{"ip":"176.32.193.16","data_as_of":"2026-10-24T01:14:58+00:00","observed":true,"total_events":3908,"verdict":{"verdict":"malicious","label":"Exploit attempts observed","detail":"9 interactive login(s) succeeded","confidence":"high","network_type":null,"why":["9 interactive session(s) logged in successfully.","The interactive sensors answer as a real service and record what the client did once inside, so this is activity after access.","The first-packet sensors recorded 3,908 event(s) from this address as well.","Not in any known-scanner range.","Sent 566,737 bytes, which is sustained payload delivery."],"engagement":{"level":"payload","label":"Sustained payload","detail":"566,737 bytes sent","bytes_sent":566737,"session_seconds":32,"persistent":false},"basis":"interactive"},"first_seen":"2026-03-20T14:38:15","last_seen":"2026-10-24T00:18:23","events_24h":36,"events_7d":292,"interactive_sessions":396,"interactive_sessions_24h":32,"interactive_sessions_7d":339,"interactive_protocols":[{"protocol":"http","sessions":273},{"protocol":"tls","sessions":83},{"protocol":"cassandra","sessions":11},{"protocol":"http-proxy","sessions":5},{"protocol":"mqtt","sessions":4},{"protocol":"redis","sessions":3},{"protocol":"smtp","sessions":2},{"protocol":"mysql","sessions":2},{"protocol":"mongodb","sessions":2},{"protocol":"rdp","sessions":1},{"protocol":"postgres","sessions":1},{"protocol":"ftp","sessions":1},{"protocol":"kafka","sessions":1},{"protocol":"ssh","sessions":1}],"geo":{"country_code":"AM","country_name":"Armenia","region":"","city":"","lat":40.25,"lon":45.0,"asn":197834,"org":"Ucom CJSC"},"source_domain":null,"known_scanners":[],"scanner_tag":null,"cve_matches":[{"cve_id":"CVE-2026-27771","title":"Gitea Container Registry - Unauthorized Private Image Access","severity":"high","actively_exploited":false,"match_field":"url_path","matched_pattern":"/v2/_catalog","kev_date_added":null}],"malware":[],"udp":null,"interaction":{"window_days":90,"sessions":396,"first_seen":"2026-10-14T17:26:05","last_seen":"2026-10-24T00:18:23","verdicts":[{"verdict":"scan","sessions":286},{"verdict":"unknown","sessions":101},{"verdict":"credential","sessions":9}],"personas":[{"persona":"nginx@1.24.0, wordpress@6.5.2, leaks@2, miner@bfgminer 5.5.0, elasticsearch@6.8.23, winrm@Windows Server 2016, fortigate@7.0.5, gitlab@19.4.2","sessions":50},{"persona":"nginx@1.18.0, wordpress@6.5.2, leaks@1, miner@cgminer 4.11.1, elasticsearch@8.11.1, winrm@Windows Server 2019, fortigate@7.2.1","sessions":49},{"persona":"nginx@1.24.0, wordpress@6.5.2, leaks@2, miner@bfgminer 5.5.0, elasticsearch@6.8.23, winrm@Windows Server 2016, dlink-dir645@1.01, fortigate@7.0.5, gitlab@19.4.2","sessions":35},{"persona":"nginx@1.24.0, wordpress@6.5.2, leaks@2, miner@bfgminer 5.5.0, elasticsearch@6.8.23, winrm@Windows Server 2016, fortigate@7.0.5, docker@25.0.3","sessions":33},{"persona":"nginx@1.18.0, wordpress@6.5.2, leaks@1, miner@cgminer 4.11.1, elasticsearch@8.11.1, winrm@Windows Server 2019, fortigate@7.2.1, gitlab@19.4.2","sessions":30},{"persona":"nginx@1.18.0, wordpress@6.5.2, leaks@1, miner@cgminer 