{"ip":"23.226.70.138","data_as_of":"2026-10-27T01:05:26+00:00","observed":true,"total_events":33,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"10+ ports swept","confidence":"medium","network_type":"CDN","why":["No exploit payloads observed.","Swept 10 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range.","Counts include 3 interactive session(s) as well as first-packet events."],"engagement":{"level":"request","label":"Request traffic","detail":"3,395 bytes sent","bytes_sent":3395,"session_seconds":0,"persistent":false},"basis":"combined"},"first_seen":"2026-10-19T00:41:45","last_seen":"2026-10-21T02:09:19","events_24h":0,"events_7d":15,"interactive_sessions":3,"interactive_sessions_24h":0,"interactive_sessions_7d":3,"interactive_protocols":[{"protocol":"http","sessions":3}],"geo":{"country_code":"US","country_name":"United States","region":"Arizona","city":"Phoenix","lat":33.4413,"lon":-112.0421,"asn":53755,"org":"Input Output Flood LLC"},"source_domain":"phoenix.wawanode.com","known_scanners":[],"scanner_tag":{"key":"peeringdb:as53755","label":"Input Output Flood","category":"cdn","url":"https://www.peeringdb.com/asn/53755"},"cve_matches":[{"cve_id":"CVE-2026-35029","title":"LiteLLM - Arbitrary File Read","severity":"high","actively_exploited":false,"match_field":"url_path","matched_pattern":"/health/liveliness","kev_date_added":null}],"malware":[],"udp":null,"interaction":{"window_days":90,"sessions":3,"first_seen":"2026-10-20T22:49:48","last_seen":"2026-10-20T23:32:16","verdicts":[{"verdict":"unknown","sessions":3}],"personas":[{"persona":"nginx@1.18.0, wordpress@6.5.2, leaks@1, miner@cgminer 4.11.1, elasticsearch@8.11.1, winrm@Windows Server 2019, fortigate@7.2.1, docker@25.0.3","sessions":3}],"services":[{"protocol":"http","port":2375,"sessions":3}],"logins":[],"commands":[],"downloads":[],"files":[],"attack":[]},"top_ports":[{"port":2375,"proto":"tcp","label":"Docker","count":15,"sessions":3},{"port":4000,"proto":"tcp","label":"","count":2,"sessions":0},{"port":1234,"proto":"tcp","label":"","count":2,"sessions":0},{"port":12345,"proto":"tcp","label":"","count":2,"sessions":0},{"port":10000,"proto":"tcp","label":"Webmin","count":2,"sessions":0},{"port":11434,"proto":"tcp","label":"","count":2,"sessions":0},{"port":5000,"proto":"tcp","label":"Web-alt","count":2,"sessions":0},{"port":8188,"proto":"tcp","label":"","count":2,"sessions":0},{"port":8001,"proto":"tcp","label":"","count":2,"sessions":0},{"port":8088,"proto":"tcp","label":"Hadoop","count":2,"sessions":0}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":["b10cun010_00040000_c4b2c4aa","b11cun040_00040013_608dab68"],"interactive":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[]}},"fingerprint_peers":{"b11cun040_00040013_608dab68":4347,"b10cun010_00040000_c4b2c4aa":404},"akin_families":{},"user_agents":["Mozilla/5.0","curl/8.4.0"],"timeline":[{"date":"2026-10-19","count":18,"sessions":0},{"date":"2026-10-20","count":12,"sessions":3},{"date":"2026-10-21","count":3,"sessions":0}],"recent_events":[{"timestamp":"2026-10-21T02:09:19","port":2375,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"identity\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:2375\",\"user-agent\":\"Mozilla/5.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/images/json?all=0","summary":"","payload_hex":"474554202f696d616765732f6a736f6e3f616c6c3d3020485454502f312e310d0a4163636570742d456e636f64696e673a206964656e746974790d0a486f73743a20<HONEYPOT>3a323337350d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0","ja3":"","session":"97972110-7cc0-4639-b37a-f4bab1dbef8d","seq":1,"duration_ms":101,"bytes_in":132,"bytes_out":78},{"timestamp":"2026-10-21T02:03:35","port":2375,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"identity\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:2375\",\"user-agent\":\"Mozilla/5.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/images/json?all=0","summary":"","payload_hex":"474554202f696d616765732f6a736f6e3f616c6c3d3020485454502f312e310d0a4163636570742d456e636f64696e673a206964656e746974790d0a486f73743a20<HONEYPOT>3a323337350d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0","ja3":"","session":"d7892746-e8bc-4523-8fb6-1ba690ab6aac","seq":1,"duration_ms":100,"bytes_in":132,"bytes_out":78},{"timestamp":"2026-10-21T02:02:03","port":2375,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"identity\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:2375\",\"user-agent\":\"Mozilla/5.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/version","summary":"","payload_hex":"474554202f76657273696f6e20485454502f312e310d0a4163636570742d456e636f64696e673a206964656e746974790d0a486f73743a20<HONEYPOT>3a323337350d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0","ja3":"","session":"e63f4120-4a41-40f8-8ace-b000cf9361a8","seq":1,"duration_ms":100,"bytes_in":122,"bytes_out":78},{"timestamp":"2026-10-20T23:22:59","port":2375,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"identity\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:2375\",\"user-agent\":\"curl/8.4.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/containers/json?all=1","summary":"","payload_hex":"474554202f636f6e7461696e6572732f6a736f6e3f616c6c3d3120485454502f312e310d0a4163636570742d456e636f64696e673a206964656e746974790d0a486f73743a20<HONEYPOT>3a323337350d0a557365722d4167656e743a206375726c2f382e342e300d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"curl/8.4.0","ja3":"","session":"ca080918-837d-46ba-9180-2f71bb78fa2a","seq":1,"duration_ms":100,"bytes_in":134,"bytes_out":78},{"timestamp":"2026-10-20T23:22:58","port":2375,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"identity\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:2375\",\"user-agent\":\"curl/8.4.