{"ip":"104.248.251.244","total_events":46,"verdict":{"verdict":"malicious","label":"Exploit attempts observed","detail":"1 exploit-path hits","confidence":"medium","network_type":"CDN","why":["1 request(s) matched a known exploit path.","Body-carrying methods (POST/PUT/PATCH/DELETE) seen: payload delivery, not just recon.","Under 5 hits, so confidence is medium.","Not in any known-scanner range."]},"first_seen":"2026-07-14T12:51:27","last_seen":"2026-07-17T16:17:47","events_24h":0,"events_7d":12,"geo":{"country_code":"DE","country_name":"Germany","region":"Hesse","city":"Frankfurt am Main","lat":50.1169,"lon":8.6837,"asn":14061,"org":"DigitalOcean, LLC"},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as14061","label":"DigitalOcean","category":"cdn","url":"https://www.peeringdb.com/asn/14061"},"cve_matches":[],"malware":[],"top_ports":[{"port":8086,"proto":"tcp","label":"InfluxDB","count":5},{"port":20000,"proto":"tcp","label":"","count":4},{"port":10250,"proto":"tcp","label":"","count":3},{"port":9042,"proto":"tcp","label":"Cassandra","count":3},{"port":5060,"proto":"tcp","label":"SIP","count":3},{"port":80,"proto":"tcp","label":"HTTP","count":3},{"port":8500,"proto":"tcp","label":"","count":3},{"port":1234,"proto":"tcp","label":"","count":3},{"port":2525,"proto":"tcp","label":"","count":2},{"port":18789,"proto":"tcp","label":"","count":2},{"port":11434,"proto":"tcp","label":"","count":2},{"port":8080,"proto":"tcp","label":"HTTP-alt","count":2},{"port":8000,"proto":"tcp","label":"HTTP-alt","count":2},{"port":22,"proto":"tcp","label":"SSH","count":2},{"port":631,"proto":"tcp","label":"IPP","count":2}],"fingerprints":{"ssh_hassh":["2aec6b44b06bec95d73f66b5d30cb69a"],"tls_ja4":["t13i191000_9dc949149365_e5728521abd4"],"tls_ja3":["96458b3de39df5d47bc5c4a9f10f8f26"],"ja4h":["ge11nn0400_88d30a62b7ad","ge11nn0300_86b6b04cb9cc","po11nn0600_3f2c5e85e3a2","ge11nn0300_0db47b7d240d"]},"fingerprint_peers":{"t13i191000_9dc949149365_e5728521abd4":131,"ge11nn0300_0db47b7d240d":4516,"po11nn0600_3f2c5e85e3a2":87,"ge11nn0300_86b6b04cb9cc":6982,"ge11nn0400_88d30a62b7ad":5806,"2aec6b44b06bec95d73f66b5d30cb69a":12},"user_agents":["Go-http-client/1.1","Mozilla/5.0 (compatible; Odin; https://docs.getodin.com/)"],"timeline":[{"date":"2026-07-14","count":8},{"date":"2026-07-15","count":14},{"date":"2026-07-16","count":15},{"date":"2026-07-17","count":9}],"recent_events":[{"timestamp":"2026-07-17T16:17:47","port":1234,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:1234\",\"user-agent\":\"Mozilla/5.0 (compatible; Odin; https://docs.getodin.com/)\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a313233340d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b204f64696e3b2068747470733a2f2f646f63732e6765746f64696e2e636f6d2f290d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; Odin; https://docs.getodin.com/)","community_id":"1:46SJSfaCB0pL1QyrrpV+/kdVoCA=","ja3":"","session":"01f4ef44-b8b2-4a81-a02e-16fa24f67462","seq":1,"duration_ms":100,"bytes_in":152,"bytes_out":80},{"timestamp":"2026-07-17T15:23:18","port":9042,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"host\":\"<HONEYPOT>:9042\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/query?q=SHOW+DIAGNOSTICS","summary":"","payload_hex":"474554202f71756572793f713d53484f572b444941474e4f535449435320485454502f312e310d0a486f73743a20<HONEYPOT>3a393034320d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","community_id":"1:cZq6q6GS5u/SN0nGBHNu2bUDNYs=","ja3":"","session":"99fcb716-c101-43ea-bf41-45b9bfd1304b","seq":1,"duration_ms":100,"bytes_in":