{"@timestamp":1788165167720,"_id":"260831-2UWEhbn4ipBNDIp0rokxW5kW","_index":"arkime_sessions3-260831","client":{"bytes":1470},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo GmbH"],"isp.dstCnt":1,"isp.src":["RouterHosting LLC"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["FranTech Solutions"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS51167 Contabo GmbH","number":51167,"organization":{"name":"Contabo GmbH"}},"bytes":345,"geo":{"country_iso_code":"FR"},"ip":"109.123.246.142","mac":["00:50:56:63:46:a6"],"mac-cnt":1,"packets":5,"port":443},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstPayload8":"15030300020250","dstRIR":"RIPE","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[82376],"firstPacket":1788164739362,"initRTT":8,"ipProtocol":6,"lastPacket":1788164739790,"length":428,"network":{"bytes":2219,"community_id":"1:MLH0NrhNlP4HF8fdMvPCn6gEhTI=","packets":11},"node":"spark-afae","packetPos":[-82376,246570,90,0,82,1552,82,89,82,0,0,0],"packetRange":{"gte":1788164739362,"lte":1788164739790},"protocol":["tls","tcp"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":7},"source":{"as":{"full":"AS14956 RouterHosting LLC","number":14956,"organization":{"name":"RouterHosting LLC"}},"bytes":1874,"geo":{"country_iso_code":"NL"},"ip":"107.189.26.103","mac":["00:c0:1d:c0:ff:ee","c0:69:11:cd:1f:19"],"mac-cnt":2,"packets":6,"port":33844},"srcOui":["Grand Junction Networks, Inc.","Arista Networks"],"srcOuiCnt":2,"srcPayload8":"16030105b9010005","srcRIR":"ARIN","srcTTL":[52],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["993561155603323"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["ac32bdeb-b49d-4079-9e6b-8fbca5e0addf"],"signatureCnt":1,"signatureId":[1031336],"signatureIdCnt":1},"tag":{"block":["false"],"blockCnt":1,"category":["protocol"],"categoryCnt":1,"description":["ip addresses with this tag have been observed attempting to opportunistically crawl the internet and establish tls/ssl connections."],"intention":["unknown"],"intentionCnt":1,"name":["tls/ssl crawler"],"nameCnt":1},"tags":["proxy","sensor:contabo-sponge-02-ts","contabo-sponge-02-ts"],"tagsCnt":3,"tcp":{"ja4ls":"118_64_521","ja4t":["29200_2-4-8-1-3_1460_7"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":5,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":2,"psh":2,"rst":0,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":1728756003},"tls":{"ja3":["052a5e65c3a64e860e1706b1de3c46a9"],"ja3Cnt":1,"ja3string":["771,4865-4866-4867-49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53,23-65281-10-11-35-13-51-45-43,4588-29-23-24,0"],"ja3stringCnt":1,"ja4":["t13i170900_5b57614c22b0_78e6aca7449b"],"ja4Cnt":1,"ja4_r":["t13i170900_002f,0035,009c,009d,1301,1302,1303,c009,c00a,c013,c014,c02b,c02c,c02f,c030,cca8,cca9_000a,000b,000d,0017,0023,002b,002d,0033,ff01_0403,0804,0401,0503,0805,0501,0806,0601,0201"],"ja4_rCnt":1,"srcSessionId":["1347b6b9644d0f463618be6f76729167fd318995bbdd6ff4c6f292c6cf92a3a8"]},"totDataBytes":1477}