4.11.1, elasticsearch@8.11.1, winrm@Windows Server 2019, fortigate@7.2.1, docker@25.0.3","sessions":30},{"persona":"nginx@1.18.0, wordpress@6.5.2, leaks@1, miner@cgminer 4.11.1, elasticsearch@8.11.1, winrm@Windows Server 2019, discovery@igd 1.0, fortigate@7.2.1","sessions":28},{"persona":"nginx@1.24.0, wordpress@6.5.2, leaks@2, miner@bfgminer 5.5.0, elasticsearch@6.8.23, winrm@Windows Server 2016, dlink-dir645@1.01, fortigate@7.0.5","sessions":9},{"persona":"cassandra@4.1.3","sessions":6},{"persona":"nginx@1.24.0, wordpress@6.5.2, leaks@2, miner@bfgminer 5.5.0, elasticsearch@6.8.23, winrm@Windows Server 2016, fortigate@7.0.5","sessions":6},{"persona":"proxy@squid/4.13","sessions":5}],"services":[{"protocol":"http","port":80,"sessions":43},{"protocol":"http","port":443,"sessions":37},{"protocol":"tls","port":9876,"sessions":31},{"protocol":"tls","port":1197,"sessions":22},{"protocol":"http","port":9876,"sessions":17},{"protocol":"http","port":1197,"sessions":15},{"protocol":"http","port":1293,"sessions":14},{"protocol":"http","port":64359,"sessions":14},{"protocol":"http","port":120,"sessions":13},{"protocol":"cassandra","port":9042,"sessions":11},{"protocol":"tls","port":500,"sessions":10},{"protocol":"tls","port":1500,"sessions":10}],"logins":[{"username":"cassandra","password":"cassandra","password_sent":true,"service":"cql-auth","outcome":"success","tries":8,"last_seen":"2026-10-24T00:18:20"},{"username":"anonymous","password":"anonymous","password_sent":true,"service":"ftp-login","outcome":"success","tries":1,"last_seen":"2026-10-21T11:09:38"}],"commands":[],"downloads":[],"files":[{"sha256":"9b24580676101877b58a73d31f2fbba57274544070572dcfaa1da727af84472b","name":"query","size":44,"mime_type":"text/plain","kind":"cql-query","times":4,"first_seen":"2026-10-22T13:11:45","last_seen":"2026-10-24T00:18:18","virustotal":null},{"sha256":"68175b8767f30394c3b1fecd93d649ada10d913a5350d875ba66259ab36a2823","name":"query","size":27,"mime_type":"text/plain","kind":"cql-query","times":2,"first_seen":"2026-10-22T13:11:50","last_seen":"2026-10-24T00:18:22","virustotal":null},{"sha256":"f96c426f589d4a255e6e2eb34c05936f62f6414fb27374b529cea214e94ca541","name":"query","size":38,"mime_type":"text/plain","kind":"cql-query","times":2,"first_seen":"2026-10-22T13:11:49","last_seen":"2026-10-24T00:18:21","virustotal":null},{"sha256":"c46312d2d88562581a82c0c31baaf6595a3308c1273293e1a0107ca0a9eb7e1c","name":"query","size":26,"mime_type":"text/plain","kind":"cql-query","times":2,"first_seen":"2026-10-22T13:11:45","last_seen":"2026-10-24T00:18:18","virustotal":null},{"sha256":"022fb3e641810183f16bd1629b9572dedbf6d22ab0effe2a079365200799c5d0","name":"query","size":29,"mime_type":"text/plain","kind":"cql-query","times":1,"first_seen":"2026-10-22T13:11:45","last_seen":"2026-10-22T13:11:45","virustotal":null},{"sha256":"cf564a73abb74a3293e1f0cae0443f87109cedf2f42bc47a17abc0ea184d7c0e","name":"listing","size":266,"mime_type":"text/plain","kind":"ftp-listing","times":1,"first_seen":"2026-10-21T11:09:39","last_seen":"2026-10-21T11:09:39","virustotal":null}],"attack":[{"technique_id":"T1595","technique_name":"Active