{"ip":"176.32.193.16","data_as_of":"2026-10-24T05:19:59+00:00","observed":true,"total_events":3917,"verdict":{"verdict":"malicious","label":"Exploit attempts observed","detail":"9 interactive login(s) succeeded","confidence":"high","network_type":null,"why":["9 interactive session(s) logged in successfully.","The interactive sensors answer as a real service and record what the client did once inside, so this is activity after access.","The first-packet sensors recorded 3,917 event(s) from this address as well.","Not in any known-scanner range.","Sent 571,309 bytes, which is sustained payload delivery."],"engagement":{"level":"payload","label":"Sustained payload","detail":"571,309 bytes sent","bytes_sent":571309,"session_seconds":32,"persistent":false},"basis":"interactive"},"first_seen":"2026-03-20T14:38:15","last_seen":"2026-10-24T05:00:26","events_24h":39,"events_7d":292,"interactive_sessions":418,"interactive_sessions_24h":54,"interactive_sessions_7d":361,"interactive_protocols":[{"protocol":"http","sessions":283},{"protocol":"tls","sessions":94},{"protocol":"cassandra","sessions":11},{"protocol":"http-proxy","sessions":5},{"protocol":"mqtt","sessions":4},{"protocol":"redis","sessions":3},{"protocol":"mongodb","sessions":3},{"protocol":"smtp","sessions":2},{"protocol":"mysql","sessions":2},{"protocol":"rdp","sessions":1},{"protocol":"postgres","sessions":1},{"protocol":"ftp","sessions":1},{"protocol":"kafka","sessions":1},{"protocol":"ssh","sessions":1}],"geo":{"country_code":"AM","country_name":"Armenia","region":"","city":"","lat":40.25,"lon":45.0,"asn":197834,"org":"Ucom CJSC"},"source_domain":null,"known_scanners":[],"scanner_tag":null,"cve_matches":[{"cve_id":"CVE-2026-27771","title":"Gitea Container Registry - Unauthorized Private Image Access","severity":"high","actively_exploited":false,"match_field":"url_path","matched_pattern":"/v2/_catalog","kev_date_added":null}],"malware":[],"udp":null,"interaction":{"window_days":90,"sessions":418,"first_seen":"2026-10-14T17:26:05","last_seen":"2026-10-24T04:34:45","verdicts":[{"verdict":"scan","sessions":297},{"verdict":"unknown","sessions":112},{"verdict":"credential","sessions":9}],"personas":[{"persona":"nginx@1.24.0, wordpress@6.5.2, leaks@2, miner@bfgminer 5.5.0, elasticsearch@6.8.23, winrm@Windows Server 2016, fortigate@7.0.5, gitlab@19.4.2","sessions":59},{"persona":"nginx@1.18.0, wordpress@6.5.2, leaks@1, miner@cgminer 4.11.1, elasticsearch@8.11.1, winrm@Windows Server 2019, fortigate@7.2.1","sessions":49},{"persona":"nginx@1.24.0, wordpress@6.5.2, leaks@2, miner@bfgminer 5.5.0, elasticsearch@6.8.23, winrm@Windows Server 2016, dlink-dir645@1.01, fortigate@7.0.5, gitlab@19.4.2","sessions":35},{"persona":"nginx@1.24.0, wordpress@6.5.2, leaks@2, miner@bfgminer 5.5.0, elasticsearch@6.8.23, winrm@Windows Server 2016, fortigate@7.0.5, docker@25.0.3","sessions":33},{"persona":"nginx@1.18.0, wordpress@6.5.2, leaks@1, miner@cgminer 4.11.1, elasticsearch@8.11.1, winrm@Windows Server 2019, fortigate@7.2.1, gitlab@19.4.2","sessions":31},{"persona":"nginx@1.18.0, wordpress@6.5.2, leaks@1, miner@cgminer 4.11.1, elasticsearch@8.11.1, winrm@Windows Server 2019, fortigate@7.2.1, docker@25.0.3","sessions":30},{"persona":"nginx@1.18.0, wordpress@6.5.2, leaks@1, miner@cgminer 4.11.1, elasticsearch@8.11.1, winrm@Windows Server 2019, discovery@igd 1.0, fortigate@7.2.1","sessions":28},{"persona":"nginx@1.24.0, wordpress@6.5.2, leaks@2, miner@bfgminer 5.5.0, elasticsearch@6.8.23, winrm@Windows Server 2016, dlink-dir645@1.01, fortigate@7.0.5","sessions":9},{"persona":"cassandra@4.1.3","sessions":6},{"persona":"nginx@1.24.0, wordpress@6.5.2, leaks@2, miner@bfgminer 