{"ip":"199.165.159.17","data_as_of":"2026-10-25T11:05:21+00:00","observed":true,"total_events":672,"verdict":{"verdict":"scanner","label":"Recognized scanner","detail":"shadowserver","confidence":"high","network_type":null,"why":["The address is in a published scanner range (shadowserver).","Known research and commercial scanners are labelled by operator and carry no threat verdict.","Counts include 152 interactive session(s) as well as first-packet events.","Interactive sessions: 1 interactive session(s) tried logins, none got in."],"engagement":{"level":"payload","label":"Sustained payload","detail":"149,686 bytes sent","bytes_sent":149686,"session_seconds":30,"persistent":false},"basis":"combined"},"first_seen":"2026-10-06T00:01:59","last_seen":"2026-10-25T09:52:52","events_24h":18,"events_7d":222,"interactive_sessions":152,"interactive_sessions_24h":13,"interactive_sessions_7d":119,"interactive_protocols":[{"protocol":"http","sessions":73},{"protocol":"tls","sessions":41},{"protocol":"postgres","sessions":3},{"protocol":"redis","sessions":3},{"protocol":"vnc","sessions":2},{"protocol":"telnet","sessions":1},{"protocol":"mysql","sessions":1},{"protocol":"mqtt","sessions":1},{"protocol":"atg","sessions":1},{"protocol":"stratum","sessions":1},{"protocol":"iec104","sessions":1},{"protocol":"ldap","sessions":1}],"geo":{"country_code":"US","country_name":"United States","region":"","city":"","lat":37.751,"lon":-97.822,"asn":22168,"org":"The Shadowserver Foundation, Inc."},"source_domain":"scan-92-0.shadowserver.io","known_scanners":["shadowserver","Shadowserver Io"],"scanner_tag":{"key":"auto:shadowserver_io","label":"Shadowserver Io","category":"research","url":""},"cve_matches":[],"malware":[],"udp":{"source_verified":false,"window_days":90,"events":5,"protocols":[{"protocol":"udp","events":5}],"ports":[{"port":123,"events":2},{"port":427,"events":1},{"port":12346,"events":1},{"port":13046,"events":1}],"dns_questions":[],"quic_clients":[],"first_seen":"2026-10-08T08:04:37","last_seen":"2026-10-22T06:10:28","recent":[{"timestamp":"2026-10-22T06:10:28","port":13046,"src_port":60377,"proto":"udp","app_proto":"","app_protocol":"dtls","summary":"\u0016��\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u00006\u0001\u0000\u0000*\u0000\u0000\u0000\u0000\u0000\u0000\u0000*��\u0000\u0000\u0000\u0000|w@\u001e��\"��\u0018��\bʬ\nd/�\"d�\b�\u0016�\u00190\u0000\u0000\u0000\u0002\u0000/\u0001\u0000","payload_hex":"16feff000000000000000000360100002a000000000000002afefd000000007c77401e8ac822a0a018ff9308caac0a642fc92264bc08a81689193000000002002f0100","sni":"","session":"86ad1853-0a02-4d58-af52-5430d5142a56","bytes_in":67,"source_verified":false},{"timestamp":"2026-10-21T06:34:29","port":123,"src_port":58501,"proto":"udp","app_proto":"","app_protocol":"ntp","summary":"\u0016\u0002\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000","payload_hex":"160200010000000000000000","sni":"","session":"8f29c4d8-9d58-4d39-9781-e91c90ee9531","bytes_in":12,"source_verified":false},{"timestamp":"2026-10-15T04:22:10","port":427,"src_port":51319,"proto":"udp","app_proto":"","app_protocol":"","summary":"\u0002\u0001\u0000\u0000\"\u0000\u0000\u0000\u0000\u0000\u0000\u0005\u0000\u0002en\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\bAAAAAAAA","payload_hex":"0201000022000000000000050002656e000000000000000000084141414141414141","sni":"","session":"4091af02-1765-45c3-a3d1-35eef6f1a6d7","bytes_in":34,"source_verified":false,"enriched":{"digest":"5951191f90ae199a","strings":["AAAAAAAA"]}},{"timestamp":"2026-10-09T08:18:40","port":12346,"src_port":56257,"proto":"udp","app_proto":"","app_protocol":"dtls","summary":"\u0016��\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