{"ip":"165.245.220.93","total_events":9,"verdict":{"verdict":"scanning","label":"Scanning for known vulnerabilities","detail":"1 exploit-path probe(s)","confidence":"medium","network_type":"CDN","why":["1 request(s) matched a known exploit path.","Only GET/HEAD seen, no request body: scanning for the vulnerability, not delivering a payload.","Not in any known-scanner range."],"engagement":{"level":"request","label":"Request traffic","detail":"1,528 bytes sent","bytes_sent":1528,"session_seconds":0,"persistent":false}},"first_seen":"2026-09-22T11:01:50","last_seen":"2026-09-23T13:40:08","events_24h":8,"events_7d":9,"geo":{"country_code":"DE","country_name":"Germany","region":"Hesse","city":"Frankfurt am Main","lat":50.1169,"lon":8.6837,"asn":14061,"org":"DigitalOcean, LLC"},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as14061","label":"DigitalOcean","category":"cdn","url":"https://www.peeringdb.com/asn/14061"},"cve_matches":[{"cve_id":"CVE-2026-27771","title":"Gitea Container Registry - Unauthorized Private Image Access","severity":"high","actively_exploited":false,"match_field":"url_path","matched_pattern":"/v2/_catalog"}],"malware":[],"top_ports":[{"port":5060,"proto":"tcp","label":"SIP","count":2},{"port":2525,"proto":"tcp","label":"","count":2},{"port":9092,"proto":"tcp","label":"Kafka","count":1},{"port":1234,"proto":"tcp","label":"","count":1},{"port":9042,"proto":"tcp","label":"Cassandra","count":1},{"port":1911,"proto":"tcp","label":"","count":1},{"port":20000,"proto":"tcp","label":"","count":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":["a11cun030_0000004a_c91eaf54","a11cun040_0000004d_aa48e2c8"]},"fingerprint_peers":{"a11cun030_0000004a_c91eaf54":67,"a11cun040_0000004d_aa48e2c8":1513},"akin_families":{"a11cun030_0000004a_c91eaf54":{"head":"a11cun030_0000004a_c91eaf54","shapes":2,"ips":67},"a11cun040_0000004d_aa48e2c8":{"head":"a11cun040_0000004d_aa48e2c8","shapes":4,"ips":1525}},"user_agents":["Mozilla/5.0 (compatible; Odin; https://docs.getodin.com/)","Go-http-client/1.1"],"timeline":[{"date":"2026-09-22","count":1},{"date":"2026-09-23","count":8}],"recent_events":[{"timestamp":"2026-09-23T13:40:08","port":20000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:20000\",\"user-agent\":\"Mozilla/5.0 (compatible; Odin; https://docs.getodin.com/)\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a32303030300d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b204f64696e3b2068747470733a2f2f646f63732e6765746f64696e2e636f6d2f290d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; Odin; https://docs.getodin.com/)","ja3":"","session":"06331356-aff1-40d8-a787-ee67af549f24","seq":1,"duration_ms":100,"bytes_in":151,"bytes_out":79},{"timestamp":"2026-09-23T12:07:45","port":9042,"proto":"tcp","app_proto":"","app_protocol":"http","host":"185.228.81.201","headers":"{\"connection\":\"close\",\"host\":\"185.228.81.201:9042\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/query?q=SHOW+DIAGNOSTICS","summary":"","payload_hex":"474554202f71756572793f713d53484f572b444941474e4f535449435320485454502f312e310d0a486f73743a203138352e3232382e38312e3230313a393034320d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"","session":"ef5f0485-fb22-41df-9f3d-e27d288ef5ff","seq":1,"duration_ms":101,"bytes_in":120,"bytes_out":79},{"timestamp":"2026-09-23T08:17:31","port":1911,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"fox a 1 -1 fox