_bytes":13,"network_bytes":39,"event_summary":"\u0012\u0001\u0000\u001a\u0000\u0000\u0001\u0000\u0000\u0000\u000b\u0000\u0006\u0001\u0000\u0011\u0000\u0001�\u000f\u0000\u0007�\u0000\u0000\u0002"} +{"timestamp":"2026-09-04T10:20:47","event_id":"4549bb2b-c8ea-49ac-88d2-b58aacf65a27","source_ip":"176.120.22.61","source_port":55235,"source_domain":"","country_code":"RU","country_name":"Russia","city_name":"","asn_number":198953,"asn_org":"Proton66 OOO","dest_port":19433,"network_protocol":"","application_protocol":"mssql-tds","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":26,"dest_bytes":13,"network_bytes":39,"event_summary":"\u0012\u0001\u0000\u001a\u0000\u0000\u0001\u0000\u0000\u0000\u000b\u0000\u0006\u0001\u0000\u0011\u0000\u0001�\u000f\u0000\u0007�\u0000\u0000\u0002"} +{"timestamp":"2026-09-04T10:20:47","event_id":"e8c2e6e9-2383-41d6-aa72-920692a1f7f1","source_ip":"176.120.22.61","source_port":55011,"source_domain":"","country_code":"RU","country_name":"Russia","city_name":"","asn_number":198953,"asn_org":"Proton66 OOO","dest_port":1666,"network_protocol":"","application_protocol":"mssql-tds","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":26,"dest_bytes":13,"network_bytes":39,"event_summary":"\u0012\u0001\u0000\u001a\u0000\u0000\u0001\u0000\u0000\u0000\u000b\u0000\u0006\u0001\u0000\u0011\u0000\u0001�\u000f\u0000\u0007�\u0000\u0000\u0002"} +{"timestamp":"2026-09-04T10:20:47","event_id":"f9a75e95-1f0a-4d6d-a52b-589ee8687873","source_ip":"176.120.22.61","source_port":54949,"source_domain":"","country_code":"RU","country_name":"Russia","city_name":"","asn_number":198953,"asn_org":"Proton66 OOO","dest_port":41433,"network_protocol":"","application_protocol":"mssql-tds","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":26,"dest_bytes":13,"network_bytes":39,"event_summary":"\u0012\u0001\u0000\u001a\u0000\u0000\u0001\u0000\u0000\u0000\u000b\u0000\u0006\u0001\u0000\u0011\u0000\u0001�\u000f\u0000\u0007�\u0000\u0000\u0002"} +{"timestamp":"2026-09-04T10:20:47","event_id":"b07619ed-7210-46a4-9165-2f1dcfa9fe60","source_ip":"176.120.22.61","source_port":54705,"source_domain":"","country_code":"RU","country_name":"Russia","city_name":"","asn_number":198953,"asn_org":"Proton66 OOO","dest_port":1400,"network_protocol":"","application_protocol":"mssql-tds","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":26,"dest_bytes":13,"network_bytes":39,"event_summary":"\u0012\u0001\u0000\u001a\u0000\u0000\u0001\u0000\u0000\u0000\u000b\u0000\u0006\u0001\u0000\u0011\u0000\u0001�\u000f\u0000\u0007�\u0000\u0000\u0002"} +{"timestamp":"2026-09-04T10:20:47","event_id":"78f13f4b-ba3b-4e11-a2a0-e829a3848871","source_ip":"176.120.22.61","source_port":54322,"source_domain":"","country_code":"RU","country_name":"Russia","city_name":"","asn_number":198953,"asn_org":"Proton66 OOO","dest_port":1100,"network_protocol":"","application_protocol":"mssql-tds","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":26,"dest_bytes":13,"network_bytes":39,"event_summary":"\u0012\u0001\u0000\u001a\u0000\u0000\u0001\u0000\u0000\u0000\u000b\u0000\u0006\u0001\u0000\u0011\u0000\u0001�\u000f\u0000\u0007�\u0000\u0000\u0002"} +{"timestamp":"2026-09-04T10:20:47","event_id":"e416e8b7-8184-4b1b-b99d-3bb4d0ac578b","source_ip":"176.120.22.61","source_port":53834,"source_domain":"","country_code":"RU","country_name":"Russia","city_name":"","asn_number":198953,"asn_org":"Proton66 OOO","dest_port":1032,"network_protocol":"","application_protocol":"mssql-tds","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":26,"dest_bytes":13,"network_bytes":39,"event_summary":"\u0012\u0001\u0000\u001a\u0000\u0000\u0001\u0000\u0000\u0000\u000b\u0000\u0006\u0001\u0000\u0011\u0000\u0001�\u000f\u0000\u0007�\u0000\u0000\u0002"} +{"timestamp":"2026-09-04T10:20:47","event_id":"8fb87b1e-638c-4ee9-8e93-7bde8d4318c7","source_ip":"176.120.22.61","source_port":53274,"source_domain":"","country_code":"RU","country_name":"Russia","city_name":"","asn_number":198953,"asn_org":"Proton66 OOO","dest_port":1112,"network_protocol":"","application_protocol":"mssql-tds","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":26,"dest_bytes":13,"network_bytes":39,"event_summary":"\u0012\u0001\u0000\u001a\u0000\u0000\u0001\u0000\u0000\u0000\u000b\u0000\u0006\u0001\u0000\u0011\u0000\u0001�\u000f\u0000\u0007�\u0000\u0000\u0002"} +{"timestamp":"2026-09-04T10:20:47","event_id":"27d1562b-81f5-4c39-b7ec-1dbcaa11cd59","source_ip":"176.120.22.61","source_port":52990,"source_domain":"","country_code":"RU","country_name":"Russia","city_name":"","asn_number":198953,"asn_org":"Proton66 OOO","dest_port":1499,"network_protocol":"","application_protocol":"mssql-tds","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":26,"dest_bytes":13,"network_bytes":39,"event_summary":"\u0012\u0001\u0000\u001a\u0000\u0000\u0001\u0000\u0000\u0000\u000b\u0000\u0006\u0001\u0000\u0011\u0000\u0001�\u000f\u0000\u0007�\u0000\u0000\u0002"} +{"timestamp":"2026-09-04T10:20:47","event_id":"894d58ba-d7e9-4be2-888c-79ffc4b7b2e2","source_ip":"176.120.22.61","source_port":51874,"source_domain":"","country_code":"RU","country_name":"Russia","city_name":"","asn_number":198953,"asn_org":"Proton66 OOO","dest_port":1431,"network_protocol":"","application_protocol":"mssql-tds","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":26,"dest_bytes":13,"network_bytes":39,"event_summary":"\u0012\u0001\u0000\u001a\u0000\u0000\u0001\u0000\u0000\u0000\u000b\u0000\u0006\u0001\u0000\u0011\u0000\u0001�\u000f\u0000\u0007�\u0000\u0000\u0002"} +{"timestamp":"2026-09-04T10:20:47","event_id":"7a90d9cf-4e03-4a43-95e8-9c548ad65846","source_ip":"176.120.22.61","source_port":51516,"source_domain":"","country_code":"RU","country_name":"Russia","city_name":"","asn_number":198953,"asn_org":"Proton66 OOO","dest_port":3308,"network_protocol":"","application_protocol":"mssql-tds","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":26,"dest_bytes":13,"network_bytes":39,"event_summary":"\u0012\u0001\u0000\u001a\u0000\u0000\u0001\u0000\u0000\u0000\u000b\u0000\u0006\u0001\u0000\u0011\u0000\u0001�\u000f\u0000\u0007�\u0000\u0000\u0002"} +{"timestamp":"2026-09-04T10:20:47","event_id":"c76435c3-3b7a-4f57-9fef-d325dee0c6ee","source_ip":"176.120.22.61","source_port":51225,"source_domain":"","country_code":"RU","country_name":"Russia","city_name":"","asn_number":198953,"asn_org":"Proton66 OOO","dest_port":23922,"network_protocol":"","application_protocol":"mssql-tds","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":26,"dest_bytes":13,"network_bytes":39,"event_summary":"\u0012\u0001\u0000\u001a\u0000\u0000\u0001\u0000\u0000\u0000\u000b\u0000\u0006\u0001\u0000\u0011\u0000\u0001�\u000f\u0000\u0007�\u0000\u0000\u0002"} \ No newline at end of file diff --git a/kevlar/2026-09-07/honeylabs/events-AS200593.ndjson b/kevlar/2026-09-07/honeylabs/events-AS200593.ndjson new file mode 100644 index 0000000..e69de29 diff --git a/kevlar/2026-09-07/honeylabs/events-AS200651.ndjson b/kevlar/2026-09-07/honeylabs/events-AS200651.ndjson new file mode 100644 index 0000000..a1d82fd --- /dev/null +++ b/kevlar/2026-09-07/honeylabs/events-AS200651.ndjson @@ -0,0 +1,24 @@ +{"timestamp":"2026-09-06T22:18:29","event_id":"459a4d61-22f6-481f-a5ea-1e1a11e1257b","source_ip":"185.100.87.136","source_port":60666,"source_domain":"","country_code":"RO","country_name":"Romania","city_name":"Bucharest","asn_number":200651,"asn_org":"FlokiNET ehf","dest_port":443,"network_protocol":"tls","application_protocol":"http","http_method":"GET","user_agent":"Mozilla/5.0 (Android 12; Mobile; rv:117.0) Gecko/117.0 Focus/117.0","url_path":"/eventmanager","url_domain":"","http_request_headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"\",\"user-agent\":\"Mozilla/5.0 (Android 12; Mobile; rv:117.0) Gecko/117.0 Focus/117.0\"}","ssh_client_hassh":"","tls_client_ja4":"t13i1909h2_9dc949149365_97f8aa674fd9","tls_client_ja3":"7c1e207beb00684bbbe144f1b0abe1d5","tls_client_version":"TLSv1.3","tls_client_cipher":"TLS_CHACHA20_POLY1305_SHA256","http_request_ja4h":"ge11nn0400_88d30a62b7ad","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":166,"dest_bytes":79,"network_bytes":245,"event_summary":""} +{"timestamp":"2026-09-06T21:56:00","event_id":"c38de225-590b-4c66-9ff6-dda73cd0e45b","source_ip":"185.100.87.136","source_port":38156,"source_domain":"","country_code":"RO","country_name":"Romania","city_name":"Bucharest","asn_number":200651,"asn_org":"FlokiNET ehf","dest_port":443,"network_protocol":"tls","application_protocol":"http","http_method":"GET","user_agent":"Mozilla/5.0 (Android 12; Mobile; rv:117.0) Gecko/117.0 Focus/117.0","url_path":"/eventmanager","url_domain":"","http_request_headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"\",\"user-agent\":\"Mozilla/5.0 (Android 12; Mobile; rv:117.0) Gecko/117.0 Focus/117.0\"}","ssh_client_hassh":"","tls_client_ja4":"t13i1909h2_9dc949149365_97f8aa674fd9","tls_client_ja3":"7c1e207beb00684bbbe144f1b0abe1d5","tls_client_version":"TLSv1.3","tls_client_cipher":"TLS_CHACHA20_POLY1305_SHA256","http_request_ja4h":"ge11nn0400_88d30a62b7ad","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":166,"dest_bytes":79,"network_bytes":245,"event_summary":""} +{"timestamp":"2026-09-06T20:33:31","event_id":"88551c1c-5d03-4ba9-99c7-668dbac3c9b4","source_ip":"185.100.87.136","source_port":58300,"source_domain":"","country_code":"RO","country_name":"Romania","city_name":"Bucharest","asn_number":200651,"asn_org":"FlokiNET ehf","dest_port":443,"network_protocol":"tls","application_protocol":"http","http_method":"GET","user_agent":"Mozilla/5.0 (Android 12; Mobile; rv:117.0) Gecko/117.0 Focus/117.0","url_path":"/eventmanager","url_domain":"","http_request_headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"\",\"user-agent\":\"Mozilla/5.0 (Android 12; Mobile; rv:117.0) Gecko/117.0 Focus/117.0\"}","ssh_client_hassh":"","tls_client_ja4":"t13i1909h2_9dc949149365_97f8aa674fd9","tls_client_ja3":"7c1e207beb00684bbbe144f1b0abe1d5","tls_client_version":"TLSv1.3","tls_client_cipher":"TLS_CHACHA20_POLY1305_SHA256","http_request_ja4h":"ge11nn0400_88d30a62b7ad","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":167,"dest_bytes":79,"network_bytes":246,"event_summary":""} +{"timestamp":"2026-09-05T02:46:08","event_id":"79552256-e055-42af-a25e-02d0c9f36f70","source_ip":"185.100.87.136","source_port":48056,"source_domain":"","country_code":"RO","country_name":"Romania","city_name":"Bucharest","asn_number":200651,"asn_org":"FlokiNET ehf","dest_port":443,"network_protocol":"","application_protocol":"","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":101000000,"source_bytes":52,"dest_bytes":14,"network_bytes":66,"event_summary":"ɔѦ��\u0005lM/\t�p#��*5#]�R:Ȏ/\u0011�͉Z��\u0019f�γ������%d1\u0017�%n�"} +{"timestamp":"2026-09-05T01:58:06","event_id":"3940f8bf-833f-4700-8098-7bc7fc7534cf","source_ip":"185.100.87.136","source_port":53828,"source_domain":"","country_code":"RO","country_name":"Romania","city_name":"Bucharest","asn_number":200651,"asn_org":"FlokiNET ehf","dest_port":443,"network_protocol":"","application_protocol":"","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":52,"dest_bytes":14,"network_bytes":66,"event_summary":"ɔѦ��\u0005lM/\t�p#��*5#]�R:Ȏ/\u0011�͉Z��\u0019f�γ������%d1\u0017�%n�"} +{"timestamp":"2026-09-05T01:02:29","event_id":"d4f9e0d2-3bb0-4765-97c6-5b373e22f9a1","source_ip":"185.100.87.136","source_port":38102,"source_domain":"","country_code":"RO","country_name":"Romania","city_name":"Bucharest","asn_number":200651,"asn_org":"FlokiNET ehf","dest_port":443,"network_protocol":"","application_protocol":"","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":52,"dest_bytes":14,"network_bytes":66,"event_summary":"ɔѦ��\u0005lM/\t�p#��*5#]�R:Ȏ/\u0011�͉Z��\u0019f�γ������%d1\u0017�%n�"} +{"timestamp":"2026-09-04T11:17:00","event_id":"962d5041-7ddd-4c49-a5b3-61fbf24efd36","source_ip":"185.100.87.136","source_port":55902,"source_domain":"","country_code":"RO","country_name":"Romania","city_name":"Bucharest","asn_number":200651,"asn_org":"FlokiNET ehf","dest_port":443,"network_protocol":"","application_protocol":"","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":16,"dest_bytes":14,"network_bytes":30,"event_summary":"\u0010 \u0000\u0000BBBB����DAAA"} +{"timestamp":"2026-09-04T08:53:42","event_id":"761b5c3e-1c7d-46e0-88a3-10ca6a2b1dbe","source_ip":"185.100.87.136","source_port":50650,"source_domain":"","country_code":"RO","country_name":"Romania","city_name":"Bucharest","asn_number":200651,"asn_org":"FlokiNET ehf","dest_port":443,"network_protocol":"","application_protocol":"","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":16,"dest_bytes":14,"network_bytes":30,"event_summary":"\u0010 \u0000\u0000BBBB����DAAA"} +{"timestamp":"2026-09-04T04:44:38","event_id":"71c6a2df-8670-42d4-a879-3935ab56c3a9","source_ip":"185.100.87.136","source_port":46942,"source_domain":"","country_code":"RO","country_name":"Romania","city_name":"Bucharest","asn_number":200651,"asn_org":"FlokiNET ehf","dest_port":443,"network_protocol":"","application_protocol":"","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":16,"dest_bytes":14,"network_bytes":30,"event_summary":"\u0010 \u0000\u0000BBBB����DAAA"} +{"timestamp":"2026-09-03T23:55:20","event_id":"db098465-edfc-48e2-8ca3-a229ef8bc264","source_ip":"185.100.87.136","source_port":44996,"source_domain":"","country_code":"RO","country_name":"Romania","city_name":"Bucharest","asn_number":200651,"asn_org":"FlokiNET ehf","dest_port":443,"network_protocol":"","application_protocol":"http","http_method":"POST","user_agent":"SPARK COMMIT: 08059e95dacafe0bf6e5782f8e2c8ec9cd8c5a17","url_path":"/api/client/update?arch=amd64&commit=08059e95dacafe0bf6e5782f8e2c8ec9cd8c5a17&os=windows","url_domain":"","http_request_headers":"{\"accept-encoding\":\"gzip\",\"content-length\":\"384\",\"content-type\":\"application/octet-stream\",\"host\":\":443\",\"secret\":\"3de172c65c5204dbce4c985d6616ca6fbbf337be4ddd40746307af802fa510a2\",\"user-agent\":\"SPARK COMMIT: 08059e95dacafe0bf6e5782f8e2c8ec9cd8c5a17\"}","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"po11nn0600_c9506d37ac14","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":740,"dest_bytes":79,"network_bytes":819,"event_summary":""} +{"timestamp":"2026-09-03T23:55:19","event_id":"a32a59e6-6870-417b-9aa5-022304265cdd","source_ip":"185.100.87.136","source_port":44988,"source_domain":"","country_code":"RO","country_name":"Romania","city_name":"Bucharest","asn_number":200651,"asn_org":"FlokiNET ehf","dest_port":443,"network_protocol":"tls","application_protocol":"http","http_method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:104.71.6212.24) Gecko/25.2.4212.671 Firefox/2.0","url_path":"/","url_domain":"","http_request_headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:104.71.6212.24) Gecko/25.2.4212.671 Firefox/2.0\"}","ssh_client_hassh":"","tls_client_ja4":"t13i1909h2_9dc949149365_97f8aa674fd9","tls_client_ja3":"7c1e207beb00684bbbe144f1b0abe1d5","tls_client_version":"TLSv1.3","tls_client_cipher":"TLS_CHACHA20_POLY1305_SHA256","http_request_ja4h":"ge11nn0400_88d30a62b7ad","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":180,"dest_bytes":79,"network_bytes":259,"event_summary":""} +{"timestamp":"2026-09-03T23:45:20","event_id":"e71711cc-c103-4332-90ab-bc4a12635627","source_ip":"185.100.87.136","source_port":53482,"source_domain":"","country_code":"RO","country_name":"Romania","city_name":"Bucharest","asn_number":200651,"asn_org":"FlokiNET ehf","dest_port":443,"network_protocol":"","application_protocol":"http","http_method":"POST","user_agent":"SPARK COMMIT: 08059e95dacafe0bf6e5782f8e2c8ec9cd8c5a17","url_path":"/api/client/update?arch=amd64&commit=08059e95dacafe0bf6e5782f8e2c8ec9cd8c5a17&os=windows","url_domain":"","http_request_headers":"{\"accept-encoding\":\"gzip\",\"content-length\":\"384\",\"content-type\":\"application/octet-stream\",\"host\":\":443\",\"secret\":\"3de172c65c5204dbce4c985d6616ca6fbbf337be4ddd40746307af802fa510a2\",\"user-agent\":\"SPARK COMMIT: 08059e95dacafe0bf6e5782f8e2c8ec9cd8c5a17\"}","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"po11nn0600_c9506d37ac14","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":741,"dest_bytes":79,"network_bytes":820,"event_summary":""} +{"timestamp":"2026-09-03T23:45:20","event_id":"b6430ce7-8aa3-42ca-9c00-6e85c648367a","source_ip":"185.100.87.136","source_port":53470,"source_domain":"","country_code":"RO","country_name":"Romania","city_name":"Bucharest","asn_number":200651,"asn_org":"FlokiNET ehf","dest_port":443,"network_protocol":"tls","application_protocol":"http","http_method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:104.71.6212.24) Gecko/25.2.4212.671 Firefox/2.0","url_path":"/","url_domain":"","http_request_headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:104.71.6212.24) Gecko/25.2.4212.671 Firefox/2.0\"}","ssh_client_hassh":"","tls_client_ja4":"t13i1909h2_9dc949149365_97f8aa674fd9","tls_client_ja3":"7c1e207beb00684bbbe144f1b0abe1d5","tls_client_version":"TLSv1.3","tls_client_cipher":"TLS_CHACHA20_POLY1305_SHA256","http_request_ja4h":"ge11nn0400_88d30a62b7ad","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":181,"dest_bytes":79,"network_bytes":260,"event_summary":""} +{"timestamp":"2026-09-03T20:46:54","event_id":"d3d22cdf-65d5-4332-8537-4704fc4ddc3b","source_ip":"185.100.87.136","source_port":48684,"source_domain":"","country_code":"RO","country_name":"Romania","city_name":"Bucharest","asn_number":200651,"asn_org":"FlokiNET ehf","dest_port":443,"network_protocol":"","application_protocol":"http","http_method":"POST","user_agent":"SPARK COMMIT: 08059e95dacafe0bf6e5782f8e2c8ec9cd8c5a17","url_path":"/api/client/update?arch=amd64&commit=08059e95dacafe0bf6e5782f8e2c8ec9cd8c5a17&os=windows","url_domain":"","http_request_headers":"{\"accept-encoding\":\"gzip\",\"content-length\":\"384\",\"content-type\":\"application/octet-stream\",\"host\":\":443\",\"secret\":\"3de172c65c5204dbce4c985d6616ca6fbbf337be4ddd40746307af802fa510a2\",\"user-agent\":\"SPARK COMMIT: 08059e95dacafe0bf6e5782f8e2c8ec9cd8c5a17\"}","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"po11nn0600_c9506d37ac14","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":740,"dest_bytes":79,"network_bytes":819,"event_summary":""} +{"timestamp":"2026-09-03T20:46:53","event_id":"2eae9013-b353-4ea8-8b21-14e4e41c030e","source_ip":"185.100.87.136","source_port":53106,"source_domain":"","country_code":"RO","country_name":"Romania","city_name":"Bucharest","asn_number":200651,"asn_org":"FlokiNET ehf","dest_port":443,"network_protocol":"tls","application_protocol":"http","http_method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:104.71.6212.24) Gecko/25.2.4212.671 Firefox/2.0","url_path":"/","url_domain":"","http_request_headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:104.71.6212.24) Gecko/25.2.4212.671 Firefox/2.0\"}","ssh_client_hassh":"","tls_client_ja4":"t13i1909h2_9dc949149365_97f8aa674fd9","tls_client_ja3":"7c1e207beb00684bbbe144f1b0abe1d5","tls_client_version":"TLSv1.3","tls_client_cipher":"TLS_CHACHA20_POLY1305_SHA256","http_request_ja4h":"ge11nn0400_88d30a62b7ad","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":180,"dest_bytes":79,"network_bytes":259,"event_summary":""} +{"timestamp":"2026-09-03T01:16:18","event_id":"ab300e7e-dd77-42ed-95a3-357e941b432a","source_ip":"185.100.87.136","source_port":40120,"source_domain":"","country_code":"RO","country_name":"Romania","city_name":"Bucharest","asn_number":200651,"asn_org":"FlokiNET ehf","dest_port":443,"network_protocol":"","application_protocol":"","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":76,"dest_bytes":14,"network_bytes":90,"event_summary":"\u0012\u0000\u0000\u0000nwe7x7apiRuyIcBpzg.\u0000\u0000\u0000\u0000\u0000\u0000\u0000{�ZH�ZF������\u0003Z\u0007�3����*����N�@��4\\��4\u0012c�zb�o��"} +{"timestamp":"2026-09-03T01:00:41","event_id":"50cf017a-05d4-40ec-99ca-1ddc0326b02e","source_ip":"185.100.87.136","source_port":54278,"source_domain":"","country_code":"RO","country_name":"Romania","city_name":"Bucharest","asn_number":200651,"asn_org":"FlokiNET ehf","dest_port":443,"network_protocol":"","application_protocol":"","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":96,"dest_bytes":14,"network_bytes":110,"event_summary":"\u000f\u0000\u0000\u0000BVHNjUZCOseZTEuE\u0000\u0000\u0000\u0000\u0000\u0000\u0000�.��\u001b��\u001b�%\u001c��<�\u0015\u0002\u0018���\u001b<$n8'\u0018\f�hU��Y�XP�a\u0017'8>\n\u000b���tQ%�\u0006\u0005���p\rzE��!\u0011\r��"} +{"timestamp":"2026-09-03T00:54:40","event_id":"c40be23d-1aab-44be-996f-9c258edd5eec","source_ip":"185.100.87.136","source_port":52772,"source_domain":"","country_code":"RO","country_name":"Romania","city_name":"Bucharest","asn_number":200651,"asn_org":"FlokiNET ehf","dest_port":443,"network_protocol":"","application_protocol":"","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":111,"dest_bytes":14,"network_bytes":125,"event_summary":"\u0013\u0000\u0000\u0000OnznfoENhbZUQIe5YY3P\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u000b��{�\u0014����\u0001�\r�NG\u001e�����\u0012M]y��6��\u001a�N�+��\f6Rt(�v:��H�H�}\u00158tpjMZ\u0005\u0011T\u000b��AiM�X-9|\u0015E�\u001d�"} +{"timestamp":"2026-09-01T14:07:55","event_id":"915197c7-4b83-4885-b21c-d7e36cd1841e","source_ip":"185.100.87.136","source_port":42160,"source_domain":"","country_code":"RO","country_name":"Romania","city_name":"Bucharest","asn_number":200651,"asn_org":"FlokiNET ehf","dest_port":8443,"network_protocol":"","application_protocol":"http","http_method":"POST","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64)","url_path":"/api/checkin","url_domain":"","http_request_headers":"{\"cache-control\":\"no-cache\",\"content-length\":\"26\",\"content-type\":\"application/json\",\"host\":\":8443\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\"}","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"po11nn0500_e4a47a99f1ac","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":213,"dest_bytes":79,"network_bytes":292,"event_summary":""} +{"timestamp":"2026-09-01T12:52:23","event_id":"f4c8c13d-8813-42e0-8b5e-9aa1dc09332b","source_ip":"185.100.87.136","source_port":32786,"source_domain":"","country_code":"RO","country_name":"Romania","city_name":"Bucharest","asn_number":200651,"asn_org":"FlokiNET ehf","dest_port":8443,"network_protocol":"","application_protocol":"http","http_method":"POST","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64)","url_path":"/api/checkin","url_domain":"","http_request_headers":"{\"cache-control\":\"no-cache\",\"content-length\":\"26\",\"content-type\":\"application/json\",\"host\":\":8443\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\"}","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"po11nn0500_e4a47a99f1ac","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":214,"dest_bytes":79,"network_bytes":293,"event_summary":""} +{"timestamp":"2026-09-01T12:25:00","event_id":"5f816950-0f5b-49bc-a693-f5a07fea295c","source_ip":"185.100.87.136","source_port":58810,"source_domain":"","country_code":"RO","country_name":"Romania","city_name":"Bucharest","asn_number":200651,"asn_org":"FlokiNET ehf","dest_port":8443,"network_protocol":"","application_protocol":"http","http_method":"POST","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64)","url_path":"/api/checkin","url_domain":"","http_request_headers":"{\"cache-control\":\"no-cache\",\"content-length\":\"26\",\"content-type\":\"application/json\",\"host\":\":8443\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\"}","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"po11nn0500_e4a47a99f1ac","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":101000000,"source_bytes":213,"dest_bytes":79,"network_bytes":292,"event_summary":""} +{"timestamp":"2026-08-31T06:06:56","event_id":"7ae2542a-f64f-4c51-903f-b2274cc16211","source_ip":"185.100.87.136","source_port":47020,"source_domain":"","country_code":"RO","country_name":"Romania","city_name":"Bucharest","asn_number":200651,"asn_org":"FlokiNET ehf","dest_port":443,"network_protocol":"tls","application_protocol":"http","http_method":"GET","user_agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3 rv:3.0; eu-FR) AppleWebKit/533.4.2 (KHTML, like Gecko) Version/5.0.1 Safari/533.4.2","url_path":"/images/transparentpix.gif","url_domain":"","http_request_headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"\",\"user-agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3 rv:3.0; eu-FR) AppleWebKit/533.4.2 (KHTML, like Gecko) Version/5.0.1 Safari/533.4.2\"}","ssh_client_hassh":"","tls_client_ja4":"t13i1909h2_9dc949149365_97f8aa674fd9","tls_client_ja3":"7c1e207beb00684bbbe144f1b0abe1d5","tls_client_version":"TLSv1.3","tls_client_cipher":"TLS_CHACHA20_POLY1305_SHA256","http_request_ja4h":"ge11nn0400_88d30a62b7ad","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":243,"dest_bytes":79,"network_bytes":322,"event_summary":""} +{"timestamp":"2026-08-31T05:00:49","event_id":"32bde13b-d088-49bf-9f4b-c07080faae72","source_ip":"185.100.87.136","source_port":54264,"source_domain":"","country_code":"RO","country_name":"Romania","city_name":"Bucharest","asn_number":200651,"asn_org":"FlokiNET ehf","dest_port":443,"network_protocol":"tls","application_protocol":"http","http_method":"GET","user_agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3 rv:3.0; eu-FR) AppleWebKit/533.4.2 (KHTML, like Gecko) Version/5.0.1 Safari/533.4.2","url_path":"/images/transparentpix.gif","url_domain":"","http_request_headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"\",\"user-agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3 rv:3.0; eu-FR) AppleWebKit/533.4.2 (KHTML, like Gecko) Version/5.0.1 Safari/533.4.2\"}","ssh_client_hassh":"","tls_client_ja4":"t13i1909h2_9dc949149365_97f8aa674fd9","tls_client_ja3":"7c1e207beb00684bbbe144f1b0abe1d5","tls_client_version":"TLSv1.3","tls_client_cipher":"TLS_CHACHA20_POLY1305_SHA256","http_request_ja4h":"ge11nn0400_88d30a62b7ad","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":242,"dest_bytes":79,"network_bytes":321,"event_summary":""} +{"timestamp":"2026-08-31T01:12:02","event_id":"4486ee38-07be-4f89-af15-2474d6d06b49","source_ip":"185.100.87.136","source_port":41682,"source_domain":"","country_code":"RO","country_name":"Romania","city_name":"Bucharest","asn_number":200651,"asn_org":"FlokiNET ehf","dest_port":443,"network_protocol":"tls","application_protocol":"http","http_method":"GET","user_agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3 rv:3.0; eu-FR) AppleWebKit/533.4.2 (KHTML, like Gecko) Version/5.0.1 Safari/533.4.2","url_path":"/images/transparentpix.gif","url_domain":"","http_request_headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"\",\"user-agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3 rv:3.0; eu-FR) AppleWebKit/533.4.2 (KHTML, like Gecko) Version/5.0.1 Safari/533.4.2\"}","ssh_client_hassh":"","tls_client_ja4":"t13i1909h2_9dc949149365_97f8aa674fd9","tls_client_ja3":"7c1e207beb00684bbbe144f1b0abe1d5","tls_client_version":"TLSv1.3","tls_client_cipher":"TLS_CHACHA20_POLY1305_SHA256","http_request_ja4h":"ge11nn0400_88d30a62b7ad","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":242,"dest_bytes":79,"network_bytes":321,"event_summary":""} \ No newline at end of file diff --git a/kevlar/2026-09-07/honeylabs/events-AS202685.ndjson b/kevlar/2026-09-07/honeylabs/events-AS202685.ndjson new file mode 100644 index 0000000..e69de29 diff --git a/kevlar/2026-09-07/honeylabs/events-AS206728.ndjson b/kevlar/2026-09-07/honeylabs/events-AS206728.ndjson new file mode 100644 index 0000000..e69de29 diff --git a/kevlar/2026-09-07/honeylabs/events-AS209847.ndjson b/kevlar/2026-09-07/honeylabs/events-AS209847.ndjson new file mode 100644 index 0000000..e69de29 diff --git a/kevlar/2026-09-07/honeylabs/events-AS210644.ndjson b/kevlar/2026-09-07/honeylabs/events-AS210644.ndjson new file mode 100644 index 0000000..22757b9 --- /dev/null +++ b/kevlar/2026-09-07/honeylabs/events-AS210644.ndjson @@ -0,0 +1,51 @@ +{"timestamp":"2026-09-02T15:29:27","event_id":"51b8b9fc-93ad-4029-8e8a-4db45b57c40e","source_ip":"185.246.217.150","source_port":20284,"source_domain":"","country_code":"NL","country_name":"The Netherlands","city_name":"Amsterdam","asn_number":210644,"asn_org":"Aeza Group LLC","dest_port":443,"network_protocol":"tls","application_protocol":"http","http_method":"GET","user_agent":"libredtail-http","url_path":"/containers/json","url_domain":"","http_request_headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"host\":\":443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","ssh_client_hassh":"","tls_client_ja4":"t13i170900_5b57614c22b0_78e6aca7449b","tls_client_ja3":"052a5e65c3a64e860e1706b1de3c46a9","tls_client_version":"TLSv1.3","tls_client_cipher":"TLS_AES_128_GCM_SHA256","http_request_ja4h":"ge11nn0500_7992432eef13","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":49,"event_duration":10514000000,"source_bytes":19145,"dest_bytes":3920,"network_bytes":23065,"event_summary":""} +{"timestamp":"2026-09-02T15:29:27","event_id":"51b8b9fc-93ad-4029-8e8a-4db45b57c40e","source_ip":"185.246.217.150","source_port":20284,"source_domain":"","country_code":"NL","country_name":"The Netherlands","city_name":"Amsterdam","asn_number":210644,"asn_org":"Aeza Group LLC","dest_port":443,"network_protocol":"tls","application_protocol":"http","http_method":"GET","user_agent":"libredtail-http","url_path":"/index.php?lang=../../../../../../../../tmp/index1","url_domain":"","http_request_headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"host\":\":443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","ssh_client_hassh":"","tls_client_ja4":"t13i170900_5b57614c22b0_78e6aca7449b","tls_client_ja3":"052a5e65c3a64e860e1706b1de3c46a9","tls_client_version":"TLSv1.3","tls_client_cipher":"TLS_AES_128_GCM_SHA256","http_request_ja4h":"ge11nn0500_7992432eef13","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":48,"event_duration":10296000000,"source_bytes":18992,"dest_bytes":3840,"network_bytes":22832,"event_summary":""} +{"timestamp":"2026-09-02T15:29:27","event_id":"51b8b9fc-93ad-4029-8e8a-4db45b57c40e","source_ip":"185.246.217.150","source_port":20284,"source_domain":"","country_code":"NL","country_name":"The Netherlands","city_name":"Amsterdam","asn_number":210644,"asn_org":"Aeza Group LLC","dest_port":443,"network_protocol":"tls","application_protocol":"http","http_method":"GET","user_agent":"libredtail-http","url_path":"/index.php?lang=../../../../../../../../usr/local/lib/php/pearcmd&+config-create+/&/+/tmp/index1.php","url_domain":"","http_request_headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"host\":\":443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","ssh_client_hassh":"","tls_client_ja4":"t13i170900_5b57614c22b0_78e6aca7449b","tls_client_ja3":"052a5e65c3a64e860e1706b1de3c46a9","tls_client_version":"TLSv1.3","tls_client_cipher":"TLS_AES_128_GCM_SHA256","http_request_ja4h":"ge11nn0500_7992432eef13","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":47,"event_duration":10087000000,"source_bytes":18805,"dest_bytes":3760,"network_bytes":22565,"event_summary":""} +{"timestamp":"2026-09-02T15:29:27","event_id":"51b8b9fc-93ad-4029-8e8a-4db45b57c40e","source_ip":"185.246.217.150","source_port":20284,"source_domain":"","country_code":"NL","country_name":"The Netherlands","city_name":"Amsterdam","asn_number":210644,"asn_org":"Aeza Group LLC","dest_port":443,"network_protocol":"tls","application_protocol":"http","http_method":"GET","user_agent":"libredtail-http","url_path":"/public/index.php?s=/index/\\think\\app/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1][]=Hello","url_domain":"","http_request_headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"host\":\":443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","ssh_client_hassh":"","tls_client_ja4":"t13i170900_5b57614c22b0_78e6aca7449b","tls_client_ja3":"052a5e65c3a64e860e1706b1de3c46a9","tls_client_version":"TLSv1.3","tls_client_cipher":"TLS_AES_128_GCM_SHA256","http_request_ja4h":"ge11nn0500_7992432eef13","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":46,"event_duration":9865000000,"source_bytes":18548,"dest_bytes":3680,"network_bytes":22228,"event_summary":""} +{"timestamp":"2026-09-02T15:29:26","event_id":"51b8b9fc-93ad-4029-8e8a-4db45b57c40e","source_ip":"185.246.217.150","source_port":20284,"source_domain":"","country_code":"NL","country_name":"The Netherlands","city_name":"Amsterdam","asn_number":210644,"asn_org":"Aeza Group LLC","dest_port":443,"network_protocol":"tls","application_protocol":"http","http_method":"GET","user_agent":"libredtail-http","url_path":"/index.php?s=/index/\\think\\app/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1][]=Hello","url_domain":"","http_request_headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"host\":\":443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","ssh_client_hassh":"","tls_client_ja4":"t13i170900_5b57614c22b0_78e6aca7449b","tls_client_ja3":"052a5e65c3a64e860e1706b1de3c46a9","tls_client_version":"TLSv1.3","tls_client_cipher":"TLS_AES_128_GCM_SHA256","http_request_ja4h":"ge11nn0500_7992432eef13","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":45,"event_duration":9655000000,"source_bytes":18301,"dest_bytes":3600,"network_bytes":21901,"event_summary":""} +{"timestamp":"2026-09-02T15:29:26","event_id":"51b8b9fc-93ad-4029-8e8a-4db45b57c40e","source_ip":"185.246.217.150","source_port":20284,"source_domain":"","country_code":"NL","country_name":"The Netherlands","city_name":"Amsterdam","asn_number":210644,"asn_org":"Aeza Group LLC","dest_port":443,"network_protocol":"tls","application_protocol":"http","http_method":"GET","user_agent":"libredtail-http","url_path":"/app/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","url_domain":"","http_request_headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"content-length\":\"33\",\"content-type\":\"text/plain\",\"host\":\":443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","ssh_client_hassh":"","tls_client_ja4":"t13i170900_5b57614c22b0_78e6aca7449b","tls_client_ja3":"052a5e65c3a64e860e1706b1de3c46a9","tls_client_version":"TLSv1.3","tls_client_cipher":"TLS_AES_128_GCM_SHA256","http_request_ja4h":"ge11nn0700_3161ce9d7233","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":44,"event_duration":9446000000,"source_bytes":18061,"dest_bytes":3520,"network_bytes":21581,"event_summary":""} +{"timestamp":"2026-09-02T15:29:26","event_id":"51b8b9fc-93ad-4029-8e8a-4db45b57c40e","source_ip":"185.246.217.150","source_port":20284,"source_domain":"","country_code":"NL","country_name":"The Netherlands","city_name":"Amsterdam","asn_number":210644,"asn_org":"Aeza Group LLC","dest_port":443,"network_protocol":"tls","application_protocol":"http","http_method":"GET","user_agent":"libredtail-http","url_path":"/apps/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","url_domain":"","http_request_headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"content-length\":\"33\",\"content-type\":\"text/plain\",\"host\":\":443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","ssh_client_hassh":"","tls_client_ja4":"t13i170900_5b57614c22b0_78e6aca7449b","tls_client_ja3":"052a5e65c3a64e860e1706b1de3c46a9","tls_client_version":"TLSv1.3","tls_client_cipher":"TLS_AES_128_GCM_SHA256","http_request_ja4h":"ge11nn0700_3161ce9d7233","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":43,"event_duration":9236000000,"source_bytes":17790,"dest_bytes":3440,"network_bytes":21230,"event_summary":""} +{"timestamp":"2026-09-02T15:29:26","event_id":"51b8b9fc-93ad-4029-8e8a-4db45b57c40e","source_ip":"185.246.217.150","source_port":20284,"source_domain":"","country_code":"NL","country_name":"The Netherlands","city_name":"Amsterdam","asn_number":210644,"asn_org":"Aeza Group LLC","dest_port":443,"network_protocol":"tls","application_protocol":"http","http_method":"GET","user_agent":"libredtail-http","url_path":"/public/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","url_domain":"","http_request_headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"content-length\":\"33\",\"content-type\":\"text/plain\",\"host\":\":443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","ssh_client_hassh":"","tls_client_ja4":"t13i170900_5b57614c22b0_78e6aca7449b","tls_client_ja3":"052a5e65c3a64e860e1706b1de3c46a9","tls_client_version":"TLSv1.3","tls_client_cipher":"TLS_AES_128_GCM_SHA256","http_request_ja4h":"ge11nn0700_3161ce9d7233","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":42,"event_duration":9015000000,"source_bytes":17518,"dest_bytes":3360,"network_bytes":20878,"event_summary":""} +{"timestamp":"2026-09-02T15:29:25","event_id":"51b8b9fc-93ad-4029-8e8a-4db45b57c40e","source_ip":"185.246.217.150","source_port":20284,"source_domain":"","country_code":"NL","country_name":"The Netherlands","city_name":"Amsterdam","asn_number":210644,"asn_org":"Aeza Group LLC","dest_port":443,"network_protocol":"tls","application_protocol":"http","http_method":"GET","user_agent":"libredtail-http","url_path":"/panel/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","url_domain":"","http_request_headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"content-length\":\"33\",\"content-type\":\"text/plain\",\"host\":\":443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","ssh_client_hassh":"","tls_client_ja4":"t13i170900_5b57614c22b0_78e6aca7449b","tls_client_ja3":"052a5e65c3a64e860e1706b1de3c46a9","tls_client_version":"TLSv1.3","tls_client_cipher":"TLS_AES_128_GCM_SHA256","http_request_ja4h":"ge11nn0700_3161ce9d7233","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":41,"event_duration":8771000000,"source_bytes":17244,"dest_bytes":3280,"network_bytes":20524,"event_summary":""} +{"timestamp":"2026-09-02T15:29:25","event_id":"51b8b9fc-93ad-4029-8e8a-4db45b57c40e","source_ip":"185.246.217.150","source_port":20284,"source_domain":"","country_code":"NL","country_name":"The Netherlands","city_name":"Amsterdam","asn_number":210644,"asn_org":"Aeza Group LLC","dest_port":443,"network_protocol":"tls","application_protocol":"http","http_method":"GET","user_agent":"libredtail-http","url_path":"/workspace/drupal/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","url_domain":"","http_request_headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"content-length\":\"33\",\"content-type\":\"text/plain\",\"host\":\":443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","ssh_client_hassh":"","tls_client_ja4":"t13i170900_5b57614c22b0_78e6aca7449b","tls_client_ja3":"052a5e65c3a64e860e1706b1de3c46a9","tls_client_version":"TLSv1.3","tls_client_cipher":"TLS_AES_128_GCM_SHA256","http_request_ja4h":"ge11nn0700_3161ce9d7233","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":40,"event_duration":8551000000,"source_bytes":16971,"dest_bytes":3200,"network_bytes":20171,"event_summary":""} +{"timestamp":"2026-09-02T15:29:25","event_id":"51b8b9fc-93ad-4029-8e8a-4db45b57c40e","source_ip":"185.246.217.150","source_port":20284,"source_domain":"","country_code":"NL","country_name":"The Netherlands","city_name":"Amsterdam","asn_number":210644,"asn_org":"Aeza Group LLC","dest_port":443,"network_protocol":"tls","application_protocol":"http","http_method":"GET","user_agent":"libredtail-http","url_path":"/blog/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","url_domain":"","http_request_headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"content-length\":\"33\",\"content-type\":\"text/plain\",\"host\":\":443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","ssh_client_hassh":"","tls_client_ja4":"t13i170900_5b57614c22b0_78e6aca7449b","tls_client_ja3":"052a5e65c3a64e860e1706b1de3c46a9","tls_client_version":"TLSv1.3","tls_client_cipher":"TLS_AES_128_GCM_SHA256","http_request_ja4h":"ge11nn0700_3161ce9d7233","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":39,"event_duration":8329000000,"source_bytes":16687,"dest_bytes":3120,"network_bytes":19807,"event_summary":""} +{"timestamp":"2026-09-02T15:29:25","event_id":"51b8b9fc-93ad-4029-8e8a-4db45b57c40e","source_ip":"185.246.217.150","source_port":20284,"source_domain":"","country_code":"NL","country_name":"The Netherlands","city_name":"Amsterdam","asn_number":210644,"asn_org":"Aeza Group LLC","dest_port":443,"network_protocol":"tls","application_protocol":"http","http_method":"GET","user_agent":"libredtail-http","url_path":"/backup/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","url_domain":"","http_request_headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"content-length\":\"33\",\"content-type\":\"text/plain\",\"host\":\":443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","ssh_client_hassh":"","tls_client_ja4":"t13i170900_5b57614c22b0_78e6aca7449b","tls_client_ja3":"052a5e65c3a64e860e1706b1de3c46a9","tls_client_version":"TLSv1.3","tls_client_cipher":"TLS_AES_128_GCM_SHA256","http_request_ja4h":"ge11nn0700_3161ce9d7233","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":38,"event_duration":8110000000,"source_bytes":16415,"dest_bytes":3040,"network_bytes":19455,"event_summary":""} +{"timestamp":"2026-09-02T15:29:25","event_id":"51b8b9fc-93ad-4029-8e8a-4db45b57c40e","source_ip":"185.246.217.150","source_port":20284,"source_domain":"","country_code":"NL","country_name":"The Netherlands","city_name":"Amsterdam","asn_number":210644,"asn_org":"Aeza Group LLC","dest_port":443,"network_protocol":"tls","application_protocol":"http","http_method":"GET","user_agent":"libredtail-http","url_path":"/admin/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","url_domain":"","http_request_headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"content-length\":\"33\",\"content-type\":\"text/plain\",\"host\":\":443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","ssh_client_hassh":"","tls_client_ja4":"t13i170900_5b57614c22b0_78e6aca7449b","tls_client_ja3":"052a5e65c3a64e860e1706b1de3c46a9","tls_client_version":"TLSv1.3","tls_client_cipher":"TLS_AES_128_GCM_SHA256","http_request_ja4h":"ge11nn0700_3161ce9d7233","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":37,"event_duration":7894000000,"source_bytes":16141,"dest_bytes":2960,"network_bytes":19101,"event_summary":""} +{"timestamp":"2026-09-02T15:29:24","event_id":"51b8b9fc-93ad-4029-8e8a-4db45b57c40e","source_ip":"185.246.217.150","source_port":20284,"source_domain":"","country_code":"NL","country_name":"The Netherlands","city_name":"Amsterdam","asn_number":210644,"asn_org":"Aeza Group LLC","dest_port":443,"network_protocol":"tls","application_protocol":"http","http_method":"GET","user_agent":"libredtail-http","url_path":"/crm/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","url_domain":"","http_request_headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"content-length\":\"33\",\"content-type\":\"text/plain\",\"host\":\":443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","ssh_client_hassh":"","tls_client_ja4":"t13i170900_5b57614c22b0_78e6aca7449b","tls_client_ja3":"052a5e65c3a64e860e1706b1de3c46a9","tls_client_version":"TLSv1.3","tls_client_cipher":"TLS_AES_128_GCM_SHA256","http_request_ja4h":"ge11nn0700_3161ce9d7233","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":36,"event_duration":7678000000,"source_bytes":15868,"dest_bytes":2880,"network_bytes":18748,"event_summary":""} +{"timestamp":"2026-09-02T15:29:24","event_id":"51b8b9fc-93ad-4029-8e8a-4db45b57c40e","source_ip":"185.246.217.150","source_port":20284,"source_domain":"","country_code":"NL","country_name":"The Netherlands","city_name":"Amsterdam","asn_number":210644,"asn_org":"Aeza Group LLC","dest_port":443,"network_protocol":"tls","application_protocol":"http","http_method":"GET","user_agent":"libredtail-http","url_path":"/cms/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","url_domain":"","http_request_headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"content-length\":\"33\",\"content-type\":\"text/plain\",\"host\":\":443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","ssh_client_hassh":"","tls_client_ja4":"t13i170900_5b57614c22b0_78e6aca7449b","tls_client_ja3":"052a5e65c3a64e860e1706b1de3c46a9","tls_client_version":"TLSv1.3","tls_client_cipher":"TLS_AES_128_GCM_SHA256","http_request_ja4h":"ge11nn0700_3161ce9d7233","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":35,"event_duration":7469000000,"source_bytes":15597,"dest_bytes":2800,"network_bytes":18397,"event_summary":""} +{"timestamp":"2026-09-02T15:29:24","event_id":"51b8b9fc-93ad-4029-8e8a-4db45b57c40e","source_ip":"185.246.217.150","source_port":20284,"source_domain":"","country_code":"NL","country_name":"The Netherlands","city_name":"Amsterdam","asn_number":210644,"asn_org":"Aeza Group LLC","dest_port":443,"network_protocol":"tls","application_protocol":"http","http_method":"GET","user_agent":"libredtail-http","url_path":"/demo/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","url_domain":"","http_request_headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"content-length\":\"33\",\"content-type\":\"text/plain\",\"host\":\":443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","ssh_client_hassh":"","tls_client_ja4":"t13i170900_5b57614c22b0_78e6aca7449b","tls_client_ja3":"052a5e65c3a64e860e1706b1de3c46a9","tls_client_version":"TLSv1.3","tls_client_cipher":"TLS_AES_128_GCM_SHA256","http_request_ja4h":"ge11nn0700_3161ce9d7233","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":34,"event_duration":7253000000,"source_bytes":15326,"dest_bytes":2720,"network_bytes":18046,"event_summary":""} +{"timestamp":"2026-09-02T15:29:24","event_id":"51b8b9fc-93ad-4029-8e8a-4db45b57c40e","source_ip":"185.246.217.150","source_port":20284,"source_domain":"","country_code":"NL","country_name":"The Netherlands","city_name":"Amsterdam","asn_number":210644,"asn_org":"Aeza Group LLC","dest_port":443,"network_protocol":"tls","application_protocol":"http","http_method":"GET","user_agent":"libredtail-http","url_path":"/api/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","url_domain":"","http_request_headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"content-length\":\"33\",\"content-type\":\"text/plain\",\"host\":\":443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","ssh_client_hassh":"","tls_client_ja4":"t13i170900_5b57614c22b0_78e6aca7449b","tls_client_ja3":"052a5e65c3a64e860e1706b1de3c46a9","tls_client_version":"TLSv1.3","tls_client_cipher":"TLS_AES_128_GCM_SHA256","http_request_ja4h":"ge11nn0700_3161ce9d7233","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":33,"event_duration":7035000000,"source_bytes":15054,"dest_bytes":2640,"network_bytes":17694,"event_summary":""} +{"timestamp":"2026-09-02T15:29:23","event_id":"51b8b9fc-93ad-4029-8e8a-4db45b57c40e","source_ip":"185.246.217.150","source_port":20284,"source_domain":"","country_code":"NL","country_name":"The Netherlands","city_name":"Amsterdam","asn_number":210644,"asn_org":"Aeza Group LLC","dest_port":443,"network_protocol":"tls","application_protocol":"http","http_method":"GET","user_agent":"libredtail-http","url_path":"/testing/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","url_domain":"","http_request_headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"content-length\":\"33\",\"content-type\":\"text/plain\",\"host\":\":443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","ssh_client_hassh":"","tls_client_ja4":"t13i170900_5b57614c22b0_78e6aca7449b","tls_client_ja3":"052a5e65c3a64e860e1706b1de3c46a9","tls_client_version":"TLSv1.3","tls_client_cipher":"TLS_AES_128_GCM_SHA256","http_request_ja4h":"ge11nn0700_3161ce9d7233","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":32,"event_duration":6816000000,"source_bytes":14783,"dest_bytes":2560,"network_bytes":17343,"event_summary":""} +{"timestamp":"2026-09-02T15:29:23","event_id":"51b8b9fc-93ad-4029-8e8a-4db45b57c40e","source_ip":"185.246.217.150","source_port":20284,"source_domain":"","country_code":"NL","country_name":"The Netherlands","city_name":"Amsterdam","asn_number":210644,"asn_org":"Aeza Group LLC","dest_port":443,"network_protocol":"tls","application_protocol":"http","http_method":"GET","user_agent":"libredtail-http","url_path":"/test/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","url_domain":"","http_request_headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"content-length\":\"33\",\"content-type\":\"text/plain\",\"host\":\":443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","ssh_client_hassh":"","tls_client_ja4":"t13i170900_5b57614c22b0_78e6aca7449b","tls_client_ja3":"052a5e65c3a64e860e1706b1de3c46a9","tls_client_version":"TLSv1.3","tls_client_cipher":"TLS_AES_128_GCM_SHA256","http_request_ja4h":"ge11nn0700_3161ce9d7233","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":31,"event_duration":6608000000,"source_bytes":14508,"dest_bytes":2480,"network_bytes":16988,"event_summary":""} +{"timestamp":"2026-09-02T15:29:23","event_id":"51b8b9fc-93ad-4029-8e8a-4db45b57c40e","source_ip":"185.246.217.150","source_port":20284,"source_domain":"","country_code":"NL","country_name":"The Netherlands","city_name":"Amsterdam","asn_number":210644,"asn_org":"Aeza Group LLC","dest_port":443,"network_protocol":"tls","application_protocol":"http","http_method":"GET","user_agent":"libredtail-http","url_path":"/tests/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","url_domain":"","http_request_headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"content-length\":\"33\",\"content-type\":\"text/plain\",\"host\":\":443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","ssh_client_hassh":"","tls_client_ja4":"t13i170900_5b57614c22b0_78e6aca7449b","tls_client_ja3":"052a5e65c3a64e860e1706b1de3c46a9","tls_client_version":"TLSv1.3","tls_client_cipher":"TLS_AES_128_GCM_SHA256","http_request_ja4h":"ge11nn0700_3161ce9d7233","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":30,"event_duration":6394000000,"source_bytes":14236,"dest_bytes":2400,"network_bytes":16636,"event_summary":""} +{"timestamp":"2026-09-02T15:29:23","event_id":"51b8b9fc-93ad-4029-8e8a-4db45b57c40e","source_ip":"185.246.217.150","source_port":20284,"source_domain":"","country_code":"NL","country_name":"The