u00006\u0001\u0000\u0000*\u0000\u0000\u0000\u0000\u0000\u0000\u0000*��\u0000\u0000\u0000\u0000|w@\u001e��\"��\u0018��\bʬ\nd/�\"d�\b�\u0016�\u00190\u0000\u0000\u0000\u0002\u0000/\u0001\u0000","payload_hex":"16feff000000000000000000360100002a000000000000002afefd000000007c77401e8ac822a0a018ff9308caac0a642fc92264bc08a81689193000000002002f0100","sni":"","session":"a9903be0-4c75-4d8a-a792-84f8501e91f4","bytes_in":67,"source_verified":false},{"timestamp":"2026-10-08T08:04:37","port":123,"src_port":59077,"proto":"udp","app_proto":"","app_protocol":"ntp","summary":"\u0017\u0000\u0003*\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000","payload_hex":"1700032a0000000000000000","sni":"","session":"a099a910-8646-43ba-90d2-f90095a0568e","bytes_in":12,"source_verified":false}]},"interaction":{"window_days":90,"sessions":153,"first_seen":"2026-10-15T00:53:51","last_seen":"2026-10-25T09:32:17","verdicts":[{"verdict":"scan","sessions":86},{"verdict":"unknown","sessions":66},{"verdict":"credential","sessions":1}],"personas":[{"persona":"nginx@1.24.0, wordpress@6.5.2, leaks@2, miner@bfgminer 5.5.0, elasticsearch@6.8.23, winrm@Windows Server 2016, fortigate@7.0.5, docker@25.0.3","sessions":30},{"persona":"nginx@1.24.0, wordpress@6.5.2, leaks@2, miner@bfgminer 5.5.0, elasticsearch@6.8.23, winrm@Windows Server 2016, fortigate@7.0.5, gitlab@19.4.2","sessions":16},{"persona":"nginx@1.18.0, wordpress@6.5.2, leaks@1, miner@cgminer 4.11.1, elasticsearch@8.11.1, winrm@Windows Server 2019, fortigate@7.2.1","sessions":10},{"persona":"nginx@1.18.0, wordpress@6.5.2, leaks@1, miner@cgminer 4.11.1, elasticsearch@8.11.1, winrm@Windows Server 2019, discovery@igd 1.0, fortigate@7.2.1","sessions":7},{"persona":"nginx@1.18.0, wordpress@6.5.2, leaks@1, miner@cgminer 4.11.1, elasticsearch@8.11.1, winrm@Windows Server 2019, fortigate@7.2.1, docker@25.0.3","sessions":6},{"persona":"redis@6.2.14","sessions":3},{"persona":"nginx@1.18.0, wordpress@6.5.2, leaks@1, miner@cgminer 4.11.1, elasticsearch@8.11.1, winrm@Windows Server 2019, fortigate@7.2.1, gitlab@19.4.2","sessions":3},{"persona":"postgres@12.18","sessions":3},{"persona":"vnc@TightVNC 2.8.81","sessions":2},{"persona":"ldap@Windows Server 2016","sessions":1},{"persona":"mqtt@1.6.9","sessions":1}],"services":[{"protocol":"http","port":12654,"sessions":5},{"protocol":"http","port":447,"sessions":4},{"protocol":"tls","port":447,"sessions":4},{"protocol":"http","port":8531,"sessions":4},{"protocol":"http","port":8020,"sessions":4},{"protocol":"postgres","port":5432,"sessions":3},{"protocol":"redis","port":6379,"sessions":3},{"protocol":"http","port":24056,"sessions":3},{"protocol":"http","port":811,"sessions":3},{"protocol":"http","port":8040,"sessions":3},{"protocol":"http","port":23456,"sessions":3},{"protocol":"http","port":4081,"sessions":3}],"logins":[{"username":"Accept-Encoding","password":" gzip:","password_sent":true,"service":"telnet","outcome":"failure","tries":1,"last_seen":"2026-10-21T04:56:15"},{"username":"User-Agent","password":" Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:140.0) Gecko/20100","password_sent":true,"service":"telnet","outcome":"failure","tries":1,"last_seen":"2026-10-21T04:56:13"},{"username":"GET / HTTP/1.1","password":"Host: :23","password_sent":true,"service":"telnet","outcome":"failure","tries":1,"last_seen":"2026-10-21T04:56:12"}],"commands":[],"downloads":[],"files":[],"attack":[{"technique_id":"T1595","technique_name":"Active Scanning","tactic_id":"TA0043","tactic_name":"Reconnaissance","sessions":86},{"technique_id":"T1078","technique_name":"Valid Accounts","tactic_id":"TA0001","tactic_name":"Initial Access","sessions":1},{"technique_id":"T1110","technique_name":"Brute