120,"bytes_out":80},{"timestamp":"2026-07-17T14:49:56","port":9042,"proto":"tcp","app_proto":"","app_protocol":"cassandra","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0004\u0000\u0000\u0001\u0005\u0000\u0000\u0000\u0000","payload_hex":"040000010500000000","method":"","user_agent":"","community_id":"1:4h5ds/pQkARajlWIWKIhcp2Un4E=","ja3":"","session":"884468a2-595f-425d-8b60-eac36db2abca","seq":1,"duration_ms":100,"bytes_in":9,"bytes_out":15},{"timestamp":"2026-07-17T13:42:00","port":11434,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:11434\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a31313433340d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","community_id":"1:VrS9z6vZgvwjm6pi849ZZwQ1UI8=","ja3":"96458b3de39df5d47bc5c4a9f10f8f26","session":"e9554e7c-7e55-424f-bca9-a1e5daf39ec0","seq":1,"duration_ms":100,"bytes_in":101,"bytes_out":80},{"timestamp":"2026-07-17T13:42:00","port":11434,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:11434\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a31313433340d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","community_id":"1:laG8jWe4u7OtqkyD7JO4KL0Y3+k=","ja3":"","session":"edb01284-7ed5-45d3-9265-595bd846144c","seq":1,"duration_ms":100,"bytes_in":101,"bytes_out":80},{"timestamp":"2026-07-17T13:04:47","port":8086,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:8086\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a383038360d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","community_id":"1:bOY71Se0UAyX4+u6US44/WQZJpc=","ja3":"96458b3de39df5d47bc5c4a9f10f8f26","session":"b8eaaee1-f9e5-433f-8d55-a97a0ddf880e","seq":1,"duration_ms":100,"bytes_in":98,"bytes_out":80},{"timestamp":"2026-07-17T13:04:46","port":8086,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:8086\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a383038360d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","community_id":"1:D76L0XJGp9B9/ahA0eF3DnRFjBs=","ja3":"","session":"483b227d-f565-41ee-8ff9-2031fd55bc00","seq":1,"duration_ms":101,"bytes_in":98,"bytes_out":80},{"timestamp":"2026-07-17T03:32:45","port":22,"proto":"tcp","app_proto":"","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"SSH-2.0-Go\r\n\u0000\u0000\u0002�\n\u0014�[�p\u0012q�\u0015�𱂸k9�\u0000\u0000\u0000�curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1\u0000\u0000\u0001-ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa,ssh-dss,ssh-ed25519\u0000\u0000\u0000Maes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,arcfour256,arcfour128\u0000\u0000\u0000Maes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,arcfour256,arcfour128\u0000\u0000\u0000$hmac-sha2-256,hmac-sha1,hmac-sha1-96\u0000\u0000\u0000$hmac-sha2-256,hmac-sha1,hmac-sha1-96\u0000\u0000\u0000\u0004none\u0000\u0000\u0000\u0004none\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000)6�\u001c2�\t�\u0013�","payload_hex":"5353482d322e302d476f0d0a000002ec0a14a85bd9701271a815a7f0b182b86b39c20000008c637572766532353531392d736861323536406c69627373682e6f72672c656364682d736861322d6e697374703235362c656364682d736861322d6e697374703338342c656364682d736861322d6e697374703532312c6469666669652d68656c6c6d616e2d67726f757031342d736861312c6469666669652d68656c6c6d616e2d67726f7570312d736861310000012d7373682d7273612d636572742d763031406f70656e7373682e636f6d2c7373682d6473732d636572742d763031406f70656e7373682e636f6d2c65636473612d736861322d6e697374703235362d636572742d763031406f70656e7373682e636f6d2c65636473612d736861322d6e697374703338342d636572742d763031406f70656e7373682e636f6d2c65636473612d736861322