Scanning","tactic_id":"TA0043","tactic_name":"Reconnaissance","sessions":286},{"technique_id":"T1078","technique_name":"Valid Accounts","tactic_id":"TA0001","tactic_name":"Initial Access","sessions":9},{"technique_id":"T1110","technique_name":"Brute Force","tactic_id":"TA0006","tactic_name":"Credential Access","sessions":9}]},"top_ports":[{"port":9876,"proto":"tcp","label":"","count":114,"sessions":48},{"port":6379,"proto":"tcp","label":"Redis","count":153,"sessions":3},{"port":80,"proto":"tcp","label":"HTTP","count":99,"sessions":43},{"port":443,"proto":"tcp","label":"HTTPS","count":96,"sessions":37},{"port":9042,"proto":"tcp","label":"Cassandra","count":119,"sessions":11},{"port":64359,"proto":"tcp","label":"","count":106,"sessions":14},{"port":2375,"proto":"tcp","label":"Docker","count":105,"sessions":11},{"port":3306,"proto":"tcp","label":"MySQL","count":105,"sessions":2},{"port":5000,"proto":"tcp","label":"Web-alt","count":103,"sessions":2},{"port":9200,"proto":"tcp","label":"Elastic","count":100,"sessions":2},{"port":11211,"proto":"tcp","label":"Memcached","count":94,"sessions":0},{"port":3000,"proto":"tcp","label":"Web-alt","count":83,"sessions":8},{"port":27017,"proto":"tcp","label":"MongoDB","count":82,"sessions":2},{"port":3389,"proto":"tcp","label":"RDP","count":66,"sessions":1},{"port":22,"proto":"tcp","label":"SSH","count":51,"sessions":0}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i1515h2_8daaf6152771_d8a2da3f94cd","t13i1516h2_8daaf6152771_b6f405a00624","t13i311000_e8f1e7e78f70_d41ae481755e","t13i130900_f57a46bbacb6_e7c285222651","t11i200800_0bf03fa604e3_c3f51f8b1329","t12d3511h9_66c735deec94_52c4d8bb91c9","t12d6912h9_ea0618708e31_1da015a32102","t12d6912hq_ea0618708e31_1da015a32102"],"tls_client_hello":"16030105a8010005a403038b6f20857a77e40288ca3ce804338f7fc8a9a4e6538d737dc0de2a989cddb0c3209e6b7b46a23ef3a20b916cf73d9a40856eeab26fccdc08de1f6a4c6bdf3c0bc2001ac02bc02fc02cc030cca9cca8c009c013c00ac01413011302130301000541000b00020100ff010001000017000000120000000500050100000000000a000c000a6399001d001700180019000d001a0018080404030807080508060401050106010503060302010203002b00050403040303003304ea04e8639904c0bda7630c4e87141a667b44304c1a1de93d84d0a2aa686ee02a8e7f8d1dcdf5331c4ca05083bdb7d8a57bd032a993ca978b6989ec3ecf07304682256b482cc1ca0d8bf8ab4948cfa7922e9a032a14426e24ab5d75eb8f2d192059dc1331c94bd2613615276ab6d86f28e0277874b7e6d19fad00b6f063844e52bd70756f4eda940e5c9c8ba5823b204956f6563fc6c0b11c2cf11319337581a095c9485887ab4ab47d41ccdb9b512d907877c850d1409f3cf20fe728afb17b4d265a400d3cbd271638d24b37c290554557b902eabc9aa7c054ca20c58a69b700a85ac2446fba00073a6b0711aa5119514f915de0b18ad7b933f0511717805223769d53ec77c5fa30f3204c6eaaafbf568199ba40635341200b506d805a9346c4b1962aae7c7b7f5996eea334c6a617f80b2b410a25961a546b4b4a19b2530a844d21337554051f2264c241b7c9f38c65fb8c3468374f4cf6161ca9ad10193e3b68066d698ae9a88f5c72339ce6599a5a2cd9cb3087978e7b58093c9738247286bad916e950037acc4971488faec221dd17889e46ce2e91cfc7ab3d5db90b15d09314fa061623ac1b92835