{"ip":"209.38.204.16","total_events":11,"verdict":{"verdict":"scanning","label":"Scanning for known vulnerabilities","detail":"1 exploit-path probe(s)","confidence":"medium","network_type":"CDN","why":["1 request(s) matched a known exploit path.","Only GET/HEAD seen, no request body: scanning for the vulnerability, not delivering a payload.","Not in any known-scanner range."],"engagement":{"level":"request","label":"Request traffic","detail":"991 bytes sent","bytes_sent":991,"session_seconds":0,"persistent":false}},"first_seen":"2026-09-22T08:26:24","last_seen":"2026-09-23T12:07:45","events_24h":9,"events_7d":11,"geo":{"country_code":"DE","country_name":"Germany","region":"Hesse","city":"Frankfurt am Main","lat":50.1169,"lon":8.6837,"asn":14061,"org":"DigitalOcean, LLC"},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as14061","label":"DigitalOcean","category":"cdn","url":"https://www.peeringdb.com/asn/14061"},"cve_matches":[],"malware":[],"top_ports":[{"port":9092,"proto":"tcp","label":"Kafka","count":7},{"port":2525,"proto":"tcp","label":"","count":2},{"port":9042,"proto":"tcp","label":"Cassandra","count":1},{"port":1911,"proto":"tcp","label":"","count":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":["a11cun030_0000004a_c91eaf54","a11cun040_0000004d_aa48e2c8"]},"fingerprint_peers":{"a11cun030_0000004a_c91eaf54":60,"a11cun040_0000004d_aa48e2c8":1455},"akin_families":{"a11cun030_0000004a_c91eaf54":{"head":"a11cun030_0000004a_c91eaf54","shapes":2,"ips":65},"a11cun040_0000004d_aa48e2c8":{"head":"a11cun040_0000004d_aa48e2c8","shapes":4,"ips":1508}},"user_agents":["Go-http-client/1.1","Mozilla/5.0 (compatible; Odin; https://docs.getodin.com/)"],"timeline":[{"date":"2026-09-22","count":5},{"date":"2026-09-23","count":6}],"recent_events":[{"timestamp":"2026-09-23T12:07:45","port":9042,"proto":"tcp","app_proto":"","app_protocol":"http","host":"185.228.81.201","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"185.228.81.201:9042\",\"user-agent\":\"Mozilla/5.0 (compatible; Odin; https://docs.getodin.com/)\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a203138352e3232382e38312e3230313a393034320d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b204f64696e3b2068747470733a2f2f646f63732e6765746f64696e2e636f6d2f290d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; Odin; https://docs.getodin.com/)","ja3":"","session":"cb57ed28-e9e2-44a6-a093-cffbf54a4e4d","seq":1,"duration_ms":101,"bytes_in":152,"bytes_out":78},{"timestamp":"2026-09-23T06:39:39","port":9092,"proto":"tcp","app_proto":"","app_protocol":"http","host":"185.228.81.201","headers":"{\"connection\":\"close\",\"host\":\"185.228.81.201:9092\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/query?q=SHOW+DIAGNOSTICS","summary":"","payload_hex":"474554202f71756572793f713d53484f572b444941474e4f535449435320485454502f312e310d0a486f73743a203138352e3232382e38312e3230313a393039320d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"","session":"01e986ff-ed3d-43de-8a60-f4f23b044507","seq":1,"duration_ms":100,"bytes_in":120,"bytes_out":78},{"timestamp":"2026-09-23T06:39:21","port":9092,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000\u0015\u0000\u0003\u0000\u0007\u0000\u0000\u0000\u0002\u0000\u0006sarama����\u0000","payload_hex":"0000001500030007000000020006736172616d61ffffffff00","method":"","user_agent":"","ja3":"","session":"2fe038d6-3444-42b8-afff-571add69771c","seq":1,"duration_ms":100,"bytes_in":25,"bytes_out":13,"enriched":{"digest":"ed73f507d2dfb7bb","strings":["sarama"]}},{"timestamp":"2026-09-23T06:39:21","port":9092,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000\u0015\u0000\u0003\u0000\u0007\u0000\u0000\u0000\u0003\u0000\u0006sarama����\u0000","payload_hex":"0000001500030007000000030006736172616d61ffffffff00","method":"","user_agent":"","ja3":"","session":"fd3bd0cb-414d-42c9-ae4a-ceb56cc14db1","seq":1,"duration_ms":100,"bytes_in":25,"bytes_out":13,"enriched":{"digest":"ad1bf8dcff8afcc6","strings":["sarama"]}},{"timestamp":"2026-09-23T06:39:20","port":9092,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000