{"ip":"157.230.89.113","data_as_of":"2026-10-25T06:53:17+00:00","observed":true,"total_events":373,"verdict":{"verdict":"scanner","label":"Recognized scanner","detail":"odin","confidence":"high","network_type":"CDN","why":["The address is in a published scanner range (odin).","Known research and commercial scanners are labelled by operator and carry no threat verdict."],"engagement":{"level":"payload","label":"Sustained payload","detail":"59,459 bytes sent","bytes_sent":59459,"session_seconds":1,"persistent":false},"basis":"first_contact"},"first_seen":"2026-10-09T07:37:33","last_seen":"2026-10-12T06:18:54","events_24h":0,"events_7d":0,"interactive_sessions":0,"interactive_sessions_24h":0,"interactive_sessions_7d":0,"interactive_protocols":[],"geo":{"country_code":"US","country_name":"United States","region":"New Jersey","city":"North Bergen","lat":40.7964,"lon":-74.0203,"asn":14061,"org":"DigitalOcean, LLC"},"source_domain":null,"known_scanners":["odin"],"scanner_tag":{"key":"peeringdb:as14061","label":"DigitalOcean","category":"cdn","url":"https://www.peeringdb.com/asn/14061"},"cve_matches":[{"cve_id":"CVE-2026-27771","title":"Gitea Container Registry - Unauthorized Private Image Access","severity":"high","actively_exploited":false,"match_field":"url_path","matched_pattern":"/v2/_catalog","kev_date_added":null}],"malware":[],"udp":null,"interaction":null,"top_ports":[{"port":27019,"proto":"tcp","label":"","count":18},{"port":7574,"proto":"tcp","label":"","count":18},{"port":1433,"proto":"tcp","label":"MSSQL","count":16},{"port":5984,"proto":"tcp","label":"CouchDB","count":16},{"port":9300,"proto":"tcp","label":"Elastic-tr","count":16},{"port":5671,"proto":"tcp","label":"","count":16},{"port":8883,"proto":"tcp","label":"","count":16},{"port":9301,"proto":"tcp","label":"","count":14},{"port":29092,"proto":"tcp","label":"","count":14},{"port":8983,"proto":"tcp","label":"Solr","count":14},{"port":1883,"proto":"tcp","label":"MQTT","count":14},{"port":9201,"proto":"tcp","label":"","count":14},{"port":9200,"proto":"tcp","label":"Elastic","count":14},{"port":9093,"proto":"tcp","label":"","count":14},{"port":11211,"proto":"tcp","label":"Memcached","count":13}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i190900_9dc949149365_e7c285222651"],"tls_client_hello":"16030100ee010000ea0303981df8269e7408a8c477b299610d303f2ca37e8d2d3cbce665af7c8f490bd1e920f9e2f958e056e62a969463c05edec616275c7c7274c43f6326d25ce6d69cacc00026c02bc02fc02cc030cca9cca8c009c013c00ac014009c009d002f0035c012000a1301130213030100007b000500050100000000000a000a0008001d001700180019000b00020100000d001a0018080404030807080508060401050106010503060302010203ff010001000017000000120000002b00050403040303003300260024001d002025f4f0e308ef17550847c2c748a38eac56e9cc089a5f98abde066904","tls_ja3":["d6828e30ab66774a91a96ae93be4ae4c"],"http_akin":["b11cun030_00040011_c91eaf54","b11cun030_00040012_13ee3d34","b11cun040_00040016_aa48e2c8","b11cuq060_04050811_ffe60107"],"interactive":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[]}},"fingerprint_peers":{"t13i190900_9dc949149365_e7c285222651":400,"b11cun030_00040011_c91eaf54":963,"b11cun030_00040012_13ee3d34":5387,"b11cun040_00040016_aa48e2c8":5534,"b11cuq060_04050811_ffe60107":149},"akin_families":{"b11cun030_00040011_c91eaf54":{"head":"b11cun030_00040011_c91eaf54","shapes":2,"ips":963}},"user_agents":["Go-http-client/1.1","Mozilla/5.0 (compatible; Odin; https://docs.getodin.com/)"],"timeline":[{"date":"2026-10-09","count":66},{"date":"2026-10-10","count":199},{"date":"2026-10-11","count":102},{"date":"2026-10-12","count":6}],"recent_events":[{"timestamp":"2026-10-12T06:18:54","port":15672,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"host\":\"<HONEYPOT>:15672\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/cgi-bin/authLogin.cgi","summary":"","payload_hex":"474554202f6367692d62696e2f617574684c6f67696e2e63676920485454502f312e310d0a486f73743a20<HONEYPOT>3a31353637320d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"","session":"6e620ddc-fe31-43d4-b0b8-4cc2e796974c","seq":1,"duration_ms":101,"bytes_in":117,"bytes_out":79},{"timestamp":"2026-10-12T06:18:54","port":15672,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"host\":\"<HONEYPOT>:15672\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/solr/admin/info/system","summary":"","payload_hex":"474554202f736f6c722f61646d696e2f696e666f2f73797374656d20485454502f312e310d0a486f73743a20<HONEYPOT>3a31353637320d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"","session":"ac8feb71-f0df-4155-aacb-935092d270ea","seq":1,"duration_ms":102,"bytes_in":118,"bytes_out":79},{"timestamp":"2026-10-12T06:18:54","port":15672,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"host\":\"<HONEYPOT>:15672\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/solr/admin/cores?action=STATUS&wt=json","summary":"","payload_hex":"474554202f736f6c722f61646d696e2f636f7265733f616374696f6e3d5354415455532677743d6a736f6e20485454502f312e310d0a486f73743a20<HONEYPOT>3a31353637320d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"","session":"767c4f02-0d14-4e63-b728-078325f55d58","seq":1,