5.5.0, elasticsearch@6.8.23, winrm@Windows Server 2016, fortigate@7.0.5","sessions":6},{"persona":"cassandra@3.11.10","sessions":5}],"services":[{"protocol":"http","port":80,"sessions":43},{"protocol":"http","port":443,"sessions":37},{"protocol":"tls","port":9876,"sessions":31},{"protocol":"tls","port":1197,"sessions":22},{"protocol":"http","port":64359,"sessions":19},{"protocol":"http","port":9876,"sessions":17},{"protocol":"http","port":1197,"sessions":15},{"protocol":"http","port":1293,"sessions":14},{"protocol":"http","port":120,"sessions":13},{"protocol":"cassandra","port":9042,"sessions":11},{"protocol":"tls","port":500,"sessions":10},{"protocol":"tls","port":64359,"sessions":10}],"logins":[{"username":"cassandra","password":"cassandra","password_sent":true,"service":"cql-auth","outcome":"success","tries":8,"last_seen":"2026-10-24T00:18:20"},{"username":"anonymous","password":"anonymous","password_sent":true,"service":"ftp-login","outcome":"success","tries":1,"last_seen":"2026-10-21T11:09:38"}],"commands":[],"downloads":[],"files":[{"sha256":"9b24580676101877b58a73d31f2fbba57274544070572dcfaa1da727af84472b","name":"query","size":44,"mime_type":"text/plain","kind":"cql-query","times":4,"first_seen":"2026-10-22T13:11:45","last_seen":"2026-10-24T00:18:18","virustotal":null},{"sha256":"68175b8767f30394c3b1fecd93d649ada10d913a5350d875ba66259ab36a2823","name":"query","size":27,"mime_type":"text/plain","kind":"cql-query","times":2,"first_seen":"2026-10-22T13:11:50","last_seen":"2026-10-24T00:18:22","virustotal":null},{"sha256":"f96c426f589d4a255e6e2eb34c05936f62f6414fb27374b529cea214e94ca541","name":"query","size":38,"mime_type":"text/plain","kind":"cql-query","times":2,"first_seen":"2026-10-22T13:11:49","last_seen":"2026-10-24T00:18:21","virustotal":null},{"sha256":"c46312d2d88562581a82c0c31baaf6595a3308c1273293e1a0107ca0a9eb7e1c","name":"query","size":26,"mime_type":"text/plain","kind":"cql-query","times":2,"first_seen":"2026-10-22T13:11:45","last_seen":"2026-10-24T00:18:18","virustotal":null},{"sha256":"022fb3e641810183f16bd1629b9572dedbf6d22ab0effe2a079365200799c5d0","name":"query","size":29,"mime_type":"text/plain","kind":"cql-query","times":1,"first_seen":"2026-10-22T13:11:45","last_seen":"2026-10-22T13:11:45","virustotal":null},{"sha256":"cf564a73abb74a3293e1f0cae0443f87109cedf2f42bc47a17abc0ea184d7c0e","name":"listing","size":266,"mime_type":"text/plain","kind":"ftp-listing","times":1,"first_seen":"2026-10-21T11:09:39","last_seen":"2026-10-21T11:09:39","virustotal":null}],"attack":[{"technique_id":"T1595","technique_name":"Active Scanning","tactic_id":"TA0043","tactic_name":"Reconnaissance","sessions":297},{"technique_id":"T1078","technique_name":"Valid Accounts","tactic_id":"TA0001","tactic_name":"Initial Access","sessions":9},{"technique_id":"T1110","technique_name":"Brute Force","tactic_id":"TA0006","tactic_name":"Credential Access","sessions":9}]},"top_ports":[{"port":9876,"proto":"tcp","label":"","count":114,"sessions":48},{"port":6379,"proto":"tcp","label":"Redis","count":153,"sessions":3},{"port":80,"proto":"tcp","label":"HTTP","count":99,"sessions":43},{"port":64359,"proto":"tcp","label":"","count":106,"sessions":29},{"port":443,"proto":"tcp","label":"HTTPS","count":96,"sessions":37},{"port":9042,"proto":"tcp","label":"Cassandra","count":119,"sessions":11},{"port":2375,"proto":"tcp","label":"Docker","count":105,"sessions":11},{"port":3306,"proto":"tcp","label":"MySQL","count":105,"sessions":2},{"port":5000,"proto":"tcp","label":"Web-alt","count":103,"sessions":2},{"port":9200,"proto":"tcp","label":