534aaabf94d9f6214ba841fc4486c4d9379227c42e8637776607f0998696781b55ab05b4a532cc14168c8e72420ca56405471aa2a4a2fe2647b397a829523aabc60ad2baeb2821af557a6a6f446047ace4a666d4da4a3277c7e17757d124337dcb670f4d0cfc2d89bfc1482b595b4c1e35884c41db8586798196bb463c7b37a9037733337acafc3f6cf59885c89364421f529c6a579099a49ade985b491342fa9a024c58b65b3973da0198a0ca10cb1b92f256acd37cf1ff682b4f523faca473d892be80162edb877b5d8af17a6901182832cc8a449f955d4841949089008a1ce9e6b9c44538253896bf126121f6568a77485ed69185cc7cd6a66b21a732d9e4b10d628381e1869d5f53b4f7a812a70452b68ba006c8e9508cae77c6c02e5afed00576fab289685373ee859adf847e247045f7c0bbd3a5095411c9ef57a317643bb883db57b60e0e1adebb4af14e227d05845075a87178662b653a762f3355c89563fc1820cf21ac1f80f2c94abc9fa88020a854bf63b4de18341f91339b5604a631470a6a13cb65c7a6173410c9f1d9a48f9ab7e0cb89d95d16157520d4bc98d3759b8ff73745b173b99b5aa9263768574a07adaaab0492436333ef3167f27e6562fb3aeeb9a7c2692ce3de935fba211085212f773b88d0c1cb7b56ebf5848b99742ddc349b5fc9ba3b2118b99cd0a996d3431cc107677777840fe1aa6682cac89f58675f3a5d4f1883030939a07939c1b6f2d2296bea663ce064de612673e7105026395bf73780961b610868d08f80ef87047bb0882b6024df7830df4523bea749041f7c29d4a8b7bb952fbe10bef65a62fb5614836912e746673b556c42c2b6552ba7ed6a4767a367e79bbb40c0242864926a4533271727941b6417320abbc3ad9eb16481690aa55287fb2c44f915af0d0ac39e5081ab15bf6e958754cbc54f27173d5af0f7b9c54f732c6b82adc4797b0d5767c35582a0a627c9c3f35d943f2c2496fd6940284cb6cf66e6d1925bcd1adf54b18e444b20aa66b74c67298b663a70144e6aac7e5051b9cbacae3753bf9455badb00c41cc5e51535b1d90ce0448fc4df10a05c7ec24ec5cb2b772ba4e660497879df10e3441263be2001d0020bda7630c4e87141a667b44304c1a1de93d84d0a2aa686ee02a8e7f8d1dcdf533","tls_ja3":["674c9b60629e4885877f5ec76f21723e","013c30c8ce44c8b27e9ceb2a14db7283","03a3ad27040f733ee5c9915e0903d028","18e9afaf91db6f8a2470e7435c2a1d6b","db8d4ad49cb378fa370b43a61a9b06b6"],"http_akin":["b11cun040_00040013_608dab68","b11cun020_00040010_724c10fb","b11cun000_00000000_334359b9","b10cun020_00000014_0a8d7f11"],"interactive":{"ssh_hassh":[],"tls_ja4":["t11i200800_0bf03fa604e3_c3f51f8b1329","t12d3511h9_66c735deec94_52c4d8bb91c9","t12d6912h9_ea0618708e31_1da015a32102","t12d6912hq_ea0618708e31_1da015a32102","t13i130900_f57a46bbacb6_e7c285222651"],"tls_ja3":["013c30c8ce44c8b27e9ceb2a14db7283","03a3ad27040f733ee5c9915e0903d028","18e9afaf91db6f8a2470e7435c2a1d6b","674c9b60629e4885877f5ec76f21723e","db8d4ad49cb378fa370b43a61a9b06b6"]}},"fingerprint_peers":{"t13i1515h2_8daaf6152771_d8a2da3f94cd":25,"t13i1516h2_8daaf6152771_b6f405a00624":1,"t13i311000_e8f1e7e78f70_d41ae481755e":746,"t13i130900_f57a46bbacb6_e7c285222651":2791,"t11i200800_0bf03fa604e3_c3f51f8b1329":0,"t12d3511h9_66c735deec94_52c4d8bb91c9":0,"t12d6912h9_ea0618708e31_1da015a32102":0,"t12d6912hq_ea0618708e31_1da015a32102":0,"b11cun040_00040013_608dab68":4345,"b11cun020_00040010_724c10fb":1714,"b11cun000_00000000_334359b9":80,"b10cun020_00000014_0a8d7f11":2036},"akin_families":{"b11cun000_00000000_334359b9":{"head":"b11cun000_00000000_334359b9","shapes":2,"ips":80}},"user_agents":["Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.27 