\u0015\u0000\u0003\u0000\u0007\u0000\u0000\u0000\u0000\u0000\u0006sarama����\u0000","payload_hex":"0000001500030007000000000006736172616d61ffffffff00","method":"","user_agent":"","ja3":"","session":"94bde611-03e2-4586-80f2-8555fbaf97c5","seq":1,"duration_ms":100,"bytes_in":25,"bytes_out":13,"enriched":{"digest":"b6d00cd8e02229c6","strings":["sarama"]}},{"timestamp":"2026-09-23T06:39:20","port":9092,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000\u0015\u0000\u0003\u0000\u0007\u0000\u0000\u0000\u0001\u0000\u0006sarama����\u0000","payload_hex":"0000001500030007000000010006736172616d61ffffffff00","method":"","user_agent":"","ja3":"","session":"f7b41dc7-5810-4aad-bf13-7891353a76d2","seq":1,"duration_ms":100,"bytes_in":25,"bytes_out":13,"enriched":{"digest":"b0fa169f5262c12e","strings":["sarama"]}},{"timestamp":"2026-09-22T22:57:31","port":9092,"proto":"tcp","app_proto":"","app_protocol":"http","host":"185.228.81.201","headers":"{\"connection\":\"close\",\"host\":\"185.228.81.201:9092\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/solr/admin/info/system","summary":"","payload_hex":"474554202f736f6c722f61646d696e2f696e666f2f73797374656d20485454502f312e310d0a486f73743a203138352e3232382e38312e3230313a393039320d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"","session":"e4d82303-e90e-4d66-9583-b5aca70f271a","seq":1,"duration_ms":101,"bytes_in":118,"bytes_out":78},{"timestamp":"2026-09-22T22:57:31","port":9092,"proto":"tcp","app_proto":"","app_protocol":"http","host":"185.228.81.201","headers":"{\"connection\":\"close\",\"host\":\"185.228.81.201:9092\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/solr/admin/cores?action=STATUS&wt=json","summary":"","payload_hex":"474554202f736f6c722f61646d696e2f636f7265733f616374696f6e3d5354415455532677743d6a736f6e20485454502f312e310d0a486f73743a203138352e3232382e38312e3230313a393039320d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"","session":"561740d8-606e-4642-ae3c-c3a36322bf55","seq":1,"duration_ms":100,"bytes_in":134,"bytes_out":78},{"timestamp":"2026-09-22T17:35:47","port":1911,"proto":"tcp","app_proto":"","app_protocol":"http","host":"185.228.81.201","headers":"{\"connection\":\"close\",\"host\":\"185.228.81.201:1911\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/cgi-bin/authLogin.cgi","summary":"","payload_hex":"474554202f6367692d62696e2f617574684c6f67696e2e63676920485454502f312e310d0a486f73743a203138352e3232382e38312e3230313a313931310d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"","session":"221e5070-bd33-4aa4-bfb1-e6b56136782f","seq":1,"duration_ms":100,"bytes_in":117,"bytes_out":78},{"timestamp":"2026-09-22T08:26:25","port":2525,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"host\":\"<HONEYPOT>:2525\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/solr/admin/cores?action=STATUS&wt=json","summary":"","payload_hex":"474554202f736f6c722f61646d696e2f636f7265733f616374696f6e3d5354415455532677743d6a736f6e20485454502f312e310d0a486f73743a20<HONEYPOT>3a323532350d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"","session":"39145002-bfd2-45e0-9be3-288334a81a8f","seq":1,"duration_ms":101,"bytes_in":133,"bytes_out":78}],"http_methods":[{"method":"GET","count":7}],"distinct_ports_total":4,"top_paths":[{"path":"/solr/admin/info/system","count":2,"ports":2},{"path":"/solr/admin/cores?action=STATUS&wt=json","count":2,"ports":2},{"path":"/","count":1,"ports":1},{"path":"/cgi-bin/authLogin.cgi","count":1,"ports":1},{"path":"/query?q=SHOW+DIAGNOSTICS","count":1,"ports":1}],"distinct_paths_total":5,"top_snis":[],"top_hosts":[{"value":"185.228.81.201","count":5}],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","Accept-Encoding","Host","User-Agent"],"representative":[{"name":"Accept","value":"*/*","notable":false},{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Host","value":"185.228.81.201:9042","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (compatible; Odin; https://docs.getodin.com/)","notable":false}],"distinct_sets":2,"events_with_headers":6},"tags":[],"data_as_of":"2026-09-23T14:27:55.441797+00:00"}