{"@timestamp":1788165167720,"_id":"260831-2UXxDDh1j1VIFokYf7LV4RlC","_index":"arkime_sessions3-260831","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Contabo GmbH"],"isp.dstCnt":1,"isp.src":["RouterHosting LLC"],"isp.srcCnt":1,"org.dst":["Contabo GmbH"],"org.dstCnt":1,"org.src":["FranTech Solutions"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS51167 Contabo GmbH","number":51167,"organization":{"name":"Contabo GmbH"}},"bytes":58,"geo":{"country_iso_code":"FR"},"ip":"109.123.246.142","mac":["00:50:56:63:46:a6"],"mac-cnt":1,"packets":1,"port":443},"dstOui":["VMware, Inc."],"dstOuiCnt":1,"dstRIR":"RIPE","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[82376],"firstPacket":1788164738834,"ipProtocol":6,"lastPacket":1788164738848,"length":14,"network":{"bytes":238,"community_id":"1:3dlKYEQbkXcmFg7bP98cJXO9+iY=","packets":4},"node":"spark-afae","packetPos":[-82376,245872,76,224,76],"packetRange":{"gte":1788164738834,"lte":1788164738848},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS14956 RouterHosting LLC","number":14956,"organization":{"name":"RouterHosting LLC"}},"bytes":180,"geo":{"country_iso_code":"NL"},"ip":"107.189.26.103","mac":["00:c0:1d:c0:ff:ee","c0:69:11:cd:1f:19"],"mac-cnt":2,"packets":3,"port":52068},"srcOui":["Grand Junction Networks, Inc.","Arista Networks"],"srcOuiCnt":2,"srcRIR":"ARIN","srcTTL":[55],"srcTTLCnt":1,"tags":["proxy","sensor:contabo-sponge-02-ts","contabo-sponge-02-ts"],"tagsCnt":3,"tcp":{"ja4t":["65535_00_00_00"],"ja4tCnt":1,"ja4ts":["64240_2_1460_00"],"ja4tsCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":2,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":1836893100},"totDataBytes":0}
{"@timestamp":1787207209953,"_id":"260820-bL-X-ZPifu1Lt5UBQ07QMww0","_index":"arkime_sessions3-260820","client":{"bytes":1720},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Kaopu Cloud HK Limited"],"isp.dstCnt":1,"isp.src":["RouterHosting LLC"],"isp.srcCnt":1,"org.dst":["LightNode-BH"],"org.dstCnt":1,"org.src":["FranTech Solutions"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":2102,"geo":{"country_iso_code":"BH"},"ip":"38.54.2.209","mac":["52:54:8f:9d:76:48"],"mac-cnt":1,"packets":12,"port":22},"dstPayload8":"5353482d322e302d","dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[76731],"firstPacket":1787206691213,"initRTT":95,"ipProtocol":6,"lastPacket":1787206697080,"length":5867,"network":{"bytes":4820,"community_id":"1:uunVFxOJKG+Gf67JzmfpfijL7Dg=","packets":27},"node":"spark-afae","packetPos":[-76731,1746072,90,600,16601,106,2398,124,1406,82,2578,1642,82,274,98,1292,82,0,2984,142,1010,1438,820,21125,870,1270,82,514],"packetRange":{"gte":1787206691213,"lte":1787206697080},"protocol":["ssh","tcp"],"protocolCnt":2,"segmentCnt":1,"server":{"bytes":1302},"source":{"as":{"full":"AS14956 RouterHosting LLC","number":14956,"organization":{"name":"RouterHosting LLC"}},"bytes":2718,"geo":{"country_iso_code":"NL"},"ip":"107.189.26.103","mac":["98:44:ce:60:15:19"],"mac-cnt":1,"packets":15,"port":42346},"srcOui":["Huawei Technologies Co.,Ltd"],"srcOuiCnt":1,"srcPayload8":"5353482d322e302d","srcRIR":"ARIN","srcTTL":[52],"srcTTLCnt":1,"ssh":{"hassh":["19532158b559096b89b1a5f7d17175b2"],"hasshCnt":1,"hasshServer":["41a85c886a9e9b845f0e69d68994492a"],"hasshServerCnt":1,"ja4ssh":["c24s16_c4s7_c9s3"],"ja4sshCnt":1,"version":["ssh-2.0-libssh2_1.11.1","ssh-2.0-openssh_9.6p1 