Force","tactic_id":"TA0006","tactic_name":"Credential Access","sessions":1}]},"top_ports":[{"port":4573,"proto":"tcp","label":"","count":35,"sessions":4},{"port":4443,"proto":"tcp","label":"","count":28,"sessions":1},{"port":10443,"proto":"tcp","label":"","count":27,"sessions":1},{"port":14443,"proto":"tcp","label":"","count":25,"sessions":0},{"port":444,"proto":"tcp","label":"","count":24,"sessions":1},{"port":12443,"proto":"tcp","label":"","count":24,"sessions":0},{"port":20443,"proto":"tcp","label":"","count":23,"sessions":0},{"port":9090,"proto":"tcp","label":"Prometheus","count":16,"sessions":0},{"port":5678,"proto":"tcp","label":"","count":16,"sessions":0},{"port":10514,"proto":"tcp","label":"","count":16,"sessions":0},{"port":9060,"proto":"tcp","label":"","count":15,"sessions":0},{"port":4848,"proto":"tcp","label":"","count":15,"sessions":0},{"port":5665,"proto":"tcp","label":"","count":15,"sessions":0},{"port":65443,"proto":"tcp","label":"","count":14,"sessions":0},{"port":449,"proto":"tcp","label":"","count":14,"sessions":0}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t12i130500_2d7513195f68_e51b7354d87f","t13i030800_55b375c5d22e_97f8aa674fd9","t12i030700_8b6334b1051c_ac8bd4dd6c01","t12i130700_2d7513195f68_ac8bd4dd6c01","ts3i080600_dafb69683c10_73823a8aef7a"],"tls_client_hello":"160301007b010000770303692b0be477db9e47becf05a7d1e41c4b635655b84202cfc706fca189cc34866500001ac02fc02bc011c007c013c009c014c00a0005002f0035c012000a01000034000500050100000000000a00080006001700180019000b00020100000d0010000e0401040302010203040105010601ff010001","tls_ja3":["7f9afda94eb685adc8d863d934bf54bd","cba7f34191ef2379c1325641f6c6c4f4","22aa2bdb630c59d5ff64a34017e418c4","44609cef6ec7084c37c59c6317edb271","caaddd3ed0a315543d761490b01b08e0"],"http_akin":["b11cun030_00000016_6396c54d","b11cun040_00040016_aa48e2c8","b11cun040_00040016_50f90888","b11cun051_00240011_3f563462_x518b"],"interactive":{"ssh_hassh":[],"tls_ja4":["t12i030700_8b6334b1051c_ac8bd4dd6c01","t12i130500_2d7513195f68_e51b7354d87f","t12i130700_2d7513195f68_ac8bd4dd6c01","t13i030800_55b375c5d22e_97f8aa674fd9","ts3i080600_dafb69683c10_73823a8aef7a"],"tls_ja3":["22aa2bdb630c59d5ff64a34017e418c4","44609cef6ec7084c37c59c6317edb271","7f9afda94eb685adc8d863d934bf54bd","caaddd3ed0a315543d761490b01b08e0","cba7f34191ef2379c1325641f6c6c4f4"]}},"fingerprint_peers":{"t12i130500_2d7513195f68_e51b7354d87f":1084,"t13i030800_55b375c5d22e_97f8aa674fd9":856,"t12i030700_8b6334b1051c_ac8bd4dd6c01":0,"t12i130700_2d7513195f68_ac8bd4dd6c01":80,"ts3i080600_dafb69683c10_73823a8aef7a":0,"b11cun040_00040016_aa48e2c8":5557,"b11cun040_00040016_50f90888":67,"b11cun051_00240011_3f563462_x518b":423,"b11cun030_00000016_6396c54d":61},"akin_families":{"b11cun030_00000016_6396c54d":{"head":"b11cun040_00040016_50f90888","shapes":3,"ips":67},"b11cun040_00040016_50f90888":{"head":"b11cun040_00040016_50f90888","shapes":3,"ips":67}},"user_agents":["Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Edg/124.0.0.0","Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36 Edg/140.0.0.0","Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36 OPR/95.0.0.0","Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/109.0","Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36","Mozilla/5.0 (X11; Linux x86_64; rv:108.0) Gecko/20100101 Firefox/108.0","Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.3","Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 YaBrowser/25.8.0.0 Safari/537.36","Mozilla/5.0 (iPad; CPU OS 15_7 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/15.6,2 Mobile/15E148 Safari/604.1","Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0","Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36","Mozilla/5.0 (Windows NT 6.1; WOW64; rv:54.0) Gecko/20100101 Firefox/54.0","Mozilla/5.0 (Windows NT 10.0; rv:125.0) Gecko/20100101 Firefox/125.0","Mozilla/5.0 (Windows NT 10.0; rv:109.0) Gecko/20100101 Firefox/115.0","Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:125.0) Gecko/20100101 Firefox/125.0","Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36"],"timeline":[{"date":"2026-10-06","count":24,"sessions":0},{"date":"2026-10-07","count":34,"sessions":0},{"date":"2026-10-08","count":30,"sessions":0},{"date":"2026-10-09","count":17,"sessions":0},{"date":"2026-10-10","count":27,"sessions":0},{"date":"2026-10-11","count":60,"sessions":0},{"date":"2026-10-12","count":34,"sessions":0},{"date":"2026-10-13","count":31,"sessions":0},{"date":"2026-10-14","count":36,"sessions":0},{"date":"2026-10-15","count":40,"sessions":14},{"date":"2026-10-16","count":20,"sessions":15},{"date":"2026-10-17","count":64,"sessions":2},{"date":"2026-10-18","count":45,"sessions":8},{"date":"2026-10-19","count":36,"sessions":46},{"date":"2026-10-20","count":36,"sessions":19},{"date":"2026-10-21","count":30,"sessions":9},{"date":"2026-10-22","count":25,"sessions":7},{"date":"2026-10-23","count":60,"sessions":13},{"date":"2026-10-24","count":5,"sessions":9},{"date":"2026-10-25","count":18,"sessions":10}],"recent_events":[{"timestamp":"2026-10-25T09:52:52","port":24056,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\":24056\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36 OPR/107.0.0.0\"}","body":"","sni":"","tls_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","tls_version":"TLSv1.2","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a203a32343035360d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132312e302e302e30205361666172692f3533372e3336204f50522f3130372e302e302e300d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36 OPR/107.0.0.0","ja3":"cba7f34191ef2379c1325641f6c6c4f4","session":"3f7ec9cf-0b69-476b-ac29-8923b2e65305","seq":1,"duration_ms":145,"bytes_in":219,"bytes_out":79},{"timestamp":"2026-10-25T09:32:17","port":8006,"proto":"tcp","app_proto":"http","app_protocol":"http","host":"","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\":8006\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36 OPR/108.0.0.0\"}","body":"","sni":"","tls_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","tls_version":"1.2","alpn":[],"url_path":"/feed/","summary":"","payload_hex":"474554202f666565642f20485454502f312e310d0a486f73743a203c484f4e4559504f543e3a383030360d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132322e302e302e30205361666172692f3533372e3336204f50522f3130382e302e302e300d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36 OPR/108.0.0.0","ja3":"cba7f34191ef2379c1325641f6c6c4f4","session":"cf8f6d29-4d71-40be-ab2c-b9dcb1d7f541-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-25T09:30:56","port":8006,"proto":"tcp","app_proto":"http","app_protocol":"http","host":"","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\":8006\",\"user-agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","tls_version":"1.2","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a203c484f4e4559504f543e3a383030360d0a557365722d4167656e743a204d6f7a696c6c612f352e3020284d6163696e746f73683b20496e74656c204d6163204f5320582031305f31355f3729204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3130372e302e302e30205361666172692f3533372e33360d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36","ja3":"cba7f34191ef2379c1325641f6c6c4f4","session":"0e94db48-a006-4403-8f0d-b37ebb575b5d-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-25T09:16:58","port":5988,"proto":"tcp","app_proto":"http","app_protocol":"http","host":"","