Honeypot DDoS Target Events Report

Fields

• timestamp
  Timestamp when the destination IP was seen in UTC+0
• protocol
  Packet type of the connection traffic (UDP/TCP)
• dst_ip
  Destination IP (being attacked by a DDoS)
• dst_port
  Destination port (being attacked by a DDoS)
• dst_asn
  ASN of the destination IP
• dst_geo
  Country of the destination IP
• dst_region
  Region of the destination IP
• dst_city
  City of the destination IP
• dst_hostname
  Reverse DNS of the destination IP
• dst_naics
  North American Industry Classification System Code
• dst_sector
  Sector to which the destination IP in question belongs; e.g. Communications, Commercial
• device_vendor
  Destination device vendor
• device_type
  Destination device type
• device_model
  Destination device model
• src_ip
  Source IP (IP acting as C2, ie. issuing commands)
• src_port
  Source port of attack commands
• src_asn
  ASN of the source IP
• src_geo
  Country of the source IP
• src_region
  Region of the source IP
• src_city
  City of the source IP
• src_hostname
  Reverse DNS of the source IP
• src_naics
  North American Industry Classification System Code
• src_sector
  Sector to which the destination IP in question belongs; e.g. Communications, Commercial
• public_source
  Source of the event data
• infection
  Description of the malware/infection
• family
  Malware family or campaign associated with the event
• tag
  Event attributes
• application
  Application name associated with the event
• version
  Software version associated with the event
• event_id
  Unique identifier assigned to the source IP or event
• dst_network
  Network CIDR being attacked
• dst_netmask
  Mask of the destination network under attack
• attack
  Attack type (command issued)
• duration
  Attack duration
• attack_src_ip
  Spoofed attack source IP (if set)
• attack_src_port
  Spoofed attack source port (if set)
• domain
  Domain to attack (in attack command)
• domain_transaction_id
  Domain transaction id, default is random (internal bot nomenclature)
• gcip
  May be used to set internal IP to destination ip, default is 0 (no)
• http_method
  HTTP method name used for the attack, default is GET
• http_path
  HTTP path used for the observed attack, default is /
• http_postdata
  POST data if any being used in the attack, default is empty/none
• http_usessl
  Is SSL used in HTTP floods
• ip_header_ack
  Set the ACK bit in IP header, default is 0 (no) except for ACK flood"
• ip_header_acknum
  Ack number value in TCP header, default is random
• ip_header_dont_fragment
  Set the Dont-Fragment bit in IP header, default is 0 (no)
• ip_header_fin
  Set the FIN bit in IP header, default is 0 (no)
• ip_header_identity
  ID field value in IP header, default is random
• ip_header_psh
  Set the PSH bit in IP header, default is 0 (no)
• ip_header_rst
  Set the RST bit in IP header, default is 0 (no)
• ip_header_seqnum
  Sequence number value in TCP header, default is random
• ip_header_syn
  Set the ACK bit in IP header, default is 0 (no) except for SYN flood
• ip_header_tos
  TOS field value in IP header, default is 0
• ip_header_ttl
  TTL field in IP header, default is 255
• ip_header_urg
  Set the URG bit in IP header, default is 0 (no)
• number_of_connections
  Number of connections
• packet_length
  Size of packet data, default is 512 bytes
• packet_randomized
  Randomize packet data content, default is 1 (yes)