{"ip":"199.165.159.49","data_as_of":"2026-10-23T21:35:27+00:00","observed":true,"total_events":623,"verdict":{"verdict":"scanner","label":"Recognized scanner","detail":"shadowserver","confidence":"high","network_type":null,"why":["The address is in a published scanner range (shadowserver).","Known research and commercial scanners are labelled by operator and carry no threat verdict.","Counts include 113 interactive session(s) as well as first-packet events."],"engagement":{"level":"payload","label":"Sustained payload","detail":"134,335 bytes sent","bytes_sent":134335,"session_seconds":3,"persistent":false},"basis":"combined"},"first_seen":"2026-10-06T01:30:03","last_seen":"2026-10-23T14:32:36","events_24h":43,"events_7d":215,"interactive_sessions":113,"interactive_sessions_24h":21,"interactive_sessions_7d":102,"interactive_protocols":[{"protocol":"http","sessions":53},{"protocol":"tls","sessions":26},{"protocol":"ssh","sessions":2},{"protocol":"mongodb","sessions":2},{"protocol":"iec104","sessions":2},{"protocol":"msrpc","sessions":2},{"protocol":"amqp","sessions":2},{"protocol":"afp","sessions":1},{"protocol":"ftp","sessions":1},{"protocol":"enip","sessions":1},{"protocol":"pcworx","sessions":1},{"protocol":"pjl","sessions":1},{"protocol":"kerberos","sessions":1},{"protocol":"fox","sessions":1}],"geo":{"country_code":"US","country_name":"United States","region":"","city":"","lat":37.751,"lon":-97.822,"asn":22168,"org":"The Shadowserver Foundation, Inc."},"source_domain":"scan-96-0.shadowserver.io","known_scanners":["shadowserver","Shadowserver Io"],"scanner_tag":{"key":"auto:shadowserver_io","label":"Shadowserver Io","category":"research","url":""},"cve_matches":[],"malware":[],"udp":{"source_verified":false,"window_days":90,"events":3,"protocols":[{"protocol":"udp","events":3}],"ports":[{"port":12346,"events":1},{"port":12646,"events":1},{"port":12946,"events":1}],"dns_questions":[],"quic_clients":[],"first_seen":"2026-10-17T07:57:04","last_seen":"2026-10-22T08:05:07","recent":[{"timestamp":"2026-10-22T08:05:07","port":12346,"src_port":41065,"proto":"udp","app_proto":"","app_protocol":"dtls","summary":"\u0016��\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u00006\u0001\u0000\u0000*\u0000\u0000\u0000\u0000\u0000\u0000\u0000*��\u0000\u0000\u0000\u0000|w@\u001e��\"��\u0018��\bʬ\nd/�\"d�\b�\u0016�\u00190\u0000\u0000\u0000\u0002\u0000/\u0001\u0000","payload_hex":"16feff000000000000000000360100002a000000000000002afefd000000007c77401e8ac822a0a018ff9308caac0a642fc92264bc08a81689193000000002002f0100","sni":"","session":"71c62d71-bde6-4093-8f5b-a8f7fc93dace","bytes_in":67,"source_verified":false},{"timestamp":"2026-10-21T00:35:51","port":12646,"src_port":54766,"proto":"udp","app_proto":"","app_protocol":"dtls","summary":"\u0016��\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u00006\u0001\u0000\u0000*\u0000\u0000\u0000\u0000\u0000\u0000\u0000*��\u0000\u0000\u0000\u0000|w@\u001e��\"��\u0018��\bʬ\nd/�\"d�\b�\u0016�\u00190\u0000\u0000\u0000\u0002\u0000/\u0001\u0000","payload_hex":"16feff000000000000000000360100002a000000000000002afefd000000007c77401e8ac822a0a018ff9308caac0a642fc92264bc08a81689193000000002002f0100","sni":"","session":"1f5fe166-8753-4020-89ad-0518f81c6c45","bytes_in":67,"source_verified":false},{"timestamp":"2026-10-17T07:57:04","port":12946,"src_port":43610,"proto":"udp","app_proto":"","app_protocol":"dtls","summary":"\u0016��\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u00006\u0001\u0000\u0000*\u0000\u0000\u0000\u0000\u0000\u0000\u0000*��\u0000\u0000\u0000\u0000|w@\u001e��\"��\u0018��\bʬ\nd/�\"d�\b�\u0016�\u00190\u0000\u0000\u0000\u0002\u0000/\u0001\u0000","payload_hex":"16feff000000000000000000360100002a000000000000002afefd000000007c77401e8ac822a0a018ff9308caac0a642fc92264bc08a81689193000000002002f0100","sni":"","session":"b00402ed-ca79-426d-9f83-612ab5e66aff","bytes_in":67,"source_verified":false}]},"interaction":{"window_days":90,"sessions":113,"first_seen":"2026-10-15T06:08:14","last_seen":"2026-10-23T14:32:36","verdicts":[{"verdict":"scan","sessions":69},{"verdict":"unknown","sessions":44}],"personas":[{"persona":"nginx@1.24.0, wordpress@6.5.2, leaks@2, miner@bfgminer 