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\":5988\",\"user-agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Safari/605.1.15\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/feed/","summary":"","payload_hex":"474554202f666565642f20485454502f312e310d0a486f73743a203c484f4e4559504f543e3a353938380d0a557365722d4167656e743a204d6f7a696c6c612f352e3020284d6163696e746f73683b20496e74656c204d6163204f5320582031305f31355f3729204170706c655765624b69742f3630352e312e313520284b48544d4c2c206c696b65204765636b6f292056657273696f6e2f31372e342e31205361666172692f3630352e312e31350d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Safari/605.1.15","ja3":"","session":"4cce6a46-9bb3-4d14-a3b8-c2ce2c574989-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-25T09:15:55","port":5988,"proto":"tcp","app_proto":"http","app_protocol":"http","host":"","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\":5988\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36 Edg/110.0.1587.50\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a203c484f4e4559504f543e3a353938380d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3131302e302e302e30205361666172692f3533372e3336204564672f3131302e302e313538372e35300d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36 Edg/110.0.1587.50","ja3":"","session":"101f8e31-bbbe-475d-b4df-1f62632b6e16-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-25T08:55:25","port":1801,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0010�\u000b\u0000LIOR<\u0002\u0000\u0000����\u0000\u0000\u0002\u0000�XsUP���I���\u0011�&�\u0007��CL9\u0011�DE�x����N��\u001d\u0010\u0003\u0000\u0000ZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZ","payload_hex":"10c00b004c494f523c020000ffffffff00000200d1587355509195954997b6e611ea26c60789cd434c39118f44459078909ea0fc4ecade1d100300005a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a5a","method":"","user_agent":"","ja3":"","session":"e70940c1-b814-4cf6-be00-223413f94250","seq":1,"duration_ms":100,"bytes_in":572,"bytes_out":14,"enriched":{"digest":"c5e5c25daaad3dce","strings":["LIOR<","XsUP","ZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZ…"]}},{"timestamp":"2026-10-25T08:33:43","port":449,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\":449\",\"user-agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:62.0) Gecko/20100101 Firefox/62.0\"}","body":"","sni":"","tls_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","tls_version":"TLSv1.2","alpn":[],"url_path":"/migadmin/lang/legacy/legacy/filechecksum","summary":"","payload_hex":"474554202f6d696761646d696e2f6c616e672f6c65676163792f6c65676163792f66696c65636865636b73756d20485454502f312e310d0a486f73743a203a3434390d0a557365722d4167656e743a204d6f7a696c6c612f352e3020284d6163696e746f73683b20496e74656c204d6163204f5320582031302e31343b2072763a36322e3029204765636b6f2f32303130303130312046697265666f782f36322e300d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:62.0) Gecko/20100101 Firefox/62.0","ja3":"cba7f34191ef2379c1325641f6c6c4f4","session":"5f95fad1-5568-477d-b1e5-43e6ceea8a8f","seq":1,"duration_ms":146,"bytes_in":214,"bytes_out":79},{"timestamp":"2026-10-25T08:33:41","port":449,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\":449\",\"user-agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:62.0) Gecko/20100101 Firefox/62.0\"}","body":"","sni":"","tls_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","tls_version":"TLSv1.2","alpn":[],"url_path":"/lang/legacy/filechecksum","summary":"","payload_hex":"474554202f6c616e672f6c65676163792f66696c65636865636b73756d20485454502f312e310d0a486f73743a203a3434390d0a557365722d4167656e743a204d6f7a696c6c612f352e3020284d6163696e746f73683b20496e74656c204d6163204f5320582031302e31343b2072763a36322e3029204765636b6f2f32303130303130312046697265666f782f36322e300d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:62.0) Gecko/20100101 