Netherlands","city_name":"Amsterdam","asn_number":210644,"asn_org":"Aeza Group LLC","dest_port":443,"network_protocol":"tls","application_protocol":"http","http_method":"GET","user_agent":"libredtail-http","url_path":"/V2/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","url_domain":"","http_request_headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"content-length\":\"33\",\"content-type\":\"text/plain\",\"host\":\":443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","ssh_client_hassh":"","tls_client_ja4":"t13i170900_5b57614c22b0_78e6aca7449b","tls_client_ja3":"052a5e65c3a64e860e1706b1de3c46a9","tls_client_version":"TLSv1.3","tls_client_cipher":"TLS_AES_128_GCM_SHA256","http_request_ja4h":"ge11nn0700_3161ce9d7233","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":29,"event_duration":6191000000,"source_bytes":13963,"dest_bytes":2320,"network_bytes":16283,"event_summary":""} +{"timestamp":"2026-09-02T15:29:23","event_id":"51b8b9fc-93ad-4029-8e8a-4db45b57c40e","source_ip":"185.246.217.150","source_port":20284,"source_domain":"","country_code":"NL","country_name":"The Netherlands","city_name":"Amsterdam","asn_number":210644,"asn_org":"Aeza Group LLC","dest_port":443,"network_protocol":"tls","application_protocol":"http","http_method":"GET","user_agent":"libredtail-http","url_path":"/ws/ec/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","url_domain":"","http_request_headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"content-length\":\"33\",\"content-type\":\"text/plain\",\"host\":\":443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","ssh_client_hassh":"","tls_client_ja4":"t13i170900_5b57614c22b0_78e6aca7449b","tls_client_ja3":"052a5e65c3a64e860e1706b1de3c46a9","tls_client_version":"TLSv1.3","tls_client_cipher":"TLS_AES_128_GCM_SHA256","http_request_ja4h":"ge11nn0700_3161ce9d7233","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":28,"event_duration":5957000000,"source_bytes":13693,"dest_bytes":2240,"network_bytes":15933,"event_summary":""} +{"timestamp":"2026-09-02T15:29:22","event_id":"51b8b9fc-93ad-4029-8e8a-4db45b57c40e","source_ip":"185.246.217.150","source_port":20284,"source_domain":"","country_code":"NL","country_name":"The Netherlands","city_name":"Amsterdam","asn_number":210644,"asn_org":"Aeza Group LLC","dest_port":443,"network_protocol":"tls","application_protocol":"http","http_method":"GET","user_agent":"libredtail-http","url_path":"/zend/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","url_domain":"","http_request_headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"content-length\":\"33\",\"content-type\":\"text/plain\",\"host\":\":443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","ssh_client_hassh":"","tls_client_ja4":"t13i170900_5b57614c22b0_78e6aca7449b","tls_client_ja3":"052a5e65c3a64e860e1706b1de3c46a9","tls_client_version":"TLSv1.3","tls_client_cipher":"TLS_AES_128_GCM_SHA256","http_request_ja4h":"ge11nn0700_3161ce9d7233","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":27,"event_duration":5727000000,"source_bytes":13420,"dest_bytes":2160,"network_bytes":15580,"event_summary":""} +{"timestamp":"2026-09-02T15:29:22","event_id":"51b8b9fc-93ad-4029-8e8a-4db45b57c40e","source_ip":"185.246.217.150","source_port":20284,"source_domain":"","country_code":"NL","country_name":"The Netherlands","city_name":"Amsterdam","asn_number":210644,"asn_org":"Aeza Group LLC","dest_port":443,"network_protocol":"tls","application_protocol":"http","http_method":"GET","user_agent":"libredtail-http","url_path":"/yii/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","url_domain":"","http_request_headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"content-length\":\"33\",\"content-type\":\"text/plain\",\"host\":\":443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","ssh_client_hassh":"","tls_client_ja4":"t13i170900_5b57614c22b0_78e6aca7449b","tls_client_ja3":"052a5e65c3a64e860e1706b1de3c46a9","tls_client_version":"TLSv1.3","tls_client_cipher":"TLS_AES_128_GCM_SHA256","http_request_ja4h":"ge11nn0700_3161ce9d7233","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":26,"event_duration":5507000000,"source_bytes":13148,"dest_bytes":2080,"network_bytes":15228,"event_summary":""} +{"timestamp":"2026-09-02T15:29:22","event_id":"51b8b9fc-93ad-4029-8e8a-4db45b57c40e","source_ip":"185.246.217.150","source_port":20284,"source_domain":"","country_code":"NL","country_name":"The Netherlands","city_name":"Amsterdam","asn_number":210644,"asn_org":"Aeza Group LLC","dest_port":443,"network_protocol":"tls","application_protocol":"http","http_method":"GET","user_agent":"libredtail-http","url_path":"/ws/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","url_domain":"","http_request_headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"content-length\":\"33\",\"content-type\":\"text/plain\",\"host\":\":443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","ssh_client_hassh":"","tls_client_ja4":"t13i170900_5b57614c22b0_78e6aca7449b","tls_client_ja3":"052a5e65c3a64e860e1706b1de3c46a9","tls_client_version":"TLSv1.3","tls_client_cipher":"TLS_AES_128_GCM_SHA256","http_request_ja4h":"ge11nn0700_3161ce9d7233","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":25,"event_duration":5296000000,"source_bytes":12877,"dest_bytes":2000,"network_bytes":14877,"event_summary":""} +{"timestamp":"2026-09-02T15:29:22","event_id":"51b8b9fc-93ad-4029-8e8a-4db45b57c40e","source_ip":"185.246.217.150","source_port":20284,"source_domain":"","country_code":"NL","country_name":"The Netherlands","city_name":"Amsterdam","asn_number":210644,"asn_org":"Aeza Group LLC","dest_port":443,"network_protocol":"tls","application_protocol":"http","http_method":"GET","user_agent":"libredtail-http","url_path":"/www/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","url_domain":"","http_request_headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"content-length\":\"33\",\"content-type\":\"text/plain\",\"host\":\":443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","ssh_client_hassh":"","tls_client_ja4":"t13i170900_5b57614c22b0_78e6aca7449b","tls_client_ja3":"052a5e65c3a64e860e1706b1de3c46a9","tls_client_version":"TLSv1.3","tls_client_cipher":"TLS_AES_128_GCM_SHA256","http_request_ja4h":"ge11nn0700_3161ce9d7233","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":24,"event_duration":5067000000,"source_bytes":12607,"dest_bytes":1920,"network_bytes":14527,"event_summary":""} +{"timestamp":"2026-09-02T15:29:22","event_id":"51b8b9fc-93ad-4029-8e8a-4db45b57c40e","source_ip":"185.246.217.150","source_port":20284,"source_domain":"","country_code":"NL","country_name":"The Netherlands","city_name":"Amsterdam","asn_number":210644,"asn_org":"Aeza Group LLC","dest_port":443,"network_protocol":"tls","application_protocol":"http","http_method":"GET","user_agent":"libredtail-http","url_path":"/laravel/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","url_domain":"","http_request_headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"content-length\":\"33\",\"content-type\":\"text/plain\",\"host\":\":443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","ssh_client_hassh":"","tls_client_ja4":"t13i170900_5b57614c22b0_78e6aca7449b","tls_client_ja3":"052a5e65c3a64e860e1706b1de3c46a9","tls_client_version":"TLSv1.3","tls_client_cipher":"TLS_AES_128_GCM_SHA256","http_request_ja4h":"ge11nn0700_3161ce9d7233","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":23,"event_duration":4863000000,"source_bytes":12336,"dest_bytes":1840,"network_bytes":14176,"event_summary":""} +{"timestamp":"2026-09-02T15:29:21","event_id":"51b8b9fc-93ad-4029-8e8a-4db45b57c40e","source_ip":"185.246.217.150","source_port":20284,"source_domain":"","country_code":"NL","country_name":"The Netherlands","city_name":"Amsterdam","asn_number":210644,"asn_org":"Aeza Group LLC","dest_port":443,"network_protocol":"tls","application_protocol":"http","http_method":"GET","user_agent":"libredtail-http","url_path":"/lib/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","url_domain":"","http_request_headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"content-length\":\"33\",\"content-type\":\"text/plain\",\"host\":\":443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","ssh_client_hassh":"","tls_client_ja4":"t13i170900_5b57614c22b0_78e6aca7449b","tls_client_ja3":"052a5e65c3a64e860e1706b1de3c46a9","tls_client_version":"TLSv1.3","tls_client_cipher":"TLS_AES_128_GCM_SHA256","http_request_ja4h":"ge11nn0700_3161ce9d7233","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":22,"event_duration":4653000000,"source_bytes":12061,"dest_bytes":1760,"network_bytes":13821,"event_summary":""} +{"timestamp":"2026-09-02T15:29:21","event_id":"51b8b9fc-93ad-4029-8e8a-4db45b57c40e","source_ip":"185.246.217.150","source_port":20284,"source_domain":"","country_code":"NL","country_name":"The Netherlands","city_name":"Amsterdam","asn_number":210644,"asn_org":"Aeza Group LLC","dest_port":443,"network_protocol":"tls","application_protocol":"http","http_method":"GET","user_agent":"libredtail-http","url_path":"/lib/phpunit/Util/PHP/eval-stdin.php","url_domain":"","http_request_headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"content-length\":\"33\",\"content-type\":\"text/plain\",\"host\":\":443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","ssh_client_hassh":"","tls_client_ja4":"t13i170900_5b57614c22b0_78e6aca7449b","tls_client_ja3":"052a5e65c3a64e860e1706b1de3c46a9","tls_client_version":"TLSv1.3","tls_client_cipher":"TLS_AES_128_GCM_SHA256","http_request_ja4h":"ge11nn0700_3161ce9d7233","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":21,"event_duration":4439000000,"source_bytes":11790,"dest_bytes":1680,"network_bytes":13470,"event_summary":""} +{"timestamp":"2026-09-02T15:29:21","event_id":"51b8b9fc-93ad-4029-8e8a-4db45b57c40e","source_ip":"185.246.217.150","source_port":20284,"source_domain":"","country_code":"NL","country_name":"The Netherlands","city_name":"Amsterdam","asn_number":210644,"asn_org":"Aeza Group LLC","dest_port":443,"network_protocol":"tls","application_protocol":"http","http_method":"GET","user_agent":"libredtail-http","url_path":"/lib/phpunit/src/Util/PHP/eval-stdin.php","url_domain":"","http_request_headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"content-length\":\"33\",\"content-type\":\"text/plain\",\"host\":\":443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","ssh_client_hassh":"","tls_client_ja4":"t13i170900_5b57614c22b0_78e6aca7449b","tls_client_ja3":"052a5e65c3a64e860e1706b1de3c46a9","tls_client_version":"TLSv1.3","tls_client_cipher":"TLS_AES_128_GCM_SHA256","http_request_ja4h":"ge11nn0700_3161ce9d7233","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":20,"event_duration":4226000000,"source_bytes":11538,"dest_bytes":1600,"network_bytes":13138,"event_summary":""} +{"timestamp":"2026-09-02T15:29:21","event_id":"51b8b9fc-93ad-4029-8e8a-4db45b57c40e","source_ip":"185.246.217.150","source_port":20284,"source_domain":"","country_code":"NL","country_name":"The Netherlands","city_name":"Amsterdam","asn_number":210644,"asn_org":"Aeza Group LLC","dest_port":443,"network_protocol":"tls","application_protocol":"http","http_method":"GET","user_agent":"libredtail-http","url_path":"/lib/phpunit/phpunit/Util/PHP/eval-stdin.php","url_domain":"","http_request_headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"content-length\":\"33\",\"content-type\":\"text/plain\",\"host\":\":443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","ssh_client_hassh":"","tls_client_ja4":"t13i170900_5b57614c22b0_78e6aca7449b","tls_client_ja3":"052a5e65c3a64e860e1706b1de3c46a9","tls_client_version":"TLSv1.3","tls_client_cipher":"TLS_AES_128_GCM_SHA256","http_request_ja4h":"ge11nn0700_3161ce9d7233","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":19,"event_duration":4006000000,"source_bytes":11282,"dest_bytes":1520,"network_bytes":12802,"event_summary":""} +{"timestamp":"2026-09-02T15:29:20","event_id":"51b8b9fc-93ad-4029-8e8a-4db45b57c40e","source_ip":"185.246.217.150","source_port":20284,"source_domain":"","country_code":"NL","country_name":"The Netherlands","city_name":"Amsterdam","asn_number":210644,"asn_org":"Aeza Group LLC","dest_port":443,"network_protocol":"tls","application_protocol":"http","http_method":"GET","user_agent":"libredtail-http","url_path":"/lib/phpunit/phpunit/src/Util/PHP/eval-stdin.php","url_domain":"","http_request_headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"content-length\":\"33\",\"content-type\":\"text/plain\",\"host\":\":443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","ssh_client_hassh":"","tls_client_ja4":"t13i170900_5b57614c22b0_78e6aca7449b","tls_client_ja3":"052a5e65c3a64e860e1706b1de3c46a9","tls_client_version":"TLSv1.3","tls_client_cipher":"TLS_AES_128_GCM_SHA256","http_request_ja4h":"ge11nn0700_3161ce9d7233","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":18,"event_duration":3791000000,"source_bytes":11022,"dest_bytes":1440,"network_bytes":12462,"event_summary":""} +{"timestamp":"2026-09-02T15:29:20","event_id":"51b8b9fc-93ad-4029-8e8a-4db45b57c40e","source_ip":"185.246.217.150","source_port":20284,"source_domain":"","country_code":"NL","country_name":"The Netherlands","city_name":"Amsterdam","asn_number":210644,"asn_org":"Aeza Group LLC","dest_port":443,"network_protocol":"tls","application_protocol":"http","http_method":"GET","user_agent":"libredtail-http","url_path":"/phpunit/Util/PHP/eval-stdin.php","url_domain":"","http_request_headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"content-length\":\"33\",\"content-type\":\"text/plain\",\"host\":\":443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","ssh_client_hassh":"","tls_client_ja4":"t13i170900_5b57614c22b0_78e6aca7449b","tls_client_ja3":"052a5e65c3a64e860e1706b1de3c46a9","tls_client_version":"TLSv1.3","tls_client_cipher":"TLS_AES_128_GCM_SHA256","http_request_ja4h":"ge11nn0700_3161ce9d7233","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":17,"event_duration":3572000000,"source_bytes":10758,"dest_bytes":1360,"network_bytes":12118,"event_summary":""} +{"timestamp":"2026-09-02T15:29:20","event_id":"51b8b9fc-93ad-4029-8e8a-4db45b57c40e","source_ip":"185.246.217.150","source_port":20284,"source_domain":"","country_code":"NL","country_name":"The Netherlands","city_name":"Amsterdam","asn_number":210644,"asn_org":"Aeza Group LLC","dest_port":443,"network_protocol":"tls","application_protocol":"http","http_method":"GET","user_agent":"libredtail-http","url_path":"/phpunit/src/Util/PHP/eval-stdin.php","url_domain":"","http_request_headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"content-length\":\"33\",\"content-type\":\"text/plain\",\"host\":\":443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","ssh_client_hassh":"","tls_client_ja4":"t13i170900_5b57614c22b0_78e6aca7449b","tls_client_ja3":"052a5e65c3a64e860e1706b1de3c46a9","tls_client_version":"TLSv1.3","tls_client_cipher":"TLS_AES_128_GCM_SHA256","http_request_ja4h":"ge11nn0700_3161ce9d7233","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":16,"event_duration":3363000000,"source_bytes":10510,"dest_bytes":1280,"network_bytes":11790,"event_summary":""} +{"timestamp":"2026-09-02T15:29:20","event_id":"51b8b9fc-93ad-4029-8e8a-4db45b57c40e","source_ip":"185.246.217.150","source_port":20284,"source_domain":"","country_code":"NL","country_name":"The Netherlands","city_name":"Amsterdam","asn_number":210644,"asn_org":"Aeza Group LLC","dest_port":443,"network_protocol":"tls","application_protocol":"http","http_method":"GET","user_agent":"libredtail-http","url_path":"/phpunit/phpunit/Util/PHP/eval-stdin.php","url_domain":"","http_request_headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"content-length\":\"33\",\"content-type\":\"text/plain\",\"host\":\":443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","ssh_client_hassh":"","tls_client_ja4":"t13i170900_5b57614c22b0_78e6aca7449b","tls_client_ja3":"052a5e65c3a64e860e1706b1de3c46a9","tls_client_version":"TLSv1.3","tls_client_cipher":"TLS_AES_128_GCM_SHA256","http_request_ja4h":"ge11nn0700_3161ce9d7233","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":15,"event_duration":3150000000,"source_bytes":10258,"dest_bytes":1200,"network_bytes":11458,"event_summary":""} +{"timestamp":"2026-09-02T15:29:20","event_id":"51b8b9fc-93ad-4029-8e8a-4db45b57c40e","source_ip":"185.246.217.150","source_port":20284,"source_domain":"","country_code":"NL","country_name":"The Netherlands","city_name":"Amsterdam","asn_number":210644,"asn_org":"Aeza Group LLC","dest_port":443,"network_protocol":"tls","application_protocol":"http","http_method":"GET","user_agent":"libredtail-http","url_path":"/phpunit/phpunit/src/Util/PHP/eval-stdin.php","url_domain":"","http_request_headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"content-length\":\"33\",\"content-type\":\"text/plain\",\"host\":\":443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","ssh_client_hassh":"","tls_client_ja4":"t13i170900_5b57614c22b0_78e6aca7449b","tls_client_ja3":"052a5e65c3a64e860e1706b1de3c46a9","tls_client_version":"TLSv1.3","tls_client_cipher":"TLS_AES_128_GCM_SHA256","http_request_ja4h":"ge11nn0700_3161ce9d7233","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":14,"event_duration":2935000000,"source_bytes":10002,"dest_bytes":1120,"network_bytes":11122,"event_summary":""} +{"timestamp":"2026-09-02T15:29:19","event_id":"51b8b9fc-93ad-4029-8e8a-4db45b57c40e","source_ip":"185.246.217.150","source_port":20284,"source_domain":"","country_code":"NL","country_name":"The Netherlands","city_name":"Amsterdam","asn_number":210644,"asn_org":"Aeza Group LLC","dest_port":443,"network_protocol":"tls","application_protocol":"http","http_method":"GET","user_agent":"libredtail-http","url_path":"/vendor/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","url_domain":"","http_request_headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"content-length\":\"33\",\"content-type\":\"text/plain\",\"host\":\":443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","ssh_client_hassh":"","tls_client_ja4":"t13i170900_5b57614c22b0_78e6aca7449b","tls_client_ja3":"052a5e65c3a64e860e1706b1de3c46a9","tls_client_version":"TLSv1.3","tls_client_cipher":"TLS_AES_128_GCM_SHA256","http_request_ja4h":"ge11nn0700_3161ce9d7233","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":13,"event_duration":2708000000,"source_bytes":9742,"dest_bytes":1040,"network_bytes":10782,"event_summary":""} +{"timestamp":"2026-09-02T15:29:19","event_id":"51b8b9fc-93ad-4029-8e8a-4db45b57c40e","source_ip":"185.246.217.150","source_port":20284,"source_domain":"","country_code":"NL","country_name":"The Netherlands","city_name":"Amsterdam","asn_number":210644,"asn_org":"Aeza Group LLC","dest_port":443,"network_protocol":"tls","application_protocol":"http","http_method":"GET","user_agent":"libredtail-http","url_path":"/vendor/phpunit/phpunit/LICENSE/eval-stdin.php","url_domain":"","http_request_headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"content-length\":\"33\",\"content-type\":\"text/plain\",\"host\":\":443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","ssh_client_hassh":"","tls_client_ja4":"t13i170900_5b57614c22b0_78e6aca7449b","tls_client_ja3":"052a5e65c3a64e860e1706b1de3c46a9","tls_client_version":"TLSv1.3","tls_client_cipher":"TLS_AES_128_GCM_SHA256","http_request_ja4h":"ge11nn0700_3161ce9d7233","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":12,"event_duration":2485000000,"source_bytes":9468,"dest_bytes":960,"network_bytes":10428,"event_summary":""} +{"timestamp":"2026-09-02T15:29:19","event_id":"51b8b9fc-93ad-4029-8e8a-4db45b57c40e","source_ip":"185.246.217.150","source_port":20284,"source_domain":"","country_code":"NL","country_name":"The Netherlands","city_name":"Amsterdam","asn_number":210644,"asn_org":"Aeza Group LLC","dest_port":443,"network_protocol":"tls","application_protocol":"http","http_method":"GET","user_agent":"libredtail-http","url_path":"/vendor/phpunit/Util/PHP/eval-stdin.php","url_domain":"","http_request_headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"content-length\":\"33\",\"content-type\":\"text/plain\",\"host\":\":443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","ssh_client_hassh":"","tls_client_ja4":"t13i170900_5b57614c22b0_78e6aca7449b","tls_client_ja3":"052a5e65c3a64e860e1706b1de3c46a9","tls_client_version":"TLSv1.3","tls_client_cipher":"TLS_AES_128_GCM_SHA256","http_request_ja4h":"ge11nn0700_3161ce9d7233","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":11,"event_duration":2258000000,"source_bytes":9206,"dest_bytes":880,"network_bytes":10086,"event_summary":""} +{"timestamp":"2026-09-02T15:29:19","event_id":"51b8b9fc-93ad-4029-8e8a-4db45b57c40e","source_ip":"185.246.217.150","source_port":20284,"source_domain":"","country_code":"NL","country_name":"The Netherlands","city_name":"Amsterdam","asn_number":210644,"asn_org":"Aeza Group LLC","dest_port":443,"network_protocol":"tls","application_protocol":"http","http_method":"GET","user_agent":"libredtail-http","url_path":"/vendor/phpunit/src/Util/PHP/eval-stdin.php","url_domain":"","http_request_headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"content-length\":\"33\",\"content-type\":\"text/plain\",\"host\":\":443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","ssh_client_hassh":"","tls_client_ja4":"t13i170900_5b57614c22b0_78e6aca7449b","tls_client_ja3":"052a5e65c3a64e860e1706b1de3c46a9","tls_client_version":"TLSv1.3","tls_client_cipher":"TLS_AES_128_GCM_SHA256","http_request_ja4h":"ge11nn0700_3161ce9d7233","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":10,"event_duration":2036000000,"source_bytes":8951,"dest_bytes":800,"network_bytes":9751,"event_summary":""} +{"timestamp":"2026-09-02T15:29:19","event_id":"51b8b9fc-93ad-4029-8e8a-4db45b57c40e","source_ip":"185.246.217.150","source_port":20284,"source_domain":"","country_code":"NL","country_name":"The Netherlands","city_name":"Amsterdam","asn_number":210644,"asn_org":"Aeza Group LLC","dest_port":443,"network_protocol":"tls","application_protocol":"http","http_method":"GET","user_agent":"libredtail-http","url_path":"/vendor/phpunit/phpunit/Util/PHP/eval-stdin.php","url_domain":"","http_request_headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"content-length\":\"33\",\"content-type\":\"text/plain\",\"host\":\":443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","ssh_client_hassh":"","tls_client_ja4":"t13i170900_5b57614c22b0_78e6aca7449b","tls_client_ja3":"052a5e65c3a64e860e1706b1de3c46a9","tls_client_version":"TLSv1.3","tls_client_cipher":"TLS_AES_128_GCM_SHA256","http_request_ja4h":"ge11nn0700_3161ce9d7233","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":9,"event_duration":1830000000,"source_bytes":8692,"dest_bytes":720,"network_bytes":9412,"event_summary":""} +{"timestamp":"2026-09-02T15:29:18","event_id":"51b8b9fc-93ad-4029-8e8a-4db45b57c40e","source_ip":"185.246.217.150","source_port":20284,"source_domain":"","country_code":"NL","country_name":"The Netherlands","city_name":"Amsterdam","asn_number":210644,"asn_org":"Aeza Group LLC","dest_port":443,"network_protocol":"tls","application_protocol":"http","http_method":"GET","user_agent":"libredtail-http","url_path":"/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php","url_domain":"","http_request_headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"content-length\":\"33\",\"content-type\":\"text/plain\",\"host\":\":443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","ssh_client_hassh":"","tls_client_ja4":"t13i170900_5b57614c22b0_78e6aca7449b","tls_client_ja3":"052a5e65c3a64e860e1706b1de3c46a9","tls_client_version":"TLSv1.3","tls_client_cipher":"TLS_AES_128_GCM_SHA256","http_request_ja4h":"ge11nn0700_3161ce9d7233","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":8,"event_duration":1609000000,"source_bytes":8429,"dest_bytes":640,"network_bytes":9069,"event_summary":""} +{"timestamp":"2026-09-02T15:29:18","event_id":"51b8b9fc-93ad-4029-8e8a-4db45b57c40e","source_ip":"185.246.217.150","source_port":20284,"source_domain":"","country_code":"NL","country_name":"The Netherlands","city_name":"Amsterdam","asn_number":210644,"asn_org":"Aeza Group LLC","dest_port":443,"network_protocol":"tls","application_protocol":"http","http_method":"POST","user_agent":"libredtail-http","url_path":"/index.php?-d+allow_url_include%3don+-d+auto_prepend_file%3dphp%3a//input","url_domain":"","http_request_headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"content-length\":\"1193\",\"content-type\":\"application/x-www-form-urlencoded\",\"host\":\":443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","ssh_client_hassh":"","tls_client_ja4":"t13i170900_5b57614c22b0_78e6aca7449b","tls_client_ja3":"052a5e65c3a64e860e1706b1de3c46a9","tls_client_version":"TLSv1.3","tls_client_cipher":"TLS_AES_128_GCM_SHA256","http_request_ja4h":"po11nn0700_3161ce9d7233","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":7,"event_duration":1402000000,"source_bytes":8162,"dest_bytes":560,"network_bytes":8722,"event_summary":""} +{"timestamp":"2026-09-02T15:29:18","event_id":"51b8b9fc-93ad-4029-8e8a-4db45b57c40e","source_ip":"185.246.217.150","source_port":20284,"source_domain":"","country_code":"NL","country_name":"The Netherlands","city_name":"Amsterdam","asn_number":210644,"asn_org":"Aeza Group LLC","dest_port":443,"network_protocol":"tls","application_protocol":"http","http_method":"POST","user_agent":"libredtail-http","url_path":"/test.hello?%25ADd+allow_url_include%3D1+%25ADd+auto_prepend_file%3Dphp://input","url_domain":"","http_request_headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"content-length\":\"1193\",\"content-type\":\"application/x-www-form-urlencoded\",\"host\":\":443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","ssh_client_hassh":"","tls_client_ja4":"t13i170900_5b57614c22b0_78e6aca7449b","tls_client_ja3":"052a5e65c3a64e860e1706b1de3c46a9","tls_client_version":"TLSv1.3","tls_client_cipher":"TLS_AES_128_GCM_SHA256","http_request_ja4h":"po11nn0700_3161ce9d7233","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":6,"event_duration":1193000000,"source_bytes":6687,"dest_bytes":480,"network_bytes":7167,"event_summary":""} +{"timestamp":"2026-09-02T15:29:18","event_id":"51b8b9fc-93ad-4029-8e8a-4db45b57c40e","source_ip":"185.246.217.150","source_port":20284,"source_domain":"","country_code":"NL","country_name":"The Netherlands","city_name":"Amsterdam","asn_number":210644,"asn_org":"Aeza Group LLC","dest_port":443,"network_protocol":"tls","application_protocol":"http","http_method":"POST","user_agent":"libredtail-http","url_path":"/index.php?%25ADd+allow_url_include%3D1+%25ADd+auto_prepend_file%3Dphp://input","url_domain":"","http_request_headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"content-length\":\"1193\",\"content-type\":\"application/x-www-form-urlencoded\",\"host\":\":443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","ssh_client_hassh":"","tls_client_ja4":"t13i170900_5b57614c22b0_78e6aca7449b","tls_client_ja3":"052a5e65c3a64e860e1706b1de3c46a9","tls_client_version":"TLSv1.3","tls_client_cipher":"TLS_AES_128_GCM_SHA256","http_request_ja4h":"po11nn0700_3161ce9d7233","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":5,"event_duration":981000000,"source_bytes":5206,"dest_bytes":400,"network_bytes":5606,"event_summary":""} +{"timestamp":"2026-09-02T15:29:17","event_id":"51b8b9fc-93ad-4029-8e8a-4db45b57c40e","source_ip":"185.246.217.150","source_port":20284,"source_domain":"","country_code":"NL","country_name":"The Netherlands","city_name":"Amsterdam","asn_number":210644,"asn_org":"Aeza Group LLC","dest_port":443,"network_protocol":"tls","application_protocol":"http","http_method":"POST","user_agent":"libredtail-http","url_path":"/?%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input","url_domain":"","http_request_headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"content-length\":\"1193\",\"content-type\":\"application/x-www-form-urlencoded\",\"host\":\":443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","ssh_client_hassh":"","tls_client_ja4":"t13i170900_5b57614c22b0_78e6aca7449b","tls_client_ja3":"052a5e65c3a64e860e1706b1de3c46a9","tls_client_version":"TLSv1.3","tls_client_cipher":"TLS_AES_128_GCM_SHA256","http_request_ja4h":"po11nn0700_3161ce9d7233","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":4,"event_duration":762000000,"source_bytes":3726,"dest_bytes":320,"network_bytes":4046,"event_summary":""} +{"timestamp":"2026-09-02T15:29:17","event_id":"51b8b9fc-93ad-4029-8e8a-4db45b57c40e","source_ip":"185.246.217.150","source_port":20284,"source_domain":"","country_code":"NL","country_name":"The Netherlands","city_name":"Amsterdam","asn_number":210644,"asn_org":"Aeza Group LLC","dest_port":443,"network_protocol":"tls","application_protocol":"http","http_method":"POST","user_agent":"libredtail-http","url_path":"/hello.world?%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input","url_domain":"","http_request_headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"content-length\":\"1193\",\"content-type\":\"application/x-www-form-urlencoded\",\"host\":\":443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","ssh_client_hassh":"","tls_client_ja4":"t13i170900_5b57614c22b0_78e6aca7449b","tls_client_ja3":"052a5e65c3a64e860e1706b1de3c46a9","tls_client_version":"TLSv1.3","tls_client_cipher":"TLS_AES_128_GCM_SHA256","http_request_ja4h":"po11nn0700_3161ce9d7233","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":3,"event_duration":546000000,"source_bytes":2259,"dest_bytes":240,"network_bytes":2499,"event_summary":""} +{"timestamp":"2026-09-02T15:29:17","event_id":"51b8b9fc-93ad-4029-8e8a-4db45b57c40e","source_ip":"185.246.217.150","source_port":20284,"source_domain":"","country_code":"NL","country_name":"The Netherlands","city_name":"Amsterdam","asn_number":210644,"asn_org":"Aeza Group LLC","dest_port":443,"network_protocol":"tls","application_protocol":"http","http_method":"POST","user_agent":"libredtail-http","url_path":"/cgi-bin/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/bin/sh","url_domain":"","http_request_headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"content-length\":\"113\",\"content-type\":\"text/plain\",\"host\":\":443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","ssh_client_hassh":"","tls_client_ja4":"t13i170900_5b57614c22b0_78e6aca7449b","tls_client_ja3":"052a5e65c3a64e860e1706b1de3c46a9","tls_client_version":"TLSv1.3","tls_client_cipher":"TLS_AES_128_GCM_SHA256","http_request_ja4h":"po11nn0700_3161ce9d7233","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":2,"event_duration":334000000,"source_bytes":781,"dest_bytes":160,"network_bytes":941,"event_summary":""} +{"timestamp":"2026-09-02T15:29:17","event_id":"51b8b9fc-93ad-4029-8e8a-4db45b57c40e","source_ip":"185.246.217.150","source_port":20284,"source_domain":"","country_code":"NL","country_name":"The Netherlands","city_name":"Amsterdam","asn_number":210644,"asn_org":"Aeza Group LLC","dest_port":443,"network_protocol":"tls","application_protocol":"http","http_method":"POST","user_agent":"libredtail-http","url_path":"/cgi-bin/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/bin/sh","url_domain":"","http_request_headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"content-length\":\"113\",\"content-type\":\"text/plain\",\"host\":\":443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","ssh_client_hassh":"","tls_client_ja4":"t13i170900_5b57614c22b0_78e6aca7449b","tls_client_ja3":"052a5e65c3a64e860e1706b1de3c46a9","tls_client_version":"TLSv1.3","tls_client_cipher":"TLS_AES_128_GCM_SHA256","http_request_ja4h":"po11nn0700_3161ce9d7233","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":363,"dest_bytes":80,"network_bytes":443,"event_summary":""} +{"timestamp":"2026-09-01T23:24:45","event_id":"1a3b2108-0dc1-453f-9079-e1a5b2ff49a6","source_ip":"185.246.217.150","source_port":13054,"source_domain":"","country_code":"NL","country_name":"The Netherlands","city_name":"Amsterdam","asn_number":210644,"asn_org":"Aeza Group LLC","dest_port":2222,"network_protocol":"","application_protocol":"ssh","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"19532158b559096b89b1a5f7d17175b2","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":136000000,"source_bytes":1536,"dest_bytes":15,"network_bytes":1551,"event_summary":"SSH-2.0-libssh2_1.11.1\r\n\u0000\u0000\u0005�\u000b\u0014��\u001cj�\t��CP�D��0�\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,ext-info-c,kex-strict-c-v00@openssh.com\u0000\u0000\u0001fecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ssh-ed25519,ssh-ed25519-cert-v01@openssh.com,rsa-sha2-512,rsa-sha2-256,rsa-sha2-512-cert-v01@openssh.com,rsa-sha2-256-cert-v01@openssh.com,ssh-rsa,ssh-rsa-cert-v01@openssh.com\u0000\u0000\u0000�chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,arcfour128,arcfour,3des-cbc\u0000\u0000\u0000�chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,arcfour128,arcfour,3des-cbc\u0000\u0000\u0000�hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96\u0000\u0000\u0000�hmac-sha2-256,hmac-sha2-256-etm@openssh.com,hmac-sha2-512,hmac-sha2-512-etm@openssh.com,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha1-96,hmac-md5,hmac-md5-96\u0000\u0000\u0000\u0004none\u0000\u0000\u0000\u0004none\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000��\u0001s;�)�S\u0004�"} +{"timestamp":"2026-08-31T22:44:34","event_id":"3e3b6543-22ba-47ce-8746-3665d3c34f27","source_ip":"185.246.217.150","source_port":31990,"source_domain":"","country_code":"NL","country_name":"The Netherlands","city_name":"Amsterdam","asn_number":210644,"asn_org":"Aeza Group LLC","dest_port":2375,"network_protocol":"","application_protocol":"http","http_method":"GET","user_agent":"libredtail-http","url_path":"/containers/json","url_domain":"","http_request_headers":"{\"accept\":\"*/*\",\"connection\":\"keep-alive\",\"host\":\":2375\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"libredtail-http\"}","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"ge11nn0500_3012a89e1aee","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":154,"dest_bytes":80,"network_bytes":234,"event_summary":""} \ No newline at end of file diff --git a/kevlar/2026-09-07/honeylabs/events-AS211720.ndjson b/kevlar/2026-09-07/honeylabs/events-AS211720.ndjson new file mode 100644 index 0000000..e69de29 diff --git a/kevlar/2026-09-07/honeylabs/events-AS213702.ndjson b/kevlar/2026-09-07/honeylabs/events-AS213702.ndjson new file mode 100644 index 0000000..e69de29 diff --git a/kevlar/2026-09-07/honeylabs/events-AS214351.ndjson b/kevlar/2026-09-07/honeylabs/events-AS214351.ndjson new file mode 100644 index 0000000..e69de29 diff --git a/kevlar/2026-09-07/honeylabs/events-AS214940.ndjson b/kevlar/2026-09-07/honeylabs/events-AS214940.ndjson new file mode 100644 index 0000000..e69de29 diff --git a/kevlar/2026-09-07/honeylabs/events-AS216139.ndjson b/kevlar/2026-09-07/honeylabs/events-AS216139.ndjson new file mode 100644 index 0000000..e69de29 diff --git a/kevlar/2026-09-07/honeylabs/events-AS216246.ndjson b/kevlar/2026-09-07/honeylabs/events-AS216246.ndjson new file mode 100644 index 0000000..62f74df --- /dev/null +++ b/kevlar/2026-09-07/honeylabs/events-AS216246.ndjson @@ -0,0 +1,2 @@ +{"timestamp":"2026-09-03T20:05:03","event_id":"b177bb95-06e3-4c45-8713-3db77a154ce9","source_ip":"45.151.101.38","source_port":36904,"source_domain":"","country_code":"RU","country_name":"Russia","city_name":"Moscow","asn_number":216246,"asn_org":"Aeza Group LLC","dest_port":8006,"network_protocol":"tls","application_protocol":"http","http_method":"POST","user_agent":"Python-urllib/3.10","url_path":"/api2/json/access/ticket","url_domain":"","http_request_headers":"{\"accept-encoding\":\"identity\",\"connection\":\"close\",\"content-length\":\"48\",\"content-type\":\"application/x-www-form-urlencoded\",\"host\":\":8006\",\"user-agent\":\"Python-urllib/3.10\"}","ssh_client_hassh":"","tls_client_ja4":"t13i181000_85036bcba153_d41ae481755e","tls_client_ja3":"8a9d5d0f12f7d43ee3af1c51d2998d99","tls_client_version":"TLSv1.3","tls_client_cipher":"TLS_AES_128_GCM_SHA256","http_request_ja4h":"po11nn0600_def5433ae821","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":101000000,"source_bytes":263,"dest_bytes":78,"network_bytes":341,"event_summary":""} +{"timestamp":"2026-08-31T13:15:24","event_id":"433ef92e-cd2f-4ef0-8ae0-fc11b23ec8c4","source_ip":"176.124.222.61","source_port":57138,"source_domain":"","country_code":"RU","country_name":"Russia","city_name":"Moscow","asn_number":216246,"asn_org":"Aeza Group LLC","dest_port":5432,"network_protocol":"","application_protocol":"","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":8,"dest_bytes":14,"network_bytes":22,"event_summary":"\u0000\u0000\u0000\b\u0004�\u0016/"} \ No newline at end of file diff --git a/kevlar/2026-09-07/honeylabs/events-AS216309.ndjson b/kevlar/2026-09-07/honeylabs/events-AS216309.ndjson new file mode 100644 index 0000000..e69de29 diff --git a/kevlar/2026-09-07/honeylabs/events-AS30823.ndjson b/kevlar/2026-09-07/honeylabs/events-AS30823.ndjson new file mode 100644 index 0000000..e69de29 diff --git a/kevlar/2026-09-07/honeylabs/events-AS33993.ndjson b/kevlar/2026-09-07/honeylabs/events-AS33993.ndjson new file mode 100644 index 0000000..e69de29 diff --git a/kevlar/2026-09-07/honeylabs/events-AS394711.ndjson b/kevlar/2026-09-07/honeylabs/events-AS394711.ndjson new file mode 100644 index 0000000..e69de29 diff --git a/kevlar/2026-09-07/honeylabs/events-AS400992.ndjson b/kevlar/2026-09-07/honeylabs/events-AS400992.ndjson new file mode 100644 index 0000000..e69de29 diff --git a/kevlar/2026-09-07/honeylabs/events-AS51396.ndjson b/kevlar/2026-09-07/honeylabs/events-AS51396.ndjson new file mode 100644 index 0000000..379893d --- /dev/null +++ b/kevlar/2026-09-07/honeylabs/events-AS51396.ndjson @@ -0,0 +1,100 @@ +{"timestamp":"2026-09-06T23:58:26","event_id":"f49daf0c-c56d-456a-b59a-cdee44ac673d","source_ip":"176.65.149.27","source_port":54702,"source_domain":"176.65.149.27.ptr.pfcloud.network","country_code":"NL","country_name":"The Netherlands","city_name":"Eygelshoven","asn_number":51396,"asn_org":"Pfcloud UG (haftungsbeschrankt)","dest_port":38049,"network_protocol":"","application_protocol":"ssh","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":109000000,"source_bytes":17,"dest_bytes":13,"network_bytes":30,"event_summary":"SSH-2.0-OpenSSH\r\n"} +{"timestamp":"2026-09-06T23:57:44","event_id":"39a8ab9e-a97d-45f2-b363-9d51b4974f63","source_ip":"204.76.203.221","source_port":40742,"source_domain":"204.76.203.221.ptr.pfcloud.network","country_code":"NL","country_name":"The Netherlands","city_name":"Eygelshoven","asn_number":51396,"asn_org":"Pfcloud UG (haftungsbeschrankt)","dest_port":1897,"network_protocol":"","application_protocol":"socks5","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":3,"dest_bytes":14,"network_bytes":17,"event_summary":"\u0005\u0001\u0000"} +{"timestamp":"2026-09-06T23:57:44","event_id":"84919345-adc4-4130-a728-449c9f1ae840","source_ip":"204.76.203.214","source_port":42142,"source_domain":"204.76.203.214.ptr.pfcloud.network","country_code":"NL","country_name":"The Netherlands","city_name":"Eygelshoven","asn_number":51396,"asn_org":"Pfcloud UG (haftungsbeschrankt)","dest_port":1897,"network_protocol":"","application_protocol":"http_connect","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":102000000,"source_bytes":67,"dest_bytes":14,"network_bytes":81,"event_summary":"CONNECT api64.ipify.org:443 HTTP/1.1\r\nHost: api64.ipify.org:443\r\n\r\n"} +{"timestamp":"2026-09-06T23:57:28","event_id":"205db62f-b023-432e-9cc5-1e6ec3914b36","source_ip":"204.76.203.221","source_port":50488,"source_domain":"204.76.203.221.ptr.pfcloud.network","country_code":"NL","country_name":"The Netherlands","city_name":"Eygelshoven","asn_number":51396,"asn_org":"Pfcloud UG (haftungsbeschrankt)","dest_port":5107,"network_protocol":"","application_protocol":"http_connect","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":63,"dest_bytes":14,"network_bytes":77,"event_summary":"CONNECT icanhazip.com:443 HTTP/1.1\r\nHost: icanhazip.com:443\r\n\r\n"} +{"timestamp":"2026-09-06T23:57:28","event_id":"0f2d761c-ab56-4191-b040-edcb9631793e","source_ip":"204.76.203.214","source_port":24452,"source_domain":"204.76.203.214.ptr.pfcloud.network","country_code":"NL","country_name":"The Netherlands","city_name":"Eygelshoven","asn_number":51396,"asn_org":"Pfcloud UG (haftungsbeschrankt)","dest_port":5107,"network_protocol":"","application_protocol":"socks5","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":103000000,"source_bytes":3,"dest_bytes":14,"network_bytes":17,"event_summary":"\u0005\u0001\u0000"} +{"timestamp":"2026-09-06T23:53:14","event_id":"4527e689-d194-44af-828b-83a0f837f227","source_ip":"176.65.148.243","source_port":59898,"source_domain":"176.65.148.243.ptr.pfcloud.network","country_code":"NL","country_name":"The Netherlands","city_name":"Eygelshoven","asn_number":51396,"asn_org":"Pfcloud UG (haftungsbeschrankt)","dest_port":25565,"network_protocol":"","application_protocol":"","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":21,"dest_bytes":14,"network_bytes":35,"event_summary":"\u0012\u0000\u0000\fc�\u0001\u0001\u0000"} +{"timestamp":"2026-09-06T23:51:54","event_id":"72d1c4f7-c654-4e1e-a2a8-17bf725275c6","source_ip":"204.76.203.221","source_port":49850,"source_domain":"204.76.203.221.ptr.pfcloud.network","country_code":"NL","country_name":"The Netherlands","city_name":"Eygelshoven","asn_number":51396,"asn_org":"Pfcloud UG (haftungsbeschrankt)","dest_port":11811,"network_protocol":"","application_protocol":"http_connect","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":102000000,"source_bytes":67,"dest_bytes":14,"network_bytes":81,"event_summary":"CONNECT api64.ipify.org:443 HTTP/1.1\r\nHost: api64.ipify.org:443\r\n\r\n"} +{"timestamp":"2026-09-06T23:51:54","event_id":"217f2a3b-ea33-4c03-b8b2-4044a71f6ffa","source_ip":"204.76.203.214","source_port":37484,"source_domain":"204.76.203.214.ptr.pfcloud.network","country_code":"NL","country_name":"The Netherlands","city_name":"Eygelshoven","asn_number":51396,"asn_org":"Pfcloud UG (haftungsbeschrankt)","dest_port":11811,"network_protocol":"","application_protocol":"socks5","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":3,"dest_bytes":14,"network_bytes":17,"event_summary":"\u0005\u0001\u0000"} +{"timestamp":"2026-09-06T23:49:00","event_id":"218f030a-50a8-49b0-9168-39a4fbe38a59","source_ip":"204.76.203.221","source_port":27860,"source_domain":"204.76.203.221.ptr.pfcloud.network","country_code":"NL","country_name":"The Netherlands","city_name":"Eygelshoven","asn_number":51396,"asn_org":"Pfcloud UG (haftungsbeschrankt)","dest_port":1212,"network_protocol":"","application_protocol":"socks5","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":101000000,"source_bytes":3,"dest_bytes":14,"network_bytes":17,"event_summary":"\u0005\u0001\u0000"} +{"timestamp":"2026-09-06T23:49:00","event_id":"3ca84960-e4cd-48d8-9788-dea907880a9c","source_ip":"204.76.203.214","source_port":35548,"source_domain":"204.76.203.214.ptr.pfcloud.network","country_code":"NL","country_name":"The Netherlands","city_name":"Eygelshoven","asn_number":51396,"asn_org":"Pfcloud UG (haftungsbeschrankt)","dest_port":1212,"network_protocol":"","application_protocol":"amazonaws","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":102000000,"source_bytes":79,"dest_bytes":14,"network_bytes":93,"event_summary":"CONNECT checkip.amazonaws.com:443 HTTP/1.1\r\nHost: checkip.amazonaws.com:443\r\n\r\n"} +{"timestamp":"2026-09-06T23:47:43","event_id":"e7f3ce17-42f9-4667-93d7-2893171dca8e","source_ip":"176.65.134.48","source_port":37316,"source_domain":"176.65.134.48.ptr.pfcloud.network","country_code":"DE","country_name":"Germany","city_name":"","asn_number":51396,"asn_org":"Pfcloud UG (haftungsbeschrankt)","dest_port":4550,"network_protocol":"","application_protocol":"http_proxy","http_method":"GET","user_agent":"Go-http-client/1.1","url_path":"http://proxy.flarevpn.digital:8080/judge","url_domain":"proxy.flarevpn.digital","http_request_headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"proxy.flarevpn.digital:8080\",\"user-agent\":\"Go-http-client/1.1\"}","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"ge11nn0400_9c3956fad5da","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":166,"dest_bytes":78,"network_bytes":244,"event_summary":""} +{"timestamp":"2026-09-06T23:47:43","event_id":"9905e2f9-7562-4d9e-befc-2a441fb2f8ef","source_ip":"176.65.134.48","source_port":37308,"source_domain":"176.65.134.48.ptr.pfcloud.network","country_code":"DE","country_name":"Germany","city_name":"","asn_number":51396,"asn_org":"Pfcloud UG (haftungsbeschrankt)","dest_port":4550,"network_protocol":"","application_protocol":"socks5","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":3,"dest_bytes":13,"network_bytes":16,"event_summary":"\u0005\u0001\u0000"} +{"timestamp":"2026-09-06T23:47:43","event_id":"604da2ee-f1e1-4b4a-a56c-4d60b9e07ca9","source_ip":"176.65.134.48","source_port":37296,"source_domain":"176.65.134.48.ptr.pfcloud.network","country_code":"DE","country_name":"Germany","city_name":"","asn_number":51396,"asn_org":"Pfcloud UG (haftungsbeschrankt)","dest_port":4550,"network_protocol":"","application_protocol":"http_proxy","http_method":"GET","user_agent":"Go-http-client/1.1","url_path":"http://proxy.flarevpn.digital:8080/judge","url_domain":"proxy.flarevpn.digital","http_request_headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"proxy.flarevpn.digital:8080\",\"user-agent\":\"Go-http-client/1.1\"}","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"ge11nn0400_9c3956fad5da","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":166,"dest_bytes":78,"network_bytes":244,"event_summary":""} +{"timestamp":"2026-09-06T23:47:43","event_id":"15379a01-b026-497d-ad3a-2f3244680849","source_ip":"176.65.134.48","source_port":37286,"source_domain":"176.65.134.48.ptr.pfcloud.network","country_code":"DE","country_name":"Germany","city_name":"","asn_number":51396,"asn_org":"Pfcloud UG (haftungsbeschrankt)","dest_port":4550,"network_protocol":"","application_protocol":"socks5","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":3,"dest_bytes":13,"network_bytes":16,"event_summary":"\u0005\u0001\u0000"} +{"timestamp":"2026-09-06T23:43:17","event_id":"18000d02-5dbe-476c-a071-051752e09a94","source_ip":"204.76.203.222","source_port":14346,"source_domain":"204.76.203.222.ptr.pfcloud.network","country_code":"NL","country_name":"The Netherlands","city_name":"Eygelshoven","asn_number":51396,"asn_org":"Pfcloud UG (haftungsbeschrankt)","dest_port":10258,"network_protocol":"","application_protocol":"http_connect","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":67,"dest_bytes":14,"network_bytes":81,"event_summary":"CONNECT api64.ipify.org:443 HTTP/1.1\r\nHost: api64.ipify.org:443\r\n\r\n"} +{"timestamp":"2026-09-06T23:43:17","event_id":"64f35fca-f37c-4070-8fb8-eda9c11d8e65","source_ip":"204.76.203.214","source_port":58782,"source_domain":"204.76.203.214.ptr.pfcloud.network","country_code":"NL","country_name":"The Netherlands","city_name":"Eygelshoven","asn_number":51396,"asn_org":"Pfcloud UG (haftungsbeschrankt)","dest_port":10258,"network_protocol":"","application_protocol":"socks5","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":101000000,"source_bytes":3,"dest_bytes":14,"network_bytes":17,"event_summary":"\u0005\u0001\u0000"} +{"timestamp":"2026-09-06T23:41:28","event_id":"bb44f793-d611-42c0-82c8-51614e7a5c4b","source_ip":"204.76.203.222","source_port":38114,"source_domain":"204.76.203.222.ptr.pfcloud.network","country_code":"NL","country_name":"The Netherlands","city_name":"Eygelshoven","asn_number":51396,"asn_org":"Pfcloud UG (haftungsbeschrankt)","dest_port":44500,"network_protocol":"","application_protocol":"amazonaws","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":101000000,"source_bytes":79,"dest_bytes":14,"network_bytes":93,"event_summary":"CONNECT checkip.amazonaws.com:443 HTTP/1.1\r\nHost: checkip.amazonaws.com:443\r\n\r\n"} +{"timestamp":"2026-09-06T23:41:28","event_id":"6b1bbfe8-55a7-4d8f-a43a-61898ad73112","source_ip":"204.76.203.221","source_port":58238,"source_domain":"204.76.203.221.ptr.pfcloud.network","country_code":"NL","country_name":"The Netherlands","city_name":"Eygelshoven","asn_number":51396,"asn_org":"Pfcloud UG (haftungsbeschrankt)","dest_port":44500,"network_protocol":"","application_protocol":"socks5","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":3,"dest_bytes":14,"network_bytes":17,"event_summary":"\u0005\u0001\u0000"} +{"timestamp":"2026-09-06T23:40:09","event_id":"97e5d5c3-f6f0-42f7-a285-ea48787f609b","source_ip":"204.76.203.214","source_port":37988,"source_domain":"204.76.203.214.ptr.pfcloud.network","country_code":"NL","country_name":"The Netherlands","city_name":"Eygelshoven","asn_number":51396,"asn_org":"Pfcloud UG (haftungsbeschrankt)","dest_port":20131,"network_protocol":"","application_protocol":"socks5","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":3,"dest_bytes":14,"network_bytes":17,"event_summary":"\u0005\u0001\u0000"} +{"timestamp":"2026-09-06T23:40:09","event_id":"7cd11877-e5f8-4e3f-a5d9-e3acb6129cf2","source_ip":"204.76.203.213","source_port":22094,"source_domain":"204.76.203.213.ptr.pfcloud.network","country_code":"NL","country_name":"The Netherlands","city_name":"Eygelshoven","asn_number":51396,"asn_org":"Pfcloud UG (haftungsbeschrankt)","dest_port":20131,"network_protocol":"","application_protocol":"http_connect","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":101000000,"source_bytes":67,"dest_bytes":14,"network_bytes":81,"event_summary":"CONNECT