{"ip":"199.165.159.25","data_as_of":"2026-10-25T11:05:20+00:00","observed":true,"total_events":594,"verdict":{"verdict":"scanner","label":"Recognized scanner","detail":"shadowserver","confidence":"high","network_type":null,"why":["The address is in a published scanner range (shadowserver).","Known research and commercial scanners are labelled by operator and carry no threat verdict.","Counts include 143 interactive session(s) as well as first-packet events."],"engagement":{"level":"payload","label":"Sustained payload","detail":"126,526 bytes sent","bytes_sent":126526,"session_seconds":8,"persistent":false},"basis":"combined"},"first_seen":"2026-10-06T01:53:36","last_seen":"2026-10-25T10:50:45","events_24h":44,"events_7d":224,"interactive_sessions":143,"interactive_sessions_24h":21,"interactive_sessions_7d":115,"interactive_protocols":[{"protocol":"http","sessions":65},{"protocol":"tls","sessions":43},{"protocol":"adb","sessions":2},{"protocol":"msrpc","sessions":2},{"protocol":"oracle-tns","sessions":1},{"protocol":"modbus","sessions":1},{"protocol":"pcworx","sessions":1},{"protocol":"stratum","sessions":1},{"protocol":"smb","sessions":1}],"geo":{"country_code":"US","country_name":"United States","region":"","city":"","lat":37.751,"lon":-97.822,"asn":22168,"org":"The Shadowserver Foundation, Inc."},"source_domain":"scan-93-0.shadowserver.io","known_scanners":["shadowserver","Shadowserver Io"],"scanner_tag":{"key":"auto:shadowserver_io","label":"Shadowserver Io","category":"research","url":""},"cve_matches":[],"malware":[],"udp":{"source_verified":false,"window_days":90,"events":2,"protocols":[{"protocol":"udp","events":2}],"ports":[{"port":427,"events":1},{"port":12446,"events":1}],"dns_questions":[],"quic_clients":[],"first_seen":"2026-10-17T07:39:47","last_seen":"2026-10-21T03:40:09","recent":[{"timestamp":"2026-10-21T03:40:09","port":427,"src_port":34012,"proto":"udp","app_proto":"","app_protocol":"","summary":"\u0002\u0001\u0000\u0000\"\u0000\u0000\u0000\u0000\u0000\u0000\u0005\u0000\u0002en\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\bAAAAAAAA","payload_hex":"0201000022000000000000050002656e000000000000000000084141414141414141","sni":"","session":"abc4d91d-4cfc-465a-a3e7-cd1534f1df4b","bytes_in":34,"source_verified":false,"enriched":{"digest":"5951191f90ae199a","strings":["AAAAAAAA"]}},{"timestamp":"2026-10-17T07:39:47","port":12446,"src_port":41488,"proto":"udp","app_proto":"","app_protocol":"dtls","summary":"\u0016��\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u00006\u0001\u0000\u0000*\u0000\u0000\u0000\u0000\u0000\u0000\u0000*��\u0000\u0000\u0000\u0000|w@\u001e��\"��\u0018��\bʬ\nd/�\"d�\b�\u0016�\u00190\u0000\u0000\u0000\u0002\u0000/\u0001\u0000","payload_hex":"16feff000000000000000000360100002a000000000000002afefd000000007c77401e8ac822a0a018ff9308caac0a642fc92264bc08a81689193000000002002f0100","sni":"","session":"8116c040-c310-429a-8f7a-716e6ab67194","bytes_in":67,"source_verified":false}]},"interaction":{"window_days":90,"sessions":144,"first_seen":"2026-10-15T07:24:52","last_seen":"2026-10-25T09:43:31","verdicts":[{"verdict":"scan","sessions":78},{"verdict":"unknown","sessions":66}],"personas":[{"persona":"nginx@1.24.0, wordpress@6.5.2, leaks@2, miner@bfgminer 5.5.0, elasticsearch@6.8.23, winrm@Windows Server 2016, fortigate@7.0.5, gitlab@19.4.2","sessions":22},{"persona":"nginx@1.24.0, wordpress@6.5.2, leaks@2, miner@bfgminer 5.5.0, elasticsearch@6.8.23, winrm@Windows Server 2016, fortigate@7.0.5, docker@25.0.3","sessions":12},{"persona":"nginx@1.18.0, wordpress@6.5.2, leaks@1, miner@cgminer 4.11.1, elasticsearch@8.11.1, winrm@Windows Server 2019, fortigate@7.2.1","sessions":11},{"persona":"nginx@1.18.0, wordpress@6.5.2, leaks@1, miner@cgminer 4.11.1, elasticsearch@8.11.1, winrm@Windows Server 2019, fortigate@7.2.1, docker@25.0.3","sessions":10},{"persona":"nginx@1.18.0, wordpress@6.5.2, leaks@1, miner@cgminer 