Firefox/62.0","ja3":"cba7f34191ef2379c1325641f6c6c4f4","session":"a4797669-59c5-4531-9dfb-797f9163e5df","seq":1,"duration_ms":145,"bytes_in":198,"bytes_out":79},{"timestamp":"2026-10-25T08:33:27","port":449,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\":449\",\"user-agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.0 Safari/605.1.15\"}","body":"","sni":"","tls_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","tls_version":"TLSv1.2","alpn":[],"url_path":"/login?redir=/ng","summary":"","payload_hex":"474554202f6c6f67696e3f72656469723d2f6e6720485454502f312e310d0a486f73743a203a3434390d0a557365722d4167656e743a204d6f7a696c6c612f352e3020284d6163696e746f73683b20496e74656c204d6163204f5320582031305f31355f3729204170706c655765624b69742f3630352e312e313520284b48544d4c2c206c696b65204765636b6f292056657273696f6e2f32362e30205361666172692f3630352e312e31350d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.0 Safari/605.1.15","ja3":"cba7f34191ef2379c1325641f6c6c4f4","session":"c72a9862-b51c-4c2f-a29c-90b86bdd3872","seq":1,"duration_ms":146,"bytes_in":224,"bytes_out":79},{"timestamp":"2026-10-25T08:33:24","port":449,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\":449\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:143.0) Gecko/20100101 Firefox/143.0\"}","body":"","sni":"","tls_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","tls_version":"TLSv1.2","alpn":[],"url_path":"/fonts/ftnt-icons.woff","summary":"","payload_hex":"474554202f666f6e74732f66746e742d69636f6e732e776f666620485454502f312e310d0a486f73743a203a3434390d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b207836343b2072763a3134332e3029204765636b6f2f32303130303130312046697265666f782f3134332e300d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:143.0) Gecko/20100101 Firefox/143.0","ja3":"cba7f34191ef2379c1325641f6c6c4f4","session":"dbd74f6e-fc26-45ad-87a4-bdce8ef8f6f6","seq":1,"duration_ms":145,"bytes_in":193,"bytes_out":79}],"http_methods":[{"method":"GET","count":687},{"method":"HEAD","count":3},{"method":"CONNECT","count":2},{"method":"POST","count":2}],"distinct_ports_total":168,"top_paths":[{"path":"/","count":303,"ports":121},{"path":"/api/v2/static/not.found","count":50,"ports":25},{"path":"/remote/logincheck","count":50,"ports":25},{"path":"/lang/legacy/filechecksum","count":49,"ports":25},{"path":"/migadmin/lang/legacy/legacy/filechecksum","count":49,"ports":25},{"path":"/fonts/ftnt-icons.woff","count":48,"ports":25},{"path":"/login?redir=/ng","count":47,"ports":25},{"path":"/feed/","count":30,"ports":27},{"path":"/favicon.ico","count":27,"ports":22},{"path":"/static/lang/custom/sbin/init","count":9,"ports":7},{"path":"/lang//custom/sbin/init","count":6,"ports":6},{"path":"/static/lang//custom/sbin/init","count":6,"ports":6},{"path":"/geoserver/web/","count":3,"ports":3},{"path":"http://api.ipify.org/?format=json","count":3,"ports":3},{"path":"/selfupdate/wuident.cab","count":3,"ports":1}],"distinct_paths_total":23,"top_snis":[],"top_hosts":[{"value":"api.ipify.org","count":3},{"value":"www.shadowserver.org","count":2}],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","Accept-Encoding","Host","User-Agent"],"representative":[{"name":"Accept","value":"*/*","notable":false},{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Host","value":":24056","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36 OPR/107.0.0.0","notable":false}],"distinct_sets":1,"events_with_headers":9},"tags":[{"tag_id":"logins","tag_type":"interactive","label":"logins","title":"Tried logins","sessions":2}]}