5.5.0, elasticsearch@6.8.23, winrm@Windows Server 2016, fortigate@7.0.5, docker@25.0.3","sessions":23},{"persona":"nginx@1.18.0, wordpress@6.5.2, leaks@1, miner@cgminer 4.11.1, elasticsearch@8.11.1, winrm@Windows Server 2019, fortigate@7.2.1","sessions":11},{"persona":"nginx@1.24.0, wordpress@6.5.2, leaks@2, miner@bfgminer 5.5.0, elasticsearch@6.8.23, winrm@Windows Server 2016, fortigate@7.0.5, gitlab@19.4.2","sessions":10},{"persona":"nginx@1.18.0, wordpress@6.5.2, leaks@1, miner@cgminer 4.11.1, elasticsearch@8.11.1, winrm@Windows Server 2019, fortigate@7.2.1, gitlab@19.4.2","sessions":4},{"persona":"ics@Schneider Modicon M340","sessions":3},{"persona":"nginx@1.18.0, wordpress@6.5.2, leaks@1, miner@cgminer 4.11.1, elasticsearch@8.11.1, winrm@Windows Server 2019, fortigate@7.2.1, docker@25.0.3","sessions":2},{"persona":"ics@Siemens S7-1200","sessions":2},{"persona":"mongodb@7.0.5","sessions":2},{"persona":"nginx@1.24.0, wordpress@6.5.2, leaks@2, miner@bfgminer 5.5.0, elasticsearch@6.8.23, winrm@Windows Server 2016, fortigate@7.0.5","sessions":2},{"persona":"linux-ubuntu@24.04","sessions":2},{"persona":"msrpc@Windows Server 2016","sessions":2}],"services":[{"protocol":"http","port":2083,"sessions":3},{"protocol":"http","port":8015,"sessions":3},{"protocol":"http","port":11453,"sessions":3},{"protocol":"http","port":11443,"sessions":3},{"protocol":"http","port":58888,"sessions":3},{"protocol":"http","port":5080,"sessions":3},{"protocol":"tls","port":9192,"sessions":2},{"protocol":"http","port":811,"sessions":2},{"protocol":"tls","port":4117,"sessions":2},{"protocol":"http","port":9593,"sessions":2},{"protocol":"http","port":32400,"sessions":2},{"protocol":"http","port":8030,"sessions":2}],"logins":[],"commands":[],"downloads":[],"files":[{"sha256":"06c2cdac76e49745e90dca2a1b524c9071e568300e8fde8308ed2abf4b823aeb","name":"job-1","size":128,"mime_type":"application/octet-stream","kind":"print-job","times":1,"first_seen":"2026-10-20T12:10:13","last_seen":"2026-10-20T12:10:13","virustotal":null}],"attack":[{"technique_id":"T1595","technique_name":"Active Scanning","tactic_id":"TA0043","tactic_name":"Reconnaissance","sessions":69}]},"top_ports":[{"port":11443,"proto":"tcp","label":"","count":23,"sessions":5},{"port":8888,"proto":"tcp","label":"HTTP-alt","count":26,"sessions":0},{"port":4434,"proto":"tcp","label":"","count":22,"sessions":4},{"port":20443,"proto":"tcp","label":"","count":24,"sessions":0},{"port":6443,"proto":"tcp","label":"k8s API","count":19,"sessions":0},{"port":5665,"proto":"tcp","label":"","count":15,"sessions":4},{"port":9090,"proto":"tcp","label":"Prometheus","count":17,"sessions":1},{"port":8081,"proto":"tcp","label":"","count":17,"sessions":0},{"port":9060,"proto":"tcp","label":"","count":16,"sessions":0},{"port":4444,"proto":"tcp","label":"","count":15,"sessions":0},{"port":9443,"proto":"tcp","label":"","count":15,"sessions":0},{"port":8080,"proto":"tcp","label":"HTTP-alt","count":15,"sessions":0},{"port":11453,"proto":"tcp","label":"","count":11,"sessions":3},{"port":33443,"proto":"tcp","label":"","count":11,"sessions":0},