d6e697374703532312d636572742d763031406f70656e7373682e636f6d2c7373682d656432353531392d636572742d763031406f70656e7373682e636f6d2c65636473612d736861322d6e697374703235362c65636473612d736861322d6e697374703338342c65636473612d736861322d6e697374703532312c7373682d7273612c7373682d6473732c7373682d656432353531390000004d6165733132382d6374722c6165733139322d6374722c6165733235362d6374722c6165733132382d67636d406f70656e7373682e636f6d2c617263666f75723235362c617263666f75723132380000004d6165733132382d6374722c6165733139322d6374722c6165733235362d6374722c6165733132382d67636d406f70656e7373682e636f6d2c617263666f75723235362c617263666f757231323800000024686d61632d736861322d3235362c686d61632d736861312c686d61632d736861312d393600000024686d61632d736861322d3235362c686d61632d736861312c686d61632d736861312d3936000000046e6f6e65000000046e6f6e65000000000000000000000000002936a41c32df09f21380","method":"","user_agent":"","community_id":"1:S4cW9PTJMa8FL0PkAEU8INoHgt8=","ja3":"","session":"ef437326-56a2-4792-b97d-2e100e540e2a","seq":1,"duration_ms":201,"bytes_in":764,"bytes_out":15,"enriched":{"digest":"7b48835cb3ca7f02","label":"SSH","strings":["SSH-2.0-Go","curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nis…","-ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ecdsa-sha2-nistp256-c…","Maes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,arcfour256,arcfour128","$hmac-sha2-256,hmac-sha1,hmac-sha1-96","none","none)6"],"iocs":{"domains":["libssh.org","openssh.com"]}}},{"timestamp":"2026-07-17T03:32:45","port":22,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"host\":\"<HONEYPOT>:22\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/v2/_catalog","summary":"","payload_hex":"474554202f76322f5f636174616c6f6720485454502f312e310d0a486f73743a20<HONEYPOT>3a32320d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","community_id":"1:LOU+MiijOjciGszCV6T4wxhyWdM=","ja3":"","session":"5e619e9d-9fd1-43bc-b143-d4db2481a067","seq":1,"duration_ms":101,"bytes_in":103,"bytes_out":80},{"timestamp":"2026-07-16T21:40:10","port":8080,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"host\":\"<HONEYPOT>:8080\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/query?q=SHOW+DIAGNOSTICS","summary":"","payload_hex":"474554202f71756572793f713d53484f572b444941474e4f535449435320485454502f312e310d0a486f73743a20<HONEYPOT>3a383038300d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","community_id":"1:RzoYx2F9o6CnbQLunI4anMeUF+g=","ja3":"","session":"66524177-ac86-4f9d-9749-26ff82cd8e8f","seq":1,"duration_ms":101,"bytes_in":120,"bytes_out":80}],"http_methods":[{"method":"GET","count":38},{"method":"POST","count":5}],"distinct_ports_total":20,"top_paths":[{"path":"/","count":24,"ports":13},{"path":"/v2/_catalog","count":5,"ports":5},{"path":"/solr/admin/info/system","count":4,"ports":4},{"path":"/cgi-bin/authLogin.cgi","count":4,"ports":4},{"path":"/solr/admin/cores?action=STATUS&wt=json","count":4,"ports":4},{"path":"/query?q=SHOW+DIAGNOSTICS","count":2,"ports":2}],"distinct_paths_total":6,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[{"value":"SSH-2.0-Go","count":1}],"credentials":[],"header_profile":{"signature":["Accept","Accept-Encoding","Host","User-Agent"],"representative":[{"name":"Accept","value":"*/*","notable":false},{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Host","value":"<HONEYPOT>:1234","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (compatible; Odin; https://docs.getodin.com/)","notable":false}],"distinct_sets":3,"events_with_headers":8},"tags":[],"data_as_of":"2026-07-23T19:21:00.758855+00:00"}