{"ip":"199.165.159.57","data_as_of":"2026-10-26T01:53:54+00:00","observed":true,"total_events":589,"verdict":{"verdict":"scanner","label":"Recognized scanner","detail":"shadowserver","confidence":"high","network_type":null,"why":["The address is in a published scanner range (shadowserver).","Known research and commercial scanners are labelled by operator and carry no threat verdict.","Counts include 146 interactive session(s) as well as first-packet events."],"engagement":{"level":"payload","label":"Sustained payload","detail":"129,055 bytes sent","bytes_sent":129055,"session_seconds":30,"persistent":false},"basis":"combined"},"first_seen":"2026-10-06T00:59:04","last_seen":"2026-10-25T14:17:05","events_24h":26,"events_7d":131,"interactive_sessions":146,"interactive_sessions_24h":18,"interactive_sessions_7d":111,"interactive_protocols":[{"protocol":"http","sessions":61},{"protocol":"tls","sessions":35},{"protocol":"postgres","sessions":3},{"protocol":"rdp","sessions":2},{"protocol":"ssh","sessions":2},{"protocol":"vnc","sessions":2},{"protocol":"msrpc","sessions":2},{"protocol":"smtp","sessions":1},{"protocol":"enip","sessions":1},{"protocol":"pcworx","sessions":1},{"protocol":"mqtt","sessions":1},{"protocol":"dnp3","sessions":1},{"protocol":"atg","sessions":1}],"geo":{"country_code":"US","country_name":"United States","region":"","city":"","lat":37.751,"lon":-97.822,"asn":22168,"org":"The Shadowserver Foundation, Inc."},"source_domain":"scan-97-0.shadowserver.io","known_scanners":["shadowserver","Shadowserver Io"],"scanner_tag":{"key":"auto:shadowserver_io","label":"Shadowserver Io","category":"research","url":""},"cve_matches":[],"malware":[],"udp":null,"interaction":{"window_days":90,"sessions":146,"first_seen":"2026-10-15T08:53:29","last_seen":"2026-10-25T14:14:24","verdicts":[{"verdict":"scan","sessions":81},{"verdict":"unknown","sessions":65}],"personas":[{"persona":"nginx@1.24.0, wordpress@6.5.2, leaks@2, miner@bfgminer 5.5.0, elasticsearch@6.8.23, winrm@Windows Server 2016, fortigate@7.0.5, gitlab@19.4.2","sessions":19},{"persona":"nginx@1.18.0, wordpress@6.5.2, leaks@1, miner@cgminer 4.11.1, elasticsearch@8.11.1, winrm@Windows Server 2019, fortigate@7.2.1","sessions":15},{"persona":"nginx@1.18.0, wordpress@6.5.2, leaks@1, miner@cgminer 4.11.1, elasticsearch@8.11.1, winrm@Windows Server 2019, fortigate@7.2.1, gitlab@19.4.2","sessions":11},{"persona":"nginx@1.24.0, wordpress@6.5.2, leaks@2, miner@bfgminer 5.5.0, elasticsearch@6.8.23, winrm@Windows Server 2016, fortigate@7.0.5, docker@25.0.3","sessions":11},{"persona":"postgres@16.2","sessions":3},{"persona":"vnc@RealVNC Server 6.11.0","sessions":2},{"persona":"nginx@1.18.0, wordpress@6.5.2, leaks@1, miner@cgminer 4.11.1, elasticsearch@8.11.1, winrm@Windows Server 2019, fortigate@7.2.1, docker@25.0.3","sessions":2},{"persona":"ics@Siemens S7-1200","sessions":2},{"persona":"linux-ubuntu@24.04","sessions":2},{"persona":"nginx@1.18.0, wordpress@6.5.2, leaks@1, miner@cgminer 4.11.1, elasticsearch@8.11.1, winrm@Windows Server 2019, discovery@igd 1.0, fortigate@7.2.1","sessions":2},{"persona":"nginx@1.18.0, wordpress@6.5.2, leaks@1, miner@cgminer 4.11.1, elasticsearch@8.11.1, winrm@Windows Server 2019, dlink-dir645@1.03, fortigate@7.2.1","sessions":1}],"services":[{"protocol":"http","port":6081,"sessions":7},{"protocol":"tls","port":23756,"sessions":5},{"protocol":"tls","port":6081,"sessions":4},{"protocol":"http","port":14443,"sessions":3},{"protocol":"http","port":23756,"sessions":3},{"protocol":"http","port":9000,"sessions":3},{"protocol":"http","port":23656,"sessions":3},{"protocol":"http","port":23556,"sessions":3},{"protocol":"http","port":31337,"sessions":3},{"protocol":"http","port":9060,"sessions":3},{"protocol":"http","port":12654,"sessions":3},{"protocol":"postgres","port":5432,"sessions":3}],"logins":[],"commands":[],"downloads":[],"files":[],"attack":[{"technique_id":"T1595","technique_name":"Active Scanning","tactic_id":"TA0043","tactic_name":"Reconnaissance","sessions":81},{"technique_id":"T1078","technique_name":"Valid Accounts","tactic_id":"TA0001","tactic_name":"Initial