{"ip":"172.86.74.129","data_as_of":"2026-10-27T13:07:38+00:00","observed":true,"total_events":18,"verdict":{"verdict":"probing","label":"Low-level probing","detail":null,"confidence":"low","network_type":null,"why":["49 event(s), fewer than 10 distinct ports, no exploit payloads.","Not in any known-scanner range.","Sent 14,909 bytes to few ports with no known exploit path, which is focused interaction with one service.","Counts include 31 interactive session(s) as well as first-packet events."],"engagement":{"level":"payload","label":"Sustained payload","detail":"14,909 bytes sent","bytes_sent":14909,"session_seconds":0,"persistent":false},"basis":"combined"},"first_seen":"2026-10-20T17:07:54","last_seen":"2026-10-20T23:37:56","events_24h":0,"events_7d":18,"interactive_sessions":31,"interactive_sessions_24h":0,"interactive_sessions_7d":31,"interactive_protocols":[{"protocol":"oracle-tns","sessions":31}],"geo":{"country_code":"US","country_name":"United States","region":"Texas","city":"Dallas","lat":32.7212,"lon":-96.6765,"asn":14956,"org":"RouterHosting LLC"},"source_domain":"129.74.86.172.static.cloudzy.com","known_scanners":[],"scanner_tag":null,"cve_matches":[],"malware":[],"udp":null,"interaction":{"window_days":90,"sessions":31,"first_seen":"2026-10-20T17:07:54","last_seen":"2026-10-20T17:08:07","verdicts":[{"verdict":"scan","sessions":31}],"personas":[{"persona":"oracle@11.2.0.4","sessions":31}],"services":[{"protocol":"oracle-tns","port":1521,"sessions":31}],"logins":[],"commands":[],"downloads":[],"files":[{"sha256":"5962988a5fc0c1e2000ce69beaad3388ee662c6650b6965fc164b4c6c2029c3c","name":"packet-1","size":236,"mime_type":"text/plain","kind":"oracle-data","times":1,"first_seen":"2026-10-20T17:08:07","last_seen":"2026-10-20T17:08:07","virustotal":null},{"sha256":"d265ddb5af5aa3f043efa07ee7d3af881da76b8aff2a33aef1d7f165bbe68491","name":"packet-1","size":236,"mime_type":"text/plain","kind":"oracle-data","times":1,"first_seen":"2026-10-20T17:08:06","last_seen":"2026-10-20T17:08:06","virustotal":null},{"sha256":"d231aced386118d92544f0d75bc2e274362226bccbaf51b7d6689d1b544abe2b","name":"packet-1","size":236,"mime_type":"text/plain","kind":"oracle-data","times":1,"first_seen":"2026-10-20T17:08:06","last_seen":"2026-10-20T17:08:06","virustotal":null},{"sha256":"55847773f581be4fbb4937be7c09ac4e60b3e47a14f23e7e16f1e329012d3a51","name":"packet-1","size":236,"mime_type":"text/plain","kind":"oracle-data","times":1,"first_seen":"2026-10-20T17:08:06","last_seen":"2026-10-20T17:08:06","virustotal":null},{"sha256":"5ca5e29fec9f544921ec6d4ad04f3cf563d461f14de53e007f8d69ac60ab2d8a","name":"packet-1","size":236,"mime_type":"text/plain","kind":"oracle-data","times":1,"first_seen":"2026-10-20T17:08:05","last_seen":"2026-10-20T17:08:05","virustotal":null},{"sha256":"fd1d9b002ead48ab5ce8e81122cd7e1482c63196f2521a11ebef64da59416288","name":"packet-1","size":236,"mime_type":"text/plain","kind":"oracle-data","times":1,"first_seen":"2026-10-20T17:08:05","last_seen":