{"ip":"164.92.207.74","total_events":11,"verdict":{"verdict":"scanning","label":"Scanning for known vulnerabilities","detail":"1 exploit-path probe(s)","confidence":"medium","network_type":"CDN","why":["1 request(s) matched a known exploit path.","Only GET/HEAD seen, no request body: scanning for the vulnerability, not delivering a payload.","Not in any known-scanner range."],"engagement":{"level":"request","label":"Request traffic","detail":"1,151 bytes sent","bytes_sent":1151,"session_seconds":0,"persistent":false}},"first_seen":"2026-09-22T08:26:24","last_seen":"2026-09-23T12:07:45","events_24h":8,"events_7d":11,"geo":{"country_code":"DE","country_name":"Germany","region":"Hesse","city":"Frankfurt am Main","lat":50.1169,"lon":8.6837,"asn":14061,"org":"DigitalOcean, LLC"},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as14061","label":"DigitalOcean","category":"cdn","url":"https://www.peeringdb.com/asn/14061"},"cve_matches":[],"malware":[],"top_ports":[{"port":9092,"proto":"tcp","label":"Kafka","count":3},{"port":2525,"proto":"tcp","label":"","count":3},{"port":5000,"proto":"tcp","label":"Web-alt","count":2},{"port":8500,"proto":"tcp","label":"","count":1},{"port":9042,"proto":"tcp","label":"Cassandra","count":1},{"port":5060,"proto":"tcp","label":"SIP","count":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i191000_9dc949149365_e5728521abd4"],"tls_client_hello":"160301010c0100010803038720a71704f99963cf9f9dba81d2e7fe473297d56d42520832bcf896167b8b522025336b7a3c3e0dfbd7345de5ab5ec4fadb5db3f0a338b5c09a13b8a443a845920026c02bc02fc02cc030cca9cca8c009c013c00ac014009c009d002f0035c012000a13011302130301000099000b00020100ff010001000017000000120000000500050100000000000a000a0008001d001700180019000d001a00180804040308070805080604010501060105030603020102030032001a0018080404030807080508060401050106010503060302010203002b00050403040303003300260024001d00202f9526eb602407e2bfeddb29c1420403b0d79f807c8ebe856d98dccc","tls_ja3":["96458b3de39df5d47bc5c4a9f10f8f26"],"http_akin":["a11cun030_0000004c_13ee3d34","a11cun030_0000004a_c91eaf54","a11cun040_0000004d_aa48e2c8"]},"fingerprint_peers":{"t13i191000_9dc949149365_e5728521abd4":196,"a11cun030_0000004c_13ee3d34":1781,"a11cun030_0000004a_c91eaf54":67,"a11cun040_0000004d_aa48e2c8":1513},"akin_families":{"a11cun030_0000004a_c91eaf54":{"head":"a11cun030_0000004a_c91eaf54","shapes":2,"ips":67},"a11cun040_0000004d_aa48e2c8":{"head":"a11cun040_0000004d_aa48e2c8","shapes":4,"ips":1525}},"user_agents":["Go-http-client/1.1","Mozilla/5.0 (compatible; Odin; https://docs.getodin.com/)"],"timeline":[{"date":"2026-09-22","count":6},{"date":"2026-09-23","count":5}],"recent_events":[{"timestamp":"2026-09-23T12:07:45","port":9042,"proto":"tcp","app_proto":"","app_protocol":"cassandra","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0004\u0000\u0000\u0001\u0005\u0000\u0000\u0000\u0000","payload_hex":"040000010500000000","method":"","user_agent":"","ja3":"","session":"6cc3762a-cede-4c95-854b-0236a2357ea0","seq":1,"duration_ms":100,"bytes_in":9,"bytes_out":13},{"timestamp":"2026-09-23T09:52:42","port":5000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"185.228.81.201","headers":"{\"connection\":\"close\",\"host\":\"185.228.81.201:5000\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/solr/admin/info/system","summary":"","payload_hex":"474554202f736f6c722f61646d696e2f696e666f2f73797374656d20485454502f312e310d0a486f73743a203138352e3232382e38312e3230313a353030300d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"","session":"07d85288-bed6-419e-8713-42bade97e54c","seq":1,"duration_ms":100,"bytes_in":118,"bytes_out":78},{"timestamp":"2026-09-23T09:52:42","port":5000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"185.228.81.201","headers":"{\"connection\":\"close\",\"host\":\"185.228.81.201:5000\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/solr/admin/cores?action=STATUS&wt=json","summary":"","payload_hex":"474554202f736f6c722f61646d696e2f636f7265733f616374696f6e3d5354415455532677743d6a736f6e20485454502f312e310d0a486f73743a203138352e3232382e38312e3230313a353030300d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"","session":"15fd7998-91bd-4d1b-87f1-b7f47ecaba4c","seq":1,"duration_ms":100,"bytes_in":134,"bytes_out":78},{"timestamp":"2026-09-23T03:21:50","port":5060,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:5060\",\"user-agent\":\"Mozilla/5.0 (compatible; Odin; https://docs.getodin.com/)\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a353036300d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b204f64696e3b2068747470733a2f2f646f63732e6765746f64696e2e636f6d2f290d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; Odin; https://docs.getodin.com/)","ja3":"","session":"7be9adad-0a61-4db1-bd56-7977e12259de","seq":1,"duration_ms":101,"bytes_in":150,"bytes_out":78},{"timestamp":"2026-09-23T00:25:22","port":8500,"proto":"tcp","app_proto":"","app_protocol":"http","host":"185.228.81.201","headers":"{\"connection\":\"close\",\"host\":\"185.228.81.201:8500\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/v1/agent/self","summary":"","payload_hex":"474554202f76312f6167656e742f73656c6620485454502f312e310d0a486f73743a203138352e3232382e38312e3230313a383530300d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"","session":"09249b79-7876-48b5-a1c5-91c41e84ad86","seq":1,"duration_ms":100,"bytes_in":109,"bytes_out":78},{"timestamp":"2026-09-22T23:28:51","port":9092,"proto":"tcp","app_proto":"","app_protocol":"http","host":"185.228.81.201","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"185.228.81.201:9092\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a203138352e3232382e38312e3230313a393039320d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"","session":"8796115a-8ff2-4035-89cd-e1a6fc8a202d","seq":1,"duration_ms":100,"bytes_in":100,"bytes_out":78},{"timestamp":"2026-09-22T23:28:51","port":9092,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"185.228.81.201","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"185.228.81.201:9092\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a203138352e3232382e38312e3230313a393039320d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"96458b3de39df5d47bc5c4a9f10f8f26","session":"62f16f06-5850-4560-828a-80ea9f733a25","seq":1,"duration_ms":100,"bytes_in":100,"bytes_out":78},{"timestamp":"2026-09-22T22:57:31","port":9092,"proto":"tcp","app_proto":"","app_protocol":"http","host":"185.228.81.201","headers":"{\"connection\":\"close\",\"host\":\"185.228.81.201:9092\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/cgi-bin/authLogin.cgi","summary":"","payload_hex":"474554202f6367692d62696e2f617574684c6f67696e2e63676920485454502f312e310d0a486f73743a203138352e3232382e38312e3230313a393039320d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"","session":"e2759aa1-6b13-4f96-b759-7467578ae44f","seq":1,"duration_ms":100,"bytes_in":117,"bytes_out":78},{"timestamp":"2026-09-22T08:26:25","port":2525,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:2525\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a323532350d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"","session":"07c0f476-4b3b-463e-8e58-4a2e53c2cc7b","seq":1,"duration_ms":100,"bytes_in":99,"bytes_out":78},{"timestamp":"2026-09-22T08:26:25","port":2525,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:2525\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a323532350d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"96458b3de39df5d47bc5c4a9f10f8f26","session":"2e4295c3-b72f-44b6-b35c-cb0e1cdd354b","seq":1,"duration_ms":100,"bytes_in":99,"bytes_out":78}],"http_methods":[{"method":"GET","count":10}],"distinct_ports_total":6,"top_paths":[{"path":"/","count":5,"ports":3},{"path":"/cgi-bin/authLogin.cgi","count":2,"ports":2},{"path":"/v1/agent/self","count":1,"ports":1},{"path":"/solr/admin/info/system","count":1,"ports":1},{"path":"/solr/admin/cores?action=STATUS&wt=json","count":1,"ports":1}],"distinct_paths_total":5,"top_snis":[],"top_hosts":[{"value":"185.228.81.201","count":6}],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","Accept-Encoding","Host","User-Agent"],"representative":[{"name":"Accept","value":"*/*","notable":false},{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Host","value":"<HONEYPOT>:5060","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (compatible; Odin; https://docs.getodin.com/)","notable":false}],"distinct_sets":3,"events_with_headers":9},"tags":[],"data_as_of":"2026-09-23T15:10:31.317449+00:00"}