api64.ipify.org:443 HTTP/1.1\r\nHost: api64.ipify.org:443\r\n\r\n"} +{"timestamp":"2026-09-06T23:39:23","event_id":"6f101876-11db-405a-939f-14e388fe4bfe","source_ip":"204.76.203.214","source_port":1750,"source_domain":"204.76.203.214.ptr.pfcloud.network","country_code":"NL","country_name":"The Netherlands","city_name":"Eygelshoven","asn_number":51396,"asn_org":"Pfcloud UG (haftungsbeschrankt)","dest_port":10474,"network_protocol":"","application_protocol":"http_connect","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":102000000,"source_bytes":63,"dest_bytes":14,"network_bytes":77,"event_summary":"CONNECT icanhazip.com:443 HTTP/1.1\r\nHost: icanhazip.com:443\r\n\r\n"} +{"timestamp":"2026-09-06T23:39:23","event_id":"d36497d7-0619-4fe0-958a-cda1d5519ea2","source_ip":"204.76.203.213","source_port":37420,"source_domain":"204.76.203.213.ptr.pfcloud.network","country_code":"NL","country_name":"The Netherlands","city_name":"Eygelshoven","asn_number":51396,"asn_org":"Pfcloud UG (haftungsbeschrankt)","dest_port":10474,"network_protocol":"","application_protocol":"socks5","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":3,"dest_bytes":14,"network_bytes":17,"event_summary":"\u0005\u0001\u0000"} +{"timestamp":"2026-09-06T23:39:02","event_id":"0047ec2b-6af1-4f8b-a719-961e60691f98","source_ip":"204.76.203.214","source_port":33066,"source_domain":"204.76.203.214.ptr.pfcloud.network","country_code":"NL","country_name":"The Netherlands","city_name":"Eygelshoven","asn_number":51396,"asn_org":"Pfcloud UG (haftungsbeschrankt)","dest_port":55555,"network_protocol":"","application_protocol":"socks5","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":3,"dest_bytes":14,"network_bytes":17,"event_summary":"\u0005\u0001\u0000"} +{"timestamp":"2026-09-06T23:39:02","event_id":"4fda5b0b-9534-4559-bf7d-2356b3335f44","source_ip":"204.76.203.213","source_port":47900,"source_domain":"204.76.203.213.ptr.pfcloud.network","country_code":"NL","country_name":"The Netherlands","city_name":"Eygelshoven","asn_number":51396,"asn_org":"Pfcloud UG (haftungsbeschrankt)","dest_port":55555,"network_protocol":"","application_protocol":"http_connect","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":102000000,"source_bytes":67,"dest_bytes":14,"network_bytes":81,"event_summary":"CONNECT api64.ipify.org:443 HTTP/1.1\r\nHost: api64.ipify.org:443\r\n\r\n"} +{"timestamp":"2026-09-06T23:36:24","event_id":"3c0e13bf-7cc4-4c21-9486-7f473836ae9e","source_ip":"204.76.203.221","source_port":60178,"source_domain":"204.76.203.221.ptr.pfcloud.network","country_code":"NL","country_name":"The Netherlands","city_name":"Eygelshoven","asn_number":51396,"asn_org":"Pfcloud UG (haftungsbeschrankt)","dest_port":19318,"network_protocol":"","application_protocol":"socks5","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":102000000,"source_bytes":3,"dest_bytes":14,"network_bytes":17,"event_summary":"\u0005\u0001\u0000"} +{"timestamp":"2026-09-06T23:36:24","event_id":"0c2dcaaf-c74f-45c2-b025-501860d9eca3","source_ip":"204.76.203.214","source_port":31800,"source_domain":"204.76.203.214.ptr.pfcloud.network","country_code":"NL","country_name":"The Netherlands","city_name":"Eygelshoven","asn_number":51396,"asn_org":"Pfcloud UG (haftungsbeschrankt)","dest_port":19318,"network_protocol":"","application_protocol":"amazonaws","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":79,"dest_bytes":14,"network_bytes":93,"event_summary":"CONNECT checkip.amazonaws.com:443 HTTP/1.1\r\nHost: checkip.amazonaws.com:443\r\n\r\n"} +{"timestamp":"2026-09-06T23:35:48","event_id":"e901d83d-d89f-47cf-979a-39d945010a8e","source_ip":"204.76.203.222","source_port":30420,"source_domain":"204.76.203.222.ptr.pfcloud.network","country_code":"NL","country_name":"The Netherlands","city_name":"Eygelshoven","asn_number":51396,"asn_org":"Pfcloud UG (haftungsbeschrankt)","dest_port":12019,"network_protocol":"","application_protocol":"socks5","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":101000000,"source_bytes":3,"dest_bytes":14,"network_bytes":17,"event_summary":"\u0005\u0001\u0000"} +{"timestamp":"2026-09-06T23:35:48","event_id":"af303d5f-8879-4b8b-9dcf-1bfd2e7a5be8","source_ip":"204.76.203.221","source_port":37830,"source_domain":"204.76.203.221.ptr.pfcloud.network","country_code":"NL","country_name":"The Netherlands","city_name":"Eygelshoven","asn_number":51396,"asn_org":"Pfcloud UG (haftungsbeschrankt)","dest_port":12019,"network_protocol":"","application_protocol":"amazonaws","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":101000000,"source_bytes":79,"dest_bytes":14,"network_bytes":93,"event_summary":"CONNECT checkip.amazonaws.com:443 HTTP/1.1\r\nHost: checkip.amazonaws.com:443\r\n\r\n"} +{"timestamp":"2026-09-06T23:35:19","event_id":"08a98e53-b934-4fec-8ee7-8134e571be5a","source_ip":"204.76.203.221","source_port":33132,"source_domain":"204.76.203.221.ptr.pfcloud.network","country_code":"NL","country_name":"The Netherlands","city_name":"Eygelshoven","asn_number":51396,"asn_org":"Pfcloud UG (haftungsbeschrankt)","dest_port":20006,"network_protocol":"","application_protocol":"socks5","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":3,"dest_bytes":14,"network_bytes":17,"event_summary":"\u0005\u0001\u0000"} +{"timestamp":"2026-09-06T23:35:19","event_id":"8e255033-15da-4111-8da4-0221e9676c0a","source_ip":"204.76.203.214","source_port":41396,"source_domain":"204.76.203.214.ptr.pfcloud.network","country_code":"NL","country_name":"The Netherlands","city_name":"Eygelshoven","asn_number":51396,"asn_org":"Pfcloud UG (haftungsbeschrankt)","dest_port":20006,"network_protocol":"","application_protocol":"amazonaws","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":103000000,"source_bytes":79,"dest_bytes":14,"network_bytes":93,"event_summary":"CONNECT checkip.amazonaws.com:443 HTTP/1.1\r\nHost: checkip.amazonaws.com:443\r\n\r\n"} +{"timestamp":"2026-09-06T23:34:01","event_id":"488c7aff-2f57-4e58-992b-fe2144e1ec99","source_ip":"204.76.203.221","source_port":34682,"source_domain":"204.76.203.221.ptr.pfcloud.network","country_code":"NL","country_name":"The Netherlands","city_name":"Eygelshoven","asn_number":51396,"asn_org":"Pfcloud UG (haftungsbeschrankt)","dest_port":11439,"network_protocol":"","application_protocol":"socks5","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":101000000,"source_bytes":3,"dest_bytes":14,"network_bytes":17,"event_summary":"\u0005\u0001\u0000"} +{"timestamp":"2026-09-06T23:34:01","event_id":"8ef19b16-3b04-481c-ae8a-9c2e2d850236","source_ip":"204.76.203.214","source_port":40406,"source_domain":"204.76.203.214.ptr.pfcloud.network","country_code":"NL","country_name":"The Netherlands","city_name":"Eygelshoven","asn_number":51396,"asn_org":"Pfcloud UG (haftungsbeschrankt)","dest_port":11439,"network_protocol":"","application_protocol":"http_connect","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":67,"dest_bytes":14,"network_bytes":81,"event_summary":"CONNECT api64.ipify.org:443 HTTP/1.1\r\nHost: api64.ipify.org:443\r\n\r\n"} +{"timestamp":"2026-09-06T23:33:03","event_id":"7c797a9a-c72b-4bee-9471-889ba8fc1922","source_ip":"204.76.203.221","source_port":5626,"source_domain":"204.76.203.221.ptr.pfcloud.network","country_code":"NL","country_name":"The Netherlands","city_name":"Eygelshoven","asn_number":51396,"asn_org":"Pfcloud UG (haftungsbeschrankt)","dest_port":42500,"network_protocol":"","application_protocol":"socks5","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":101000000,"source_bytes":3,"dest_bytes":14,"network_bytes":17,"event_summary":"\u0005\u0001\u0000"} +{"timestamp":"2026-09-06T23:33:03","event_id":"1022bae0-2575-445c-bf42-f49f6c3b18a1","source_ip":"204.76.203.213","source_port":15612,"source_domain":"204.76.203.213.ptr.pfcloud.network","country_code":"NL","country_name":"The Netherlands","city_name":"Eygelshoven","asn_number":51396,"asn_org":"Pfcloud UG (haftungsbeschrankt)","dest_port":42500,"network_protocol":"","application_protocol":"http_connect","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":67,"dest_bytes":14,"network_bytes":81,"event_summary":"CONNECT api64.ipify.org:443 HTTP/1.1\r\nHost: api64.ipify.org:443\r\n\r\n"} +{"timestamp":"2026-09-06T23:32:25","event_id":"8bca9a6d-3667-474d-8e5c-f12324406147","source_ip":"176.65.149.31","source_port":51680,"source_domain":"176.65.149.31.ptr.pfcloud.network","country_code":"NL","country_name":"The Netherlands","city_name":"Eygelshoven","asn_number":51396,"asn_org":"Pfcloud UG (haftungsbeschrankt)","dest_port":1930,"network_protocol":"","application_protocol":"ssh","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":117000000,"source_bytes":17,"dest_bytes":13,"network_bytes":30,"event_summary":"SSH-2.0-OpenSSH\r\n"} +{"timestamp":"2026-09-06T23:32:22","event_id":"3a640124-0a29-4d79-8f26-4fb17f8c6ace","source_ip":"204.76.203.214","source_port":59178,"source_domain":"204.76.203.214.ptr.pfcloud.network","country_code":"NL","country_name":"The Netherlands","city_name":"Eygelshoven","asn_number":51396,"asn_org":"Pfcloud UG (haftungsbeschrankt)","dest_port":5858,"network_protocol":"","application_protocol":"amazonaws","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":101000000,"source_bytes":79,"dest_bytes":14,"network_bytes":93,"event_summary":"CONNECT checkip.amazonaws.com:443 HTTP/1.1\r\nHost: checkip.amazonaws.com:443\r\n\r\n"} +{"timestamp":"2026-09-06T23:32:22","event_id":"823db01c-7e29-4e1e-9684-95a76e31caf2","source_ip":"204.76.203.213","source_port":63460,"source_domain":"204.76.203.213.ptr.pfcloud.network","country_code":"NL","country_name":"The Netherlands","city_name":"Eygelshoven","asn_number":51396,"asn_org":"Pfcloud UG (haftungsbeschrankt)","dest_port":5858,"network_protocol":"","application_protocol":"socks5","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":3,"dest_bytes":14,"network_bytes":17,"event_summary":"\u0005\u0001\u0000"} +{"timestamp":"2026-09-06T23:31:42","event_id":"ac30ae6d-eb4f-4aa4-9fd5-cec8f9cbe181","source_ip":"176.65.148.243","source_port":53822,"source_domain":"176.65.148.243.ptr.pfcloud.network","country_code":"NL","country_name":"The Netherlands","city_name":"Eygelshoven","asn_number":51396,"asn_org":"Pfcloud UG (haftungsbeschrankt)","dest_port":25565,"network_protocol":"","application_protocol":"","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":22,"dest_bytes":14,"network_bytes":36,"event_summary":"\u0013\u0000\u0000\rc�\u0001\u0001\u0000"} +{"timestamp":"2026-09-06T23:31:04","event_id":"edb8b213-e42f-4e2d-82e3-6e72ea7349b4","source_ip":"204.76.203.214","source_port":3906,"source_domain":"204.76.203.214.ptr.pfcloud.network","country_code":"NL","country_name":"The Netherlands","city_name":"Eygelshoven","asn_number":51396,"asn_org":"Pfcloud UG (haftungsbeschrankt)","dest_port":10100,"network_protocol":"","application_protocol":"http_connect","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":63,"dest_bytes":14,"network_bytes":77,"event_summary":"CONNECT icanhazip.com:443 HTTP/1.1\r\nHost: icanhazip.com:443\r\n\r\n"} +{"timestamp":"2026-09-06T23:31:04","event_id":"7f03168f-f031-48ab-8c12-4fa14cee113c","source_ip":"204.76.203.213","source_port":20244,"source_domain":"204.76.203.213.ptr.pfcloud.network","country_code":"NL","country_name":"The Netherlands","city_name":"Eygelshoven","asn_number":51396,"asn_org":"Pfcloud UG (haftungsbeschrankt)","dest_port":10100,"network_protocol":"","application_protocol":"socks5","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":103000000,"source_bytes":3,"dest_bytes":14,"network_bytes":17,"event_summary":"\u0005\u0001\u0000"} +{"timestamp":"2026-09-06T23:31:03","event_id":"faef2b41-58c2-4497-865d-e19608fca789","source_ip":"204.76.203.214","source_port":13278,"source_domain":"204.76.203.214.ptr.pfcloud.network","country_code":"NL","country_name":"The Netherlands","city_name":"Eygelshoven","asn_number":51396,"asn_org":"Pfcloud UG (haftungsbeschrankt)","dest_port":22222,"network_protocol":"","application_protocol":"socks5","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":3,"dest_bytes":14,"network_bytes":17,"event_summary":"\u0005\u0001\u0000"} +{"timestamp":"2026-09-06T23:31:03","event_id":"94752b88-0c45-4582-9adf-18ce3f78ddc0","source_ip":"204.76.203.213","source_port":8628,"source_domain":"204.76.203.213.ptr.pfcloud.network","country_code":"NL","country_name":"The Netherlands","city_name":"Eygelshoven","asn_number":51396,"asn_org":"Pfcloud UG (haftungsbeschrankt)","dest_port":22222,"network_protocol":"","application_protocol":"amazonaws","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":101000000,"source_bytes":79,"dest_bytes":14,"network_bytes":93,"event_summary":"CONNECT checkip.amazonaws.com:443 HTTP/1.1\r\nHost: checkip.amazonaws.com:443\r\n\r\n"} +{"timestamp":"2026-09-06T23:30:10","event_id":"a1a44699-0875-4220-b802-3006bc591749","source_ip":"204.76.203.222","source_port":41688,"source_domain":"204.76.203.222.ptr.pfcloud.network","country_code":"NL","country_name":"The Netherlands","city_name":"Eygelshoven","asn_number":51396,"asn_org":"Pfcloud UG (haftungsbeschrankt)","dest_port":11180,"network_protocol":"","application_protocol":"socks5","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":102000000,"source_bytes":3,"dest_bytes":14,"network_bytes":17,"event_summary":"\u0005\u0001\u0000"} +{"timestamp":"2026-09-06T23:30:10","event_id":"8f30868a-a636-467f-8d24-d01e1e32c0b0","source_ip":"204.76.203.213","source_port":39730,"source_domain":"204.76.203.213.ptr.pfcloud.network","country_code":"NL","country_name":"The Netherlands","city_name":"Eygelshoven","asn_number":51396,"asn_org":"Pfcloud UG (haftungsbeschrankt)","dest_port":11180,"network_protocol":"","application_protocol":"http_connect","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":67,"dest_bytes":14,"network_bytes":81,"event_summary":"CONNECT api64.ipify.org:443 HTTP/1.1\r\nHost: api64.ipify.org:443\r\n\r\n"} +{"timestamp":"2026-09-06T23:29:08","event_id":"731917cb-fd22-46e4-a6e9-3e5a7d28b3d5","source_ip":"204.76.203.222","source_port":24984,"source_domain":"204.76.203.222.ptr.pfcloud.network","country_code":"NL","country_name":"The Netherlands","city_name":"Eygelshoven","asn_number":51396,"asn_org":"Pfcloud UG (haftungsbeschrankt)","dest_port":4121,"network_protocol":"","application_protocol":"socks5","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":101000000,"source_bytes":3,"dest_bytes":14,"network_bytes":17,"event_summary":"\u0005\u0001\u0000"} +{"timestamp":"2026-09-06T23:29:08","event_id":"58a05c2f-d54a-40a5-8019-2f6a0018a169","source_ip":"204.76.203.214","source_port":56908,"source_domain":"204.76.203.214.ptr.pfcloud.network","country_code":"NL","country_name":"The Netherlands","city_name":"Eygelshoven","asn_number":51396,"asn_org":"Pfcloud UG (haftungsbeschrankt)","dest_port":4121,"network_protocol":"","application_protocol":"http_connect","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":104000000,"source_bytes":67,"dest_bytes":14,"network_bytes":81,"event_summary":"CONNECT api64.ipify.org:443 HTTP/1.1\r\nHost: api64.ipify.org:443\r\n\r\n"} +{"timestamp":"2026-09-06T23:27:42","event_id":"790d5622-9ecd-44e4-b310-e3a93925e9e8","source_ip":"204.76.203.222","source_port":12138,"source_domain":"204.76.203.222.ptr.pfcloud.network","country_code":"NL","country_name":"The Netherlands","city_name":"Eygelshoven","asn_number":51396,"asn_org":"Pfcloud UG (haftungsbeschrankt)","dest_port":10001,"network_protocol":"","application_protocol":"socks5","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":101000000,"source_bytes":3,"dest_bytes":14,"network_bytes":17,"event_summary":"\u0005\u0001\u0000"} +{"timestamp":"2026-09-06T23:27:42","event_id":"10a0ff21-547f-4263-9397-3376a3626d31","source_ip":"204.76.203.214","source_port":62632,"source_domain":"204.76.203.214.ptr.pfcloud.network","country_code":"NL","country_name":"The Netherlands","city_name":"Eygelshoven","asn_number":51396,"asn_org":"Pfcloud UG (haftungsbeschrankt)","dest_port":10001,"network_protocol":"","application_protocol":"http_connect","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":63,"dest_bytes":14,"network_bytes":77,"event_summary":"CONNECT icanhazip.com:443 HTTP/1.1\r\nHost: icanhazip.com:443\r\n\r\n"} +{"timestamp":"2026-09-06T23:26:59","event_id":"f9096b36-10cc-4dc4-b843-1f9bc3349942","source_ip":"204.76.203.222","source_port":55442,"source_domain":"204.76.203.222.ptr.pfcloud.network","country_code":"NL","country_name":"The Netherlands","city_name":"Eygelshoven","asn_number":51396,"asn_org":"Pfcloud UG (haftungsbeschrankt)","dest_port":10213,"network_protocol":"","application_protocol":"amazonaws","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":101000000,"source_bytes":79,"dest_bytes":14,"network_bytes":93,"event_summary":"CONNECT checkip.amazonaws.com:443 HTTP/1.1\r\nHost: checkip.amazonaws.com:443\r\n\r\n"} +{"timestamp":"2026-09-06T23:26:59","event_id":"9d0e9897-ed84-47b4-9bfe-d5cc81c8c4e5","source_ip":"204.76.203.214","source_port":7378,"source_domain":"204.76.203.214.ptr.pfcloud.network","country_code":"NL","country_name":"The Netherlands","city_name":"Eygelshoven","asn_number":51396,"asn_org":"Pfcloud UG (haftungsbeschrankt)","dest_port":10213,"network_protocol":"","application_protocol":"socks5","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":3,"dest_bytes":14,"network_bytes":17,"event_summary":"\u0005\u0001\u0000"} +{"timestamp":"2026-09-06T23:26:34","event_id":"aa824cf5-10cd-4f2c-b230-48750680d534","source_ip":"45.135.193.193","source_port":48036,"source_domain":"45.135.193.193.ptr.pfcloud.network","country_code":"DE","country_name":"Germany","city_name":"Langen","asn_number":51396,"asn_org":"Pfcloud UG (haftungsbeschrankt)","dest_port":8888,"network_protocol":"","application_protocol":"http_connect","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":104000000,"source_bytes":89,"dest_bytes":14,"network_bytes":103,"event_summary":"CONNECT httpbin.org:443 HTTP/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive\r\n\r\n"} +{"timestamp":"2026-09-06T23:26:34","event_id":"42eea07e-191f-4a34-ad3e-034c5561d821","source_ip":"45.135.193.193","source_port":57294,"source_domain":"45.135.193.193.ptr.pfcloud.network","country_code":"DE","country_name":"Germany","city_name":"Langen","asn_number":51396,"asn_org":"Pfcloud UG (haftungsbeschrankt)","dest_port":8080,"network_protocol":"","application_protocol":"http_connect","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":104000000,"source_bytes":89,"dest_bytes":14,"network_bytes":103,"event_summary":"CONNECT httpbin.org:443 HTTP/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive\r\n\r\n"} +{"timestamp":"2026-09-06T23:26:34","event_id":"101a15e7-7537-4ccf-9e89-155b2eb36f88","source_ip":"45.135.193.193","source_port":56894,"source_domain":"45.135.193.193.ptr.pfcloud.network","country_code":"DE","country_name":"Germany","city_name":"Langen","asn_number":51396,"asn_org":"Pfcloud UG (haftungsbeschrankt)","dest_port":8000,"network_protocol":"","application_protocol":"http_connect","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":104000000,"source_bytes":89,"dest_bytes":14,"network_bytes":103,"event_summary":"CONNECT httpbin.org:443 HTTP/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive\r\n\r\n"} +{"timestamp":"2026-09-06T23:26:34","event_id":"155eb390-e6c4-416a-8551-943ac169d831","source_ip":"45.135.193.193","source_port":60222,"source_domain":"45.135.193.193.ptr.pfcloud.network","country_code":"DE","country_name":"Germany","city_name":"Langen","asn_number":51396,"asn_org":"Pfcloud UG (haftungsbeschrankt)","dest_port":81,"network_protocol":"","application_protocol":"http_connect","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":103000000,"source_bytes":89,"dest_bytes":14,"network_bytes":103,"event_summary":"CONNECT httpbin.org:443 HTTP/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive\r\n\r\n"} +{"timestamp":"2026-09-06T23:26:34","event_id":"d618e9a6-aac3-4e81-86e9-cff955bba00c","source_ip":"45.135.193.193","source_port":57318,"source_domain":"45.135.193.193.ptr.pfcloud.network","country_code":"DE","country_name":"Germany","city_name":"Langen","asn_number":51396,"asn_org":"Pfcloud UG (haftungsbeschrankt)","dest_port":3128,"network_protocol":"","application_protocol":"http_connect","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":103000000,"source_bytes":89,"dest_bytes":14,"network_bytes":103,"event_summary":"CONNECT httpbin.org:443 HTTP/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive\r\n\r\n"} +{"timestamp":"2026-09-06T23:26:34","event_id":"9938cf7e-96b3-4f52-953c-d944dc12c0db","source_ip":"45.135.193.193","source_port":37508,"source_domain":"45.135.193.193.ptr.pfcloud.network","country_code":"DE","country_name":"Germany","city_name":"Langen","asn_number":51396,"asn_org":"Pfcloud UG (haftungsbeschrankt)","dest_port":443,"network_protocol":"","application_protocol":"http_connect","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":103000000,"source_bytes":89,"dest_bytes":14,"network_bytes":103,"event_summary":"CONNECT httpbin.org:443 HTTP/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive\r\n\r\n"} +{"timestamp":"2026-09-06T23:26:34","event_id":"ade85edd-a2b1-458d-a88a-687b982b973e","source_ip":"45.135.193.193","source_port":40094,"source_domain":"45.135.193.193.ptr.pfcloud.network","country_code":"DE","country_name":"Germany","city_name":"Langen","asn_number":51396,"asn_org":"Pfcloud UG (haftungsbeschrankt)","dest_port":8081,"network_protocol":"","application_protocol":"http_connect","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":102000000,"source_bytes":89,"dest_bytes":14,"network_bytes":103,"event_summary":"CONNECT httpbin.org:443 HTTP/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive\r\n\r\n"} +{"timestamp":"2026-09-06T23:26:34","event_id":"f854a4f6-5600-4d68-a5c5-9d6edcc1f6fb","source_ip":"45.135.193.193","source_port":54976,"source_domain":"45.135.193.193.ptr.pfcloud.network","country_code":"DE","country_name":"Germany","city_name":"Langen","asn_number":51396,"asn_org":"Pfcloud UG (haftungsbeschrankt)","dest_port":80,"network_protocol":"","application_protocol":"http_connect","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":89,"dest_bytes":14,"network_bytes":103,"event_summary":"CONNECT httpbin.org:443 HTTP/1.1\r\nHost: httpbin.org:443\r\nProxy-Connection: keep-alive\r\n\r\n"} +{"timestamp":"2026-09-06T23:26:25","event_id":"39657d23-0685-4945-b1d5-f11f366d5783","source_ip":"204.76.203.214","source_port":38228,"source_domain":"204.76.203.214.ptr.pfcloud.network","country_code":"NL","country_name":"The Netherlands","city_name":"Eygelshoven","asn_number":51396,"asn_org":"Pfcloud UG (haftungsbeschrankt)","dest_port":11537,"network_protocol":"","application_protocol":"http_connect","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":102000000,"source_bytes":67,"dest_bytes":14,"network_bytes":81,"event_summary":"CONNECT api64.ipify.org:443 HTTP/1.1\r\nHost: api64.ipify.org:443\r\n\r\n"} +{"timestamp":"2026-09-06T23:26:25","event_id":"fde82192-e3c8-4ebf-b18b-65135dbbca4a","source_ip":"204.76.203.213","source_port":24398,"source_domain":"204.76.203.213.ptr.pfcloud.network","country_code":"NL","country_name":"The Netherlands","city_name":"Eygelshoven","asn_number":51396,"asn_org":"Pfcloud UG (haftungsbeschrankt)","dest_port":11537,"network_protocol":"","application_protocol":"socks5","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":101000000,"source_bytes":3,"dest_bytes":14,"network_bytes":17,"event_summary":"\u0005\u0001\u0000"} +{"timestamp":"2026-09-06T23:24:55","event_id":"b940ab1b-acba-45c5-9bfd-53c2f523f9d3","source_ip":"204.76.203.214","source_port":44240,"source_domain":"204.76.203.214.ptr.pfcloud.network","country_code":"NL","country_name":"The Netherlands","city_name":"Eygelshoven","asn_number":51396,"asn_org":"Pfcloud UG (haftungsbeschrankt)","dest_port":11508,"network_protocol":"","application_protocol":"socks5","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":103000000,"source_bytes":3,"dest_bytes":14,"network_bytes":17,"event_summary":"\u0005\u0001\u0000"} +{"timestamp":"2026-09-06T23:24:55","event_id":"e63a0f68-7a71-47b7-a484-9f82ecc9ee29","source_ip":"204.76.203.213","source_port":19378,"source_domain":"204.76.203.213.ptr.pfcloud.network","country_code":"NL","country_name":"The Netherlands","city_name":"Eygelshoven","asn_number":51396,"asn_org":"Pfcloud UG (haftungsbeschrankt)","dest_port":11508,"network_protocol":"","application_protocol":"http_connect","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":101000000,"source_bytes":63,"dest_bytes":14,"network_bytes":77,"event_summary":"CONNECT icanhazip.com:443 HTTP/1.1\r\nHost: icanhazip.com:443\r\n\r\n"} +{"timestamp":"2026-09-06T23:23:20","event_id":"a3b83c22-0dd2-4f33-848b-2e79dd6e6d6a","source_ip":"204.76.203.222","source_port":35542,"source_domain":"204.76.203.222.ptr.pfcloud.network","country_code":"NL","country_name":"The Netherlands","city_name":"Eygelshoven","asn_number":51396,"asn_org":"Pfcloud UG (haftungsbeschrankt)","dest_port":12328,"network_protocol":"","application_protocol":"amazonaws","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":79,"dest_bytes":14,"network_bytes":93,"event_summary":"CONNECT checkip.amazonaws.com:443 HTTP/1.1\r\nHost: checkip.amazonaws.com:443\r\n\r\n"} +{"timestamp":"2026-09-06T23:23:20","event_id":"26c27852-e08a-47b6-9a7b-7807be021df0","source_ip":"204.76.203.221","source_port":49870,"source_domain":"204.76.203.221.ptr.pfcloud.network","country_code":"NL","country_name":"The Netherlands","city_name":"Eygelshoven","asn_number":51396,"asn_org":"Pfcloud UG (haftungsbeschrankt)","dest_port":12328,"network_protocol":"","application_protocol":"socks5","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":102000000,"source_bytes":3,"dest_bytes":14,"network_bytes":17,"event_summary":"\u0005\u0001\u0000"} +{"timestamp":"2026-09-06T23:20:40","event_id":"63dac0c9-1316-4fd9-a5f2-64302d797558","source_ip":"204.76.203.222","source_port":7880,"source_domain":"204.76.203.222.ptr.pfcloud.network","country_code":"NL","country_name":"The Netherlands","city_name":"Eygelshoven","asn_number":51396,"asn_org":"Pfcloud UG (haftungsbeschrankt)","dest_port":1666,"network_protocol":"","application_protocol":"socks5","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":3,"dest_bytes":14,"network_bytes":17,"event_summary":"\u0005\u0001\u0000"} +{"timestamp":"2026-09-06T23:20:40","event_id":"f866219e-3a24-484c-810f-4162436df1c4","source_ip":"204.76.203.213","source_port":21686,"source_domain":"204.76.203.213.ptr.pfcloud.network","country_code":"NL","country_name":"The Netherlands","city_name":"Eygelshoven","asn_number":51396,"asn_org":"Pfcloud UG (haftungsbeschrankt)","dest_port":1666,"network_protocol":"","application_protocol":"amazonaws","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":101000000,"source_bytes":79,"dest_bytes":14,"network_bytes":93,"event_summary":"CONNECT checkip.amazonaws.com:443 HTTP/1.1\r\nHost: checkip.amazonaws.com:443\r\n\r\n"} +{"timestamp":"2026-09-06T23:19:03","event_id":"1e75345a-4116-4211-9966-a100262af549","source_ip":"204.76.203.222","source_port":15494,"source_domain":"204.76.203.222.ptr.pfcloud.network","country_code":"NL","country_name":"The Netherlands","city_name":"Eygelshoven","asn_number":51396,"asn_org":"Pfcloud UG (haftungsbeschrankt)","dest_port":10020,"network_protocol":"","application_protocol":"http_connect","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":63,"dest_bytes":14,"network_bytes":77,"event_summary":"CONNECT icanhazip.com:443 HTTP/1.1\r\nHost: icanhazip.com:443\r\n\r\n"} +{"timestamp":"2026-09-06T23:19:03","event_id":"9e21aa27-462a-4cbf-a789-aefbb040b7fe","source_ip":"204.76.203.213","source_port":27372,"source_domain":"204.76.203.213.ptr.pfcloud.network","country_code":"NL","country_name":"The Netherlands","city_name":"Eygelshoven","asn_number":51396,"asn_org":"Pfcloud UG (haftungsbeschrankt)","dest_port":10020,"network_protocol":"","application_protocol":"socks5","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":3,"dest_bytes":14,"network_bytes":17,"event_summary":"\u0005\u0001\u0000"} +{"timestamp":"2026-09-06T23:18:44","event_id":"b17e4854-abf4-476e-a304-78a02075c471","source_ip":"204.76.203.221","source_port":16600,"source_domain":"204.76.203.221.ptr.pfcloud.network","country_code":"NL","country_name":"The Netherlands","city_name":"Eygelshoven","asn_number":51396,"asn_org":"Pfcloud UG (haftungsbeschrankt)","dest_port":10258,"network_protocol":"","application_protocol":"http_connect","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":102000000,"source_bytes":67,"dest_bytes":14,"network_bytes":81,"event_summary":"CONNECT api64.ipify.org:443 HTTP/1.1\r\nHost: api64.ipify.org:443\r\n\r\n"} +{"timestamp":"2026-09-06T23:18:44","event_id":"30afc8b1-b128-45a6-b121-171949646a9c","source_ip":"204.76.203.213","source_port":42102,"source_domain":"204.76.203.213.ptr.pfcloud.network","country_code":"NL","country_name":"The Netherlands","city_name":"Eygelshoven","asn_number":51396,"asn_org":"Pfcloud UG (haftungsbeschrankt)","dest_port":10258,"network_protocol":"","application_protocol":"socks5","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":101000000,"source_bytes":3,"dest_bytes":14,"network_bytes":17,"event_summary":"\u0005\u0001\u0000"} +{"timestamp":"2026-09-06T23:18:35","event_id":"be74dffc-88ba-43aa-a0bc-c733495bafb1","source_ip":"204.76.203.222","source_port":11802,"source_domain":"204.76.203.222.ptr.pfcloud.network","country_code":"NL","country_name":"The Netherlands","city_name":"Eygelshoven","asn_number":51396,"asn_org":"Pfcloud UG (haftungsbeschrankt)","dest_port":5512,"network_protocol":"","application_protocol":"http_connect","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":63,"dest_bytes":14,"network_bytes":77,"event_summary":"CONNECT icanhazip.com:443 HTTP/1.1\r\nHost: icanhazip.com:443\r\n\r\n"} +{"timestamp":"2026-09-06T23:18:35","event_id":"f3bc9caa-0a61-40e2-bbc6-6b4a70331aa1","source_ip":"204.76.203.214","source_port":58276,"source_domain":"204.76.203.214.ptr.pfcloud.network","country_code":"NL","country_name":"The Netherlands","city_name":"Eygelshoven","asn_number":51396,"asn_org":"Pfcloud UG (haftungsbeschrankt)","dest_port":5512,"network_protocol":"","application_protocol":"socks5","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":3,"dest_bytes":14,"network_bytes":17,"event_summary":"\u0005\u0001\u0000"} +{"timestamp":"2026-09-06T23:18:31","event_id":"f64243e0-1fd7-41f1-943e-c70c7c5f7c33","source_ip":"204.76.203.222","source_port":43730,"source_domain":"204.76.203.222.ptr.pfcloud.network","country_code":"NL","country_name":"The Netherlands","city_name":"Eygelshoven","asn_number":51396,"asn_org":"Pfcloud UG (haftungsbeschrankt)","dest_port":11007,"network_protocol":"","application_protocol":"socks5","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":103000000,"source_bytes":3,"dest_bytes":14,"network_bytes":17,"event_summary":"\u0005\u0001\u0000"} +{"timestamp":"2026-09-06T23:18:31","event_id":"6bd45fce-3349-4c00-a8cc-6e770b70e5db","source_ip":"204.76.203.213","source_port":40614,"source_domain":"204.76.203.213.ptr.pfcloud.network","country_code":"NL","country_name":"The Netherlands","city_name":"Eygelshoven","asn_number":51396,"asn_org":"Pfcloud UG (haftungsbeschrankt)","dest_port":11007,"network_protocol":"","application_protocol":"http_connect","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":63,"dest_bytes":14,"network_bytes":77,"event_summary":"CONNECT icanhazip.com:443 HTTP/1.1\r\nHost: icanhazip.com:443\r\n\r\n"} +{"timestamp":"2026-09-06T23:17:26","event_id":"c3fd4de7-3b63-46eb-90c4-f0a9138d349e","source_ip":"204.76.203.222","source_port":57358,"source_domain":"204.76.203.222.ptr.pfcloud.network","country_code":"NL","country_name":"The Netherlands","city_name":"Eygelshoven","asn_number":51396,"asn_org":"Pfcloud UG (haftungsbeschrankt)","dest_port":42103,"network_protocol":"","application_protocol":"amazonaws","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":79,"dest_bytes":14,"network_bytes":93,"event_summary":"CONNECT checkip.amazonaws.com:443 HTTP/1.1\r\nHost: checkip.amazonaws.com:443\r\n\r\n"} +{"timestamp":"2026-09-06T23:17:26","event_id":"c6be4aa6-b993-4232-b4e2-ce416f7068fa","source_ip":"204.76.203.213","source_port":6966,"source_domain":"204.76.203.213.ptr.pfcloud.network","country_code":"NL","country_name":"The Netherlands","city_name":"Eygelshoven","asn_number":51396,"asn_org":"Pfcloud UG (haftungsbeschrankt)","dest_port":42103,"network_protocol":"","application_protocol":"socks5","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":3,"dest_bytes":14,"network_bytes":17,"event_summary":"\u0005\u0001\u0000"} +{"timestamp":"2026-09-06T23:12:13","event_id":"baad81ab-daa5-4796-9207-43e96987ceb5","source_ip":"204.76.203.222","source_port":37024,"source_domain":"204.76.203.222.ptr.pfcloud.network","country_code":"NL","country_name":"The Netherlands","city_name":"Eygelshoven","asn_number":51396,"asn_org":"Pfcloud UG (haftungsbeschrankt)","dest_port":11236,"network_protocol":"","application_protocol":"socks5","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":101000000,"source_bytes":3,"dest_bytes":14,"network_bytes":17,"event_summary":"\u0005\u0001\u0000"} +{"timestamp":"2026-09-06T23:12:13","event_id":"b4fd3734-b0f8-4785-97c1-8cb78ea8a950","source_ip":"204.76.203.221","source_port":27510,"source_domain":"204.76.203.221.ptr.pfcloud.network","country_code":"NL","country_name":"The Netherlands","city_name":"Eygelshoven","asn_number":51396,"asn_org":"Pfcloud UG (haftungsbeschrankt)","dest_port":11236,"network_protocol":"","application_protocol":"http_connect","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":63,"dest_bytes":14,"network_bytes":77,"event_summary":"CONNECT icanhazip.com:443 HTTP/1.1\r\nHost: icanhazip.com:443\r\n\r\n"} +{"timestamp":"2026-09-06T23:12:11","event_id":"be7f8416-77cd-4b8e-97ea-08419c77586f","source_ip":"204.76.203.222","source_port":3850,"source_domain":"204.76.203.222.ptr.pfcloud.network","country_code":"NL","country_name":"The Netherlands","city_name":"Eygelshoven","asn_number":51396,"asn_org":"Pfcloud UG (haftungsbeschrankt)","dest_port":4203,"network_protocol":"","application_protocol":"socks5","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":101000000,"source_bytes":3,"dest_bytes":14,"network_bytes":17,"event_summary":"\u0005\u0001\u0000"} +{"timestamp":"2026-09-06T23:12:11","event_id":"fc6c78da-43c3-4197-938c-f42b87585d60","source_ip":"204.76.203.221","source_port":55752,"source_domain":"204.76.203.221.ptr.pfcloud.network","country_code":"NL","country_name":"The Netherlands","city_name":"Eygelshoven","asn_number":51396,"asn_org":"Pfcloud UG (haftungsbeschrankt)","dest_port":4203,"network_protocol":"","application_protocol":"http_connect","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":101000000,"source_bytes":67,"dest_bytes":14,"network_bytes":81,"event_summary":"CONNECT api64.ipify.org:443 HTTP/1.1\r\nHost: api64.ipify.org:443\r\n\r\n"} +{"timestamp":"2026-09-06T23:11:54","event_id":"d4ee38a4-549d-4a0c-9ce0-ee77a4114f12","source_ip":"204.76.203.221","source_port":4714,"source_domain":"204.76.203.221.ptr.pfcloud.network","country_code":"NL","country_name":"The Netherlands","city_name":"Eygelshoven","asn_number":51396,"asn_org":"Pfcloud UG (haftungsbeschrankt)","dest_port":20028,"network_protocol":"","application_protocol":"http_connect","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":67,"dest_bytes":14,"network_bytes":81,"event_summary":"CONNECT api64.ipify.org:443 HTTP/1.1\r\nHost: api64.ipify.org:443\r\n\r\n"} +{"timestamp":"2026-09-06T23:11:54","event_id":"dd497055-df87-4a20-93d5-92b94cb2bd05","source_ip":"204.76.203.214","source_port":49888,"source_domain":"204.76.203.214.ptr.pfcloud.network","country_code":"NL","country_name":"The Netherlands","city_name":"Eygelshoven","asn_number":51396,"asn_org":"Pfcloud UG (haftungsbeschrankt)","dest_port":20028,"network_protocol":"","application_protocol":"socks5","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":102000000,"source_bytes":3,"dest_bytes":14,"network_bytes":17,"event_summary":"\u0005\u0001\u0000"} +{"timestamp":"2026-09-06T23:11:08","event_id":"e461397a-1821-47d2-a998-47da155f0011","source_ip":"204.76.203.221","source_port":15574,"source_domain":"204.76.203.221.ptr.pfcloud.network","country_code":"NL","country_name":"The Netherlands","city_name":"Eygelshoven","asn_number":51396,"asn_org":"Pfcloud UG (haftungsbeschrankt)","dest_port":1082,"network_protocol":"","application_protocol":"socks5","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":3,"dest_bytes":14,"network_bytes":17,"event_summary":"\u0005\u0001\u0000"} +{"timestamp":"2026-09-06T23:11:08","event_id":"bec962f0-8cf6-40da-8f44-49707f3cf2b8","source_ip":"204.76.203.214","source_port":23068,"source_domain":"204.76.203.214.ptr.pfcloud.network","country_code":"NL","country_name":"The Netherlands","city_name":"Eygelshoven","asn_number":51396,"asn_org":"Pfcloud UG (haftungsbeschrankt)","dest_port":1082,"network_protocol":"","application_protocol":"amazonaws","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":79,"dest_bytes":14,"network_bytes":93,"event_summary":"CONNECT checkip.amazonaws.com:443 HTTP/1.1\r\nHost: checkip.amazonaws.com:443\r\n\r\n"} +{"timestamp":"2026-09-06T23:08:11","event_id":"e5628600-8de9-4109-ba86-737eb87856c4","source_ip":"204.76.203.222","source_port":6638,"source_domain":"204.76.203.222.ptr.pfcloud.network","country_code":"NL","country_name":"The Netherlands","city_name":"Eygelshoven","asn_number":51396,"asn_org":"Pfcloud UG (haftungsbeschrankt)","dest_port":50020,"network_protocol":"","application_protocol":"socks5","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":144000000,"source_bytes":3,"dest_bytes":14,"network_bytes":17,"event_summary":"\u0005\u0001\u0000"} +{"timestamp":"2026-09-06T23:08:11","event_id":"3551d32c-b5f3-4658-a2cd-3a76b51595cf","source_ip":"204.76.203.213","source_port":48106,"source_domain":"204.76.203.213.ptr.pfcloud.network","country_code":"NL","country_name":"The Netherlands","city_name":"Eygelshoven","asn_number":51396,"asn_org":"Pfcloud UG (haftungsbeschrankt)","dest_port":50020,"network_protocol":"","application_protocol":"amazonaws","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":145000000,"source_bytes":79,"dest_bytes":14,"network_bytes":93,"event_summary":"CONNECT checkip.amazonaws.com:443 HTTP/1.1\r\nHost: checkip.amazonaws.com:443\r\n\r\n"} +{"timestamp":"2026-09-06T23:07:55","event_id":"415e27cb-f881-40e6-b8c8-27f987474390","source_ip":"204.76.203.222","source_port":8678,"source_domain":"204.76.203.222.ptr.pfcloud.network","country_code":"NL","country_name":"The Netherlands","city_name":"Eygelshoven","asn_number":51396,"asn_org":"Pfcloud UG (haftungsbeschrankt)","dest_port":6330,"network_protocol":"","application_protocol":"socks5","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":102000000,"source_bytes":3,"dest_bytes":14,"network_bytes":17,"event_summary":"\u0005\u0001\u0000"} +{"timestamp":"2026-09-06T23:07:55","event_id":"63741316-fb65-40d1-be98-a05258403364","source_ip":"204.76.203.213","source_port":23220,"source_domain":"204.76.203.213.ptr.pfcloud.network","country_code":"NL","country_name":"The Netherlands","city_name":"Eygelshoven","asn_number":51396,"asn_org":"Pfcloud UG (haftungsbeschrankt)","dest_port":6330,"network_protocol":"","application_protocol":"http_connect","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":101000000,"source_bytes":63,"dest_bytes":14,"network_bytes":77,"event_summary":"CONNECT icanhazip.com:443 HTTP/1.1\r\nHost: icanhazip.com:443\r\n\r\n"} +{"timestamp":"2026-09-06T23:07:14","event_id":"7228075d-ea4d-4278-a9c1-aad9ce2279ee","source_ip":"204.76.203.214","source_port":26612,"source_domain":"204.76.203.214.ptr.pfcloud.network","country_code":"NL","country_name":"The Netherlands","city_name":"Eygelshoven","asn_number":51396,"asn_org":"Pfcloud UG (haftungsbeschrankt)","dest_port":10474,"network_protocol":"","application_protocol":"socks5","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":3,"dest_bytes":14,"network_bytes":17,"event_summary":"\u0005\u0001\u0000"} +{"timestamp":"2026-09-06T23:07:14","event_id":"786c402b-38b9-4fde-9434-688b84203c16","source_ip":"204.76.203.213","source_port":25764,"source_domain":"204.76.203.213.ptr.pfcloud.network","country_code":"NL","country_name":"The Netherlands","city_name":"Eygelshoven","asn_number":51396,"asn_org":"Pfcloud UG (haftungsbeschrankt)","dest_port":10474,"network_protocol":"","application_protocol":"amazonaws","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":101000000,"source_bytes":79,"dest_bytes":14,"network_bytes":93,"event_summary":"CONNECT checkip.amazonaws.com:443 HTTP/1.1\r\nHost: checkip.amazonaws.com:443\r\n\r\n"} +{"timestamp":"2026-09-06T23:04:52","event_id":"df77e265-2606-4f90-b73d-80115b3e568c","source_ip":"204.76.203.222","source_port":51422,"source_domain":"204.76.203.222.ptr.pfcloud.network","country_code":"NL","country_name":"The Netherlands","city_name":"Eygelshoven","asn_number":51396,"asn_org":"Pfcloud UG (haftungsbeschrankt)","dest_port":20105,"network_protocol":"","application_protocol":"socks5","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":3,"dest_bytes":14,"network_bytes":17,"event_summary":"\u0005\u0001\u0000"} +{"timestamp":"2026-09-06T23:04:52","event_id":"923394d0-65ac-489d-b7f9-2466a113862c","source_ip":"204.76.203.213","source_port":9676,"source_domain":"204.76.203.213.ptr.pfcloud.network","country_code":"NL","country_name":"The Netherlands","city_name":"Eygelshoven","asn_number":51396,"asn_org":"Pfcloud UG (haftungsbeschrankt)","dest_port":20105,"network_protocol":"","application_protocol":"http_connect","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":101000000,"source_bytes":67,"dest_bytes":14,"network_bytes":81,"event_summary":"CONNECT api64.ipify.org:443 HTTP/1.1\r\nHost: api64.ipify.org:443\r\n\r\n"} +{"timestamp":"2026-09-06T23:04:39","event_id":"52bdcae5-8c21-488d-a1d7-9fab072e91bd","source_ip":"176.65.149.212","source_port":38310,"source_domain":"176.65.149.212.ptr.pfcloud.network","country_code":"NL","country_name":"The Netherlands","city_name":"Eygelshoven","asn_number":51396,"asn_org":"Pfcloud UG (haftungsbeschrankt)","dest_port":8038,"network_protocol":"","application_protocol":"ssh","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":115000000,"source_bytes":17,"dest_bytes":14,"network_bytes":31,"event_summary":"SSH-2.0-OpenSSH\r\n"} +{"timestamp":"2026-09-06T23:03:47","event_id":"f83d5e7c-de7c-45dc-9556-cd13b666d2b8","source_ip":"204.76.203.222","source_port":46728,"source_domain":"204.76.203.222.ptr.pfcloud.network","country_code":"NL","country_name":"The Netherlands","city_name":"Eygelshoven","asn_number":51396,"asn_org":"Pfcloud UG (haftungsbeschrankt)","dest_port":20011,"network_protocol":"","application_protocol":"socks5","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":3,"dest_bytes":14,"network_bytes":17,"event_summary":"\u0005\u0001\u0000"} +{"timestamp":"2026-09-06T23:03:47","event_id":"4e555db4-1b7f-4d47-8db1-d8b73706b30b","source_ip":"204.76.203.214","source_port":27728,"source_domain":"204.76.203.214.ptr.pfcloud.network","country_code":"NL","country_name":"The Netherlands","city_name":"Eygelshoven","asn_number":51396,"asn_org":"Pfcloud UG (haftungsbeschrankt)","dest_port":20011,"network_protocol":"","application_protocol":"http_connect","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":67,"dest_bytes":14,"network_bytes":81,"event_summary":"CONNECT api64.ipify.org:443 HTTP/1.1\r\nHost: api64.ipify.org:443\r\n\r\n"} +{"timestamp":"2026-09-06T23:03:41","event_id":"b24d5556-a5b6-49a2-a395-4ea5bb1b59b6","source_ip":"204.76.203.222","source_port":11534,"source_domain":"204.76.203.222.ptr.pfcloud.network","country_code":"NL","country_name":"The Netherlands","city_name":"Eygelshoven","asn_number":51396,"asn_org":"Pfcloud UG (haftungsbeschrankt)","dest_port":30006,"network_protocol":"","application_protocol":"socks5","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":101000000,"source_bytes":3,"dest_bytes":14,"network_bytes":17,"event_summary":"\u0005\u0001\u0000"} +{"timestamp":"2026-09-06T23:03:41","event_id":"1dca77e2-93be-4a85-a46c-299cc5e7c8f7","source_ip":"204.76.203.221","source_port":65274,"source_domain":"204.76.203.221.ptr.pfcloud.network","country_code":"NL","country_name":"The Netherlands","city_name":"Eygelshoven","asn_number":51396,"asn_org":"Pfcloud UG (haftungsbeschrankt)","dest_port":30006,"network_protocol":"","application_protocol":"amazonaws","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":79,"dest_bytes":14,"network_bytes":93,"event_summary":"CONNECT checkip.amazonaws.com:443 HTTP/1.1\r\nHost: checkip.amazonaws.com:443\r\n\r\n"} +{"timestamp":"2026-09-06T23:01:39","event_id":"b73a7bbf-324a-48c6-8417-697ad12467a5","source_ip":"204.76.203.221","source_port":57288,"source_domain":"204.76.203.221.ptr.pfcloud.network","country_code":"NL","country_name":"The Netherlands","city_name":"Eygelshoven","asn_number":51396,"asn_org":"Pfcloud UG (haftungsbeschrankt)","dest_port":11000,"network_protocol":"","application_protocol":"socks5","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":3,"dest_bytes":14,"network_bytes":17,"event_summary":"\u0005\u0001\u0000"} +{"timestamp":"2026-09-06T23:01:39","event_id":"1f8c1314-ca42-4cb0-81f8-7c50b1b733c1","source_ip":"204.76.203.213","source_port":6720,"source_domain":"204.76.203.213.ptr.pfcloud.network","country_code":"NL","country_name":"The Netherlands","city_name":"Eygelshoven","asn_number":51396,"asn_org":"Pfcloud UG (haftungsbeschrankt)","dest_port":11000,"network_protocol":"","application_protocol":"http_connect","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":102000000,"source_bytes":67,"dest_bytes":14,"network_bytes":81,"event_summary":"CONNECT api64.ipify.org:443 HTTP/1.1\r\nHost: api64.ipify.org:443\r\n\r\n"} +{"timestamp":"2026-09-06T22:58:48","event_id":"27d04307-7b1d-44a1-8f8a-ff9cd51ae7e7","source_ip":"204.76.203.214","source_port":52920,"source_domain":"204.76.203.214.ptr.pfcloud.network","country_code":"NL","country_name":"The Netherlands","city_name":"Eygelshoven","asn_number":51396,"asn_org":"Pfcloud UG (haftungsbeschrankt)","dest_port":9898,"network_protocol":"","application_protocol":"socks5","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":101000000,"source_bytes":3,"dest_bytes":14,"network_bytes":17,"event_summary":"\u0005\u0001\u0000"} \ No newline at end of file diff --git a/kevlar/2026-09-07/honeylabs/events-AS51852.ndjson b/kevlar/2026-09-07/honeylabs/events-AS51852.ndjson new file mode 100644 index 0000000..0de2d8f --- /dev/null +++ b/kevlar/2026-09-07/honeylabs/events-AS51852.ndjson @@ -0,0 +1,32 @@ +{"timestamp":"2026-09-04T19:27:10","event_id":"e3bf526d-779d-4d55-9f3c-2118cb5a6d7e","source_ip":"46.19.142.226","source_port":41174,"source_domain":"hostedby.privatelayer.com","country_code":"CH","country_name":"Switzerland","city_name":"","asn_number":51852,"asn_org":"Private Layer INC","dest_port":2087,"network_protocol":"tls","application_protocol":"http","http_method":"POST","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64)","url_path":"/login/?login_only=1","url_domain":"","http_request_headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"content-length\":\"20\",\"host\":\":2087\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\"}","ssh_client_hassh":"","tls_client_ja4":"t13i190800_9dc949149365_97f8aa674fd9","tls_client_ja3":"19e29534fd49dd27d09234e639c4057e","tls_client_version":"TLSv1.3","tls_client_cipher":"TLS_AES_128_GCM_SHA256","http_request_ja4h":"po11nn0500_c5c1780925fe","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":200,"dest_bytes":78,"network_bytes":278,"event_summary":""} +{"timestamp":"2026-09-04T19:27:10","event_id":"58284d32-335d-4c17-a679-d3ebfa7345af","source_ip":"46.19.142.226","source_port":41172,"source_domain":"hostedby.privatelayer.com","country_code":"CH","country_name":"Switzerland","city_name":"","asn_number":51852,"asn_org":"Private Layer INC","dest_port":2087,"network_protocol":"tls","application_protocol":"http","http_method":"GET","user_agent":"Mozilla/5.0","url_path":"/openid_connect/cpanelid","url_domain":"","http_request_headers":"{\"accept-encoding\":\"gzip\",\"host\":\":2087\",\"user-agent\":\"Mozilla/5.0\"}","ssh_client_hassh":"","tls_client_ja4":"t13i190800_9dc949149365_97f8aa674fd9","tls_client_ja3":"19e29534fd49dd27d09234e639c4057e","tls_client_version":"TLSv1.3","tls_client_cipher":"TLS_AES_128_GCM_SHA256","http_request_ja4h":"ge11nn0300_0db47b7d240d","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":114,"dest_bytes":78,"network_bytes":192,"event_summary":""} +{"timestamp":"2026-09-04T18:34:59","event_id":"b1cbfc26-7468-4d58-b4a9-d9f0d93cc47b","source_ip":"46.19.142.226","source_port":54674,"source_domain":"hostedby.privatelayer.com","country_code":"CH","country_name":"Switzerland","city_name":"","asn_number":51852,"asn_org":"Private Layer INC","dest_port":2087,"network_protocol":"tls","application_protocol":"http","http_method":"POST","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64)","url_path":"/login/?login_only=1","url_domain":"","http_request_headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"content-length\":\"20\",\"host\":\":2087\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\"}","ssh_client_hassh":"","tls_client_ja4":"t13i190800_9dc949149365_97f8aa674fd9","tls_client_ja3":"19e29534fd49dd27d09234e639c4057e","tls_client_version":"TLSv1.3","tls_client_cipher":"TLS_AES_128_GCM_SHA256","http_request_ja4h":"po11nn0500_c5c1780925fe","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":201,"dest_bytes":78,"network_bytes":279,"event_summary":""} +{"timestamp":"2026-09-04T18:34:59","event_id":"d5daae92-0aab-434a-b263-8120b3659ace","source_ip":"46.19.142.226","source_port":54660,"source_domain":"hostedby.privatelayer.com","country_code":"CH","country_name":"Switzerland","city_name":"","asn_number":51852,"asn_org":"Private