{"ip":"165.227.90.53","data_as_of":"2026-10-26T09:22:18+00:00","observed":true,"total_events":299,"verdict":{"verdict":"scanner","label":"Recognized scanner","detail":"odin","confidence":"high","network_type":"CDN","why":["The address is in a published scanner range (odin).","Known research and commercial scanners are labelled by operator and carry no threat verdict.","Held a session open for 60s, against a median of well under a second.","Counts include 112 interactive session(s) as well as first-packet events."],"engagement":{"level":"payload","label":"Sustained payload, held open","detail":"66,892 bytes sent, longest session 60s","bytes_sent":66892,"session_seconds":60,"persistent":true},"basis":"combined"},"first_seen":"2026-10-21T10:55:16","last_seen":"2026-10-24T05:05:28","events_24h":0,"events_7d":299,"interactive_sessions":112,"interactive_sessions_24h":0,"interactive_sessions_7d":112,"interactive_protocols":[{"protocol":"http","sessions":88},{"protocol":"tls","sessions":6},{"protocol":"postgres","sessions":5},{"protocol":"mysql","sessions":2},{"protocol":"mqtt","sessions":1},{"protocol":"mssql","sessions":1}],"geo":{"country_code":"US","country_name":"United States","region":"New Jersey","city":"North Bergen","lat":40.7964,"lon":-74.0203,"asn":14061,"org":"DigitalOcean, LLC"},"source_domain":null,"known_scanners":["odin"],"scanner_tag":{"key":"peeringdb:as14061","label":"DigitalOcean","category":"cdn","url":"https://www.peeringdb.com/asn/14061"},"cve_matches":[{"cve_id":"CVE-2026-27771","title":"Gitea Container Registry - Unauthorized Private Image Access","severity":"high","actively_exploited":false,"match_field":"url_path","matched_pattern":"/v2/_catalog","kev_date_added":null}],"malware":[],"udp":null,"interaction":{"window_days":90,"sessions":112,"first_seen":"2026-10-21T11:16:44","last_seen":"2026-10-24T04:37:26","verdicts":[{"verdict":"scan","sessions":97},{"verdict":"unknown","sessions":15}],"personas":[{"persona":"nginx@1.24.0, wordpress@6.5.2, leaks@2, miner@bfgminer 5.5.0, elasticsearch@6.8.23, winrm@Windows Server 2016, fortigate@7.0.5, gitlab@19.4.2","sessions":43},{"persona":"nginx@1.18.0, wordpress@6.5.2, leaks@1, miner@cgminer 4.11.1, elasticsearch@8.11.1, winrm@Windows Server 2019, fortigate@7.2.1, gitlab@19.4.2","sessions":29},{"persona":"nginx@1.24.0, wordpress@6.5.2, leaks@2, miner@bfgminer 5.5.0, elasticsearch@6.8.23, winrm@Windows Server 2016, fortigate@7.0.5, docker@25.0.3","sessions":11},{"persona":"nginx@1.24.0, wordpress@6.5.2, leaks@2, miner@bfgminer 5.5.0, elasticsearch@6.8.23, winrm@Windows Server 2016, fortigate@7.0.5","sessions":5},{"persona":"postgres@16.2","sessions":4},{"persona":"mqtt@2.0.15","sessions":1},{"persona":"postgres@12.18","sessions":1},{"persona":"mysql@8.0.37","sessions":1},{"persona":"mssql@15.0.4345.5","sessions":1},{"persona":"mysql@8.0.33","sessions":1}],"services":[{"protocol":"http","port":7574,"sessions":10},{"protocol":"http","port":29092,"sessions":9},{"protocol":"http","port":5671,"sessions":8},{"protocol":"http","port":27019,"sessions":8},{"protocol":"http","port":9301,"sessions":7},{"protocol":"tcp","port":5984,"sessions":6},{"protocol":"http","port":9201,"sessions":6},{"protocol":"http","port":27018,"sessions":6},{"protocol":"http","port":9302,"sessions":6},{"protocol":"http","port":9203,"sessions":6},{"protocol":"postgres","port":5432,"sessions":5},{"protocol":"http","port":9200,"sessions":5}],"logins":[],"commands":[],"downloads":[],"files":[],"attack":[{"technique_id":"T1595","technique_name":"Active Scanning","tactic_id":"TA0043","tactic_name":"Reconnaissance","sessions":97},{"technique_id":"T1078","technique_name":"Valid Accounts","tactic_id":"TA0001","tactic_name":"Initial