Safari/537.36","Go-http-client/1.1","Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36","msnbot/1.1 ( http://search.msn.com/msnbot.htm)","Mozilla/5.0 (Linux; U; Android 1.5; de-ch; HTC Hero Build/CUPCAKE) AppleWebKit/528.5  (KHTML, like Gecko) Version/3.1.2 Mobile Safari/525.20.1","Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en) AppleWebKit/125.2 (KHTML, like Gecko) Safari/85.8","fasthttp","Mozilla/5.0 (Linux; Android 9; Redmi Note 8T) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36","Mozilla/5.0 (compatible; MSIE 8.0; Windows NT 5.0; Trident/3.0)","Mozilla/5.0 (Windows NT 6.1) AppleWebKit/5340 (KHTML, like Gecko) Chrome/44.0.808.0 Safari/5340","Mozilla/5.0 Mozilla/5.0 (Windows NT 5.0; rv:41.0) Gecko/20150620 Firefox/41.0","Mozilla/5.0 (Windows NT 6.0) AppleWebKit/5311 (KHTML, like Gecko) Chrome/47.0.836.0 Safari/5311","Mozilla/5.0 Mozilla/5.0 (Windows NT 6.1; rv:37.0) Gecko/20150818 Firefox/37.0","Mozilla/5.0 (Windows; U; Windows NT 6.1) AppleWebKit/534.36.2 (KHTML, like Gecko) Version/4.0 Safari/534.36.2","Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 5.0; Trident/4.0)","Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 5.0; Trident/4.0)"],"timeline":[{"date":"2026-07-26","count":6,"sessions":0},{"date":"2026-07-27","count":31,"sessions":0},{"date":"2026-07-28","count":9,"sessions":0},{"date":"2026-07-29","count":9,"sessions":0},{"date":"2026-07-30","count":13,"sessions":0},{"date":"2026-07-31","count":19,"sessions":0},{"date":"2026-08-01","count":18,"sessions":0},{"date":"2026-08-02","count":13,"sessions":0},{"date":"2026-08-03","count":12,"sessions":0},{"date":"2026-08-04","count":18,"sessions":0},{"date":"2026-08-05","count":31,"sessions":0},{"date":"2026-08-06","count":24,"sessions":0},{"date":"2026-08-07","count":25,"sessions":0},{"date":"2026-08-08","count":13,"sessions":0},{"date":"2026-08-09","count":19,"sessions":0},{"date":"2026-08-10","count":27,"sessions":0},{"date":"2026-08-11","count":24,"sessions":0},{"date":"2026-08-12","count":14,"sessions":0},{"date":"2026-08-13","count":14,"sessions":0},{"date":"2026-08-14","count":22,"sessions":0},{"date":"2026-08-15","count":22,"sessions":0},{"date":"2026-08-16","count":17,"sessions":0},{"date":"2026-08-17","count":21,"sessions":0},{"date":"2026-08-18","count":16,"sessions":0},{"date":"2026-08-19","count":23,"sessions":0},{"date":"2026-08-20","count":15,"sessions":0},{"date":"2026-08-21","count":23,"sessions":0},{"date":"2026-08-22","count":19,"sessions":0},{"date":"2026-08-23","count":32,"sessions":0},{"date":"2026-08-24","count":12,"sessions":0},{"date":"2026-08-25","count":28,"sessions":0},{"date":"2026-08-26","count":31,"sessions":0},{"date":"2026-08-27","count":15,"sessions":0},{"date":"2026-08-28","count":19,"sessions":0},{"date":"2026-08-29","count":16,"sessions":0},{"date":"2026-08-30","count":17,"sessions":0},{"date":"2026-08-31","count":24,"sessions":0},{"date":"2026-09-01","count":8,"sessions":0},{"date":"2026-09-02","count":18,"sessions":0},{"date":"2026-09-03","count":27,"sessions":0},{"date":"2026-09-04","count":