Layer INC","dest_port":2087,"network_protocol":"tls","application_protocol":"http","http_method":"GET","user_agent":"Mozilla/5.0","url_path":"/openid_connect/cpanelid","url_domain":"","http_request_headers":"{\"accept-encoding\":\"gzip\",\"host\":\":2087\",\"user-agent\":\"Mozilla/5.0\"}","ssh_client_hassh":"","tls_client_ja4":"t13i190800_9dc949149365_97f8aa674fd9","tls_client_ja3":"19e29534fd49dd27d09234e639c4057e","tls_client_version":"TLSv1.3","tls_client_cipher":"TLS_AES_128_GCM_SHA256","http_request_ja4h":"ge11nn0300_0db47b7d240d","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":115,"dest_bytes":78,"network_bytes":193,"event_summary":""} +{"timestamp":"2026-09-04T18:34:20","event_id":"4829ffac-a4a5-4d99-8003-e0fef24fb7d3","source_ip":"46.19.142.226","source_port":35154,"source_domain":"hostedby.privatelayer.com","country_code":"CH","country_name":"Switzerland","city_name":"","asn_number":51852,"asn_org":"Private Layer INC","dest_port":2087,"network_protocol":"tls","application_protocol":"http","http_method":"POST","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64)","url_path":"/login/?login_only=1","url_domain":"","http_request_headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"content-length\":\"20\",\"host\":\":2087\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\"}","ssh_client_hassh":"","tls_client_ja4":"t13i190800_9dc949149365_97f8aa674fd9","tls_client_ja3":"19e29534fd49dd27d09234e639c4057e","tls_client_version":"TLSv1.3","tls_client_cipher":"TLS_CHACHA20_POLY1305_SHA256","http_request_ja4h":"po11nn0500_c5c1780925fe","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":101000000,"source_bytes":200,"dest_bytes":78,"network_bytes":278,"event_summary":""} +{"timestamp":"2026-09-04T18:34:20","event_id":"7983218d-b32a-4de8-a85c-a2204b7a20bd","source_ip":"46.19.142.226","source_port":35150,"source_domain":"hostedby.privatelayer.com","country_code":"CH","country_name":"Switzerland","city_name":"","asn_number":51852,"asn_org":"Private Layer INC","dest_port":2087,"network_protocol":"tls","application_protocol":"http","http_method":"GET","user_agent":"Mozilla/5.0","url_path":"/openid_connect/cpanelid","url_domain":"","http_request_headers":"{\"accept-encoding\":\"gzip\",\"host\":\":2087\",\"user-agent\":\"Mozilla/5.0\"}","ssh_client_hassh":"","tls_client_ja4":"t13i190800_9dc949149365_97f8aa674fd9","tls_client_ja3":"19e29534fd49dd27d09234e639c4057e","tls_client_version":"TLSv1.3","tls_client_cipher":"TLS_CHACHA20_POLY1305_SHA256","http_request_ja4h":"ge11nn0300_0db47b7d240d","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":114,"dest_bytes":78,"network_bytes":192,"event_summary":""} +{"timestamp":"2026-09-04T11:46:33","event_id":"5d784166-36bc-4cd4-8f22-138b953ff499","source_ip":"141.255.165.66","source_port":29456,"source_domain":"4soho.com","country_code":"CH","country_name":"Switzerland","city_name":"Zurich","asn_number":51852,"asn_org":"Private Layer INC","dest_port":1723,"network_protocol":"","application_protocol":"pptp","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":156,"dest_bytes":14,"network_bytes":170,"event_summary":"\u0000�\u0000\u0001\u001a+","http_request_headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\":8085\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0\"}","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"ge11nn0400_9c3956fad5da","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":170,"dest_bytes":78,"network_bytes":248,"event_summary":""} +{"timestamp":"2026-09-01T12:06:54","event_id":"af88c093-e605-464c-8bc5-7c2f6fb43c2e","source_ip":"179.43.186.220","source_port":16180,"source_domain":"hostedby.privatelayer.com","country_code":"CH","country_name":"Switzerland","city_name":"Rümlang","asn_number":51852,"asn_org":"Private Layer INC","dest_port":80,"network_protocol":"","application_protocol":"http","http_method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/125 Safari/537.36","url_path":"/wp-json/","url_domain":"","http_request_headers":"{\"accept\":\"text/html,application/json;q=0.9,*/*;q=0.8\",\"accept-encoding\":\"gzip\",\"host\":\"\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/125 Safari/537.36\"}","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"ge11nn0400_88d30a62b7ad","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":222,"dest_bytes":79,"network_bytes":301,"event_summary":""} +{"timestamp":"2026-09-01T12:06:48","event_id":"ef2aa5ee-8575-4f20-928b-76241191649d","source_ip":"179.43.186.220","source_port":26588,"source_domain":"hostedby.privatelayer.com","country_code":"CH","country_name":"Switzerland","city_name":"Rümlang","asn_number":51852,"asn_org":"Private Layer INC","dest_port":443,"network_protocol":"tls","application_protocol":"http","http_method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/125 Safari/537.36","url_path":"/","url_domain":"","http_request_headers":"{\"accept\":\"text/html,application/json;q=0.9,*/*;q=0.8\",\"accept-encoding\":\"gzip\",\"host\":\"\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/125 Safari/537.36\"}","ssh_client_hassh":"","tls_client_ja4":"t13i131000_f57a46bbacb6_ab7e3b40a677","tls_client_ja3":"56b0f6febc953849f7ace70c5a2ae34d","tls_client_version":"TLSv1.3","tls_client_cipher":"TLS_CHACHA20_POLY1305_SHA256","http_request_ja4h":"ge11nn0400_88d30a62b7ad","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":214,"dest_bytes":79,"network_bytes":293,"event_summary":""} +{"timestamp":"2026-09-01T12:06:48","event_id":"ce36e8d8-030b-48af-84af-847026382dbb","source_ip":"179.43.186.220","source_port":16172,"source_domain":"hostedby.privatelayer.com","country_code":"CH","country_name":"Switzerland","city_name":"Rümlang","asn_number":51852,"asn_org":"Private Layer INC","dest_port":80,"network_protocol":"","application_protocol":"http","http_method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/125 Safari/537.36","url_path":"/","url_domain":"","http_request_headers":"{\"accept\":\"text/html,application/json;q=0.9,*/*;q=0.8\",\"accept-encoding\":\"gzip\",\"host\":\"\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/125 Safari/537.36\"}","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"ge11nn0400_88d30a62b7ad","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":214,"dest_bytes":79,"network_bytes":293,"event_summary":""} +{"timestamp":"2026-09-01T07:55:46","event_id":"f9051fae-07c1-4f83-a000-99c8cde5a819","source_ip":"179.43.146.27","source_port":36984,"source_domain":"mta2.smartfastjoy3.com","country_code":"CH","country_name":"Switzerland","city_name":"Rümlang","asn_number":51852,"asn_org":"Private Layer INC","dest_port":32400,"network_protocol":"tls","application_protocol":"http","http_method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0","url_path":"/","url_domain":"","http_request_headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\":32400\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0\"}","ssh_client_hassh":"","tls_client_ja4":"t13i1310h1_f57a46bbacb6_e7c285222651","tls_client_ja3":"faa162b5a653756fba26803ea81b362f","tls_client_version":"TLSv1.3","tls_client_cipher":"TLS_AES_128_GCM_SHA256","http_request_ja4h":"ge11nn0400_9c3956fad5da","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":101000000,"source_bytes":171,"dest_bytes":78,"network_bytes":249,"event_summary":""} +{"timestamp":"2026-08-31T16:49:55","event_id":"5b352e94-db6a-45da-a7b9-31843a2ed8b5","source_ip":"179.43.150.26","source_port":50786,"source_domain":"hostedby.privatelayer.com","country_code":"CH","country_name":"Switzerland","city_name":"Rümlang","asn_number":51852,"asn_org":"Private Layer INC","dest_port":8443,"network_protocol":"","application_protocol":"http","http_method":"GET","user_agent":"Mozilla/5.0","url_path":"/z1356","url_domain":"","http_request_headers":"{\"accept\":\"*/*\",\"host\":\":8443\",\"user-agent\":\"Mozilla/5.0\"}","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"ge11nn0300_341eb0d8946c","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":4,"event_duration":1038000000,"source_bytes":352,"dest_bytes":312,"network_bytes":664,"event_summary":""} +{"timestamp":"2026-08-31T16:49:55","event_id":"5b352e94-db6a-45da-a7b9-31843a2ed8b5","source_ip":"179.43.150.26","source_port":50786,"source_domain":"hostedby.privatelayer.com","country_code":"CH","country_name":"Switzerland","city_name":"Rümlang","asn_number":51852,"asn_org":"Private Layer INC","dest_port":8443,"network_protocol":"","application_protocol":"http","http_method":"GET","user_agent":"Mozilla/5.0","url_path":"/s/1974","url_domain":"","http_request_headers":"{\"accept\":\"*/*\",\"host\":\":8443\",\"user-agent\":\"Mozilla/5.0\"}","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"ge11nn0300_341eb0d8946c","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":3,"event_duration":741000000,"source_bytes":264,"dest_bytes":234,"network_bytes":498,"event_summary":""} +{"timestamp":"2026-08-31T16:49:55","event_id":"5b352e94-db6a-45da-a7b9-31843a2ed8b5","source_ip":"179.43.150.26","source_port":50786,"source_domain":"hostedby.privatelayer.com","country_code":"CH","country_name":"Switzerland","city_name":"Rümlang","asn_number":51852,"asn_org":"Private Layer INC","dest_port":8443,"network_protocol":"","application_protocol":"http","http_method":"GET","user_agent":"Mozilla/5.0","url_path":"/.e199","url_domain":"","http_request_headers":"{\"accept\":\"*/*\",\"host\":\":8443\",\"user-agent\":\"Mozilla/5.0\"}","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"ge11nn0300_341eb0d8946c","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":2,"event_duration":433000000,"source_bytes":175,"dest_bytes":156,"network_bytes":331,"event_summary":""} +{"timestamp":"2026-08-31T16:49:54","event_id":"5b352e94-db6a-45da-a7b9-31843a2ed8b5","source_ip":"179.43.150.26","source_port":50786,"source_domain":"hostedby.privatelayer.com","country_code":"CH","country_name":"Switzerland","city_name":"Rümlang","asn_number":51852,"asn_org":"Private Layer INC","dest_port":8443,"network_protocol":"","application_protocol":"http","http_method":"GET","user_agent":"Mozilla/5.0","url_path":"/.env","url_domain":"","http_request_headers":"{\"accept\":\"*/*\",\"host\":\":8443\",\"user-agent\":\"Mozilla/5.0\"}","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"ge11nn0300_341eb0d8946c","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":87,"dest_bytes":78,"network_bytes":165,"event_summary":""} +{"timestamp":"2026-08-31T15:36:22","event_id":"b1eee67b-cd86-47c4-a031-cc111067d5f8","source_ip":"179.43.150.26","source_port":54320,"source_domain":"hostedby.privatelayer.com","country_code":"CH","country_name":"Switzerland","city_name":"Rümlang","asn_number":51852,"asn_org":"Private Layer INC","dest_port":8443,"network_protocol":"","application_protocol":"http","http_method":"GET","user_agent":"Mozilla/5.0","url_path":"/z945","url_domain":"","http_request_headers":"{\"accept\":\"*/*\",\"host\":\":8443\",\"user-agent\":\"Mozilla/5.0\"}","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"ge11nn0300_341eb0d8946c","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":4,"event_duration":1168000000,"source_bytes":344,"dest_bytes":312,"network_bytes":656,"event_summary":""} +{"timestamp":"2026-08-31T15:36:22","event_id":"b61409d4-193c-47ea-a783-bcf69924583c","source_ip":"179.43.150.26","source_port":42000,"source_domain":"hostedby.privatelayer.com","country_code":"CH","country_name":"Switzerland","city_name":"Rümlang","asn_number":51852,"asn_org":"Private Layer INC","dest_port":8443,"network_protocol":"","application_protocol":"http","http_method":"GET","user_agent":"Mozilla/5.0","url_path":"/z1891","url_domain":"","http_request_headers":"{\"accept\":\"*/*\",\"host\":\":8443\",\"user-agent\":\"Mozilla/5.0\"}","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"ge11nn0300_341eb0d8946c","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":4,"event_duration":987000000,"source_bytes":345,"dest_bytes":312,"network_bytes":657,"event_summary":""} +{"timestamp":"2026-08-31T15:36:21","event_id":"b1eee67b-cd86-47c4-a031-cc111067d5f8","source_ip":"179.43.150.26","source_port":54320,"source_domain":"hostedby.privatelayer.com","country_code":"CH","country_name":"Switzerland","city_name":"Rümlang","asn_number":51852,"asn_org":"Private Layer INC","dest_port":8443,"network_protocol":"","application_protocol":"http","http_method":"GET","user_agent":"Mozilla/5.0","url_path":"/s/1688","url_domain":"","http_request_headers":"{\"accept\":\"*/*\",\"host\":\":8443\",\"user-agent\":\"Mozilla/5.0\"}","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"ge11nn0300_341eb0d8946c","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":3,"event_duration":827000000,"source_bytes":259,"dest_bytes":234,"network_bytes":493,"event_summary":""} +{"timestamp":"2026-08-31T15:36:21","event_id":"b1eee67b-cd86-47c4-a031-cc111067d5f8","source_ip":"179.43.150.26","source_port":54320,"source_domain":"hostedby.privatelayer.com","country_code":"CH","country_name":"Switzerland","city_name":"Rümlang","asn_number":51852,"asn_org":"Private Layer INC","dest_port":8443,"network_protocol":"","application_protocol":"http","http_method":"GET","user_agent":"Mozilla/5.0","url_path":"/.e3448","url_domain":"","http_request_headers":"{\"accept\":\"*/*\",\"host\":\":8443\",\"user-agent\":\"Mozilla/5.0\"}","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"ge11nn0300_341eb0d8946c","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":2,"event_duration":463000000,"source_bytes":172,"dest_bytes":156,"network_bytes":328,"event_summary":""} +{"timestamp":"2026-08-31T15:36:21","event_id":"b1eee67b-cd86-47c4-a031-cc111067d5f8","source_ip":"179.43.150.26","source_port":54320,"source_domain":"hostedby.privatelayer.com","country_code":"CH","country_name":"Switzerland","city_name":"Rümlang","asn_number":51852,"asn_org":"Private Layer INC","dest_port":8443,"network_protocol":"","application_protocol":"http","http_method":"GET","user_agent":"Mozilla/5.0","url_path":"/.env","url_domain":"","http_request_headers":"{\"accept\":\"*/*\",\"host\":\":8443\",\"user-agent\":\"Mozilla/5.0\"}","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"ge11nn0300_341eb0d8946c","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":101000000,"source_bytes":85,"dest_bytes":78,"network_bytes":163,"event_summary":""} +{"timestamp":"2026-08-31T15:36:21","event_id":"b61409d4-193c-47ea-a783-bcf69924583c","source_ip":"179.43.150.26","source_port":42000,"source_domain":"hostedby.privatelayer.com","country_code":"CH","country_name":"Switzerland","city_name":"Rümlang","asn_number":51852,"asn_org":"Private Layer INC","dest_port":8443,"network_protocol":"","application_protocol":"http","http_method":"GET","user_agent":"Mozilla/5.0","url_path":"/s/6254","url_domain":"","http_request_headers":"{\"accept\":\"*/*\",\"host\":\":8443\",\"user-agent\":\"Mozilla/5.0\"}","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"ge11nn0300_341eb0d8946c","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":3,"event_duration":702000000,"source_bytes":259,"dest_bytes":234,"network_bytes":493,"event_summary":""} +{"timestamp":"2026-08-31T15:36:21","event_id":"b61409d4-193c-47ea-a783-bcf69924583c","source_ip":"179.43.150.26","source_port":42000,"source_domain":"hostedby.privatelayer.com","country_code":"CH","country_name":"Switzerland","city_name":"Rümlang","asn_number":51852,"asn_org":"Private Layer INC","dest_port":8443,"network_protocol":"","application_protocol":"http","http_method":"GET","user_agent":"Mozilla/5.0","url_path":"/.e4641","url_domain":"","http_request_headers":"{\"accept\":\"*/*\",\"host\":\":8443\",\"user-agent\":\"Mozilla/5.0\"}","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"ge11nn0300_341eb0d8946c","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":2,"event_duration":376000000,"source_bytes":172,"dest_bytes":156,"network_bytes":328,"event_summary":""} +{"timestamp":"2026-08-31T15:36:21","event_id":"b61409d4-193c-47ea-a783-bcf69924583c","source_ip":"179.43.150.26","source_port":42000,"source_domain":"hostedby.privatelayer.com","country_code":"CH","country_name":"Switzerland","city_name":"Rümlang","asn_number":51852,"asn_org":"Private Layer INC","dest_port":8443,"network_protocol":"","application_protocol":"http","http_method":"GET","user_agent":"Mozilla/5.0","url_path":"/.env","url_domain":"","http_request_headers":"{\"accept\":\"*/*\",\"host\":\":8443\",\"user-agent\":\"Mozilla/5.0\"}","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"ge11nn0300_341eb0d8946c","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":85,"dest_bytes":78,"network_bytes":163,"event_summary":""} +{"timestamp":"2026-08-31T15:32:53","event_id":"144bcfa3-e3de-495b-8f1f-4044dc2c78db","source_ip":"179.43.150.26","source_port":54024,"source_domain":"hostedby.privatelayer.com","country_code":"CH","country_name":"Switzerland","city_name":"Rümlang","asn_number":51852,"asn_org":"Private Layer INC","dest_port":8443,"network_protocol":"","application_protocol":"http","http_method":"GET","user_agent":"Mozilla/5.0","url_path":"/z3411","url_domain":"","http_request_headers":"{\"accept\":\"*/*\",\"host\":\":8443\",\"user-agent\":\"Mozilla/5.0\"}","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"ge11nn0300_341eb0d8946c","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":4,"event_duration":864000000,"source_bytes":349,"dest_bytes":312,"network_bytes":661,"event_summary":""} +{"timestamp":"2026-08-31T15:32:53","event_id":"144bcfa3-e3de-495b-8f1f-4044dc2c78db","source_ip":"179.43.150.26","source_port":54024,"source_domain":"hostedby.privatelayer.com","country_code":"CH","country_name":"Switzerland","city_name":"Rümlang","asn_number":51852,"asn_org":"Private Layer INC","dest_port":8443,"network_protocol":"","application_protocol":"http","http_method":"GET","user_agent":"Mozilla/5.0","url_path":"/s/7694","url_domain":"","http_request_headers":"{\"accept\":\"*/*\",\"host\":\":8443\",\"user-agent\":\"Mozilla/5.0\"}","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"ge11nn0300_341eb0d8946c","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":3,"event_duration":676000000,"source_bytes":262,"dest_bytes":234,"network_bytes":496,"event_summary":""} +{"timestamp":"2026-08-31T15:32:52","event_id":"144bcfa3-e3de-495b-8f1f-4044dc2c78db","source_ip":"179.43.150.26","source_port":54024,"source_domain":"hostedby.privatelayer.com","country_code":"CH","country_name":"Switzerland","city_name":"Rümlang","asn_number":51852,"asn_org":"Private Layer INC","dest_port":8443,"network_protocol":"","application_protocol":"http","http_method":"GET","user_agent":"Mozilla/5.0","url_path":"/.e7095","url_domain":"","http_request_headers":"{\"accept\":\"*/*\",\"host\":\":8443\",\"user-agent\":\"Mozilla/5.0\"}","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"ge11nn0300_341eb0d8946c","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":2,"event_duration":392000000,"source_bytes":174,"dest_bytes":156,"network_bytes":330,"event_summary":""} +{"timestamp":"2026-08-31T15:32:52","event_id":"144bcfa3-e3de-495b-8f1f-4044dc2c78db","source_ip":"179.43.150.26","source_port":54024,"source_domain":"hostedby.privatelayer.com","country_code":"CH","country_name":"Switzerland","city_name":"Rümlang","asn_number":51852,"asn_org":"Private Layer INC","dest_port":8443,"network_protocol":"","application_protocol":"http","http_method":"GET","user_agent":"Mozilla/5.0","url_path":"/.env","url_domain":"","http_request_headers":"{\"accept\":\"*/*\",\"host\":\":8443\",\"user-agent\":\"Mozilla/5.0\"}","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"ge11nn0300_341eb0d8946c","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":86,"dest_bytes":78,"network_bytes":164,"event_summary":""} \ No newline at end of file diff --git a/kevlar/2026-09-07/honeylabs/events-AS57043.ndjson b/kevlar/2026-09-07/honeylabs/events-AS57043.ndjson new file mode 100644 index 0000000..2c7100e --- /dev/null +++ b/kevlar/2026-09-07/honeylabs/events-AS57043.ndjson @@ -0,0 +1,12 @@ +{"timestamp":"2026-09-03T03:47:57","event_id":"1e3817f0-a1a4-46b7-9013-f28d17df1bf4","source_ip":"82.39.165.100","source_port":51071,"source_domain":"","country_code":"DE","country_name":"Germany","city_name":"Frankfurt am Main","asn_number":57043,"asn_org":"Hostkey B.v.","dest_port":22,"network_protocol":"","application_protocol":"ssh","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"98ddc5604ef6a1006a2b49a58759fbe6","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":166000000,"source_bytes":812,"dest_bytes":13,"network_bytes":825,"event_summary":"SSH-2.0-Go\r\n\u0000\u0000\u0003\u001c\t\u0014\f���MR��0��'D(��\u0000\u0000\u0000qcurve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1\u0000\u0000\u0001-ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa,ssh-dss,ssh-ed25519\u0000\u0000\u0000Uaes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr\u0000\u0000\u0000Uaes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr\u0000\u0000\u0000Bhmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96\u0000\u0000\u0000Bhmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96\u0000\u0000\u0000\u0004none\u0000\u0000\u0000\u0004none\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0010���f����"} +{"timestamp":"2026-09-03T03:28:44","event_id":"93a051be-273f-4957-8968-294c0c7e8b67","source_ip":"82.39.165.100","source_port":59633,"source_domain":"","country_code":"DE","country_name":"Germany","city_name":"Frankfurt am Main","asn_number":57043,"asn_org":"Hostkey B.v.","dest_port":22,"network_protocol":"","application_protocol":"ssh","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"98ddc5604ef6a1006a2b49a58759fbe6","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":453000000,"source_bytes":812,"dest_bytes":13,"network_bytes":825,"event_summary":"SSH-2.0-Go\r\n\u0000\u0000\u0003\u001c\t\u0014�<����w՛�سbc�\u0000\u0000\u0000qcurve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1\u0000\u0000\u0001-ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa,ssh-dss,ssh-ed25519\u0000\u0000\u0000Uaes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr\u0000\u0000\u0000Uaes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr\u0000\u0000\u0000Bhmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96\u0000\u0000\u0000Bhmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96\u0000\u0000\u0000\u0004none\u0000\u0000\u0000\u0004none\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000�x~��e\ri�"} +{"timestamp":"2026-09-02T21:19:46","event_id":"f60f3808-99b6-4f53-b37f-579a605741e9","source_ip":"163.5.16.6","source_port":8315,"source_domain":"","country_code":"GB","country_name":"United Kingdom","city_name":"London","asn_number":57043,"asn_org":"Hostkey B.v.","dest_port":19571,"network_protocol":"","application_protocol":"rdp","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":19,"dest_bytes":10,"network_bytes":29,"event_summary":"\u0003\u0000\u0000\u0013\u000e�\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000"} +{"timestamp":"2026-09-02T21:19:36","event_id":"75f1111a-32b9-4dd6-8695-79fa7cd62698","source_ip":"163.5.16.6","source_port":3027,"source_domain":"","country_code":"GB","country_name":"United Kingdom","city_name":"London","asn_number":57043,"asn_org":"Hostkey B.v.","dest_port":19571,"network_protocol":"","application_protocol":"rdp","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":19,"dest_bytes":10,"network_bytes":29,"event_summary":"\u0003\u0000\u0000\u0013\u000e�\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000"} +{"timestamp":"2026-09-02T21:19:35","event_id":"6a566b38-21a7-4d73-b456-2ff3cb935d34","source_ip":"163.5.16.6","source_port":2913,"source_domain":"","country_code":"GB","country_name":"United Kingdom","city_name":"London","asn_number":57043,"asn_org":"Hostkey B.v.","dest_port":19571,"network_protocol":"","application_protocol":"rdp","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":19,"dest_bytes":10,"network_bytes":29,"event_summary":"\u0003\u0000\u0000\u0013\u000e�\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000"} +{"timestamp":"2026-09-02T21:17:28","event_id":"b813e4f7-babf-4454-b715-a960656463c4","source_ip":"163.5.16.6","source_port":7296,"source_domain":"","country_code":"GB","country_name":"United Kingdom","city_name":"London","asn_number":57043,"asn_org":"Hostkey B.v.","dest_port":5070,"network_protocol":"","application_protocol":"rdp","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":19,"dest_bytes":10,"network_bytes":29,"event_summary":"\u0003\u0000\u0000\u0013\u000e�\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000"} +{"timestamp":"2026-09-02T21:13:20","event_id":"7ac37f87-3ff5-4fad-845a-2be8da3ea05a","source_ip":"163.5.16.6","source_port":13381,"source_domain":"","country_code":"GB","country_name":"United Kingdom","city_name":"London","asn_number":57043,"asn_org":"Hostkey B.v.","dest_port":14603,"network_protocol":"","application_protocol":"rdp","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":19,"dest_bytes":10,"network_bytes":29,"event_summary":"\u0003\u0000\u0000\u0013\u000e�\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000"} +{"timestamp":"2026-09-02T21:13:19","event_id":"d61fae98-7e28-469c-8f89-816c804b888c","source_ip":"163.5.16.6","source_port":12957,"source_domain":"","country_code":"GB","country_name":"United Kingdom","city_name":"London","asn_number":57043,"asn_org":"Hostkey B.v.","dest_port":20271,"network_protocol":"","application_protocol":"rdp","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":19,"dest_bytes":10,"network_bytes":29,"event_summary":"\u0003\u0000\u0000\u0013\u000e�\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000"} +{"timestamp":"2026-09-02T21:03:21","event_id":"9c359aa4-344e-4a79-ba49-90cdeb2c2508","source_ip":"163.5.16.6","source_port":53446,"source_domain":"","country_code":"GB","country_name":"United Kingdom","city_name":"London","asn_number":57043,"asn_org":"Hostkey B.v.","dest_port":42481,"network_protocol":"","application_protocol":"rdp","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":19,"dest_bytes":10,"network_bytes":29,"event_summary":"\u0003\u0000\u0000\u0013\u000e�\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000"} +{"timestamp":"2026-09-02T21:02:40","event_id":"11f773c4-942e-43e0-82db-665e9a83311a","source_ip":"163.5.16.6","source_port":32984,"source_domain":"","country_code":"GB","country_name":"United Kingdom","city_name":"London","asn_number":57043,"asn_org":"Hostkey B.v.","dest_port":44981,"network_protocol":"","application_protocol":"rdp","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":100000000,"source_bytes":19,"dest_bytes":10,"network_bytes":29,"event_summary":"\u0003\u0000\u0000\u0013\u000e�\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000"} +{"timestamp":"2026-08-31T15:43:13","event_id":"b48001ad-4b6a-4ff9-9794-4e43328fcfaa","source_ip":"82.39.165.100","source_port":62142,"source_domain":"","country_code":"DE","country_name":"Germany","city_name":"Frankfurt am Main","asn_number":57043,"asn_org":"Hostkey B.v.","dest_port":22,"network_protocol":"","application_protocol":"ssh","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"98ddc5604ef6a1006a2b49a58759fbe6","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":165000000,"source_bytes":812,"dest_bytes":13,"network_bytes":825,"event_summary":"SSH-2.0-Go\r\n\u0000\u0000\u0003\u001c\t\u0014�\r�L\u001d�\u0016O�EK�w�<\u0000\u0000\u0000qcurve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1\u0000\u0000\u0001-ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa,ssh-dss,ssh-ed25519\u0000\u0000\u0000Uaes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr\u0000\u0000\u0000Uaes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr\u0000\u0000\u0000Bhmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96\u0000\u0000\u0000Bhmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96\u0000\u0000\u0000\u0004none\u0000\u0000\u0000\u0004none\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000%BJ�c���{"} +{"timestamp":"2026-08-31T15:39:39","event_id":"190a3bf5-5b40-4feb-8571-cc49b4eb05db","source_ip":"82.39.165.100","source_port":49356,"source_domain":"","country_code":"DE","country_name":"Germany","city_name":"Frankfurt am Main","asn_number":57043,"asn_org":"Hostkey B.v.","dest_port":22,"network_protocol":"","application_protocol":"ssh","http_method":"","user_agent":"","url_path":"","url_domain":"","http_request_headers":"","ssh_client_hassh":"98ddc5604ef6a1006a2b49a58759fbe6","tls_client_ja4":"","tls_client_ja3":"","tls_client_version":"","tls_client_cipher":"","http_request_ja4h":"","tls_client_server_name":"","tls_client_cert_subject":"","tls_client_cert_issuer":"","event_sequence":1,"event_duration":329000000,"source_bytes":812,"dest_bytes":13,"network_bytes":825,"event_summary":"SSH-2.0-Go\r\n\u0000\u0000\u0003\u001c\t\u0014�\u0016a�K2\u000bAޠ_{\u001a��8\u0000\u0000\u0000qcurve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1\u0000\u0000\u0001-ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa,ssh-dss,ssh-ed25519\u0000\u0000\u0000Uaes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr\u0000\u0000\u0000Uaes128-gcm@openssh.com,chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr\u0000\u0000\u0000Bhmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96\u0000\u0000\u0000Bhmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96\u0000\u0000\u0000\u0004none\u0000\u0000\u0000\u0004none\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000�&���\u0013\u0000,�"} \ No newline at end of file diff --git a/kevlar/2026-09-07/honeylabs/events-AS58854.ndjson b/kevlar/2026-09-07/honeylabs/events-AS58854.ndjson new file mode 100644 index 0000000..e69de29 diff --git a/kevlar/2026-09-07/honeylabs/fingerprints.csv b/kevlar/2026-09-07/honeylabs/fingerprints.csv new file mode 100644 index 0000000..db55459 --- /dev/null +++ b/kevlar/2026-09-07/honeylabs/fingerprints.csv @@ -0,0 +1,37 @@ +ip,asn,events,ja4,ja4h,hassh,user_agents,url_paths +"45.151.101.38","AS216246","1","t13i181000_85036bcba153_d41ae481755e","po11nn0600_def5433ae821","","Python-urllib/3.10","/api2/json/access/ticket" +"176.124.222.61","AS216246","1","","","","","" +"176.65.149.27","AS51396","1","","","","","" +"204.76.203.221","AS51396","18","","","","","" +"204.76.203.214","AS51396","25","","","","","" +"176.65.148.243","AS51396","2","","","","","" +"176.65.134.48","AS51396","4","","ge11nn0400_9c3956fad5da","","Go-http-client/1.1","http://proxy.flarevpn.digital:8080/judge" +"204.76.203.222","AS51396","20","","","","","" +"204.76.203.213","AS51396","20","","","","","" +"176.65.149.31","AS51396","1","","","","","" +"45.135.193.193","AS51396","8","","","","","" +"176.65.149.212","AS51396","1","","","","","" +"176.120.22.240","AS198953","30","t12i210600_76e208dd3e22_f28add8e7af0","ge11nn0200_549fad093d6b ge11nn0300_80168362a4ec","","","/remote/login?lang=en" +"193.143.1.66","AS198953","6","","","","","" +"176.120.22.61","AS198953","64","","","","","" +"185.100.87.136","AS200651","24","t13i1909h2_9dc949149365_97f8aa674fd9","ge11nn0400_88d30a62b7ad po11nn0600_c9506d37ac14 po11nn0500_e4a47a99f1ac","","Mozilla/5.0 (Android 12; Mobile; rv:117.0) Gecko/117.0 Focus/117.0 | SPARK COMMIT: 08059e95dacafe0bf6e5782f8e2c8ec9cd8c5a17 | Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:104.71.6212.24) Gecko/25.2.4212.671 Firefox/2.0 | Mozilla/5.0 (Windows NT 10.0; Win64; x64) | Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3 rv:3.0; eu-FR) AppleWebKit/533.4.2 (KHTML, like Gecko) Version/5.0.1 Safari/533.4.2","/eventmanager /api/client/update?arch=amd64&commit=08059e95dacafe0bf6e5782f8e2c8ec9cd8c5a17&os=windows / /api/checkin /images/transparentpix.gif" +"185.246.217.150","AS210644","51","t13i170900_5b57614c22b0_78e6aca7449b","ge11nn0500_7992432eef13 ge11nn0700_3161ce9d7233 po11nn0700_3161ce9d7233 ge11nn0500_3012a89e1aee","19532158b559096b89b1a5f7d17175b2","libredtail-http","/containers/json /index.php?lang=../../../../../../../../tmp/index1 /index.php?lang=../../../../../../../../usr/local/lib/php/pearcmd&+config-create+/&/+/tmp/index1.php /public/index.php?s=/index/\think\app/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1][]=Hello /index.php?s=/index/\think\app/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1][]=Hello /app/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php /apps/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php /public/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php /panel/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php /workspace/drupal/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php" +"46.19.142.226","AS51852","6","t13i190800_9dc949149365_97f8aa674fd9","po11nn0500_c5c1780925fe ge11nn0300_0db47b7d240d","","Mozilla/5.0 (Windows NT 10.0; Win64; x64) | Mozilla/5.0","/login/?login_only=1 /openid_connect/cpanelid" +"141.255.165.66","AS51852","5","","","","","" +"179.43.146.27","AS51852","2","t13i1310h1_f57a46bbacb6_e7c285222651","ge11nn0400_9c3956fad5da","","Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0","/" +"179.43.186.220","AS51852","3","t13i131000_f57a46bbacb6_ab7e3b40a677","ge11nn0400_88d30a62b7ad","","Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/125 Safari/537.36","/wp-json/ /" +"179.43.150.26","AS51852","16","","ge11nn0300_341eb0d8946c","","Mozilla/5.0","/z1356 /s/1974 /.e199 /.env /z945 /z1891 /s/1688 /.e3448 /s/6254 /.e4641" +"45.61.149.189","AS14956","1","t13i181000_85036bcba153_d41ae481755e","ge11nn0400_8fd06a127c33","","Python-urllib/3.13","/webclient/" +"45.61.183.10","AS14956","4","","","","","" +"216.126.239.215","AS14956","8","","","","","" +"144.172.108.79","AS14956","24","","","","","" +"167.88.168.121","AS14956","4","","ge11nn0400_9c3956fad5da","","Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0","/" +"144.172.112.11","AS14956","2","","","","","" +"45.61.157.82","AS14956","32","","","","","" +"216.126.227.187","AS14956","1","","ge11nn0400_c3abebcf3d28","","Python/3.13 aiohttp/3.13.5","/api/v1/version" +"144.172.100.114","AS14956","1","","","","","" +"144.172.99.12","AS14956","1","t13i100900_61a7ad8aa9b6_88aa062a14c8","ge11nn0300_7fd797acd99d","","Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36","/.env" +"144.172.115.222","AS14956","1","t13i311000_e8f1e7e78f70_d41ae481755e","","","","" +"144.172.99.200","AS14956","16","","","","","" +"82.39.165.100","AS57043","4","","","98ddc5604ef6a1006a2b49a58759fbe6","","" +"163.5.16.6","AS57043","8","","","","","" \ No newline at end of file diff --git a/kevlar/2026-09-07/honeylabs/ioc-lookups.json b/kevlar/2026-09-07/honeylabs/ioc-lookups.json new file mode 100644 index 0000000..252b936 --- /dev/null +++ b/kevlar/2026-09-07/honeylabs/ioc-lookups.json @@ -0,0 +1,1175 @@ +[ + { + "asn": "AS57043", + "name": "HOSTKEY-AS", + "ip": "163.5.16.6", + "event_count": 8, + "lookup": { + "total_events": 8, + "first_seen": "2026-09-02T21:02:40", + "last_seen": "2026-09-02T21:19:46", + "asn_number": 57043, + "asn_org": "Hostkey B.v.", + "country_name": "United Kingdom", + "country_code": "GB", + "ports_targeted": [ + 19571, + 42481, + 5070, + 14603, + 44981, + 20271 + ], + "ports_targeted_count": 6, + "tls_event_count": 0, + "top_http_methods": [], + "top_user_agents": [], + "top_url_paths": [], + "top_ja4_fingerprints": [], + "top_ja3_fingerprints": [], + "top_hassh_fingerprints": [], + "client_cert_event_count": 0, + "client_cert_subjects": [], + "rdns": "", + "loader_hits": 0, + "exploit_hits": 0, + "bytes_sent": 152, + "unique_source_ips": 1, + "ioc": "163.5.16.6", + "window": "last 7 days", + "query_type": "ip", + "scanner": null, + "verdict_key": "probing", + "verdict": "Low-level probing", + "verdict_why": [ + "8 event(s), fewer than 10 distinct ports, no exploit payloads.", + "Not in any known-scanner range." + ], + "verdict_confidence": "low", + "cve_probes": [] + } + }, + { + "asn": "AS57043", + "name": "HOSTKEY-AS", + "ip": "82.39.165.100", + "event_count": 4, + "lookup": { + "total_events": 4, + "first_seen": "2026-08-31T15:39:39", + "last_seen": "2026-09-03T03:47:57", + "asn_number": 57043, + "asn_org": "Hostkey B.v.", + "country_name": "Germany", + "country_code": "DE", + "ports_targeted": [ + 22 + ], + "ports_targeted_count": 1, + "tls_event_count": 0, + "top_http_methods": [], + "top_user_agents": [], + "top_url_paths": [], + "top_ja4_fingerprints": [], + "top_ja3_fingerprints": [], + "top_hassh_fingerprints": [ + "98ddc5604ef6a1006a2b49a58759fbe6" + ], + "client_cert_event_count": 0, + "client_cert_subjects": [], + "rdns": "", + "loader_hits": 0, + "exploit_hits": 0, + "bytes_sent": 3248, + "unique_source_ips": 1, + "ioc": "82.39.165.100", + "window": "last 7 days", + "query_type": "ip", + "scanner": null, + "verdict_key": "probing", + "verdict": "Low-level probing", + "verdict_why": [ + "4 event(s), fewer than 10 distinct ports, no exploit payloads.", + "Not in any known-scanner range." + ], + "verdict_confidence": "low", + "cve_probes": [] + } + }, + { + "asn": "AS210644", + "name": "AEZA-AS", + "ip": "185.246.217.150", + "event_count": 51, + "lookup": { + "total_events": 51, + "first_seen": "2026-08-31T22:44:34", + "last_seen": "2026-09-02T15:29:27", + "asn_number": 210644, + "asn_org": "Aeza Group LLC", + "country_name": "The Netherlands", + "country_code": "NL", + "ports_targeted": [ + 443, + 2222, + 2375 + ], + "ports_targeted_count": 3, + "tls_event_count": 49, + "top_http_methods": [ + "GET", + "POST" + ], + "top_user_agents": [ + "libredtail-http" + ], + "top_url_paths": [ + "/containers/json", + "/crm/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php", + "/cms/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php", + "/demo/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php", + "/yii/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php", + "/api/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php", + "/testing/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php", + "/ws/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php", + "/ws/ec/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php", + "/test/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php" + ], + "top_ja4_fingerprints": [ + "t13i170900_5b57614c22b0_78e6aca7449b" + ], + "top_ja3_fingerprints": [ + "052a5e65c3a64e860e1706b1de3c46a9" + ], + "top_hassh_fingerprints": [ + "19532158b559096b89b1a5f7d17175b2" + ], + "client_cert_event_count": 0, + "client_cert_subjects": [], + "rdns": "", + "loader_hits": 2, + "exploit_hits": 45, + "bytes_sent": 610617, + "unique_source_ips": 1, + "ioc": "185.246.217.150", + "window": "last 7 days", + "query_type": "ip", + "scanner": null, + "verdict_key": "malicious", + "verdict": "Exploit attempts observed", + "verdict_why": [ + "45 request(s) matched a known exploit path.", + "Exploit-path hits present; HTTP verb mix unknown, so read cautiously.", + "5+ hits raise confidence to high.", + "Not in any known-scanner range.", + "Sent 610,617 bytes: sustained payload delivery, not a single opportunistic request." + ], + "verdict_confidence": "high", + "cve_probes": [ + { + "cve_id": "CVE-2017-9841", + "title": "PHPUnit - Remote Code Execution", + "severity": "critical", + "actively_exploited": true + }, + { + "cve_id": "CVE-2021-42013", + "title": "Apache 2.4.49/2.4.50 - Path Traversal and Remote Code Execution", + "severity": "critical", + "actively_exploited": true + } + ] + } + }, + { + "asn": "AS14956", + "name": "ROUTERHOSTING", + "ip": "45.61.157.82", + "event_count": 32, + "lookup": { + "total_events": 32, + "first_seen": "2026-09-04T01:15:12", + "last_seen": "2026-09-04T06:30:09", + "asn_number": 14956, + "asn_org": "RouterHosting LLC", + "country_name": "United States", + "country_code": "US", + "ports_targeted": [ + 445 + ], + "ports_targeted_count": 1, + "tls_event_count": 0, + "top_http_methods": [], + "top_user_agents": [], + "top_url_paths": [], + "top_ja4_fingerprints": [], + "top_ja3_fingerprints": [], + "top_hassh_fingerprints": [], + "client_cert_event_count": 0, + "client_cert_subjects": [], + "rdns": "82.157.61.45.static.cloudzy.com", + "loader_hits": 0, + "exploit_hits": 0, + "bytes_sent": 8684, + "unique_source_ips": 1, + "ioc": "45.61.157.82", + "window": "last 7 days", + "query_type": "ip", + "scanner": null, + "verdict_key": "probing", + "verdict": "Low-level probing", + "verdict_why": [ + "32 event(s), fewer than 10 distinct ports, no exploit payloads.", + "Not in any known-scanner range.", + "Sent 8,684 bytes despite few ports and no known exploit path: focused interaction with one service, worth a look." + ], + "verdict_confidence": "low", + "cve_probes": [] + } + }, + { + "asn": "AS14956", + "name": "ROUTERHOSTING", + "ip": "144.172.108.79", + "event_count": 24, + "lookup": { + "total_events": 24, + "first_seen": "2026-09-04T20:02:59", + "last_seen": "2026-09-05T02:54:19", + "asn_number": 14956, + "asn_org": "RouterHosting LLC", + "country_name": "United States", + "country_code": "US", + "ports_targeted": [ + 445 + ], + "ports_targeted_count": 1, + "tls_event_count": 0, + "top_http_methods": [], + "top_user_agents": [], + "top_url_paths": [], + "top_ja4_fingerprints": [], + "top_ja3_fingerprints": [], + "top_hassh_fingerprints": [], + "client_cert_event_count": 0, + "client_cert_subjects": [], + "rdns": "79.108.172.144.static.cloudzy.com", + "loader_hits": 0, + "exploit_hits": 0, + "bytes_sent": 6513, + "unique_source_ips": 1, + "ioc": "144.172.108.79", + "window": "last 7 days", + "query_type": "ip", + "scanner": null, + "verdict_key": "probing", + "verdict": "Low-level probing", + "verdict_why": [ + "24 event(s), fewer than 10 distinct ports, no exploit payloads.", + "Not in any known-scanner range.", + "Sent 6,513 bytes despite few ports and no known exploit path: focused interaction with one service, worth a look." + ], + "verdict_confidence": "low", + "cve_probes": [] + } + }, + { + "asn": "AS14956", + "name": "ROUTERHOSTING", + "ip": "144.172.99.200", + "event_count": 16, + "lookup": { + "total_events": 16, + "first_seen": "2026-09-01T07:55:37", + "last_seen": "2026-09-01T08:57:36", + "asn_number": 14956, + "asn_org": "RouterHosting LLC", + "country_name": "United States", + "country_code": "US", + "ports_targeted": [ + 445 + ], + "ports_targeted_count": 1, + "tls_event_count": 0, + "top_http_methods": [], + "top_user_agents": [], + "top_url_paths": [], + "top_ja4_fingerprints": [], + "top_ja3_fingerprints": [], + "top_hassh_fingerprints": [], + "client_cert_event_count": 0, + "client_cert_subjects": [], + "rdns": "200.99.172.144.static.cloudzy.com", + "loader_hits": 0, + "exploit_hits": 0, + "bytes_sent": 4342, + "unique_source_ips": 1, + "ioc": "144.172.99.200", + "window": "last 7 days", + "query_type": "ip", + "scanner": null, + "verdict_key": "probing", + "verdict": "Low-level probing", + "verdict_why": [ + "16 event(s), fewer than 10 distinct ports, no exploit payloads.", + "Not in any known-scanner range.", + "Sent 4,342 bytes despite few ports and no known exploit path: focused interaction with one service, worth a look." + ], + "verdict_confidence": "low", + "cve_probes": [] + } + }, + { + "asn": "AS51852", + "name": "PLI-AS", + "ip": "179.43.150.26", + "event_count": 16, + "lookup": { + "total_events": 16, + "first_seen": "2026-08-31T15:32:52", + "last_seen": "2026-08-31T16:49:55", + "asn_number": 51852, + "asn_org": "Private Layer INC", + "country_name": "Switzerland", + "country_code": "CH", + "ports_targeted": [ + 8443 + ], + "ports_targeted_count": 1, + "tls_event_count": 0, + "top_http_methods": [ + "GET" + ], + "top_user_agents": [ + "Mozilla/5.0" + ], + "top_url_paths": [ + "/.env", + "/z1356", + "/s/1974", + "/.e199", + "/z1891", + "/s/1688", + "/.e3448", + "/z945", + "/s/7694", + "/s/6254" + ], + "top_ja4_fingerprints": [], + "top_ja3_fingerprints": [], + "top_hassh_fingerprints": [], + "client_cert_event_count": 0, + "client_cert_subjects": [], + "rdns": "hostedby.privatelayer.com", + "loader_hits": 0, + "exploit_hits": 4, + "bytes_sent": 3470, + "unique_source_ips": 1, + "ioc": "179.43.150.26", + "window": "last 7 days", + "query_type": "ip", + "scanner": null, + "verdict_key": "malicious", + "verdict": "Exploit attempts observed", + "verdict_why": [ + "4 request(s) matched a known exploit path.", + "Exploit-path hits present; HTTP verb mix unknown, so read cautiously.", + "Under 5 hits, so confidence is medium.", + "Not in any known-scanner range." + ], + "verdict_confidence": "medium", + "cve_probes": [] + } + }, + { + "asn": "AS51852", + "name": "PLI-AS", + "ip": "46.19.142.226", + "event_count": 6, + "lookup": { + "total_events": 6, + "first_seen": "2026-09-04T18:34:20", + "last_seen": "2026-09-04T19:27:10", + "asn_number": 51852, + "asn_org": "Private Layer INC", + "country_name": "Switzerland", + "country_code": "CH", + "ports_targeted": [ + 2087 + ], + "ports_targeted_count": 1, + "tls_event_count": 6, + "top_http_methods": [ + "GET", + "POST" + ], + "top_user_agents": [ + "Mozilla/5.0", + "Mozilla/5.0 (Windows NT 10.0; Win64; x64)" + ], + "top_url_paths": [ + "/openid_connect/cpanelid", + "/login/?login_only=1" + ], + "top_ja4_fingerprints": [ + "t13i190800_9dc949149365_97f8aa674fd9" + ], + "top_ja3_fingerprints": [ + "19e29534fd49dd27d09234e639c4057e" + ], + "top_hassh_fingerprints": [], + "client_cert_event_count": 0, + "client_cert_subjects": [], + "rdns": "hostedby.privatelayer.com", + "loader_hits": 0, + "exploit_hits": 0, + "bytes_sent": 944, + "unique_source_ips": 1, + "ioc": "46.19.142.226", + "window": "last 7 days", + "query_type": "ip", + "scanner": null, + "verdict_key": "probing", + "verdict": "Low-level probing", + "verdict_why": [ + "6 event(s), fewer than 10 distinct ports, no exploit payloads.", + "Not in any known-scanner range." + ], + "verdict_confidence": "low", + "cve_probes": [ + { + "cve_id": "CVE-2026-41940", + "title": "cPanel & WHM - Authentication Bypass via Session-File CRLF Injection", + "severity": "CRITICAL", + "actively_exploited": true + } + ] + } + }, + { + "asn": "AS51852", + "name": "PLI-AS", + "ip": "141.255.165.66", + "event_count": 5, + "lookup": { + "total_events": 5, + "first_seen": "2026-09-03T20:48:30", + "last_seen": "2026-09-04T11:46:33", + "asn_number": 51852, + "asn_org": "Private Layer INC", + "country_name": "Switzerland", + "country_code": "CH", + "ports_targeted": [ + 1723 + ], + "ports_targeted_count": 1, + "tls_event_count": 0, + "top_http_methods": [], + "top_user_agents": [], + "top_url_paths": [], + "top_ja4_fingerprints": [], + "top_ja3_fingerprints": [], + "top_hassh_fingerprints": [], + "client_cert_event_count": 0, + "client_cert_subjects": [], + "rdns": "4soho.com", + "loader_hits": 0, + "exploit_hits": 0, + "bytes_sent": 780, + "unique_source_ips": 1, + "ioc": "141.255.165.66", + "window": "last 7 days", + "query_type": "ip", + "scanner": null, + "verdict_key": "probing", + "verdict": "Low-level probing", + "verdict_why": [ + "5 event(s), fewer than 10 distinct ports, no exploit payloads.", + "Not in any known-scanner range." + ], + "verdict_confidence": "low", + "cve_probes": [] + } + }, + { + "asn": "AS51396", + "name": "PFCLOUD", + "ip": "204.76.203.222", + "event_count": 1159, + "lookup": { + "total_events": 1331, + "first_seen": "2026-09-02T09:47:23", + "last_seen": "2026-09-07T09:45:33", + "asn_number": 51396, + "asn_org": "Pfcloud UG (haftungsbeschrankt)", + "country_name": "The Netherlands", + "country_code": "NL", + "ports_targeted": [ + 5151, + 10118, + 11517, + 2222, + 10080, + 50009, + 7375, + 52120, + 50032, + 11004, + 11338, + 2018, + 8004, + 11238, + 8084, + 10803, + 6666, + 13292, + 9000, + 6652, + 9443, + 11148, + 5477, + 56789, + 10165, + 30006, + 10023, + 30011, + 10001, + 5001, + 2026, + 11635, + 11435, + 11409, + 2030, + 6128, + 11415, + 6969, + 20999, + 8095, + 9252, + 13509, + 5212, + 8045, + 50007, + 9054, + 12367, + 32536, + 3389, + 9098 + ], + "ports_targeted_count": 879, + "tls_event_count": 0, + "top_http_methods": [], + "top_user_agents": [], + "top_url_paths": [], + "top_ja4_fingerprints": [], + "top_ja3_fingerprints": [], + "top_hassh_fingerprints": [], + "client_cert_event_count": 0, + "client_cert_subjects": [], + "rdns": "204.76.203.222.ptr.pfcloud.network", + "loader_hits": 0, + "exploit_hits": 0, + "bytes_sent": 49337, + "unique_source_ips": 1, + "ioc": "204.76.203.222", + "window": "last 7 days", + "query_type": "ip", + "scanner": null, + "verdict_key": "scanning", + "verdict": "Unrecognized scanner", + "verdict_why": [ + "No exploit payloads observed.", + "Swept 879 distinct ports (threshold for a sweep is 10).", + "Not in any known-scanner range." + ], + "verdict_confidence": "medium", + "cve_probes": [] + } + }, + { + "asn": "AS51396", + "name": "PFCLOUD", + "ip": "204.76.203.221", + "event_count": 1154, + "lookup": { + "total_events": 1332, + "first_seen": "2026-09-02T09:47:23", + "last_seen": "2026-09-07T09:47:47", + "asn_number": 51396, + "asn_org": "Pfcloud UG (haftungsbeschrankt)", + "country_name": "The Netherlands", + "country_code": "NL", + "ports_targeted": [ + 5477, + 11617, + 11918, + 10080, + 11587, + 10231, + 5918, + 6588, + 11416, + 11000, + 20898, + 5507, + 31280, + 11181, + 9258, + 20274, + 9040, + 20132, + 1083, + 20621, + 11081, + 11111, + 11528, + 20023, + 6685, + 10031, + 20038, + 10023, + 3129, + 50008, + 11338, + 1080, + 10109, + 50028, + 8225, + 10000, + 50019, + 10157, + 9898, + 5513, + 1058, + 9999, + 18505, + 5108, + 10034, + 11404, + 9422, + 8045, + 10432, + 32260 + ], + "ports_targeted_count": 890, + "tls_event_count": 0, + "top_http_methods": [], + "top_user_agents": [], + "top_url_paths": [], + "top_ja4_fingerprints": [], + "top_ja3_fingerprints": [], + "top_hassh_fingerprints": [], + "client_cert_event_count": 