{"ip":"164.90.208.203","total_events":36,"verdict":{"verdict":"scanner","label":"Recognized scanner","detail":"odin","confidence":"high","network_type":"CDN","why":["Source IP is in a known scanner range (odin).","Known research and commercial scanners are labelled as such, not as threats."],"engagement":{"level":"payload","label":"Sustained payload","detail":"9,075 bytes sent","bytes_sent":9075,"session_seconds":0,"persistent":false}},"first_seen":"2026-09-05T12:29:17","last_seen":"2026-09-10T06:57:10","events_24h":0,"events_7d":0,"geo":{"country_code":"DE","country_name":"Germany","region":"Hesse","city":"Frankfurt am Main","lat":50.1169,"lon":8.6837,"asn":14061,"org":"DigitalOcean, LLC"},"source_domain":null,"known_scanners":["odin"],"scanner_tag":{"key":"peeringdb:as14061","label":"DigitalOcean","category":"cdn","url":"https://www.peeringdb.com/asn/14061"},"cve_matches":[{"cve_id":"CVE-2026-27771","title":"Gitea Container Registry - Unauthorized Private Image Access","severity":"high","actively_exploited":false,"match_field":"url_path","matched_pattern":"/v2/_catalog"}],"malware":[],"top_ports":[{"port":20000,"proto":"tcp","label":"","count":7},{"port":6443,"proto":"tcp","label":"k8s API","count":6},{"port":18789,"proto":"tcp","label":"","count":4},{"port":8000,"proto":"tcp","label":"HTTP-alt","count":3},{"port":631,"proto":"tcp","label":"IPP","count":2},{"port":9042,"proto":"tcp","label":"Cassandra","count":2},{"port":5060,"proto":"tcp","label":"SIP","count":2},{"port":1911,"proto":"tcp","label":"","count":2},{"port":8080,"proto":"tcp","label":"HTTP-alt","count":1},{"port":1234,"proto":"tcp","label":"","count":1},{"port":80,"proto":"tcp","label":"HTTP","count":1},{"port":9092,"proto":"tcp","label":"Kafka","count":1},{"port":6000,"proto":"tcp","label":"X11","count":1},{"port":445,"proto":"tcp","label":"SMB","count":1},{"port":4891,"proto":"tcp","label":"","count":1}],"fingerprints":{"ssh_hassh":["2aec6b44b06bec95d73f66b5d30cb69a"],"tls_ja4":["t13i191000_9dc949149365_e5728521abd4"],"tls_client_hello":"","tls_ja3":["96458b3de39df5d47bc5c4a9f10f8f26"],"http_akin":[]},"fingerprint_peers":{"t13i191000_9dc949149365_e5728521abd4":201,"2aec6b44b06bec95d73f66b5d30cb69a":20},"akin_families":{},"user_agents":["Mozilla/5.0 (compatible; Odin; https://docs.getodin.com/)","Go-http-client/1.1"],"timeline":[{"date":"2026-09-05","count":5},{"date":"2026-09-06","count":10},{"date":"2026-09-07","count":7},{"date":"2026-09-08","count":7},{"date":"2026-09-09","count":6},{"date":"2026-09-10","count":1}],"recent_events":[{"timestamp":"2026-09-10T06:57:10","port":22,"proto":"tcp","app_proto":"","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"SSH-2.0-Go\r\n\u0000\u0000\u0002�\n\u0014� W��d����ha��I�\u0000\u0000\u0000�curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1\u0000\u0000\u0001-ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa,ssh-dss,ssh-ed25519\u0000\u0000\u0000Maes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,arcfour256,arcfour128\u0000\u0000\u0000Maes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,arcfour256,arcfour128\u0000\u0000\u0000$hmac-sha2-256,hmac-sha1,hmac-sha1-96\u0000\u0000\u0000$hmac-sha2-256,hmac-sha1,hmac-sha1-96\u0000\u0000\u0000\u0004none\u0000\u0000\u0000\u0004none\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u001f���H?���","payload_hex":"5353482d322e302d476f0d0a000002ec0a148420579cd264e9b2feba6861bda0498f0000008c637572766532353531392d736861323536406c69627373682e6f72672c656364682d736861322d6e697374703235362c656364682d736861322d6e697374703338342c656364682d736861322d6e697374703532312c6469666669652d68656c6c6d616e2d67726f757031342d736861312c6469666669652d68656c6c6d616e2d67726f7570312d736861310000012d7373682d7273612d636572742d763031406f70656e7373682e636f6d2c7373682d6473732d636572742d763031406f70656e7373682e636f6d2c65636473612d736861322d6e697374703235362d636572742d763031406f70656e7373682e636f6d2c65636473612d736861322d6e697374703338342d636572742d763031406