"Elastic","count":100,"sessions":2},{"port":11211,"proto":"tcp","label":"Memcached","count":94,"sessions":0},{"port":3000,"proto":"tcp","label":"Web-alt","count":86,"sessions":8},{"port":27017,"proto":"tcp","label":"MongoDB","count":82,"sessions":3},{"port":3389,"proto":"tcp","label":"RDP","count":66,"sessions":1},{"port":22,"proto":"tcp","label":"SSH","count":51,"sessions":0}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i1515h2_8daaf6152771_d8a2da3f94cd","t13i1516h2_8daaf6152771_b6f405a00624","t13i311000_e8f1e7e78f70_d41ae481755e","t13i130900_f57a46bbacb6_e7c285222651","t12d3411h9_a634f799a498_52c4d8bb91c9","t12d3511h9_66c735deec94_52c4d8bb91c9","t12d6912h9_ea0618708e31_1da015a32102","t12d6912hq_ea0618708e31_1da015a32102"],"tls_client_hello":"16030105a8010005a403037b3ffdd448c84ec89cc9007bb27ab1babf4027ecdfdbbb1f57aa268b1f45733f200ae7ca8c9c627e78939c20461132273202b1e728d2425037003d9a22b5a6dee2001ac02bc02fc02cc030cca9cca8c009c013c00ac01413011302130301000541000b00020100ff010001000017000000120000000500050100000000000a000c000a6399001d001700180019000d001a0018080404030807080508060401050106010503060302010203002b00050403040303003304ea04e8639904c0b6e8556e4ff760fedced8149f2dc952695e86e1fb2c95241ca5c1f64269aeb54bb6c3ef018b83040c78c66ccdddbaf77158228f641e84a93e04a32e0c4b7bf02d0884c1724e7a3feca3769b96d2b9a04c6781ee6a8646c74bc60b30c07993476ea0cc10681aa0b7bfa22160069cea62c4351aaca7e533425d48e4b7286ff13397509776dd66ee4e4762d523e2a8c0c2875cb2265cc6bf003e8003e0512a5df790eb81392fee665ad07b8195a26599b8ca9939c82565de3042a2a158520238aad8b4cea096c7a963f14cb02712c017da363e3f13e057c7d32cb0c09c91670733a3138277bd027024016719245267b99e2ab1e53422a5d2968d5358d7c3b8f421c50f39822f859680f92ceb53921189c74ef5cc710992a2da8902bc2b2b715b79659057e3c826811a6702733f8d6812f96157141224360b5f44a20ee2844feb4669d40c867fa61dc0c3222981f15168120d5518323adfe501793aacbc77bafdd7355d8691b4701940aa336ddf42f7d78032cf3b52f97bb0bf98dc2178b786c1948c052f8cb127f27121ecc7cb7ba7b1a1c9c40e94fce8088da7838e8178e1fac6faf77b0ce1c4185a87d5ec5c9164500a325ad0311307b466840a186b2e8ce74e0b10d7c3a7f026dd18c12edf36aae0a05a95272c246112b92afbac38169c82187ea89d050a0365a1574fa5dacba559189367d76105e09046411177ba79434a0bb76b1aef1f83f95365efb5b46e376282f94162c837620a68bc7579d52930f3022a0c804c796005048b45010d0893ad5cb04222b8edb15eea045906154a5d1190c97aea485817949c5a33803b988586e071d3179841675322e0a623a93925c1c451ec6a97a6396c6bbaaadab3074277f82706ad73753b44055d1480ac2bb5174416fa7d552a95468077b4fe24b94f3cc7801444474e5c6cf1c8830d85d3b47407291b1063b970699390512aea2307923075a368a3bd6e9959a84897d948ca9e8512ff510a4a8652e33ab1459a546569c7022b81489790bb14b73512e19d6676b255a0bf4044e704c88aa3bfc880f88b88cc9abc2d41b4e472ccdb484c8aaf40855103ee0a809f917282e48474b45110be03d6b76c6f3f33483a4300067b6c33515118856745b3c0c358a80392e7d320d93ccb6015ab945f2780d8465e8dcc21cb0be7dc2a9ed235f5e485eee054b8581073d9932f50559d2745998d8aba3974f7a1327b67096e329a3465013ca475e2b0b5521bc984bf11244fc184135c35ac4b1146a65b5b98200986100e8290b44279006aec1b578e1c54159fb0f385097884bc7a27c2d5e49c853744e3a802a550846d9a143fed301987685f234520c652a2fac57bd713a7b309c81e81bf524a220052dca6cb3c3f1b9713ab647d55d867a5061a07a738c4f883062df9c963ea56ac050b46fd08c5d11650e765371e8473200999faac9b0164e035575155865b6a840d36a375328a0df7154b5c8ad01100993d95464365289728b5f61653c060c7df474b0a1271a94a5c935b2ea8657112270dc7aaa9411642c935d4cccc79521364d536f7fda4e1c78802f48b09acc66a0757023faa9929b5ac93b9f2af521aa9133368258b66440234941ae27654c3acc9368a05f7a2c38ba07fb544def004f979649dd2713a6e29b54f761164a00af96a1df81fb002aea7a2d6fd05c6ec1edaab7b885dd79fe952224db46ca7e0dad3a92001d0020b6e8556e4ff760fedced