"2026-10-20T17:08:05","virustotal":null},{"sha256":"359f3b8cffdc67ac9f5167c57f453e8e615cdb8217504b23e644a6b16517aedd","name":"packet-1","size":236,"mime_type":"text/plain","kind":"oracle-data","times":1,"first_seen":"2026-10-20T17:08:05","last_seen":"2026-10-20T17:08:05","virustotal":null},{"sha256":"35abbbc181ac4760bace86e41748cde8b1a11438a10d57fdb7797ff773cf197c","name":"packet-1","size":236,"mime_type":"text/plain","kind":"oracle-data","times":1,"first_seen":"2026-10-20T17:08:05","last_seen":"2026-10-20T17:08:05","virustotal":null},{"sha256":"9fe10545f3292d71700df7af25b70df71af719e9af8a0767a262e8a5f2e6be7b","name":"packet-1","size":236,"mime_type":"text/plain","kind":"oracle-data","times":1,"first_seen":"2026-10-20T17:08:04","last_seen":"2026-10-20T17:08:04","virustotal":null},{"sha256":"caca896234687ef044ea220300506acd4c0b75b2af5bdb5ac454da735ddc8e95","name":"packet-1","size":236,"mime_type":"text/plain","kind":"oracle-data","times":1,"first_seen":"2026-10-20T17:08:04","last_seen":"2026-10-20T17:08:04","virustotal":null},{"sha256":"18fc9eaedc15652ad8d57bb41352868b1d92863154cfa3e78f4c3a29dafa9258","name":"packet-1","size":241,"mime_type":"text/plain","kind":"oracle-data","times":1,"first_seen":"2026-10-20T17:08:04","last_seen":"2026-10-20T17:08:04","virustotal":null},{"sha256":"8a83d510c28e6397ad6bd3b98cd085cf99341e7ad770b4a42eae681a541dd2f8","name":"packet-1","size":241,"mime_type":"text/plain","kind":"oracle-data","times":1,"first_seen":"2026-10-20T17:08:03","last_seen":"2026-10-20T17:08:03","virustotal":null},{"sha256":"3ea567a7189dbc566e36dee304cddd6079a9c49be933a5026f0520e26ee2a7f1","name":"packet-1","size":241,"mime_type":"text/plain","kind":"oracle-data","times":1,"first_seen":"2026-10-20T17:08:03","last_seen":"2026-10-20T17:08:03","virustotal":null},{"sha256":"ced086b924e48aa31283565877d20d50bfb248e8ce310a58f03c4c9e9e76e0fd","name":"packet-1","size":241,"mime_type":"text/plain","kind":"oracle-data","times":1,"first_seen":"2026-10-20T17:08:03","last_seen":"2026-10-20T17:08:03","virustotal":null},{"sha256":"06e333aa577c5fd2122cc004af35060f8eb2461fb55b77e0404bfea6d253f65d","name":"packet-1","size":241,"mime_type":"text/plain","kind":"oracle-data","times":1,"first_seen":"2026-10-20T17:08:03","last_seen":"2026-10-20T17:08:03","virustotal":null},{"sha256":"cc4733374ce662974d016f194f274eb6ea72724bab6f6263f1bd4ac09e07f1b3","name":"packet-1","size":241,"mime_type":"text/plain","kind":"oracle-data","times":1,"first_seen":"2026-10-20T17:08:02","last_seen":"2026-10-20T17:08:02","virustotal":null},{"sha256":"dd686676cae2430d977232f1577556a8c59208c131e31897ab7c8390b1fc0fff","name":"packet-1","size":241,"mime_type":"text/plain","kind":"oracle-data","times":1,"first_seen":"2026-10-20T17:08:02","last_seen":"2026-10-20T17:08:02","virustotal":null},{"sha256":"da3d2da40c17f05a07a18250ea4953203ad6f52670a27bc9240f98b833136589","name":"packet-1","size":241,"mime_type":"text/plain","kind":"oracle-data","times":1,"first_seen":"2026-10-20T17:08:02","last_seen":