0, + "client_cert_subjects": [], + "rdns": "204.76.203.221.ptr.pfcloud.network", + "loader_hits": 0, + "exploit_hits": 0, + "bytes_sent": 47840, + "unique_source_ips": 1, + "ioc": "204.76.203.221", + "window": "last 7 days", + "query_type": "ip", + "scanner": null, + "verdict_key": "scanning", + "verdict": "Unrecognized scanner", + "verdict_why": [ + "No exploit payloads observed.", + "Swept 890 distinct ports (threshold for a sweep is 10).", + "Not in any known-scanner range." + ], + "verdict_confidence": "medium", + "cve_probes": [] + } + }, + { + "asn": "AS51396", + "name": "PFCLOUD", + "ip": "204.76.203.213", + "event_count": 1123, + "lookup": { + "total_events": 1286, + "first_seen": "2026-09-02T09:53:18", + "last_seen": "2026-09-07T09:39:49", + "asn_number": 51396, + "asn_org": "Pfcloud UG (haftungsbeschrankt)", + "country_name": "The Netherlands", + "country_code": "NL", + "ports_targeted": [ + 11000, + 5518, + 20009, + 5112, + 11537, + 20035, + 11008, + 50029, + 56789, + 31460, + 4219, + 2028, + 3385, + 1112, + 10027, + 10140, + 5918, + 11918, + 10101, + 4544, + 20104, + 10033, + 30000, + 10109, + 10801, + 9898, + 20390, + 8891, + 10041, + 11322, + 10075, + 25412, + 49532, + 34491, + 50012, + 17891, + 50008, + 20015, + 20248, + 11644, + 33128, + 9002, + 1065, + 6724, + 18080, + 10137, + 11508, + 10821, + 20132, + 31526 + ], + "ports_targeted_count": 872, + "tls_event_count": 0, + "top_http_methods": [], + "top_user_agents": [], + "top_url_paths": [], + "top_ja4_fingerprints": [], + "top_ja3_fingerprints": [], + "top_hassh_fingerprints": [], + "client_cert_event_count": 0, + "client_cert_subjects": [], + "rdns": "204.76.203.213.ptr.pfcloud.network", + "loader_hits": 0, + "exploit_hits": 0, + "bytes_sent": 46038, + "unique_source_ips": 1, + "ioc": "204.76.203.213", + "window": "last 7 days", + "query_type": "ip", + "scanner": null, + "verdict_key": "scanning", + "verdict": "Unrecognized scanner", + "verdict_why": [ + "No exploit payloads observed.", + "Swept 872 distinct ports (threshold for a sweep is 10).", + "Not in any known-scanner range." + ], + "verdict_confidence": "medium", + "cve_probes": [] + } + }, + { + "asn": "AS216246", + "name": "RU-AEZA-AS", + "ip": "176.124.222.61", + "event_count": 1, + "lookup": { + "total_events": 1, + "first_seen": "2026-08-31T13:15:24", + "last_seen": "2026-08-31T13:15:24", + "asn_number": 216246, + "asn_org": "Aeza Group LLC", + "country_name": "Russia", + "country_code": "RU", + "ports_targeted": [ + 5432 + ], + "ports_targeted_count": 1, + "tls_event_count": 0, + "top_http_methods": [], + "top_user_agents": [], + "top_url_paths": [], + "top_ja4_fingerprints": [], + "top_ja3_fingerprints": [], + "top_hassh_fingerprints": [], + "client_cert_event_count": 0, + "client_cert_subjects": [], + "rdns": "", + "loader_hits": 0, + "exploit_hits": 0, + "bytes_sent": 8, + "unique_source_ips": 1, + "ioc": "176.124.222.61", + "window": "last 7 days", + "query_type": "ip", + "scanner": null, + "verdict_key": "probing", + "verdict": "Low-level probing", + "verdict_why": [ + "1 event(s), fewer than 10 distinct ports, no exploit payloads.", + "Not in any known-scanner range." + ], + "verdict_confidence": "low", + "cve_probes": [] + } + }, + { + "asn": "AS216246", + "name": "RU-AEZA-AS", + "ip": "45.151.101.38", + "event_count": 1, + "lookup": { + "total_events": 1, + "first_seen": "2026-09-03T20:05:03", + "last_seen": "2026-09-03T20:05:03", + "asn_number": 216246, + "asn_org": "Aeza Group LLC", + "country_name": "Russia", + "country_code": "RU", + "ports_targeted": [ + 8006 + ], + "ports_targeted_count": 1, + "tls_event_count": 1, + "top_http_methods": [ + "POST" + ], + "top_user_agents": [ + "Python-urllib/3.10" + ], + "top_url_paths": [ + "/api2/json/access/ticket" + ], + "top_ja4_fingerprints": [ + "t13i181000_85036bcba153_d41ae481755e" + ], + "top_ja3_fingerprints": [ + "8a9d5d0f12f7d43ee3af1c51d2998d99" + ], + "top_hassh_fingerprints": [], + "client_cert_event_count": 0, + "client_cert_subjects": [], + "rdns": "", + "loader_hits": 0, + "exploit_hits": 0, + "bytes_sent": 263, + "unique_source_ips": 1, + "ioc": "45.151.101.38", + "window": "last 7 days", + "query_type": "ip", + "scanner": null, + "verdict_key": "probing", + "verdict": "Low-level probing", + "verdict_why": [ + "1 event(s), fewer than 10 distinct ports, no exploit payloads.", + "Not in any known-scanner range." + ], + "verdict_confidence": "low", + "cve_probes": [ + { + "cve_id": "CVE-2023-54391", + "title": "Proxmox VE - Default Credentials with TFA Bypass", + "severity": "critical", + "actively_exploited": false + } + ] + } + }, + { + "asn": "AS200651", + "name": "FLOKINET", + "ip": "185.100.87.136", + "event_count": 24, + "lookup": { + "total_events": 22, + "first_seen": "2026-09-01T12:25:00", + "last_seen": "2026-09-07T09:47:19", + "asn_number": 200651, + "asn_org": "FlokiNET ehf", + "country_name": "Romania", + "country_code": "RO", + "ports_targeted": [ + 443, + 8443 + ], + "ports_targeted_count": 2, + "tls_event_count": 7, + "top_http_methods": [ + "GET", + "POST" + ], + "top_user_agents": [ + "SPARK COMMIT: 08059e95dacafe0bf6e5782f8e2c8ec9cd8c5a17", + "Mozilla/5.0 (Windows NT 10.0; Win64; x64)", + "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:104.71.6212.24) Gecko/25.2.4212.671 Firefox/2.0", + "Mozilla/5.0 (Android 12; Mobile; rv:117.0) Gecko/117.0 Focus/117.0" + ], + "top_url_paths": [ + "/api/checkin", + "/", + "/api/client/update?arch=amd64&commit=08059e95dacafe0bf6e5782f8e2c8ec9cd8c5a17&os=windows", + "/eventmanager", + "/images/transparentpix.gif" + ], + "top_ja4_fingerprints": [ + "t13i1909h2_9dc949149365_97f8aa674fd9" + ], + "top_ja3_fingerprints": [ + "7c1e207beb00684bbbe144f1b0abe1d5" + ], + "top_hassh_fingerprints": [], + "client_cert_event_count": 0, + "client_cert_subjects": [], + "rdns": "", + "loader_hits": 0, + "exploit_hits": 0, + "bytes_sent": 4631, + "unique_source_ips": 1, + "ioc": "185.100.87.136", + "window": "last 7 days", + "query_type": "ip", + "scanner": null, + "verdict_key": "probing", + "verdict": "Low-level probing", + "verdict_why": [ + "22 event(s), fewer than 10 distinct ports, no exploit payloads.", + "Not in any known-scanner range.", + "Sent 4,631 bytes despite few ports and no known exploit path: focused interaction with one service, worth a look." + ], + "verdict_confidence": "low", + "cve_probes": [] + } + }, + { + "asn": "AS198953", + "name": "PROTON66", + "ip": "176.120.22.61", + "event_count": 1597, + "lookup": { + "total_events": 1634, + "first_seen": "2026-08-31T11:36:25", + "last_seen": "2026-09-07T09:23:19", + "asn_number": 198953, + "asn_org": "Proton66 OOO", + "country_name": "Russia", + "country_code": "RU", + "ports_targeted": [ + 11433, + 5433, + 2433, + 15366, + 2017, + 22020, + 35366, + 23341, + 1002, + 13433, + 37628, + 5539, + 7433, + 1434, + 7788, + 5000, + 5678, + 40501, + 1433, + 14330, + 2866, + 9001, + 18433, + 41433, + 1438, + 55366, + 3433, + 1501, + 1800, + 15774, + 8989, + 9999, + 1455, + 42130, + 6000, + 5005, + 21433, + 8888, + 7366, + 4433, + 5368, + 1444, + 16433, + 22433, + 19433, + 1456, + 6602, + 51234, + 6240, + 2468 + ], + "ports_targeted_count": 270, + "tls_event_count": 0, + "top_http_methods": [], + "top_user_agents": [], + "top_url_paths": [], + "top_ja4_fingerprints": [], + "top_ja3_fingerprints": [], + "top_hassh_fingerprints": [], + "client_cert_event_count": 0, + "client_cert_subjects": [], + "rdns": "", + "loader_hits": 0, + "exploit_hits": 0, + "bytes_sent": 129048, + "unique_source_ips": 1, + "ioc": "176.120.22.61", + "window": "last 7 days", + "query_type": "ip", + "scanner": null, + "verdict_key": "scanning", + "verdict": "Unrecognized scanner", + "verdict_why": [ + "No exploit payloads observed.", + "Swept 270 distinct ports (threshold for a sweep is 10).", + "Not in any known-scanner range." + ], + "verdict_confidence": "medium", + "cve_probes": [] + } + }, + { + "asn": "AS198953", + "name": "PROTON66", + "ip": "176.120.22.240", + "event_count": 45, + "lookup": { + "total_events": 60, + "first_seen": "2026-09-01T05:50:24", + "last_seen": "2026-09-07T03:25:20", + "asn_number": 198953, + "asn_org": "Proton66 OOO", + "country_name": "Russia", + "country_code": "RU", + "ports_targeted": [ + 4443, + 8443, + 10443, + 500, + 1701, + 443, + 3799, + 8013, + 47, + 1812, + 1813, + 4500, + 8014, + 1443, + 2443, + 11443 + ], + "ports_targeted_count": 16, + "tls_event_count": 60, + "top_http_methods": [ + "GET" + ], + "top_user_agents": [ + "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:74.0) Gecko/20100101 Firefox/74.0 - github.com/anasbousselham/)" + ], + "top_url_paths": [ + "/remote/login?lang=en", + "/remote/fgt_lang?lang=/../../../..//////////dev/cmdb/sslvpn_websession" + ], + "top_ja4_fingerprints": [ + "t12i210600_76e208dd3e22_f28add8e7af0", + "t13i190800_9dc949149365_97f8aa674fd9" + ], + "top_ja3_fingerprints": [ + "c12f54a3f91dc7bafd92cb59fe009a35", + "89be98bbd4f065fe510fca4893cf8d9b" + ], + "top_hassh_fingerprints": [], + "client_cert_event_count": 0, + "client_cert_subjects": [], + "rdns": "", + "loader_hits": 0, + "exploit_hits": 0, + "bytes_sent": 8294, + "unique_source_ips": 1, + "ioc": "176.120.22.240", + "window": "last 7 days", + "query_type": "ip", + "scanner": null, + "verdict_key": "scanning", + "verdict": "Unrecognized scanner", + "verdict_why": [ + "No exploit payloads observed.", + "Swept 16 distinct ports (threshold for a sweep is 10).", + "Not in any known-scanner range." + ], + "verdict_confidence": "medium", + "cve_probes": [ + { + "cve_id": "CVE-2018-13379", + "title": "Fortinet FortiOS SSL VPN path traversal", + "severity": "critical", + "actively_exploited": true + } + ] + } + }, + { + "asn": "AS198953", + "name": "PROTON66", + "ip": "193.143.1.66", + "event_count": 24, + "lookup": { + "total_events": 24, + "first_seen": "2026-08-31T18:27:14", + "last_seen": "2026-09-04T21:27:35", + "asn_number": 198953, + "asn_org": "Proton66 OOO", + "country_name": "Russia", + "country_code": "RU", + "ports_targeted": [ + 3389, + 3384, + 3349, + 33894 + ], + "ports_targeted_count": 4, + "tls_event_count": 0, + "top_http_methods": [], + "top_user_agents": [], + "top_url_paths": [], + "top_ja4_fingerprints": [], + "top_ja3_fingerprints": [], + "top_hassh_fingerprints": [], + "client_cert_event_count": 0, + "client_cert_subjects": [], + "rdns": "", + "loader_hits": 0, + "exploit_hits": 0, + "bytes_sent": 1056, + "unique_source_ips": 1, + "ioc": "193.143.1.66", + "window": "last 7 days", + "query_type": "ip", + "scanner": null, + "verdict_key": "probing", + "verdict": "Low-level probing", + "verdict_why": [ + "24 event(s), fewer than 10 distinct ports, no exploit payloads.", + "Not in any known-scanner range." + ], + "verdict_confidence": "low", + "cve_probes": [] + } + } +] \ No newline at end of file diff --git a/kevlar/2026-09-07/honeylabs/loop-summary.json b/kevlar/2026-09-07/honeylabs/loop-summary.json new file mode 100644 index 0000000..4648c3e --- /dev/null +++ b/kevlar/2026-09-07/honeylabs/loop-summary.json @@ -0,0 +1,239 @@ +[ + { + "asn": "AS57043", + "name": "HOSTKEY-AS", + "ipRows": 2, + "uaRows": 0, + "events": 12, + "eventTotal": 12, + "errors": [] + }, + { + "asn": "AS209847", + "name": "THE", + "ipRows": 0, + "uaRows": 0, + "events": 0, + "eventTotal": 0, + "errors": [] + }, + { + "asn": "AS210644", + "name": "AEZA-AS", + "ipRows": 1, + "uaRows": 1, + "events": 0, + "eventTotal": 0, + "errors": [ + "events:unparseable" + ] + }, + { + "asn": "AS138915", + "name": "KAOPU-HK", + "ipRows": 0, + "uaRows": 0, + "events": 0, + "eventTotal": 0, + "errors": [] + }, + { + "asn": "AS14956", + "name": "ROUTERHOSTING", + "ipRows": 12, + "uaRows": 4, + "events": 0, + "eventTotal": 0, + "errors": [ + "events:unparseable" + ] + }, + { + "asn": "AS216139", + "name": "IRONHOST", + "ipRows": 0, + "uaRows": 0, + "events": 0, + "eventTotal": 0, + "errors": [] + }, + { + "asn": "AS51852", + "name": "PLI-AS", + "ipRows": 5, + "uaRows": 4, + "events": 0, + "eventTotal": 0, + "errors": [ + "events:unparseable" + ] + }, + { + "asn": "AS400992", + "name": "ZHOUYISAT-COMMUNICATIONS", + "ipRows": 0, + "uaRows": 0, + "events": 0, + "eventTotal": 0, + "errors": [] + }, + { + "asn": "AS33993", + "name": "UFO-AS", + "ipRows": 0, + "uaRows": 0, + "events": 0, + "eventTotal": 0, + "errors": [] + }, + { + "asn": "AS51396", + "name": "PFCLOUD", + "ipRows": 20, + "uaRows": 18, + "events": 0, + "eventTotal": 0, + "errors": [ + "events:unparseable" + ] + }, + { + "asn": "AS213702", + "name": "QWINS-LTD", + "ipRows": 0, + "uaRows": 0, + "events": 0, + "eventTotal": 0, + "errors": [] + }, + { + "asn": "AS216246", + "name": "RU-AEZA-AS", + "ipRows": 2, + "uaRows": 1, + "events": 2, + "eventTotal": 2, + "errors": [] + }, + { + "asn": "AS200651", + "name": "FLOKINET", + "ipRows": 1, + "uaRows": 5, + "events": 0, + "eventTotal": 0, + "errors": [ + "events:unparseable" + ] + }, + { + "asn": "AS30823", + "name": "AUROLOGIC", + "ipRows": 0, + "uaRows": 0, + "events": 0, + "eventTotal": 0, + "errors": [] + }, + { + "asn": "AS140666", + "name": "ADPL-AS-AP", + "ipRows": 0, + "uaRows": 0, + "events": 0, + "eventTotal": 0, + "errors": [] + }, + { + "asn": "AS214351", + "name": "FEMOIT", + "ipRows": 0, + "uaRows": 0, + "events": 0, + "eventTotal": 0, + "errors": [] + }, + { + "asn": "AS198953", + "name": "PROTON66", + "ipRows": 4, + "uaRows": 4, + "events": 0, + "eventTotal": 0, + "errors": [ + "events:unparseable" + ] + }, + { + "asn": "AS200593", + "name": "PROSPERO-AS", + "ipRows": 0, + "uaRows": 0, + "events": 0, + "eventTotal": 0, + "errors": [] + }, + { + "asn": "AS214940", + "name": "KPRONET", + "ipRows": 0, + "uaRows": 0, + "events": 0, + "eventTotal": 0, + "errors": [] + }, + { + "asn": "AS206728", + "name": "MEDIALAND-AS", + "ipRows": 0, + "uaRows": 0, + "events": 0, + "eventTotal": 0, + "errors": [] + }, + { + "asn": "AS211720", + "name": "Datashield", + "ipRows": 0, + "uaRows": 0, + "events": 0, + "eventTotal": 0, + "errors": [] + }, + { + "asn": "AS216309", + "name": "INVISIONTECH-GROUP-SRL", + "ipRows": 0, + "uaRows": 0, + "events": 0, + "eventTotal": 0, + "errors": [] + }, + { + "asn": "AS58854", + "name": "KAOPY", + "ipRows": 0, + "uaRows": 0, + "events": 0, + "eventTotal": 0, + "errors": [] + }, + { + "asn": "AS202685", + "name": "TR-ARKEL", + "ipRows": 0, + "uaRows": 0, + "events": 0, + "eventTotal": 0, + "errors": [] + }, + { + "asn": "AS394711", + "name": "KORGRID", + "ipRows": 0, + "uaRows": 0, + "events": 0, + "eventTotal": 0, + "errors": [] + } +] \ No newline at end of file diff --git a/kevlar/2026-09-07/honeylabs/top-attackers-ip-AS138915.json b/kevlar/2026-09-07/honeylabs/top-attackers-ip-AS138915.json new file mode 100644 index 0000000..0637a08 --- /dev/null +++ b/kevlar/2026-09-07/honeylabs/top-attackers-ip-AS138915.json @@ -0,0 +1 @@ +[] \ No newline at end of file diff --git a/kevlar/2026-09-07/honeylabs/top-attackers-ip-AS140666.json b/kevlar/2026-09-07/honeylabs/top-attackers-ip-AS140666.json new file mode 100644 index 0000000..0637a08 --- /dev/null +++ b/kevlar/2026-09-07/honeylabs/top-attackers-ip-AS140666.json @@ -0,0 +1 @@ +[] \ No newline at end of file diff --git a/kevlar/2026-09-07/honeylabs/top-attackers-ip-AS14956.json b/kevlar/2026-09-07/honeylabs/top-attackers-ip-AS14956.json new file mode 100644 index 0000000..c2237ad --- /dev/null +++ b/kevlar/2026-09-07/honeylabs/top-attackers-ip-AS14956.json @@ -0,0 +1,195 @@ +[ + { + "value": "::ffff:45.61.157.82", + "event_count": 32, + "unique_ips": 1, + "first_seen": "2026-09-04T01:15:12", + "last_seen": "2026-09-04T06:30:09", + "top_ports": [ + 445 + ], + "countries": [ + "US" + ], + "asn_org": "RouterHosting LLC", + "asn_number": 14956, + "country_name": "United States" + }, + { + "value": "::ffff:144.172.108.79", + "event_count": 24, + "unique_ips": 1, + "first_seen": "2026-09-04T20:02:59", + "last_seen": "2026-09-05T02:54:19", + "top_ports": [ + 445 + ], + "countries": [ + "US" + ], + "asn_org": "RouterHosting LLC", + "asn_number": 14956, + "country_name": "United States" + }, + { + "value": "::ffff:144.172.99.200", + "event_count": 16, + "unique_ips": 1, + "first_seen": "2026-09-01T07:55:37", + "last_seen": "2026-09-01T08:57:36", + "top_ports": [ + 445 + ], + "countries": [ + "US" + ], + "asn_org": "RouterHosting LLC", + "asn_number": 14956, + "country_name": "United States" + }, + { + "value": "::ffff:216.126.239.215", + "event_count": 8, + "unique_ips": 1, + "first_seen": "2026-09-06T00:12:30", + "last_seen": "2026-09-06T00:12:34", + "top_ports": [ + 445 + ], + "countries": [ + "US" + ], + "asn_org": "RouterHosting LLC", + "asn_number": 14956, + "country_name": "United States" + }, + { + "value": "::ffff:45.61.183.10", + "event_count": 4, + "unique_ips": 1, + "first_seen": "2026-09-06T01:13:05", + "last_seen": "2026-09-06T06:25:29", + "top_ports": [ + 445 + ], + "countries": [ + "US" + ], + "asn_org": "RouterHosting LLC", + "asn_number": 14956, + "country_name": "United States" + }, + { + "value": "::ffff:167.88.168.121", + "event_count": 4, + "unique_ips": 1, + "first_seen": "2026-09-03T06:47:31", + "last_seen": "2026-09-04T19:38:08", + "top_ports": [ + 2095, + 8008 + ], + "countries": [ + "US" + ], + "asn_org": "RouterHosting LLC", + "asn_number": 14956, + "country_name": "United States" + }, + { + "value": "::ffff:144.172.112.11", + "event_count": 2, + "unique_ips": 1, + "first_seen": "2026-09-04T18:11:24", + "last_seen": "2026-09-04T18:11:24", + "top_ports": [ + 445 + ], + "countries": [ + "US" + ], + "asn_org": "RouterHosting LLC", + "asn_number": 14956, + "country_name": "United States" + }, + { + "value": "::ffff:144.172.100.114", + "event_count": 1, + "unique_ips": 1, + "first_seen": "2026-09-02T07:32:32", + "last_seen": "2026-09-02T07:32:32", + "top_ports": [ + 1723 + ], + "countries": [ + "US" + ], + "asn_org": "RouterHosting LLC", + "asn_number": 14956, + "country_name": "United States" + }, + { + "value": "::ffff:144.172.99.12", + "event_count": 1, + "unique_ips": 1, + "first_seen": "2026-09-02T02:45:38", + "last_seen": "2026-09-02T02:45:38", + "top_ports": [ + 443 + ], + "countries": [ + "US" + ], + "asn_org": "RouterHosting LLC", + "asn_number": 14956, + "country_name": "United States" + }, + { + "value": "::ffff:45.61.149.189", + "event_count": 1, + "unique_ips": 1, + "first_seen": "2026-09-06T15:51:16", + "last_seen": "2026-09-06T15:51:16", + "top_ports": [ + 443 + ], + "countries": [ + "US" + ], + "asn_org": "RouterHosting LLC", + "asn_number": 14956, + "country_name": "United States" + }, + { + "value": "::ffff:216.126.227.187", + "event_count": 1, + "unique_ips": 1, + "first_seen": "2026-09-03T17:01:38", + "last_seen": "2026-09-03T17:01:38", + "top_ports": [ + 7860 + ], + "countries": [ + "US" + ], + "asn_org": "RouterHosting LLC", + "asn_number": 14956, + "country_name": "United States" + }, + { + "value": "::ffff:144.172.115.222", + "event_count": 1, + "unique_ips": 1, + "first_seen": "2026-09-01T09:05:26", + "last_seen": "2026-09-01T09:05:26", + "top_ports": [ + 5061 + ], + "countries": [ + "US" + ], + "asn_org": "RouterHosting LLC", + "asn_number": 14956, + "country_name": "United States" + } +] \ No newline at end of file diff --git a/kevlar/2026-09-07/honeylabs/top-attackers-ip-AS198953.json b/kevlar/2026-09-07/honeylabs/top-attackers-ip-AS198953.json new file mode 100644 index 0000000..fb76840 --- /dev/null +++ b/kevlar/2026-09-07/honeylabs/top-attackers-ip-AS198953.json @@ -0,0 +1,75 @@ +[ + { + "value": "::ffff:176.120.22.61", + "event_count": 1597, + "unique_ips": 1, + "first_seen": "2026-08-31T09:44:36", + "last_seen": "2026-09-04T10:20:48", + "top_ports": [ + 11433, + 14331, + 14330, + 35366, + 37628 + ], + "countries": [ + "RU" + ], + "asn_org": "Proton66 OOO", + "asn_number": 198953, + "country_name": "Russia" + }, + { + "value": "::ffff:176.120.22.240", + "event_count": 45, + "unique_ips": 1, + "first_seen": "2026-09-01T05:50:24", + "last_seen": "2026-09-06T14:40:21", + "top_ports": [ + 4443, + 8443, + 10443 + ], + "countries": [ + "RU" + ], + "asn_org": "Proton66 OOO", + "asn_number": 198953, + "country_name": "Russia" + }, + { + "value": "::ffff:193.143.1.66", + "event_count": 24, + "unique_ips": 1, + "first_seen": "2026-08-31T18:27:14", + "last_seen": "2026-09-04T21:27:35", + "top_ports": [ + 3389, + 3384, + 3349, + 33894 + ], + "countries": [ + "RU" + ], + "asn_org": "Proton66 OOO", + "asn_number": 198953, + "country_name": "Russia" + }, + { + "value": "::ffff:176.120.22.147", + "event_count": 3, + "unique_ips": 1, + "first_seen": "2026-09-03T02:10:02", + "last_seen": "2026-09-03T02:11:21", + "top_ports": [ + 8006 + ], + "countries": [ + "RU" + ], + "asn_org": "Proton66 OOO", + "asn_number": 198953, + "country_name": "Russia" + } +] \ No newline at end of file diff --git a/kevlar/2026-09-07/honeylabs/top-attackers-ip-AS200593.json b/kevlar/2026-09-07/honeylabs/top-attackers-ip-AS200593.json new file mode 100644 index 0000000..0637a08 --- /dev/null +++ b/kevlar/2026-09-07/honeylabs/top-attackers-ip-AS200593.json @@ -0,0 +1 @@ +[] \ No newline at end of file diff --git a/kevlar/2026-09-07/honeylabs/top-attackers-ip-AS200651.json b/kevlar/2026-09-07/honeylabs/top-attackers-ip-AS200651.json new file mode 100644 index 0000000..f29fdbd --- /dev/null +++ b/kevlar/2026-09-07/honeylabs/top-attackers-ip-AS200651.json @@ -0,0 +1,19 @@ +[ + { + "value": "::ffff:185.100.87.136", + "event_count": 24, + "unique_ips": 1, + "first_seen": "2026-08-31T01:12:02", + "last_seen": "2026-09-06T22:18:29", + "top_ports": [ + 443, + 8443 + ], + "countries": [ + "RO" + ], + "asn_org": "FlokiNET ehf", + "asn_number": 200651, + "country_name": "Romania" + } +] \ No newline at end of file diff --git a/kevlar/2026-09-07/honeylabs/top-attackers-ip-AS202685.json b/kevlar/2026-09-07/honeylabs/top-attackers-ip-AS202685.json new file mode 100644 index 0000000..0637a08 --- /dev/null +++ b/kevlar/2026-09-07/honeylabs/top-attackers-ip-AS202685.json @@ -0,0 +1 @@ +[] \ No newline at end of file diff --git a/kevlar/2026-09-07/honeylabs/top-attackers-ip-AS206728.json b/kevlar/2026-09-07/honeylabs/top-attackers-ip-AS206728.json new file mode 100644 index 0000000..0637a08 --- /dev/null +++ b/kevlar/2026-09-07/honeylabs/top-attackers-ip-AS206728.json @@ -0,0 +1 @@ +[] \ No newline at end of file diff --git a/kevlar/2026-09-07/honeylabs/top-attackers-ip-AS209847.json b/kevlar/2026-09-07/honeylabs/top-attackers-ip-AS209847.json new file mode 100644 index 0000000..0637a08 --- /dev/null +++ b/kevlar/2026-09-07/honeylabs/top-attackers-ip-AS209847.json @@ -0,0 +1 @@ +[] \ No newline at end of file diff --git a/kevlar/2026-09-07/honeylabs/top-attackers-ip-AS210644.json b/kevlar/2026-09-07/honeylabs/top-attackers-ip-AS210644.json new file mode 100644 index 0000000..df91df1 --- /dev/null +++ b/kevlar/2026-09-07/honeylabs/top-attackers-ip-AS210644.json @@ -0,0 +1,20 @@ +[ + { + "value": "::ffff:185.246.217.150", + "event_count": 51, + "unique_ips": 1, + "first_seen": "2026-08-31T22:44:34", + "last_seen": "2026-09-02T15:29:27", + "top_ports": [ + 443, + 2222, + 2375 + ], + "countries": [ + "NL" + ], + "asn_org": "Aeza Group LLC", + "asn_number": 210644, + "country_name": "The Netherlands" + } +] \ No newline at end of file diff --git a/kevlar/2026-09-07/honeylabs/top-attackers-ip-AS211720.json b/kevlar/2026-09-07/honeylabs/top-attackers-ip-AS211720.json new file mode 100644 index 0000000..0637a08 --- /dev/null +++ b/kevlar/2026-09-07/honeylabs/top-attackers-ip-AS211720.json @@ -0,0 +1 @@ +[] \ No newline at end of file diff --git a/kevlar/2026-09-07/honeylabs/top-attackers-ip-AS213702.json b/kevlar/2026-09-07/honeylabs/top-attackers-ip-AS213702.json new file mode 100644 index 0000000..0637a08 --- /dev/null +++ b/kevlar/2026-09-07/honeylabs/top-attackers-ip-AS213702.json @@ -0,0 +1 @@ +[] \ No newline at end of file diff --git a/kevlar/2026-09-07/honeylabs/top-attackers-ip-AS214351.json b/kevlar/2026-09-07/honeylabs/top-attackers-ip-AS214351.json new file mode 100644 index 0000000..0637a08 --- /dev/null +++ b/kevlar/2026-09-07/honeylabs/top-attackers-ip-AS214351.json @@ -0,0 +1 @@ +[] \ No newline at end of file diff --git a/kevlar/2026-09-07/honeylabs/top-attackers-ip-AS214940.json b/kevlar/2026-09-07/honeylabs/top-attackers-ip-AS214940.json new file mode 100644 index 0000000..0637a08 --- /dev/null +++ b/kevlar/2026-09-07/honeylabs/top-attackers-ip-AS214940.json @@ -0,0 +1 @@ +[] \ No newline at end of file diff --git a/kevlar/2026-09-07/honeylabs/top-attackers-ip-AS216139.json b/kevlar/2026-09-07/honeylabs/top-attackers-ip-AS216139.json new file mode 100644 index 0000000..0637a08 --- /dev/null +++ b/kevlar/2026-09-07/honeylabs/top-attackers-ip-AS216139.json @@ -0,0 +1 @@ +[] \ No newline at end of file diff --git a/kevlar/2026-09-07/honeylabs/top-attackers-ip-AS216246.json b/kevlar/2026-09-07/honeylabs/top-attackers-ip-AS216246.json new file mode 100644 index 0000000..1076b6a --- /dev/null +++ b/kevlar/2026-09-07/honeylabs/top-attackers-ip-AS216246.json @@ -0,0 +1,34 @@ +[ + { + "value": "::ffff:176.124.222.61", + "event_count": 1, + "unique_ips": 1, + "first_seen": "2026-08-31T13:15:24", + "last_seen": "2026-08-31T13:15:24", + "top_ports": [ + 5432 + ], + "countries": [ + "RU" + ], + "asn_org": "Aeza Group LLC", + "asn_number": 216246, + "country_name": "Russia" + }, + { + "value": "::ffff:45.151.101.38", + "event_count": 1, + "unique_ips": 1, + "first_seen": "2026-09-03T20:05:03", + "last_seen": "2026-09-03T20:05:03", + "top_ports": [ + 8006 + ], + "countries": [ + "RU" + ], + "asn_org": "Aeza Group LLC", + "asn_number": 216246, + "country_name": "Russia" + } +] \ No newline at end of file diff --git a/kevlar/2026-09-07/honeylabs/top-attackers-ip-AS216309.json b/kevlar/2026-09-07/honeylabs/top-attackers-ip-AS216309.json new file mode 100644 index 0000000..0637a08 --- /dev/null +++ b/kevlar/2026-09-07/honeylabs/top-attackers-ip-AS216309.json @@ -0,0 +1 @@ +[] \ No newline at end of file diff --git a/kevlar/2026-09-07/honeylabs/top-attackers-ip-AS30823.json b/kevlar/2026-09-07/honeylabs/top-attackers-ip-AS30823.json new file mode 100644 index 0000000..0637a08 --- /dev/null +++ b/kevlar/2026-09-07/honeylabs/top-attackers-ip-AS30823.json @@ -0,0 +1 @@ +[] \ No newline at end of file diff --git a/kevlar/2026-09-07/honeylabs/top-attackers-ip-AS33993.json b/kevlar/2026-09-07/honeylabs/top-attackers-ip-AS33993.json new file mode 100644 index 0000000..0637a08 --- /dev/null +++ b/kevlar/2026-09-07/honeylabs/top-attackers-ip-AS33993.json @@ -0,0 +1 @@ +[] \ No newline at end of file diff --git a/kevlar/2026-09-07/honeylabs/top-attackers-ip-AS394711.json b/kevlar/2026-09-07/honeylabs/top-attackers-ip-AS394711.json new file mode 100644 index 0000000..0637a08 --- /dev/null +++ b/kevlar/2026-09-07/honeylabs/top-attackers-ip-AS394711.json @@ -0,0 +1 @@ +[] \ No newline at end of file diff --git a/kevlar/2026-09-07/honeylabs/top-attackers-ip-AS400992.json b/kevlar/2026-09-07/honeylabs/top-attackers-ip-AS400992.json new file mode 100644 index 0000000..0637a08 --- /dev/null +++ b/kevlar/2026-09-07/honeylabs/top-attackers-ip-AS400992.json @@ -0,0 +1 @@ +[] \ No newline at end of file diff --git a/kevlar/2026-09-07/honeylabs/top-attackers-ip-AS51396.json b/kevlar/2026-09-07/honeylabs/top-attackers-ip-AS51396.json new file mode 100644 index 0000000..c72dab5 --- /dev/null +++ b/kevlar/2026-09-07/honeylabs/top-attackers-ip-AS51396.json @@ -0,0 +1,396 @@ +[ + { + "value": "::ffff:204.76.203.222", + "event_count": 1159, + "unique_ips": 1, + "first_seen": "2026-09-02T09:47:23", + "last_seen": "2026-09-06T23:43:17", + "top_ports": [ + 6128, + 11238, + 10803, + 11148, + 11415 + ], + "countries": [ + "NL" + ], + "asn_org": "Pfcloud UG (haftungsbeschrankt)", + "asn_number": 51396, + "country_name": "The Netherlands" + }, + { + "value": "::ffff:204.76.203.221", + "event_count": 1154, + "unique_ips": 1, + "first_seen": "2026-09-02T09:47:23", + "last_seen": "2026-09-06T23:57:44", + "top_ports": [ + 11587, + 10231, + 13246, + 31280, + 1083 + ], + "countries": [ + "NL" + ], + "asn_org": "Pfcloud UG (haftungsbeschrankt)", + "asn_number": 51396, + "country_name": "The Netherlands" + }, + { + "value": "::ffff:204.76.203.213", + "event_count": 1123, + "unique_ips": 1, + "first_seen": "2026-09-02T09:53:18", + "last_seen": "2026-09-06T23:40:09", + "top_ports": [ + 5112, + 3385, + 10140, + 50012, + 11644 + ], + "countries": [ + "NL" + ], + "asn_org": "Pfcloud UG (haftungsbeschrankt)", + "asn_number": 51396, + "country_name": "The Netherlands" + }, + { + "value": "::ffff:204.76.203.214", + "event_count": 1091, + "unique_ips": 1, + "first_seen": "2026-09-02T09:48:01", + "last_seen": "2026-09-06T23:57:44", + "top_ports": [ + 10119, + 21698, + 11100, + 15120, + 10006 + ], + "countries": [ + "NL" + ], + "asn_org": "Pfcloud UG (haftungsbeschrankt)", + "asn_number": 51396, + "country_name": "The Netherlands" + }, + { + "value": "::ffff:204.76.203.49", + "event_count": 836, + "unique_ips": 1, + "first_seen": "2026-08-31T00:54:43", + "last_seen": "2026-09-06T22:29:18", + "top_ports": [ + 8080, + 1081, + 888, + 8888, + 4145 + ], + "countries": [ + "NL" + ], + "asn_org": "Pfcloud UG (haftungsbeschrankt)", + "asn_number": 51396, + "country_name": "The Netherlands" + }, + { + "value": "::ffff:176.65.148.153", + "event_count": 453, + "unique_ips": 1, + "first_seen": "2026-09-01T22:14:32", + "last_seen": "2026-09-04T09:28:19", + "top_ports": [ + 3389, + 3318, + 3324, + 3349, + 3372 + ], + "countries": [ + "NL" + ], + "asn_org": "Pfcloud UG (haftungsbeschrankt)", + "asn_number": 51396, + "country_name": "The Netherlands" + }, + { + "value": "::ffff:204.76.203.7", + "event_count": 446, + "unique_ips": 1, + "first_seen": "2026-08-31T00:35:35", + "last_seen": "2026-09-03T00:22:11", + "top_ports": [ + 24575, + 24001, + 24444, + 20129, + 20119 + ], + "countries": [ + "NL" + ], + "asn_org": "Pfcloud UG (haftungsbeschrankt)", + "asn_number": 51396, + "country_name": "The Netherlands" + }, + { + "value": "::ffff:45.135.193.193", + "event_count": 400, + "unique_ips": 1, + "first_seen": "2026-08-31T11:30:54", + "last_seen": "2026-09-06T23:26:34", + "top_ports": [ + 8888, + 3128, + 81, + 80, + 8080 + ], + "countries": [ + "DE" + ], + "asn_org": "Pfcloud UG (haftungsbeschrankt)", + "asn_number": 51396, + "country_name": "Germany" + }, + { + "value": "::ffff:45.135.194.113", + "event_count": 220, + "unique_ips": 1, + "first_seen": "2026-08-31T01:05:13", + "last_seen": "2026-09-06T21:38:43", + "top_ports": [ + 666, + 555, + 8888, + 90, + 8000 + ], + "countries": [ + "DE" + ], + "asn_org": "Pfcloud UG (haftungsbeschrankt)", + "asn_number": 51396, + "country_name": "Germany" + }, + { + "value": "::ffff:45.135.193.198", + "event_count": 200, + "unique_ips": 1, + "first_seen": "2026-08-31T01:11:46", + "last_seen": "2026-09-06T07:38:01", + "top_ports": [ + 8181, + 8080, + 18080, + 9999, + 8000 + ], + "countries": [ + "DE" + ], + "asn_org": "Pfcloud UG (haftungsbeschrankt)", + "asn_number": 51396, + "country_name": "Germany" + }, + { + "value": "::ffff:176.65.148.226", + "event_count": 126, + "unique_ips": 1, + "first_seen": "2026-08-31T02:03:10", + "last_seen": "2026-09-06T17:30:01", + "top_ports": [ + 80, + 443, + 8500, + 8090, + 3000 + ], + "countries": [ + "NL" + ], + "asn_org": "Pfcloud UG (haftungsbeschrankt)", + "asn_number": 51396, + "country_name": "The Netherlands" + }, + { + "value": "::ffff:176.65.149.212", + "event_count": 106, + "unique_ips": 1, + "first_seen": "2026-08-31T00:00:25", + "last_seen": "2026-09-06T23:04:39", + "top_ports": [ + 7994, + 7993, + 7990, + 8010, + 8016 + ], + "countries": [ + "NL" + ], + "asn_org": "Pfcloud UG (haftungsbeschrankt)", + "asn_number": 51396, + "country_name": "The Netherlands" + }, + { + "value": "::ffff:176.65.149.27", + "event_count": 102, + "unique_ips": 1, + "first_seen": "2026-08-31T00:56:02", + "last_seen": "2026-09-06T23:58:26", + "top_ports": [ + 38002, + 38026, + 38000, + 38020, + 38001 + ], + "countries": [ + "NL" + ], + "asn_org": "Pfcloud UG (haftungsbeschrankt)", + "asn_number": 51396, + "country_name": "The Netherlands" + }, + { + "value": "::ffff:176.65.149.31", + "event_count": 99, + "unique_ips": 1, + "first_seen": "2026-08-31T01:21:26", + "last_seen": "2026-09-06T23:32:25", + "top_ports": [ + 1883, + 1908, + 1906, + 1897, + 1905 + ], + "countries": [ + "NL" + ], + "asn_org": "Pfcloud UG (haftungsbeschrankt)", + "asn_number": 51396, + "country_name": "The Netherlands" + }, + { + "value": "::ffff:176.65.149.30", + "event_count": 89, + "unique_ips": 1, + "first_seen": "2026-08-31T00:39:52", + "last_seen": "2026-09-06T22:50:28", + "top_ports": [ + 31975, + 32019, + 31973, + 31974, + 32017 + ], + "countries": [ + "NL" + ], + "asn_org": "Pfcloud UG (haftungsbeschrankt)", + "asn_number": 51396, + "country_name": "The Netherlands" + }, + { + "value": "::ffff:176.65.148.93", + "event_count": 67, + "unique_ips": 1, + "first_seen": "2026-09-01T07:37:27", + "last_seen": "2026-09-06T22:49:21", + "top_ports": [ + 1082, + 1085, + 1080, + 1094, + 1079 + ], + "countries": [ + "NL" + ], + "asn_org": "Pfcloud UG (haftungsbeschrankt)", + "asn_number": 51396, + "country_name": "The Netherlands" + }, + { + "value": "::ffff:176.65.149.236", + "event_count": 62, + "unique_ips": 1, + "first_seen": "2026-08-31T05:44:55", + "last_seen": "2026-09-06T21:26:21", + "top_ports": [ + 8000, + 9000, + 82, + 88, + 443 + ], + "countries": [ + "NL" + ], + "asn_org": "Pfcloud UG (haftungsbeschrankt)", + "asn_number": 51396, + "country_name": "The Netherlands" + }, + { + "value": "::ffff:204.76.203.4", + "event_count": 51, + "unique_ips": 1, + "first_seen": "2026-08-31T00:03:33", + "last_seen": "2026-08-31T11:42:35", + "top_ports": [ + 25564, + 25566, + 25565 + ], + "countries": [ + "NL" + ], + "asn_org": "Pfcloud UG (haftungsbeschrankt)", + "asn_number": 51396, + "country_name": "The Netherlands" + }, + { + "value": "::ffff:176.65.148.156", + "event_count": 51, + "unique_ips": 1, + "first_seen": "2026-08-31T15:53:23", + "last_seen": "2026-09-05T11:36:49", + "top_ports": [ + 25565 + ], + "countries": [ + "NL" + ], + "asn_org": "Pfcloud UG (haftungsbeschrankt)", + "asn_number": 51396, + "country_name": "The Netherlands" + }, + { + "value": "::ffff:176.65.134.48", + "event_count": 48, + "unique_ips": 1, + "first_seen": "2026-09-05T04:30:55", + "last_seen": "2026-09-06T23:47:43", + "top_ports": [ + 4550, + 4747, + 4700, + 4646, + 4567 + ], + "countries": [ + "DE" + ], + "asn_org": "Pfcloud UG (haftungsbeschrankt)", + "asn_number": 51396, + "country_name": "Germany" + } +] \ No newline at end of file diff --git a/kevlar/2026-09-07/honeylabs/top-attackers-ip-AS51852.json b/kevlar/2026-09-07/honeylabs/top-attackers-ip-AS51852.json new file mode 100644 index 0000000..489e877 --- /dev/null +++ b/kevlar/2026-09-07/honeylabs/top-attackers-ip-AS51852.json @@ -0,0 +1,84 @@ +[ + { + "value": "::ffff:179.43.150.26", + "event_count": 16, + "unique_ips": 1, + "first_seen": "2026-08-31T15:32:52", + "last_seen": "2026-08-31T16:49:55", + "top_ports": [ + 8443 + ], + "countries": [ + "CH" + ], + "asn_org": "Private Layer INC", + "asn_number": 51852, + "country_name": "Switzerland" + }, + { + "value": "::ffff:46.19.142.226", + "event_count": 6, + "unique_ips": 1, + "first_seen": "2026-09-04T18:34:20", + "last_seen": "2026-09-04T19:27:10", + "top_ports": [ + 2087 + ], + "countries": [ + "CH" + ], + "asn_org": "Private Layer INC", + "asn_number": 51852, + "country_name": "Switzerland" + }, + { + "value": "::ffff:141.255.165.66", + "event_count": 5, + "unique_ips": 1, + "first_seen": "2026-09-03T20:48:30", + "last_seen": "2026-09-04T11:46:33", + "top_ports": [ + 1723 + ], + "countries": [ + "CH" + ], + "asn_org": "Private Layer INC", + "asn_number": 51852, + "country_name": "Switzerland" + }, + { + "value": "::ffff:179.43.186.220", + "event_count": 3, + "unique_ips": 1, + "first_seen": "2026-09-01T12:06:48", + "last_seen": "2026-09-01T12:06:54", + "top_ports": [ + 80, + 443 + ], + "countries": [ + "CH" + ], + "asn_org": "Private Layer INC", + "asn_number": 51852, + "country_name": "Switzerland" + }, + { + "value": "::ffff:179.43.146.27", + "event_count": 2, + "unique_ips": 1, + "first_seen": "2026-09-01T07:55:46", + "last_seen": "2026-09-02T18:13:22", + "top_ports": [ + 32400, + 8085 + ], + "countries": [ + "CH" + ], + "asn_org": "Private Layer INC", + "asn_number": 51852, + "country_name": "Switzerland" + } +] \ No newline at end of file diff --git a/kevlar/2026-09-07/honeylabs/top-attackers-ip-AS57043.json b/kevlar/2026-09-07/honeylabs/top-attackers-ip-AS57043.json new file mode 100644 index 0000000..97c2523 --- /dev/null +++ b/kevlar/2026-09-07/honeylabs/top-attackers-ip-AS57043.json @@ -0,0 +1,38 @@ +[ + { + "value": "::ffff:163.5.16.6", + "event_count": 8, + "unique_ips": 1, + "first_seen": "2026-09-02T21:02:40", + "last_seen": "2026-09-02T21:19:46", + "top_ports": [ + 19571, + 44981, + 14603, + 5070, + 20271 + ], + "countries": [ + "GB" + ], + "asn_org": "Hostkey B.v.", + "asn_number": 57043, + "country_name": "United Kingdom" + }, + { + "value": "::ffff:82.39.165.100", + "event_count": 4, + "unique_ips": 1, + "first_seen": "2026-08-31T15:39:39", + "last_seen": "2026-09-03T03:47:57", + "top_ports": [ + 22 + ], + "countries": [ + "DE" + ], + "asn_org": "Hostkey B.v.", + "asn_number": 57043, + "country_name": "Germany" + } +] \ No newline at end of file diff --git a/kevlar/2026-09-07/honeylabs/top-attackers-ip-AS58854.json b/kevlar/2026-09-07/honeylabs/top-attackers-ip-AS58854.json new file mode 100644 index 0000000..0637a08 --- /dev/null +++ b/kevlar/2026-09-07/honeylabs/top-attackers-ip-AS58854.json @@ -0,0 +1 @@ +[] \ No newline at end of file diff --git a/kevlar/2026-09-07/honeylabs/top-attackers-ua-AS138915.json b/kevlar/2026-09-07/honeylabs/top-attackers-ua-AS138915.json new file mode 100644 index 0000000..0637a08 --- /dev/null +++ b/kevlar/2026-09-07/honeylabs/top-attackers-ua-AS138915.json @@ -0,0 +1 @@ +[] \ No newline at end of file diff --git a/kevlar/2026-09-07/honeylabs/top-attackers-ua-AS140666.json b/kevlar/2026-09-07/honeylabs/top-attackers-ua-AS140666.json new file mode 100644 index 0000000..0637a08 --- /dev/null +++ b/kevlar/2026-09-07/honeylabs/top-attackers-ua-AS140666.json @@ -0,0 +1 @@ +[] \ No newline at end of file diff --git a/kevlar/2026-09-07/honeylabs/top-attackers-ua-AS14956.json b/kevlar/2026-09-07/honeylabs/top-attackers-ua-AS14956.json new file mode 100644 index 0000000..70c1586 --- /dev/null +++ b/kevlar/2026-09-07/honeylabs/top-attackers-ua-AS14956.json @@ -0,0 +1,55 @@ +[ + { + "value": "Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0", + "event_count": 4, + "unique_ips": 1, + "first_seen": "2026-09-03T06:47:31", + "last_seen": "2026-09-04T19:38:08", + "top_ports": [ + 2095, + 8008 + ], + "countries": [ + "US" + ] + }, + { + "value": "Python-urllib/3.13", + "event_count": 1, + "unique_ips": 1, + "first_seen": "2026-09-06T15:51:16", + "last_seen": "2026-09-06T15:51:16", + "top_ports": [ + 443 + ], + "countries": [ + "US" + ] + }, + { + "value": "Python/3.13 aiohttp/3.13.5", + "event_count": 1, + "unique_ips": 1, + "first_seen": "2026-09-03T17:01:38", + "last_seen": "2026-09-03T17:01:38", + "top_ports": [ + 7860 + ], + "countries": [ + "US" + ] + }, + { + "value": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36", + "event_count": 1, + "unique_ips": 1, + "first_seen": "2026-09-02T02:45:38", + "last_seen": "2026-09-02T02:45:38", + "top_ports": [ + 443 + ], + "countries": [ + "US" + ] + } +] \ No newline at end of file diff --git a/kevlar/2026-09-07/honeylabs/top-attackers-ua-AS198953.json b/kevlar/2026-09-07/honeylabs/top-attackers-ua-AS198953.json new file mode 100644 index 0000000..009a778 --- /dev/null +++ b/kevlar/2026-09-07/honeylabs/top-attackers-ua-AS198953.json @@ -0,0 +1,54 @@ +[ + { + "value": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.1 Mobile/15E148 Safari/604.1", + "event_count": 1, + "unique_ips": 1, + "first_seen": "2026-09-03T02:11:21", + "last_seen": "2026-09-03T02:11:21", + "top_ports": [ + 8006 + ], + "countries": [ + "RU" + ] + }, + { + "value": "Mozilla/5.0 (Macintosh, Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/15.6.1 Safari/605.1.15", + "event_count": 1, + "unique_ips": 1, + "first_seen": "2026-09-03T02:10:04", + "last_seen": "2026-09-03T02:10:04", + "top_ports": [ + 8006 + ], + "countries": [ + "RU" + ] + }, + { + "value": "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:74.0) Gecko/20100101 Firefox/74.0 - github.com/anasbousselham/)", + "event_count": 1, + "unique_ips": 1, + "first_seen": "2026-09-01T05:50:24", + "last_seen": "2026-09-01T05:50:24", + "top_ports": [ + 10443 + ], + "countries": [ + "RU" + ] + }, + { + "value": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36", + "event_count": 1, + "unique_ips": 1, + "first_seen": "2026-09-03T02:10:02", + "last_seen": "2026-09-03T02:10:02", + "top_ports": [ + 8006 + ], + "countries": [ + "RU" + ] + } +] \ No newline at end of file diff --git a/kevlar/2026-09-07/honeylabs/top-attackers-ua-AS200593.json b/kevlar/2026-09-07/honeylabs/top-attackers-ua-AS200593.json new file mode 100644 index 0000000..0637a08 --- /dev/null +++ b/kevlar/2026-09-07/honeylabs/top-attackers-ua-AS200593.json @@ -0,0 +1 @@ +[] \ No newline at end of file diff --git a/kevlar/2026-09-07/honeylabs/top-attackers-ua-AS200651.json b/kevlar/2026-09-07/honeylabs/top-attackers-ua-AS200651.json new file mode 100644 index 0000000..d10948d --- /dev/null +++ b/kevlar/2026-09-07/honeylabs/top-attackers-ua-AS200651.json @@ -0,0 +1,67 @@ +[ + { + "value": "SPARK COMMIT: 08059e95dacafe0bf6e5782f8e2c8ec9cd8c5a17", + "event_count": 3, + "unique_ips": 1, + "first_seen": "2026-09-03T20:46:54", + "last_seen": "2026-09-03T23:55:20", + "top_ports": [ + 443 + ], + "countries": [ + "RO" + ] + }, + { + "value": "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:104.71.6212.24) Gecko/25.2.4212.671 Firefox/2.0", + "event_count": 3, + "unique_ips": 1, + "first_seen": "2026-09-03T20:46:53", + "last_seen": "2026-09-03T23:55:19", + "top_ports": [ + 443 + ], + "countries": [ + "RO" + ] + }, + { + "value": "Mozilla/5.0 (Android 12; Mobile; rv:117.0) Gecko/117.0 Focus/117.0", + "event_count": 3, + "unique_ips": 1, + "first_seen": "2026-09-06T20:33:31", + "last_seen": "2026-09-06T22:18:29", + "top_ports": [ + 443 + ], + "countries": [ + "RO" + ] + }, + { + "value": "Mozilla/5.0 (Windows NT 10.0; Win64; x64)", + "event_count": 3, + "unique_ips": 1, + "first_seen": "2026-09-01T12:25:00", + "last_seen": "2026-09-01T14:07:55", + "top_ports": [ + 8443 + ], + "countries": [ + "RO" + ] + }, + { + "value": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3 rv:3.0; eu-FR) AppleWebKit/533.4.2 (KHTML, like Gecko) Version/5.0.1 Safari/533.4.2", + "event_count": 3, + "unique_ips": 1, + "first_seen": "2026-08-31T01:12:02", + "last_seen": "2026-08-31T06:06:56", + "top_ports": [ + 443 + ], + "countries": [ + "RO" + ] + } +] \ No newline at end of file diff --git a/kevlar/2026-09-07/honeylabs/top-attackers-ua-AS202685.json b/kevlar/2026-09-07/honeylabs/top-attackers-ua-AS202685.json new file mode 100644 index 0000000..0637a08 --- /dev/null +++ b/kevlar/2026-09-07/honeylabs/top-attackers-ua-AS202685.json @@ -0,0 +1 @@ +[] \ No newline at end of file diff --git a/kevlar/2026-09-07/honeylabs/top-attackers-ua-AS206728.json b/kevlar/2026-09-07/honeylabs/top-attackers-ua-AS206728.json new file mode 100644 index 0000000..0637a08 --- /dev/null +++ b/kevlar/2026-09-07/honeylabs/top-attackers-ua-AS206728.json @@ -0,0 +1 @@ +[] \ No newline at end of file diff --git a/kevlar/2026-09-07/honeylabs/top-attackers-ua-AS209847.json b/kevlar/2026-09-07/honeylabs/top-attackers-ua-AS209847.json new file mode 100644 index 0000000..0637a08 --- /dev/null +++ b/kevlar/2026-09-07/honeylabs/top-attackers-ua-AS209847.json @@ -0,0 +1 @@ +[] \ No newline at end of file diff --git a/kevlar/2026-09-07/honeylabs/top-attackers-ua-AS210644.json b/kevlar/2026-09-07/honeylabs/top-attackers-ua-AS210644.json new file mode 100644 index 0000000..5836a89 --- /dev/null +++ b/kevlar/2026-09-07/honeylabs/top-attackers-ua-AS210644.json @@ -0,0 +1,16 @@ +[ + { + "value": "libredtail-http", + "event_count": 50, + "unique_ips": 1, + "first_seen": "2026-08-31T22:44:34", + "last_seen": "2026-09-02T15:29:27", + "top_ports": [ + 443, + 2375 + ], + "countries": [ + "NL" + ] + } +] \ No newline at end of file diff --git a/kevlar/2026-09-07/honeylabs/top-attackers-ua-AS211720.json b/kevlar/2026-09-07/honeylabs/top-attackers-ua-AS211720.json new file mode 100644 index 0000000..0637a08 --- /dev/null +++ b/kevlar/2026-09-07/honeylabs/top-attackers-ua-AS211720.json @@ -0,0 +1 @@ +[] \ No newline at end of file diff --git a/kevlar/2026-09-07/honeylabs/top-attackers-ua-AS213702.json b/kevlar/2026-09-07/honeylabs/top-attackers-ua-AS213702.json new file mode 100644 index 0000000..0637a08 --- /dev/null +++ b/kevlar/2026-09-07/honeylabs/top-attackers-ua-AS213702.json @@ -0,0 +1 @@ +[] \ No newline at end of file diff --git a/kevlar/2026-09-07/honeylabs/top-attackers-ua-AS214351.json b/kevlar/2026-09-07/honeylabs/top-attackers-ua-AS214351.json new file mode 100644 index 0000000..0637a08 --- /dev/null +++ b/kevlar/2026-09-07/honeylabs/top-attackers-ua-AS214351.json @@ -0,0 +1 @@ +[] \ No newline at end of file diff --git a/kevlar/2026-09-07/honeylabs/top-attackers-ua-AS214940.json b/kevlar/2026-09-07/honeylabs/top-attackers-ua-AS214940.json new file mode 100644 index 0000000..0637a08 --- /dev/null +++ b/kevlar/2026-09-07/honeylabs/top-attackers-ua-AS214940.json @@ -0,0 +1 @@ +[] \ No newline at end of file diff --git a/kevlar/2026-09-07/honeylabs/top-attackers-ua-AS216139.json b/kevlar/2026-09-07/honeylabs/top-attackers-ua-AS216139.json new file mode 100644 index 0000000..0637a08 --- /dev/null +++ b/kevlar/2026-09-07/honeylabs/top-attackers-ua-AS216139.json @@ -0,0 +1 @@ +[] \ No newline at end of file diff --git a/kevlar/2026-09-07/honeylabs/top-attackers-ua-AS216246.json b/kevlar/2026-09-07/honeylabs/top-attackers-ua-AS216246.json new file mode 100644 index 0000000..9396a02 --- /dev/null +++ b/kevlar/2026-09-07/honeylabs/top-attackers-ua-AS216246.json @@ -0,0 +1,15 @@ +[ + { + "value": "Python-urllib/3.10", + "event_count": 1, + "unique_ips": 1, + "first_seen": "2026-09-03T20:05:03", + "last_seen": "2026-09-03T20:05:03", + "top_ports": [ + 8006 + ], + "countries": [ + "RU" + ] + } +] \ No newline at end of file diff --git a/kevlar/2026-09-07/honeylabs/top-attackers-ua-AS216309.json b/kevlar/2026-09-07/honeylabs/top-attackers-ua-AS216309.json new file mode 100644 index 0000000..0637a08 --- /dev/null +++ b/kevlar/2026-09-07/honeylabs/top-attackers-ua-AS216309.json @@ -0,0 +1 @@ +[] \ No newline at end of file diff --git a/kevlar/2026-09-07/honeylabs/top-attackers-ua-AS30823.json b/kevlar/2026-09-07/honeylabs/top-attackers-ua-AS30823.json new file mode 100644 index 0000000..0637a08 --- /dev/null +++ b/kevlar/2026-09-07/honeylabs/top-attackers-ua-AS30823.json @@ -0,0 +1 @@ +[] \ No newline at end of file diff --git a/kevlar/2026-09-07/honeylabs/top-attackers-ua-AS33993.json b/kevlar/2026-09-07/honeylabs/top-attackers-ua-AS33993.json new file mode 100644 index 0000000..0637a08 --- /dev/null +++ b/kevlar/2026-09-07/honeylabs/top-attackers-ua-AS33993.json @@ -0,0 +1 @@ +[] \ No newline at end of file diff --git a/kevlar/2026-09-07/honeylabs/top-attackers-ua-AS394711.json b/kevlar/2026-09-07/honeylabs/top-attackers-ua-AS394711.json new file mode 100644 index 0000000..0637a08 --- /dev/null +++ b/kevlar/2026-09-07/honeylabs/top-attackers-ua-AS394711.json @@ -0,0 +1 @@ +[] \ No newline at end of file diff --git a/kevlar/2026-09-07/honeylabs/top-attackers-ua-AS400992.json b/kevlar/2026-09-07/honeylabs/top-attackers-ua-AS400992.json new file mode 100644 index 0000000..0637a08 --- /dev/null +++ b/kevlar/2026-09-07/honeylabs/top-attackers-ua-AS400992.json @@ -0,0 +1 @@ +[] \ No newline at end of file diff --git a/kevlar/2026-09-07/honeylabs/top-attackers-ua-AS51396.json b/kevlar/2026-09-07/honeylabs/top-attackers-ua-AS51396.json new file mode 100644 index 0000000..933fc46 --- /dev/null +++ b/kevlar/2026-09-07/honeylabs/top-attackers-ua-AS51396.json @@ -0,0 +1,254 @@ +[ + { + "value": "Go-http-client/1.1", + "event_count": 372, + "unique_ips": 5, + "first_seen": "2026-08-31T00:35:35", + "last_seen": "2026-09-06T23:47:43", + "top_ports": [ + 4550, + 4747, + 222, + 8000, + 11434 + ], + "countries": [ + "NL", + "DE" + ] + }, + { + "value": "0day", + "event_count": 200, + "unique_ips": 1, + "first_seen": "2026-08-31T01:11:46", + "last_seen": "2026-09-06T07:38:01", + "top_ports": [ + 8181, + 8080, + 18080, + 18088, + 8888 + ], + "countries": [ + "DE" + ] + }, + { + "value": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36", + "event_count": 126, + "unique_ips": 1, + "first_seen": "2026-08-31T02:03:10", + "last_seen": "2026-09-06T17:30:01", + "top_ports": [ + 80, + 443, + 8500, + 8090, + 3000 + ], + "countries": [ + "NL" + ] + }, + { + "value": "Mozilla/5.0 zgrab/0.x", + "event_count": 95, + "unique_ips": 5, + "first_seen": "2026-08-31T00:50:18", + "last_seen": "2026-09-06T21:26:21", + "top_ports": [ + 8000, + 8001, + 443, + 9000, + 88 + ], + "countries": [ + "NL" + ] + }, + { + "value": "kubo-probe/1.0", + "event_count": 12, + "unique_ips": 1, + "first_seen": "2026-08-31T11:11:43", + "last_seen": "2026-09-02T16:28:23", + "top_ports": [ + 5001, + 8080 + ], + "countries": [ + "DE" + ] + }, + { + "value": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36", + "event_count": 10, + "unique_ips": 1, + "first_seen": "2026-08-31T10:08:26", + "last_seen": "2026-09-05T08:05:52", + "top_ports": [ + 80 + ], + "countries": [ + "NL" + ] + }, + { + "value": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36", + "event_count": 6, + "unique_ips": 1, + "first_seen": "2026-09-05T12:54:20", + "last_seen": "2026-09-05T13:26:20", + "top_ports": [ + 8090 + ], + "countries": [ + "NL" + ] + }, + { + "value": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36", + "event_count": 