4.11.1, elasticsearch@8.11.1, winrm@Windows Server 2019, fortigate@7.2.1, gitlab@19.4.2","sessions":8},{"persona":"ics@Siemens S7-1200","sessions":2},{"persona":"msrpc@Windows Server 2016","sessions":2},{"persona":"nginx@1.18.0, wordpress@6.5.2, leaks@1, miner@cgminer 4.11.1, elasticsearch@8.11.1, winrm@Windows Server 2019, discovery@igd 1.0, fortigate@7.2.1","sessions":2},{"persona":"miner@cgminer 4.11.1","sessions":1},{"persona":"adb@Android 7.1 TV box","sessions":1},{"persona":"smb@Windows Server 2019","sessions":1}],"services":[{"protocol":"http","port":9192,"sessions":5},{"protocol":"http","port":1003,"sessions":4},{"protocol":"tls","port":1003,"sessions":4},{"protocol":"http","port":7900,"sessions":3},{"protocol":"http","port":23856,"sessions":3},{"protocol":"http","port":8531,"sessions":3},{"protocol":"tls","port":8531,"sessions":3},{"protocol":"http","port":2031,"sessions":3},{"protocol":"tcp","port":1200,"sessions":3},{"protocol":"http","port":31337,"sessions":3},{"protocol":"http","port":800,"sessions":3},{"protocol":"http","port":9090,"sessions":3}],"logins":[],"commands":[],"downloads":[],"files":[],"attack":[{"technique_id":"T1595","technique_name":"Active Scanning","tactic_id":"TA0043","tactic_name":"Reconnaissance","sessions":78}]},"top_ports":[{"port":8443,"proto":"tcp","label":"HTTPS-alt","count":24,"sessions":0},{"port":9090,"proto":"tcp","label":"Prometheus","count":16,"sessions":5},{"port":403,"proto":"tcp","label":"","count":16,"sessions":4},{"port":10514,"proto":"tcp","label":"","count":19,"sessions":0},{"port":9060,"proto":"tcp","label":"","count":19,"sessions":0},{"port":443,"proto":"tcp","label":"HTTPS","count":18,"sessions":0},{"port":14443,"proto":"tcp","label":"","count":17,"sessions":0},{"port":65443,"proto":"tcp","label":"","count":16,"sessions":0},{"port":7443,"proto":"tcp","label":"","count":16,"sessions":0},{"port":11443,"proto":"tcp","label":"","count":15,"sessions":0},{"port":5678,"proto":"tcp","label":"","count":15,"sessions":0},{"port":6443,"proto":"tcp","label":"k8s API","count":14,"sessions":0},{"port":4444,"proto":"tcp","label":"","count":14,"sessions":0},{"port":8090,"proto":"tcp","label":"","count":10,"sessions":1},{"port":80,"proto":"tcp","label":"HTTP","count":10,"sessions":0}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t12i130500_2d7513195f68_e51b7354d87f","t13i030800_55b375c5d22e_97f8aa674fd9","t12i130700_2d7513195f68_ac8bd4dd6c01","t12i030700_8b6334b1051c_ac8bd4dd6c01","ts3i080600_dafb69683c10_73823a8aef7a"],"tls_client_hello":"160301007b0100007703036a55ddf6e91829a16cd63e6874b2114b1331b18912583adbaae2fa9a0d11cb9800001ac02fc02bc011c007c013c009c014c00a0005002f0035c012000a01000034000500050100000000000a00080006001700180019000b00020100000d0010000e0401040302010203040105010601ff010001","tls_ja3":["caaddd3ed0a315543d761490b01b08e0","7f9afda94eb685adc8d863d934bf54bd","cba7f34191ef2379c1325641f6c6c4f4","22aa2bdb630c59d5ff64a34017e418c4","44609cef6ec7084c37c59c6317edb271"],"http_akin":["b11cun010_00040000_c4b2c4aa","b11cun020_00040010_724c10fb","b11cun040_00040016_aa48e2c8","b11cun040_00040016_50f90888"],"interactive":{"ssh_hassh":[],"tls_ja4":["t12i030700_8b6334b1051c_ac8bd4dd6c01","t12i130500_2d7513195f68_e51b7354d87f","t13i030800_55b375c5d22e_97f8aa674fd9","ts3i080600_dafb69683c10_73823a8aef7a"],"tls_ja3":["22aa2bdb630c59d5ff64a34017e418c4","44609cef6ec7084c37c59c6317edb271","7f9afda94eb685adc8d863d934bf54bd","cba7f34191ef2379c1325641f6c6c4f4"]}},"fingerprint_peers":{"t12i130500_2d7513195f68_e51b7354d87f":1084,"t13i030800_55b375c5d22e_97f8aa674fd9":856,"b11cun010_00040000_c4b2c4aa":936,"b11cun020_00040010_724c10fb":1855,"b11cun040_00040016_aa48e2c8":5557,"t12i130700_2d7513195f68_ac8bd4dd6c01":80,"t12i030700_8b6334b1051c_ac8bd4dd6c01":0,"ts3i080600_dafb69683c10_73823a8aef7a":0,"b11cun040_00040016_50f90888":67},"akin_families":{"b11cun020_00040010_724c10fb":{"head":"b11cun020_00040010_724c10fb","shapes":2,"ips":1855},"b11cun040_00040016_50f90888":{"head":"b11cun040_00040016_50f90888","shapes":3,"ips":67}},"user_agents":["Mozilla/5.0 (Windows NT 10.0; rv:125.0) Gecko/20100101 Firefox/125.0","Mozilla/5.0 (X11; Linux x86_64; rv:137.0) Gecko/20100101 Firefox/137.0","Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36","Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36","Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101 Firefox/102.0","Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/115.0","Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36","Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36","Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36","Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36 OPR/108.0.0.0","Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/110.0","Mozilla/5.0 (Windows NT 6.1; Win64; x64; ) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.156 Not(A:Brand/24 YaBrowser/24.4.1.899 Yowser/2.5  Safari/537.36","Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:141.0) Gecko/20100101 Firefox/141.0","Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36","Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36","Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:128.0) Gecko/20100101 Firefox/128.0"],"timeline":[{"date":"2026-10-06","count":36,"sessions":0},{"date":"2026-10-07","count":50,"sessions":0},{"date":"2026-10-08","count":21,"sessions":0},{"date":"2026-10-09","count":44,"sessions":0},{"date":"2026-10-10","count":16,"sessions":0},{"date":"2026-10-11","count":10,"sessions":0},{"date":"2026-10-12","count":29,"sessions":0},{"date":"2026-10-13","count":35,"sessions":0},{"date":"2026-10-14","count":47,"sessions":0},{"date":"2026-10-15","count":9,"sessions":8},{"date":"2026-10-16","count":21,"sessions":3},{"date":"2026-10-17","count":26,"sessions":13},{"date":"2026-10-18","count":45,"sessions":4},{"date":"2026-10-19","count":24,"sessions":10},{"date":"2026-10-20","count":25,"sessions":13},{"date":"2026-10-21","count":24,"sessions":19},{"date":"2026-10-22","count":38,"sessions":12},{"date":"2026-10-23","count":46,"sessions":37},{"date":"2026-10-24","count":4,"sessions":10},{"date":"2026-10-25","count":44,"sessions":14}],"recent_events":[{"timestamp":"2026-10-25T10:50:45","port":8000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:8000\",\"user-agent\":\"Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:109.0) Gecko/20100101 Firefox/115.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a383030300d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e5420362e313b2057696e36343b207836343b2072763a3130392e3029204765636b6f2f32303130303130312046697265666f782f3131352e300d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:109.0) Gecko/20100101 Firefox/115.0","ja3":"","session":"8ed8ed61-28e3-4304-87b0-fa4d277bf544","seq":1,"duration_ms":100,"bytes_in":173,"bytes_out":79},{"timestamp":"2026-10-25T09:43:31","port":7900,"proto":"tcp","app_proto":"http","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:7900\",\"user-agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","tls_version":"1.2","alpn":[],"url_path":"/feed/","summary":"","payload_hex":"474554202f666565642f20485454502f312e310d0a486f73743a203c484f4e4559504f543e3a373930300d0a557365722d4167656e743a204d6f7a696c6c612f352e3020284d6163696e746f73683b20496e74656c204d6163204f5320582031305f31355f3729204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3134302e302e302e30205361666172692f3533372e33360d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36","ja3":"cba7f34191ef2379c1325641f6c6c4f4","session":"c4e60ec0-a4eb-4317-80f1-48eafeacfe6e-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-25T09:43:08","port":7900,"proto":"tcp","app_proto":"http","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:7900\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:128.0) Gecko/20100101 