"2026-10-20T17:08:02","virustotal":null},{"sha256":"3a6c5f107037825bf41c63a74d270bd2ab5cf4d1f90658a76b54929ce56e59f4","name":"packet-1","size":241,"mime_type":"text/plain","kind":"oracle-data","times":1,"first_seen":"2026-10-20T17:08:01","last_seen":"2026-10-20T17:08:01","virustotal":null},{"sha256":"9698afc533ff81abd079a260332cbe1dea9accba656925b8b7279ffe7b8fbb83","name":"packet-1","size":241,"mime_type":"text/plain","kind":"oracle-data","times":1,"first_seen":"2026-10-20T17:08:01","last_seen":"2026-10-20T17:08:01","virustotal":null},{"sha256":"fe46b9e5cf5cf633c6d80a58947cae609335f05b0fb006acc3243a227cea59ef","name":"packet-1","size":238,"mime_type":"text/plain","kind":"oracle-data","times":1,"first_seen":"2026-10-20T17:08:01","last_seen":"2026-10-20T17:08:01","virustotal":null},{"sha256":"8010131475ddc7d3b5a46b4af1bcc98eaf3bab026258f75d3ac425a563af02f0","name":"packet-1","size":238,"mime_type":"text/plain","kind":"oracle-data","times":1,"first_seen":"2026-10-20T17:08:01","last_seen":"2026-10-20T17:08:01","virustotal":null},{"sha256":"0da11526d36f69da59c7d9f2d8f18dd5a096a127f07eea751b2dfcc69e9d1c7d","name":"packet-1","size":238,"mime_type":"text/plain","kind":"oracle-data","times":1,"first_seen":"2026-10-20T17:08:00","last_seen":"2026-10-20T17:08:00","virustotal":null},{"sha256":"b26868edf4fd88da73adcca853c97c060a75ad6f0eeced440a97032c3dfa79dc","name":"packet-1","size":238,"mime_type":"text/plain","kind":"oracle-data","times":1,"first_seen":"2026-10-20T17:08:00","last_seen":"2026-10-20T17:08:00","virustotal":null},{"sha256":"4549442d9025291731425c5e8bbe0175893fb87b08d5cd96ad4112b3e0996dd2","name":"packet-1","size":238,"mime_type":"text/plain","kind":"oracle-data","times":1,"first_seen":"2026-10-20T17:08:00","last_seen":"2026-10-20T17:08:00","virustotal":null}],"attack":[{"technique_id":"T1595","technique_name":"Active Scanning","tactic_id":"TA0043","tactic_name":"Reconnaissance","sessions":31}]},"top_ports":[{"port":1521,"proto":"tcp","label":"Oracle","count":18,"sessions":31}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":[],"interactive":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[]}},"fingerprint_peers":{},"akin_families":{},"user_agents":[],"timeline":[{"date":"2026-10-20","count":18,"sessions":31}],"recent_events":[{"timestamp":"2026-10-20T23:37:56","port":1521,"proto":"tcp","app_proto":"","app_protocol":"oracle","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000J\u0000\u0000\u0001\u0000\u0000\u0000\u0001?\u0001,\u0004\u0001 \u0000 \u0000O�\u0000\u0000\u0000\u0001\u0000�\u0000J\u0000\u0000\u0000\u0000��\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000 \u0000\u0000\u0000 \u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000�\u0000\u0000\u0006\u0000\u0000\u0000\u0000\u0000(DESCRIPTION=(TRANSPORT_CONNECT_TIMEOUT=6)(ADDRESS=(PROTOCOL=tcp)(HOST=<HONEYPOT>)(PORT=1521))(CONNECT_DATA=(SERVICE_NAME=XE)(CID=(PROGRAM=/usr/bin/python3)(HOST=ubuntu-utah-1gb)(USER=root))(CONNECTION_ID=sb70DcwhuF36rMV6xA2tTQ==)))","payload_hex":"004a000001000000013f012c0401200020004f980000000100ea004a0000000084840000000000000000000000000000000000000000000000000000200000002000000000000000000100f40000060000000000284445534352495054494f4e3d285452414e53504f52545f434f4e4e4543545f54494d454f55543d362928414444524553533d2850524f544f434f4c3d7463702928484f53543d<HONEYPOT>2928504f52543d31353231292928434f4e4e4543545f444154413d28534552564943455f4e414d453d584529284349443d2850524f4752414d3d2f7573722f62696e2f707974686f6e332928484f53543d7562756e74752d757461682d3167622928555345523d726f6f74292928434f4e4e454354494f4e5f49443d736237304463776875463336724d56367841327454513d3d292929","method":"","user_agent":"","ja3":"","session":"57593a23-24c3-4aea-ac61-fd3e3161e6ee","seq":1,"duration_ms":101,"bytes_in":318,"bytes_out":13,"enriched":{"digest":"6123f497c47821d6","strings":["(DESCRIPTION=(TRANSPORT_CONNECT_TIMEOUT=6)(ADDRESS=(PROTOCOL=tcp)(HOST=<HONEYPOT…"]}},{"timestamp":"2026-10-20T23:37:25","port":1521,"proto":"tcp","app_proto":"","app_protocol":"oracle","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000J\u0000\u0000\u0001\u0000\u0000\u0000\u0001?\u0001,\u0004\u0001 \u0000 \u0000O�\u0000\u0000\u0000\u0001\u0000�\u0000J\u0000\u0000\u0000\u0000��\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000 \u0000\u0000\u0000 \u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000�\u0000\u0000\u0006\u0000\u0000\u0000\u0000\u0000(DESCRIPTION=(TRANSPORT_CONNECT_TIMEOUT=6)(ADDRESS=(PROTOCOL=tcp)(HOST=<HONEYPOT>)(PORT=1521))(CONNECT_DATA=(SERVICE_NAME=ORCLCDB)(CID=(PROGRAM=/usr/bin/python3)(HOST=ubuntu-utah-1gb)(USER=root))(CONNECTION_ID=jUHooJbAWXkmVuYaJ1aLEQ==)))","payload_hex":"004a000001000000013f012c0401200020004f980000000100ef004a0000000084840000000000000000000000000000000000000000000000000000200000002000000000000000000100f90000060000000000284445534352495054494f4e3d285452414e53504f52545f434f4e4e4543545f54494d454f55543d362928414444524553533d2850524f544f434f4c3d7463702928484f53543d<HONEYPOT>2928504f52543d31353231292928434f4e4e4543545f444154413d28534552564943455f4e414d453d4f52434c43444229284349443d2850524f4752414d3d2f7573722f62696e2f707974686f6e332928484f53543d7562756e74752d757461682d3167622928555345523d726f6f74292928434f4e4e454354494f4e5f49443d6a55486f6f4a624157586b6d567559614a31614c45513d3d292929","method":"","user_agent":"","ja3":"","session":"cd5ae030-cf79-406d-b954-a5ded0146143","seq":1,"duration_ms":100,"bytes_in":323,"bytes_out":13,"enriched":{"digest":"af0f523dad0c79fc","strings":["(DESCRIPTION=(TRANSPORT_CONNECT_TIMEOUT=6)(ADDRESS=(PROTOCOL=tcp)(HOST=<HONEYPOT…"]}},{"timestamp":"2026-10-20T23:36:55","port":1521,"proto":"tcp","app_proto":"","app_protocol":"oracle","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000J\u0000\u0000\u0001\u0000\u0000\u0000\u0001?