f70656e7373682e636f6d2c65636473612d736861322d6e697374703532312d636572742d763031406f70656e7373682e636f6d2c7373682d656432353531392d636572742d763031406f70656e7373682e636f6d2c65636473612d736861322d6e697374703235362c65636473612d736861322d6e697374703338342c65636473612d736861322d6e697374703532312c7373682d7273612c7373682d6473732c7373682d656432353531390000004d6165733132382d6374722c6165733139322d6374722c6165733235362d6374722c6165733132382d67636d406f70656e7373682e636f6d2c617263666f75723235362c617263666f75723132380000004d6165733132382d6374722c6165733139322d6374722c6165733235362d6374722c6165733132382d67636d406f70656e7373682e636f6d2c617263666f75723235362c617263666f757231323800000024686d61632d736861322d3235362c686d61632d736861312c686d61632d736861312d393600000024686d61632d736861322d3235362c686d61632d736861312c686d61632d736861312d3936000000046e6f6e65000000046e6f6e65000000000000000000000000001f92d3ca7f483fa7bda8","method":"","user_agent":"","ja3":"","session":"1dc8c80a-ff4f-4df4-89c2-846478aa939e","seq":1,"duration_ms":201,"bytes_in":764,"bytes_out":14,"enriched":{"digest":"e6887757307f9878","label":"SSH","strings":["SSH-2.0-Go","curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nis…","-ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ecdsa-sha2-nistp256-c…","Maes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,arcfour256,arcfour128","$hmac-sha2-256,hmac-sha1,hmac-sha1-96","none"],"iocs":{"domains":["libssh.org","openssh.com"]}}},{"timestamp":"2026-09-09T18:18:23","port":1234,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:1234\",\"user-agent\":\"Mozilla/5.0 (compatible; Odin; https://docs.getodin.com/)\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a313233340d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b204f64696e3b2068747470733a2f2f646f63732e6765746f64696e2e636f6d2f290d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; Odin; https://docs.getodin.com/)","ja3":"","session":"b673bb37-ef1b-42f2-823b-03baec4c323c","seq":1,"duration_ms":101,"bytes_in":150,"bytes_out":79},{"timestamp":"2026-09-09T08:44:28","port":1911,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:1911\",\"user-agent\":\"Mozilla/5.0 (compatible; Odin; https://docs.getodin.com/)\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a313931310d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b204f64696e3b2068747470733a2f2f646f63732e6765746f64696e2e636f6d2f290d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; Odin; https://docs.getodin.com/)","ja3":"","session":"4e423989-dd72-4be6-8bfd-ffd368de3afa","seq":1,"duration_ms":100,"bytes_in":151,"bytes_out":79},{"timestamp":"2026-09-09T02:06:07","port":6443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"host\":\"<HONEYPOT>:6443\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/api/v1/endpoints","summary":"","payload_hex":"474554202f6170692f76312f656e64706f696e747320485454502f312e310d0a486f73743a20<HONEYPOT>3a363434330d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"96458b3de39df5d47bc5c4a9f10f8f26","session":"c9831017-ba3c-4678-9c65-17056941b69a","seq":1,"duration_ms":101,"bytes_in":110,"bytes_out":79},{"timestamp":"2026-09-09T02:06:07","port":6443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"host\":\"<HONEYPOT>:6443\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/api/v1/nodes","summary":"","payload_hex":"474554202f6170692f76312f6e6f64657320485454502f312e310d0a486f73743a20<HONEYPOT>3a363434330d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"96458b3de39df5d47bc5c4a9f10f8f26","session":"ed7b33dd-103f-4f3d-982f-6ad3e5858029","seq":1,"duration_ms":100,"bytes_in":106,"bytes_out":79},{"timestamp":"2026-09-09T02:06:07","port":6443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"host\":\"<HONEYPOT>:6443\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/api/v1/services","summary":"","payload_hex":"474554202f6170692f76312f736572766963657320485454502f312e310d0a486f73743a20<HONEYPOT>3a363434330d