20,"sessions":0},{"date":"2026-09-05","count":19,"sessions":0},{"date":"2026-09-06","count":16,"sessions":0},{"date":"2026-09-07","count":5,"sessions":0},{"date":"2026-09-08","count":18,"sessions":0},{"date":"2026-09-09","count":27,"sessions":0},{"date":"2026-09-10","count":19,"sessions":0},{"date":"2026-09-11","count":20,"sessions":0},{"date":"2026-09-12","count":4,"sessions":0},{"date":"2026-09-13","count":10,"sessions":0},{"date":"2026-09-14","count":8,"sessions":0},{"date":"2026-09-15","count":4,"sessions":0},{"date":"2026-09-16","count":7,"sessions":0},{"date":"2026-09-17","count":4,"sessions":0},{"date":"2026-09-18","count":5,"sessions":0},{"date":"2026-09-19","count":5,"sessions":0},{"date":"2026-09-20","count":6,"sessions":0},{"date":"2026-09-21","count":4,"sessions":0},{"date":"2026-09-22","count":4,"sessions":0},{"date":"2026-09-23","count":4,"sessions":0},{"date":"2026-09-24","count":8,"sessions":0},{"date":"2026-09-25","count":2,"sessions":0},{"date":"2026-09-26","count":6,"sessions":0},{"date":"2026-09-27","count":4,"sessions":0},{"date":"2026-09-28","count":21,"sessions":0},{"date":"2026-09-29","count":14,"sessions":0},{"date":"2026-09-30","count":24,"sessions":0},{"date":"2026-10-01","count":18,"sessions":0},{"date":"2026-10-02","count":32,"sessions":0},{"date":"2026-10-03","count":37,"sessions":0},{"date":"2026-10-04","count":25,"sessions":0},{"date":"2026-10-05","count":30,"sessions":0},{"date":"2026-10-06","count":19,"sessions":0},{"date":"2026-10-07","count":26,"sessions":0},{"date":"2026-10-08","count":23,"sessions":0},{"date":"2026-10-09","count":17,"sessions":0},{"date":"2026-10-10","count":22,"sessions":0},{"date":"2026-10-11","count":27,"sessions":0},{"date":"2026-10-12","count":24,"sessions":0},{"date":"2026-10-13","count":6,"sessions":0},{"date":"2026-10-14","count":26,"sessions":12},{"date":"2026-10-15","count":38,"sessions":20},{"date":"2026-10-16","count":46,"sessions":25},{"date":"2026-10-17","count":46,"sessions":19},{"date":"2026-10-18","count":31,"sessions":14},{"date":"2026-10-19","count":42,"sessions":32},{"date":"2026-10-20","count":28,"sessions":15},{"date":"2026-10-21","count":49,"sessions":92},{"date":"2026-10-22","count":58,"sessions":135},{"date":"2026-10-23","count":40,"sessions":27},{"date":"2026-10-24","count":0,"sessions":5}],"recent_events":[{"timestamp":"2026-10-24T00:18:23","port":9042,"proto":"tcp","app_proto":"cassandra","app_protocol":"cassandra","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0004\u0000\u0001@\n\u0000\u0000\u0000\u001d\u0000\fcde8120c0000\u0000\u0004&\u0000\u0000\u0013�\u0000\u0006^�\b���","payload_hex":"040001400a0000001d000c6364653831323063303030300004260000138800065e8b08e09892","method":"","user_agent":"","ja3":"","session":"05a87278-05d9-4101-8eaf-ea1912bd6367-11","seq":11,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"fc0770494d594b43","strings":["cde8120c0000"]},"interactive":true},{"timestamp":"2026-10-24T00:18:22","port":9042,"proto":"tcp","app_proto":"cassandra","app_protocol":"cassandra","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0004\u0000\u0001\u0000\t\u0000\u0000\u0000\u001f\u0000\u0000\u0000\u001bSELECT * from system.local;","payload_hex":"04000100090000001f0000001b53454c454354202a2066726f6d2073797374656d2e6c6f63616c3b","method":"","user_agent":"","ja3":"","session":"05a87278-05d9-4101-8eaf-ea1912bd6367-9","seq":9,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"8076b84df5a3a868","strings":["SELECT * from system.local;"],"iocs":{"domains":["system.local"]}},"interactive":true},{"timestamp":"2026-10-24T00:18:22","port":9042,"proto":"tcp","app_proto":"cassandra","app_protocol":"cassandra","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0004\u0000\u0000�\u0005\u0000\u0000\u0000\u0000","payload_hex":"040000c00500000000","method":"","user_agent":"","ja3":"","session":"05a87278-05d9-4101-8eaf-ea1912bd6367-7","seq":7,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-24T00:18:21","port":9042,"proto":"tcp","app_proto":"cassandra","app_protocol":"cassandra","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0004\u0000\u0001@\n\u0000\u0000\u0000\u001d\u0000\fcde8120c0000\u0000\u0004&\u0000\u0000\u0013�\u0000\u0006^�\b�g�","payload_hex":"040001400a0000001d000c6364653831323063303030300004260000138800065e8b08c767f2","method":"","user_agent":"","ja3":"","session":"87963652-9eaa-4838-8e9b-b1dcb18445da-11","seq":11,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"9193c55aaecf9f6f","strings":["cde8120c0000"]},"interactive":true},{"timestamp":"2026-10-24T00:18:21","port":9042,"proto":"tcp","app_proto":"cassandra","app_protocol":"cassandra","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0004\u0000\u0001\u0000\u0005\u0000\u0000\u0000\u0000","payload_hex":"040001000500000000","method":"","user_agent":"","ja3":"","session":"87963652-9eaa-4838-8e9b-b1dcb18445da-9","seq":9,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-24T00:18:20","port":9042,"proto":"tcp","app_proto":"cassandra","app_protocol":"cassandra","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0004\u0000\u0000�\t\u0000\u0000\u0000*\u0000\u0000\u0000&SELECT * FROM system_schema.keyspaces;","payload_hex":"040000c0090000002a0000002653454c454354202a2046524f4d2073797374656d5f736368656d612e6b65797370616365733b","method":"","user_agent":"","ja3":"","session":"87963652-9eaa-4838-8e9b-b1dcb18445da-7","seq":7,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"91d16b1d2b08c3d7","strings":["&SELECT * FROM system_schema.keyspaces;","*&SELECT * FROM system_schema.keyspaces;"]},"interactive":true},{"timestamp":"2026-10-24T00:18:20","port":9042,"proto":"tcp","app_proto":"cassandra","app_protocol":"cassandra","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0004\u0000\u0000�\u000f\u0000\u0000\u0000\u0018\u0000\u0000\u0000\u0014\u0000cassandra\u0000cassandra","payload_hex":"040000800f00000018000000140063617373616e6472610063617373616e647261","method":"","user_agent":"","ja3":"","session":"05a87278-05d9-4101-8eaf-ea1912bd6367-5","seq":5,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"a86fceb947885ddc","strings":["cassandra","cassandracassandra"]},"interactive":true},{