\u0001,\u0004\u0001 \u0000 \u0000O�\u0000\u0000\u0000\u0001\u0000�\u0000J\u0000\u0000\u0000\u0000��\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000 \u0000\u0000\u0000 \u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000�\u0000\u0000\u0006\u0000\u0000\u0000\u0000\u0000(DESCRIPTION=(TRANSPORT_CONNECT_TIMEOUT=6)(ADDRESS=(PROTOCOL=tcp)(HOST=<HONEYPOT>)(PORT=1521))(CONNECT_DATA=(SERVICE_NAME=ORCLCDB)(CID=(PROGRAM=/usr/bin/python3)(HOST=ubuntu-utah-1gb)(USER=root))(CONNECTION_ID=sIzq50MnPZP0L7UThLX66w==)))","payload_hex":"004a000001000000013f012c0401200020004f980000000100ef004a0000000084840000000000000000000000000000000000000000000000000000200000002000000000000000000100f90000060000000000284445534352495054494f4e3d285452414e53504f52545f434f4e4e4543545f54494d454f55543d362928414444524553533d2850524f544f434f4c3d7463702928484f53543d<HONEYPOT>2928504f52543d31353231292928434f4e4e4543545f444154413d28534552564943455f4e414d453d4f52434c43444229284349443d2850524f4752414d3d2f7573722f62696e2f707974686f6e332928484f53543d7562756e74752d757461682d3167622928555345523d726f6f74292928434f4e4e454354494f4e5f49443d73497a7135304d6e505a50304c375554684c583636773d3d292929","method":"","user_agent":"","ja3":"","session":"67997286-95ab-45bb-a2ed-600d8b057661","seq":1,"duration_ms":100,"bytes_in":323,"bytes_out":13,"enriched":{"digest":"94acdec0aea393c4","strings":["(DESCRIPTION=(TRANSPORT_CONNECT_TIMEOUT=6)(ADDRESS=(PROTOCOL=tcp)(HOST=<HONEYPOT…"]}},{"timestamp":"2026-10-20T23:36:25","port":1521,"proto":"tcp","app_proto":"","app_protocol":"oracle","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000J\u0000\u0000\u0001\u0000\u0000\u0000\u0001?\u0001,\u0004\u0001 \u0000 \u0000O�\u0000\u0000\u0000\u0001\u0000�\u0000J\u0000\u0000\u0000\u0000��\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000 \u0000\u0000\u0000 \u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000�\u0000\u0000\u0006\u0000\u0000\u0000\u0000\u0000(DESCRIPTION=(TRANSPORT_CONNECT_TIMEOUT=6)(ADDRESS=(PROTOCOL=tcp)(HOST=<HONEYPOT>)(PORT=1521))(CONNECT_DATA=(SERVICE_NAME=ORCL)(CID=(PROGRAM=/usr/bin/python3)(HOST=ubuntu-utah-1gb)(USER=root))(CONNECTION_ID=PksI2R4TCqqv371cbe/h5Q==)))","payload_hex":"004a000001000000013f012c0401200020004f980000000100ec004a0000000084840000000000000000000000000000000000000000000000000000200000002000000000000000000100f60000060000000000284445534352495054494f4e3d285452414e53504f52545f434f4e4e4543545f54494d454f55543d362928414444524553533d2850524f544f434f4c3d7463702928484f53543d<HONEYPOT>2928504f52543d31353231292928434f4e4e4543545f444154413d28534552564943455f4e414d453d4f52434c29284349443d2850524f4752414d3d2f7573722f62696e2f707974686f6e332928484f53543d7562756e74752d757461682d3167622928555345523d726f6f74292928434f4e4e454354494f4e5f49443d506b734932523454437171763337316362652f6835513d3d292929","method":"","user_agent":"","ja3":"","session":"b91c0595-8a83-47fe-aa18-02832b67902a","seq":1,"duration_ms":100,"bytes_in":320,"bytes_out":13,"enriched":{"digest":"abdca41f629aef00","strings":["(DESCRIPTION=(TRANSPORT_CONNECT_TIMEOUT=6)(ADDRESS=(PROTOCOL=tcp)(HOST=<HONEYPOT…"]}},{"timestamp":"2026-10-20T23:35:55","port":1521,"proto":"tcp","app_proto":"","app_protocol":"oracle","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000J\u0000\u0000\u0001\u0000\u0000\u0000\u0001?