"duration_ms":100,"bytes_in":134,"bytes_out":79},{"timestamp":"2026-10-12T02:12:55","port":29092,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"host\":\"<HONEYPOT>:29092\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/cgi-bin/authLogin.cgi","summary":"","payload_hex":"474554202f6367692d62696e2f617574684c6f67696e2e63676920485454502f312e310d0a486f73743a20<HONEYPOT>3a32393039320d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"","session":"75e113f3-e546-447f-ae4f-dbca5741a12a","seq":1,"duration_ms":101,"bytes_in":116,"bytes_out":79},{"timestamp":"2026-10-12T02:12:55","port":29092,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"host\":\"<HONEYPOT>:29092\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/solr/admin/info/system","summary":"","payload_hex":"474554202f736f6c722f61646d696e2f696e666f2f73797374656d20485454502f312e310d0a486f73743a20<HONEYPOT>3a32393039320d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"","session":"b6d40f84-d46c-465b-9e5c-a05eedf9f35d","seq":1,"duration_ms":102,"bytes_in":117,"bytes_out":79},{"timestamp":"2026-10-12T02:12:55","port":29092,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"host\":\"<HONEYPOT>:29092\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/solr/admin/cores?action=STATUS&wt=json","summary":"","payload_hex":"474554202f736f6c722f61646d696e2f636f7265733f616374696f6e3d5354415455532677743d6a736f6e20485454502f312e310d0a486f73743a20<HONEYPOT>3a32393039320d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"","session":"d34d77a3-b727-4504-b97c-e0e0d4e131c5","seq":1,"duration_ms":101,"bytes_in":133,"bytes_out":79},{"timestamp":"2026-10-11T22:58:17","port":9202,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"host\":\"<HONEYPOT>:9202\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/v2/_catalog","summary":"","payload_hex":"474554202f76322f5f636174616c6f6720485454502f312e310d0a486f73743a20<HONEYPOT>3a393230320d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"","session":"323d044f-4ee4-4a3a-ac21-ea2391a68307","seq":1,"duration_ms":100,"bytes_in":107,"bytes_out":79},{"timestamp":"2026-10-11T20:30:43","port":9203,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"host\":\"<HONEYPOT>:9203\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/cgi-bin/authLogin.cgi","summary":"","payload_hex":"474554202f6367692d62696e2f617574684c6f67696e2e63676920485454502f312e310d0a486f73743a20<HONEYPOT>3a393230330d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"","session":"e1cba18d-ae52-4a3e-927b-38500a512f2f","seq":1,"duration_ms":102,"bytes_in":115,"bytes_out":79},{"timestamp":"2026-10-11T20:30:43","port":9203,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"host\":\"<HONEYPOT>:9203\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/solr/admin/info/system","summary":"","payload_hex":"474554202f736f6c722f61646d696e2f696e666f2f73797374656d20485454502f312e310d0a486f73743a20<HONEYPOT>3a393230330d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"","session":"ec701fdc-b1b8-489d-8a2a-f1bd2420e63e","seq":1,"duration_ms":100,"bytes_in":116,"bytes_out":79},{"timestamp":"2026-10-11T20:30:43","port":9203,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"host\":\"<HONEYPOT>:9203\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/solr/admin/cores?action=STATUS&wt=json","summary":"","payload_hex":"474554202f736f6c722f61646d696e2f636f7265733f616374696f6e3d5354415455532677743d6a736f6e20485454502f312e310d0a486f73743a20<HONEYPOT>3a393230330d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"","session":"cebcc032-379e-4bd1-9ef3-5717904dd01d","seq":1,"duration_ms":101,"bytes_in":132,"bytes_out":79}],"http_methods":[{"method":"GET","count":307},{"method":"POST","count":35}],"distinct_ports_total":29,"top_paths":[{"path":"/","count":152,"ports":28},{"path":"/solr/admin/info/system","count":40,"ports":25},{"path":"/cgi-bin/authLogin.cgi","count":40,"ports":25},{"path":"/solr/admin/cores?action=STATUS&wt=json","count":40,"ports":25},{"path":"/query?q=SHOW+DIAGNOSTICS","count":35,"ports":22},{"path":"/v2/_catalog","count":30,"ports":21},{"path":"/_all_dbs","count":2,"ports":1},{"path":"/?pretty","count":1,"ports":1},{"path":"/_cluster/health?pretty","count":1,"ports":1},{"path":"/_cat/indices?format=json","count":1,"ports":1}],"distinct_paths_total":10,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Connection","Host","User-Agent"],"representative":[{"name":"Connection","value":"close","notable":false},{"name":"Host","value":"<HONEYPOT>:15672","notable":false},{"name":"User-Agent","value":"Go-http-client/1.1","notable":false}],"distinct_sets":1,"events_with_headers":10},"tags":[{"tag_id":"CVE-2026-27771","tag_type":"cve","title":"Gitea Container Registry - Unauthorized Private Image Access","severity":"high","actively_exploited":false,"match_field":"url_path","matched_pattern":"/v2/_catalog","reference_urls":["https://blog.gitea.com/release-of-1.26.2/","https://github.com/go-gitea/gitea/pull/37290","https://github.com/go-gitea/gitea/pull/37610","https://orca.security/resources/blog/gitea-container-registry-vulnerability/"],"kev_date_added":null}]}