8149f2dc952695e86e1fb2c95241ca5c1f64269aeb54","tls_ja3":["674c9b60629e4885877f5ec76f21723e","013c30c8ce44c8b27e9ceb2a14db7283","03a3ad27040f733ee5c9915e0903d028","a96dc3876784813c57d302241e620acd","db8d4ad49cb378fa370b43a61a9b06b6"],"http_akin":["b11cun040_00040013_608dab68","b11cun020_00040010_724c10fb","b11cun000_00000000_334359b9","b10cun020_00000014_0a8d7f11"],"interactive":{"ssh_hassh":[],"tls_ja4":["t12d3411h9_a634f799a498_52c4d8bb91c9","t12d3511h9_66c735deec94_52c4d8bb91c9","t12d6912h9_ea0618708e31_1da015a32102","t12d6912hq_ea0618708e31_1da015a32102","t13i130900_f57a46bbacb6_e7c285222651"],"tls_ja3":["013c30c8ce44c8b27e9ceb2a14db7283","03a3ad27040f733ee5c9915e0903d028","674c9b60629e4885877f5ec76f21723e","a96dc3876784813c57d302241e620acd","db8d4ad49cb378fa370b43a61a9b06b6"]}},"fingerprint_peers":{"t13i311000_e8f1e7e78f70_d41ae481755e":741,"t13i130900_f57a46bbacb6_e7c285222651":2778,"t12d3411h9_a634f799a498_52c4d8bb91c9":0,"t12d3511h9_66c735deec94_52c4d8bb91c9":0,"t12d6912h9_ea0618708e31_1da015a32102":0,"t12d6912hq_ea0618708e31_1da015a32102":0,"b11cun040_00040013_608dab68":4347,"b11cun020_00040010_724c10fb":1721,"b11cun000_00000000_334359b9":80,"b10cun020_00000014_0a8d7f11":2036,"t13i1516h2_8daaf6152771_b6f405a00624":1,"t13i1515h2_8daaf6152771_d8a2da3f94cd":26},"akin_families":{"b11cun020_00040010_724c10fb":{"head":"b11cun020_00040010_724c10fb","shapes":2,"ips":1721},"b11cun000_00000000_334359b9":{"head":"b11cun000_00000000_334359b9","shapes":2,"ips":80}},"user_agents":["Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.27 Safari/537.36","Go-http-client/1.1","Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36","msnbot/1.1 ( http://search.msn.com/msnbot.htm)","Mozilla/5.0 (Linux; U; Android 1.5; de-ch; HTC Hero Build/CUPCAKE) AppleWebKit/528.5  (KHTML, like Gecko) Version/3.1.2 Mobile Safari/525.20.1","Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en) AppleWebKit/125.2 (KHTML, like Gecko) Safari/85.8","fasthttp","Mozilla/5.0 (Linux; Android 9; Redmi Note 8T) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36","Mozilla/5.0 (compatible; MSIE 8.0; Windows NT 5.0; Trident/3.0)","Mozilla/5.0 (Windows NT 6.1) AppleWebKit/5340 (KHTML, like Gecko) Chrome/44.0.808.0 Safari/5340","Mozilla/5.0 Mozilla/5.0 (Windows NT 5.0; rv:41.0) Gecko/20150620 Firefox/41.0","Mozilla/5.0 (Windows NT 6.0) AppleWebKit/5311 (KHTML, like Gecko) Chrome/47.0.836.0 Safari/5311","Mozilla/5.0 Mozilla/5.0 (Windows NT 6.1; rv:37.0) Gecko/20150818 Firefox/37.0","Mozilla/5.0 (Windows; U; Windows NT 6.1) AppleWebKit/534.36.2 (KHTML, like Gecko) Version/4.0 Safari/534.36.2","Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 5.0; Trident/4.0)","Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 5.0; Trident/4.0)"],"timeline":[{"date":"2026-07-26","count":5,"sessions":0},{"date":"2026-07-27","count":31,"sessions":0},{"date":"2026-07-28","count":9,"sessions":0},{"date":"2026-07-29","count":9,"sessions":0},{"date":"2026-07-30","count":13,"sessions":0},{"date":"2026-07-31","count":19,"sessions":0},{"date":"2026-08-01","count":18,"sessions":0},{"date":"2026-08-02","count":13,"sessions":0},{"date":"2026-08-03","count":12,"sessions":0},{"date":"2026-08-04","count":18,"sessions":0},{"date":"2026-08-05","count":31,"sessions":0},{"date":"2026-08-06","count":24,"sessions":0},{"date":"2026-08-07","count":25,"sessions":0},{"date":"2026-08-08","count":13,"sessions":0},{"date":"2026-08-09","count":19,"sessions":0},{"date":"2026-08-10","count":27,"sessions":0},{"date":"2026-08-11","count":24,"sessions":0},{"date":"2026-08-12","count":14,"sessions":0},{"date":"2026-08-13","count":14,"