\u0001,\u0004\u0001 \u0000 \u0000O�\u0000\u0000\u0000\u0001\u0000�\u0000J\u0000\u0000\u0000\u0000��\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000 \u0000\u0000\u0000 \u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000�\u0000\u0000\u0006\u0000\u0000\u0000\u0000\u0000(DESCRIPTION=(TRANSPORT_CONNECT_TIMEOUT=6)(ADDRESS=(PROTOCOL=tcp)(HOST=<HONEYPOT>)(PORT=1521))(CONNECT_DATA=(SERVICE_NAME=ORCL)(CID=(PROGRAM=/usr/bin/python3)(HOST=ubuntu-utah-1gb)(USER=root))(CONNECTION_ID=kNwafAdym3dyuav0W8+Kxw==)))","payload_hex":"004a000001000000013f012c0401200020004f980000000100ec004a0000000084840000000000000000000000000000000000000000000000000000200000002000000000000000000100f60000060000000000284445534352495054494f4e3d285452414e53504f52545f434f4e4e4543545f54494d454f55543d362928414444524553533d2850524f544f434f4c3d7463702928484f53543d<HONEYPOT>2928504f52543d31353231292928434f4e4e4543545f444154413d28534552564943455f4e414d453d4f52434c29284349443d2850524f4752414d3d2f7573722f62696e2f707974686f6e332928484f53543d7562756e74752d757461682d3167622928555345523d726f6f74292928434f4e4e454354494f4e5f49443d6b4e7761664164796d3364797561763057382b4b78773d3d292929","method":"","user_agent":"","ja3":"","session":"01d7e037-d247-455c-ab66-6630cb52b75a","seq":1,"duration_ms":100,"bytes_in":320,"bytes_out":13,"enriched":{"digest":"b8a1062a39864e08","strings":["(DESCRIPTION=(TRANSPORT_CONNECT_TIMEOUT=6)(ADDRESS=(PROTOCOL=tcp)(HOST=<HONEYPOT…"]}},{"timestamp":"2026-10-20T23:35:50","port":1521,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000e\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u00016\u0001,\u0000\u0000\b\u0000�\u0003\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000(AUTH_SESSION_KEY=1364911224)(CONNECT_DATA=(SID=PLSEXTRLPROC))","payload_hex":"006500000100000000000136012c000008007fff03000000000000000000000000000000000000000028415554485f53455353494f4e5f4b45593d313336343931313232342928434f4e4e4543545f444154413d285349443d504c53455854524c50524f432929","method":"","user_agent":"","ja3":"","session":"6bc33438-f902-48be-86c0-a86576e6e50b","seq":1,"duration_ms":101,"bytes_in":103,"bytes_out":13,"enriched":{"digest":"867492b650d59259","strings":["(AUTH_SESSION_KEY=1364911224)(CONNECT_DATA=(SID=PLSEXTRLPROC))"]}},{"timestamp":"2026-10-20T18:39:29","port":1521,"proto":"tcp","app_proto":"","app_protocol":"oracle","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000J\u0000\u0000\u0001\u0000\u0000\u0000\u0001?\u0001,\u0004\u0001 \u0000 \u0000O�\u0000\u0000\u0000\u0001\u0000�\u0000J\u0000\u0000\u0000\u0000��\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000 \u0000\u0000\u0000 \u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000�\u0000\u0000\u0006\u0000\u0000\u0000\u0000\u0000(DESCRIPTION=(TRANSPORT_CONNECT_TIMEOUT=6)(ADDRESS=(PROTOCOL=tcp)(HOST=<HONEYPOT>)(PORT=1521))(CONNECT_DATA=(SERVICE_NAME=XE)(CID=(PROGRAM=/usr/bin/python3)(HOST=ubuntu-utah-1gb)(USER=root))(CONNECTION_ID=cC5AxjwU+qj3OVM1agVWww==)))","payload_hex":"004a000001000000013f012c0401200020004f980000000100eb004a0000000084840000000000000000000000000000000000000000000000000000200000002000000000000000000100f50000060000000000284445534352495054494f4e3d285452414e53504f52545f434f4e4e4543545f54494d454f55543d362928414444524553533d2850524f544f434f4c3d7463702928484f53543d<HONEYPOT>2928504f52543d31353231292928434f4e4e4543545f444154413d28534552564943455f4e414d453d584529284349443d2850524f4752414d3d2f7573722f62696e2f707974686f6e332928484f53543d7562756e74752d757461682d3167622928555345523d726f6f74292928434f4e4e454354494f4e5f49443d63433541786a77552b716a334f564d316167565777773d3d292929","method":"","user_agent":"","ja3":"","session":"24c04db1-29bd-4666-ae21-c756556c722b","seq":1,"duration_ms":100,"bytes_in":319,"bytes_out":13,"enriched":{"digest":"e9b88b309e5bb76d","strings":["(DESCRIPTION=(TRANSPORT_CONNECT_TIMEOUT=6)(ADDRESS=(PROTOCOL=tcp)(HOST=<HONEYPOT…"]}},{"timestamp":"2026-10-20T18:38:58","port":1521,"proto":"tcp","app_proto":"","app_protocol":"oracle","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000J\u0000\u0000\u0001\u0000\u0000\u0000\u0001?\u0001,\u0004\u0001 \u0000 \u0000O�\u0000\u0000\u0000\u0001\u0000�\u0000J\u0000\u0000\u0000\u0000��\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000 \u0000\u0000\u0000 \u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000�\u0000\u0000\u0006\u0000\u0000\u0000\u0000\u0000(DESCRIPTION=(TRANSPORT_CONNECT_TIMEOUT=6)(ADDRESS=(PROTOCOL=tcp)(HOST=<HONEYPOT>)(PORT=1521))(CONNECT_DATA=(SERVICE_NAME=ORCLCDB)(CID=(PROGRAM=/usr/bin/python3)(HOST=ubuntu-utah-1gb)(USER=root))(CONNECTION_ID=WOQePf1sEO4n+Qh9Rm2XMA==)))","payload_hex":"004a000001000000013f012c0401200020004f980000000100f0004a0000000084840000000000000000000000000000000000000000000000000000200000002000000000000000000100fa0000060000000000284445534352495054494f4e3d285452414e53504f52545f434f4e4e4543545f54494d454f55543d362928414444524553533d2850524f544f434f4c3d7463702928484f53543d<HONEYPOT>2928504f52543d31353231292928434f4e4e4543545f444154413d28534552564943455f4e414d453d4f52434c43444229284349443d2850524f4752414d3d2f7573722f62696e2f707974686f6e332928484f53543d7562756e74752d757461682d3167622928555345523d726f6f74292928434f4e4e454354494f4e5f49443d574f516550663173454f346e2b516839526d32584d413d3d292929","method":"","user_agent":"","ja3":"","session":"c53a59cd-4916-4570-a41e-6aa829bb444b","seq":1,"duration_ms":100,"bytes_in":324,"bytes_out":13,"enriched":{"digest":"9bd66fc8c795ce8f","strings":["(DESCRIPTION=(TRANSPORT_CONNECT_TIMEOUT=6)(ADDRESS=(PROTOCOL=tcp)(HOST=<HONEYPOT…"]}},{"timestamp":"2026-10-20T18:38:28","port":1521,"proto":"tcp","app_proto":"","app_protocol":"oracle","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000J\u0000\u0000\u0001\u0000\u0000\u0000\u0001?