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"96458b3de39df5d47bc5c4a9f10f8f26","session":"b28a42b1-18ce-4421-b19b-2bba8fc8a01e","seq":1,"duration_ms":100,"bytes_in":109,"bytes_out":79},{"timestamp":"2026-09-09T02:06:07","port":6443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"host\":\"<HONEYPOT>:6443\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/api/v1/pods","summary":"","payload_hex":"474554202f6170692f76312f706f647320485454502f312e310d0a486f73743a20<HONEYPOT>3a363434330d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"96458b3de39df5d47bc5c4a9f10f8f26","session":"19373ede-1e86-4b3f-b1b3-dfca9a36102e","seq":1,"duration_ms":100,"bytes_in":105,"bytes_out":79},{"timestamp":"2026-09-08T23:25:39","port":6443,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:6443\",\"user-agent\":\"Mozilla/5.0 (compatible; Odin; https://docs.getodin.com/)\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a363434330d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b204f64696e3b2068747470733a2f2f646f63732e6765746f64696e2e636f6d2f290d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; Odin; https://docs.getodin.com/)","ja3":"","session":"403f347b-d625-4036-a52b-3a806fe78e0f","seq":1,"duration_ms":100,"bytes_in":150,"bytes_out":79},{"timestamp":"2026-09-08T21:08:01","port":9042,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:9042\",\"user-agent\":\"Mozilla/5.0 (compatible; Odin; https://docs.getodin.com/)\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a393034320d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b204f64696e3b2068747470733a2f2f646f63732e6765746f64696e2e636f6d2f290d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; Odin; https://docs.getodin.com/)","ja3":"","session":"2c11aa12-7031-4570-90da-3eb35a6f143a","seq":1,"duration_ms":100,"bytes_in":151,"bytes_out":79},{"timestamp":"2026-09-08T13:53:38","port":631,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"host\":\"<HONEYPOT>:631\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/cgi-bin/authLogin.cgi","summary":"","payload_hex":"474554202f6367692d62696e2f617574684c6f67696e2e63676920485454502f312e310d0a486f73743a20<HONEYPOT>3a3633310d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"","session":"1c16c193-1ab3-46f6-b5d0-a9583ef72607","seq":1,"duration_ms":100,"bytes_in":114,"bytes_out":79}],"http_methods":[{"method":"GET","count":29},{"method":"POST","count":4}],"distinct_ports_total":16,"top_paths":[{"path":"/","count":18,"ports":13},{"path":"/query?q=SHOW+DIAGNOSTICS","count":4,"ports":4},{"path":"/v2/_catalog","count":2,"ports":2},{"path":"/solr/admin/info/system","count":2,"ports":1},{"path":"/solr/admin/cores?action=STATUS&wt=json","count":2,"ports":1},{"path":"/api/v1/pods","count":1,"ports":1},{"path":"/api/v1/nodes","count":1,"ports":1},{"path":"/api/v1/services","count":1,"ports":1},{"path":"/api/v1/endpoints","count":1,"ports":1},{"path":"/cgi-bin/authLogin.cgi","count":1,"ports":1}],"distinct_paths_total":10,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[{"value":"SSH-2.0-Go","count":1}],"credentials":[],"header_profile":{"signature":["Accept","Accept-Encoding","Host","User-Agent"],"representative":[{"name":"Accept","value":"*/*","notable":false},{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Host","value":"<HONEYPOT>:1234","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (compatible; Odin; https://docs.getodin.com/)","notable":false}],"distinct_sets":2,"events_with_headers":9},"tags":[{"tag_id":"CVE-2026-27771","tag_type":"cve","title":"Gitea Container Registry - Unauthorized Private Image Access","severity":"high","actively_exploited":false,"match_field":"url_path","matched_pattern":"/v2/_catalog","reference_urls":["https://blog.gitea.com/release-of-1.26.2/","https://github.com/go-gitea/gitea/pull/37290","https://github.com/go-gitea/gitea/pull/37610","https://orca.security/resources/blog/gitea-container-registry-vulnerability/"]}],"data_as_of":"2026-09-24T13:04:51.920338+00:00"}