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/version","summary":"","payload_hex":"474554202f76657273696f6e20485454502f312e310d0a4163636570742d456e636f64696e673a206964656e746974790d0a486f73743a20<HONEYPOT>3a323337350d0a557365722d4167656e743a206375726c2f382e342e300d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"curl/8.4.0","ja3":"","session":"4d720c80-0c37-4fd8-814d-e0cf66a049f0","seq":1,"duration_ms":100,"bytes_in":120,"bytes_out":78},{"timestamp":"2026-10-20T23:22:18","port":2375,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"identity\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:2375\",\"user-agent\":\"curl/8.4.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/containers/json?all=1","summary":"","payload_hex":"474554202f636f6e7461696e6572732f6a736f6e3f616c6c3d3120485454502f312e310d0a4163636570742d456e636f64696e673a206964656e746974790d0a486f73743a20<HONEYPOT>3a323337350d0a557365722d4167656e743a206375726c2f382e342e300d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"curl/8.4.0","ja3":"","session":"48b829e6-c055-4224-94d3-e8fac7a86880","seq":1,"duration_ms":100,"bytes_in":135,"bytes_out":78},{"timestamp":"2026-10-20T23:22:18","port":2375,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"identity\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:2375\",\"user-agent\":\"curl/8.4.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/version","summary":"","payload_hex":"474554202f76657273696f6e20485454502f312e310d0a4163636570742d456e636f64696e673a206964656e746974790d0a486f73743a20<HONEYPOT>3a323337350d0a557365722d4167656e743a206375726c2f382e342e300d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"curl/8.4.0","ja3":"","session":"bd7ce213-c9f5-4bba-b560-26cd653282e6","seq":1,"duration_ms":100,"bytes_in":121,"bytes_out":78},{"timestamp":"2026-10-20T23:22:01","port":2375,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"identity\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:2375\",\"user-agent\":\"curl/8.4.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/containers/json?all=1","summary":"","payload_hex":"474554202f636f6e7461696e6572732f6a736f6e3f616c6c3d3120485454502f312e310d0a4163636570742d456e636f64696e673a206964656e746974790d0a486f73743a20<HONEYPOT>3a323337350d0a557365722d4167656e743a206375726c2f382e342e300d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"curl/8.4.0","ja3":"","session":"75dbe338-a9bc-4702-a096-5702f1eae8b7","seq":1,"duration_ms":100,"bytes_in":136,"bytes_out":78},{"timestamp":"2026-10-20T23:22:01","port":2375,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"identity\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:2375\",\"user-agent\":\"curl/8.4.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/version","summary":"","payload_hex":"474554202f76657273696f6e20485454502f312e310d0a4163636570742d456e636f64696e673a206964656e746974790d0a486f73743a20<HONEYPOT>3a323337350d0a557365722d4167656e743a206375726c2f382e342e300d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"curl/8.4.0","ja3":"","session":"82c4d191-0d75-4676-96a6-3e5a10298b49","seq":1,"duration_ms":100,"bytes_in":122,"bytes_out":78},{"timestamp":"2026-10-20T22:49:54","port":2375,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"identity\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:2375\",\"user-agent\":\"curl/8.4.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/containers/json","summary":"","payload_hex":"474554202f636f6e7461696e6572732f6a736f6e20485454502f312e310d0a4163636570742d456e636f64696e673a206964656e746974790d0a486f73743a20<HONEYPOT>3a323337350d0a557365722d4167656e743a206375726c2f382e342e300d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"curl/8.4.0","ja3":"","session":"d578994c-f8c8-4e11-a034-7bdc18aa5f14","seq":1,"duration_ms":100,"bytes_in":130,"bytes_out":78}],"http_methods":[{"method":"GET","count":33}],"distinct_ports_total":10,"top_paths":[{"path":"/v1/models","count":16,"ports":9},{"path":"/version","count":6,"ports":1},{"path":"/containers/json?all=1","count":6,"ports":1},{"path":"/images/json?all=0","count":2,"ports":1},{"path":"/api/tags","count":1,"ports":1},{"path":"/containers/json","count":1,"ports":1},{"path":"/health/liveliness","count":1,"ports":1}],"distinct_paths_total":7,"top_snis":[],"top_hosts":[{"value":"x","count":9}],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept-Encoding","Connection","Host","User-Agent"],"representative":[{"name":"Accept-Encoding","value":"identity","notable":false},{"name":"Connection","value":"close","notable":false},{"name":"Host","value":"<HONEYPOT>:2375","notable":false},{"name":"User-Agent","value":"Mozilla/5.0","notable":false}],"distinct_sets":1,"events_with_headers":10},"tags":[{"tag_id":"CVE-2026-35029","tag_type":"cve","title":"LiteLLM - Arbitrary File Read","severity":"high","actively_exploited":false,"match_field":"url_path","matched_pattern":"/health/liveliness","reference_urls":["https://github.com/BerriAI/litellm","https://sec-consult.com/vulnerability-lab/advisory/broken-access-control-in-config-endpoint-in-litellm/","https://nvd.nist.gov/vuln/detail/CVE-2026-35029"],"kev_date_added":null}]}