Access","sessions":1}]},"top_ports":[{"port":29092,"proto":"tcp","label":"","count":15,"sessions":9},{"port":7574,"proto":"tcp","label":"","count":14,"sessions":10},{"port":5984,"proto":"tcp","label":"CouchDB","count":11,"sessions":10},{"port":9093,"proto":"tcp","label":"","count":18,"sessions":1},{"port":15672,"proto":"tcp","label":"RabbitMQ","count":18,"sessions":1},{"port":9200,"proto":"tcp","label":"Elastic","count":14,"sessions":5},{"port":5432,"proto":"tcp","label":"Postgres","count":13,"sessions":5},{"port":9203,"proto":"tcp","label":"","count":12,"sessions":6},{"port":8087,"proto":"tcp","label":"","count":14,"sessions":3},{"port":11211,"proto":"tcp","label":"Memcached","count":15,"sessions":0},{"port":1433,"proto":"tcp","label":"MSSQL","count":14,"sessions":1},{"port":8983,"proto":"tcp","label":"Solr","count":12,"sessions":3},{"port":8883,"proto":"tcp","label":"","count":14,"sessions":0},{"port":2181,"proto":"tcp","label":"","count":12,"sessions":0},{"port":15671,"proto":"tcp","label":"","count":10,"sessions":0}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t12d400600_44c89e5422f1_e51b7354d87f","t13i190900_9dc949149365_e7c285222651","t13i310900_e8f1e7e78f70_1f22a2ca17c4"],"tls_client_hello":"16030100ee010000ea03031fa7de7bf972357c5f62c38f260fe72f98cfeac635457fd3b93075df73007c7f2069fb124fd8678bfac559a6a48fe18372c334f544adbb7827600be55fa68df0640026c02bc02fc02cc030cca9cca8c009c013c00ac014009c009d002f0035c012000a1301130213030100007b000500050100000000000a000a0008001d001700180019000b00020100000d001a0018080404030807080508060401050106010503060302010203ff010001000017000000120000002b00050403040303003300260024001d0020689e2fbae6fd1f92c519bab2f30ba4fe11330199fe2f11f7a74d5a2c","tls_ja3":["1b9bb541fa237aff65acf838b154df7f","d6828e30ab66774a91a96ae93be4ae4c","c216e752cae6f8755fd27f561d031636"],"http_akin":["b11cun030_00040011_c91eaf54","b11cun030_00040012_13ee3d34","b11cun040_00040016_aa48e2c8","b11cuq060_04050811_ffe60107"],"interactive":{"ssh_hassh":[],"tls_ja4":["t13i190900_9dc949149365_e7c285222651","t13i310900_e8f1e7e78f70_1f22a2ca17c4"],"tls_ja3":["c216e752cae6f8755fd27f561d031636","d6828e30ab66774a91a96ae93be4ae4c"]}},"fingerprint_peers":{"t13i190900_9dc949149365_e7c285222651":400,"t13i310900_e8f1e7e78f70_1f22a2ca17c4":0,"b11cun030_00040012_13ee3d34":5484,"b11cun040_00040016_aa48e2c8":5565,"b11cuq060_04050811_ffe60107":143,"t12d400600_44c89e5422f1_e51b7354d87f":3,"b11cun030_00040011_c91eaf54":974},"akin_families":{"b11cun030_00040011_c91eaf54":{"head":"b11cun030_00040011_c91eaf54","shapes":6,"ips":975}},"user_agents":["Go-http-client/1.1","Mozilla/5.0 (compatible; Odin; https://docs.getodin.com/)"],"timeline":[{"date":"2026-10-21","count":109,"sessions":27},{"date":"2026-10-22","count":62,"sessions":42},{"date":"2026-10-23","count":105,"sessions":37},{"date":"2026-10-24","count":23,"sessions":6}],"recent_events":[{"timestamp":"2026-10-24T05:05:28","port":11211,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"host\":\"<HONEYPOT>:11211\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/query?q=SHOW+DIAGNOSTICS","summary":"","payload_hex":"474554202f71756572793f713d53484f572b444941474e4f535449435320485454502f312e310d0a486f73743a20<HONEYPOT>3a31313231310d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"","session":"f6915cbb-a880-4a33-86a7-8a4bdc9b7610","seq":1,"duration_ms":100,"bytes_in":120,"bytes_out":78},{"timestamp":"2026-10-24T05:05:28","port":11211,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:11211\",\"user-agent\":\"Mozilla/5.0 (compatible; Odin; https://docs.getodin.com/)\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a31313231310d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b204f64696e3b2068747470733a2f2f646f63732e6765746f64696e2e636f6d2f290d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; Odin; https://docs.getodin.com/)","ja3":"","session":"118c6c58-5edc-4a7f-aa6d-3c5e6b9184de","seq":1,"duration_ms":101,"bytes_in":152,"bytes_out":78},{"timestamp":"2026-10-24T05:05:28","port":11211,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"host\":\"<HONEYPOT>:11211\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/v2/_catalog","summary":"","payload_hex":"474554202f76322f5f636174616c6f6720485454502f312e310d0a486f73743a20<HONEYPOT>3a31313231310d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"","session":"9ef5eda9-d673-414d-88d1-8a6a9fb7ef5f","seq":1,"duration_ms":100,"bytes_in":107,"bytes_out":78},{"timestamp":"2026-10-24T05:05:28","port":11211,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"host\":\"<HONEYPOT>:11211\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/cgi-bin/authLogin.cgi","summary":"","payload_hex":"474554202f6367692d62696e2f617574684c6f67696e2e63676920485454502f312e310d0a486f73743a20<HONEYPOT>3a31313231310d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