ubuntu-3ubuntu13.5"],"versionCnt":2},"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["917695486512582"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["GPL ATTACK SSH Connection Attempt","537cee16-c4a9-45cd-baf1-75963ab7bdd2"],"signatureCnt":2,"signatureId":[1080086,1000010],"signatureIdCnt":2},"tag":{"block":["true"],"blockCnt":1,"category":["activity"],"categoryCnt":1,"description":["ip addresses with this tag have been observed attempting to negotiate an ssh session."],"intention":["suspicious"],"intentionCnt":1,"name":["ssh connection attempt"],"nameCnt":1},"tags":["sensor:bahrain-sponge-01-ts","bahrain-sponge-01-ts","honeypot"],"tagsCnt":3,"tcp":{"ja4l":"95121_52_435900","ja4ls":"35_64_166662","ja4t":["29200_2-4-8-1-3_1460_7"],"ja4tCnt":1,"ja4ts":["65160_2-4-8-1-3_1460_7"],"ja4tsCnt":1},"tcpflags":{"ack":12,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":2,"psh":11,"rst":0,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":1961525166},"totDataBytes":3022}
{"@timestamp":1787207209941,"_id":"260820-bL8X2PKBT6hCmoaS3guIm_W9","_index":"arkime_sessions3-260820","client":{"bytes":0},"dbip":{"conntype.dst":["Corporate"],"conntype.dstCnt":1,"conntype.src":["Corporate"],"conntype.srcCnt":1,"isp.dst":["Kaopu Cloud HK Limited"],"isp.dstCnt":1,"isp.src":["RouterHosting LLC"],"isp.srcCnt":1,"org.dst":["LightNode-BH"],"org.dstCnt":1,"org.src":["FranTech Solutions"],"org.srcCnt":1,"usertype.dst":["hosting"],"usertype.dstCnt":1,"usertype.src":["hosting"],"usertype.srcCnt":1},"destination":{"as":{"full":"AS138915 Kaopu Cloud HK Limited","number":138915,"organization":{"name":"Kaopu Cloud HK Limited"}},"bytes":58,"geo":{"country_iso_code":"BH"},"ip":"38.54.2.209","mac":["52:54:8f:9d:76:48"],"mac-cnt":1,"packets":1,"port":22},"dstRIR":"ARIN","dstTTL":[64],"dstTTLCnt":1,"ethertype":2048,"fileId":[76731],"firstPacket":1787206690084,"ipProtocol":6,"lastPacket":1787206690276,"length":192,"network":{"bytes":220,"community_id":"1:1C5BaSTrFYodU8odrR+6zMIS2Qw=","packets":4},"node":"spark-afae","packetPos":[-76731,1740152,70,1282,70],"packetRange":{"gte":1787206690084,"lte":1787206690276},"protocol":["tcp"],"protocolCnt":1,"segmentCnt":1,"server":{"bytes":0},"source":{"as":{"full":"AS14956 RouterHosting LLC","number":14956,"organization":{"name":"RouterHosting LLC"}},"bytes":162,"geo":{"country_iso_code":"NL"},"ip":"107.189.26.103","mac":["98:44:ce:60:15:19"],"mac-cnt":1,"packets":3,"port":50849},"srcDscp":[40],"srcDscpCnt":1,"srcOui":["Huawei Technologies Co.,Ltd"],"srcOuiCnt":1,"srcRIR":"ARIN","srcTTL":[52],"srcTTLCnt":1,"suricata":{"action":["allowed"],"actionCnt":1,"category":[""],"categoryCnt":1,"flowId":["645682251986147"],"flowIdCnt":1,"gid":[1],"gidCnt":1,"severity":[3],"severityCnt":1,"signature":["GPL ATTACK SSH Connection Attempt"],"signatureCnt":1,"signatureId":[1000010],"signatureIdCnt":1},"tags":["sensor:bahrain-sponge-01-ts","bahrain-sponge-01-ts","honeypot"],"tagsCnt":3,"tcp":{"ja4t":["65535_00_00_00"],"ja4tCnt":1,"ja4ts":["64240_2_1460_00"],"ja4tsCnt":1},"tcpflags":{"ack":0,"ae":0,"cwr":0,"dstZero":0,"ece":0,"fin":0,"psh":0,"rst":2,"srcZero":0,"syn":1,"syn-ack":1,"urg":0},"tcpseq":{"dst":0,"src":641124744},"totDataBytes":0}