{"port":443,"proto":"tcp","label":"HTTPS","count":9,"sessions":0}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t12i130500_2d7513195f68_e51b7354d87f","t13i030800_55b375c5d22e_97f8aa674fd9","t12i130700_2d7513195f68_ac8bd4dd6c01","t12i030700_8b6334b1051c_ac8bd4dd6c01","ts3i080600_dafb69683c10_73823a8aef7a"],"tls_client_hello":"160301007b010000770303adaaace7736a69b7239b27da3e37531be45dad8a0332d86594eabb481011ec7c00001ac02fc02bc011c007c013c009c014c00a0005002f0035c012000a01000034000500050100000000000a00080006001700180019000b00020100000d0010000e0401040302010203040105010601ff010001","tls_ja3":["caaddd3ed0a315543d761490b01b08e0","7f9afda94eb685adc8d863d934bf54bd","cba7f34191ef2379c1325641f6c6c4f4","22aa2bdb630c59d5ff64a34017e418c4","44609cef6ec7084c37c59c6317edb271"],"http_akin":["b11cun030_00000016_6396c54d","b11cun040_00040016_aa48e2c8","b11cun051_00240011_3f563462_x518b","b11cun030_00040014_54d07b6d"],"interactive":{"ssh_hassh":[],"tls_ja4":["t12i030700_8b6334b1051c_ac8bd4dd6c01","t12i130500_2d7513195f68_e51b7354d87f","t13i030800_55b375c5d22e_97f8aa674fd9","ts3i080600_dafb69683c10_73823a8aef7a"],"tls_ja3":["22aa2bdb630c59d5ff64a34017e418c4","44609cef6ec7084c37c59c6317edb271","7f9afda94eb685adc8d863d934bf54bd","cba7f34191ef2379c1325641f6c6c4f4"]}},"fingerprint_peers":{"t12i130500_2d7513195f68_e51b7354d87f":960,"t13i030800_55b375c5d22e_97f8aa674fd9":790,"t12i130700_2d7513195f68_ac8bd4dd6c01":78,"t12i030700_8b6334b1051c_ac8bd4dd6c01":0,"ts3i080600_dafb69683c10_73823a8aef7a":0,"b11cun030_00000016_6396c54d":61,"b11cun040_00040016_aa48e2c8":5361,"b11cun030_00040014_54d07b6d":3802,"b11cun051_00240011_3f563462_x518b":374},"akin_families":{"b11cun030_00000016_6396c54d":{"head":"b11cun040_00040016_50f90888","shapes":3,"ips":70}},"user_agents":["Mozilla/5.0 (X11; Linux x86_64; rv:91.0) Gecko/20100101 Firefox/91.0","Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36","Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.0 Safari/605.1.15","Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Edg/124.0.0.0","Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 Edg/123.0.0.0","Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko/20100101 Firefox/124.0","Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36","Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 Edg/125.0.0.0","Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/119.0","Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.3 Safari/605.1.15","Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/120.0.6099.28 Safari/537.36","Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/15.4 Safari/605.1.15","Mozilla/5.0 (Windows NT 10.0; rv:102.0) Gecko/20100101 Firefox/102.0","Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:102.0) Gecko/20100101 Firefox/102.0","Mozilla/5.0 (X11; Linux x86_64; rv:137.0) Gecko/20100101 Firefox/137.0","Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36"],"timeline":[{"date":"2026-10-06","count":32,"sessions":0},{"date":"2026-10-07","count":35,"sessions":0},{"date":"2026-10-08","count":20,"sessions":0},{"date":"2026-10-09","count":44,"sessions":0},{"date":"2026-10-10","count":32,"sessions":0},{"date":"2026-10-11","count":29,"sessions":0},{"date":"2026-10-12","count":35,"sessions":0},{"date":"2026-10-13","count":52,"sessions":0},{"date":"2026-10-14","count":59,"sessions":0},{"date":"2026-10-15","count":40,"sessions":2},{"date":"2026-10-16","count":30,"sessions":9},{"date":"2026-10-17","count":54,"sessions":0},{"date":"2026-10-18","count":30,"sessions":12},{"date":"2026-10-19","count":23,"sessions":20},{"date":"2026-10-20","count":27,"sessions":14},{"date":"2026-10-21","count