4, + "unique_ips": 1, + "first_seen": "2026-09-01T09:55:22", + "last_seen": "2026-09-02T01:32:40", + "top_ports": [ + 80 + ], + "countries": [ + "NL" + ] + }, + { + "value": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.3 Safari/605.1.15", + "event_count": 1, + "unique_ips": 1, + "first_seen": "2026-09-01T10:40:15", + "last_seen": "2026-09-01T10:40:15", + "top_ports": [ + 443 + ], + "countries": [ + "UA" + ] + }, + { + "value": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1 Safari/605.1.15", + "event_count": 1, + "unique_ips": 1, + "first_seen": "2026-09-01T06:45:24", + "last_seen": "2026-09-01T06:45:24", + "top_ports": [ + 443 + ], + "countries": [ + "UA" + ] + }, + { + "value": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36", + "event_count": 1, + "unique_ips": 1, + "first_seen": "2026-08-31T07:27:42", + "last_seen": "2026-08-31T07:27:42", + "top_ports": [ + 443 + ], + "countries": [ + "UA" + ] + }, + { + "value": "Mozilla/5.0 (Knoppix; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36", + "event_count": 1, + "unique_ips": 1, + "first_seen": "2026-08-31T09:52:59", + "last_seen": "2026-08-31T09:52:59", + "top_ports": [ + 443 + ], + "countries": [ + "UA" + ] + }, + { + "value": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Safari/537.36 Edge/12.246", + "event_count": 1, + "unique_ips": 1, + "first_seen": "2026-09-03T10:27:07", + "last_seen": "2026-09-03T10:27:07", + "top_ports": [ + 8080 + ], + "countries": [ + "NL" + ] + }, + { + "value": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36", + "event_count": 1, + "unique_ips": 1, + "first_seen": "2026-08-31T18:59:50", + "last_seen": "2026-08-31T18:59:50", + "top_ports": [ + 443 + ], + "countries": [ + "UA" + ] + }, + { + "value": "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0", + "event_count": 1, + "unique_ips": 1, + "first_seen": "2026-09-01T07:30:45", + "last_seen": "2026-09-01T07:30:45", + "top_ports": [ + 443 + ], + "countries": [ + "UA" + ] + }, + { + "value": "Mozilla/5.0 (Macintosh, Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/19.0 Safari/605.1.15", + "event_count": 1, + "unique_ips": 1, + "first_seen": "2026-08-31T07:08:42", + "last_seen": "2026-08-31T07:08:42", + "top_ports": [ + 443 + ], + "countries": [ + "UA" + ] + }, + { + "value": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.5 Safari/605.1.15 AlohaBrowser/7.6.0", + "event_count": 1, + "unique_ips": 1, + "first_seen": "2026-08-31T19:29:52", + "last_seen": "2026-08-31T19:29:52", + "top_ports": [ + 443 + ], + "countries": [ + "UA" + ] + }, + { + "value": "Mozilla/5.0 (X11; Linux x86_64; rv:1.9.6.20) Gecko/ Firefox/3.6.17", + "event_count": 1, + "unique_ips": 1, + "first_seen": "2026-08-31T22:17:09", + "last_seen": "2026-08-31T22:17:09", + "top_ports": [ + 443 + ], + "countries": [ + "UA" + ] + } +] \ No newline at end of file diff --git a/kevlar/2026-09-07/honeylabs/top-attackers-ua-AS51852.json b/kevlar/2026-09-07/honeylabs/top-attackers-ua-AS51852.json new file mode 100644 index 0000000..28cef53 --- /dev/null +++ b/kevlar/2026-09-07/honeylabs/top-attackers-ua-AS51852.json @@ -0,0 +1,57 @@ +[ + { + "value": "Mozilla/5.0", + "event_count": 19, + "unique_ips": 2, + "first_seen": "2026-08-31T15:32:52", + "last_seen": "2026-09-04T19:27:10", + "top_ports": [ + 8443, + 2087 + ], + "countries": [ + "CH" + ] + }, + { + "value": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/125 Safari/537.36", + "event_count": 3, + "unique_ips": 1, + "first_seen": "2026-09-01T12:06:48", + "last_seen": "2026-09-01T12:06:54", + "top_ports": [ + 80, + 443 + ], + "countries": [ + "CH" + ] + }, + { + "value": "Mozilla/5.0 (Windows NT 10.0; Win64; x64)", + "event_count": 3, + "unique_ips": 1, + "first_seen": "2026-09-04T18:34:20", + "last_seen": "2026-09-04T19:27:10", + "top_ports": [ + 2087 + ], + "countries": [ + "CH" + ] + }, + { + "value": "Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0", + "event_count": 2, + "unique_ips": 1, + "first_seen": "2026-09-01T07:55:46", + "last_seen": "2026-09-02T18:13:22", + "top_ports": [ + 32400, + 8085 + ], + "countries": [ + "CH" + ] + } +] \ No newline at end of file diff --git a/kevlar/2026-09-07/honeylabs/top-attackers-ua-AS57043.json b/kevlar/2026-09-07/honeylabs/top-attackers-ua-AS57043.json new file mode 100644 index 0000000..0637a08 --- /dev/null +++ b/kevlar/2026-09-07/honeylabs/top-attackers-ua-AS57043.json @@ -0,0 +1 @@ +[] \ No newline at end of file diff --git a/kevlar/2026-09-07/honeylabs/top-attackers-ua-AS58854.json b/kevlar/2026-09-07/honeylabs/top-attackers-ua-AS58854.json new file mode 100644 index 0000000..0637a08 --- /dev/null +++ b/kevlar/2026-09-07/honeylabs/top-attackers-ua-AS58854.json @@ -0,0 +1 @@ +[] \ No newline at end of file diff --git a/kevlar/2026-09-07/honeylabs/top-attackers.csv b/kevlar/2026-09-07/honeylabs/top-attackers.csv new file mode 100644 index 0000000..24ebbc3 --- /dev/null +++ b/kevlar/2026-09-07/honeylabs/top-attackers.csv @@ -0,0 +1,48 @@ +asn,asn_name,ip,event_count,first_seen,last_seen,top_ports,countries +"AS57043","HOSTKEY-AS","163.5.16.6","8","2026-09-02T21:02:40","2026-09-02T21:19:46","19571 44981 14603 5070 20271","GB" +"AS57043","HOSTKEY-AS","82.39.165.100","4","2026-08-31T15:39:39","2026-09-03T03:47:57","22","DE" +"AS210644","AEZA-AS","185.246.217.150","51","2026-08-31T22:44:34","2026-09-02T15:29:27","443 2222 2375","NL" +"AS14956","ROUTERHOSTING","45.61.157.82","32","2026-09-04T01:15:12","2026-09-04T06:30:09","445","US" +"AS14956","ROUTERHOSTING","144.172.108.79","24","2026-09-04T20:02:59","2026-09-05T02:54:19","445","US" +"AS14956","ROUTERHOSTING","144.172.99.200","16","2026-09-01T07:55:37","2026-09-01T08:57:36","445","US" +"AS14956","ROUTERHOSTING","216.126.239.215","8","2026-09-06T00:12:30","2026-09-06T00:12:34","445","US" +"AS14956","ROUTERHOSTING","45.61.183.10","4","2026-09-06T01:13:05","2026-09-06T06:25:29","445","US" +"AS14956","ROUTERHOSTING","167.88.168.121","4","2026-09-03T06:47:31","2026-09-04T19:38:08","2095 8008","US" +"AS14956","ROUTERHOSTING","144.172.112.11","2","2026-09-04T18:11:24","2026-09-04T18:11:24","445","US" +"AS14956","ROUTERHOSTING","144.172.100.114","1","2026-09-02T07:32:32","2026-09-02T07:32:32","1723","US" +"AS14956","ROUTERHOSTING","144.172.99.12","1","2026-09-02T02:45:38","2026-09-02T02:45:38","443","US" +"AS14956","ROUTERHOSTING","45.61.149.189","1","2026-09-06T15:51:16","2026-09-06T15:51:16","443","US" +"AS14956","ROUTERHOSTING","216.126.227.187","1","2026-09-03T17:01:38","2026-09-03T17:01:38","7860","US" +"AS14956","ROUTERHOSTING","144.172.115.222","1","2026-09-01T09:05:26","2026-09-01T09:05:26","5061","US" +"AS51852","PLI-AS","179.43.150.26","16","2026-08-31T15:32:52","2026-08-31T16:49:55","8443","CH" +"AS51852","PLI-AS","46.19.142.226","6","2026-09-04T18:34:20","2026-09-04T19:27:10","2087","CH" +"AS51852","PLI-AS","141.255.165.66","5","2026-09-03T20:48:30","2026-09-04T11:46:33","1723","CH" +"AS51852","PLI-AS","179.43.186.220","3","2026-09-01T12:06:48","2026-09-01T12:06:54","80 443","CH" +"AS51852","PLI-AS","179.43.146.27","2","2026-09-01T07:55:46","2026-09-02T18:13:22","32400 8085","CH" +"AS51396","PFCLOUD","204.76.203.222","1159","2026-09-02T09:47:23","2026-09-06T23:43:17","6128 11238 10803 11148 11415","NL" +"AS51396","PFCLOUD","204.76.203.221","1154","2026-09-02T09:47:23","2026-09-06T23:57:44","11587 10231 13246 31280 1083","NL" +"AS51396","PFCLOUD","204.76.203.213","1123","2026-09-02T09:53:18","2026-09-06T23:40:09","5112 3385 10140 50012 11644","NL" +"AS51396","PFCLOUD","204.76.203.214","1091","2026-09-02T09:48:01","2026-09-06T23:57:44","10119 21698 11100 15120 10006","NL" +"AS51396","PFCLOUD","204.76.203.49","836","2026-08-31T00:54:43","2026-09-06T22:29:18","8080 1081 888 8888 4145","NL" +"AS51396","PFCLOUD","176.65.148.153","453","2026-09-01T22:14:32","2026-09-04T09:28:19","3389 3318 3324 3349 3372","NL" +"AS51396","PFCLOUD","204.76.203.7","446","2026-08-31T00:35:35","2026-09-03T00:22:11","24575 24001 24444 20129 20119","NL" +"AS51396","PFCLOUD","45.135.193.193","400","2026-08-31T11:30:54","2026-09-06T23:26:34","8888 3128 81 80 8080","DE" +"AS51396","PFCLOUD","45.135.194.113","220","2026-08-31T01:05:13","2026-09-06T21:38:43","666 555 8888 90 8000","DE" +"AS51396","PFCLOUD","45.135.193.198","200","2026-08-31T01:11:46","2026-09-06T07:38:01","8181 8080 18080 9999 8000","DE" +"AS51396","PFCLOUD","176.65.148.226","126","2026-08-31T02:03:10","2026-09-06T17:30:01","80 443 8500 8090 3000","NL" +"AS51396","PFCLOUD","176.65.149.212","106","2026-08-31T00:00:25","2026-09-06T23:04:39","7994 7993 7990 8010 8016","NL" +"AS51396","PFCLOUD","176.65.149.27","102","2026-08-31T00:56:02","2026-09-06T23:58:26","38002 38026 38000 38020 38001","NL" +"AS51396","PFCLOUD","176.65.149.31","99","2026-08-31T01:21:26","2026-09-06T23:32:25","1883 1908 1906 1897 1905","NL" +"AS51396","PFCLOUD","176.65.149.30","89","2026-08-31T00:39:52","2026-09-06T22:50:28","31975 32019 31973 31974 32017","NL" +"AS51396","PFCLOUD","176.65.148.93","67","2026-09-01T07:37:27","2026-09-06T22:49:21","1082 1085 1080 1094 1079","NL" +"AS51396","PFCLOUD","176.65.149.236","62","2026-08-31T05:44:55","2026-09-06T21:26:21","8000 9000 82 88 443","NL" +"AS51396","PFCLOUD","204.76.203.4","51","2026-08-31T00:03:33","2026-08-31T11:42:35","25564 25566 25565","NL" +"AS51396","PFCLOUD","176.65.148.156","51","2026-08-31T15:53:23","2026-09-05T11:36:49","25565","NL" +"AS51396","PFCLOUD","176.65.134.48","48","2026-09-05T04:30:55","2026-09-06T23:47:43","4550 4747 4700 4646 4567","DE" +"AS216246","RU-AEZA-AS","176.124.222.61","1","2026-08-31T13:15:24","2026-08-31T13:15:24","5432","RU" +"AS216246","RU-AEZA-AS","45.151.101.38","1","2026-09-03T20:05:03","2026-09-03T20:05:03","8006","RU" +"AS200651","FLOKINET","185.100.87.136","24","2026-08-31T01:12:02","2026-09-06T22:18:29","443 8443","RO" +"AS198953","PROTON66","176.120.22.61","1597","2026-08-31T09:44:36","2026-09-04T10:20:48","11433 14331 14330 35366 37628","RU" +"AS198953","PROTON66","176.120.22.240","45","2026-09-01T05:50:24","2026-09-06T14:40:21","4443 8443 10443","RU" +"AS198953","PROTON66","193.143.1.66","24","2026-08-31T18:27:14","2026-09-04T21:27:35","3389 3384 3349 33894","RU" +"AS198953","PROTON66","176.120.22.147","3","2026-09-03T02:10:02","2026-09-03T02:11:21","8006","RU" \ No newline at end of file diff --git a/kevlar/2026-09-07/honeylabs/top-ips-all.json b/kevlar/2026-09-07/honeylabs/top-ips-all.json new file mode 100644 index 0000000..bb90954 --- /dev/null +++ b/kevlar/2026-09-07/honeylabs/top-ips-all.json @@ -0,0 +1,941 @@ +[ + { + "asn": "AS57043", + "name": "HOSTKEY-AS", + "value": "::ffff:163.5.16.6", + "event_count": 8, + "unique_ips": 1, + "first_seen": "2026-09-02T21:02:40", + "last_seen": "2026-09-02T21:19:46", + "top_ports": [ + 19571, + 44981, + 14603, + 5070, + 20271 + ], + "countries": [ + "GB" + ], + "asn_org": "Hostkey B.v.", + "asn_number": 57043, + "country_name": "United Kingdom" + }, + { + "asn": "AS57043", + "name": "HOSTKEY-AS", + "value": "::ffff:82.39.165.100", + "event_count": 4, + "unique_ips": 1, + "first_seen": "2026-08-31T15:39:39", + "last_seen": "2026-09-03T03:47:57", + "top_ports": [ + 22 + ], + "countries": [ + "DE" + ], + "asn_org": "Hostkey B.v.", + "asn_number": 57043, + "country_name": "Germany" + }, + { + "asn": "AS210644", + "name": "AEZA-AS", + "value": "::ffff:185.246.217.150", + "event_count": 51, + "unique_ips": 1, + "first_seen": "2026-08-31T22:44:34", + "last_seen": "2026-09-02T15:29:27", + "top_ports": [ + 443, + 2222, + 2375 + ], + "countries": [ + "NL" + ], + "asn_org": "Aeza Group LLC", + "asn_number": 210644, + "country_name": "The Netherlands" + }, + { + "asn": "AS14956", + "name": "ROUTERHOSTING", + "value": "::ffff:45.61.157.82", + "event_count": 32, + "unique_ips": 1, + "first_seen": "2026-09-04T01:15:12", + "last_seen": "2026-09-04T06:30:09", + "top_ports": [ + 445 + ], + "countries": [ + "US" + ], + "asn_org": "RouterHosting LLC", + "asn_number": 14956, + "country_name": "United States" + }, + { + "asn": "AS14956", + "name": "ROUTERHOSTING", + "value": "::ffff:144.172.108.79", + "event_count": 24, + "unique_ips": 1, + "first_seen": "2026-09-04T20:02:59", + "last_seen": "2026-09-05T02:54:19", + "top_ports": [ + 445 + ], + "countries": [ + "US" + ], + "asn_org": "RouterHosting LLC", + "asn_number": 14956, + "country_name": "United States" + }, + { + "asn": "AS14956", + "name": "ROUTERHOSTING", + "value": "::ffff:144.172.99.200", + "event_count": 16, + "unique_ips": 1, + "first_seen": "2026-09-01T07:55:37", + "last_seen": "2026-09-01T08:57:36", + "top_ports": [ + 445 + ], + "countries": [ + "US" + ], + "asn_org": "RouterHosting LLC", + "asn_number": 14956, + "country_name": "United States" + }, + { + "asn": "AS14956", + "name": "ROUTERHOSTING", + "value": "::ffff:216.126.239.215", + "event_count": 8, + "unique_ips": 1, + "first_seen": "2026-09-06T00:12:30", + "last_seen": "2026-09-06T00:12:34", + "top_ports": [ + 445 + ], + "countries": [ + "US" + ], + "asn_org": "RouterHosting LLC", + "asn_number": 14956, + "country_name": "United States" + }, + { + "asn": "AS14956", + "name": "ROUTERHOSTING", + "value": "::ffff:45.61.183.10", + "event_count": 4, + "unique_ips": 1, + "first_seen": "2026-09-06T01:13:05", + "last_seen": "2026-09-06T06:25:29", + "top_ports": [ + 445 + ], + "countries": [ + "US" + ], + "asn_org": "RouterHosting LLC", + "asn_number": 14956, + "country_name": "United States" + }, + { + "asn": "AS14956", + "name": "ROUTERHOSTING", + "value": "::ffff:167.88.168.121", + "event_count": 4, + "unique_ips": 1, + "first_seen": "2026-09-03T06:47:31", + "last_seen": "2026-09-04T19:38:08", + "top_ports": [ + 2095, + 8008 + ], + "countries": [ + "US" + ], + "asn_org": "RouterHosting LLC", + "asn_number": 14956, + "country_name": "United States" + }, + { + "asn": "AS14956", + "name": "ROUTERHOSTING", + "value": "::ffff:144.172.112.11", + "event_count": 2, + "unique_ips": 1, + "first_seen": "2026-09-04T18:11:24", + "last_seen": "2026-09-04T18:11:24", + "top_ports": [ + 445 + ], + "countries": [ + "US" + ], + "asn_org": "RouterHosting LLC", + "asn_number": 14956, + "country_name": "United States" + }, + { + "asn": "AS14956", + "name": "ROUTERHOSTING", + "value": "::ffff:144.172.100.114", + "event_count": 1, + "unique_ips": 1, + "first_seen": "2026-09-02T07:32:32", + "last_seen": "2026-09-02T07:32:32", + "top_ports": [ + 1723 + ], + "countries": [ + "US" + ], + "asn_org": "RouterHosting LLC", + "asn_number": 14956, + "country_name": "United States" + }, + { + "asn": "AS14956", + "name": "ROUTERHOSTING", + "value": "::ffff:144.172.99.12", + "event_count": 1, + "unique_ips": 1, + "first_seen": "2026-09-02T02:45:38", + "last_seen": "2026-09-02T02:45:38", + "top_ports": [ + 443 + ], + "countries": [ + "US" + ], + "asn_org": "RouterHosting LLC", + "asn_number": 14956, + "country_name": "United States" + }, + { + "asn": "AS14956", + "name": "ROUTERHOSTING", + "value": "::ffff:45.61.149.189", + "event_count": 1, + "unique_ips": 1, + "first_seen": "2026-09-06T15:51:16", + "last_seen": "2026-09-06T15:51:16", + "top_ports": [ + 443 + ], + "countries": [ + "US" + ], + "asn_org": "RouterHosting LLC", + "asn_number": 14956, + "country_name": "United States" + }, + { + "asn": "AS14956", + "name": "ROUTERHOSTING", + "value": "::ffff:216.126.227.187", + "event_count": 1, + "unique_ips": 1, + "first_seen": "2026-09-03T17:01:38", + "last_seen": "2026-09-03T17:01:38", + "top_ports": [ + 7860 + ], + "countries": [ + "US" + ], + "asn_org": "RouterHosting LLC", + "asn_number": 14956, + "country_name": "United States" + }, + { + "asn": "AS14956", + "name": "ROUTERHOSTING", + "value": "::ffff:144.172.115.222", + "event_count": 1, + "unique_ips": 1, + "first_seen": "2026-09-01T09:05:26", + "last_seen": "2026-09-01T09:05:26", + "top_ports": [ + 5061 + ], + "countries": [ + "US" + ], + "asn_org": "RouterHosting LLC", + "asn_number": 14956, + "country_name": "United States" + }, + { + "asn": "AS51852", + "name": "PLI-AS", + "value": "::ffff:179.43.150.26", + "event_count": 16, + "unique_ips": 1, + "first_seen": "2026-08-31T15:32:52", + "last_seen": "2026-08-31T16:49:55", + "top_ports": [ + 8443 + ], + "countries": [ + "CH" + ], + "asn_org": "Private Layer INC", + "asn_number": 51852, + "country_name": "Switzerland" + }, + { + "asn": "AS51852", + "name": "PLI-AS", + "value": "::ffff:46.19.142.226", + "event_count": 6, + "unique_ips": 1, + "first_seen": "2026-09-04T18:34:20", + "last_seen": "2026-09-04T19:27:10", + "top_ports": [ + 2087 + ], + "countries": [ + "CH" + ], + "asn_org": "Private Layer INC", + "asn_number": 51852, + "country_name": "Switzerland" + }, + { + "asn": "AS51852", + "name": "PLI-AS", + "value": "::ffff:141.255.165.66", + "event_count": 5, + "unique_ips": 1, + "first_seen": "2026-09-03T20:48:30", + "last_seen": "2026-09-04T11:46:33", + "top_ports": [ + 1723 + ], + "countries": [ + "CH" + ], + "asn_org": "Private Layer INC", + "asn_number": 51852, + "country_name": "Switzerland" + }, + { + "asn": "AS51852", + "name": "PLI-AS", + "value": "::ffff:179.43.186.220", + "event_count": 3, + "unique_ips": 1, + "first_seen": "2026-09-01T12:06:48", + "last_seen": "2026-09-01T12:06:54", + "top_ports": [ + 80, + 443 + ], + "countries": [ + "CH" + ], + "asn_org": "Private Layer INC", + "asn_number": 51852, + "country_name": "Switzerland" + }, + { + "asn": "AS51852", + "name": "PLI-AS", + "value": "::ffff:179.43.146.27", + "event_count": 2, + "unique_ips": 1, + "first_seen": "2026-09-01T07:55:46", + "last_seen": "2026-09-02T18:13:22", + "top_ports": [ + 32400, + 8085 + ], + "countries": [ + "CH" + ], + "asn_org": "Private Layer INC", + "asn_number": 51852, + "country_name": "Switzerland" + }, + { + "asn": "AS51396", + "name": "PFCLOUD", + "value": "::ffff:204.76.203.222", + "event_count": 1159, + "unique_ips": 1, + "first_seen": "2026-09-02T09:47:23", + "last_seen": "2026-09-06T23:43:17", + "top_ports": [ + 6128, + 11238, + 10803, + 11148, + 11415 + ], + "countries": [ + "NL" + ], + "asn_org": "Pfcloud UG (haftungsbeschrankt)", + "asn_number": 51396, + "country_name": "The Netherlands" + }, + { + "asn": "AS51396", + "name": "PFCLOUD", + "value": "::ffff:204.76.203.221", + "event_count": 1154, + "unique_ips": 1, + "first_seen": "2026-09-02T09:47:23", + "last_seen": "2026-09-06T23:57:44", + "top_ports": [ + 11587, + 10231, + 13246, + 31280, + 1083 + ], + "countries": [ + "NL" + ], + "asn_org": "Pfcloud UG (haftungsbeschrankt)", + "asn_number": 51396, + "country_name": "The Netherlands" + }, + { + "asn": "AS51396", + "name": "PFCLOUD", + "value": "::ffff:204.76.203.213", + "event_count": 1123, + "unique_ips": 1, + "first_seen": "2026-09-02T09:53:18", + "last_seen": "2026-09-06T23:40:09", + "top_ports": [ + 5112, + 3385, + 10140, + 50012, + 11644 + ], + "countries": [ + "NL" + ], + "asn_org": "Pfcloud UG (haftungsbeschrankt)", + "asn_number": 51396, + "country_name": "The Netherlands" + }, + { + "asn": "AS51396", + "name": "PFCLOUD", + "value": "::ffff:204.76.203.214", + "event_count": 1091, + "unique_ips": 1, + "first_seen": "2026-09-02T09:48:01", + "last_seen": "2026-09-06T23:57:44", + "top_ports": [ + 10119, + 21698, + 11100, + 15120, + 10006 + ], + "countries": [ + "NL" + ], + "asn_org": "Pfcloud UG (haftungsbeschrankt)", + "asn_number": 51396, + "country_name": "The Netherlands" + }, + { + "asn": "AS51396", + "name": "PFCLOUD", + "value": "::ffff:204.76.203.49", + "event_count": 836, + "unique_ips": 1, + "first_seen": "2026-08-31T00:54:43", + "last_seen": "2026-09-06T22:29:18", + "top_ports": [ + 8080, + 1081, + 888, + 8888, + 4145 + ], + "countries": [ + "NL" + ], + "asn_org": "Pfcloud UG (haftungsbeschrankt)", + "asn_number": 51396, + "country_name": "The Netherlands" + }, + { + "asn": "AS51396", + "name": "PFCLOUD", + "value": "::ffff:176.65.148.153", + "event_count": 453, + "unique_ips": 1, + "first_seen": "2026-09-01T22:14:32", + "last_seen": "2026-09-04T09:28:19", + "top_ports": [ + 3389, + 3318, + 3324, + 3349, + 3372 + ], + "countries": [ + "NL" + ], + "asn_org": "Pfcloud UG (haftungsbeschrankt)", + "asn_number": 51396, + "country_name": "The Netherlands" + }, + { + "asn": "AS51396", + "name": "PFCLOUD", + "value": "::ffff:204.76.203.7", + "event_count": 446, + "unique_ips": 1, + "first_seen": "2026-08-31T00:35:35", + "last_seen": "2026-09-03T00:22:11", + "top_ports": [ + 24575, + 24001, + 24444, + 20129, + 20119 + ], + "countries": [ + "NL" + ], + "asn_org": "Pfcloud UG (haftungsbeschrankt)", + "asn_number": 51396, + "country_name": "The Netherlands" + }, + { + "asn": "AS51396", + "name": "PFCLOUD", + "value": "::ffff:45.135.193.193", + "event_count": 400, + "unique_ips": 1, + "first_seen": "2026-08-31T11:30:54", + "last_seen": "2026-09-06T23:26:34", + "top_ports": [ + 8888, + 3128, + 81, + 80, + 8080 + ], + "countries": [ + "DE" + ], + "asn_org": "Pfcloud UG (haftungsbeschrankt)", + "asn_number": 51396, + "country_name": "Germany" + }, + { + "asn": "AS51396", + "name": "PFCLOUD", + "value": "::ffff:45.135.194.113", + "event_count": 220, + "unique_ips": 1, + "first_seen": "2026-08-31T01:05:13", + "last_seen": "2026-09-06T21:38:43", + "top_ports": [ + 666, + 555, + 8888, + 90, + 8000 + ], + "countries": [ + "DE" + ], + "asn_org": "Pfcloud UG (haftungsbeschrankt)", + "asn_number": 51396, + "country_name": "Germany" + }, + { + "asn": "AS51396", + "name": "PFCLOUD", + "value": "::ffff:45.135.193.198", + "event_count": 200, + "unique_ips": 1, + "first_seen": "2026-08-31T01:11:46", + "last_seen": "2026-09-06T07:38:01", + "top_ports": [ + 8181, + 8080, + 18080, + 9999, + 8000 + ], + "countries": [ + "DE" + ], + "asn_org": "Pfcloud UG (haftungsbeschrankt)", + "asn_number": 51396, + "country_name": "Germany" + }, + { + "asn": "AS51396", + "name": "PFCLOUD", + "value": "::ffff:176.65.148.226", + "event_count": 126, + "unique_ips": 1, + "first_seen": "2026-08-31T02:03:10", + "last_seen": "2026-09-06T17:30:01", + "top_ports": [ + 80, + 443, + 8500, + 8090, + 3000 + ], + "countries": [ + "NL" + ], + "asn_org": "Pfcloud UG (haftungsbeschrankt)", + "asn_number": 51396, + "country_name": "The Netherlands" + }, + { + "asn": "AS51396", + "name": "PFCLOUD", + "value": "::ffff:176.65.149.212", + "event_count": 106, + "unique_ips": 1, + "first_seen": "2026-08-31T00:00:25", + "last_seen": "2026-09-06T23:04:39", + "top_ports": [ + 7994, + 7993, + 7990, + 8010, + 8016 + ], + "countries": [ + "NL" + ], + "asn_org": "Pfcloud UG (haftungsbeschrankt)", + "asn_number": 51396, + "country_name": "The Netherlands" + }, + { + "asn": "AS51396", + "name": "PFCLOUD", + "value": "::ffff:176.65.149.27", + "event_count": 102, + "unique_ips": 1, + "first_seen": "2026-08-31T00:56:02", + "last_seen": "2026-09-06T23:58:26", + "top_ports": [ + 38002, + 38026, + 38000, + 38020, + 38001 + ], + "countries": [ + "NL" + ], + "asn_org": "Pfcloud UG (haftungsbeschrankt)", + "asn_number": 51396, + "country_name": "The Netherlands" + }, + { + "asn": "AS51396", + "name": "PFCLOUD", + "value": "::ffff:176.65.149.31", + "event_count": 99, + "unique_ips": 1, + "first_seen": "2026-08-31T01:21:26", + "last_seen": "2026-09-06T23:32:25", + "top_ports": [ + 1883, + 1908, + 1906, + 1897, + 1905 + ], + "countries": [ + "NL" + ], + "asn_org": "Pfcloud UG (haftungsbeschrankt)", + "asn_number": 51396, + "country_name": "The Netherlands" + }, + { + "asn": "AS51396", + "name": "PFCLOUD", + "value": "::ffff:176.65.149.30", + "event_count": 89, + "unique_ips": 1, + "first_seen": "2026-08-31T00:39:52", + "last_seen": "2026-09-06T22:50:28", + "top_ports": [ + 31975, + 32019, + 31973, + 31974, + 32017 + ], + "countries": [ + "NL" + ], + "asn_org": "Pfcloud UG (haftungsbeschrankt)", + "asn_number": 51396, + "country_name": "The Netherlands" + }, + { + "asn": "AS51396", + "name": "PFCLOUD", + "value": "::ffff:176.65.148.93", + "event_count": 67, + "unique_ips": 1, + "first_seen": "2026-09-01T07:37:27", + "last_seen": "2026-09-06T22:49:21", + "top_ports": [ + 1082, + 1085, + 1080, + 1094, + 1079 + ], + "countries": [ + "NL" + ], + "asn_org": "Pfcloud UG (haftungsbeschrankt)", + "asn_number": 51396, + "country_name": "The Netherlands" + }, + { + "asn": "AS51396", + "name": "PFCLOUD", + "value": "::ffff:176.65.149.236", + "event_count": 62, + "unique_ips": 1, + "first_seen": "2026-08-31T05:44:55", + "last_seen": "2026-09-06T21:26:21", + "top_ports": [ + 8000, + 9000, + 82, + 88, + 443 + ], + "countries": [ + "NL" + ], + "asn_org": "Pfcloud UG (haftungsbeschrankt)", + "asn_number": 51396, + "country_name": "The Netherlands" + }, + { + "asn": "AS51396", + "name": "PFCLOUD", + "value": "::ffff:204.76.203.4", + "event_count": 51, + "unique_ips": 1, + "first_seen": "2026-08-31T00:03:33", + "last_seen": "2026-08-31T11:42:35", + "top_ports": [ + 25564, + 25566, + 25565 + ], + "countries": [ + "NL" + ], + "asn_org": "Pfcloud UG (haftungsbeschrankt)", + "asn_number": 51396, + "country_name": "The Netherlands" + }, + { + "asn": "AS51396", + "name": "PFCLOUD", + "value": "::ffff:176.65.148.156", + "event_count": 51, + "unique_ips": 1, + "first_seen": "2026-08-31T15:53:23", + "last_seen": "2026-09-05T11:36:49", + "top_ports": [ + 25565 + ], + "countries": [ + "NL" + ], + "asn_org": "Pfcloud UG (haftungsbeschrankt)", + "asn_number": 51396, + "country_name": "The Netherlands" + }, + { + "asn": "AS51396", + "name": "PFCLOUD", + "value": "::ffff:176.65.134.48", + "event_count": 48, + "unique_ips": 1, + "first_seen": "2026-09-05T04:30:55", + "last_seen": "2026-09-06T23:47:43", + "top_ports": [ + 4550, + 4747, + 4700, + 4646, + 4567 + ], + "countries": [ + "DE" + ], + "asn_org": "Pfcloud UG (haftungsbeschrankt)", + "asn_number": 51396, + "country_name": "Germany" + }, + { + "asn": "AS216246", + "name": "RU-AEZA-AS", + "value": "::ffff:176.124.222.61", + "event_count": 1, + "unique_ips": 1, + "first_seen": "2026-08-31T13:15:24", + "last_seen": "2026-08-31T13:15:24", + "top_ports": [ + 5432 + ], + "countries": [ + "RU" + ], + "asn_org": "Aeza Group LLC", + "asn_number": 216246, + "country_name": "Russia" + }, + { + "asn": "AS216246", + "name": "RU-AEZA-AS", + "value": "::ffff:45.151.101.38", + "event_count": 1, + "unique_ips": 1, + "first_seen": "2026-09-03T20:05:03", + "last_seen": "2026-09-03T20:05:03", + "top_ports": [ + 8006 + ], + "countries": [ + "RU" + ], + "asn_org": "Aeza Group LLC", + "asn_number": 216246, + "country_name": "Russia" + }, + { + "asn": "AS200651", + "name": "FLOKINET", + "value": "::ffff:185.100.87.136", + "event_count": 24, + "unique_ips": 1, + "first_seen": "2026-08-31T01:12:02", + "last_seen": "2026-09-06T22:18:29", + "top_ports": [ + 443, + 8443 + ], + "countries": [ + "RO" + ], + "asn_org": "FlokiNET ehf", + "asn_number": 200651, + "country_name": "Romania" + }, + { + "asn": "AS198953", + "name": "PROTON66", + "value": "::ffff:176.120.22.61", + "event_count": 1597, + "unique_ips": 1, + "first_seen": "2026-08-31T09:44:36", + "last_seen": "2026-09-04T10:20:48", + "top_ports": [ + 11433, + 14331, + 14330, + 35366, + 37628 + ], + "countries": [ + "RU" + ], + "asn_org": "Proton66 OOO", + "asn_number": 198953, + "country_name": "Russia" + }, + { + "asn": "AS198953", + "name": "PROTON66", + "value": "::ffff:176.120.22.240", + "event_count": 45, + "unique_ips": 1, + "first_seen": "2026-09-01T05:50:24", + "last_seen": "2026-09-06T14:40:21", + "top_ports": [ + 4443, + 8443, + 10443 + ], + "countries": [ + "RU" + ], + "asn_org": "Proton66 OOO", + "asn_number": 198953, + "country_name": "Russia" + }, + { + "asn": "AS198953", + "name": "PROTON66", + "value": "::ffff:193.143.1.66", + "event_count": 24, + "unique_ips": 1, + "first_seen": "2026-08-31T18:27:14", + "last_seen": "2026-09-04T21:27:35", + "top_ports": [ + 3389, + 3384, + 3349, + 33894 + ], + "countries": [ + "RU" + ], + "asn_org": "Proton66 OOO", + "asn_number": 198953, + "country_name": "Russia" + }, + { + "asn": "AS198953", + "name": "PROTON66", + "value": "::ffff:176.120.22.147", + "event_count": 3, + "unique_ips": 1, + "first_seen": "2026-09-03T02:10:02", + "last_seen": "2026-09-03T02:11:21", + "top_ports": [ + 8006 + ], + "countries": [ + "RU" + ], + "asn_org": "Proton66 OOO", + "asn_number": 198953, + "country_name": "Russia" + } +] \ No newline at end of file diff --git a/kevlar/2026-09-07/honeylabs/user-agents-all.json b/kevlar/2026-09-07/honeylabs/user-agents-all.json new file mode 100644 index 0000000..3e8f85c --- /dev/null +++ b/kevlar/2026-09-07/honeylabs/user-agents-all.json @@ -0,0 +1,580 @@ +[ + { + "asn": "AS210644", + "name": "AEZA-AS", + "value": "libredtail-http", + "event_count": 50, + "unique_ips": 1, + "first_seen": "2026-08-31T22:44:34", + "last_seen": "2026-09-02T15:29:27", + "top_ports": [ + 443, + 2375 + ], + "countries": [ + "NL" + ] + }, + { + "asn": "AS14956", + "name": "ROUTERHOSTING", + "value": "Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0", + "event_count": 4, + "unique_ips": 1, + "first_seen": "2026-09-03T06:47:31", + "last_seen": "2026-09-04T19:38:08", + "top_ports": [ + 2095, + 8008 + ], + "countries": [ + "US" + ] + }, + { + "asn": "AS14956", + "name": "ROUTERHOSTING", + "value": "Python-urllib/3.13", + "event_count": 1, + "unique_ips": 1, + "first_seen": "2026-09-06T15:51:16", + "last_seen": "2026-09-06T15:51:16", + "top_ports": [ + 443 + ], + "countries": [ + "US" + ] + }, + { + "asn": "AS14956", + "name": "ROUTERHOSTING", + "value": "Python/3.13 aiohttp/3.13.5", + "event_count": 1, + "unique_ips": 1, + "first_seen": "2026-09-03T17:01:38", + "last_seen": "2026-09-03T17:01:38", + "top_ports": [ + 7860 + ], + "countries": [ + "US" + ] + }, + { + "asn": "AS14956", + "name": "ROUTERHOSTING", + "value": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36", + "event_count": 1, + "unique_ips": 1, + "first_seen": "2026-09-02T02:45:38", + "last_seen": "2026-09-02T02:45:38", + "top_ports": [ + 443 + ], + "countries": [ + "US" + ] + }, + { + "asn": "AS51852", + "name": "PLI-AS", + "value": "Mozilla/5.0", + "event_count": 19, + "unique_ips": 2, + "first_seen": "2026-08-31T15:32:52", + "last_seen": "2026-09-04T19:27:10", + "top_ports": [ + 8443, + 2087 + ], + "countries": [ + "CH" + ] + }, + { + "asn": "AS51852", + "name": "PLI-AS", + "value": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/125 Safari/537.36", + "event_count": 3, + "unique_ips": 1, + "first_seen": "2026-09-01T12:06:48", + "last_seen": "2026-09-01T12:06:54", + "top_ports": [ + 80, + 443 + ], + "countries": [ + "CH" + ] + }, + { + "asn": "AS51852", + "name": "PLI-AS", + "value": "Mozilla/5.0 (Windows NT 10.0; Win64; x64)", + "event_count": 3, + "unique_ips": 1, + "first_seen": "2026-09-04T18:34:20", + "last_seen": "2026-09-04T19:27:10", + "top_ports": [ + 2087 + ], + "countries": [ + "CH" + ] + }, + { + "asn": "AS51852", + "name": "PLI-AS", + "value": "Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0", + "event_count": 2, + "unique_ips": 1, + "first_seen": "2026-09-01T07:55:46", + "last_seen": "2026-09-02T18:13:22", + "top_ports": [ + 32400, + 8085 + ], + "countries": [ + "CH" + ] + }, + { + "asn": "AS51396", + "name": "PFCLOUD", + "value": "Go-http-client/1.1", + "event_count": 372, + "unique_ips": 5, + "first_seen": "2026-08-31T00:35:35", + "last_seen": "2026-09-06T23:47:43", + "top_ports": [ + 4550, + 4747, + 222, + 8000, + 11434 + ], + "countries": [ + "NL", + "DE" + ] + }, + { + "asn": "AS51396", + "name": "PFCLOUD", + "value": "0day", + "event_count": 200, + "unique_ips": 1, + "first_seen": "2026-08-31T01:11:46", + "last_seen": "2026-09-06T07:38:01", + "top_ports": [ + 8181, + 8080, + 18080, + 18088, + 8888 + ], + "countries": [ + "DE" + ] + }, + { + "asn": "AS51396", + "name": "PFCLOUD", + "value": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36", + "event_count": 126, + "unique_ips": 1, + "first_seen": "2026-08-31T02:03:10", + "last_seen": "2026-09-06T17:30:01", + "top_ports": [ + 80, + 443, + 8500, + 8090, + 3000 + ], + "countries": [ + "NL" + ] + }, + { + "asn": "AS51396", + "name": "PFCLOUD", + "value": "Mozilla/5.0 zgrab/0.x", + "event_count": 95, + "unique_ips": 5, + "first_seen": "2026-08-31T00:50:18", + "last_seen": "2026-09-06T21:26:21", + "top_ports": [ + 8000, + 8001, + 443, + 9000, + 88 + ], + "countries": [ + "NL" + ] + }, + { + "asn": "AS51396", + "name": "PFCLOUD", + "value": "kubo-probe/1.0", + "event_count": 12, + "unique_ips": 1, + "first_seen": "2026-08-31T11:11:43", + "last_seen": "2026-09-02T16:28:23", + "top_ports": [ + 5001, + 8080 + ], + "countries": [ + "DE" + ] + }, + { + "asn": "AS51396", + "name": "PFCLOUD", + "value": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36", + "event_count": 10, + "unique_ips": 1, + "first_seen": "2026-08-31T10:08:26", + "last_seen": "2026-09-05T08:05:52", + "top_ports": [ + 80 + ], + "countries": [ + "NL" + ] + }, + { + "asn": "AS51396", + "name": "PFCLOUD", + "value": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36", + "event_count": 6, + "unique_ips": 1, + "first_seen": "2026-09-05T12:54:20", + "last_seen": "2026-09-05T13:26:20", + "top_ports": [ + 8090 + ], + "countries": [ + "NL" + ] + }, + { + "asn": "AS51396", + "name": "PFCLOUD", + "value": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36", + "event_count": 4, + "unique_ips": 1, + "first_seen": "2026-09-01T09:55:22", + "last_seen": "2026-09-02T01:32:40", + "top_ports": [ + 80 + ], + "countries": [ + "NL" + ] + }, + { + "asn": "AS51396", + "name": "PFCLOUD", + "value": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.3 Safari/605.1.15", + "event_count": 1, + "unique_ips": 1, + "first_seen": "2026-09-01T10:40:15", + "last_seen": "2026-09-01T10:40:15", + "top_ports": [ + 443 + ], + "countries": [ + "UA" + ] + }, + { + "asn": "AS51396", + "name": "PFCLOUD", + "value": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.1 Safari/605.1.15", + "event_count": 1, + "unique_ips": 1, + "first_seen": "2026-09-01T06:45:24", + "last_seen": "2026-09-01T06:45:24", + "top_ports": [ + 443 + ], + "countries": [ + "UA" + ] + }, + { + "asn": "AS51396", + "name": "PFCLOUD", + "value": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36", + "event_count": 1, + "unique_ips": 1, + "first_seen": "2026-08-31T07:27:42", + "last_seen": "2026-08-31T07:27:42", + "top_ports": [ + 443 + ], + "countries": [ + "UA" + ] + }, + { + "asn": "AS51396", + "name": "PFCLOUD", + "value": "Mozilla/5.0 (Knoppix; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36", + "event_count": 1, + "unique_ips": 1, + "first_seen": "2026-08-31T09:52:59", + "last_seen": "2026-08-31T09:52:59", + "top_ports": [ + 443 + ], + "countries": [ + "UA" + ] + }, + { + "asn": "AS51396", + "name": "PFCLOUD", + "value": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Safari/537.36 Edge/12.246", + "event_count": 1, + "unique_ips": 1, + "first_seen": "2026-09-03T10:27:07", + "last_seen": "2026-09-03T10:27:07", + "top_ports": [ + 8080 + ], + "countries": [ + "NL" + ] + }, + { + "asn": "AS51396", + "name": "PFCLOUD", + "value": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36", + "event_count": 1, + "unique_ips": 1, + "first_seen": "2026-08-31T18:59:50", + "last_seen": "2026-08-31T18:59:50", + "top_ports": [ + 443 + ], + "countries": [ + "UA" + ] + }, + { + "asn": "AS51396", + "name": "PFCLOUD", + "value": "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0", + "event_count": 1, + "unique_ips": 1, + "first_seen": "2026-09-01T07:30:45", + "last_seen": "2026-09-01T07:30:45", + "top_ports": [ + 443 + ], + "countries": [ + "UA" + ] + }, + { + "asn": "AS51396", + "name": "PFCLOUD", + "value": "Mozilla/5.0 (Macintosh, Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/19.0 Safari/605.1.15", + "event_count": 1, + "unique_ips": 1, + "first_seen": "2026-08-31T07:08:42", + "last_seen": "2026-08-31T07:08:42", + "top_ports": [ + 443 + ], + "countries": [ + "UA" + ] + }, + { + "asn": "AS51396", + "name": "PFCLOUD", + "value": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.5 Safari/605.1.15 AlohaBrowser/7.6.0", + "event_count": 1, + "unique_ips": 1, + "first_seen": "2026-08-31T19:29:52", + "last_seen": "2026-08-31T19:29:52", + "top_ports": [ + 443 + ], + "countries": [ + "UA" + ] + }, + { + "asn": "AS51396", + "name": "PFCLOUD", + "value": "Mozilla/5.0 (X11; Linux x86_64; rv:1.9.6.20) Gecko/ Firefox/3.6.17", + "event_count": 1, + "unique_ips": 1, + "first_seen": "2026-08-31T22:17:09", + "last_seen": "2026-08-31T22:17:09", + "top_ports": [ + 443 + ], + "countries": [ + "UA" + ] + }, + { + "asn": "AS216246", + "name": "RU-AEZA-AS", + "value": "Python-urllib/3.10", + "event_count": 1, + "unique_ips": 1, + "first_seen": "2026-09-03T20:05:03", + "last_seen": "2026-09-03T20:05:03", + "top_ports": [ + 8006 + ], + "countries": [ + "RU" + ] + }, + { + "asn": "AS200651", + "name": "FLOKINET", + "value": "SPARK COMMIT: 08059e95dacafe0bf6e5782f8e2c8ec9cd8c5a17", + "event_count": 3, + "unique_ips": 1, + "first_seen": "2026-09-03T20:46:54", + "last_seen": "2026-09-03T23:55:20", + "top_ports": [ + 443 + ], + "countries": [ + "RO" + ] + }, + { + "asn": "AS200651", + "name": "FLOKINET", + "value": "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:104.71.6212.24) Gecko/25.2.4212.671 Firefox/2.0", + "event_count": 3, + "unique_ips": 1, + "first_seen": "2026-09-03T20:46:53", + "last_seen": "2026-09-03T23:55:19", + "top_ports": [ + 443 + ], + "countries": [ + "RO" + ] + }, + { + "asn": "AS200651", + "name": "FLOKINET", + "value": "Mozilla/5.0 (Android 12; Mobile; rv:117.0) Gecko/117.0 Focus/117.0", + "event_count": 3, + "unique_ips": 1, + "first_seen": "2026-09-06T20:33:31", + "last_seen": "2026-09-06T22:18:29", + "top_ports": [ + 443 + ], + "countries": [ + "RO" + ] + }, + { + "asn": "AS200651", + "name": "FLOKINET", + "value": "Mozilla/5.0 (Windows NT 10.0; Win64; x64)", + "event_count": 3, + "unique_ips": 1, + "first_seen": "2026-09-01T12:25:00", + "last_seen": "2026-09-01T14:07:55", + "top_ports": [ + 8443 + ], + "countries": [ + "RO" + ] + }, + { + "asn": "AS200651", + "name": "FLOKINET", + "value": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_3 rv:3.0; eu-FR) AppleWebKit/533.4.2 (KHTML, like Gecko) Version/5.0.1 Safari/533.4.2", + "event_count": 3, + "unique_ips": 1, + "first_seen": "2026-08-31T01:12:02", + "last_seen": "2026-08-31T06:06:56", + "top_ports": [ + 443 + ], + "countries": [ + "RO" + ] + }, + { + "asn": "AS198953", + "name": "PROTON66", + "value": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.1 Mobile/15E148 Safari/604.1", + "event_count": 1, + "unique_ips": 1, + "first_seen": "2026-09-03T02:11:21", + "last_seen": "2026-09-03T02:11:21", + "top_ports": [ + 8006 + ], + "countries": [ + "RU" + ] + }, + { + "asn": "AS198953", + "name": "PROTON66", + "value": "Mozilla/5.0 (Macintosh, Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/15.6.1 Safari/605.1.15", + "event_count": 1, + "unique_ips": 1, + "first_seen": "2026-09-03T02:10:04", + "last_seen": "2026-09-03T02:10:04", + "top_ports": [ + 8006 + ], + "countries": [ + "RU" + ] + }, + { + "asn": "AS198953", + "name": "PROTON66", + "value": "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:74.0) Gecko/20100101 Firefox/74.0 - github.com/anasbousselham/)", + "event_count": 1, + "unique_ips": 1, + "first_seen": "2026-09-01T05:50:24", + "last_seen": "2026-09-01T05:50:24", + "top_ports": [ + 10443 + ], + "countries": [ + "RU" + ] + }, + { + "asn": "AS198953", + "name": "PROTON66", + "value": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36", + "event_count": 1, + "unique_ips": 1, + "first_seen": "2026-09-03T02:10:02", + "last_seen": "2026-09-03T02:10:02", + "top_ports": [ + 8006 + ], + "countries": [ + "RU" + ] + } +] \ No newline at end of file diff --git a/kevlar/2026-09-07/iocs/README.md b/kevlar/2026-09-07/iocs/README.md new file mode 100644 index 0000000..7dbe1d9 --- /dev/null +++ b/kevlar/2026-09-07/iocs/README.md @@ -0,0 +1,12 @@ +# Weekly BP Report -- 2026-09-07 + +Generated: 2026-09-07T10:02:32Z +ASNs covered: 25 +Sponge sessions found (top-talker sums): 138339 +Honeylabs events found (sampled): 416 +Censys IPs enriched: 10 +Anomalies flagged: 47 + +Baseline note: the 2026-08-31 run cached unbounded Arkime windows. This run +re-queried the prior week (2026-08-24 to 2026-08-31) with matched 7-day bounds +for all percentage comparisons. See changes/prior-window-2026-08-24_31.json. diff --git a/kevlar/2026-09-07/iocs/all-observed-ips.txt b/kevlar/2026-09-07/iocs/all-observed-ips.txt new file mode 100644 index 0000000..0504e9c --- /dev/null +++ b/kevlar/2026-09-07/iocs/all-observed-ips.txt @@ -0,0 +1,152 @@ +# all observed source IPs, week 2026-08-31 to 2026-09-07 (Sponge + Honeylabs) +# AS57043 - HOSTKEY-AS +82.38.67.164 # sponge:162 +5.39.217.86 # sponge:24 +163.5.16.6 # honeylabs:8 +31.207.46.105 # sponge:7 +82.39.165.100 # honeylabs:4 +66.151.40.231 # sponge:2 +82.21.150.241 # sponge:1 +# AS209847 - THE +77.91.122.2 # sponge:3 +# AS210644 - AEZA-AS +185.246.217.150 # honeylabs:51 +77.110.110.145 # sponge:45 +138.124.102.8 # sponge:33 +213.165.32.131 # sponge:11 +46.226.167.103 # sponge:7 +85.192.24.119 # sponge:1 +# AS138915 - KAOPU-HK +38.54.2.209 # sponge:30290 +38.54.2.232 # sponge:13234 +38.54.2.13 # sponge:1438 +38.54.2.75 # sponge:848 +38.54.2.168 # sponge:675 +38.54.2.170 # sponge:674 +38.54.2.221 # sponge:311 +38.60.227.250 # sponge:97 +38.54.2.204 # sponge:75 +38.54.2.203 # sponge:61 +38.54.2.4 # sponge:41 +38.54.2.9 # sponge:29 +38.54.2.91 # sponge:17 +38.54.2.235 # sponge:12 +38.54.2.22 # sponge:11 +38.54.2.195 # sponge:11 +38.54.2.233 # sponge:11 +38.54.2.55 # sponge:8 +38.54.2.71 # sponge:8 +38.54.2.146 # sponge:8 +# AS14956 - ROUTERHOSTING +144.172.104.123 # sponge:70 +144.172.102.126 # sponge:54 +144.172.97.249 # sponge:50 +45.61.157.82 # honeylabs:32 +144.172.104.147 # sponge:30 +144.172.108.79 # honeylabs:24 +144.172.115.90 # sponge:20 +144.172.99.200 # honeylabs:16 +167.88.168.121 # sponge:7 honeylabs:4 +144.172.117.61 # sponge:8 +216.126.239.215 # honeylabs:8 +107.189.22.128 # sponge:6 +216.126.227.187 # sponge:5 honeylabs:1 +45.61.149.189 # sponge:4 honeylabs:1 +172.86.89.217 # sponge:4 +45.61.183.10 # honeylabs:4 +107.189.26.103 # sponge:2 +144.172.91.28 # sponge:2 +144.172.98.217 # sponge:2 +144.172.112.11 # honeylabs:2 +45.59.117.222 # sponge:1 +45.61.129.23 # sponge:1 +45.61.151.41 # sponge:1 +107.189.27.179 # sponge:1 +144.172.84.178 # sponge:1 +144.172.102.30 # sponge:1 +144.172.100.114 # honeylabs:1 +144.172.99.12 # honeylabs:1 +144.172.115.222 # honeylabs:1 +# AS51852 - PLI-AS +46.19.138.10 # sponge:50 +179.43.150.26 # sponge:16 honeylabs:16 +179.43.146.27 # sponge:12 honeylabs:2 +179.43.186.220 # sponge:10 honeylabs:3 +46.19.142.226 # sponge:4 honeylabs:6 +141.255.165.66 # honeylabs:5 +141.255.165.67 # sponge:3 +141.255.165.69 # sponge:1 +179.43.189.73 # sponge:1 +# AS400992 - ZHOUYISAT +23.172.217.87 # sponge:167 +23.172.217.77 # sponge:33 +194.48.142.88 # sponge:25 +194.48.142.134 # sponge:1 +# AS51396 - PFCLOUD +204.76.203.4 # sponge:56644 +204.76.203.18 # sponge:6091 +45.156.87.13 # sponge:3167 +204.76.203.214 # sponge:2690 honeylabs:25 +204.76.203.222 # sponge:2621 honeylabs:20 +204.76.203.221 # sponge:2600 honeylabs:18 +204.76.203.213 # sponge:2538 honeylabs:20 +176.65.148.243 # sponge:1836 honeylabs:2 +45.156.87.93 # sponge:1572 +176.65.148.84 # sponge:1532 +204.76.203.49 # sponge:1521 +45.153.34.149 # sponge:788 +45.153.34.181 # sponge:787 +45.156.87.166 # sponge:787 +45.135.194.24 # sponge:546 +204.76.203.7 # sponge:487 +176.65.148.93 # sponge:475 +176.65.149.67 # sponge:453 +45.135.193.198 # sponge:410 +45.135.193.193 # sponge:393 honeylabs:8 +176.65.134.48 # honeylabs:4 +176.65.149.27 # honeylabs:1 +176.65.149.31 # honeylabs:1 +176.65.149.212 # honeylabs:1 +# AS216246 - RU-AEZA-AS +45.151.101.38 # honeylabs:1 +176.124.222.61 # honeylabs:1 +# AS200651 - FLOKINET +185.100.87.136 # sponge:73 honeylabs:24 +185.100.85.48 # sponge:3 +# AS30823 - AUROLOGIC +172.86.92.151 # sponge:2 +# AS198953 - PROTON66 +176.120.22.61 # sponge:1415 honeylabs:64 +176.120.22.240 # sponge:44 honeylabs:30 +176.120.22.147 # sponge:8 +193.143.1.66 # honeylabs:6 +176.120.22.123 # sponge:2 +# AS200593 - PROSPERO-AS +91.215.85.104 # sponge:1 +# AS214940 - KPRONET +77.83.39.94 # sponge:46 +77.83.39.108 # sponge:11 +77.83.39.144 # sponge:2 +# AS211720 - Datashield +185.231.33.46 # sponge:20 +# AS216309 - INVISIONTECH-GROUP-SRL +67.219.214.53 # sponge:2 +67.219.214.90 # sponge:2 +67.219.214.127 # sponge:2 +67.219.214.145 # sponge:2 +67.219.214.154 # sponge:2 +67.219.214.247 # sponge:2 +67.219.214.1 # sponge:1 +67.219.214.2 # sponge:1 +67.219.214.17 # sponge:1 +67.219.214.19 # sponge:1 +67.219.214.27 # sponge:1 +67.219.214.32 # sponge:1 +67.219.214.33 # sponge:1 +67.219.214.36 # sponge:1 +67.219.214.50 # sponge:1 +67.219.214.52 # sponge:1 +67.219.214.55 # sponge:1 +67.219.214.57 # sponge:1 +67.219.214.58 # sponge:1 +67.219.214.60 # sponge:1 diff --git a/kevlar/2026-09-07/iocs/c2-paths.txt b/kevlar/2026-09-07/iocs/c2-paths.txt new file mode 100644 index 0000000..1ed0dfb --- /dev/null +++ b/kevlar/2026-09-07/iocs/c2-paths.txt @@ -0,0 +1,41 @@ +# notable HTTP paths observed, week 2026-08-31 to 2026-09-07 +/remote/login?lang=en -- 30 hit(s), AS198953 +/ -- 11 hit(s), AS14956, AS51852, AS200651 +/.env -- 5 hit(s), AS14956, AS51852 +/login/?login_only=1 -- 3 hit(s), AS51852 +/openid_connect/cpanelid -- 3 hit(s), AS51852 +/eventmanager -- 3 hit(s), AS200651 +/api/client/update?arch=amd64&commit=08059e95dacafe0bf6e5782f8e2c8ec9cd8c5a17&os=windows -- 3 hit(s), AS200651 +/api/checkin -- 3 hit(s), AS200651 +/images/transparentpix.gif -- 3 hit(s), AS200651 +/containers/json -- 2 hit(s), AS210644 +http://proxy.flarevpn.digital:8080/judge -- 2 hit(s), AS51396 +/index.php?lang=../../../../../../../../tmp/index1 -- 1 hit(s), AS210644 +/index.php?lang=../../../../../../../../usr/local/lib/php/pearcmd&+config-create+/&/+/tmp/index1.php -- 1 hit(s), AS210644 +/public/index.php?s=/index/\think\app/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1][]=Hello -- 1 hit(s), AS210644 +/index.php?s=/index/\think\app/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1][]=Hello -- 1 hit(s), AS210644 +/app/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php -- 1 hit(s), AS210644 +/apps/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php -- 1 hit(s), AS210644 +/public/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php -- 1 hit(s), AS210644 +/panel/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php -- 1 hit(s), AS210644 +/workspace/drupal/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php -- 1 hit(s), AS210644 +/blog/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php -- 1 hit(s), AS210644 +/backup/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php -- 1 hit(s), AS210644 +/admin/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php -- 1 hit(s), AS210644 +/crm/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php -- 1 hit(s), AS210644 +/cms/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php -- 1 hit(s), AS210644 +/demo/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php -- 1 hit(s), AS210644 +/api/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php -- 1 hit(s), AS210644 +/testing/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php -- 1 hit(s), AS210644 +/test/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php -- 1 hit(s), AS210644 +/tests/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php -- 1 hit(s), AS210644 +/V2/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php -- 1 hit(s), AS210644 +/ws/ec/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php -- 1 hit(s), AS210644 +/zend/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php -- 1 hit(s), AS210644 +/yii/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php -- 1 hit(s), AS210644 +/ws/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php -- 1 hit(s), AS210644 +/www/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php -- 1 hit(s), AS210644 +/laravel/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php -- 1 hit(s), AS210644 +/lib/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php -- 1 hit(s), AS210644 +/lib/phpunit/Util/PHP/eval-stdin.php -- 1 hit(s), AS210644 +/lib/phpunit/src/Util/PHP/eval-stdin.php -- 1 hit(s), AS210644 diff --git a/kevlar/2026-09-07/iocs/fingerprints.txt b/kevlar/2026-09-07/iocs/fingerprints.txt new file mode 100644 index 0000000..c3de1f3 --- /dev/null +++ b/kevlar/2026-09-07/iocs/fingerprints.txt @@ -0,0 +1,34 @@ +# fingerprints observed, week 2026-08-31 to 2026-09-07 +# JA4 TLS client fingerprints +t13i181000_85036bcba153_d41ae481755e -- 2 IP(s): 45.151.101.38 (AS216246), 45.61.149.189 (AS14956) +t12i210600_76e208dd3e22_f28add8e7af0 -- 1 IP(s): 176.120.22.240 (AS198953) +t13i1909h2_9dc949149365_97f8aa674fd9 -- 1 IP(s): 185.100.87.136 (AS200651) +t13i170900_5b57614c22b0_78e6aca7449b -- 1 IP(s): 185.246.217.150 (AS210644) +t13i190800_9dc949149365_97f8aa674fd9 -- 1 IP(s): 46.19.142.226 (AS51852) +t13i1310h1_f57a46bbacb6_e7c285222651 -- 1 IP(s): 179.43.146.27 (AS51852) +t13i131000_f57a46bbacb6_ab7e3b40a677 -- 1 IP(s): 179.43.186.220 (AS51852) +t13i100900_61a7ad8aa9b6_88aa062a14c8 -- 1 IP(s): 144.172.99.12 (AS14956) +t13i311000_e8f1e7e78f70_d41ae481755e -- 1 IP(s): 144.172.115.222 (AS14956) + +# JA4H HTTP fingerprints +ge11nn0400_9c3956fad5da -- 3 IP(s): 176.65.134.48 (AS51396), 179.43.146.27 (AS51852), 167.88.168.121 (AS14956) +ge11nn0400_88d30a62b7ad -- 2 IP(s): 185.100.87.136 (AS200651), 179.43.186.220 (AS51852) +po11nn0600_def5433ae821 -- 1 IP(s): 45.151.101.38 (AS216246) +ge11nn0200_549fad093d6b -- 1 IP(s): 176.120.22.240 (AS198953) +ge11nn0300_80168362a4ec -- 1 IP(s): 176.120.22.240 (AS198953) +po11nn0600_c9506d37ac14 -- 1 IP(s): 185.100.87.136 (AS200651) +po11nn0500_e4a47a99f1ac -- 1 IP(s): 185.100.87.136 (AS200651) +ge11nn0500_7992432eef13 -- 1 IP(s): 185.246.217.150 (AS210644) +ge11nn0700_3161ce9d7233 -- 1 IP(s): 185.246.217.150 (AS210644) +po11nn0700_3161ce9d7233 -- 1 IP(s): 185.246.217.150 (AS210644) +ge11nn0500_3012a89e1aee -- 1 IP(s): 185.246.217.150 (AS210644) +po11nn0500_c5c1780925fe -- 1 IP(s): 46.19.142.226 (AS51852) +ge11nn0300_0db47b7d240d -- 1 IP(s): 46.19.142.226 (AS51852) +ge11nn0300_341eb0d8946c -- 1 IP(s): 179.43.150.26 (AS51852) +ge11nn0400_8fd06a127c33 -- 1 IP(s): 45.61.149.189 (AS14956) +ge11nn0400_c3abebcf3d28 -- 1 IP(s): 216.126.227.187 (AS14956) +ge11nn0300_7fd797acd99d -- 1 IP(s): 144.172.99.12 (AS14956) + +# HASSH SSH fingerprints +19532158b559096b89b1a5f7d17175b2 -- 1 IP(s): 185.246.217.150 (AS210644) +98ddc5604ef6a1006a2b49a58759fbe6 -- 1 IP(s): 82.39.165.100 (AS57043) diff --git a/kevlar/2026-09-07/sponge/bp-ip-sessions.csv b/kevlar/2026-09-07/sponge/bp-ip-sessions.csv new file mode 100644 index 0000000..098ae95 --- /dev/null +++ b/kevlar/2026-09-07/sponge/bp-ip-sessions.csv @@ -0,0 +1,13 @@ +ip,asn,name,sessions,first_seen,last_seen,tags,protocols,bytes_total +"176.120.22.61","AS198953","PROTON66","5","2026-09-04","2026-09-04","honeypot sensor:contabo-sponge-01-ts contabo-sponge-01-ts","","528" +"204.76.203.4","AS51396","PFCLOUD","5","2026-09-06","2026-09-06","contabo-sponge-01-ts honeypot sensor:contabo-sponge-01-ts sensor:bahrain-sponge-01-ts bahrain-sponge-01-ts","","310" +"204.76.203.222","AS51396","PFCLOUD","5","2026-09-06","2026-09-06","sponge-01-ts honeypot sensor:sponge-01-ts contabo-sponge-01-ts sensor:contabo-sponge-01-ts","","282" +"185.246.217.150","AS210644","AEZA","0","","","","","0" +"45.61.157.82","AS14956","ROUTERHOSTING","0","","","","","0" +"185.100.87.136","AS200651","FLOKINET","5","2026-09-06","2026-09-06","sensor:frantech-ts honeypot frantech-ts contabo-sponge-01-ts sensor:contabo-sponge-01-ts","","2560" +"144.172.108.79","AS14956","ROUTERHOSTING","0","","","","","0" +"179.43.150.26","AS51852","PLI","5","2026-08-31","2026-08-31","frantech-ts honeypot sensor:frantech-ts sensor:netcup-ts netcup-ts","","4535" +"23.172.217.87","AS400992","ZHOUYISAT","5","2026-09-06","2026-09-06","contabo-sponge-01-ts honeypot sensor:contabo-sponge-01-ts sponge-01-ts sensor:sponge-01-ts","","758" +"38.54.2.209","AS138915","KAOPU-HK","5","2026-09-06","2026-09-06","sensor:bahrain-sponge-01-ts honeypot bahrain-sponge-01-ts","","1035" +"77.83.39.94","AS214940","KPRONET","5","2026-09-01","2026-09-02","bahrain-sponge-01-ts sensor:bahrain-sponge-01-ts honeypot contabo-sponge-02-ts sensor:contabo-sponge-02-ts","","6882" +"77.91.122.2","AS209847","THE","3","2026-09-03","2026-09-03","honeypot frantech-ts sensor:frantech-ts","","1971" \ No newline at end of file diff --git a/kevlar/2026-09-07/sponge/data-range-1d.ndjson b/kevlar/2026-09-07/sponge/data-range-1d.ndjson new file mode 100644 index 0000000..4934fbc --- /dev/null +++ b/kevlar/2026-09-07/sponge/data-range-1d.ndjson @@ -0,0 +1,180 @@ +{"doc_count":28273,"timestamp":"2026-03-12T00:00:00.000Z"} +{"doc_count":40892,"timestamp":"2026-03-13T00:00:00.000Z"} +{"doc_count":133074,"timestamp":"2026-03-14T00:00:00.000Z"} +{"doc_count":407893,"timestamp":"2026-03-15T00:00:00.000Z"} +{"doc_count":725521,"timestamp":"2026-03-16T00:00:00.000Z"} +{"doc_count":477862,"timestamp":"2026-03-17T00:00:00.000Z"} +{"doc_count":390808,"timestamp":"2026-03-18T00:00:00.000Z"} +{"doc_count":389978,"timestamp":"2026-03-19T00:00:00.000Z"} +{"doc_count":226969,"timestamp":"2026-03-20T00:00:00.000Z"} +{"doc_count":652871,"timestamp":"2026-03-21T00:00:00.000Z"} +{"doc_count":446755,"timestamp":"2026-03-22T00:00:00.000Z"} +{"doc_count":385368,"timestamp":"2026-03-23T00:00:00.000Z"} +{"doc_count":443941,"timestamp":"2026-03-24T00:00:00.000Z"} +{"doc_count":316830,"timestamp":"2026-03-25T00:00:00.000Z"} +{"doc_count":479054,"timestamp":"2026-03-26T00:00:00.000Z"} +{"doc_count":427638,"timestamp":"2026-03-27T00:00:00.000Z"} +{"doc_count":359836,"timestamp":"2026-03-28T00:00:00.000Z"} +{"doc_count":649248,"timestamp":"2026-03-29T00:00:00.000Z"} +{"doc_count":824444,"timestamp":"2026-03-30T00:00:00.000Z"} +{"doc_count":1264114,"timestamp":"2026-03-31T00:00:00.000Z"} +{"doc_count":515410,"timestamp":"2026-04-01T00:00:00.000Z"} +{"doc_count":1331047,"timestamp":"2026-04-02T00:00:00.000Z"} +{"doc_count":424412,"timestamp":"2026-04-03T00:00:00.000Z"} +{"doc_count":665490,"timestamp":"2026-04-04T00:00:00.000Z"} +{"doc_count":768919,"timestamp":"2026-04-05T00:00:00.000Z"} +{"doc_count":532794,"timestamp":"2026-04-06T00:00:00.000Z"} +{"doc_count":792419,"timestamp":"2026-04-07T00:00:00.000Z"} +{"doc_count":613418,"timestamp":"2026-04-08T00:00:00.000Z"} +{"doc_count":818144,"timestamp":"2026-04-09T00:00:00.000Z"} +{"doc_count":825845,"timestamp":"2026-04-10T00:00:00.000Z"} +{"doc_count":655960,"timestamp":"2026-04-11T00:00:00.000Z"} +{"doc_count":820512,"timestamp":"2026-04-12T00:00:00.000Z"} +{"doc_count":885189,"timestamp":"2026-04-13T00:00:00.000Z"} +{"doc_count":445782,"timestamp":"2026-04-14T00:00:00.000Z"} +{"doc_count":573071,"timestamp":"2026-04-15T00:00:00.000Z"} +{"doc_count":712526,"timestamp":"2026-04-16T00:00:00.000Z"} +{"doc_count":501397,"timestamp":"2026-04-17T00:00:00.000Z"} +{"doc_count":614470,"timestamp":"2026-04-18T00:00:00.000Z"} +{"doc_count":615655,"timestamp":"2026-04-19T00:00:00.000Z"} +{"doc_count":746778,"timestamp":"2026-04-20T00:00:00.000Z"} +{"doc_count":582810,"timestamp":"2026-04-21T00:00:00.000Z"} +{"doc_count":564665,"timestamp":"2026-04-22T00:00:00.000Z"} +{"doc_count":539228,"timestamp":"2026-04-23T00:00:00.000Z"} +{"doc_count":620765,"timestamp":"2026-04-24T00:00:00.000Z"} +{"doc_count":516569,"timestamp":"2026-04-25T00:00:00.000Z"} +{"doc_count":563556,"timestamp":"2026-04-26T00:00:00.000Z"} +{"doc_count":511842,"timestamp":"2026-04-27T00:00:00.000Z"} +{"doc_count":533989,"timestamp":"2026-04-28T00:00:00.000Z"} +{"doc_count":753556,"timestamp":"2026-04-29T00:00:00.000Z"} +{"doc_count":1114600,"timestamp":"2026-04-30T00:00:00.000Z"} +{"doc_count":1888857,"timestamp":"2026-05-01T00:00:00.000Z"} +{"doc_count":1421851,"timestamp":"2026-05-02T00:00:00.000Z"} +{"doc_count":1980586,"timestamp":"2026-05-03T00:00:00.000Z"} +{"doc_count":1647458,"timestamp":"2026-05-04T00:00:00.000Z"} +{"doc_count":1965381,"timestamp":"2026-05-05T00:00:00.000Z"} +{"doc_count":3071933,"timestamp":"2026-05-06T00:00:00.000Z"} +{"doc_count":2159620,"timestamp":"2026-05-07T00:00:00.000Z"} +{"doc_count":949027,"timestamp":"2026-05-08T00:00:00.000Z"} +{"doc_count":1633048,"timestamp":"2026-05-09T00:00:00.000Z"} +{"doc_count":528243,"timestamp":"2026-05-10T00:00:00.000Z"} +{"doc_count":642031,"timestamp":"2026-05-11T00:00:00.000Z"} +{"doc_count":771894,"timestamp":"2026-05-12T00:00:00.000Z"} +{"doc_count":737631,"timestamp":"2026-05-13T00:00:00.000Z"} +{"doc_count":864780,"timestamp":"2026-05-14T00:00:00.000Z"} +{"doc_count":1363547,"timestamp":"2026-05-15T00:00:00.000Z"} +{"doc_count":1513136,"timestamp":"2026-05-16T00:00:00.000Z"} +{"doc_count":1646432,"timestamp":"2026-05-17T00:00:00.000Z"} +{"doc_count":1830906,"timestamp":"2026-05-18T00:00:00.000Z"} +{"doc_count":726796,"timestamp":"2026-05-19T00:00:00.000Z"} +{"doc_count":1492175,"timestamp":"2026-05-20T00:00:00.000Z"} +{"doc_count":1531922,"timestamp":"2026-05-21T00:00:00.000Z"} +{"doc_count":649388,"timestamp":"2026-05-22T00:00:00.000Z"} +{"doc_count":679049,"timestamp":"2026-05-23T00:00:00.000Z"} +{"doc_count":847052,"timestamp":"2026-05-24T00:00:00.000Z"} +{"doc_count":631185,"timestamp":"2026-05-25T00:00:00.000Z"} +{"doc_count":725664,"timestamp":"2026-05-26T00:00:00.000Z"} +{"doc_count":544449,"timestamp":"2026-05-27T00:00:00.000Z"} +{"doc_count":650432,"timestamp":"2026-05-28T00:00:00.000Z"} +{"doc_count":475667,"timestamp":"2026-05-29T00:00:00.000Z"} +{"doc_count":444926,"timestamp":"2026-05-30T00:00:00.000Z"} +{"doc_count":721274,"timestamp":"2026-05-31T00:00:00.000Z"} +{"doc_count":829278,"timestamp":"2026-06-01T00:00:00.000Z"} +{"doc_count":989749,"timestamp":"2026-06-02T00:00:00.000Z"} +{"doc_count":526930,"timestamp":"2026-06-03T00:00:00.000Z"} +{"doc_count":889291,"timestamp":"2026-06-04T00:00:00.000Z"} +{"doc_count":920511,"timestamp":"2026-06-05T00:00:00.000Z"} +{"doc_count":730025,"timestamp":"2026-06-06T00:00:00.000Z"} +{"doc_count":818865,"timestamp":"2026-06-07T00:00:00.000Z"} +{"doc_count":806738,"timestamp":"2026-06-08T00:00:00.000Z"} +{"doc_count":744136,"timestamp":"2026-06-09T00:00:00.000Z"} +{"doc_count":618610,"timestamp":"2026-06-10T00:00:00.000Z"} +{"doc_count":690426,"timestamp":"2026-06-11T00:00:00.000Z"} +{"doc_count":884615,"timestamp":"2026-06-12T00:00:00.000Z"} +{"doc_count":778984,"timestamp":"2026-06-13T00:00:00.000Z"} +{"doc_count":1504116,"timestamp":"2026-06-14T00:00:00.000Z"} +{"doc_count":1077223,"timestamp":"2026-06-15T00:00:00.000Z"} +{"doc_count":833047,"timestamp":"2026-06-16T00:00:00.000Z"} +{"doc_count":740688,"timestamp":"2026-06-17T00:00:00.000Z"} +{"doc_count":649752,"timestamp":"2026-06-18T00:00:00.000Z"} +{"doc_count":590548,"timestamp":"2026-06-19T00:00:00.000Z"} +{"doc_count":687409,"timestamp":"2026-06-20T00:00:00.000Z"} +{"doc_count":628622,"timestamp":"2026-06-21T00:00:00.000Z"} +{"doc_count":767654,"timestamp":"2026-06-22T00:00:00.000Z"} +{"doc_count":757377,"timestamp":"2026-06-23T00:00:00.000Z"} +{"doc_count":824613,"timestamp":"2026-06-24T00:00:00.000Z"} +{"doc_count":1240071,"timestamp":"2026-06-25T00:00:00.000Z"} +{"doc_count":759172,"timestamp":"2026-06-26T00:00:00.000Z"} +{"doc_count":662908,"timestamp":"2026-06-27T00:00:00.000Z"} +{"doc_count":728841,"timestamp":"2026-06-28T00:00:00.000Z"} +{"doc_count":853084,"timestamp":"2026-06-29T00:00:00.000Z"} +{"doc_count":1041038,"timestamp":"2026-06-30T00:00:00.000Z"} +{"doc_count":652717,"timestamp":"2026-07-01T00:00:00.000Z"} +{"doc_count":672883,"timestamp":"2026-07-02T00:00:00.000Z"} +{"doc_count":616853,"timestamp":"2026-07-03T00:00:00.000Z"} +{"doc_count":584509,"timestamp":"2026-07-04T00:00:00.000Z"} +{"doc_count":776678,"timestamp":"2026-07-05T00:00:00.000Z"} +{"doc_count":611925,"timestamp":"2026-07-06T00:00:00.000Z"} +{"doc_count":772239,"timestamp":"2026-07-07T00:00:00.000Z"} +{"doc_count":638426,"timestamp":"2026-07-08T00:00:00.000Z"} +{"doc_count":520175,"timestamp":"2026-07-09T00:00:00.000Z"} +{"doc_count":619359,"timestamp":"2026-07-10T00:00:00.000Z"} +{"doc_count":792185,"timestamp":"2026-07-11T00:00:00.000Z"} +{"doc_count":821407,"timestamp":"2026-07-12T00:00:00.000Z"} +{"doc_count":910993,"timestamp":"2026-07-13T00:00:00.000Z"} +{"doc_count":1030534,"timestamp":"2026-07-14T00:00:00.000Z"} +{"doc_count":924665,"timestamp":"2026-07-15T00:00:00.000Z"} +{"doc_count":722675,"timestamp":"2026-07-16T00:00:00.000Z"} +{"doc_count":1070772,"timestamp":"2026-07-17T00:00:00.000Z"} +{"doc_count":977847,"timestamp":"2026-07-18T00:00:00.000Z"} +{"doc_count":1328861,"timestamp":"2026-07-19T00:00:00.000Z"} +{"doc_count":984357,"timestamp":"2026-07-20T00:00:00.000Z"} +{"doc_count":625462,"timestamp":"2026-07-21T00:00:00.000Z"} +{"doc_count":1577311,"timestamp":"2026-07-22T00:00:00.000Z"} +{"doc_count":1544592,"timestamp":"2026-07-23T00:00:00.000Z"} +{"doc_count":1491010,"timestamp":"2026-07-24T00:00:00.000Z"} +{"doc_count":1382342,"timestamp":"2026-07-25T00:00:00.000Z"} +{"doc_count":1562661,"timestamp":"2026-07-26T00:00:00.000Z"} +{"doc_count":1065732,"timestamp":"2026-07-27T00:00:00.000Z"} +{"doc_count":1135296,"timestamp":"2026-07-28T00:00:00.000Z"} +{"doc_count":1010276,"timestamp":"2026-07-29T00:00:00.000Z"} +{"doc_count":847589,"timestamp":"2026-07-30T00:00:00.000Z"} +{"doc_count":1049542,"timestamp":"2026-07-31T00:00:00.000Z"} +{"doc_count":1291676,"timestamp":"2026-08-01T00:00:00.000Z"} +{"doc_count":1378875,"timestamp":"2026-08-02T00:00:00.000Z"} +{"doc_count":1044766,"timestamp":"2026-08-03T00:00:00.000Z"} +{"doc_count":4128756,"timestamp":"2026-08-04T00:00:00.000Z"} +{"doc_count":731675,"timestamp":"2026-08-05T00:00:00.000Z"} +{"doc_count":634611,"timestamp":"2026-08-06T00:00:00.000Z"} +{"doc_count":946631,"timestamp":"2026-08-07T00:00:00.000Z"} +{"doc_count":1010954,"timestamp":"2026-08-08T00:00:00.000Z"} +{"doc_count":1160580,"timestamp":"2026-08-09T00:00:00.000Z"} +{"doc_count":1064341,"timestamp":"2026-08-10T00:00:00.000Z"} +{"doc_count":739995,"timestamp":"2026-08-11T00:00:00.000Z"} +{"doc_count":742067,"timestamp":"2026-08-12T00:00:00.000Z"} +{"doc_count":791067,"timestamp":"2026-08-13T00:00:00.000Z"} +{"doc_count":928074,"timestamp":"2026-08-14T00:00:00.000Z"} +{"doc_count":958381,"timestamp":"2026-08-15T00:00:00.000Z"} +{"doc_count":1010572,"timestamp":"2026-08-16T00:00:00.000Z"} +{"doc_count":1143359,"timestamp":"2026-08-17T00:00:00.000Z"} +{"doc_count":1314109,"timestamp":"2026-08-18T00:00:00.000Z"} +{"doc_count":856073,"timestamp":"2026-08-19T00:00:00.000Z"} +{"doc_count":1096178,"timestamp":"2026-08-20T00:00:00.000Z"} +{"doc_count":831694,"timestamp":"2026-08-21T00:00:00.000Z"} +{"doc_count":1323332,"timestamp":"2026-08-22T00:00:00.000Z"} +{"doc_count":1447112,"timestamp":"2026-08-23T00:00:00.000Z"} +{"doc_count":1499746,"timestamp":"2026-08-24T00:00:00.000Z"} +{"doc_count":928712,"timestamp":"2026-08-25T00:00:00.000Z"} +{"doc_count":1188691,"timestamp":"2026-08-26T00:00:00.000Z"} +{"doc_count":1231680,"timestamp":"2026-08-27T00:00:00.000Z"} +{"doc_count":1153062,"timestamp":"2026-08-28T00:00:00.000Z"} +{"doc_count":1583964,"timestamp":"2026-08-29T00:00:00.000Z"} +{"doc_count":880105,"timestamp":"2026-08-30T00:00:00.000Z"} +{"doc_count":706273,"timestamp":"2026-08-31T00:00:00.000Z"} +{"doc_count":783020,"timestamp":"2026-09-01T00:00:00.000Z"} +{"doc_count":818030,"timestamp":"2026-09-02T00:00:00.000Z"} +{"doc_count":1278154,"timestamp":"2026-09-03T00:00:00.000Z"} +{"doc_count":1379649,"timestamp":"2026-09-04T00:00:00.000Z"} +{"doc_count":1436160,"timestamp":"2026-09-05T00:00:00.000Z"} +{"doc_count":1262483,"timestamp":"2026-09-06T00:00:00.000Z"} +{"doc_count":411208,"timestamp":"2026-09-07T00:00:00.000Z"} diff --git a/kevlar/2026-09-07/sponge/port-targeting-AS138915.ndjson b/kevlar/2026-09-07/sponge/port-targeting-AS138915.ndjson new file mode 100644 index 0000000..a5b0bc0 --- /dev/null +++ b/kevlar/2026-09-07/sponge/port-targeting-AS138915.ndjson @@ -0,0 +1,20 @@ +{"doc_count":13604,"key":80} +{"doc_count":9109,"key":123} +{"doc_count":5222,"key":5355} +{"doc_count":4953,"key":137} +{"doc_count":4714,"key":443} +{"doc_count":3781,"key":5353} +{"doc_count":3451,"key":1900} +{"doc_count":1663,"key":5678} +{"doc_count":840,"key":138} +{"doc_count":250,"key":0} +{"doc_count":127,"key":67} +{"doc_count":50,"key":28591} +{"doc_count":20,"key":53} +{"doc_count":20,"key":50001} +{"doc_count":20,"key":50002} +{"doc_count":20,"key":50003} +{"doc_count":16,"key":9999} +{"doc_count":15,"key":20002} +{"doc_count":15,"key":20004} +{"doc_count":11,"key":5686} diff --git a/kevlar/2026-09-07/sponge/port-targeting-AS140666.ndjson b/kevlar/2026-09-07/sponge/port-targeting-AS140666.ndjson new file mode 100644 index 0000000..e69de29 diff --git a/kevlar/2026-09-07/sponge/port-targeting-AS14956.ndjson b/kevlar/2026-09-07/sponge/port-targeting-AS14956.ndjson new file mode 100644 index 0000000..c7ec49e --- /dev/null +++ b/kevlar/2026-09-07/sponge/port-targeting-AS14956.ndjson @@ -0,0 +1,20 @@ +{"doc_count":50,"key":22} +{"doc_count":20,"key":8545} +{"doc_count":20,"key":8546} +{"doc_count":20,"key":8547} +{"doc_count":20,"key":8548} +{"doc_count":20,"key":8549} +{"doc_count":12,"key":5060} +{"doc_count":11,"key":443} +{"doc_count":6,"key":80} +{"doc_count":6,"key":587} +{"doc_count":5,"key":7860} +{"doc_count":4,"key":8899} +{"doc_count":4,"key":8900} +{"doc_count":3,"key":445} +{"doc_count":3,"key":1723} +{"doc_count":3,"key":8080} +{"doc_count":2,"key":0} +{"doc_count":2,"key":8022} +{"doc_count":2,"key":11211} +{"doc_count":2,"key":22222} diff --git a/kevlar/2026-09-07/sponge/port-targeting-AS198953.ndjson b/kevlar/2026-09-07/sponge/port-targeting-AS198953.ndjson new file mode 100644 index 0000000..c65aae7 --- /dev/null +++ b/kevlar/2026-09-07/sponge/port-targeting-AS198953.ndjson @@ -0,0 +1,20 @@ +{"doc_count":22,"key":4443} +{"doc_count":21,"key":1433} +{"doc_count":21,"key":1434} +{"doc_count":21,"key":1500} +{"doc_count":21,"key":1501} +{"doc_count":21,"key":1800} +{"doc_count":21,"key":2008} +{"doc_count":21,"key":3005} +{"doc_count":21,"key":3333} +{"doc_count":21,"key":4433} +{"doc_count":21,"key":5000} +{"doc_count":19,"key":11443} +{"doc_count":14,"key":10443} +{"doc_count":12,"key":443} +{"doc_count":12,"key":8443} +{"doc_count":11,"key":222} +{"doc_count":11,"key":1100} +{"doc_count":11,"key":1111} +{"doc_count":11,"key":1112} +{"doc_count":11,"key":1200} diff --git a/kevlar/2026-09-07/sponge/port-targeting-AS200593.ndjson b/kevlar/2026-09-07/sponge/port-targeting-AS200593.ndjson new file mode 100644 index 0000000..7ba6ae2 --- /dev/null +++ b/kevlar/2026-09-07/sponge/port-targeting-AS200593.ndjson @@ -0,0 +1 @@ +{"doc_count":1,"key":443} diff --git a/kevlar/2026-09-07/sponge/port-targeting-AS200651.ndjson b/kevlar/2026-09-07/sponge/port-targeting-AS200651.ndjson new file mode 100644 index 0000000..2c422d4 --- /dev/null +++ b/kevlar/2026-09-07/sponge/port-targeting-AS200651.ndjson @@ -0,0 +1,4 @@ +{"doc_count":60,"key":443} +{"doc_count":7,"key":8443} +{"doc_count":6,"key":8080} +{"doc_count":3,"key":22} diff --git a/kevlar/2026-09-07/sponge/port-targeting-AS202685.ndjson b/kevlar/2026-09-07/sponge/port-targeting-AS202685.ndjson new file mode 100644 index 0000000..e69de29 diff --git a/kevlar/2026-09-07/sponge/port-targeting-AS206728.ndjson b/kevlar/2026-09-07/sponge/port-targeting-AS206728.ndjson new file mode 100644 index 0000000..e69de29 diff --git a/kevlar/2026-09-07/sponge/port-targeting-AS209847.ndjson b/kevlar/2026-09-07/sponge/port-targeting-AS209847.ndjson new file mode 100644 index 0000000..cb682f6 --- /dev/null +++ b/kevlar/2026-09-07/sponge/port-targeting-AS209847.ndjson @@ -0,0 +1 @@ +{"doc_count":3,"key":3389} diff --git a/kevlar/2026-09-07/sponge/port-targeting-AS210644.ndjson b/kevlar/2026-09-07/sponge/port-targeting-AS210644.ndjson new file mode 100644 index 0000000..ee73b54 --- /dev/null +++ b/kevlar/2026-09-07/sponge/port-targeting-AS210644.ndjson @@ -0,0 +1,20 @@ +{"doc_count":45,"key":443} +{"doc_count":13,"key":8888} +{"doc_count":11,"key":22} +{"doc_count":4,"key":4145} +{"doc_count":3,"key":3128} +{"doc_count":2,"key":2080} +{"doc_count":2,"key":3125} +{"doc_count":2,"key":5678} +{"doc_count":2,"key":8254} +{"doc_count":1,"key":808} +{"doc_count":1,"key":999} +{"doc_count":1,"key":1080} +{"doc_count":1,"key":1111} +{"doc_count":1,"key":4153} +{"doc_count":1,"key":6588} +{"doc_count":1,"key":8006} +{"doc_count":1,"key":8008} +{"doc_count":1,"key":8085} +{"doc_count":1,"key":8090} +{"doc_count":1,"key":8181} diff --git a/kevlar/2026-09-07/sponge/port-targeting-AS211720.ndjson b/kevlar/2026-09-07/sponge/port-targeting-AS211720.ndjson new file mode 100644 index 0000000..b42cc18 --- /dev/null +++ b/kevlar/2026-09-07/sponge/port-targeting-AS211720.ndjson @@ -0,0 +1,14 @@ +{"doc_count":5,"key":50443} +{"doc_count":2,"key":443} +{"doc_count":2,"key":444} +{"doc_count":1,"key":4430} +{"doc_count":1,"key":4433} +{"doc_count":1,"key":4443} +{"doc_count":1,"key":4444} +{"doc_count":1,"key":5443} +{"doc_count":1,"key":6443} +{"doc_count":1,"key":7443} +{"doc_count":1,"key":8443} +{"doc_count":1,"key":9443} +{"doc_count":1,"key":10443} +{"doc_count":1,"key":60443} diff --git a/kevlar/2026-09-07/sponge/port-targeting-AS213702.ndjson b/kevlar/2026-09-07/sponge/port-targeting-AS213702.ndjson new file mode 100644 index 0000000..e69de29 diff --git a/kevlar/2026-09-07/sponge/port-targeting-AS214351.ndjson b/kevlar/2026-09-07/sponge/port-targeting-AS214351.ndjson new file mode 100644 index 0000000..e69de29 diff --git a/kevlar/2026-09-07/sponge/port-targeting-AS214940.ndjson b/kevlar/2026-09-07/sponge/port-targeting-AS214940.ndjson new file mode 100644 index 0000000..6afc3b9 --- /dev/null +++ b/kevlar/2026-09-07/sponge/port-targeting-AS214940.ndjson @@ -0,0 +1,3 @@ +{"doc_count":31,"key":80} +{"doc_count":17,"key":443} +{"doc_count":11,"key":2525} diff --git a/kevlar/2026-09-07/sponge/port-targeting-AS216139.ndjson b/kevlar/2026-09-07/sponge/port-targeting-AS216139.ndjson new file mode 100644 index 0000000..e69de29 diff --git a/kevlar/2026-09-07/sponge/port-targeting-AS216246.ndjson b/kevlar/2026-09-07/sponge/port-targeting-AS216246.ndjson new file mode 100644 index 0000000..e69de29 diff --git a/kevlar/2026-09-07/sponge/port-targeting-AS216309.ndjson b/kevlar/2026-09-07/sponge/port-targeting-AS216309.ndjson new file mode 100644 index 0000000..a729853 --- /dev/null +++ b/kevlar/2026-09-07/sponge/port-targeting-AS216309.ndjson @@ -0,0 +1 @@ +{"doc_count":60,"key":80} diff --git a/kevlar/2026-09-07/sponge/port-targeting-AS30823.ndjson b/kevlar/2026-09-07/sponge/port-targeting-AS30823.ndjson new file mode 100644 index 0000000..27566e8 --- /dev/null +++ b/kevlar/2026-09-07/sponge/port-targeting-AS30823.ndjson @@ -0,0 +1 @@ +{"doc_count":2,"key":5060} diff --git a/kevlar/2026-09-07/sponge/port-targeting-AS33993.ndjson b/kevlar/2026-09-07/sponge/port-targeting-AS33993.ndjson new file mode 100644 index 0000000..e69de29 diff --git a/kevlar/2026-09-07/sponge/port-targeting-AS394711.ndjson b/kevlar/2026-09-07/sponge/port-targeting-AS394711.ndjson new file mode 100644 index 0000000..e69de29 diff --git a/kevlar/2026-09-07/sponge/port-targeting-AS400992.ndjson b/kevlar/2026-09-07/sponge/port-targeting-AS400992.ndjson new file mode 100644 index 0000000..2d00c66 --- /dev/null +++ b/kevlar/2026-09-07/sponge/port-targeting-AS400992.ndjson @@ -0,0 +1,14 @@ +{"doc_count":101,"key":443} +{"doc_count":99,"key":80} +{"doc_count":4,"key":2883} +{"doc_count":3,"key":2880} +{"doc_count":3,"key":2881} +{"doc_count":3,"key":2882} +{"doc_count":3,"key":2887} +{"doc_count":2,"key":2877} +{"doc_count":2,"key":2878} +{"doc_count":2,"key":2886} +{"doc_count":1,"key":2879} +{"doc_count":1,"key":2884} +{"doc_count":1,"key":2885} +{"doc_count":1,"key":25565} diff --git a/kevlar/2026-09-07/sponge/port-targeting-AS51396.ndjson b/kevlar/2026-09-07/sponge/port-targeting-AS51396.ndjson new file mode 100644 index 0000000..0bb8059 --- /dev/null +++ b/kevlar/2026-09-07/sponge/port-targeting-AS51396.ndjson @@ -0,0 +1,20 @@ +{"doc_count":7120,"key":22} +{"doc_count":6384,"key":80} +{"doc_count":702,"key":8080} +{"doc_count":435,"key":1080} +{"doc_count":426,"key":1081} +{"doc_count":335,"key":3306} +{"doc_count":322,"key":8888} +{"doc_count":259,"key":3128} +{"doc_count":249,"key":25565} +{"doc_count":246,"key":888} +{"doc_count":236,"key":4145} +{"doc_count":190,"key":1090} +{"doc_count":188,"key":1086} +{"doc_count":187,"key":443} +{"doc_count":187,"key":1088} +{"doc_count":165,"key":27017} +{"doc_count":120,"key":8000} +{"doc_count":100,"key":9999} +{"doc_count":98,"key":8545} +{"doc_count":91,"key":53} diff --git a/kevlar/2026-09-07/sponge/port-targeting-AS51852.ndjson b/kevlar/2026-09-07/sponge/port-targeting-AS51852.ndjson new file mode 100644 index 0000000..d2af7dd --- /dev/null +++ b/kevlar/2026-09-07/sponge/port-targeting-AS51852.ndjson @@ -0,0 +1,20 @@ +{"doc_count":10,"key":443} +{"doc_count":10,"key":8443} +{"doc_count":8,"key":5062} +{"doc_count":6,"key":5060} +{"doc_count":6,"key":5960} +{"doc_count":6,"key":6051} +{"doc_count":6,"key":7070} +{"doc_count":6,"key":7080} +{"doc_count":6,"key":8000} +{"doc_count":6,"key":8050} +{"doc_count":4,"key":1701} +{"doc_count":4,"key":2087} +{"doc_count":3,"key":5860} +{"doc_count":3,"key":6060} +{"doc_count":2,"key":2096} +{"doc_count":2,"key":3128} +{"doc_count":2,"key":8006} +{"doc_count":2,"key":8008} +{"doc_count":2,"key":8082} +{"doc_count":2,"key":32400} diff --git a/kevlar/2026-09-07/sponge/port-targeting-AS57043.ndjson b/kevlar/2026-09-07/sponge/port-targeting-AS57043.ndjson new file mode 100644 index 0000000..fce20c9 --- /dev/null +++ b/kevlar/2026-09-07/sponge/port-targeting-AS57043.ndjson @@ -0,0 +1,6 @@ +{"doc_count":162,"key":80} +{"doc_count":18,"key":443} +{"doc_count":9,"key":3102} +{"doc_count":4,"key":9443} +{"doc_count":2,"key":22} +{"doc_count":1,"key":6881} diff --git a/kevlar/2026-09-07/sponge/port-targeting-AS58854.ndjson b/kevlar/2026-09-07/sponge/port-targeting-AS58854.ndjson new file mode 100644 index 0000000..e69de29 diff --git a/kevlar/2026-09-07/sponge/session-stats-by-ip-AS138915.ndjson b/kevlar/2026-09-07/sponge/session-stats-by-ip-AS138915.ndjson new file mode 100644 index 0000000..697afc7 --- /dev/null +++ b/kevlar/2026-09-07/sponge/session-stats-by-ip-AS138915.ndjson @@ -0,0 +1,20 @@ +{"doc_count":30290,"key":"38.54.2.209"} +{"doc_count":13234,"key":"38.54.2.232"} +{"doc_count":1438,"key":"38.54.2.13"} +{"doc_count":848,"key":"38.54.2.75"} +{"doc_count":675,"key":"38.54.2.168"} +{"doc_count":674,"key":"38.54.2.170"} +{"doc_count":311,"key":"38.54.2.221"} +{"doc_count":97,"key":"38.60.227.250"} +{"doc_count":75,"key":"38.54.2.204"} +{"doc_count":61,"key":"38.54.2.203"} +{"doc_count":41,"key":"38.54.2.4"} +{"doc_count":29,"key":"38.54.2.9"} +{"doc_count":17,"key":"38.54.2.91"} +{"doc_count":12,"key":"38.54.2.235"} +{"doc_count":11,"key":"38.54.2.22"} +{"doc_count":11,"key":"38.54.2.195"} +{"doc_count":11,"key":"38.54.2.233"} +{"doc_count":8,"key":"38.54.2.55"} +{"doc_count":8,"key":"38.54.2.71"} +{"doc_count":8,"key":"38.54.2.146"} diff --git a/kevlar/2026-09-07/sponge/session-stats-by-ip-AS140666.ndjson b/kevlar/2026-09-07/sponge/session-stats-by-ip-AS140666.ndjson new file mode 100644 index 0000000..e69de29 diff --git a/kevlar/2026-09-07/sponge/session-stats-by-ip-AS14956.ndjson b/kevlar/2026-09-07/sponge/session-stats-by-ip-AS14956.ndjson new file mode 100644 index 0000000..1d24905 --- /dev/null +++ b/kevlar/2026-09-07/sponge/session-stats-by-ip-AS14956.ndjson @@ -0,0 +1,20 @@ +{"doc_count":70,"key":"144.172.104.123"} +{"doc_count":54,"key":"144.172.102.126"} +{"doc_count":50,"key":"144.172.97.249"} +{"doc_count":30,"key":"144.172.104.147"} +{"doc_count":20,"key":"144.172.115.90"} +{"doc_count":8,"key":"144.172.117.61"} +{"doc_count":7,"key":"167.88.168.121"} +{"doc_count":6,"key":"107.189.22.128"} +{"doc_count":5,"key":"216.126.227.187"} +{"doc_count":4,"key":"45.61.149.189"} +{"doc_count":4,"key":"172.86.89.217"} +{"doc_count":2,"key":"107.189.26.103"} +{"doc_count":2,"key":"144.172.91.28"} +{"doc_count":2,"key":"144.172.98.217"} +{"doc_count":1,"key":"45.59.117.222"} +{"doc_count":1,"key":"45.61.129.23"} +{"doc_count":1,"key":"45.61.151.41"} +{"doc_count":1,"key":"107.189.27.179"} +{"doc_count":1,"key":"144.172.84.178"} +{"doc_count":1,"key":"144.172.102.30"} diff --git a/kevlar/2026-09-07/sponge/session-stats-by-ip-AS198953.ndjson b/kevlar/2026-09-07/sponge/session-stats-by-ip-AS198953.ndjson new file mode 100644 index 0000000..50df20f --- /dev/null +++ b/kevlar/2026-09-07/sponge/session-stats-by-ip-AS198953.ndjson @@ -0,0 +1,4 @@ +{"doc_count":1415,"key":"176.120.22.61"} +{"doc_count":44,"key":"176.120.22.240"} +{"doc_count":8,"key":"176.120.22.147"} +{"doc_count":2,"key":"176.120.22.123"} diff --git a/kevlar/2026-09-07/sponge/session-stats-by-ip-AS200593.ndjson b/kevlar/2026-09-07/sponge/session-stats-by-ip-AS200593.ndjson new file mode 100644 index 0000000..de55936 --- /dev/null +++ b/kevlar/2026-09-07/sponge/session-stats-by-ip-AS200593.ndjson @@ -0,0 +1 @@ +{"doc_count":1,"key":"91.215.85.104"} diff --git a/kevlar/2026-09-07/sponge/session-stats-by-ip-AS200651.ndjson b/kevlar/2026-09-07/sponge/session-stats-by-ip-AS200651.ndjson new file mode 100644 index 0000000..06d941d --- /dev/null +++ b/kevlar/2026-09-07/sponge/session-stats-by-ip-AS200651.ndjson @@ -0,0 +1,2 @@ +{"doc_count":73,"key":"185.100.87.136"} +{"doc_count":3,"key":"185.100.85.48"} diff --git a/kevlar/2026-09-07/sponge/session-stats-by-ip-AS202685.ndjson b/kevlar/2026-09-07/sponge/session-stats-by-ip-AS202685.ndjson new file mode 100644 index 0000000..e69de29 diff --git a/kevlar/2026-09-07/sponge/session-stats-by-ip-AS206728.ndjson b/kevlar/2026-09-07/sponge/session-stats-by-ip-AS206728.ndjson new file mode 100644 index 0000000..e69de29 diff --git a/kevlar/2026-09-07/sponge/session-stats-by-ip-AS209847.ndjson b/kevlar/2026-09-07/sponge/session-stats-by-ip-AS209847.ndjson new file mode 100644 index 0000000..1eb3858 --- /dev/null +++ b/kevlar/2026-09-07/sponge/session-stats-by-ip-AS209847.ndjson @@ -0,0 +1 @@ +{"doc_count":3,"key":"77.91.122.2"} diff --git a/kevlar/2026-09-07/sponge/session-stats-by-ip-AS210644.ndjson b/kevlar/2026-09-07/sponge/session-stats-by-ip-AS210644.ndjson new file mode 100644 index 0000000..aefcb1c --- /dev/null +++ b/kevlar/2026-09-07/sponge/session-stats-by-ip-AS210644.ndjson @@ -0,0 +1,5 @@ +{"doc_count":45,"key":"77.110.110.145"} +{"doc_count":33,"key":"138.124.102.8"} +{"doc_count":11,"key":"213.165.32.131"} +{"doc_count":7,"key":"46.226.167.103"} +{"doc_count":1,"key":"85.192.24.119"} diff --git a/kevlar/2026-09-07/sponge/session-stats-by-ip-AS211720.ndjson b/kevlar/2026-09-07/sponge/session-stats-by-ip-AS211720.ndjson new file mode 100644 index 0000000..75361cf --- /dev/null +++ b/kevlar/2026-09-07/sponge/session-stats-by-ip-AS211720.ndjson @@ -0,0 +1 @@ +{"doc_count":20,"key":"185.231.33.46"} diff --git a/kevlar/2026-09-07/sponge/session-stats-by-ip-AS213702.ndjson b/kevlar/2026-09-07/sponge/session-stats-by-ip-AS213702.ndjson new file mode 100644 index 0000000..e69de29 diff --git a/kevlar/2026-09-07/sponge/session-stats-by-ip-AS214351.ndjson b/kevlar/2026-09-07/sponge/session-stats-by-ip-AS214351.ndjson new file mode 100644 index 0000000..e69de29 diff --git a/kevlar/2026-09-07/sponge/session-stats-by-ip-AS214940.ndjson b/kevlar/2026-09-07/sponge/session-stats-by-ip-AS214940.ndjson new file mode 100644 index 0000000..4204355 --- /dev/null +++ b/kevlar/2026-09-07/sponge/session-stats-by-ip-AS214940.ndjson @@ -0,0 +1,3 @@ +{"doc_count":46,"key":"77.83.39.94"} +{"doc_count":11,"key":"77.83.39.108"} +{"doc_count":2,"key":"77.83.39.144"} diff --git a/kevlar/2026-09-07/sponge/session-stats-by-ip-AS216139.ndjson b/kevlar/2026-09-07/sponge/session-stats-by-ip-AS216139.ndjson new file mode 100644 index 0000000..e69de29 diff --git a/kevlar/2026-09-07/sponge/session-stats-by-ip-AS216246.ndjson b/kevlar/2026-09-07/sponge/session-stats-by-ip-AS216246.ndjson new file mode 100644 index 0000000..e69de29 diff --git a/kevlar/2026-09-07/sponge/session-stats-by-ip-AS216309.ndjson b/kevlar/2026-09-07/sponge/session-stats-by-ip-AS216309.ndjson new file mode 100644 index 0000000..0ba08aa --- /dev/null +++ b/kevlar/2026-09-07/sponge/session-stats-by-ip-AS216309.ndjson @@ -0,0 +1,20 @@ +{"doc_count":2,"key":"67.219.214.53"} +{"doc_count":2,"key":"67.219.214.90"} +{"doc_count":2,"key":"67.219.214.127"} +{"doc_count":2,"key":"67.219.214.145"} +{"doc_count":2,"key":"67.219.214.154"} +{"doc_count":2,"key":"67.219.214.247"} +{"doc_count":1,"key":"67.219.214.1"} +{"doc_count":1,"key":"67.219.214.2"} +{"doc_count":1,"key":"67.219.214.17"} +{"doc_count":1,"key":"67.219.214.19"} +{"doc_count":1,"key":"67.219.214.27"} +{"doc_count":1,"key":"67.219.214.32"} +{"doc_count":1,"key":"67.219.214.33"} +{"doc_count":1,"key":"67.219.214.36"} +{"doc_count":1,"key":"67.219.214.50"} +{"doc_count":1,"key":"67.219.214.52"} +{"doc_count":1,"key":"67.219.214.55"} +{"doc_count":1,"key":"67.219.214.57"} +{"doc_count":1,"key":"67.219.214.58"} +{"doc_count":1,"key":"67.219.214.60"} diff --git a/kevlar/2026-09-07/sponge/session-stats-by-ip-AS30823.ndjson b/kevlar/2026-09-07/sponge/session-stats-by-ip-AS30823.ndjson new file mode 100644 index 0000000..d7bae81 --- /dev/null +++ b/kevlar/2026-09-07/sponge/session-stats-by-ip-AS30823.ndjson @@ -0,0 +1 @@ +{"doc_count":2,"key":"172.86.92.151"} diff --git a/kevlar/2026-09-07/sponge/session-stats-by-ip-AS33993.ndjson b/kevlar/2026-09-07/sponge/session-stats-by-ip-AS33993.ndjson new file mode 100644 index 0000000..e69de29 diff --git a/kevlar/2026-09-07/sponge/session-stats-by-ip-AS394711.ndjson b/kevlar/2026-09-07/sponge/session-stats-by-ip-AS394711.ndjson new file mode 100644 index 0000000..e69de29 diff --git a/kevlar/2026-09-07/sponge/session-stats-by-ip-AS400992.ndjson b/kevlar/2026-09-07/sponge/session-stats-by-ip-AS400992.ndjson new file mode 100644 index 0000000..3850451 --- /dev/null +++ b/kevlar/2026-09-07/sponge/session-stats-by-ip-AS400992.ndjson @@ -0,0 +1,4 @@ +{"doc_count":167,"key":"23.172.217.87"} +{"doc_count":33,"key":"23.172.217.77"} +{"doc_count":25,"key":"194.48.142.88"} +{"doc_count":1,"key":"194.48.142.134"} diff --git a/kevlar/2026-09-07/sponge/session-stats-by-ip-AS51396.ndjson b/kevlar/2026-09-07/sponge/session-stats-by-ip-AS51396.ndjson new file mode 100644 index 0000000..3acdf61 --- /dev/null +++ b/kevlar/2026-09-07/sponge/session-stats-by-ip-AS51396.ndjson @@ -0,0 +1,20 @@ +{"doc_count":56644,"key":"204.76.203.4"} +{"doc_count":6091,"key":"204.76.203.18"} +{"doc_count":3167,"key":"45.156.87.13"} +{"doc_count":2690,"key":"204.76.203.214"} +{"doc_count":2621,"key":"204.76.203.222"} +{"doc_count":2600,"key":"204.76.203.221"} +{"doc_count":2538,"key":"204.76.203.213"} +{"doc_count":1836,"key":"176.65.148.243"} +{"doc_count":1572,"key":"45.156.87.93"} +{"doc_count":1532,"key":"176.65.148.84"} +{"doc_count":1521,"key":"204.76.203.49"} +{"doc_count":788,"key":"45.153.34.149"} +{"doc_count":787,"key":"45.153.34.181"} +{"doc_count":787,"key":"45.156.87.166"} +{"doc_count":546,"key":"45.135.194.24"} +{"doc_count":487,"key":"204.76.203.7"} +{"doc_count":475,"key":"176.65.148.93"} +{"doc_count":453,"key":"176.65.149.67"} +{"doc_count":410,"key":"45.135.193.198"} +{"doc_count":393,"key":"45.135.193.193"} diff --git a/kevlar/2026-09-07/sponge/session-stats-by-ip-AS51852.ndjson b/kevlar/2026-09-07/sponge/session-stats-by-ip-AS51852.ndjson new file mode 100644 index 0000000..40e98f2 --- /dev/null +++ b/kevlar/2026-09-07/sponge/session-stats-by-ip-AS51852.ndjson @@ -0,0 +1,8 @@ +{"doc_count":50,"key":"46.19.138.10"} +{"doc_count":16,"key":"179.43.150.26"} +{"doc_count":12,"key":"179.43.146.27"} +{"doc_count":10,"key":"179.43.186.220"} +{"doc_count":4,"key":"46.19.142.226"} +{"doc_count":3,"key":"141.255.165.67"} +{"doc_count":1,"key":"141.255.165.69"} +{"doc_count":1,"key":"179.43.189.73"} diff --git a/kevlar/2026-09-07/sponge/session-stats-by-ip-AS57043.ndjson b/kevlar/2026-09-07/sponge/session-stats-by-ip-AS57043.ndjson new file mode 100644 index 0000000..86d343b --- /dev/null +++ b/kevlar/2026-09-07/sponge/session-stats-by-ip-AS57043.ndjson @@ -0,0 +1,5 @@ +{"doc_count":162,"key":"82.38.67.164"} +{"doc_count":24,"key":"5.39.217.86"} +{"doc_count":7,"key":"31.207.46.105"} +{"doc_count":2,"key":"66.151.40.231"} +{"doc_count":1,"key":"82.21.150.241"} diff --git a/kevlar/2026-09-07/sponge/session-stats-by-ip-AS58854.ndjson b/kevlar/2026-09-07/sponge/session-stats-by-ip-AS58854.ndjson new file mode 100644 index 0000000..e69de29 diff --git a/kevlar/2026-09-07/sponge/timeline-all-asns.ndjson b/kevlar/2026-09-07/sponge/timeline-all-asns.ndjson new file mode 100644 index 0000000..ed57b16 --- /dev/null +++ b/kevlar/2026-09-07/sponge/timeline-all-asns.ndjson @@ -0,0 +1,840 @@ +{"doc_count":10244,"split_key":396982,"timestamp":"2026-08-31T00:00:00.000Z"} +{"doc_count":2575,"split_key":22295,"timestamp":"2026-08-31T00:00:00.000Z"} +{"doc_count":579,"split_key":16509,"timestamp":"2026-08-31T00:00:00.000Z"} +{"doc_count":558,"split_key":36352,"timestamp":"2026-08-31T00:00:00.000Z"} +{"doc_count":538,"split_key":37963,"timestamp":"2026-08-31T00:00:00.000Z"} +{"doc_count":14424,"split_key":14061,"timestamp":"2026-08-31T01:00:00.000Z"} +{"doc_count":2751,"split_key":274069,"timestamp":"2026-08-31T01:00:00.000Z"} +{"doc_count":2645,"split_key":209630,"timestamp":"2026-08-31T01:00:00.000Z"} +{"doc_count":2644,"split_key":396982,"timestamp":"2026-08-31T01:00:00.000Z"} +{"doc_count":2471,"split_key":22295,"timestamp":"2026-08-31T01:00:00.000Z"} +{"doc_count":50621,"split_key":14061,"timestamp":"2026-08-31T02:00:00.000Z"} +{"doc_count":5343,"split_key":396982,"timestamp":"2026-08-31T02:00:00.000Z"} +{"doc_count":2822,"split_key":22295,"timestamp":"2026-08-31T02:00:00.000Z"} +{"doc_count":600,"split_key":16509,"timestamp":"2026-08-31T02:00:00.000Z"} +{"doc_count":567,"split_key":37963,"timestamp":"2026-08-31T02:00:00.000Z"} +{"doc_count":17866,"split_key":14061,"timestamp":"2026-08-31T03:00:00.000Z"} +{"doc_count":2490,"split_key":22295,"timestamp":"2026-08-31T03:00:00.000Z"} +{"doc_count":1552,"split_key":396982,"timestamp":"2026-08-31T03:00:00.000Z"} +{"doc_count":954,"split_key":209334,"timestamp":"2026-08-31T03:00:00.000Z"} +{"doc_count":547,"split_key":37963,"timestamp":"2026-08-31T03:00:00.000Z"} +{"doc_count":2939,"split_key":209630,"timestamp":"2026-08-31T04:00:00.000Z"} +{"doc_count":2608,"split_key":274069,"timestamp":"2026-08-31T04:00:00.000Z"} +{"doc_count":2144,"split_key":396982,"timestamp":"2026-08-31T04:00:00.000Z"} +{"doc_count":1968,"split_key":209334,"timestamp":"2026-08-31T04:00:00.000Z"} +{"doc_count":1794,"split_key":22295,"timestamp":"2026-08-31T04:00:00.000Z"} +{"doc_count":3886,"split_key":209334,"timestamp":"2026-08-31T05:00:00.000Z"} +{"doc_count":2263,"split_key":22295,"timestamp":"2026-08-31T05:00:00.000Z"} +{"doc_count":1075,"split_key":396982,"timestamp":"2026-08-31T05:00:00.000Z"} +{"doc_count":744,"split_key":16509,"timestamp":"2026-08-31T05:00:00.000Z"} +{"doc_count":541,"split_key":37963,"timestamp":"2026-08-31T05:00:00.000Z"} +{"doc_count":5103,"split_key":209334,"timestamp":"2026-08-31T06:00:00.000Z"} +{"doc_count":2938,"split_key":209630,"timestamp":"2026-08-31T06:00:00.000Z"} +{"doc_count":2766,"split_key":274069,"timestamp":"2026-08-31T06:00:00.000Z"} +{"doc_count":2614,"split_key":22295,"timestamp":"2026-08-31T06:00:00.000Z"} +{"doc_count":1577,"split_key":396982,"timestamp":"2026-08-31T06:00:00.000Z"} +{"doc_count":9149,"split_key":209334,"timestamp":"2026-08-31T07:00:00.000Z"} +{"doc_count":2842,"split_key":22295,"timestamp":"2026-08-31T07:00:00.000Z"} +{"doc_count":2201,"split_key":396982,"timestamp":"2026-08-31T07:00:00.000Z"} +{"doc_count":528,"split_key":201401,"timestamp":"2026-08-31T07:00:00.000Z"} +{"doc_count":475,"split_key":37963,"timestamp":"2026-08-31T07:00:00.000Z"} +{"doc_count":8575,"split_key":209334,"timestamp":"2026-08-31T08:00:00.000Z"} +{"doc_count":2226,"split_key":22295,"timestamp":"2026-08-31T08:00:00.000Z"} +{"doc_count":2089,"split_key":396982,"timestamp":"2026-08-31T08:00:00.000Z"} +{"doc_count":1234,"split_key":274069,"timestamp":"2026-08-31T08:00:00.000Z"} +{"doc_count":1198,"split_key":209630,"timestamp":"2026-08-31T08:00:00.000Z"} +{"doc_count":4472,"split_key":13335,"timestamp":"2026-08-31T09:00:00.000Z"} +{"doc_count":4133,"split_key":209334,"timestamp":"2026-08-31T09:00:00.000Z"} +{"doc_count":2016,"split_key":209630,"timestamp":"2026-08-31T09:00:00.000Z"} +{"doc_count":1641,"split_key":274069,"timestamp":"2026-08-31T09:00:00.000Z"} +{"doc_count":1627,"split_key":22295,"timestamp":"2026-08-31T09:00:00.000Z"} +{"doc_count":10012,"split_key":209334,"timestamp":"2026-08-31T10:00:00.000Z"} +{"doc_count":6940,"split_key":13335,"timestamp":"2026-08-31T10:00:00.000Z"} +{"doc_count":1889,"split_key":22295,"timestamp":"2026-08-31T10:00:00.000Z"} +{"doc_count":1329,"split_key":16276,"timestamp":"2026-08-31T10:00:00.000Z"} +{"doc_count":651,"split_key":16509,"timestamp":"2026-08-31T10:00:00.000Z"} +{"doc_count":7149,"split_key":209334,"timestamp":"2026-08-31T11:00:00.000Z"} +{"doc_count":2900,"split_key":274069,"timestamp":"2026-08-31T11:00:00.000Z"} +{"doc_count":2669,"split_key":209630,"timestamp":"2026-08-31T11:00:00.000Z"} +{"doc_count":2414,"split_key":22295,"timestamp":"2026-08-31T11:00:00.000Z"} +{"doc_count":819,"split_key":16509,"timestamp":"2026-08-31T11:00:00.000Z"} +{"doc_count":8437,"split_key":209334,"timestamp":"2026-08-31T12:00:00.000Z"} +{"doc_count":1564,"split_key":22295,"timestamp":"2026-08-31T12:00:00.000Z"} +{"doc_count":649,"split_key":37963,"timestamp":"2026-08-31T12:00:00.000Z"} +{"doc_count":581,"split_key":51396,"timestamp":"2026-08-31T12:00:00.000Z"} +{"doc_count":499,"split_key":53667,"timestamp":"2026-08-31T12:00:00.000Z"} +{"doc_count":7413,"split_key":209334,"timestamp":"2026-08-31T13:00:00.000Z"} +{"doc_count":3221,"split_key":22295,"timestamp":"2026-08-31T13:00:00.000Z"} +{"doc_count":1858,"split_key":209630,"timestamp":"2026-08-31T13:00:00.000Z"} +{"doc_count":1796,"split_key":274069,"timestamp":"2026-08-31T13:00:00.000Z"} +{"doc_count":744,"split_key":201401,"timestamp":"2026-08-31T13:00:00.000Z"} +{"doc_count":11547,"split_key":209334,"timestamp":"2026-08-31T14:00:00.000Z"} +{"doc_count":1424,"split_key":22295,"timestamp":"2026-08-31T14:00:00.000Z"} +{"doc_count":1170,"split_key":209630,"timestamp":"2026-08-31T14:00:00.000Z"} +{"doc_count":1161,"split_key":274069,"timestamp":"2026-08-31T14:00:00.000Z"} +{"doc_count":941,"split_key":53667,"timestamp":"2026-08-31T14:00:00.000Z"} +{"doc_count":16242,"split_key":209334,"timestamp":"2026-08-31T15:00:00.000Z"} +{"doc_count":12725,"split_key":11878,"timestamp":"2026-08-31T15:00:00.000Z"} +{"doc_count":4146,"split_key":22295,"timestamp":"2026-08-31T15:00:00.000Z"} +{"doc_count":796,"split_key":53667,"timestamp":"2026-08-31T15:00:00.000Z"} +{"doc_count":763,"split_key":201401,"timestamp":"2026-08-31T15:00:00.000Z"} +{"doc_count":7279,"split_key":209334,"timestamp":"2026-08-31T16:00:00.000Z"} +{"doc_count":3248,"split_key":22295,"timestamp":"2026-08-31T16:00:00.000Z"} +{"doc_count":3077,"split_key":209630,"timestamp":"2026-08-31T16:00:00.000Z"} +{"doc_count":2699,"split_key":274069,"timestamp":"2026-08-31T16:00:00.000Z"} +{"doc_count":1282,"split_key":53667,"timestamp":"2026-08-31T16:00:00.000Z"} +{"doc_count":15711,"split_key":209334,"timestamp":"2026-08-31T17:00:00.000Z"} +{"doc_count":3946,"split_key":22295,"timestamp":"2026-08-31T17:00:00.000Z"} +{"doc_count":1270,"split_key":16509,"timestamp":"2026-08-31T17:00:00.000Z"} +{"doc_count":851,"split_key":53667,"timestamp":"2026-08-31T17:00:00.000Z"} +{"doc_count":802,"split_key":37963,"timestamp":"2026-08-31T17:00:00.000Z"} +{"doc_count":12061,"split_key":209334,"timestamp":"2026-08-31T18:00:00.000Z"} +{"doc_count":3620,"split_key":22295,"timestamp":"2026-08-31T18:00:00.000Z"} +{"doc_count":2995,"split_key":209630,"timestamp":"2026-08-31T18:00:00.000Z"} +{"doc_count":2871,"split_key":274069,"timestamp":"2026-08-31T18:00:00.000Z"} +{"doc_count":766,"split_key":201401,"timestamp":"2026-08-31T18:00:00.000Z"} +{"doc_count":22714,"split_key":209334,"timestamp":"2026-08-31T19:00:00.000Z"} +{"doc_count":3718,"split_key":22295,"timestamp":"2026-08-31T19:00:00.000Z"} +{"doc_count":2043,"split_key":64199,"timestamp":"2026-08-31T19:00:00.000Z"} +{"doc_count":853,"split_key":53667,"timestamp":"2026-08-31T19:00:00.000Z"} +{"doc_count":772,"split_key":201401,"timestamp":"2026-08-31T19:00:00.000Z"} +{"doc_count":14170,"split_key":209334,"timestamp":"2026-08-31T20:00:00.000Z"} +{"doc_count":2914,"split_key":209630,"timestamp":"2026-08-31T20:00:00.000Z"} +{"doc_count":2893,"split_key":274069,"timestamp":"2026-08-31T20:00:00.000Z"} +{"doc_count":2859,"split_key":22295,"timestamp":"2026-08-31T20:00:00.000Z"} +{"doc_count":1388,"split_key":53667,"timestamp":"2026-08-31T20:00:00.000Z"} +{"doc_count":7517,"split_key":209334,"timestamp":"2026-08-31T21:00:00.000Z"} +{"doc_count":3659,"split_key":22295,"timestamp":"2026-08-31T21:00:00.000Z"} +{"doc_count":1391,"split_key":53667,"timestamp":"2026-08-31T21:00:00.000Z"} +{"doc_count":836,"split_key":31615,"timestamp":"2026-08-31T21:00:00.000Z"} +{"doc_count":721,"split_key":37963,"timestamp":"2026-08-31T21:00:00.000Z"} +{"doc_count":3385,"split_key":22295,"timestamp":"2026-08-31T22:00:00.000Z"} +{"doc_count":3021,"split_key":209630,"timestamp":"2026-08-31T22:00:00.000Z"} +{"doc_count":2872,"split_key":274069,"timestamp":"2026-08-31T22:00:00.000Z"} +{"doc_count":1471,"split_key":31615,"timestamp":"2026-08-31T22:00:00.000Z"} +{"doc_count":1098,"split_key":396982,"timestamp":"2026-08-31T22:00:00.000Z"} +{"doc_count":2500,"split_key":22295,"timestamp":"2026-08-31T23:00:00.000Z"} +{"doc_count":1459,"split_key":31615,"timestamp":"2026-08-31T23:00:00.000Z"} +{"doc_count":1373,"split_key":51396,"timestamp":"2026-08-31T23:00:00.000Z"} +{"doc_count":800,"split_key":53667,"timestamp":"2026-08-31T23:00:00.000Z"} +{"doc_count":726,"split_key":16509,"timestamp":"2026-08-31T23:00:00.000Z"} +{"doc_count":9986,"split_key":14987,"timestamp":"2026-09-01T00:00:00.000Z"} +{"doc_count":2747,"split_key":274069,"timestamp":"2026-09-01T00:00:00.000Z"} +{"doc_count":2679,"split_key":209630,"timestamp":"2026-09-01T00:00:00.000Z"} +{"doc_count":2378,"split_key":22295,"timestamp":"2026-09-01T00:00:00.000Z"} +{"doc_count":1460,"split_key":31615,"timestamp":"2026-09-01T00:00:00.000Z"} +{"doc_count":6691,"split_key":36352,"timestamp":"2026-09-01T01:00:00.000Z"} +{"doc_count":2487,"split_key":22295,"timestamp":"2026-09-01T01:00:00.000Z"} +{"doc_count":1481,"split_key":31615,"timestamp":"2026-09-01T01:00:00.000Z"} +{"doc_count":750,"split_key":37963,"timestamp":"2026-09-01T01:00:00.000Z"} +{"doc_count":572,"split_key":51396,"timestamp":"2026-09-01T01:00:00.000Z"} +{"doc_count":2993,"split_key":209630,"timestamp":"2026-09-01T02:00:00.000Z"} +{"doc_count":2962,"split_key":22295,"timestamp":"2026-09-01T02:00:00.000Z"} +{"doc_count":2770,"split_key":274069,"timestamp":"2026-09-01T02:00:00.000Z"} +{"doc_count":1466,"split_key":31615,"timestamp":"2026-09-01T02:00:00.000Z"} +{"doc_count":767,"split_key":37963,"timestamp":"2026-09-01T02:00:00.000Z"} +{"doc_count":2930,"split_key":22295,"timestamp":"2026-09-01T03:00:00.000Z"} +{"doc_count":1461,"split_key":31615,"timestamp":"2026-09-01T03:00:00.000Z"} +{"doc_count":962,"split_key":209334,"timestamp":"2026-09-01T03:00:00.000Z"} +{"doc_count":774,"split_key":37963,"timestamp":"2026-09-01T03:00:00.000Z"} +{"doc_count":606,"split_key":16509,"timestamp":"2026-09-01T03:00:00.000Z"} +{"doc_count":3642,"split_key":22295,"timestamp":"2026-09-01T04:00:00.000Z"} +{"doc_count":2638,"split_key":209630,"timestamp":"2026-09-01T04:00:00.000Z"} +{"doc_count":2580,"split_key":274069,"timestamp":"2026-09-01T04:00:00.000Z"} +{"doc_count":2154,"split_key":209334,"timestamp":"2026-09-01T04:00:00.000Z"} +{"doc_count":1459,"split_key":31615,"timestamp":"2026-09-01T04:00:00.000Z"} +{"doc_count":3975,"split_key":209334,"timestamp":"2026-09-01T05:00:00.000Z"} +{"doc_count":2964,"split_key":22295,"timestamp":"2026-09-01T05:00:00.000Z"} +{"doc_count":1480,"split_key":31615,"timestamp":"2026-09-01T05:00:00.000Z"} +{"doc_count":898,"split_key":36352,"timestamp":"2026-09-01T05:00:00.000Z"} +{"doc_count":752,"split_key":37963,"timestamp":"2026-09-01T05:00:00.000Z"} +{"doc_count":4399,"split_key":209334,"timestamp":"2026-09-01T06:00:00.000Z"} +{"doc_count":3583,"split_key":22295,"timestamp":"2026-09-01T06:00:00.000Z"} +{"doc_count":2127,"split_key":274069,"timestamp":"2026-09-01T06:00:00.000Z"} +{"doc_count":2106,"split_key":209630,"timestamp":"2026-09-01T06:00:00.000Z"} +{"doc_count":1463,"split_key":31615,"timestamp":"2026-09-01T06:00:00.000Z"} +{"doc_count":9974,"split_key":209334,"timestamp":"2026-09-01T07:00:00.000Z"} +{"doc_count":2918,"split_key":22295,"timestamp":"2026-09-01T07:00:00.000Z"} +{"doc_count":1598,"split_key":396982,"timestamp":"2026-09-01T07:00:00.000Z"} +{"doc_count":1553,"split_key":37963,"timestamp":"2026-09-01T07:00:00.000Z"} +{"doc_count":1291,"split_key":209630,"timestamp":"2026-09-01T07:00:00.000Z"} +{"doc_count":8365,"split_key":209334,"timestamp":"2026-09-01T08:00:00.000Z"} +{"doc_count":3298,"split_key":22295,"timestamp":"2026-09-01T08:00:00.000Z"} +{"doc_count":2166,"split_key":274069,"timestamp":"2026-09-01T08:00:00.000Z"} +{"doc_count":2103,"split_key":209630,"timestamp":"2026-09-01T08:00:00.000Z"} +{"doc_count":1901,"split_key":37963,"timestamp":"2026-09-01T08:00:00.000Z"} +{"doc_count":3565,"split_key":22295,"timestamp":"2026-09-01T09:00:00.000Z"} +{"doc_count":2962,"split_key":37963,"timestamp":"2026-09-01T09:00:00.000Z"} +{"doc_count":2843,"split_key":209334,"timestamp":"2026-09-01T09:00:00.000Z"} +{"doc_count":1304,"split_key":274069,"timestamp":"2026-09-01T09:00:00.000Z"} +{"doc_count":1125,"split_key":36352,"timestamp":"2026-09-01T09:00:00.000Z"} +{"doc_count":10835,"split_key":209334,"timestamp":"2026-09-01T10:00:00.000Z"} +{"doc_count":3311,"split_key":22295,"timestamp":"2026-09-01T10:00:00.000Z"} +{"doc_count":2685,"split_key":37963,"timestamp":"2026-09-01T10:00:00.000Z"} +{"doc_count":2090,"split_key":274069,"timestamp":"2026-09-01T10:00:00.000Z"} +{"doc_count":1854,"split_key":209630,"timestamp":"2026-09-01T10:00:00.000Z"} +{"doc_count":7039,"split_key":209334,"timestamp":"2026-09-01T11:00:00.000Z"} +{"doc_count":2420,"split_key":22295,"timestamp":"2026-09-01T11:00:00.000Z"} +{"doc_count":1387,"split_key":15557,"timestamp":"2026-09-01T11:00:00.000Z"} +{"doc_count":1266,"split_key":209630,"timestamp":"2026-09-01T11:00:00.000Z"} +{"doc_count":1016,"split_key":274069,"timestamp":"2026-09-01T11:00:00.000Z"} +{"doc_count":8231,"split_key":209334,"timestamp":"2026-09-01T12:00:00.000Z"} +{"doc_count":6810,"split_key":56153,"timestamp":"2026-09-01T12:00:00.000Z"} +{"doc_count":3622,"split_key":22295,"timestamp":"2026-09-01T12:00:00.000Z"} +{"doc_count":2156,"split_key":274069,"timestamp":"2026-09-01T12:00:00.000Z"} +{"doc_count":1909,"split_key":209630,"timestamp":"2026-09-01T12:00:00.000Z"} +{"doc_count":21642,"split_key":56153,"timestamp":"2026-09-01T13:00:00.000Z"} +{"doc_count":6121,"split_key":209334,"timestamp":"2026-09-01T13:00:00.000Z"} +{"doc_count":3299,"split_key":22295,"timestamp":"2026-09-01T13:00:00.000Z"} +{"doc_count":1538,"split_key":37963,"timestamp":"2026-09-01T13:00:00.000Z"} +{"doc_count":1234,"split_key":209630,"timestamp":"2026-09-01T13:00:00.000Z"} +{"doc_count":14519,"split_key":56153,"timestamp":"2026-09-01T14:00:00.000Z"} +{"doc_count":12201,"split_key":209334,"timestamp":"2026-09-01T14:00:00.000Z"} +{"doc_count":3617,"split_key":22295,"timestamp":"2026-09-01T14:00:00.000Z"} +{"doc_count":1762,"split_key":209630,"timestamp":"2026-09-01T14:00:00.000Z"} +{"doc_count":1685,"split_key":274069,"timestamp":"2026-09-01T14:00:00.000Z"} +{"doc_count":12506,"split_key":209334,"timestamp":"2026-09-01T15:00:00.000Z"} +{"doc_count":9218,"split_key":149089,"timestamp":"2026-09-01T15:00:00.000Z"} +{"doc_count":3512,"split_key":35695,