{"ip":"31.56.19.21","total_events":1,"verdict":{"verdict":"probing","label":"Low-level probing","detail":null,"confidence":"low","network_type":null,"why":["1 event(s), fewer than 10 distinct ports, no exploit payloads.","Not in any known-scanner range."],"engagement":{"level":"request","label":"Request traffic","detail":"271 bytes sent","bytes_sent":271,"session_seconds":0,"persistent":false}},"first_seen":"2026-10-04T01:34:48","last_seen":"2026-10-04T01:34:48","events_24h":0,"events_7d":1,"geo":{"country_code":"AE","country_name":"United Arab Emirates","region":"","city":"","lat":23.75,"lon":54.5,"asn":403005,"org":"Blatant"},"source_domain":null,"known_scanners":[],"scanner_tag":null,"cve_matches":[],"malware":[],"udp":{"source_verified":false,"window_days":90,"events":69,"protocols":[{"protocol":"udp","events":69}],"ports":[{"port":1900,"events":69}],"dns_questions":[],"quic_clients":[],"first_seen":"2026-10-05T11:05:45","last_seen":"2026-10-05T15:49:39","recent":[{"timestamp":"2026-10-05T15:49:39","port":1900,"src_port":33360,"proto":"udp","app_proto":"","app_protocol":"ssdp","summary":"M-SEARCH * HTTP/1.1\r\nHOST: 239.255.255.250:1900\r\nST: urn:schemas-upnp-org:device:Basic:1\r\nMAN: \"ssdp:discover\"\r\nMX: 3\r\nLOCATION: http://64.89.160.48/bins/cat.sh\r\n\r\n","payload_hex":"4d2d534541524348202a20485454502f312e310d0a484f53543a203233392e3235352e3235352e3235303a313930300d0a53543a2075726e3a736368656d61732d75706e702d6f72673a6465766963653a42617369633a310d0a4d414e3a2022737364703a646973636f766572220d0a4d583a20330d0a4c4f434154494f4e3a20687474703a2f2f36342e38392e3136302e34382f62696e732f6361742e73680d0a0d0a","sni":"","session":"962f3276-f07a-4278-9715-cf322da98e9e","bytes_in":164,"source_verified":false,"enriched":{"digest":"981472fed857c50c","strings":["M-SEARCH * HTTP/1.1","HOST: 239.255.255.250:1900","ST: urn:schemas-upnp-org:device:Basic:1","MAN: \"ssdp:discover\"","MX: 3","LOCATION: http://64.89.160.48/bins/cat.sh"],"iocs":{"urls":["http://64.89.160.48/bins/cat.sh"],"ips":["239.255.255.250","64.89.160.48"],"domains":["cat.sh"],"paths":["/64.89.160.48/bins/cat.sh"]}}},{"timestamp":"2026-10-05T15:49:32","port":1900,"src_port":34292,"proto":"udp","app_proto":"","app_protocol":"ssdp","summary":"M-SEARCH * HTTP/1.1\r\nHOST: 239.255.255.250:1900\r\nST: urn:schemas-upnp-org:device:Basic:1\r\nMAN: \"ssdp:discover\"\r\nMX: 3\r\nLOCATION: http://64.89.160.48/bins/cat.sh\r\n\r\n","payload_hex":"4d2d534541524348202a20485454502f312e310d0a484f53543a203233392e3235352e3235352e3235303a313930300d0a53543a2075726e3a736368656d61732d75706e702d6f72673a6465766963653a42617369633a310d0a4d414e3a2022737364703a646973636f766572220d0a4d583a20330d0a4c4f434154494f4e3a20687474703a2f2f36342e38392e3136302e34382f62696e732f6361742e73680d0a0d0a","sni":"","session":"bfc31e8a-eb76-4d39-aef2-6d626af2117b","bytes_in":164,"source_verified":false,"enriched":{"digest":"981472fed857c50c","strings":["M-SEARCH * HTTP/1.1","HOST: 239.255.255.250:1900","ST: urn:schemas-upnp-org:device:Basic:1","MAN: \"ssdp:discover\"","MX: 3","LOCATION: http://64.89.160.48/bins/cat.sh"],"iocs":{"urls":["http://64.89.160.48/bins/cat.sh"],"ips":["239.255.255.250","64.89.160.48"],"domains":["cat.sh"],"paths":["/64.89.160.48/bins/cat.sh"]}}},{"timestamp":"2026-10-05T15:49:08","port":1900,"src_port":42056,"proto":"udp","app_proto":"","app_protocol":"ssdp","summary":"M-SEARCH * HTTP/1.1\r\nHOST: 239.255.255.250:1900\r\nST: urn:schemas-upnp-org:device:Basic:1\r\nMAN: \"ssdp:discover\"\r\nMX: 3\r\nLOCATION: http://64.89.160.48/bins/cat.sh\r\n\r\n","payload_hex":"4d2d534541524348202a20485454502f312e310d0a484f53543a203233392e3235352e3235352e3235303a313930300d0a53543a2075726e3a736368656d61732d75706e702d6f72673a6465766963653a42617369633a310d0a4d414e3a2022737364703a646973636f766572220d0a4d583a20330d0a4c4f434154494f4e3a20687474703a2f2f36342e38392e3136302e34382f62696e732f6361742e73680d0a0d0a","sni":"","session":"735ed350-ed8c-4390-a11f-ffe6e2d93271","bytes_in":164,"source_verified":false,"enriched":{"digest":"981472fed857c50c","strings":["M-SEARCH * HTTP/1.1","HOST: 239.255.255.250:1900","ST: urn:schemas-upnp-org:device:Basic:1","MAN: \"ssdp:discover\"","MX: 3","LOCATION: http://64.89.160.48/bins/cat.sh"],"iocs":{"urls":["http://64.89.160.48/bins/cat.sh"],"ips":["239.255.255.250","64.89.160.48"],"domains":["cat.sh"],"paths":["/64.89.160.48/bins/cat.sh"]}}},{"timestamp":"2026-10-05T15:33:32","port":1900,"src_port":51502,"proto":"udp","app_proto":"","app_protocol":"ssdp","summary":"M-SEARCH * HTTP/1.1\r\nHOST: 239.255.255.250:1900\r\nST: urn:schemas-upnp-org:device:Basic:1\r\nMAN: \"ssdp:discover\"\r\nMX: 3\r\nLOCATION: http://64.89.160.48/bins/cat.sh\r\n\r\n","payload_hex":"4d2d534541524348202a20485454502f312e310d0a484f53543a203233392e3235352e3235352e3235303a313930300d0a53543a2075726e3a736368656d61732d75706e702d6f72673a6465766963653a42617369633a310d0a4d414e3a2022737364703a646973636f766572220d0a4d583a20330d0a4c4f434154494f4e3a20687474703a2f2f36342e38392e3136302e34382f62696e732f6361742e73680d0a0d0a","sni":"","session":"8fb2fabb-9a75-412e-b51c-22b62576880e","bytes_in":164,"source_verified":false,"enriched":{"digest":"981472fed857c50c","strings":["M-SEARCH * HTTP/1.1","HOST: 239.255.255.250:1900","ST: urn:schemas-upnp-org:device:Basic:1","MAN: \"ssdp:discover\"","MX: 3","LOCATION: http://64.89.160.48/bins/cat.sh"],"iocs":{"urls":["http://64.89.160.48/bins/cat.sh"],"ips":["239.255.255.250","64.89.160.48"],"domains":["cat.sh"],"paths":["/64.89.160.48/bins/cat.sh"]}}},{"timestamp":"2026-10-05T15:33:27","port":1900,"src_port":48941,"proto":"udp","app_proto":"","app_protocol":"ssdp","summary":"M-SEARCH * HTTP/1.1\r\nHOST: 239.255.255.250:1900\r\nST: urn:schemas-upnp-org:device:Basic:1\r\nMAN: \"ssdp:discover\"\r\nMX: 3\r\nLOCATION: http://64.89.160.48/bins/cat.sh\r\n\r\n","payload_hex":"4d2d534541524348202a20485454502f312e310d0a484f53543a203233392e3235352e3235352e3235303a313930300d0a53543a2075726e3a736368656d61732d75706e702d6f72673a6465766963653a42617369633a310d0a4d414e3a2022737364703a646973636f766572220d0a4d583a20330d0a4c4f434154494f4e3a20687474703a2f2f36342e38392e3136302e34382f62696e732f6361742e73680d0a0d0a","sni":"","session":"4468b2a8-b917-4396-95ce-a1adb5c05a11","bytes_in":164,"source_verified":false,"enriched":{"digest":"981472fed857c50c","strings":["M-SEARCH * HTTP/1.1","HOST: 239.255.255.250:1900","ST: urn:schemas-upnp-org:device:Basic:1","MAN: \"ssdp:discover\"","MX: 3","LOCATION: http://64.89.160.48/bins/cat.sh"],"iocs":{"urls":["http://64.89.160.48/bins/cat.sh"],"ips":["239.255.255.250","64.89.160.48"],"domains":["cat.sh"],"paths":["/64.89.160.48/bins/cat.sh"]}}},{"timestamp":"2026-10-05T15:33:00","port":1900,"src_port":54594,"proto":"udp","app_proto":"","app_protocol":"ssdp","summary":"M-SEARCH * HTTP/1.1\r\nHOST: 239.255.255.250:1900\r\nST: urn:schemas-upnp-org:device:Basic:1\r\nMAN: \"ssdp:discover\"\r\nMX: 3\r\nLOCATION: http://64.89.160.48/bins/cat.sh\r\n\r\n","payload_hex":"4d2d534541524348202a20485454502f312e310d0a484f53543a203233392e3235352e3235352e3235303a313930300d0a53543a2075726e3a736368656d61732d75706e702d6f72673a6465766963653a42617369633a310d0a4d414e3a2022737364703a646973636f766572220d0a4d583a20330d0a4c4f434154494f4e3a20687474703a2f2f36342e38392e3136302e34382f62696e732f6361742e73680d0a0d0a","sni":"","session":"a7efa2de-a575-4c32-a501-6cf20fffcd0b","bytes_in":164,"source_verified":false,"enriched":{"digest":"981472fed857c50c","strings":["M-SEARCH * HTTP/1.1","HOST: 239.255.255.250:1900","ST: urn:schemas-upnp-org:device:Basic:1","MAN: \"ssdp:discover\"","MX: 3","LOCATION: http://64.89.160.48/bins/cat.sh"],"iocs":{"urls":["http://64.89.160.48/bins/cat.sh"],"ips":["239.255.255.250","64.89.160.48"],"domains":["cat.sh"],"paths":["/64.89.160.48/bins/cat.sh"]}}},{"timestamp":"2026-10-05T15:20:34","port":1900,"src_port":43043,"proto":"udp","app_proto":"","app_protocol":"ssdp","summary":"M-SEARCH * HTTP/1.1\r\nHOST: 239.255.255.250:1900\r\nST: urn:schemas-upnp-org:device:Basic:1\r\nMAN: \"ssdp:discover\"\r\nMX: 3\r\nLOCATION: http://64.89.160.48/bins/cat.sh\r\n\r\n","payload_hex":"4d2d534541524348202a20485454502f312e310d0a484f53543a203233392e3235352e3235352e3235303a313930300d0a53543a2075726e3a736368656d61732d75706e702d6f72673a6465766963653a42617369633a310d0a4d414e3a2022737364703a646973636f766572220d0a4d583a20330d0a4c4f434154494f4e3a20687474703a2f2f36342e38392e3136302e34382f62696e732f6361742e73680d0a0d0a","sni":"","session":"00a1c39d-3fa2-401b-9619-100e3f57d0f1","bytes_in":164,"source_verified":false,"enriched":{"digest":"981472fed857c50c","strings":["M-SEARCH * HTTP/1.1","HOST: 239.255.255.250:1900","ST: urn:schemas-upnp-org:device:Basic:1","MAN: \"ssdp:discover\"","MX: 3","LOCATION: http://64.89.160.48/bins/cat.sh"],"iocs":{"urls":["http://64.89.160.48/bins/cat.sh"],"ips":["239.255.255.250","64.89.160.48"],"domains":["cat.sh"],"paths":["/64.89.160.48/bins/cat.sh"]}}},{"timestamp":"2026-10-05T15:20:27","port":1900,"src_port":37641,"proto":"udp","app_proto":"","app_protocol":"ssdp","summary":"M-SEARCH * HTTP/1.1\r\nHOST: 239.255.255.250:1900\r\nST: urn:schemas-upnp-org:device:Basic:1\r\nMAN: \"ssdp:discover\"\r\nMX: 3\r\nLOCATION: http://64.89.160.48/bins/cat.sh\r\n\r\n","payload_hex":"4d2d534541524348202a20485454502f312e310d0a484f53543a203233392e3235352e3235352e3235303a313930300d0a53543a2075726e3a736368656d61732d75706e702d6f72673a6465766963653a42617369633a310d0a4d414e3a2022737364703a646973636f766572220d0a4d583a20330d0a4c4f434154494f4e3a20687474703a2f2f36342e38392e3136302e34382f62696e732f6361742e73680d0a0d0a","sni":"","session":"c20eb558-b073-4aa0-9b5a-42df0bd39ea7","bytes_in":164,"source_verified":false,"enriched":{"digest":"981472fed857c50c","strings":["M-SEARCH * HTTP/1.1","HOST: 239.255.255.250:1900","ST: urn:schemas-upnp-org:device:Basic:1","MAN: \"ssdp:discover\"","MX: 3","LOCATION: http://64.89.160.48/bins/cat.sh"],"iocs":{"urls":["http://64.89.160.48/bins/cat.sh"],"ips":["239.255.255.250","64.89.160.48"],"domains":["cat.sh"],"paths":["/64.89.160.48/bins/cat.sh"]}}},{"timestamp":"2026-10-05T15:19:59","port":1900,"src_port":39565,"proto":"udp","app_proto":"","app_protocol":"ssdp","summary":"M-SEARCH * HTTP/1.1\r\nHOST: 239.255.255.250:1900\r\nST: urn:schemas-upnp-org:device:Basic:1\r\nMAN: \"ssdp:discover\"\r\nMX: 3\r\nLOCATION: http://64.89.160.48/bins/cat.sh\r\n\r\n","payload_hex":"4d2d534541524348202a20485454502f312e310d0a484f53543a203233392e3235352e3235352e3235303a313930300d0a53543a2075726e3a736368656d61732d75706e702d6f72673a6465766963653a42617369633a310d0a4d414e3a2022737364703a646973636f766572220d0a4d583a20330d0a4c4f434154494f4e3a20687474703a2f2f36342e38392e3136302e34382f62696e732f6361742e73680d0a0d0a","sni":"","session":"79828c8c-9589-4695-af92-db8bb7e0dad7","bytes_in":164,"source_verified":false,"enriched":{"digest":"981472fed857c50c","strings":["M-SEARCH * HTTP/1.1","HOST: 239.255.255.250:1900","ST: urn:schemas-upnp-org:device:Basic:1","MAN: \"ssdp:discover\"","MX: 3","LOCATION: http://64.89.160.48/bins/cat.sh"],"iocs":{"urls":["http://64.89.160.48/bins/cat.sh"],"ips":["239.255.255.250","64.89.160.48"],"domains":["cat.sh"],"paths":["/64.89.160.48/bins/cat.sh"]}}},{"timestamp":"2026-10-05T15:05:49","port":1900,"src_port":39933,"proto":"udp","app_proto":"","app_protocol":"ssdp","summary":"M-SEARCH * HTTP/1.1\r\nHOST: 239.255.255.250:1900\r\nST: urn:schemas-upnp-org:device:Basic:1\r\nMAN: \"ssdp:discover\"\r\nMX: 3\r\nLOCATION: http://64.89.160.48/bins/cat.sh\r\n\r\n","payload_hex":"4d2d534541524348202a20485454502f312e310d0a484f53543a203233392e3235352e3235352e3235303a313930300d0a53543a2075726e3a736368656d61732d75706e702d6f72673a6465766963653a42617369633a310d0a4d414e3a2022737364703a646973636f766572220d0a4d583a20330d0a4c4f434154494f4e3a20687474703a2f2f36342e38392e3136302e34382f62696e732f6361742e73680d0a0d0a","sni":"","session":"0b37f146-9df7-4d5b-a93f-d215c0a0f27b","bytes_in":164,"source_verified":false,"enriched":{"digest":"981472fed857c50c","strings":["M-SEARCH * HTTP/1.1","HOST: 239.255.255.250:1900","ST: urn:schemas-upnp-org:device:Basic:1","MAN: \"ssdp:discover\"","MX: 3","LOCATION: http://64.89.160.48/bins/cat.sh"],"iocs":{"urls":["http://64.89.160.48/bins/cat.sh"],"ips":["239.255.255.250","64.89.160.48"],"domains":["cat.sh"],"paths":["/64.89.160.48/bins/cat.sh"]}}},{"timestamp":"2026-10-05T15:05:43","port":1900,"src_port":59947,"proto":"udp","app_proto":"","app_protocol":"ssdp","summary":"M-SEARCH * HTTP/1.1\r\nHOST: 239.255.255.250:1900\r\nST: urn:schemas-upnp-org:device:Basic:1\r\nMAN: \"ssdp:discover\"\r\nMX: 3\r\nLOCATION: http://64.89.160.48/bins/cat.sh\r\n\r\n","payload_hex":"4d2d534541524348202a20485454502f312e310d0a484f53543a203233392e3235352e3235352e3235303a313930300d0a53543a2075726e3a736368656d61732d75706e702d6f72673a6465766963653a42617369633a310d0a4d414e3a2022737364703a646973636f766572220d0a4d583a20330d0a4c4f434154494f4e3a20687474703a2f2f36342e38392e3136302e34382f62696e732f6361742e73680d0a0d0a","sni":"","session":"f6e47c3c-6bbc-4be7-af7a-0a0c405b6394","bytes_in":164,"source_verified":false,"enriched":{"digest":"981472fed857c50c","strings":["M-SEARCH * HTTP/1.1","HOST: 239.255.255.250:1900","ST: urn:schemas-upnp-org:device:Basic:1","MAN: \"ssdp:discover\"","MX: 3","LOCATION: http://64.89.160.48/bins/cat.sh"],"iocs":{"urls":["http://64.89.160.48/bins/cat.sh"],"ips":["239.255.255.250","64.89.160.48"],"domains":["cat.sh"],"paths":["/64.89.160.48/bins/cat.sh"]}}},{"timestamp":"2026-10-05T15:05:15","port":1900,"src_port":34584,"proto":"udp","app_proto":"","app_protocol":"ssdp","summary":"M-SEARCH * HTTP/1.1\r\nHOST: 239.255.255.250:1900\r\nST: urn:schemas-upnp-org:device:Basic:1\r\nMAN: \"ssdp:discover\"\r\nMX: 3\r\nLOCATION: http://64.89.160.48/bins/cat.sh\r\n\r\n","payload_hex":"4d2d534541524348202a20485454502f312e310d0a484f53543a203233392e3235352e3235352e3235303a313930300d0a53543a2075726e3a736368656d61732d75706e702d6f72673a6465766963653a42617369633a310d0a4d414e3a2022737364703a646973636f766572220d0a4d583a20330d0a4c4f434154494f4e3a20687474703a2f2f36342e38392e3136302e34382f62696e732f6361742e73680d0a0d0a","sni":"","session":"b7cfdae8-055d-47a0-8b28-4a67a98440b6","bytes_in":164,"source_verified":false,"enriched":{"digest":"981472fed857c50c","strings":["M-SEARCH * HTTP/1.1","HOST: 239.255.255.250:1900","ST: urn:schemas-upnp-org:device:Basic:1","MAN: \"ssdp:discover\"","MX: 3","LOCATION: http://64.89.160.48/bins/cat.sh"],"iocs":{"urls":["http://64.89.160.48/bins/cat.sh"],"ips":["239.255.255.250","64.89.160.48"],"domains":["cat.sh"],"paths":["/64.89.160.48/bins/cat.sh"]}}},{"timestamp":"2026-10-05T14:52:31","port":1900,"src_port":56127,"proto":"udp","app_proto":"","app_protocol":"ssdp","summary":"M-SEARCH * HTTP/1.1\r\nHOST: 239.255.255.250:1900\r\nST: urn:schemas-upnp-org:device:Basic:1\r\nMAN: \"ssdp:discover\"\r\nMX: 3\r\nLOCATION: http://64.89.160.48/bins/cat.sh\r\n\r\n","payload_hex":"4d2d534541524348202a20485454502f312e310d0a484f53543a203233392e3235352e3235352e3235303a313930300d0a53543a2075726e3a736368656d61732d75706e702d6f72673a6465766963653a42617369633a310d0a4d414e3a2022737364703a646973636f766572220d0a4d583a20330d0a4c4f434154494f4e3a20687474703a2f2f36342e38392e3136302e34382f62696e732f6361742e73680d0a0d0a","sni":"","session":"ae8295fc-a639-45ec-8e95-9958ab3c859d","bytes_in":164,"source_verified":false,"enriched":{"digest":"981472fed857c50c","strings":["M-SEARCH * HTTP/1.1","HOST: 239.255.255.250:1900","ST: urn:schemas-upnp-org:device:Basic:1","MAN: \"ssdp:discover\"","MX: 3","LOCATION: http://64.89.160.48/bins/cat.sh"],"iocs":{"urls":["http://64.89.160.48/bins/cat.sh"],"ips":["239.255.255.250","64.89.160.48"],"domains":["cat.sh"],"paths":["/64.89.160.48/bins/cat.sh"]}}},{"timestamp":"2026-10-05T14:52:23","port":1900,"src_port":47903,"proto":"udp","app_proto":"","app_protocol":"ssdp","summary":"M-SEARCH * HTTP/1.1\r\nHOST: 239.255.255.250:1900\r\nST: urn:schemas-upnp-org:device:Basic:1\r\nMAN: \"ssdp:discover\"\r\nMX: 3\r\nLOCATION: http://64.89.160.48/bins/cat.sh\r\n\r\n","payload_hex":"4d2d534541524348202a20485454502f312e310d0a484f53543a203233392e3235352e3235352e3235303a313930300d0a53543a2075726e3a736368656d61732d75706e702d6f72673a6465766963653a42617369633a310d0a4d414e3a2022737364703a646973636f766572220d0a4d583a20330d0a4c4f434154494f4e3a20687474703a2f2f36342e38392e3136302e34382f62696e732f6361742e73680d0a0d0a","sni":"","session":"cb355e8c-e306-4a15-b255-25847f453360","bytes_in":164,"source_verified":false,"enriched":{"digest":"981472fed857c50c","strings":["M-SEARCH * HTTP/1.1","HOST: 239.255.255.250:1900","ST: urn:schemas-upnp-org:device:Basic:1","MAN: \"ssdp:discover\"","MX: 3","LOCATION: http://64.89.160.48/bins/cat.sh"],"iocs":{"urls":["http://64.89.160.48/bins/cat.sh"],"ips":["239.255.255.250","64.89.160.48"],"domains":["cat.sh"],"paths":["/64.89.160.48/bins/cat.sh"]}}},{"timestamp":"2026-10-05T14:51:57","port":1900,"src_port":35952,"proto":"udp","app_proto":"","app_protocol":"ssdp","summary":"M-SEARCH * HTTP/1.1\r\nHOST: 239.255.255.250:1900\r\nST: urn:schemas-upnp-org:device:Basic:1\r\nMAN: \"ssdp:discover\"\r\nMX: 3\r\nLOCATION: http://64.89.160.48/bins/cat.sh\r\n\r\n","payload_hex":"4d2d534541524348202a20485454502f312e310d0a484f53543a203233392e3235352e3235352e3235303a313930300d0a53543a2075726e3a736368656d61732d75706e702d6f72673a6465766963653a42617369633a310d0a4d414e3a2022737364703a646973636f766572220d0a4d583a20330d0a4c4f434154494f4e3a20687474703a2f2f36342e38392e3136302e34382f62696e732f6361742e73680d0a0d0a","sni":"","session":"3d5d757b-8392-452a-a21f-54bd019180ff","bytes_in":164,"source_verified":false,"enriched":{"digest":"981472fed857c50c","strings":["M-SEARCH * HTTP/1.1","HOST: 239.255.255.250:1900","ST: urn:schemas-upnp-org:device:Basic:1","MAN: \"ssdp:discover\"","MX: 3","LOCATION: http://64.89.160.48/bins/cat.sh"],"iocs":{"urls":["http://64.89.160.48/bins/cat.sh"],"ips":["239.255.255.250","64.89.160.48"],"domains":["cat.sh"],"paths":["/64.89.160.48/bins/cat.sh"]}}},{"timestamp":"2026-10-05T14:47:20","port":1900,"src_port":33230,"proto":"udp","app_proto":"","app_protocol":"ssdp","summary":"M-SEARCH * HTTP/1.1\r\nHOST: 239.255.255.250:1900\r\nST: urn:schemas-upnp-org:device:Basic:1\r\nMAN: \"ssdp:discover\"\r\nMX: 3\r\nLOCATION: http://64.89.160.48/bins/cat.sh\r\n\r\n","payload_hex":"4d2d534541524348202a20485454502f312e310d0a484f53543a203233392e3235352e3235352e3235303a313930300d0a53543a2075726e3a736368656d61732d75706e702d6f72673a6465766963653a42617369633a310d0a4d414e3a2022737364703a646973636f766572220d0a4d583a20330d0a4c4f434154494f4e3a20687474703a2f2f36342e38392e3136302e34382f62696e732f6361742e73680d0a0d0a","sni":"","session":"54cf1bb4-1615-4c42-9f36-a61940a9d2cc","bytes_in":164,"source_verified":false,"enriched":{"digest":"981472fed857c50c","strings":["M-SEARCH * HTTP/1.1","HOST: 239.255.255.250:1900","ST: urn:schemas-upnp-org:device:Basic:1","MAN: \"ssdp:discover\"","MX: 3","LOCATION: http://64.89.160.48/bins/cat.sh"],"iocs":{"urls":["http://64.89.160.48/bins/cat.sh"],"ips":["239.255.255.250","64.89.160.48"],"domains":["cat.sh"],"paths":["/64.89.160.48/bins/cat.sh"]}}},{"timestamp":"2026-10-05T14:47:14","port":1900,"src_port":54417,"proto":"udp","app_proto":"","app_protocol":"ssdp","summary":"M-SEARCH * HTTP/1.1\r\nHOST: 239.255.255.250:1900\r\nST: urn:schemas-upnp-org:device:Basic:1\r\nMAN: \"ssdp:discover\"\r\nMX: 3\r\nLOCATION: http://64.89.160.48/bins/cat.sh\r\n\r\n","payload_hex":"4d2d534541524348202a20485454502f312e310d0a484f53543a203233392e3235352e3235352e3235303a313930300d0a53543a2075726e3a736368656d61732d75706e702d6f72673a6465766963653a42617369633a310d0a4d414e3a2022737364703a646973636f766572220d0a4d583a20330d0a4c4f434154494f4e3a20687474703a2f2f36342e38392e3136302e34382f62696e732f6361742e73680d0a0d0a","sni":"","session":"b91700a0-8dc2-4ddc-adb0-15749ad39805","bytes_in":164,"source_verified":false,"enriched":{"digest":"981472fed857c50c","strings":["M-SEARCH * HTTP/1.1","HOST: 239.255.255.250:1900","ST: urn:schemas-upnp-org:device:Basic:1","MAN: \"ssdp:discover\"","MX: 3","LOCATION: http://64.89.160.48/bins/cat.sh"],"iocs":{"urls":["http://64.89.160.48/bins/cat.sh"],"ips":["239.255.255.250","64.89.160.48"],"domains":["cat.sh"],"paths":["/64.89.160.48/bins/cat.sh"]}}},{"timestamp":"2026-10-05T14:46:46","port":1900,"src_port":58054,"proto":"udp","app_proto":"","app_protocol":"ssdp","summary":"M-SEARCH * HTTP/1.1\r\nHOST: 239.255.255.250:1900\r\nST: urn:schemas-upnp-org:device:Basic:1\r\nMAN: \"ssdp:discover\"\r\nMX: 3\r\nLOCATION: http://64.89.160.48/bins/cat.sh\r\n\r\n","payload_hex":"4d2d534541524348202a20485454502f312e310d0a484f53543a203233392e3235352e3235352e3235303a313930300d0a53543a2075726e3a736368656d61732d75706e702d6f72673a6465766963653a42617369633a310d0a4d414e3a2022737364703a646973636f766572220d0a4d583a20330d0a4c4f434154494f4e3a20687474703a2f2f36342e38392e3136302e34382f62696e732f6361742e73680d0a0d0a","sni":"","session":"bcaf49fa-7145-4206-bce3-ce66015789bb","bytes_in":164,"source_verified":false,"enriched":{"digest":"981472fed857c50c","strings":["M-SEARCH * HTTP/1.1","HOST: 239.255.255.250:1900","ST: urn:schemas-upnp-org:device:Basic:1","MAN: \"ssdp:discover\"","MX: 3","LOCATION: http://64.89.160.48/bins/cat.sh"],"iocs":{"urls":["http://64.89.160.48/bins/cat.sh"],"ips":["239.255.255.250","64.89.160.48"],"domains":["cat.sh"],"paths":["/64.89.160.48/bins/cat.sh"]}}},{"timestamp":"2026-10-05T14:31:33","port":1900,"src_port":39905,"proto":"udp","app_proto":"","app_protocol":"ssdp","summary":"M-SEARCH * HTTP/1.1\r\nHOST: 239.255.255.250:1900\r\nST: urn:schemas-upnp-org:device:Basic:1\r\nMAN: \"ssdp:discover\"\r\nMX: 3\r\nLOCATION: http://64.89.160.48/bins/cat.sh\r\n\r\n","payload_hex":"4d2d534541524348202a20485454502f312e310d0a484f53543a203233392e3235352e3235352e3235303a313930300d0a53543a2075726e3a736368656d61732d75706e702d6f72673a6465766963653a42617369633a310d0a4d414e3a2022737364703a646973636f766572220d0a4d583a20330d0a4c4f434154494f4e3a20687474703a2f2f36342e38392e3136302e34382f62696e732f6361742e73680d0a0d0a","sni":"","session":"722bde63-80e7-4904-a222-62fd36246b94","bytes_in":164,"source_verified":false,"enriched":{"digest":"981472fed857c50c","strings":["M-SEARCH * HTTP/1.1","HOST: 239.255.255.250:1900","ST: urn:schemas-upnp-org:device:Basic:1","MAN: \"ssdp:discover\"","MX: 3","LOCATION: http://64.89.160.48/bins/cat.sh"],"iocs":{"urls":["http://64.89.160.48/bins/cat.sh"],"ips":["239.255.255.250","64.89.160.48"],"domains":["cat.sh"],"paths":["/64.89.160.48/bins/cat.sh"]}}},{"timestamp":"2026-10-05T14:31:27","port":1900,"src_port":54077,"proto":"udp","app_proto":"","app_protocol":"ssdp","summary":"M-SEARCH * HTTP/1.1\r\nHOST: 239.255.255.250:1900\r\nST: urn:schemas-upnp-org:device:Basic:1\r\nMAN: \"ssdp:discover\"\r\nMX: 3\r\nLOCATION: http://64.89.160.48/bins/cat.sh\r\n\r\n","payload_hex":"4d2d534541524348202a20485454502f312e310d0a484f53543a203233392e3235352e3235352e3235303a313930300d0a53543a2075726e3a736368656d61732d75706e702d6f72673a6465766963653a42617369633a310d0a4d414e3a2022737364703a646973636f766572220d0a4d583a20330d0a4c4f434154494f4e3a20687474703a2f2f36342e38392e3136302e34382f62696e732f6361742e73680d0a0d0a","sni":"","session":"63583c72-96e3-4285-9682-ef64a520676e","bytes_in":164,"source_verified":false,"enriched":{"digest":"981472fed857c50c","strings":["M-SEARCH * HTTP/1.1","HOST: 239.255.255.250:1900","ST: urn:schemas-upnp-org:device:Basic:1","MAN: \"ssdp:discover\"","MX: 3","LOCATION: http://64.89.160.48/bins/cat.sh"],"iocs":{"urls":["http://64.89.160.48/bins/cat.sh"],"ips":["239.255.255.250","64.89.160.48"],"domains":["cat.sh"],"paths":["/64.89.160.48/bins/cat.sh"]}}},{"timestamp":"2026-10-05T14:31:01","port":1900,"src_port":33507,"proto":"udp","app_proto":"","app_protocol":"ssdp","summary":"M-SEARCH * HTTP/1.1\r\nHOST: 239.255.255.250:1900\r\nST: urn:schemas-upnp-org:device:Basic:1\r\nMAN: \"ssdp:discover\"\r\nMX: 3\r\nLOCATION: http://64.89.160.48/bins/cat.sh\r\n\r\n","payload_hex":"4d2d534541524348202a20485454502f312e310d0a484f53543a203233392e3235352e3235352e3235303a313930300d0a53543a2075726e3a736368656d61732d75706e702d6f72673a6465766963653a42617369633a310d0a4d414e3a2022737364703a646973636f766572220d0a4d583a20330d0a4c4f434154494f4e3a20687474703a2f2f36342e38392e3136302e34382f62696e732f6361742e73680d0a0d0a","sni":"","session":"eda266c5-c5f8-4e24-97f7-b018a6e62d98","bytes_in":164,"source_verified":false,"enriched":{"digest":"981472fed857c50c","strings":["M-SEARCH * HTTP/1.1","HOST: 239.255.255.250:1900","ST: urn:schemas-upnp-org:device:Basic:1","MAN: \"ssdp:discover\"","MX: 3","LOCATION: http://64.89.160.48/bins/cat.sh"],"iocs":{"urls":["http://64.89.160.48/bins/cat.sh"],"ips":["239.255.255.250","64.89.160.48"],"domains":["cat.sh"],"paths":["/64.89.160.48/bins/cat.sh"]}}},{"timestamp":"2026-10-05T14:18:31","port":1900,"src_port":39595,"proto":"udp","app_proto":"","app_protocol":"ssdp","summary":"M-SEARCH * HTTP/1.1\r\nHOST: 239.255.255.250:1900\r\nST: urn:schemas-upnp-org:device:Basic:1\r\nMAN: \"ssdp:discover\"\r\nMX: 3\r\nLOCATION: http://64.89.160.48/bins/cat.sh\r\n\r\n","payload_hex":"4d2d534541524348202a20485454502f312e310d0a484f53543a203233392e3235352e3235352e3235303a313930300d0a53543a2075726e3a736368656d61732d75706e702d6f72673a6465766963653a42617369633a310d0a4d414e3a2022737364703a646973636f766572220d0a4d583a20330d0a4c4f434154494f4e3a20687474703a2f2f36342e38392e3136302e34382f62696e732f6361742e73680d0a0d0a","sni":"","session":"1b52e81d-edb6-48ad-bb31-dc2d602ae97b","bytes_in":164,"source_verified":false,"enriched":{"digest":"981472fed857c50c","strings":["M-SEARCH * HTTP/1.1","HOST: 239.255.255.250:1900","ST: urn:schemas-upnp-org:device:Basic:1","MAN: \"ssdp:discover\"","MX: 3","LOCATION: http://64.89.160.48/bins/cat.sh"],"iocs":{"urls":["http://64.89.160.48/bins/cat.sh"],"ips":["239.255.255.250","64.89.160.48"],"domains":["cat.sh"],"paths":["/64.89.160.48/bins/cat.sh"]}}},{"timestamp":"2026-10-05T14:18:25","port":1900,"src_port":33495,"proto":"udp","app_proto":"","app_protocol":"ssdp","summary":"M-SEARCH * HTTP/1.1\r\nHOST: 239.255.255.250:1900\r\nST: urn:schemas-upnp-org:device:Basic:1\r\nMAN: \"ssdp:discover\"\r\nMX: 3\r\nLOCATION: http://64.89.160.48/bins/cat.sh\r\n\r\n","payload_hex":"4d2d534541524348202a20485454502f312e310d0a484f53543a203233392e3235352e3235352e3235303a313930300d0a53543a2075726e3a736368656d61732d75706e702d6f72673a6465766963653a42617369633a310d0a4d414e3a2022737364703a646973636f766572220d0a4d583a20330d0a4c4f434154494f4e3a20687474703a2f2f36342e38392e3136302e34382f62696e732f6361742e73680d0a0d0a","sni":"","session":"aae86a67-971b-45db-a84f-47bdcd7f1078","bytes_in":164,"source_verified":false,"enriched":{"digest":"981472fed857c50c","strings":["M-SEARCH * HTTP/1.1","HOST: 239.255.255.250:1900","ST: urn:schemas-upnp-org:device:Basic:1","MAN: \"ssdp:discover\"","MX: 3","LOCATION: http://64.89.160.48/bins/cat.sh"],"iocs":{"urls":["http://64.89.160.48/bins/cat.sh"],"ips":["239.255.255.250","64.89.160.48"],"domains":["cat.sh"],"paths":["/64.89.160.48/bins/cat.sh"]}}},{"timestamp":"2026-10-05T14:18:00","port":1900,"src_port":47891,"proto":"udp","app_proto":"","app_protocol":"ssdp","summary":"M-SEARCH * HTTP/1.1\r\nHOST: 239.255.255.250:1900\r\nST: urn:schemas-upnp-org:device:Basic:1\r\nMAN: \"ssdp:discover\"\r\nMX: 3\r\nLOCATION: http://64.89.160.48/bins/cat.sh\r\n\r\n","payload_hex":"4d2d534541524348202a20485454502f312e310d0a484f53543a203233392e3235352e3235352e3235303a313930300d0a53543a2075726e3a736368656d61732d75706e702d6f72673a6465766963653a42617369633a310d0a4d414e3a2022737364703a646973636f766572220d0a4d583a20330d0a4c4f434154494f4e3a20687474703a2f2f36342e38392e3136302e34382f62696e732f6361742e73680d0a0d0a","sni":"","session":"8e4445cb-d573-4a6a-bc71-a65c7354571f","bytes_in":164,"source_verified":false,"enriched":{"digest":"981472fed857c50c","strings":["M-SEARCH * HTTP/1.1","HOST: 239.255.255.250:1900","ST: urn:schemas-upnp-org:device:Basic:1","MAN: \"ssdp:discover\"","MX: 3","LOCATION: http://64.89.160.48/bins/cat.sh"],"iocs":{"urls":["http://64.89.160.48/bins/cat.sh"],"ips":["239.255.255.250","64.89.160.48"],"domains":["cat.sh"],"paths":["/64.89.160.48/bins/cat.sh"]}}},{"timestamp":"2026-10-05T14:11:08","port":1900,"src_port":45083,"proto":"udp","app_proto":"","app_protocol":"ssdp","summary":"M-SEARCH * HTTP/1.1\r\nHOST: 239.255.255.250:1900\r\nST: urn:schemas-upnp-org:device:Basic:1\r\nMAN: \"ssdp:discover\"\r\nMX: 3\r\nLOCATION: http://64.89.160.48/bins/cat.sh\r\n\r\n","payload_hex":"4d2d534541524348202a20485454502f312e310d0a484f53543a203233392e3235352e3235352e3235303a313930300d0a53543a2075726e3a736368656d61732d75706e702d6f72673a6465766963653a42617369633a310d0a4d414e3a2022737364703a646973636f766572220d0a4d583a20330d0a4c4f434154494f4e3a20687474703a2f2f36342e38392e3136302e34382f62696e732f6361742e73680d0a0d0a","sni":"","session":"986e010a-7eef-44e7-8ae5-c8bef0ddd50c","bytes_in":164,"source_verified":false,"enriched":{"digest":"981472fed857c50c","strings":["M-SEARCH * HTTP/1.1","HOST: 239.255.255.250:1900","ST: urn:schemas-upnp-org:device:Basic:1","MAN: \"ssdp:discover\"","MX: 3","LOCATION: http://64.89.160.48/bins/cat.sh"],"iocs":{"urls":["http://64.89.160.48/bins/cat.sh"],"ips":["239.255.255.250","64.89.160.48"],"domains":["cat.sh"],"paths":["/64.89.160.48/bins/cat.sh"]}}}]},"top_ports":[{"port":8080,"proto":"tcp","label":"HTTP-alt","count":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":["b11cun070_0004003f_8a4d1a98"]},"fingerprint_peers":{"b11cun070_0004003f_8a4d1a98":12},"akin_families":{},"user_agents":["Linux Gnu (cow)"],"timeline":[{"date":"2026-10-04","count":1}],"recent_events":[{"timestamp":"2026-10-04T01:34:48","port":8080,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8\",\"accept-encoding\":\"gzip, deflate\",\"accept-language\":\"en-GB,en;q=0.5\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8080\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"Linux Gnu (cow)\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a383038300d0a557365722d4167656e743a204c696e757820476e752028636f7729200d0a4163636570743a20746578742f68746d6c2c6170706c69636174696f6e2f7868746d6c2b786d6c2c6170706c69636174696f6e2f786d6c3b713d302e392c696d6167652f776562702c2a2f2a3b713d302e380d0a4163636570742d4c616e67756167653a20656e2d47422c656e3b713d302e350d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a436f6e6e656374696f6e3a20636c6f73650d0a557067726164652d496e7365637572652d52657175657374733a20310d0a0d0a","method":"GET","user_agent":"Linux Gnu (cow)","ja3":"","session":"a8611561-825f-4df7-b021-0ff816bb9f54","seq":1,"duration_ms":100,"bytes_in":271,"bytes_out":76}],"http_methods":[{"method":"GET","count":1}],"distinct_ports_total":1,"top_paths":[{"path":"/","count":1,"ports":1}],"distinct_paths_total":1,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","Accept-Encoding","Accept-Language","Connection","Host","Upgrade-Insecure-Requests","User-Agent"],"representative":[{"name":"Accept","value":"text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8","notable":false},{"name":"Accept-Encoding","value":"gzip, deflate","notable":false},{"name":"Accept-Language","value":"en-GB,en;q=0.5","notable":false},{"name":"Connection","value":"close","notable":false},{"name":"Host","value":"<HONEYPOT>:8080","notable":false},{"name":"Upgrade-Insecure-Requests","value":"1","notable":false},{"name":"User-Agent","value":"Linux Gnu (cow)","notable":false}],"distinct_sets":1,"events_with_headers":1},"tags":[],"data_as_of":"2026-10-05T20:49:32.577075+00:00"}