sessions":0},{"date":"2026-08-14","count":22,"sessions":0},{"date":"2026-08-15","count":22,"sessions":0},{"date":"2026-08-16","count":17,"sessions":0},{"date":"2026-08-17","count":21,"sessions":0},{"date":"2026-08-18","count":16,"sessions":0},{"date":"2026-08-19","count":23,"sessions":0},{"date":"2026-08-20","count":15,"sessions":0},{"date":"2026-08-21","count":23,"sessions":0},{"date":"2026-08-22","count":19,"sessions":0},{"date":"2026-08-23","count":32,"sessions":0},{"date":"2026-08-24","count":12,"sessions":0},{"date":"2026-08-25","count":28,"sessions":0},{"date":"2026-08-26","count":31,"sessions":0},{"date":"2026-08-27","count":15,"sessions":0},{"date":"2026-08-28","count":19,"sessions":0},{"date":"2026-08-29","count":16,"sessions":0},{"date":"2026-08-30","count":17,"sessions":0},{"date":"2026-08-31","count":24,"sessions":0},{"date":"2026-09-01","count":8,"sessions":0},{"date":"2026-09-02","count":18,"sessions":0},{"date":"2026-09-03","count":27,"sessions":0},{"date":"2026-09-04","count":20,"sessions":0},{"date":"2026-09-05","count":19,"sessions":0},{"date":"2026-09-06","count":16,"sessions":0},{"date":"2026-09-07","count":5,"sessions":0},{"date":"2026-09-08","count":18,"sessions":0},{"date":"2026-09-09","count":27,"sessions":0},{"date":"2026-09-10","count":19,"sessions":0},{"date":"2026-09-11","count":20,"sessions":0},{"date":"2026-09-12","count":4,"sessions":0},{"date":"2026-09-13","count":10,"sessions":0},{"date":"2026-09-14","count":8,"sessions":0},{"date":"2026-09-15","count":4,"sessions":0},{"date":"2026-09-16","count":7,"sessions":0},{"date":"2026-09-17","count":4,"sessions":0},{"date":"2026-09-18","count":5,"sessions":0},{"date":"2026-09-19","count":5,"sessions":0},{"date":"2026-09-20","count":6,"sessions":0},{"date":"2026-09-21","count":4,"sessions":0},{"date":"2026-09-22","count":4,"sessions":0},{"date":"2026-09-23","count":4,"sessions":0},{"date":"2026-09-24","count":8,"sessions":0},{"date":"2026-09-25","count":2,"sessions":0},{"date":"2026-09-26","count":6,"sessions":0},{"date":"2026-09-27","count":4,"sessions":0},{"date":"2026-09-28","count":21,"sessions":0},{"date":"2026-09-29","count":14,"sessions":0},{"date":"2026-09-30","count":24,"sessions":0},{"date":"2026-10-01","count":18,"sessions":0},{"date":"2026-10-02","count":32,"sessions":0},{"date":"2026-10-03","count":37,"sessions":0},{"date":"2026-10-04","count":25,"sessions":0},{"date":"2026-10-05","count":30,"sessions":0},{"date":"2026-10-06","count":19,"sessions":0},{"date":"2026-10-07","count":26,"sessions":0},{"date":"2026-10-08","count":23,"sessions":0},{"date":"2026-10-09","count":17,"sessions":0},{"date":"2026-10-10","count":22,"sessions":0},{"date":"2026-10-11","count":27,"sessions":0},{"date":"2026-10-12","count":24,"sessions":0},{"date":"2026-10-13","count":6,"sessions":0},{"date":"2026-10-14","count":26,"sessions":12},{"date":"2026-10-15","count":38,"sessions":20},{"date":"2026-10-16","count":46,"sessions":25},{"date":"2026-10-17","count":46,"sessions":19},{"date":"2026-10-18","count":31,"sessions":14},{"date":"2026-10-19","count":42,"sessions":32},{"date":"2026-10-20","count":28,"sessions":15},{"date":"2026-10-21","count":49,"sessions":92},{"date":"2026-10-22","count":58,"sessions":135},{"date":"2026-10-23","count":40,"sessions":27},{"date":"2026-10-24","count":9,"sessions":27}],"recent_events":[{"timestamp":"2026-10-24T05:00:26","port":42069,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:42069\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/aab9","summary":"","payload_hex":"474554202f6161623920485454502f312e310d0a486f73743a20<HONEYPOT>3a34323036390d