Access","sessions":1}]},"top_ports":[{"port":4444,"proto":"tcp","label":"","count":31,"sessions":0},{"port":20443,"proto":"tcp","label":"","count":21,"sessions":0},{"port":7443,"proto":"tcp","label":"","count":20,"sessions":0},{"port":9060,"proto":"tcp","label":"","count":14,"sessions":5},{"port":5665,"proto":"tcp","label":"","count":18,"sessions":0},{"port":403,"proto":"tcp","label":"","count":14,"sessions":4},{"port":449,"proto":"tcp","label":"","count":17,"sessions":0},{"port":4434,"proto":"tcp","label":"","count":17,"sessions":0},{"port":10514,"proto":"tcp","label":"","count":16,"sessions":0},{"port":444,"proto":"tcp","label":"","count":16,"sessions":0},{"port":811,"proto":"tcp","label":"","count":15,"sessions":0},{"port":11443,"proto":"tcp","label":"","count":15,"sessions":0},{"port":65443,"proto":"tcp","label":"","count":14,"sessions":0},{"port":8080,"proto":"tcp","label":"HTTP-alt","count":13,"sessions":1},{"port":9090,"proto":"tcp","label":"Prometheus","count":10,"sessions":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t12i130500_2d7513195f68_e51b7354d87f","t13i030800_55b375c5d22e_97f8aa674fd9","t12i130700_2d7513195f68_ac8bd4dd6c01","t12i030700_8b6334b1051c_ac8bd4dd6c01","t13i190800_9dc949149365_97f8aa674fd9","ts3i080600_dafb69683c10_73823a8aef7a"],"tls_client_hello":"160301007b01000077030347b84046a5b2454d8e128d0e185f99dac78065a08fc2ca2a73cc9417d8d39faf00001ac02fc02bc011c007c013c009c014c00a0005002f0035c012000a01000034000500050100000000000a00080006001700180019000b00020100000d0010000e0401040302010203040105010601ff010001","tls_ja3":["7f9afda94eb685adc8d863d934bf54bd","caaddd3ed0a315543d761490b01b08e0","cba7f34191ef2379c1325641f6c6c4f4","22aa2bdb630c59d5ff64a34017e418c4","35fa0a83e466acbec1cfbb9016d550ab","44609cef6ec7084c37c59c6317edb271"],"http_akin":["b11cun010_00040000_c4b2c4aa","b11cun020_00040010_724c10fb","b11cun040_00040016_aa48e2c8","b11cun051_00240011_3f563462_x518b"],"interactive":{"ssh_hassh":[],"tls_ja4":["t12i030700_8b6334b1051c_ac8bd4dd6c01","t12i130500_2d7513195f68_e51b7354d87f","t13i030800_55b375c5d22e_97f8aa674fd9","t13i190800_9dc949149365_97f8aa674fd9","ts3i080600_dafb69683c10_73823a8aef7a"],"tls_ja3":["22aa2bdb630c59d5ff64a34017e418c4","35fa0a83e466acbec1cfbb9016d550ab","44609cef6ec7084c37c59c6317edb271","7f9afda94eb685adc8d863d934bf54bd","cba7f34191ef2379c1325641f6c6c4f4"]}},"fingerprint_peers":{"t12i130500_2d7513195f68_e51b7354d87f":1098,"t13i030800_55b375c5d22e_97f8aa674fd9":869,"t12i130700_2d7513195f68_ac8bd4dd6c01":82,"t12i030700_8b6334b1051c_ac8bd4dd6c01":0,"t13i190800_9dc949149365_97f8aa674fd9":3293,"ts3i080600_dafb69683c10_73823a8aef7a":0,"b11cun010_00040000_c4b2c4aa":933,"b11cun020_00040010_724c10fb":1873,"b11cun040_00040016_aa48e2c8":5565,"b11cun051_00240011_3f563462_x518b":429},"akin_families":{"b11cun020_00040010_724c10fb":{"head":"b11cun020_00040010_724c10fb","shapes":2,"ips":1874}},"user_agents":["Mozilla/5.0 (Windows NT 10.0; rv:125.0) Gecko/20100101 Firefox/125.0","Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36","Mozilla/5.0 (Windows NT 10.0; rv:102.0) Gecko/20100101 Firefox/102.0","Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36","Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36 Edg/110.0.1587.57","Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:83.0) Gecko/20100101 Firefox/83.0","Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36","Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36","Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36 Edg/109.0.1518.78","Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36 OPR/107.0.0.0","Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.3 Safari/605.1.15","Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0","Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36","Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36 OPR/120.0.0.0","Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36","Mozilla/5.0 (X11; Linux x86_64; rv:107.0) Gecko/20100101 