Firefox/128.0\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a203c484f4e4559504f543e3a373930300d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b207836343b2072763a3132382e3029204765636b6f2f32303130303130312046697265666f782f3132382e300d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:128.0) Gecko/20100101 Firefox/128.0","ja3":"7f9afda94eb685adc8d863d934bf54bd","session":"0330b8e1-dde2-4191-93a1-0db3bd1ac817-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-25T09:42:42","port":7900,"proto":"tcp","app_proto":"http","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:7900\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:128.0) Gecko/20100101 Firefox/128.0\"}","body":"","sni":"","tls_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","tls_version":"1.2","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a203c484f4e4559504f543e3a373930300d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b207836343b2072763a3132382e3029204765636b6f2f32303130303130312046697265666f782f3132382e300d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:128.0) Gecko/20100101 Firefox/128.0","ja3":"cba7f34191ef2379c1325641f6c6c4f4","session":"2c5a5b20-c892-471c-a8d0-1f69d01174e1-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-25T09:37:46","port":2600,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:2600\",\"user-agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:142.0) Gecko/20100101 Firefox/142.0\"}","body":"","sni":"","tls_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","tls_version":"TLSv1.2","alpn":[],"url_path":"/migadmin/lang/legacy/legacy/filechecksum","summary":"","payload_hex":"474554202f6d696761646d696e2f6c616e672f6c65676163792f6c65676163792f66696c65636865636b73756d20485454502f312e310d0a486f73743a20<HONEYPOT>3a323630300d0a557365722d4167656e743a204d6f7a696c6c612f352e3020284d6163696e746f73683b20496e74656c204d6163204f5320582031302e31353b2072763a3134322e3029204765636b6f2f32303130303130312046697265666f782f3134322e300d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:142.0) Gecko/20100101 Firefox/142.0","ja3":"cba7f34191ef2379c1325641f6c6c4f4","session":"51e09192-234e-4ff2-b0ca-e994467cf6f4","seq":1,"duration_ms":154,"bytes_in":217,"bytes_out":79},{"timestamp":"2026-10-25T09:37:44","port":2600,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:2600\",\"user-agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:142.0) Gecko/20100101 Firefox/142.0\"}","body":"","sni":"","tls_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","tls_version":"TLSv1.2","alpn":[],"url_path":"/lang/legacy/filechecksum","summary":"","payload_hex":"474554202f6c616e672f6c65676163792f66696c65636865636b73756d20485454502f312e310d0a486f73743a20<HONEYPOT>3a323630300d0a557365722d4167656e743a204d6f7a696c6c612f352e3020284d6163696e746f73683b20496e74656c204d6163204f5320582031302e31353b2072763a3134322e3029204765636b6f2f32303130303130312046697265666f782f3134322e300d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:142.0) Gecko/20100101 Firefox/142.0","ja3":"cba7f34191ef2379c1325641f6c6c4f4","session":"6f8c0ded-1761-4a7c-b5f8-3e6666754c82","seq":1,"duration_ms":146,"bytes_in":201,"bytes_out":79},{"timestamp":"2026-10-25T09:37:31","port":2600,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:2600\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","tls_version":"TLSv1.2","alpn":[],"url_path":"/login?redir=/ng","summary":"","payload_hex":"474554202f6c6f67696e3f72656469723d2f6e6720485454502f312e310d0a486f73743a20<HONEYPOT>3a323630300d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3131392e302e302e30205361666172692f3533372e33360d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36","ja3":"cba7f34191ef2379c1325641f6c6c4f4","session":"6ce1d476-2167-47ac-bbbc-d24b7dea3bc5","seq":1,"duration_ms":145,"bytes_in":219,"bytes_out":79},{"timestamp":"2026-10-25T09:37:28","port":2600,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:2600\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36 