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f37302e302e333533382e3737205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36","ja3":"674c9b60629e4885877f5ec76f21723e","session":"e32abaf4-04e7-489f-bd2f-904fb6c4b67c","seq":1,"duration_ms":101,"bytes_in":219,"bytes_out":78},{"timestamp":"2026-10-24T05:00:26","port":42069,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:42069\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/aaa9","summary":"","payload_hex":"474554202f6161613920485454502f312e310d0a486f73743a20<HONEYPOT>3a34323036390d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f37302e302e333533382e3737205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36","ja3":"674c9b60629e4885877f5ec76f21723e","session":"2d2ff6af-cbee-4ff5-af80-eae806ad858c","seq":1,"duration_ms":100,"bytes_in":219,"bytes_out":78},{"timestamp":"2026-10-24T04:34:45","port":31337,"proto":"tcp","app_proto":"http","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:31337\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/aab9","summary":"","payload_hex":"474554202f6161623920485454502f312e310d0a486f73743a203c484f4e4559504f543e3a33313333370d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f37302e302e333533382e3737205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36","ja3":"","session":"26d7b57e-4b49-43cf-aae4-b9a28b6b1270-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-24T04:34:44","port":31337,"proto":"tcp","app_proto":"http","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:31337\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"1.3","alpn":[],"url_path":"/aab9","summary":"","payload_hex":"474554202f6161623920485454502f312e310d0a486f73743a203c484f4e4559504f543e3a33313333370d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f37302e302e333533382e3737205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36","ja3":"674c9b60629e4885877f5ec76f21723e","session":"2f3229be-edb3-42bf-8955-813283e23365-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-24T04:34:44","port":31337,"proto":"tcp","app_proto":"http","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:31337\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/aaa9","summary":"","payload_hex":"474554202f6161613920485454502f312e310d0a486f73743a203c484f4e4559504f543e3a33313333370d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f37302e302e333533382e3737205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36","ja3":"","session":"c8936bfc-731b-47ae-9d13-d4076463bcc9-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-24T04:34:43","port":31337,"proto":"tcp","app_proto":"http","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:31337\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"1.3","alpn":[],"url_path":"/aaa9","summary":"","payload_hex":"474554202f6161613920485454502f312e310d0a486f73743a203c484f4e4559504f543e3a33313333370d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f37302e302e333533382e3737205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36","ja3":"674c9b60629e4885877f5ec76f21723e","session":"ef25555d-43dd-484a-9bce-c8c561259d42-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-24T04:24:57","port":8888,"proto":"tcp","app_proto":"","app_protocol":"http","host":"","headers":"{\"accept\":\"*/*\",\"user-agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.27 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e300d0a557365722d4167656e743a204d6f7a696c6c612f352e3020284d6163696e746f73683b20496e74656c204d6163204f5320582031305f31355f3729204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3130322e302e353030352e3237205361666172692f3533372e33360d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.27 