{"ip":"134.209.219.161","total_events":347,"verdict":{"verdict":"malicious","label":"Exploit attempts observed","detail":"1 exploit-path hits","confidence":"high","network_type":"CDN","why":["1 request(s) matched a known exploit path.","Body-carrying methods (POST/PUT/PATCH/DELETE) seen: payload delivery, not just recon.","Under 5 hits, so confidence is medium.","Not in any known-scanner range.","Sent 56,413 bytes: sustained payload delivery, not a single opportunistic request."],"engagement":{"level":"payload","label":"Sustained payload","detail":"56,413 bytes sent","bytes_sent":56413,"session_seconds":1,"persistent":false}},"first_seen":"2026-08-09T18:05:32","last_seen":"2026-08-12T06:00:29","events_24h":0,"events_7d":347,"geo":{"country_code":"US","country_name":"United States","region":"New Jersey","city":"North Bergen","lat":40.7964,"lon":-74.0203,"asn":14061,"org":"DigitalOcean, LLC"},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as14061","label":"DigitalOcean","category":"cdn","url":"https://www.peeringdb.com/asn/14061"},"cve_matches":[{"cve_id":"CVE-2026-27771","title":"Gitea Container Registry - Unauthorized Private Image Access","severity":"high","actively_exploited":false,"match_field":"url_path","matched_pattern":"/v2/_catalog"}],"malware":[],"top_ports":[{"port":1883,"proto":"tcp","label":"MQTT","count":20},{"port":5984,"proto":"tcp","label":"CouchDB","count":18},{"port":1433,"proto":"tcp","label":"MSSQL","count":17},{"port":11211,"proto":"tcp","label":"Memcached","count":16},{"port":9200,"proto":"tcp","label":"Elastic","count":14},{"port":1434,"proto":"tcp","label":"MSSQL","count":14},{"port":27019,"proto":"tcp","label":"","count":14},{"port":9300,"proto":"tcp","label":"Elastic-tr","count":13},{"port":9202,"proto":"tcp","label":"","count":13},{"port":3306,"proto":"tcp","label":"MySQL","count":13},{"port":15671,"proto":"tcp","label":"","count":13},{"port":9301,"proto":"tcp","label":"","count":12},{"port":27018,"proto":"tcp","label":"MongoDB","count":12},{"port":9201,"proto":"tcp","label":"","count":12},{"port":8983,"proto":"tcp","label":"Solr","count":12}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i190900_9dc949149365_e7c285222651"],"tls_ja3":["d6828e30ab66774a91a96ae93be4ae4c"],"ja4h":["ge11nn0300_86b6b04cb9cc","ge11nn0400_88d30a62b7ad","po11nn0600_3f2c5e85e3a2","ge11nn0300_0db47b7d240d"]},"fingerprint_peers":{"t13i190900_9dc949149365_e7c285222651":3310,"ge11nn0300_0db47b7d240d":5542,"po11nn0600_3f2c5e85e3a2":129,"ge11nn0300_86b6b04cb9cc":5633,"ge11nn0400_88d30a62b7ad":4813},"user_agents":["Go-http-client/1.1","Mozilla/5.0 (compatible; Odin; https://docs.getodin.com/)"],"timeline":[{"date":"2026-08-09","count":47},{"date":"2026-08-10","count":147},{"date":"2026-08-11","count":125},{"date":"2026-08-12","count":28}],"recent_events":[{"timestamp":"2026-08-12T06:00:29","port":2181,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"host\":\"<HONEYPOT>:2181\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/cgi-bin/authLogin.cgi","summary":"","payload_hex":"474554202f6367692d62696e2f617574684c6f67696e2e63676920485454502f312e310d0a486f73743a20<HONEYPOT>3a323138310d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"","session":"154499c3-c7e2-49b0-bdba-8c5d5d5cadc1","seq":1,"duration_ms":101,"bytes_in":116,"bytes_out":80},{"timestamp":"2026-08-12T06:00:29","port":2181,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"host\":\"<HONEYPOT>:2181\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/v2/_catalog","summary":"","payload_hex":"474554202f76322f5f636174616c6f6720485454502f312e310d0a486f73743a20<HONEYPOT>3a323138310d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"","session":"b514eecb-5a11-4a0a-8825-075faed4c9bd","seq":1,"duration_ms":100,"bytes_in":106,"bytes_out":80},{"timestamp":"2026-08-12T03:40:35","port":29092,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"host\":\"<HONEYPOT>:29092\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/v2/_catalog","summary":"","payload_hex":"474554202f76322f5f636174616c6f6720485454502f312e310d0a486f73743a20<HONEYPOT>3a32393039320d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"","session":"bf7e7ed4-827c-4e0f-808d-b4ee96460cdc","seq":1,"duration_ms":101,"bytes_in":107,"bytes_out":80},{"timestamp":"2026-08-12T03:40:35","port":29092,