":21,"sessions":20},{"date":"2026-10-22","count":17,"sessions":15},{"date":"2026-10-23","count":43,"sessions":21}],"recent_events":[{"timestamp":"2026-10-23T14:09:09","port":4369,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0001n","payload_hex":"00016e","method":"","user_agent":"","ja3":"","session":"47d8b034-9371-4b04-b354-da98c6f1ca5a","seq":1,"duration_ms":100,"bytes_in":3,"bytes_out":14},{"timestamp":"2026-10-23T14:03:18","port":2375,"proto":"tcp","app_proto":"http","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"host\":\"<HONEYPOT>\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/version","summary":"","payload_hex":"474554202f76657273696f6e20485454502f312e310d0a486f73743a203c484f4e4559504f543e0d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"5656227d-de3d-4779-b64e-717a8656bb92-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-23T12:22:06","port":9000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:9000\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/favicon.ico","summary":"","payload_hex":"474554202f66617669636f6e2e69636f20485454502f312e310d0a486f73743a20<HONEYPOT>3a393030300d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3133372e302e302e30205361666172692f3533372e33360d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36","ja3":"","session":"0475f2c9-0ce9-4cdf-9eff-926c9595c233","seq":1,"duration_ms":101,"bytes_in":216,"bytes_out":79},{"timestamp":"2026-10-23T12:21:16","port":9000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:9000\",\"user-agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.3 Safari/605.1.15\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a393030300d0a557365722d4167656e743a204d6f7a696c6c612f352e3020284d6163696e746f73683b20496e74656c204d6163204f5320582031305f31355f3729204170706c655765624b69742f3630352e312e313520284b48544d4c2c206c696b65204765636b6f292056657273696f6e2f31362e33205361666172692f3630352e312e31350d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.3 Safari/605.1.15","ja3":"","session":"b1066a46-d8a2-4bec-88e3-8f935cfa9843","seq":1,"duration_ms":107,"bytes_in":211,"bytes_out":79},{"timestamp":"2026-10-23T12:04:03","port":2600,"proto":"tcp","app_proto":"http","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:2600\",\"user-agent\":\"Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","tls_version":"1.2","alpn":[],"url_path":"/feed/","summary":"","payload_hex":"474554202f666565642f20485454502f312e310d0a486f73743a203c484f4e4559504f543e3a323630300d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e5420362e313b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3130392e302e302e30205361666172692f3533372e33360d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36","ja3":"cba7f34191ef2379c1325641f6c6c4f4","session":"8a0cc610-af97-451f-b453-ffa538559788-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-23T12:02:48","port":2600,"proto":"tcp","app_proto":"http","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:2600\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","tls_version":"1.2","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a203c484f4e4559504f543e3a323630300d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3130382e302e302e30205361666172692f3533372e33360d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36","ja3":"cba7f34191ef2379c1325641f6c6c4f4","session":"08b3d7f6-b597-45e7-b151-8a638e5c0405-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-23T11:53:01","port":6081,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:6081\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko/20100101 