"","session":"fa7d3c9d-0a2d-4be1-86c6-b34f1112b5ea","seq":1,"duration_ms":100,"bytes_in":117,"bytes_out":78},{"timestamp":"2026-10-24T04:39:46","port":15672,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:15672\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a31353637320d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"d6828e30ab66774a91a96ae93be4ae4c","session":"d4c7d685-8c22-45f7-8218-b1ba871def5d","seq":1,"duration_ms":100,"bytes_in":100,"bytes_out":78},{"timestamp":"2026-10-24T04:39:46","port":15672,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:15672\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a31353637320d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"","session":"9ae016f4-755f-452a-bc0e-3558c23e4ba0","seq":1,"duration_ms":100,"bytes_in":100,"bytes_out":78},{"timestamp":"2026-10-24T04:36:26","port":9203,"proto":"tcp","app_proto":"http","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:9203\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a203c484f4e4559504f543e3a393230330d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"d6828e30ab66774a91a96ae93be4ae4c","session":"ba483100-bbb2-4852-8090-271093d182d3-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-24T04:36:26","port":9203,"proto":"tcp","app_proto":"http","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:9203\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a203c484f4e4559504f543e3a393230330d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"","session":"142cdc73-e8d4-4494-9788-f4f257215ca1-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-24T04:36:26","port":9203,"proto":"tcp","app_proto":"http","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"host\":\"<HONEYPOT>:9203\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/cgi-bin/authLogin.cgi","summary":"","payload_hex":"474554202f6367692d62696e2f617574684c6f67696e2e63676920485454502f312e310d0a486f73743a203c484f4e4559504f543e3a393230330d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"","session":"50db207a-6182-4410-a4aa-3576e85cab02-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-24T04:36:26","port":9203,"proto":"tcp","app_proto":"http","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"host\":\"<HONEYPOT>:9203\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/query","summary":"","payload_hex":"474554202f71756572793f713d53484f572b444941474e4f535449435320485454502f312e310d0a486f73743a203c484f4e4559504f543e3a393230330d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"","session":"4b8d517b-bf32-4777-93ab-2eecd1cb2271-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true}],"http_methods":[{"method":"GET","count":311},{"method":"POST","count":43}],"distinct_ports_total":29,"top_paths":[{"path":"/","count":155,"ports":28},{"path":"/solr/admin/info/system","count":46,"ports":22},{"path":"/solr/admin/cores?action=STATUS&wt=json","count":39,"ports":22},{"path":"/v2/_catalog","count":37,"ports":17},{"path":"/cgi-bin/authLogin.cgi","count":37,"ports":17},{"path":"/query?q=SHOW+DIAGNOSTICS","count":25,"ports":17},{"path":"/query","count":12,"ports":10},{"path":"/solr/admin/cores","count":6,"ports":5},{"path":"/_cluster/health","count":1,"ports":1},{"path":"/_cat/indices","count":1,"ports":1}],"distinct_paths_total":10,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","Accept-Encoding","Host","User-Agent"],"representative":[{"name":"Accept","value":"*/*","notable":false},{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Host","value":"<HONEYPOT>:11211","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (compatible; Odin; https://docs.getodin.com/)","notable":false}],"distinct_sets":3,"events_with_headers":10},"tags":[{"tag_id":"CVE-2026-27771","tag_type":"cve","title":"Gitea Container Registry - Unauthorized Private Image Access","severity":"high","actively_exploited":false,"match_field":"url_path","matched_pattern":"/v2/_catalog","reference_urls":["https://blog.gitea.com/release-of-1.26.2/","https://github.com/go-gitea/gitea/pull/37290","https://github.com/go-gitea/gitea/pull/37610","https://orca.security/resources/blog/gitea-container-registry-vulnerability/"],"kev_date_added":null},{"tag_id":"logins","tag_type":"interactive","label":"logins","title":"Tried logins","sessions":1}]}