hello\n{\nfox.version=s:1.0\nid=i:1\nhostName=s:xpvm-0omdc01xmy\nhostAddress=s:192.168.1.125\napp.name=s:Workbench\napp.version=s:3.7.44\nvm.name=s:Java HotSpot(TM) Server VM\nvm.version=s:20.4-b02\nos.name=s:Windows XP\nos.version=s:5.1\nlang=s:en\ntimeZone=s:America/Los_Angeles;-28800000;3600000;02:00:00.000,wall,march,8,on or after,sunday,undefined;02:00:00.000,wall,november,1,on or after,sunday,undefined\nhostId=s:Win-99CB-D49D-5442-07BB\nvmUuid=s:8b530bc8-76c5-4139-a2ea-0fabd394d305\nbrandId=s:vykon\n};;\n","payload_hex":"666f7820612031202d3120666f782068656c6c6f0a7b0a666f782e76657273696f6e3d733a312e300a69643d693a310a686f73744e616d653d733a7870766d2d306f6d64633031786d790a686f7374416464726573733d733a3139322e3136382e312e3132350a6170702e6e616d653d733a576f726b62656e63680a6170702e76657273696f6e3d733a332e372e34340a766d2e6e616d653d733a4a61766120486f7453706f7428544d292053657276657220564d0a766d2e76657273696f6e3d733a32302e342d6230320a6f732e6e616d653d733a57696e646f77732058500a6f732e76657273696f6e3d733a352e310a6c616e673d733a656e0a74696d655a6f6e653d733a416d65726963612f4c6f735f416e67656c65733b2d32383830303030303b333630303030303b30323a30303a30302e3030302c77616c6c2c6d617263682c382c6f6e206f722061667465722c73756e6461792c756e646566696e65643b30323a30303a30302e3030302c77616c6c2c6e6f76656d6265722c312c6f6e206f722061667465722c73756e6461792c756e646566696e65640a686f737449643d733a57696e2d393943422d443439442d353434322d303742420a766d557569643d733a38623533306263382d373663352d343133392d613265612d3066616264333934643330350a6272616e6449643d733a76796b6f6e0a7d3b3b0a","method":"","user_agent":"","ja3":"","session":"040200a4-9ecd-4053-9d88-07b9a3d8d111","seq":1,"duration_ms":100,"bytes_in":513,"bytes_out":14,"enriched":{"digest":"fe39c976bf6d2d07","strings":["fox a 1 -1 fox hello","fox.version=s:1.0","id=i:1","hostName=s:xpvm-0omdc01xmy","hostAddress=s:192.168.1.125","app.name=s:Workbench","app.version=s:3.7.44","vm.name=s:Java HotSpot(TM) Server VM","vm.version=s:20.4-b02","os.name=s:Windows XP"],"iocs":{"ips":["192.168.1.125"],"domains":["fox.version","app.name","app.version","vm.name","vm.version","os.name"]}}},{"timestamp":"2026-09-23T07:36:42","port":5060,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"host\":\"<HONEYPOT>:5060\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/query?q=SHOW+DIAGNOSTICS","summary":"","payload_hex":"474554202f71756572793f713d53484f572b444941474e4f535449435320485454502f312e310d0a486f73743a20<HONEYPOT>3a353036300d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"","session":"cbdecfa8-d12d-43c2-981f-942a1edcb266","seq":1,"duration_ms":100,"bytes_in":118,"bytes_out":79},{"timestamp":"2026-09-23T06:38:59","port":9092,"proto":"tcp","app_proto":"","app_protocol":"http","host":"185.228.81.201","headers":"{\"connection\":\"close\",\"host\":\"185.228.81.201:9092\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/cgi-bin/authLogin.cgi","summary":"","payload_hex":"474554202f6367692d62696e2f617574684c6f67696e2e63676920485454502f312e310d0a486f73743a203138352e3232382e38312e3230313a393039320d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"","session":"526020f4-fd07-4a15-998e-475f02be1163","seq":1,"duration_ms":100,"bytes_in":117,"bytes_out":79},{"timestamp":"2026-09-23T03:21:50","port":5060,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"host\":\"<HONEYPOT>:5060\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/v2/_catalog","summary":"","payload_hex":"474554202f76322f5f636174616c6f6720485454502f312e310d0a486f73743a20<HONEYPOT>3a353036300d