Safari/537.36","ja3":"","session":"df56365d-ff8a-4ad0-99ad-7278bab5734e","seq":1,"duration_ms":100,"bytes_in":166,"bytes_out":78},{"timestamp":"2026-10-24T04:17:21","port":64359,"proto":"tcp","app_proto":"http","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:64359\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/aab9","summary":"","payload_hex":"474554202f6161623920485454502f312e310d0a486f73743a203c484f4e4559504f543e3a36343335390d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f37302e302e333533382e3737205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36","ja3":"","session":"4b94ec2f-1b3b-459b-b5e1-5186db237cca-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-24T04:17:20","port":64359,"proto":"tcp","app_proto":"http","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:64359\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"1.3","alpn":[],"url_path":"/aab9","summary":"","payload_hex":"474554202f6161623920485454502f312e310d0a486f73743a203c484f4e4559504f543e3a36343335390d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f37302e302e333533382e3737205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36","ja3":"674c9b60629e4885877f5ec76f21723e","session":"8ab2f29b-737d-46db-8c14-2fc82f229cb0-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-24T04:17:20","port":64359,"proto":"tcp","app_proto":"http","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:64359\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/aaa9","summary":"","payload_hex":"474554202f6161613920485454502f312e310d0a486f73743a203c484f4e4559504f543e3a36343335390d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f37302e302e333533382e3737205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36","ja3":"","session":"138082de-2bfd-450d-b8e5-03ac04b8c9d3-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true}],"http_methods":[{"method":"GET","count":3826}],"distinct_ports_total":114,"top_paths":[{"path":"/","count":1409,"ports":113},{"path":"/aaa9","count":1189,"ports":113},{"path":"/aab9","count":1187,"ports":113},{"path":"/favicon.ico","count":5,"ports":5},{"path":"/v1.18/containers/json","count":5,"ports":1},{"path":"/1.php","count":5,"ports":1},{"path":"/2.php","count":5,"ports":1},{"path":"/3.php","count":5,"ports":1},{"path":"/index.php","count":5,"ports":1},{"path":"/phpinfo.php","count":5,"ports":1},{"path":"/test.php","count":5,"ports":1},{"path":"/api/v1/users/search","count":3,"ports":1},{"path":"/v2/_catalog","count":2,"ports":1}],"distinct_paths_total":13,"top_snis":[],"top_hosts":[],"top_alpns":[{"value":"h2, http/1.1","count":4}],"banners":[],"credentials":[],"header_profile":{"signature":["Accept-Encoding","Connection","Host","User-Agent"],"representative":[{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Connection","value":"close","notable":false},{"name":"Host","value":"<HONEYPOT>:42069","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36","notable":false}],"distinct_sets":2,"events_with_headers":10},"tags":[{"tag_id":"CVE-2026-27771","tag_type":"cve","title":"Gitea Container Registry - Unauthorized Private Image Access","severity":"high","actively_exploited":false,"match_field":"url_path","matched_pattern":"/v2/_catalog","reference_urls":["https://blog.gitea.com/release-of-1.26.2/","https://github.com/go-gitea/gitea/pull/37290","https://github.com/go-gitea/gitea/pull/37610","https://orca.security/resources/blog/gitea-container-registry-vulnerability/"],"kev_date_added":null},{"tag_id":"logins","tag_type":"interactive","label":"logins","title":"Tried logins","sessions":9}]}