Firefox/107.0"],"timeline":[{"date":"2026-10-06","count":50,"sessions":0},{"date":"2026-10-07","count":26,"sessions":0},{"date":"2026-10-08","count":30,"sessions":0},{"date":"2026-10-09","count":40,"sessions":0},{"date":"2026-10-10","count":44,"sessions":0},{"date":"2026-10-11","count":49,"sessions":0},{"date":"2026-10-12","count":34,"sessions":0},{"date":"2026-10-13","count":40,"sessions":0},{"date":"2026-10-14","count":23,"sessions":0},{"date":"2026-10-15","count":17,"sessions":3},{"date":"2026-10-16","count":23,"sessions":13},{"date":"2026-10-17","count":19,"sessions":9},{"date":"2026-10-18","count":53,"sessions":8},{"date":"2026-10-19","count":41,"sessions":24},{"date":"2026-10-20","count":7,"sessions":6},{"date":"2026-10-21","count":15,"sessions":12},{"date":"2026-10-22","count":24,"sessions":28},{"date":"2026-10-23","count":18,"sessions":15},{"date":"2026-10-24","count":3,"sessions":10},{"date":"2026-10-25","count":33,"sessions":18}],"recent_events":[{"timestamp":"2026-10-25T14:17:05","port":2404,"proto":"tcp","app_proto":"","app_protocol":"iec60870","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"h\u0004C\u0000\u0000\u0000","payload_hex":"680443000000","method":"","user_agent":"","ja3":"","session":"d4aadd5b-49ec-4d4f-b1ce-60688652bac9","seq":1,"duration_ms":100,"bytes_in":6,"bytes_out":14},{"timestamp":"2026-10-25T13:24:31","port":2455,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"��\u0001\u0000\u0000\u0000\u0001","payload_hex":"bbbb0100000001","method":"","user_agent":"","ja3":"","session":"3b8fc693-23d5-4a51-9699-fc9cc5d3e92b-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-25T12:39:10","port":3389,"proto":"tcp","app_proto":"rdp","app_protocol":"mqtt","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","tls_version":"1.2","alpn":[],"url_path":"","summary":"07�\u0003\u0002\u0001`�00.0,�*\u0004(NTLMSSP\u0000\u0001\u0000\u0000\u0000��\b�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\n\u0000cE\u0000\u0000\u0000\u000f","payload_hex":"3037a003020160a130302e302ca02a04284e544c4d5353500001000000b78208e2000000000000000000000000000000000a0063450000000f","method":"","user_agent":"","ja3":"35fa0a83e466acbec1cfbb9016d550ab","session":"e66d8138-93b4-4e17-80c5-8b3ea5496ea5-3","seq":3,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"0031b79f0a6005ce","strings":["00.0,","(NTLMSSP"]},"interactive":true},{"timestamp":"2026-10-25T12:39:09","port":3389,"proto":"tcp","app_proto":"rdp","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","tls_version":"1.2","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000+&�\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=zgrab\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","payload_hex":"0300002b26e00000000000436f6f6b69653a206d737473686173683d7a677261620d0a0100080003000000","method":"","user_agent":"","ja3":"35fa0a83e466acbec1cfbb9016d550ab","session":"e66d8138-93b4-4e17-80c5-8b3ea5496ea5-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"264bdc07cc4ae44b","label":"RDP (X.224)","strings":["Cookie: mstshash=zgrab"]},"interactive":true},{"timestamp":"2026-10-25T12:36:15","port":4369,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0001n","payload_hex":"00016e","method":"","user_agent":"","ja3":"","session":"d4e6e004-ff56-4fee-9575-d73b596f9a19","seq":1,"duration_ms":100,"bytes_in":3,"bytes_out":14},{"timestamp":"2026-10-25T12:24:47","port":5665,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:5665\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36 OPR/94.0.0.0\"}","body":"","sni":"","tls_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","tls_version":"TLSv1.2","alpn":[],"url_path":"/migadmin/lang/legacy/legacy/filechecksum","summary":"","payload_hex":"474554202f6d696761646d696e2f6c616e672f6c65676163792f6c65676163792f66696c65636865636b73756d20485454502f312e310d0a486f73743a20<HONEYPOT>3a353636350d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3130382e302e302e30205361666172692f3533372e3336204f50522f39342e302e302e300d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36 OPR/94.0.0.0","ja3":"cba7f34191ef2379c1325641f6c6c4f4","session":"549f341b-bfd4-4f3f-b7b0-6c2daa6cef2c","seq":1,"duration_ms":246,"bytes_in":259,"bytes_out":79},{"timestamp":"2026-10-25T12:24:45","port":5665,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:5665\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36 OPR/94.0.0.0\"}","body":"","sni":"","tls_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","tls_version":"TLSv1.2","alpn":[],"url_path":"/lang/legacy/filechecksum","summary":"","payload_hex":"474554202f6c616e672f6c65676163792f66696c65636865636b73756d20485454502f312e310d0a486f73743a20<HONEYPOT>3a353636350d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3130382e302e302e30205361666172692f3533372e3336204f50522f39342e302e302e300d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36 OPR/94.0.0.0","ja3":"cba7f34191ef2379c1325641f6c6c4f4","session":"0fb675cf-5d83-4c7f-a714-1ddd6da3f925","seq":1,"duration_ms":247,"bytes_in":243,"bytes_out":79},{"timestamp":"2026-10-25T12:24:35","port":5665,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:5665\",\"user-agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/135.