"timestamp":"2026-10-24T00:18:20","port":9042,"proto":"tcp","app_proto":"cassandra","app_protocol":"cassandra","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0004\u0000\u0000@\u0001\u0000\u0000\u0000S\u0000\u0003\u0000\u000bCQL_VERSION\u0000\u00053.0.0\u0000\u000bDRIVER_NAME\u0000\u0016github.com/gocql/gocql\u0000\u000eDRIVER_VERSION\u0000\u0006v1.6.0","payload_hex":"0400004001000000530003000b43514c5f56455253494f4e0005332e302e30000b4452495645525f4e414d4500166769746875622e636f6d2f676f63716c2f676f63716c000e4452495645525f56455253494f4e000676312e362e30","method":"","user_agent":"","ja3":"","session":"05a87278-05d9-4101-8eaf-ea1912bd6367-3","seq":3,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"618cd86d74fa61e8","strings":["CQL_VERSION","3.0.0","DRIVER_NAME","github.com/gocql/gocql","DRIVER_VERSION","v1.6.0"],"iocs":{"domains":["github.com"],"paths":["/gocql/gocql"]}},"interactive":true},{"timestamp":"2026-10-24T00:18:20","port":9042,"proto":"tcp","app_proto":"cassandra","app_protocol":"cassandra","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0004\u0000\u0000\u0001\u0005\u0000\u0000\u0000\u0000","payload_hex":"040000010500000000","method":"","user_agent":"","ja3":"","session":"05a87278-05d9-4101-8eaf-ea1912bd6367-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-24T00:18:19","port":9042,"proto":"tcp","app_proto":"cassandra","app_protocol":"cassandra","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0004\u0000\u0002\u0000\u0005\u0000\u0000\u0000\u0000","payload_hex":"040002000500000000","method":"","user_agent":"","ja3":"","session":"fb0ee941-e1a1-4dd4-bfa8-a322f41be6f0-17","seq":17,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true}],"http_methods":[{"method":"GET","count":3807}],"distinct_ports_total":114,"top_paths":[{"path":"/","count":1405,"ports":113},{"path":"/aaa9","count":1182,"ports":113},{"path":"/aab9","count":1180,"ports":113},{"path":"/favicon.ico","count":5,"ports":5},{"path":"/v1.18/containers/json","count":5,"ports":1},{"path":"/1.php","count":5,"ports":1},{"path":"/2.php","count":5,"ports":1},{"path":"/3.php","count":5,"ports":1},{"path":"/index.php","count":5,"ports":1},{"path":"/phpinfo.php","count":5,"ports":1},{"path":"/test.php","count":5,"ports":1},{"path":"/v2/_catalog","count":2,"ports":1},{"path":"/api/v1/users/search","count":2,"ports":1}],"distinct_paths_total":13,"top_snis":[],"top_hosts":[],"top_alpns":[{"value":"h2, http/1.1","count":4}],"banners":[],"credentials":[],"header_profile":null,"tags":[{"tag_id":"CVE-2026-27771","tag_type":"cve","title":"Gitea Container Registry - Unauthorized Private Image Access","severity":"high","actively_exploited":false,"match_field":"url_path","matched_pattern":"/v2/_catalog","reference_urls":["https://blog.gitea.com/release-of-1.26.2/","https://github.com/go-gitea/gitea/pull/37290","https://github.com/go-gitea/gitea/pull/37610","https://orca.security/resources/blog/gitea-container-registry-vulnerability/"],"kev_date_added":null},{"tag_id":"logins","tag_type":"interactive","label":"logins","title":"Tried logins","sessions":9}]}