"timestamp":"2026-09-01T15:00:00.000Z"} +{"doc_count":2326,"split_key":22295,"timestamp":"2026-09-01T15:00:00.000Z"} +{"doc_count":1382,"split_key":274069,"timestamp":"2026-09-01T15:00:00.000Z"} +{"doc_count":23723,"split_key":149089,"timestamp":"2026-09-01T16:00:00.000Z"} +{"doc_count":11368,"split_key":209334,"timestamp":"2026-09-01T16:00:00.000Z"} +{"doc_count":3612,"split_key":22295,"timestamp":"2026-09-01T16:00:00.000Z"} +{"doc_count":1244,"split_key":274069,"timestamp":"2026-09-01T16:00:00.000Z"} +{"doc_count":1215,"split_key":209630,"timestamp":"2026-09-01T16:00:00.000Z"} +{"doc_count":14745,"split_key":149089,"timestamp":"2026-09-01T17:00:00.000Z"} +{"doc_count":14186,"split_key":209334,"timestamp":"2026-09-01T17:00:00.000Z"} +{"doc_count":4128,"split_key":22295,"timestamp":"2026-09-01T17:00:00.000Z"} +{"doc_count":1955,"split_key":274069,"timestamp":"2026-09-01T17:00:00.000Z"} +{"doc_count":1926,"split_key":56153,"timestamp":"2026-09-01T17:00:00.000Z"} +{"doc_count":22509,"split_key":56153,"timestamp":"2026-09-01T18:00:00.000Z"} +{"doc_count":11934,"split_key":209334,"timestamp":"2026-09-01T18:00:00.000Z"} +{"doc_count":4765,"split_key":22295,"timestamp":"2026-09-01T18:00:00.000Z"} +{"doc_count":1421,"split_key":36352,"timestamp":"2026-09-01T18:00:00.000Z"} +{"doc_count":692,"split_key":51396,"timestamp":"2026-09-01T18:00:00.000Z"} +{"doc_count":20939,"split_key":56153,"timestamp":"2026-09-01T19:00:00.000Z"} +{"doc_count":18475,"split_key":209334,"timestamp":"2026-09-01T19:00:00.000Z"} +{"doc_count":3431,"split_key":22295,"timestamp":"2026-09-01T19:00:00.000Z"} +{"doc_count":2763,"split_key":209630,"timestamp":"2026-09-01T19:00:00.000Z"} +{"doc_count":2584,"split_key":274069,"timestamp":"2026-09-01T19:00:00.000Z"} +{"doc_count":18947,"split_key":209334,"timestamp":"2026-09-01T20:00:00.000Z"} +{"doc_count":4316,"split_key":22295,"timestamp":"2026-09-01T20:00:00.000Z"} +{"doc_count":1492,"split_key":214961,"timestamp":"2026-09-01T20:00:00.000Z"} +{"doc_count":1263,"split_key":36352,"timestamp":"2026-09-01T20:00:00.000Z"} +{"doc_count":917,"split_key":16509,"timestamp":"2026-09-01T20:00:00.000Z"} +{"doc_count":8713,"split_key":209334,"timestamp":"2026-09-01T21:00:00.000Z"} +{"doc_count":6557,"split_key":135004,"timestamp":"2026-09-01T21:00:00.000Z"} +{"doc_count":4189,"split_key":22295,"timestamp":"2026-09-01T21:00:00.000Z"} +{"doc_count":2940,"split_key":274069,"timestamp":"2026-09-01T21:00:00.000Z"} +{"doc_count":2847,"split_key":209630,"timestamp":"2026-09-01T21:00:00.000Z"} +{"doc_count":3332,"split_key":22295,"timestamp":"2026-09-01T22:00:00.000Z"} +{"doc_count":1011,"split_key":36352,"timestamp":"2026-09-01T22:00:00.000Z"} +{"doc_count":710,"split_key":51396,"timestamp":"2026-09-01T22:00:00.000Z"} +{"doc_count":489,"split_key":209334,"timestamp":"2026-09-01T22:00:00.000Z"} +{"doc_count":428,"split_key":396982,"timestamp":"2026-09-01T22:00:00.000Z"} +{"doc_count":3733,"split_key":22295,"timestamp":"2026-09-01T23:00:00.000Z"} +{"doc_count":2961,"split_key":274069,"timestamp":"2026-09-01T23:00:00.000Z"} +{"doc_count":2849,"split_key":209630,"timestamp":"2026-09-01T23:00:00.000Z"} +{"doc_count":1097,"split_key":36352,"timestamp":"2026-09-01T23:00:00.000Z"} +{"doc_count":648,"split_key":16509,"timestamp":"2026-09-01T23:00:00.000Z"} +{"doc_count":10020,"split_key":14987,"timestamp":"2026-09-02T00:00:00.000Z"} +{"doc_count":3286,"split_key":22295,"timestamp":"2026-09-02T00:00:00.000Z"} +{"doc_count":1520,"split_key":64013,"timestamp":"2026-09-02T00:00:00.000Z"} +{"doc_count":987,"split_key":36352,"timestamp":"2026-09-02T00:00:00.000Z"} +{"doc_count":753,"split_key":39351,"timestamp":"2026-09-02T00:00:00.000Z"} +{"doc_count":3845,"split_key":22295,"timestamp":"2026-09-02T01:00:00.000Z"} +{"doc_count":2936,"split_key":209630,"timestamp":"2026-09-02T01:00:00.000Z"} +{"doc_count":2891,"split_key":274069,"timestamp":"2026-09-02T01:00:00.000Z"} +{"doc_count":1130,"split_key":36352,"timestamp":"2026-09-02T01:00:00.000Z"} +{"doc_count":866,"split_key":43350,"timestamp":"2026-09-02T01:00:00.000Z"} +{"doc_count":2318,"split_key":22295,"timestamp":"2026-09-02T02:00:00.000Z"} +{"doc_count":923,"split_key":43350,"timestamp":"2026-09-02T02:00:00.000Z"} +{"doc_count":680,"split_key":36352,"timestamp":"2026-09-02T02:00:00.000Z"} +{"doc_count":667,"split_key":16509,"timestamp":"2026-09-02T02:00:00.000Z"} +{"doc_count":619,"split_key":396982,"timestamp":"2026-09-02T02:00:00.000Z"} +{"doc_count":3609,"split_key":22295,"timestamp":"2026-09-02T03:00:00.000Z"} +{"doc_count":2947,"split_key":209630,"timestamp":"2026-09-02T03:00:00.000Z"} +{"doc_count":2814,"split_key":274069,"timestamp":"2026-09-02T03:00:00.000Z"} +{"doc_count":1188,"split_key":36352,"timestamp":"2026-09-02T03:00:00.000Z"} +{"doc_count":867,"split_key":43350,"timestamp":"2026-09-02T03:00:00.000Z"} +{"doc_count":2792,"split_key":22295,"timestamp":"2026-09-02T04:00:00.000Z"} +{"doc_count":1356,"split_key":209334,"timestamp":"2026-09-02T04:00:00.000Z"} +{"doc_count":906,"split_key":43350,"timestamp":"2026-09-02T04:00:00.000Z"} +{"doc_count":867,"split_key":36352,"timestamp":"2026-09-02T04:00:00.000Z"} +{"doc_count":760,"split_key":16509,"timestamp":"2026-09-02T04:00:00.000Z"} +{"doc_count":4524,"split_key":209334,"timestamp":"2026-09-02T05:00:00.000Z"} +{"doc_count":3276,"split_key":22295,"timestamp":"2026-09-02T05:00:00.000Z"} +{"doc_count":2910,"split_key":274069,"timestamp":"2026-09-02T05:00:00.000Z"} +{"doc_count":2879,"split_key":209630,"timestamp":"2026-09-02T05:00:00.000Z"} +{"doc_count":1235,"split_key":396982,"timestamp":"2026-09-02T05:00:00.000Z"} +{"doc_count":4415,"split_key":209334,"timestamp":"2026-09-02T06:00:00.000Z"} +{"doc_count":4216,"split_key":22295,"timestamp":"2026-09-02T06:00:00.000Z"} +{"doc_count":1296,"split_key":36352,"timestamp":"2026-09-02T06:00:00.000Z"} +{"doc_count":886,"split_key":43350,"timestamp":"2026-09-02T06:00:00.000Z"} +{"doc_count":543,"split_key":51396,"timestamp":"2026-09-02T06:00:00.000Z"} +{"doc_count":8903,"split_key":209334,"timestamp":"2026-09-02T07:00:00.000Z"} +{"doc_count":4183,"split_key":22295,"timestamp":"2026-09-02T07:00:00.000Z"} +{"doc_count":2853,"split_key":209630,"timestamp":"2026-09-02T07:00:00.000Z"} +{"doc_count":2738,"split_key":274069,"timestamp":"2026-09-02T07:00:00.000Z"} +{"doc_count":1551,"split_key":37963,"timestamp":"2026-09-02T07:00:00.000Z"} +{"doc_count":5804,"split_key":209334,"timestamp":"2026-09-02T08:00:00.000Z"} +{"doc_count":3583,"split_key":22295,"timestamp":"2026-09-02T08:00:00.000Z"} +{"doc_count":1053,"split_key":36352,"timestamp":"2026-09-02T08:00:00.000Z"} +{"doc_count":866,"split_key":43350,"timestamp":"2026-09-02T08:00:00.000Z"} +{"doc_count":627,"split_key":16509,"timestamp":"2026-09-02T08:00:00.000Z"} +{"doc_count":6165,"split_key":209334,"timestamp":"2026-09-02T09:00:00.000Z"} +{"doc_count":2968,"split_key":209630,"timestamp":"2026-09-02T09:00:00.000Z"} +{"doc_count":2886,"split_key":274069,"timestamp":"2026-09-02T09:00:00.000Z"} +{"doc_count":2743,"split_key":22295,"timestamp":"2026-09-02T09:00:00.000Z"} +{"doc_count":918,"split_key":43350,"timestamp":"2026-09-02T09:00:00.000Z"} +{"doc_count":11171,"split_key":209334,"timestamp":"2026-09-02T10:00:00.000Z"} +{"doc_count":2540,"split_key":22295,"timestamp":"2026-09-02T10:00:00.000Z"} +{"doc_count":887,"split_key":16509,"timestamp":"2026-09-02T10:00:00.000Z"} +{"doc_count":865,"split_key":43350,"timestamp":"2026-09-02T10:00:00.000Z"} +{"doc_count":803,"split_key":36352,"timestamp":"2026-09-02T10:00:00.000Z"} +{"doc_count":7202,"split_key":209334,"timestamp":"2026-09-02T11:00:00.000Z"} +{"doc_count":5281,"split_key":265904,"timestamp":"2026-09-02T11:00:00.000Z"} +{"doc_count":3261,"split_key":22295,"timestamp":"2026-09-02T11:00:00.000Z"} +{"doc_count":2918,"split_key":209630,"timestamp":"2026-09-02T11:00:00.000Z"} +{"doc_count":2904,"split_key":274069,"timestamp":"2026-09-02T11:00:00.000Z"} +{"doc_count":7339,"split_key":209334,"timestamp":"2026-09-02T12:00:00.000Z"} +{"doc_count":5379,"split_key":265904,"timestamp":"2026-09-02T12:00:00.000Z"} +{"doc_count":3133,"split_key":270646,"timestamp":"2026-09-02T12:00:00.000Z"} +{"doc_count":2429,"split_key":214961,"timestamp":"2026-09-02T12:00:00.000Z"} +{"doc_count":2341,"split_key":22295,"timestamp":"2026-09-02T12:00:00.000Z"} +{"doc_count":8866,"split_key":396982,"timestamp":"2026-09-02T13:00:00.000Z"} +{"doc_count":8421,"split_key":265904,"timestamp":"2026-09-02T13:00:00.000Z"} +{"doc_count":7264,"split_key":209334,"timestamp":"2026-09-02T13:00:00.000Z"} +{"doc_count":3726,"split_key":22295,"timestamp":"2026-09-02T13:00:00.000Z"} +{"doc_count":2996,"split_key":209630,"timestamp":"2026-09-02T13:00:00.000Z"} +{"doc_count":12105,"split_key":209334,"timestamp":"2026-09-02T14:00:00.000Z"} +{"doc_count":6406,"split_key":265904,"timestamp":"2026-09-02T14:00:00.000Z"} +{"doc_count":2856,"split_key":22295,"timestamp":"2026-09-02T14:00:00.000Z"} +{"doc_count":2437,"split_key":214961,"timestamp":"2026-09-02T14:00:00.000Z"} +{"doc_count":2029,"split_key":270646,"timestamp":"2026-09-02T14:00:00.000Z"} +{"doc_count":17866,"split_key":197697,"timestamp":"2026-09-02T15:00:00.000Z"} +{"doc_count":12960,"split_key":209334,"timestamp":"2026-09-02T15:00:00.000Z"} +{"doc_count":8000,"split_key":265904,"timestamp":"2026-09-02T15:00:00.000Z"} +{"doc_count":4568,"split_key":22295,"timestamp":"2026-09-02T15:00:00.000Z"} +{"doc_count":2989,"split_key":274069,"timestamp":"2026-09-02T15:00:00.000Z"} +{"doc_count":16748,"split_key":197697,"timestamp":"2026-09-02T16:00:00.000Z"} +{"doc_count":13165,"split_key":209334,"timestamp":"2026-09-02T16:00:00.000Z"} +{"doc_count":8958,"split_key":270646,"timestamp":"2026-09-02T16:00:00.000Z"} +{"doc_count":6413,"split_key":149089,"timestamp":"2026-09-02T16:00:00.000Z"} +{"doc_count":6128,"split_key":265904,"timestamp":"2026-09-02T16:00:00.000Z"} +{"doc_count":18001,"split_key":149089,"timestamp":"2026-09-02T17:00:00.000Z"} +{"doc_count":8327,"split_key":209334,"timestamp":"2026-09-02T17:00:00.000Z"} +{"doc_count":3746,"split_key":22295,"timestamp":"2026-09-02T17:00:00.000Z"} +{"doc_count":2749,"split_key":274069,"timestamp":"2026-09-02T17:00:00.000Z"} +{"doc_count":2695,"split_key":209630,"timestamp":"2026-09-02T17:00:00.000Z"} +{"doc_count":13591,"split_key":149089,"timestamp":"2026-09-02T18:00:00.000Z"} +{"doc_count":12339,"split_key":209334,"timestamp":"2026-09-02T18:00:00.000Z"} +{"doc_count":2936,"split_key":22295,"timestamp":"2026-09-02T18:00:00.000Z"} +{"doc_count":2419,"split_key":214961,"timestamp":"2026-09-02T18:00:00.000Z"} +{"doc_count":1011,"split_key":45102,"timestamp":"2026-09-02T18:00:00.000Z"} +{"doc_count":12300,"split_key":209334,"timestamp":"2026-09-02T19:00:00.000Z"} +{"doc_count":3659,"split_key":22295,"timestamp":"2026-09-02T19:00:00.000Z"} +{"doc_count":2925,"split_key":274069,"timestamp":"2026-09-02T19:00:00.000Z"} +{"doc_count":2889,"split_key":209630,"timestamp":"2026-09-02T19:00:00.000Z"} +{"doc_count":2517,"split_key":202281,"timestamp":"2026-09-02T19:00:00.000Z"} +{"doc_count":12664,"split_key":209334,"timestamp":"2026-09-02T20:00:00.000Z"} +{"doc_count":8999,"split_key":40676,"timestamp":"2026-09-02T20:00:00.000Z"} +{"doc_count":3533,"split_key":22295,"timestamp":"2026-09-02T20:00:00.000Z"} +{"doc_count":1961,"split_key":14061,"timestamp":"2026-09-02T20:00:00.000Z"} +{"doc_count":1344,"split_key":36352,"timestamp":"2026-09-02T20:00:00.000Z"} +{"doc_count":13528,"split_key":209334,"timestamp":"2026-09-02T21:00:00.000Z"} +{"doc_count":2893,"split_key":209630,"timestamp":"2026-09-02T21:00:00.000Z"} +{"doc_count":2739,"split_key":274069,"timestamp":"2026-09-02T21:00:00.000Z"} +{"doc_count":2500,"split_key":36352,"timestamp":"2026-09-02T21:00:00.000Z"} +{"doc_count":1968,"split_key":214961,"timestamp":"2026-09-02T21:00:00.000Z"} +{"doc_count":11892,"split_key":209334,"timestamp":"2026-09-02T22:00:00.000Z"} +{"doc_count":2500,"split_key":36352,"timestamp":"2026-09-02T22:00:00.000Z"} +{"doc_count":1364,"split_key":22295,"timestamp":"2026-09-02T22:00:00.000Z"} +{"doc_count":996,"split_key":45102,"timestamp":"2026-09-02T22:00:00.000Z"} +{"doc_count":623,"split_key":201401,"timestamp":"2026-09-02T22:00:00.000Z"} +{"doc_count":3948,"split_key":36352,"timestamp":"2026-09-02T23:00:00.000Z"} +{"doc_count":2916,"split_key":209630,"timestamp":"2026-09-02T23:00:00.000Z"} +{"doc_count":2892,"split_key":274069,"timestamp":"2026-09-02T23:00:00.000Z"} +{"doc_count":2269,"split_key":22295,"timestamp":"2026-09-02T23:00:00.000Z"} +{"doc_count":1993,"split_key":214961,"timestamp":"2026-09-02T23:00:00.000Z"} +{"doc_count":10015,"split_key":14987,"timestamp":"2026-09-03T00:00:00.000Z"} +{"doc_count":4081,"split_key":9009,"timestamp":"2026-09-03T00:00:00.000Z"} +{"doc_count":3261,"split_key":36352,"timestamp":"2026-09-03T00:00:00.000Z"} +{"doc_count":2464,"split_key":214961,"timestamp":"2026-09-03T00:00:00.000Z"} +{"doc_count":1833,"split_key":22295,"timestamp":"2026-09-03T00:00:00.000Z"} +{"doc_count":17400,"split_key":48090,"timestamp":"2026-09-03T01:00:00.000Z"} +{"doc_count":4250,"split_key":36352,"timestamp":"2026-09-03T01:00:00.000Z"} +{"doc_count":2974,"split_key":209630,"timestamp":"2026-09-03T01:00:00.000Z"} +{"doc_count":2873,"split_key":274069,"timestamp":"2026-09-03T01:00:00.000Z"} +{"doc_count":2451,"split_key":214961,"timestamp":"2026-09-03T01:00:00.000Z"} +{"doc_count":3909,"split_key":36352,"timestamp":"2026-09-03T02:00:00.000Z"} +{"doc_count":2218,"split_key":48090,"timestamp":"2026-09-03T02:00:00.000Z"} +{"doc_count":2048,"split_key":22295,"timestamp":"2026-09-03T02:00:00.000Z"} +{"doc_count":1002,"split_key":45102,"timestamp":"2026-09-03T02:00:00.000Z"} +{"doc_count":706,"split_key":211590,"timestamp":"2026-09-03T02:00:00.000Z"} +{"doc_count":8809,"split_key":149089,"timestamp":"2026-09-03T03:00:00.000Z"} +{"doc_count":4213,"split_key":36352,"timestamp":"2026-09-03T03:00:00.000Z"} +{"doc_count":2919,"split_key":209630,"timestamp":"2026-09-03T03:00:00.000Z"} +{"doc_count":2760,"split_key":274069,"timestamp":"2026-09-03T03:00:00.000Z"} +{"doc_count":2393,"split_key":22295,"timestamp":"2026-09-03T03:00:00.000Z"} +{"doc_count":24115,"split_key":149089,"timestamp":"2026-09-03T04:00:00.000Z"} +{"doc_count":3241,"split_key":396982,"timestamp":"2026-09-03T04:00:00.000Z"} +{"doc_count":3106,"split_key":36352,"timestamp":"2026-09-03T04:00:00.000Z"} +{"doc_count":1759,"split_key":22295,"timestamp":"2026-09-03T04:00:00.000Z"} +{"doc_count":1286,"split_key":209334,"timestamp":"2026-09-03T04:00:00.000Z"} +{"doc_count":15222,"split_key":149089,"timestamp":"2026-09-03T05:00:00.000Z"} +{"doc_count":4552,"split_key":209334,"timestamp":"2026-09-03T05:00:00.000Z"} +{"doc_count":3502,"split_key":36352,"timestamp":"2026-09-03T05:00:00.000Z"} +{"doc_count":2807,"split_key":274069,"timestamp":"2026-09-03T05:00:00.000Z"} +{"doc_count":2803,"split_key":209630,"timestamp":"2026-09-03T05:00:00.000Z"} +{"doc_count":9888,"split_key":48090,"timestamp":"2026-09-03T06:00:00.000Z"} +{"doc_count":3812,"split_key":396982,"timestamp":"2026-09-03T06:00:00.000Z"} +{"doc_count":3488,"split_key":209334,"timestamp":"2026-09-03T06:00:00.000Z"} +{"doc_count":2607,"split_key":36352,"timestamp":"2026-09-03T06:00:00.000Z"} +{"doc_count":1608,"split_key":22295,"timestamp":"2026-09-03T06:00:00.000Z"} +{"doc_count":8082,"split_key":209334,"timestamp":"2026-09-03T07:00:00.000Z"} +{"doc_count":4560,"split_key":149089,"timestamp":"2026-09-03T07:00:00.000Z"} +{"doc_count":3665,"split_key":396982,"timestamp":"2026-09-03T07:00:00.000Z"} +{"doc_count":3187,"split_key":36352,"timestamp":"2026-09-03T07:00:00.000Z"} +{"doc_count":2957,"split_key":209630,"timestamp":"2026-09-03T07:00:00.000Z"} +{"doc_count":24300,"split_key":149089,"timestamp":"2026-09-03T08:00:00.000Z"} +{"doc_count":7230,"split_key":209334,"timestamp":"2026-09-03T08:00:00.000Z"} +{"doc_count":4778,"split_key":396982,"timestamp":"2026-09-03T08:00:00.000Z"} +{"doc_count":3165,"split_key":36352,"timestamp":"2026-09-03T08:00:00.000Z"} +{"doc_count":1666,"split_key":22295,"timestamp":"2026-09-03T08:00:00.000Z"} +{"doc_count":19139,"split_key":149089,"timestamp":"2026-09-03T09:00:00.000Z"} +{"doc_count":6467,"split_key":209334,"timestamp":"2026-09-03T09:00:00.000Z"} +{"doc_count":4861,"split_key":396982,"timestamp":"2026-09-03T09:00:00.000Z"} +{"doc_count":3922,"split_key":36352,"timestamp":"2026-09-03T09:00:00.000Z"} +{"doc_count":3368,"split_key":22295,"timestamp":"2026-09-03T09:00:00.000Z"} +{"doc_count":10058,"split_key":209334,"timestamp":"2026-09-03T10:00:00.000Z"} +{"doc_count":7282,"split_key":149089,"timestamp":"2026-09-03T10:00:00.000Z"} +{"doc_count":3122,"split_key":396982,"timestamp":"2026-09-03T10:00:00.000Z"} +{"doc_count":2810,"split_key":36352,"timestamp":"2026-09-03T10:00:00.000Z"} +{"doc_count":1702,"split_key":22295,"timestamp":"2026-09-03T10:00:00.000Z"} +{"doc_count":23571,"split_key":149089,"timestamp":"2026-09-03T11:00:00.000Z"} +{"doc_count":7935,"split_key":209334,"timestamp":"2026-09-03T11:00:00.000Z"} +{"doc_count":4639,"split_key":270646,"timestamp":"2026-09-03T11:00:00.000Z"} +{"doc_count":3666,"split_key":396982,"timestamp":"2026-09-03T11:00:00.000Z"} +{"doc_count":3190,"split_key":36352,"timestamp":"2026-09-03T11:00:00.000Z"} +{"doc_count":16922,"split_key":149089,"timestamp":"2026-09-03T12:00:00.000Z"} +{"doc_count":6492,"split_key":209334,"timestamp":"2026-09-03T12:00:00.000Z"} +{"doc_count":6169,"split_key":270646,"timestamp":"2026-09-03T12:00:00.000Z"} +{"doc_count":3983,"split_key":36352,"timestamp":"2026-09-03T12:00:00.000Z"} +{"doc_count":3074,"split_key":265904,"timestamp":"2026-09-03T12:00:00.000Z"} +{"doc_count":14434,"split_key":135905,"timestamp":"2026-09-03T13:00:00.000Z"} +{"doc_count":8362,"split_key":209334,"timestamp":"2026-09-03T13:00:00.000Z"} +{"doc_count":5954,"split_key":270646,"timestamp":"2026-09-03T13:00:00.000Z"} +{"doc_count":5786,"split_key":396982,"timestamp":"2026-09-03T13:00:00.000Z"} +{"doc_count":2957,"split_key":265904,"timestamp":"2026-09-03T13:00:00.000Z"} +{"doc_count":24373,"split_key":135905,"timestamp":"2026-09-03T14:00:00.000Z"} +{"doc_count":12675,"split_key":209334,"timestamp":"2026-09-03T14:00:00.000Z"} +{"doc_count":3486,"split_key":270646,"timestamp":"2026-09-03T14:00:00.000Z"} +{"doc_count":2477,"split_key":396982,"timestamp":"2026-09-03T14:00:00.000Z"} +{"doc_count":2297,"split_key":36352,"timestamp":"2026-09-03T14:00:00.000Z"} +{"doc_count":10803,"split_key":209334,"timestamp":"2026-09-03T15:00:00.000Z"} +{"doc_count":4498,"split_key":135905,"timestamp":"2026-09-03T15:00:00.000Z"} +{"doc_count":3535,"split_key":36352,"timestamp":"2026-09-03T15:00:00.000Z"} +{"doc_count":2810,"split_key":209630,"timestamp":"2026-09-03T15:00:00.000Z"} +{"doc_count":2810,"split_key":265904,"timestamp":"2026-09-03T15:00:00.000Z"} +{"doc_count":13306,"split_key":209334,"timestamp":"2026-09-03T16:00:00.000Z"} +{"doc_count":9769,"split_key":265904,"timestamp":"2026-09-03T16:00:00.000Z"} +{"doc_count":6576,"split_key":149089,"timestamp":"2026-09-03T16:00:00.000Z"} +{"doc_count":4882,"split_key":270646,"timestamp":"2026-09-03T16:00:00.000Z"} +{"doc_count":3241,"split_key":396982,"timestamp":"2026-09-03T16:00:00.000Z"} +{"doc_count":24178,"split_key":149089,"timestamp":"2026-09-03T17:00:00.000Z"} +{"doc_count":3553,"split_key":48925,"timestamp":"2026-09-03T17:00:00.000Z"} +{"doc_count":3377,"split_key":209334,"timestamp":"2026-09-03T17:00:00.000Z"} +{"doc_count":2934,"split_key":36352,"timestamp":"2026-09-03T17:00:00.000Z"} +{"doc_count":2880,"split_key":274069,"timestamp":"2026-09-03T17:00:00.000Z"} +{"doc_count":23623,"split_key":149089,"timestamp":"2026-09-03T18:00:00.000Z"} +{"doc_count":14873,"split_key":209334,"timestamp":"2026-09-03T18:00:00.000Z"} +{"doc_count":9064,"split_key":198401,"timestamp":"2026-09-03T18:00:00.000Z"} +{"doc_count":3399,"split_key":36352,"timestamp":"2026-09-03T18:00:00.000Z"} +{"doc_count":3222,"split_key":39603,"timestamp":"2026-09-03T18:00:00.000Z"} +{"doc_count":23686,"split_key":149089,"timestamp":"2026-09-03T19:00:00.000Z"} +{"doc_count":14739,"split_key":209334,"timestamp":"2026-09-03T19:00:00.000Z"} +{"doc_count":12158,"split_key":198401,"timestamp":"2026-09-03T19:00:00.000Z"} +{"doc_count":4060,"split_key":36352,"timestamp":"2026-09-03T19:00:00.000Z"} +{"doc_count":2814,"split_key":274069,"timestamp":"2026-09-03T19:00:00.000Z"} +{"doc_count":24107,"split_key":149089,"timestamp":"2026-09-03T20:00:00.000Z"} +{"doc_count":14016,"split_key":209334,"timestamp":"2026-09-03T20:00:00.000Z"} +{"doc_count":12344,"split_key":198401,"timestamp":"2026-09-03T20:00:00.000Z"} +{"doc_count":3984,"split_key":36352,"timestamp":"2026-09-03T20:00:00.000Z"} +{"doc_count":3118,"split_key":265904,"timestamp":"2026-09-03T20:00:00.000Z"} +{"doc_count":23342,"split_key":149089,"timestamp":"2026-09-03T21:00:00.000Z"} +{"doc_count":13367,"split_key":209334,"timestamp":"2026-09-03T21:00:00.000Z"} +{"doc_count":12319,"split_key":198401,"timestamp":"2026-09-03T21:00:00.000Z"} +{"doc_count":3643,"split_key":36352,"timestamp":"2026-09-03T21:00:00.000Z"} +{"doc_count":2848,"split_key":274069,"timestamp":"2026-09-03T21:00:00.000Z"} +{"doc_count":17059,"split_key":149089,"timestamp":"2026-09-03T22:00:00.000Z"} +{"doc_count":12454,"split_key":209334,"timestamp":"2026-09-03T22:00:00.000Z"} +{"doc_count":12299,"split_key":198401,"timestamp":"2026-09-03T22:00:00.000Z"} +{"doc_count":4019,"split_key":265904,"timestamp":"2026-09-03T22:00:00.000Z"} +{"doc_count":3712,"split_key":36352,"timestamp":"2026-09-03T22:00:00.000Z"} +{"doc_count":6760,"split_key":265904,"timestamp":"2026-09-03T23:00:00.000Z"} +{"doc_count":3398,"split_key":270646,"timestamp":"2026-09-03T23:00:00.000Z"} +{"doc_count":2820,"split_key":274069,"timestamp":"2026-09-03T23:00:00.000Z"} +{"doc_count":2803,"split_key":36352,"timestamp":"2026-09-03T23:00:00.000Z"} +{"doc_count":2742,"split_key":209630,"timestamp":"2026-09-03T23:00:00.000Z"} +{"doc_count":12804,"split_key":212238,"timestamp":"2026-09-04T00:00:00.000Z"} +{"doc_count":9002,"split_key":14987,"timestamp":"2026-09-04T00:00:00.000Z"} +{"doc_count":5477,"split_key":42926,"timestamp":"2026-09-04T00:00:00.000Z"} +{"doc_count":3843,"split_key":396982,"timestamp":"2026-09-04T00:00:00.000Z"} +{"doc_count":3081,"split_key":36352,"timestamp":"2026-09-04T00:00:00.000Z"} +{"doc_count":5806,"split_key":42926,"timestamp":"2026-09-04T01:00:00.000Z"} +{"doc_count":3767,"split_key":396982,"timestamp":"2026-09-04T01:00:00.000Z"} +{"doc_count":2879,"split_key":197328,"timestamp":"2026-09-04T01:00:00.000Z"} +{"doc_count":2696,"split_key":274069,"timestamp":"2026-09-04T01:00:00.000Z"} +{"doc_count":2650,"split_key":209630,"timestamp":"2026-09-04T01:00:00.000Z"} +{"doc_count":5680,"split_key":42926,"timestamp":"2026-09-04T02:00:00.000Z"} +{"doc_count":3246,"split_key":36352,"timestamp":"2026-09-04T02:00:00.000Z"} +{"doc_count":2845,"split_key":197328,"timestamp":"2026-09-04T02:00:00.000Z"} +{"doc_count":2775,"split_key":396982,"timestamp":"2026-09-04T02:00:00.000Z"} +{"doc_count":2137,"split_key":214961,"timestamp":"2026-09-04T02:00:00.000Z"} +{"doc_count":6285,"split_key":135905,"timestamp":"2026-09-04T03:00:00.000Z"} +{"doc_count":5822,"split_key":42926,"timestamp":"2026-09-04T03:00:00.000Z"} +{"doc_count":2934,"split_key":209630,"timestamp":"2026-09-04T03:00:00.000Z"} +{"doc_count":2915,"split_key":197328,"timestamp":"2026-09-04T03:00:00.000Z"} +{"doc_count":2839,"split_key":274069,"timestamp":"2026-09-04T03:00:00.000Z"} +{"doc_count":23702,"split_key":135905,"timestamp":"2026-09-04T04:00:00.000Z"} +{"doc_count":5784,"split_key":42926,"timestamp":"2026-09-04T04:00:00.000Z"} +{"doc_count":4557,"split_key":396982,"timestamp":"2026-09-04T04:00:00.000Z"} +{"doc_count":2896,"split_key":197328,"timestamp":"2026-09-04T04:00:00.000Z"} +{"doc_count":2657,"split_key":36352,"timestamp":"2026-09-04T04:00:00.000Z"} +{"doc_count":23878,"split_key":135905,"timestamp":"2026-09-04T05:00:00.000Z"} +{"doc_count":5875,"split_key":42926,"timestamp":"2026-09-04T05:00:00.000Z"} +{"doc_count":4572,"split_key":209334,"timestamp":"2026-09-04T05:00:00.000Z"} +{"doc_count":3448,"split_key":396982,"timestamp":"2026-09-04T05:00:00.000Z"} +{"doc_count":2926,"split_key":197328,"timestamp":"2026-09-04T05:00:00.000Z"} +{"doc_count":24311,"split_key":135905,"timestamp":"2026-09-04T06:00:00.000Z"} +{"doc_count":5824,"split_key":42926,"timestamp":"2026-09-04T06:00:00.000Z"} +{"doc_count":2900,"split_key":197328,"timestamp":"2026-09-04T06:00:00.000Z"} +{"doc_count":2848,"split_key":209334,"timestamp":"2026-09-04T06:00:00.000Z"} +{"doc_count":2428,"split_key":214961,"timestamp":"2026-09-04T06:00:00.000Z"} +{"doc_count":23626,"split_key":135905,"timestamp":"2026-09-04T07:00:00.000Z"} +{"doc_count":8497,"split_key":209334,"timestamp":"2026-09-04T07:00:00.000Z"} +{"doc_count":5883,"split_key":42926,"timestamp":"2026-09-04T07:00:00.000Z"} +{"doc_count":3352,"split_key":22295,"timestamp":"2026-09-04T07:00:00.000Z"} +{"doc_count":2968,"split_key":209630,"timestamp":"2026-09-04T07:00:00.000Z"} +{"doc_count":16321,"split_key":135905,"timestamp":"2026-09-04T08:00:00.000Z"} +{"doc_count":5859,"split_key":209334,"timestamp":"2026-09-04T08:00:00.000Z"} +{"doc_count":5783,"split_key":42926,"timestamp":"2026-09-04T08:00:00.000Z"} +{"doc_count":4215,"split_key":22295,"timestamp":"2026-09-04T08:00:00.000Z"} +{"doc_count":2905,"split_key":197328,"timestamp":"2026-09-04T08:00:00.000Z"} +{"doc_count":8290,"split_key":209334,"timestamp":"2026-09-04T09:00:00.000Z"} +{"doc_count":5812,"split_key":42926,"timestamp":"2026-09-04T09:00:00.000Z"} +{"doc_count":3515,"split_key":396982,"timestamp":"2026-09-04T09:00:00.000Z"} +{"doc_count":3046,"split_key":22295,"timestamp":"2026-09-04T09:00:00.000Z"} +{"doc_count":2978,"split_key":209630,"timestamp":"2026-09-04T09:00:00.000Z"} +{"doc_count":7651,"split_key":209334,"timestamp":"2026-09-04T10:00:00.000Z"} +{"doc_count":4144,"split_key":396982,"timestamp":"2026-09-04T10:00:00.000Z"} +{"doc_count":2461,"split_key":214961,"timestamp":"2026-09-04T10:00:00.000Z"} +{"doc_count":2118,"split_key":22295,"timestamp":"2026-09-04T10:00:00.000Z"} +{"doc_count":1155,"split_key":51396,"timestamp":"2026-09-04T10:00:00.000Z"} +{"doc_count":8764,"split_key":209334,"timestamp":"2026-09-04T11:00:00.000Z"} +{"doc_count":3945,"split_key":396982,"timestamp":"2026-09-04T11:00:00.000Z"} +{"doc_count":2957,"split_key":22295,"timestamp":"2026-09-04T11:00:00.000Z"} +{"doc_count":2776,"split_key":209630,"timestamp":"2026-09-04T11:00:00.000Z"} +{"doc_count":2561,"split_key":274069,"timestamp":"2026-09-04T11:00:00.000Z"} +{"doc_count":7587,"split_key":209334,"timestamp":"2026-09-04T12:00:00.000Z"} +{"doc_count":3600,"split_key":63737,"timestamp":"2026-09-04T12:00:00.000Z"} +{"doc_count":3243,"split_key":22295,"timestamp":"2026-09-04T12:00:00.000Z"} +{"doc_count":2730,"split_key":396982,"timestamp":"2026-09-04T12:00:00.000Z"} +{"doc_count":2072,"split_key":214961,"timestamp":"2026-09-04T12:00:00.000Z"} +{"doc_count":8322,"split_key":209334,"timestamp":"2026-09-04T13:00:00.000Z"} +{"doc_count":8315,"split_key":63737,"timestamp":"2026-09-04T13:00:00.000Z"} +{"doc_count":5138,"split_key":396982,"timestamp":"2026-09-04T13:00:00.000Z"} +{"doc_count":2787,"split_key":274069,"timestamp":"2026-09-04T13:00:00.000Z"} +{"doc_count":2753,"split_key":209630,"timestamp":"2026-09-04T13:00:00.000Z"} +{"doc_count":17660,"split_key":63737,"timestamp":"2026-09-04T14:00:00.000Z"} +{"doc_count":10826,"split_key":209334,"timestamp":"2026-09-04T14:00:00.000Z"} +{"doc_count":7408,"split_key":265904,"timestamp":"2026-09-04T14:00:00.000Z"} +{"doc_count":5422,"split_key":198401,"timestamp":"2026-09-04T14:00:00.000Z"} +{"doc_count":3866,"split_key":396982,"timestamp":"2026-09-04T14:00:00.000Z"} +{"doc_count":19844,"split_key":198401,"timestamp":"2026-09-04T15:00:00.000Z"} +{"doc_count":14725,"split_key":154247,"timestamp":"2026-09-04T15:00:00.000Z"} +{"doc_count":13383,"split_key":63737,"timestamp":"2026-09-04T15:00:00.000Z"} +{"doc_count":9195,"split_key":209334,"timestamp":"2026-09-04T15:00:00.000Z"} +{"doc_count":8109,"split_key":265904,"timestamp":"2026-09-04T15:00:00.000Z"} +{"doc_count":24080,"split_key":154247,"timestamp":"2026-09-04T16:00:00.000Z"} +{"doc_count":15332,"split_key":209334,"timestamp":"2026-09-04T16:00:00.000Z"} +{"doc_count":6174,"split_key":265904,"timestamp":"2026-09-04T16:00:00.000Z"} +{"doc_count":3196,"split_key":270646,"timestamp":"2026-09-04T16:00:00.000Z"} +{"doc_count":2785,"split_key":396982,"timestamp":"2026-09-04T16:00:00.000Z"} +{"doc_count":24125,"split_key":154247,"timestamp":"2026-09-04T17:00:00.000Z"} +{"doc_count":15382,"split_key":198401,"timestamp":"2026-09-04T17:00:00.000Z"} +{"doc_count":4206,"split_key":209334,"timestamp":"2026-09-04T17:00:00.000Z"} +{"doc_count":3185,"split_key":39603,"timestamp":"2026-09-04T17:00:00.000Z"} +{"doc_count":3169,"split_key":265904,"timestamp":"2026-09-04T17:00:00.000Z"} +{"doc_count":23670,"split_key":154247,"timestamp":"2026-09-04T18:00:00.000Z"} +{"doc_count":18961,"split_key":198401,"timestamp":"2026-09-04T18:00:00.000Z"} +{"doc_count":3001,"split_key":29314,"timestamp":"2026-09-04T18:00:00.000Z"} +{"doc_count":2969,"split_key":22295,"timestamp":"2026-09-04T18:00:00.000Z"} +{"doc_count":2761,"split_key":50638,"timestamp":"2026-09-04T18:00:00.000Z"} +{"doc_count":27861,"split_key":209334,"timestamp":"2026-09-04T19:00:00.000Z"} +{"doc_count":24170,"split_key":154247,"timestamp":"2026-09-04T19:00:00.000Z"} +{"doc_count":19101,"split_key":198401,"timestamp":"2026-09-04T19:00:00.000Z"} +{"doc_count":11998,"split_key":396982,"timestamp":"2026-09-04T19:00:00.000Z"} +{"doc_count":3119,"split_key":22295,"timestamp":"2026-09-04T19:00:00.000Z"} +{"doc_count":23870,"split_key":154247,"timestamp":"2026-09-04T20:00:00.000Z"} +{"doc_count":18962,"split_key":198401,"timestamp":"2026-09-04T20:00:00.000Z"} +{"doc_count":14816,"split_key":209334,"timestamp":"2026-09-04T20:00:00.000Z"} +{"doc_count":2980,"split_key":13110,"timestamp":"2026-09-04T20:00:00.000Z"} +{"doc_count":2561,"split_key":22295,"timestamp":"2026-09-04T20:00:00.000Z"} +{"doc_count":16107,"split_key":198401,"timestamp":"2026-09-04T21:00:00.000Z"} +{"doc_count":12922,"split_key":209334,"timestamp":"2026-09-04T21:00:00.000Z"} +{"doc_count":8966,"split_key":154247,"timestamp":"2026-09-04T21:00:00.000Z"} +{"doc_count":4632,"split_key":396982,"timestamp":"2026-09-04T21:00:00.000Z"} +{"doc_count":2705,"split_key":209630,"timestamp":"2026-09-04T21:00:00.000Z"} +{"doc_count":12947,"split_key":209334,"timestamp":"2026-09-04T22:00:00.000Z"} +{"doc_count":2481,"split_key":22295,"timestamp":"2026-09-04T22:00:00.000Z"} +{"doc_count":2267,"split_key":396982,"timestamp":"2026-09-04T22:00:00.000Z"} +{"doc_count":1457,"split_key":138415,"timestamp":"2026-09-04T22:00:00.000Z"} +{"doc_count":733,"split_key":16509,"timestamp":"2026-09-04T22:00:00.000Z"} +{"doc_count":3373,"split_key":396982,"timestamp":"2026-09-04T23:00:00.000Z"} +{"doc_count":2950,"split_key":274069,"timestamp":"2026-09-04T23:00:00.000Z"} +{"doc_count":2820,"split_key":22295,"timestamp":"2026-09-04T23:00:00.000Z"} +{"doc_count":2767,"split_key":209630,"timestamp":"2026-09-04T23:00:00.000Z"} +{"doc_count":1456,"split_key":138415,"timestamp":"2026-09-04T23:00:00.000Z"} +{"doc_count":9008,"split_key":14987,"timestamp":"2026-09-05T00:00:00.000Z"} +{"doc_count":5212,"split_key":396982,"timestamp":"2026-09-05T00:00:00.000Z"} +{"doc_count":3113,"split_key":265904,"timestamp":"2026-09-05T00:00:00.000Z"} +{"doc_count":2517,"split_key":22295,"timestamp":"2026-09-05T00:00:00.000Z"} +{"doc_count":1898,"split_key":214961,"timestamp":"2026-09-05T00:00:00.000Z"} +{"doc_count":3002,"split_key":396982,"timestamp":"2026-09-05T01:00:00.000Z"} +{"doc_count":2910,"split_key":209630,"timestamp":"2026-09-05T01:00:00.000Z"} +{"doc_count":2752,"split_key":274069,"timestamp":"2026-09-05T01:00:00.000Z"} +{"doc_count":2557,"split_key":22295,"timestamp":"2026-09-05T01:00:00.000Z"} +{"doc_count":2464,"split_key":214961,"timestamp":"2026-09-05T01:00:00.000Z"} +{"doc_count":12748,"split_key":212238,"timestamp":"2026-09-05T02:00:00.000Z"} +{"doc_count":3049,"split_key":214961,"timestamp":"2026-09-05T02:00:00.000Z"} +{"doc_count":2881,"split_key":396982,"timestamp":"2026-09-05T02:00:00.000Z"} +{"doc_count":2180,"split_key":42926,"timestamp":"2026-09-05T02:00:00.000Z"} +{"doc_count":1981,"split_key":22295,"timestamp":"2026-09-05T02:00:00.000Z"} +{"doc_count":11858,"split_key":42926,"timestamp":"2026-09-05T03:00:00.000Z"} +{"doc_count":3278,"split_key":396982,"timestamp":"2026-09-05T03:00:00.000Z"} +{"doc_count":2838,"split_key":274069,"timestamp":"2026-09-05T03:00:00.000Z"} +{"doc_count":2818,"split_key":22295,"timestamp":"2026-09-05T03:00:00.000Z"} +{"doc_count":2628,"split_key":209630,"timestamp":"2026-09-05T03:00:00.000Z"} +{"doc_count":11898,"split_key":42926,"timestamp":"2026-09-05T04:00:00.000Z"} +{"doc_count":4658,"split_key":396982,"timestamp":"2026-09-05T04:00:00.000Z"} +{"doc_count":2139,"split_key":22295,"timestamp":"2026-09-05T04:00:00.000Z"} +{"doc_count":2023,"split_key":214961,"timestamp":"2026-09-05T04:00:00.000Z"} +{"doc_count":1456,"split_key":138415,"timestamp":"2026-09-05T04:00:00.000Z"} +{"doc_count":11808,"split_key":42926,"timestamp":"2026-09-05T05:00:00.000Z"} +{"doc_count":5803,"split_key":396982,"timestamp":"2026-09-05T05:00:00.000Z"} +{"doc_count":4841,"split_key":209334,"timestamp":"2026-09-05T05:00:00.000Z"} +{"doc_count":2998,"split_key":209630,"timestamp":"2026-09-05T05:00:00.000Z"} +{"doc_count":2819,"split_key":274069,"timestamp":"2026-09-05T05:00:00.000Z"} +{"doc_count":12597,"split_key":396982,"timestamp":"2026-09-05T06:00:00.000Z"} +{"doc_count":12006,"split_key":42926,"timestamp":"2026-09-05T06:00:00.000Z"} +{"doc_count":3277,"split_key":209334,"timestamp":"2026-09-05T06:00:00.000Z"} +{"doc_count":2948,"split_key":22295,"timestamp":"2026-09-05T06:00:00.000Z"} +{"doc_count":2658,"split_key":214961,"timestamp":"2026-09-05T06:00:00.000Z"} +{"doc_count":29077,"split_key":396982,"timestamp":"2026-09-05T07:00:00.000Z"} +{"doc_count":8671,"split_key":209334,"timestamp":"2026-09-05T07:00:00.000Z"} +{"doc_count":7378,"split_key":42926,"timestamp":"2026-09-05T07:00:00.000Z"} +{"doc_count":3021,"split_key":274069,"timestamp":"2026-09-05T07:00:00.000Z"} +{"doc_count":2947,"split_key":214961,"timestamp":"2026-09-05T07:00:00.000Z"} +{"doc_count":5575,"split_key":396982,"timestamp":"2026-09-05T08:00:00.000Z"} +{"doc_count":4139,"split_key":209334,"timestamp":"2026-09-05T08:00:00.000Z"} +{"doc_count":3417,"split_key":64199,"timestamp":"2026-09-05T08:00:00.000Z"} +{"doc_count":2946,"split_key":214961,"timestamp":"2026-09-05T08:00:00.000Z"} +{"doc_count":2755,"split_key":13335,"timestamp":"2026-09-05T08:00:00.000Z"} +{"doc_count":10781,"split_key":396982,"timestamp":"2026-09-05T09:00:00.000Z"} +{"doc_count":9302,"split_key":209334,"timestamp":"2026-09-05T09:00:00.000Z"} +{"doc_count":3441,"split_key":64199,"timestamp":"2026-09-05T09:00:00.000Z"} +{"doc_count":2984,"split_key":274069,"timestamp":"2026-09-05T09:00:00.000Z"} +{"doc_count":2958,"split_key":214961,"timestamp":"2026-09-05T09:00:00.000Z"} +{"doc_count":11478,"split_key":396982,"timestamp":"2026-09-05T10:00:00.000Z"} +{"doc_count":5722,"split_key":209334,"timestamp":"2026-09-05T10:00:00.000Z"} +{"doc_count":3407,"split_key":64199,"timestamp":"2026-09-05T10:00:00.000Z"} +{"doc_count":2965,"split_key":214961,"timestamp":"2026-09-05T10:00:00.000Z"} +{"doc_count":2026,"split_key":22295,"timestamp":"2026-09-05T10:00:00.000Z"} +{"doc_count":12842,"split_key":396982,"timestamp":"2026-09-05T11:00:00.000Z"} +{"doc_count":7803,"split_key":209334,"timestamp":"2026-09-05T11:00:00.000Z"} +{"doc_count":3160,"split_key":214961,"timestamp":"2026-09-05T11:00:00.000Z"} +{"doc_count":2921,"split_key":274069,"timestamp":"2026-09-05T11:00:00.000Z"} +{"doc_count":2854,"split_key":209630,"timestamp":"2026-09-05T11:00:00.000Z"} +{"doc_count":13255,"split_key":396982,"timestamp":"2026-09-05T12:00:00.000Z"} +{"doc_count":10606,"split_key":209334,"timestamp":"2026-09-05T12:00:00.000Z"} +{"doc_count":3944,"split_key":37963,"timestamp":"2026-09-05T12:00:00.000Z"} +{"doc_count":3186,"split_key":214961,"timestamp":"2026-09-05T12:00:00.000Z"} +{"doc_count":748,"split_key":201401,"timestamp":"2026-09-05T12:00:00.000Z"} +{"doc_count":12052,"split_key":198401,"timestamp":"2026-09-05T13:00:00.000Z"} +{"doc_count":9283,"split_key":396982,"timestamp":"2026-09-05T13:00:00.000Z"} +{"doc_count":5178,"split_key":209334,"timestamp":"2026-09-05T13:00:00.000Z"} +{"doc_count":3280,"split_key":214961,"timestamp":"2026-09-05T13:00:00.000Z"} +{"doc_count":2939,"split_key":274069,"timestamp":"2026-09-05T13:00:00.000Z"} +{"doc_count":18659,"split_key":149089,"timestamp":"2026-09-05T14:00:00.000Z"} +{"doc_count":18490,"split_key":198401,"timestamp":"2026-09-05T14:00:00.000Z"} +{"doc_count":13864,"split_key":209334,"timestamp":"2026-09-05T14:00:00.000Z"} +{"doc_count":8229,"split_key":396982,"timestamp":"2026-09-05T14:00:00.000Z"} +{"doc_count":3267,"split_key":214961,"timestamp":"2026-09-05T14:00:00.000Z"} +{"doc_count":24216,"split_key":149089,"timestamp":"2026-09-05T15:00:00.000Z"} +{"doc_count":18671,"split_key":198401,"timestamp":"2026-09-05T15:00:00.000Z"} +{"doc_count":8784,"split_key":209334,"timestamp":"2026-09-05T15:00:00.000Z"} +{"doc_count":5669,"split_key":396982,"timestamp":"2026-09-05T15:00:00.000Z"} +{"doc_count":3262,"split_key":214961,"timestamp":"2026-09-05T15:00:00.000Z"} +{"doc_count":23668,"split_key":149089,"timestamp":"2026-09-05T16:00:00.000Z"} +{"doc_count":18530,"split_key":198401,"timestamp":"2026-09-05T16:00:00.000Z"} +{"doc_count":15532,"split_key":209334,"timestamp":"2026-09-05T16:00:00.000Z"} +{"doc_count":8074,"split_key":396982,"timestamp":"2026-09-05T16:00:00.000Z"} +{"doc_count":3287,"split_key":1967,"timestamp":"2026-09-05T16:00:00.000Z"} +{"doc_count":24211,"split_key":149089,"timestamp":"2026-09-05T17:00:00.000Z"} +{"doc_count":18512,"split_key":198401,"timestamp":"2026-09-05T17:00:00.000Z"} +{"doc_count":4692,"split_key":209334,"timestamp":"2026-09-05T17:00:00.000Z"} +{"doc_count":4645,"split_key":396982,"timestamp":"2026-09-05T17:00:00.000Z"} +{"doc_count":4283,"split_key":42926,"timestamp":"2026-09-05T17:00:00.000Z"} +{"doc_count":24100,"split_key":149089,"timestamp":"2026-09-05T18:00:00.000Z"} +{"doc_count":18541,"split_key":198401,"timestamp":"2026-09-05T18:00:00.000Z"} +{"doc_count":9806,"split_key":42926,"timestamp":"2026-09-05T18:00:00.000Z"} +{"doc_count":5754,"split_key":396982,"timestamp":"2026-09-05T18:00:00.000Z"} +{"doc_count":3259,"split_key":214961,"timestamp":"2026-09-05T18:00:00.000Z"} +{"doc_count":29102,"split_key":209334,"timestamp":"2026-09-05T19:00:00.000Z"} +{"doc_count":23756,"split_key":149089,"timestamp":"2026-09-05T19:00:00.000Z"} +{"doc_count":18490,"split_key":198401,"timestamp":"2026-09-05T19:00:00.000Z"} +{"doc_count":5954,"split_key":396982,"timestamp":"2026-09-05T19:00:00.000Z"} +{"doc_count":2802,"split_key":209630,"timestamp":"2026-09-05T19:00:00.000Z"} +{"doc_count":18527,"split_key":198401,"timestamp":"2026-09-05T20:00:00.000Z"} +{"doc_count":16192,"split_key":209334,"timestamp":"2026-09-05T20:00:00.000Z"} +{"doc_count":5369,"split_key":149089,"timestamp":"2026-09-05T20:00:00.000Z"} +{"doc_count":1864,"split_key":396982,"timestamp":"2026-09-05T20:00:00.000Z"} +{"doc_count":970,"split_key":138995,"timestamp":"2026-09-05T20:00:00.000Z"} +{"doc_count":18397,"split_key":198401,"timestamp":"2026-09-05T21:00:00.000Z"} +{"doc_count":13403,"split_key":209334,"timestamp":"2026-09-05T21:00:00.000Z"} +{"doc_count":3728,"split_key":209630,"timestamp":"2026-09-05T21:00:00.000Z"} +{"doc_count":2773,"split_key":50019,"timestamp":"2026-09-05T21:00:00.000Z"} +{"doc_count":2012,"split_key":274069,"timestamp":"2026-09-05T21:00:00.000Z"} +{"doc_count":17822,"split_key":198401,"timestamp":"2026-09-05T22:00:00.000Z"} +{"doc_count":13232,"split_key":209334,"timestamp":"2026-09-05T22:00:00.000Z"} +{"doc_count":6776,"split_key":50019,"timestamp":"2026-09-05T22:00:00.000Z"} +{"doc_count":1463,"split_key":214961,"timestamp":"2026-09-05T22:00:00.000Z"} +{"doc_count":1277,"split_key":209854,"timestamp":"2026-09-05T22:00:00.000Z"} +{"doc_count":6760,"split_key":50019,"timestamp":"2026-09-05T23:00:00.000Z"} +{"doc_count":6521,"split_key":198401,"timestamp":"2026-09-05T23:00:00.000Z"} +{"doc_count":2583,"split_key":209630,"timestamp":"2026-09-05T23:00:00.000Z"} +{"doc_count":1106,"split_key":209334,"timestamp":"2026-09-05T23:00:00.000Z"} +{"doc_count":969,"split_key":138995,"timestamp":"2026-09-05T23:00:00.000Z"} +{"doc_count":9009,"split_key":14987,"timestamp":"2026-09-06T00:00:00.000Z"} +{"doc_count":6866,"split_key":50019,"timestamp":"2026-09-06T00:00:00.000Z"} +{"doc_count":1753,"split_key":214961,"timestamp":"2026-09-06T00:00:00.000Z"} +{"doc_count":1371,"split_key":209630,"timestamp":"2026-09-06T00:00:00.000Z"} +{"doc_count":970,"split_key":138995,"timestamp":"2026-09-06T00:00:00.000Z"} +{"doc_count":6707,"split_key":50019,"timestamp":"2026-09-06T01:00:00.000Z"} +{"doc_count":2458,"split_key":214961,"timestamp":"2026-09-06T01:00:00.000Z"} +{"doc_count":796,"split_key":16509,"timestamp":"2026-09-06T01:00:00.000Z"} +{"doc_count":639,"split_key":396982,"timestamp":"2026-09-06T01:00:00.000Z"} +{"doc_count":581,"split_key":138995,"timestamp":"2026-09-06T01:00:00.000Z"} +{"doc_count":12799,"split_key":9009,"timestamp":"2026-09-06T02:00:00.000Z"} +{"doc_count":6770,"split_key":50019,"timestamp":"2026-09-06T02:00:00.000Z"} +{"doc_count":3180,"split_key":209630,"timestamp":"2026-09-06T02:00:00.000Z"} +{"doc_count":2468,"split_key":214961,"timestamp":"2026-09-06T02:00:00.000Z"} +{"doc_count":1161,"split_key":274069,"timestamp":"2026-09-06T02:00:00.000Z"} +{"doc_count":2343,"split_key":50019,"timestamp":"2026-09-06T03:00:00.000Z"} +{"doc_count":1463,"split_key":214961,"timestamp":"2026-09-06T03:00:00.000Z"} +{"doc_count":1322,"split_key":396982,"timestamp":"2026-09-06T03:00:00.000Z"} +{"doc_count":716,"split_key":51396,"timestamp":"2026-09-06T03:00:00.000Z"} +{"doc_count":715,"split_key":16509,"timestamp":"2026-09-06T03:00:00.000Z"} +{"doc_count":3485,"split_key":209630,"timestamp":"2026-09-06T04:00:00.000Z"} +{"doc_count":1425,"split_key":209334,"timestamp":"2026-09-06T04:00:00.000Z"} +{"doc_count":1205,"split_key":14061,"timestamp":"2026-09-06T04:00:00.000Z"} +{"doc_count":1171,"split_key":274069,"timestamp":"2026-09-06T04:00:00.000Z"} +{"doc_count":942,"split_key":51396,"timestamp":"2026-09-06T04:00:00.000Z"} +{"doc_count":4682,"split_key":209334,"timestamp":"2026-09-06T05:00:00.000Z"} +{"doc_count":802,"split_key":214961,"timestamp":"2026-09-06T05:00:00.000Z"} +{"doc_count":698,"split_key":209630,"timestamp":"2026-09-06T05:00:00.000Z"} +{"doc_count":584,"split_key":16276,"timestamp":"2026-09-06T05:00:00.000Z"} +{"doc_count":554,"split_key":396982,"timestamp":"2026-09-06T05:00:00.000Z"} +{"doc_count":42938,"split_key":396982,"timestamp":"2026-09-06T06:00:00.000Z"} +{"doc_count":2708,"split_key":209334,"timestamp":"2026-09-06T06:00:00.000Z"} +{"doc_count":990,"split_key":209630,"timestamp":"2026-09-06T06:00:00.000Z"} +{"doc_count":818,"split_key":214961,"timestamp":"2026-09-06T06:00:00.000Z"} +{"doc_count":671,"split_key":37963,"timestamp":"2026-09-06T06:00:00.000Z"} +{"doc_count":15506,"split_key":396982,"timestamp":"2026-09-06T07:00:00.000Z"} +{"doc_count":8329,"split_key":209334,"timestamp":"2026-09-06T07:00:00.000Z"} +{"doc_count":3243,"split_key":209630,"timestamp":"2026-09-06T07:00:00.000Z"} +{"doc_count":1219,"split_key":274069,"timestamp":"2026-09-06T07:00:00.000Z"} +{"doc_count":1069,"split_key":20473,"timestamp":"2026-09-06T07:00:00.000Z"} +{"doc_count":18499,"split_key":396982,"timestamp":"2026-09-06T08:00:00.000Z"} +{"doc_count":4069,"split_key":209334,"timestamp":"2026-09-06T08:00:00.000Z"} +{"doc_count":1200,"split_key":20473,"timestamp":"2026-09-06T08:00:00.000Z"} +{"doc_count":824,"split_key":214961,"timestamp":"2026-09-06T08:00:00.000Z"} +{"doc_count":615,"split_key":209630,"timestamp":"2026-09-06T08:00:00.000Z"} +{"doc_count":17269,"split_key":396982,"timestamp":"2026-09-06T09:00:00.000Z"} +{"doc_count":9285,"split_key":209334,"timestamp":"2026-09-06T09:00:00.000Z"} +{"doc_count":3424,"split_key":209630,"timestamp":"2026-09-06T09:00:00.000Z"} +{"doc_count":1766,"split_key":34984,"timestamp":"2026-09-06T09:00:00.000Z"} +{"doc_count":1755,"split_key":214961,"timestamp":"2026-09-06T09:00:00.000Z"} +{"doc_count":10629,"split_key":34984,"timestamp":"2026-09-06T10:00:00.000Z"} +{"doc_count":9744,"split_key":396982,"timestamp":"2026-09-06T10:00:00.000Z"} +{"doc_count":4026,"split_key":209334,"timestamp":"2026-09-06T10:00:00.000Z"} +{"doc_count":2475,"split_key":214961,"timestamp":"2026-09-06T10:00:00.000Z"} +{"doc_count":1124,"split_key":20473,"timestamp":"2026-09-06T10:00:00.000Z"} +{"doc_count":9407,"split_key":209334,"timestamp":"2026-09-06T11:00:00.000Z"} +{"doc_count":7650,"split_key":396982,"timestamp":"2026-09-06T11:00:00.000Z"} +{"doc_count":6525,"split_key":34984,"timestamp":"2026-09-06T11:00:00.000Z"} +{"doc_count":2080,"split_key":214961,"timestamp":"2026-09-06T11:00:00.000Z"} +{"doc_count":1670,"split_key":209630,"timestamp":"2026-09-06T11:00:00.000Z"} +{"doc_count":11584,"split_key":209334,"timestamp":"2026-09-06T12:00:00.000Z"} +{"doc_count":8597,"split_key":396982,"timestamp":"2026-09-06T12:00:00.000Z"} +{"doc_count":6537,"split_key":34984,"timestamp":"2026-09-06T12:00:00.000Z"} +{"doc_count":2267,"split_key":214762,"timestamp":"2026-09-06T12:00:00.000Z"} +{"doc_count":2251,"split_key":209630,"timestamp":"2026-09-06T12:00:00.000Z"} +{"doc_count":7165,"split_key":396982,"timestamp":"2026-09-06T13:00:00.000Z"} +{"doc_count":5170,"split_key":209334,"timestamp":"2026-09-06T13:00:00.000Z"} +{"doc_count":4105,"split_key":214762,"timestamp":"2026-09-06T13:00:00.000Z"} +{"doc_count":2496,"split_key":136907,"timestamp":"2026-09-06T13:00:00.000Z"} +{"doc_count":2131,"split_key":34984,"timestamp":"2026-09-06T13:00:00.000Z"} +{"doc_count":11426,"split_key":209334,"timestamp":"2026-09-06T14:00:00.000Z"} +{"doc_count":8833,"split_key":396982,"timestamp":"2026-09-06T14:00:00.000Z"} +{"doc_count":3634,"split_key":16509,"timestamp":"2026-09-06T14:00:00.000Z"} +{"doc_count":3529,"split_key":209630,"timestamp":"2026-09-06T14:00:00.000Z"} +{"doc_count":2153,"split_key":214961,"timestamp":"2026-09-06T14:00:00.000Z"} +{"doc_count":7643,"split_key":396982,"timestamp":"2026-09-06T15:00:00.000Z"} +{"doc_count":7466,"split_key":209334,"timestamp":"2026-09-06T15:00:00.000Z"} +{"doc_count":3562,"split_key":16509,"timestamp":"2026-09-06T15:00:00.000Z"} +{"doc_count":2436,"split_key":214961,"timestamp":"2026-09-06T15:00:00.000Z"} +{"doc_count":955,"split_key":51396,"timestamp":"2026-09-06T15:00:00.000Z"} +{"doc_count":21262,"split_key":209334,"timestamp":"2026-09-06T16:00:00.000Z"} +{"doc_count":9623,"split_key":396982,"timestamp":"2026-09-06T16:00:00.000Z"} +{"doc_count":3810,"split_key":16509,"timestamp":"2026-09-06T16:00:00.000Z"} +{"doc_count":2554,"split_key":209630,"timestamp":"2026-09-06T16:00:00.000Z"} +{"doc_count":2226,"split_key":214961,"timestamp":"2026-09-06T16:00:00.000Z"} +{"doc_count":7533,"split_key":396982,"timestamp":"2026-09-06T17:00:00.000Z"} +{"doc_count":6182,"split_key":209334,"timestamp":"2026-09-06T17:00:00.000Z"} +{"doc_count":3837,"split_key":16509,"timestamp":"2026-09-06T17:00:00.000Z"} +{"doc_count":1599,"split_key":15899,"timestamp":"2026-09-06T17:00:00.000Z"} +{"doc_count":1241,"split_key":209630,"timestamp":"2026-09-06T17:00:00.000Z"} +{"doc_count":8254,"split_key":396982,"timestamp":"2026-09-06T18:00:00.000Z"} +{"doc_count":3787,"split_key":16509,"timestamp":"2026-09-06T18:00:00.000Z"} +{"doc_count":3386,"split_key":211301,"timestamp":"2026-09-06T18:00:00.000Z"} +{"doc_count":1068,"split_key":209334,"timestamp":"2026-09-06T18:00:00.000Z"} +{"doc_count":863,"split_key":51396,"timestamp":"2026-09-06T18:00:00.000Z"} +{"doc_count":25172,"split_key":209334,"timestamp":"2026-09-06T19:00:00.000Z"} +{"doc_count":8361,"split_key":396982,"timestamp":"2026-09-06T19:00:00.000Z"} +{"doc_count":6467,"split_key":211301,"timestamp":"2026-09-06T19:00:00.000Z"} +{"doc_count":3623,"split_key":209630,"timestamp":"2026-09-06T19:00:00.000Z"} +{"doc_count":3462,"split_key":16509,"timestamp":"2026-09-06T19:00:00.000Z"} +{"doc_count":17736,"split_key":209334,"timestamp":"2026-09-06T20:00:00.000Z"} +{"doc_count":4594,"split_key":14061,"timestamp":"2026-09-06T20:00:00.000Z"} +{"doc_count":3534,"split_key":396982,"timestamp":"2026-09-06T20:00:00.000Z"} +{"doc_count":1737,"split_key":16276,"timestamp":"2026-09-06T20:00:00.000Z"} +{"doc_count":1242,"split_key":211301,"timestamp":"2026-09-06T20:00:00.000Z"} +{"doc_count":17133,"split_key":14061,"timestamp":"2026-09-06T21:00:00.000Z"} +{"doc_count":12561,"split_key":209334,"timestamp":"2026-09-06T21:00:00.000Z"} +{"doc_count":3587,"split_key":209630,"timestamp":"2026-09-06T21:00:00.000Z"} +{"doc_count":1568,"split_key":274069,"timestamp":"2026-09-06T21:00:00.000Z"} +{"doc_count":946,"split_key":16509,"timestamp":"2026-09-06T21:00:00.000Z"} +{"doc_count":37985,"split_key":14061,"timestamp":"2026-09-06T22:00:00.000Z"} +{"doc_count":13740,"split_key":209334,"timestamp":"2026-09-06T22:00:00.000Z"} +{"doc_count":1172,"split_key":47516,"timestamp":"2026-09-06T22:00:00.000Z"} +{"doc_count":922,"split_key":209854,"timestamp":"2026-09-06T22:00:00.000Z"} +{"doc_count":774,"split_key":4907,"timestamp":"2026-09-06T22:00:00.000Z"} +{"doc_count":30930,"split_key":14061,"timestamp":"2026-09-06T23:00:00.000Z"} +{"doc_count":2672,"split_key":47516,"timestamp":"2026-09-06T23:00:00.000Z"} +{"doc_count":2264,"split_key":209334,"timestamp":"2026-09-06T23:00:00.000Z"} +{"doc_count":1773,"split_key":209630,"timestamp":"2026-09-06T23:00:00.000Z"} +{"doc_count":1486,"split_key":209854,"timestamp":"2026-09-06T23:00:00.000Z"} -- cgit v1.2.3