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","tls_version":"TLSv1.2","alpn":[],"url_path":"/lang/custom/sbin/init","summary":"","payload_hex":"474554202f6c616e672f637573746f6d2f7362696e2f696e697420485454502f312e310d0a486f73743a20<HONEYPOT>3a353636350d0a557365722d4167656e743a204d6f7a696c6c612f352e3020284d6163696e746f73683b20496e74656c204d6163204f5320582031305f31355f3729204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f2920486561646c6573734368726f6d652f3133352e302e302e30205361666172692f3533372e33360d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/135.0.0.0 Safari/537.36","ja3":"cba7f34191ef2379c1325641f6c6c4f4","session":"db44d5c4-56bc-45a7-8444-d424252b4174","seq":1,"duration_ms":251,"bytes_in":241,"bytes_out":79},{"timestamp":"2026-10-25T12:24:31","port":5665,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:5665\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","tls_version":"TLSv1.2","alpn":[],"url_path":"/login?redir=/ng","summary":"","payload_hex":"474554202f6c6f67696e3f72656469723d2f6e6720485454502f312e310d0a486f73743a20<HONEYPOT>3a353636350d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3133392e302e302e30205361666172692f3533372e33360d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36","ja3":"cba7f34191ef2379c1325641f6c6c4f4","session":"1bc502ed-e070-4cf6-b80b-9e7b14ae919e","seq":1,"duration_ms":251,"bytes_in":211,"bytes_out":79},{"timestamp":"2026-10-25T12:24:29","port":5665,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:5665\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36 OPR/107.0.0.0\"}","body":"","sni":"","tls_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","tls_version":"TLSv1.2","alpn":[],"url_path":"/fonts/ftnt-icons.woff","summary":"","payload_hex":"474554202f666f6e74732f66746e742d69636f6e732e776f666620485454502f312e310d0a486f73743a20<HONEYPOT>3a353636350d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132312e302e302e30205361666172692f3533372e3336204f50522f3130372e302e302e300d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36 OPR/107.0.0.0","ja3":"cba7f34191ef2379c1325641f6c6c4f4","session":"bc354497-c9bf-4b4e-9794-616fae9c9984","seq":1,"duration_ms":250,"bytes_in":241,"bytes_out":79}],"http_methods":[{"method":"GET","count":587},{"method":"HEAD","count":1},{"method":"CONNECT","count":1}],"distinct_ports_total":160,"top_paths":[{"path":"/","count":251,"ports":105},{"path":"/lang/legacy/filechecksum","count":44,"ports":26},{"path":"/login?redir=/ng","count":43,"ports":26},{"path":"/fonts/ftnt-icons.woff","count":43,"ports":26},{"path":"/api/v2/static/not.found","count":43,"ports":26},{"path":"/migadmin/lang/legacy/legacy/filechecksum","count":43,"ports":25},{"path":"/remote/logincheck","count":42,"ports":25},{"path":"/favicon.ico","count":25,"ports":17},{"path":"/feed/","count":25,"ports":23},{"path":"/static/lang/custom/sbin/init","count":7,"ports":7},{"path":"/lang/custom/sbin/init","count":6,"ports":6},{"path":"/static/lang//custom/sbin/init","count":5,"ports":5},{"path":"/lang//custom/sbin/init","count":3,"ports":3},{"path":"http://api.ipify.org/?format=json","count":3,"ports":3},{"path":"/geoserver/web/","count":1,"ports":1}],"distinct_paths_total":20,"top_snis":[],"top_hosts":[{"value":"api.ipify.org","count":3},{"value":"www.shadowserver.org","count":1}],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","Accept-Encoding","Host","User-Agent"],"representative":[{"name":"Accept","value":"*/*","notable":false},{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Host","value":"<HONEYPOT>:5665","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36 OPR/94.0.0.0","notable":false}],"distinct_sets":1,"events_with_headers":5},"tags":[{"tag_id":"logins","tag_type":"interactive","label":"logins","title":"Tried logins","sessions":1}]}