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"host\":\"<HONEYPOT>:29092\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/cgi-bin/authLogin.cgi","summary":"","payload_hex":"474554202f6367692d62696e2f617574684c6f67696e2e63676920485454502f312e310d0a486f73743a20<HONEYPOT>3a32393039320d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"","session":"a959a572-56e7-48e8-b937-f5704edd8f9b","seq":1,"duration_ms":100,"bytes_in":117,"bytes_out":80},{"timestamp":"2026-08-12T03:13:27","port":1434,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:1434\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a313433340d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"d6828e30ab66774a91a96ae93be4ae4c","session":"b05374bc-acb1-420d-bc30-f2ea9c7e6ab1","seq":1,"duration_ms":100,"bytes_in":99,"bytes_out":80},{"timestamp":"2026-08-12T03:13:26","port":1434,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:1434\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a313433340d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"","session":"227bd87b-1132-4872-afc6-7c02be19cf4c","seq":1,"duration_ms":100,"bytes_in":99,"bytes_out":80},{"timestamp":"2026-08-12T03:13:26","port":1434,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"host\":\"<HONEYPOT>:1434\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/cgi-bin/authLogin.cgi","summary":"","payload_hex":"474554202f6367692d62696e2f617574684c6f67696e2e63676920485454502f312e310d0a486f73743a20<HONEYPOT>3a313433340d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"","session":"85ed05e0-b70c-4647-b4ba-d58cbdde9d48","seq":1,"duration_ms":100,"bytes_in":116,"bytes_out":80},{"timestamp":"2026-08-12T03:13:26","port":1434,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"host\":\"<HONEYPOT>:1434\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/v2/_catalog","summary":"","payload_hex":"474554202f76322f5f636174616c6f6720485454502f312e310d0a486f73743a20<HONEYPOT>3a313433340d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"","session":"85965010-240b-4163-85a8-07f353cd588b","seq":1,"duration_ms":100,"bytes_in":106,"bytes_out":80},{"timestamp":"2026-08-12T03:01:14","port":15671,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:15671\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a31353637310d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"d6828e30ab66774a91a96ae93be4ae4c","session":"d666930e-9e6a-4399-be09-51ba20357e6b","seq":1,"duration_ms":100,"bytes_in":100,"bytes_out":80},{"timestamp":"2026-08-12T03:01:14","port":15671,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:15671\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a31353637310d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"","session":"ab47c625-1f3f-4f0d-8ff5-e8a8d57c5532","seq":1,"duration_ms":100,"bytes_in":100,"bytes_out":80}],"http_methods":[{"method":"GET","count":298},{"method":"POST","count":34}],"distinct_ports_total":28,"top_paths":[{"path":"/","count":154,"ports":28},{"path":"/v2/_catalog","count":41,"ports":27},{"path":"/cgi-bin/authLogin.cgi","count":41,"ports":27},{"path":"/query?q=SHOW+DIAGNOSTICS","count":34,"ports":20},{"path":"/solr/admin/info/system","count":29,"ports":21},{"path":"/solr/admin/cores?action=STATUS&wt=json","count":29,"ports":21},{"path":"/?pretty","count":1,"ports":1},{"path":"/_all_dbs","count":1,"ports":1},{"path":"/_cluster/health?pretty","count":1,"ports":1},{"path":"/_cat/indices?format=json","count":1,"ports":1}],"distinct_paths_total":10,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Connection","Host","User-Agent"],"representative":[{"name":"Connection","value":"close","notable":false},{"name":"Host","value":"<HONEYPOT>:2181","notable":false},{"name":"User-Agent","value":"Go-http-client/1.1","notable":false}],"distinct_sets":2,"events_with_headers":10},"tags":[{"tag_id":"CVE-2026-27771","tag_type":"cve","title":"Gitea Container Registry - Unauthorized Private Image Access","severity":"high","actively_exploited":false,"match_field":"url_path","matched_pattern":"/v2/_catalog","reference_urls":["https://blog.gitea.com/release-of-1.26.2/","https://github.com/go-gitea/gitea/pull/37290","https://github.com/go-gitea/gitea/pull/37610","https://orca.security/resources/blog/gitea-container-registry-vulnerability/"]}],"data_as_of":"2026-08-15T09:47:41.037658+00:00"}