Firefox/124.0\"}","body":"","sni":"","tls_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","tls_version":"TLSv1.2","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a363038310d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b207836343b2072763a3132342e3029204765636b6f2f32303130303130312046697265666f782f3132342e300d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko/20100101 Firefox/124.0","ja3":"cba7f34191ef2379c1325641f6c6c4f4","session":"be2d026a-b0d2-4ed5-a8c3-2fbd6bb0dd34","seq":1,"duration_ms":253,"bytes_in":174,"bytes_out":79},{"timestamp":"2026-10-23T10:48:53","port":8000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:8000\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a383030300d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b20574f57363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3130392e302e302e30205361666172692f3533372e33360d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36","ja3":"","session":"01170d20-51b9-4735-b66a-9968a5f61960","seq":1,"duration_ms":100,"bytes_in":199,"bytes_out":79},{"timestamp":"2026-10-23T10:48:50","port":8000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:8000\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a383030300d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b20574f57363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3130392e302e302e30205361666172692f3533372e33360d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36","ja3":"","session":"19417ae9-4330-4f03-9d45-1fdab0e99784","seq":1,"duration_ms":100,"bytes_in":200,"bytes_out":79},{"timestamp":"2026-10-23T09:49:49","port":82,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:82\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","tls_version":"TLSv1.2","alpn":[],"url_path":"/favicon.ico","summary":"","payload_hex":"474554202f66617669636f6e2e69636f20485454502f312e310d0a486f73743a20<HONEYPOT>3a38320d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3133352e302e302e30205361666172692f3533372e33360d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36","ja3":"cba7f34191ef2379c1325641f6c6c4f4","session":"f0e6612f-2ac5-4bc3-9d10-c3f60c4c4ddb","seq":1,"duration_ms":249,"bytes_in":214,"bytes_out":79}],"http_methods":[{"method":"GET","count":598},{"method":"HEAD","count":2},{"method":"CONNECT","count":2},{"method":"POST","count":1}],"distinct_ports_total":171,"top_paths":[{"path":"/","count":269,"ports":124},{"path":"/login?redir=/ng","count":40,"ports":24},{"path":"/fonts/ftnt-icons.woff","count":40,"ports":24},{"path":"/api/v2/static/not.found","count":40,"ports":24},{"path":"/remote/logincheck","count":40,"ports":24},{"path":"/lang/legacy/filechecksum","count":40,"ports":24},{"path":"/migadmin/lang/legacy/legacy/filechecksum","count":40,"ports":24},{"path":"/favicon.ico","count":37,"ports":30},{"path":"/feed/","count":21,"ports":21},{"path":"/static/lang/custom/sbin/init","count":8,"ports":8},{"path":"/static/lang//custom/sbin/init","count":6,"ports":5},{"path":"/lang//custom/sbin/init","count":5,"ports":5},{"path":"/lang/custom/sbin/init","count":4,"ports":4},{"path":"/version","count":3,"ports":1},{"path":"/geoserver/web/","count":2,"ports":2}],"distinct_paths_total":20,"top_snis":[],"top_hosts":[{"value":"api.ipify.org","count":3},{"value":"www.shadowserver.org","count":2}],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","Accept-Encoding","Host","User-Agent"],"representative":[{"name":"Accept","value":"*/*","notable":false},{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Host","value":"<HONEYPOT>:9000","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36","notable":false}],"distinct_sets":2,"events_with_headers":9},"tags":[]}