Edg/138.0.0.0\"}","body":"","sni":"","tls_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","tls_version":"TLSv1.2","alpn":[],"url_path":"/fonts/ftnt-icons.woff","summary":"","payload_hex":"474554202f666f6e74732f66746e742d69636f6e732e776f666620485454502f312e310d0a486f73743a20<HONEYPOT>3a323630300d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3133382e302e302e30205361666172692f3533372e3336204564672f3133382e302e302e300d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36 Edg/138.0.0.0","ja3":"cba7f34191ef2379c1325641f6c6c4f4","session":"da3ed9f6-f0b7-4627-8851-ca0e82f16770","seq":1,"duration_ms":145,"bytes_in":239,"bytes_out":79},{"timestamp":"2026-10-25T09:37:26","port":2600,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:2600\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36 Edg/138.0.0.0\"}","body":"","sni":"","tls_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","tls_version":"TLSv1.2","alpn":[],"url_path":"/remote/logincheck","summary":"","payload_hex":"474554202f72656d6f74652f6c6f67696e636865636b20485454502f312e310d0a486f73743a20<HONEYPOT>3a323630300d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3133382e302e302e30205361666172692f3533372e3336204564672f3133382e302e302e300d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36 Edg/138.0.0.0","ja3":"cba7f34191ef2379c1325641f6c6c4f4","session":"82df21a1-6d1e-4c60-8b20-a9c0a9d75582","seq":1,"duration_ms":145,"bytes_in":235,"bytes_out":79},{"timestamp":"2026-10-25T09:37:23","port":2600,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:2600\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Edg/124.0.0.0\"}","body":"","sni":"","tls_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","tls_version":"TLSv1.2","alpn":[],"url_path":"/api/v2/static/not.found","summary":"","payload_hex":"474554202f6170692f76322f7374617469632f6e6f742e666f756e6420485454502f312e310d0a486f73743a20<HONEYPOT>3a323630300d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132342e302e302e30205361666172692f3533372e3336204564672f3132342e302e302e300d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Edg/124.0.0.0","ja3":"cba7f34191ef2379c1325641f6c6c4f4","session":"6485e62b-d80d-4358-a06a-7d2ad7790f02","seq":1,"duration_ms":145,"bytes_in":231,"bytes_out":79}],"http_methods":[{"method":"GET","count":592},{"method":"HEAD","count":3}],"distinct_ports_total":160,"top_paths":[{"path":"/","count":269,"ports":109},{"path":"/api/v2/static/not.found","count":40,"ports":26},{"path":"/migadmin/lang/legacy/legacy/filechecksum","count":40,"ports":26},{"path":"/login?redir=/ng","count":39,"ports":25},{"path":"/remote/logincheck","count":39,"ports":25},{"path":"/lang/legacy/filechecksum","count":39,"ports":25},{"path":"/fonts/ftnt-icons.woff","count":38,"ports":24},{"path":"/favicon.ico","count":33,"ports":26},{"path":"/feed/","count":26,"ports":24},{"path":"/lang//custom/sbin/init","count":7,"ports":7},{"path":"/lang/custom/sbin/init","count":4,"ports":3},{"path":"/geoserver/web/","count":3,"ports":2},{"path":"http://api.ipify.org/?format=json","count":3,"ports":3},{"path":"/static/lang//custom/sbin/init","count":3,"ports":3},{"path":"/static/lang/custom/sbin/init","count":3,"ports":3}],"distinct_paths_total":21,"top_snis":[],"top_hosts":[{"value":"api.ipify.org","count":3}],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","Accept-Encoding","Host","User-Agent"],"representative":[{"name":"Accept","value":"*/*","notable":false},{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Host","value":"<HONEYPOT>:8000","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:109.0) Gecko/20100101 Firefox/115.0","notable":false}],"distinct_sets":1,"events_with_headers":10},"tags":[]}