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"","session":"6c45d76a-2bf4-4a5b-931f-4766376c75ea","seq":1,"duration_ms":102,"bytes_in":105,"bytes_out":79},{"timestamp":"2026-09-23T00:42:16","port":2525,"proto":"tcp","app_proto":"","app_protocol":"http","host":"185.228.81.201","headers":"{\"connection\":\"close\",\"host\":\"185.228.81.201:2525\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/solr/admin/info/system","summary":"","payload_hex":"474554202f736f6c722f61646d696e2f696e666f2f73797374656d20485454502f312e310d0a486f73743a203138352e3232382e38312e3230313a323532350d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"","session":"d4c18c2d-0e70-4476-8941-291b74dc4f7d","seq":1,"duration_ms":100,"bytes_in":118,"bytes_out":79},{"timestamp":"2026-09-23T00:42:16","port":2525,"proto":"tcp","app_proto":"","app_protocol":"http","host":"185.228.81.201","headers":"{\"connection\":\"close\",\"host\":\"185.228.81.201:2525\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/solr/admin/cores?action=STATUS&wt=json","summary":"","payload_hex":"474554202f736f6c722f61646d696e2f636f7265733f616374696f6e3d5354415455532677743d6a736f6e20485454502f312e310d0a486f73743a203138352e3232382e38312e3230313a323532350d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"","session":"6158f9a6-7114-4b5a-99b2-74a4e7c33539","seq":1,"duration_ms":100,"bytes_in":134,"bytes_out":79},{"timestamp":"2026-09-22T11:01:50","port":1234,"proto":"tcp","app_proto":"","app_protocol":"http","host":"185.228.81.201","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"185.228.81.201:1234\",\"user-agent\":\"Mozilla/5.0 (compatible; Odin; https://docs.getodin.com/)\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a203138352e3232382e38312e3230313a313233340d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b204f64696e3b2068747470733a2f2f646f63732e6765746f64696e2e636f6d2f290d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; Odin; https://docs.getodin.com/)","ja3":"","session":"ed2487b6-decb-46bd-895a-11f75059e09f","seq":1,"duration_ms":100,"bytes_in":152,"bytes_out":79}],"http_methods":[{"method":"GET","count":8}],"distinct_ports_total":7,"top_paths":[{"path":"/","count":2,"ports":2},{"path":"/query?q=SHOW+DIAGNOSTICS","count":2,"ports":2},{"path":"/v2/_catalog","count":1,"ports":1},{"path":"/solr/admin/info/system","count":1,"ports":1},{"path":"/cgi-bin/authLogin.cgi","count":1,"ports":1},{"path":"/solr/admin/cores?action=STATUS&wt=json","count":1,"ports":1}],"distinct_paths_total":6,"top_snis":[],"top_hosts":[{"value":"185.228.81.201","count":5}],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","Accept-Encoding","Host","User-Agent"],"representative":[{"name":"Accept","value":"*/*","notable":false},{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Host","value":"<HONEYPOT>:20000","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (compatible; Odin; https://docs.getodin.com/)","notable":false}],"distinct_sets":2,"events_with_headers":8},"tags":[{"tag_id":"CVE-2026-27771","tag_type":"cve","title":"Gitea Container Registry - Unauthorized Private Image Access","severity":"high","actively_exploited":false,"match_field":"url_path","matched_pattern":"/v2/_catalog","reference_urls":["https://blog.gitea.com/release-of-1.26.2/","https://github.com/go-gitea/gitea/pull/37290","https://github.com/go-gitea/gitea/pull/37610","https://orca.security/resources/blog/gitea-container-registry-vulnerability/"]}],"data_as_of":"2026-09-23T15:10:42.734005+00:00"}