\u0001,\u0004\u0001 \u0000 \u0000O�\u0000\u0000\u0000\u0001\u0000�\u0000J\u0000\u0000\u0000\u0000��\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000 \u0000\u0000\u0000 \u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000�\u0000\u0000\u0006\u0000\u0000\u0000\u0000\u0000(DESCRIPTION=(TRANSPORT_CONNECT_TIMEOUT=6)(ADDRESS=(PROTOCOL=tcp)(HOST=<HONEYPOT>)(PORT=1521))(CONNECT_DATA=(SERVICE_NAME=ORCLCDB)(CID=(PROGRAM=/usr/bin/python3)(HOST=ubuntu-utah-1gb)(USER=root))(CONNECTION_ID=KTzBKaBUBHR2+TvC0zmJzw==)))","payload_hex":"004a000001000000013f012c0401200020004f980000000100f0004a0000000084840000000000000000000000000000000000000000000000000000200000002000000000000000000100fa0000060000000000284445534352495054494f4e3d285452414e53504f52545f434f4e4e4543545f54494d454f55543d362928414444524553533d2850524f544f434f4c3d7463702928484f53543d<HONEYPOT>2928504f52543d31353231292928434f4e4e4543545f444154413d28534552564943455f4e414d453d4f52434c43444229284349443d2850524f4752414d3d2f7573722f62696e2f707974686f6e332928484f53543d7562756e74752d757461682d3167622928555345523d726f6f74292928434f4e4e454354494f4e5f49443d4b547a424b614255424852322b547643307a6d4a7a773d3d292929","method":"","user_agent":"","ja3":"","session":"d802dcb3-5386-471c-9fb7-eedb4e53dd82","seq":1,"duration_ms":100,"bytes_in":324,"bytes_out":13,"enriched":{"digest":"545cf2717d79e235","strings":["(DESCRIPTION=(TRANSPORT_CONNECT_TIMEOUT=6)(ADDRESS=(PROTOCOL=tcp)(HOST=<HONEYPOT…"]}},{"timestamp":"2026-10-20T18:37:58","port":1521,"proto":"tcp","app_proto":"","app_protocol":"oracle","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000J\u0000\u0000\u0001\u0000\u0000\u0000\u0001?\u0001,\u0004\u0001 \u0000 \u0000O�\u0000\u0000\u0000\u0001\u0000�\u0000J\u0000\u0000\u0000\u0000��\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000 \u0000\u0000\u0000 \u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000�\u0000\u0000\u0006\u0000\u0000\u0000\u0000\u0000(DESCRIPTION=(TRANSPORT_CONNECT_TIMEOUT=6)(ADDRESS=(PROTOCOL=tcp)(HOST=<HONEYPOT>)(PORT=1521))(CONNECT_DATA=(SERVICE_NAME=ORCL)(CID=(PROGRAM=/usr/bin/python3)(HOST=ubuntu-utah-1gb)(USER=root))(CONNECTION_ID=11HAO3Y3kjxTbfpbBxr+ig==)))","payload_hex":"004a000001000000013f012c0401200020004f980000000100ed004a0000000084840000000000000000000000000000000000000000000000000000200000002000000000000000000100f70000060000000000284445534352495054494f4e3d285452414e53504f52545f434f4e4e4543545f54494d454f55543d362928414444524553533d2850524f544f434f4c3d7463702928484f53543d<HONEYPOT>2928504f52543d31353231292928434f4e4e4543545f444154413d28534552564943455f4e414d453d4f52434c29284349443d2850524f4752414d3d2f7573722f62696e2f707974686f6e332928484f53543d7562756e74752d757461682d3167622928555345523d726f6f74292928434f4e4e454354494f4e5f49443d313148414f3359336b6a7854626670624278722b69673d3d292929","method":"","user_agent":"","ja3":"","session":"ac9d18a4-4de2-4a8d-ae5f-d85d4f2646ca","seq":1,"duration_ms":100,"bytes_in":321,"bytes_out":13,"enriched":{"digest":"da753e83801bf534","strings":["(DESCRIPTION=(TRANSPORT_CONNECT_TIMEOUT=6)(ADDRESS=(PROTOCOL=tcp)(HOST=<HONEYPOT…"]}}],"http_methods":[],"distinct_ports_total":1,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[]}