{"ip":"71.6.158.166","data_as_of":"2026-10-23T11:07:51+00:00","observed":true,"total_events":2176,"verdict":{"verdict":"scanner","label":"Recognized scanner","detail":"shodan","confidence":"high","network_type":null,"why":["The address is in a published scanner range (shodan).","Known research and commercial scanners are labelled by operator and carry no threat verdict.","Counts include 129 interactive session(s) as well as first-packet events.","Interactive sessions: 2 interactive session(s) carried an exploit attempt."],"engagement":{"level":"payload","label":"Sustained payload","detail":"241,850 bytes sent","bytes_sent":241850,"session_seconds":28,"persistent":false},"basis":"combined"},"first_seen":"2026-02-17T10:29:38","last_seen":"2026-10-23T01:26:36","events_24h":12,"events_7d":146,"interactive_sessions":129,"interactive_sessions_24h":6,"interactive_sessions_7d":105,"interactive_protocols":[{"protocol":"http","sessions":25},{"protocol":"pop3","sessions":15},{"protocol":"ssh","sessions":6},{"protocol":"vnc","sessions":6},{"protocol":"rdp","sessions":4},{"protocol":"smtp","sessions":3},{"protocol":"s7comm","sessions":2},{"protocol":"stratum","sessions":2},{"protocol":"socks5","sessions":1},{"protocol":"smb","sessions":1}],"geo":{"country_code":"US","country_name":"United States","region":"","city":"","lat":37.751,"lon":-97.822,"asn":10439,"org":"CariNet, Inc."},"source_domain":"ninja.census.shodan.io","known_scanners":["shodan","Shodan"],"scanner_tag":{"key":"shodan","label":"Shodan","category":"commercial","url":"https://www.shodan.io/"},"cve_matches":[],"malware":[],"udp":{"source_verified":false,"window_days":90,"events":17,"protocols":[{"protocol":"udp","events":17}],"ports":[{"port":1701,"events":2},{"port":7,"events":1},{"port":111,"events":1},{"port":389,"events":1},{"port":523,"events":1},{"port":626,"events":1},{"port":1194,"events":1},{"port":2123,"events":1},{"port":3386,"events":1},{"port":4800,"events":1}],"dns_questions":[],"quic_clients":[],"first_seen":"2026-10-13T18:21:47","last_seen":"2026-10-22T20:10:25","recent":[{"timestamp":"2026-10-22T20:10:25","port":523,"src_port":21172,"proto":"udp","app_proto":"","app_protocol":"","summary":"DB2GETADDR\u0000SQL08010\u0000","payload_hex":"444232474554414444520053514c303830313000","sni":"","session":"bcdeb8b0-5ac5-49d3-b36a-0294387ade4c","bytes_in":20,"source_verified":false,"enriched":{"digest":"b50f2bbb287fb5b0","strings":["DB2GETADDR","SQL08010","DB2GETADDRSQL08010"]}},{"timestamp":"2026-10-20T03:56:13","port":1701,"src_port":9531,"proto":"udp","app_proto":"","app_protocol":"","summary":"�\u0002\u0000<\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000�\b\u0000\u0000\u0000\u0000\u0000\u0001�\b\u0000\u0000\u0000\u0002\u0001\u0000�\u000e\u0000\u0000\u0000\u0007nxp-scan�\n\u0000\u0000\u0000\u0003\u0000\u0000\u0000\u0003�\b\u0000\u0000\u0000\t\u0000\u0000","payload_hex":"c802003c000000000000000080080000000000018008000000020100800e000000076e78702d7363616e800a00000003000000038008000000090000","sni":"","session":"7484b4d0-0357-4928-9d01-ca2173acafe4","bytes_in":60,"source_verified":false,"enriched":{"digest":"1e61134475a676f7","strings":["nxp-scan"]}},{"timestamp":"2026-10-20T01:47:01","port":17185,"src_port":19243,"proto":"udp","app_proto":"","app_protocol":"","summary":"\u001a\t��\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002UUUU\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000��U\u0012\u0000\u0000\u0000<\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000","payload_hex":"1a09faba000000000000000255555555000000010000000100000000000000000000000000000000ffff55120000003c00000001000000020000000000000000","sni":"","session":"a838822a-16ea-416e-998c-77c6536c5268","bytes_in":64,"source_verified":false,"enriched":{"digest":"3a1da6b0c87973b4","strings":["UUUU"]}},{"timestamp":"2026-10-19T04:09:44","port":30311,"src_port":24955,"proto":"udp","app_proto":"","app_protocol":"","summary":"���7lu��E��ƥ6N\"S�\u0013\u0014|�*�_D\u0015j�(��p|x ��R�]�\u001f�7X�K\u001c�\u00137\fV�\b^�\u0010\u0017ծ�l7@RG\\�\u0014Յ�\u00007��\u0019��:g��~J�m�R��\\�^\u0000\u0001�\u0004˄\u0000\u0000\u0001�v_�v_˄\u0000\u0000\u0001�v_�v_�j�'","payload_hex":"f99885376c75b5f345eaf3c6a5364e22539f13147c882af85f44156ac52886bc707c78208f8a52be5de71fa13758fe4b1ce713370c56cc085ec31017d5aed46c374052475ce014d585b5003787c819e19c3a67cde17e4a896dff52a5e85c875e0001de04cb847f00000182765f82765fcb847f00000182765f82765f846ad47f27","sni":"","session":"47fd2bac-e4a8-4865-8557-b6dbe53531f1","bytes_in":129,"source_verified":false,"enriched":{"digest":"a9eccdb718246637","strings":["6N\"S","l7@RG\\"]}},{"timestamp":"2026-10-18T19:03:11","port":3386,"src_port":30227,"proto":"udp","app_proto":"","app_protocol":"","summary":"2\u0001\u0000\u0004\u0000\u0000\u0000\u0000\f=\u0000\u0000","payload_hex":"32010004000000000c3d0000","sni":"","session":"4696901e-7054-4e1d-8052-406039f6df51","bytes_in":12,"source_verified":false},{"timestamp":"2026-10-18T06:57:40","port":111,"src_port":14903,"proto":"udp","app_proto":"","app_protocol":"nfs","summary":"\u000b�<%\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001��\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0004\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000","payload_hex":"0bcd3c250000000000000002000186a0000000020000000400000000000000000000000000000000","sni":"","session":"3f116b2c-d122-4a22-b498-a7e30608f407","bytes_in":40,"source_verified":false},{"timestamp":"2026-10-17T12:24:21","port":27015,"src_port":16728,"proto":"udp","app_proto":"","app_protocol":"","summary":"����TSource Engine Query\u0000","payload_hex":"ffffffff54536f7572636520456e67696e6520517565727900","sni":"","session":"19d7c5c9-6f73-4a92-8c59-e41aff85f1f3","bytes_in":25,"source_verified":false,"enriched":{"digest":"63a483aa9fa2eb4b","strings":["TSource Engine Query"]}},{"timestamp":"2026-10-17T10:48:37","port":626,"src_port":2442,"proto":"udp","app_proto":"","app_protocol":"","summary":"SNQUERY: 127.0.0.1:AAAAAA:xsvr","payload_hex":"534e51554552593a203132372e302e302e313a4141414141413a78737672","sni":"","session":"fd60037d-5053-4ee2-a37b-02a0cba000e6","bytes_in":30,"source_verified":false,"enriched":{"digest":"a7b99493357929ca","strings":["SNQUERY: 127.0.0.1:AAAAAA:xsvr"],"iocs":{"ips":["127.0.0.1"]}}},{"timestamp":"2026-10-16T14:26:42","port":7,"src_port":27221,"proto":"udp","app_proto":"","app_protocol":"","summary":"echo","payload_hex":"6563686f","sni":"","session":"6aa7f683-68dd-4a66-97f6-ee0eb62a46ef","bytes_in":4,"source_verified":false,"enriched":{"digest":"b2d21e771d9f8686","strings":["echo"]}},{"timestamp":"2026-10-15T19:53:23","port":1194,"src_port":26876,"proto":"udp","app_proto":"","app_protocol":"","summary":"8��:����m\u0000\u0000\u0000\u0000\u0000T","payload_hex":"38d9ce3abef698a56d000000000054","sni":"","session":"8bcc97f1-20e6-43e3-b7c9-c502f09721f9","bytes_in":15,"source_verified":false},{"timestamp":"2026-10-15T02:06:50","port":2123,"src_port":30227,"proto":"udp","app_proto":"","app_protocol":"gtp_c","summary":"2\u0001\u0000\u0004\u0000\u0000\u0000\u0000\f=\u0000\u0000","payload_hex":"32010004000000000c3d0000","sni":"","session":"4887bd8d-6128-4a73-accc-74db63bc22fa","bytes_in":12,"source_verified":false},{"timestamp":"2026-10-14T23:46:06","port":10001,"src_port":21442,"proto":"udp","app_proto":"","app_protocol":"","summary":"\u0001\u0000\u0000\u0000","payload_hex":"01000000","sni":"","session":"707ac976-487f-446c-bd8c-b4273dace28d","bytes_in":4,"source_verified":false},{"timestamp":"2026-10-14T23:23:32","port":5050,"src_port":30066,"proto":"udp","app_proto":"","app_protocol":"","summary":"�\u0000\u0000\n\u0000\u0000\u0000\u0000\u0000\u0000\u0000\b\u0000\u0000\u0000\u0002","payload_hex":"dd00000a000000000000000800000002","sni":"","session":"35c2375a-ea2f-4a3b-9f9e-5d3dce82be7a","bytes_in":16,"source_verified":false},{"timestamp":"2026-10-14T13:03:12","port":4800,"src_port":28855,"proto":"udp","app_proto":"","app_protocol":"","summary":"\u0001\u0000\u0000\b\u0000\u0000\u0000\u0000","payload_hex":"0100000800000000","sni":"","session":"9f0fc12c-b3d5-4cf0-bc4c-153f7d4bdd08","bytes_in":8,"source_verified":false},{"timestamp":"2026-10-14T12:54:13","port":11211,"src_port":26477,"proto":"udp","app_proto":"","app_protocol":"","summary":"\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000stats\r\n","payload_hex":"000000000001000073746174730d0a","sni":"","session":"fc3e21aa-dd5c-420e-99a3-f3906b92a453","bytes_in":15,"source_verified":false,"enriched":{"digest":"aea7f2c1ff30d6c2","strings":["stats"]}},{"timestamp":"2026-10-13T21:41:34","port":389,"src_port":32064,"proto":"udp","app_proto":"","app_protocol":"ldap","summary":"0�\u0000\u0000\u0000-\u0002\u0001\u0007c�\u0000\u0000\u0000$\u0004\u0000\n\u0001\u0000\n\u0001\u0000\u0002\u0001\u0000\u0002\u0001d\u0001\u0001\u0000�\u000bobjectClass0�\u0000\u0000\u0000\u0000","payload_hex":"30840000002d02010763840000002404000a01000a0100020100020164010100870b6f626a656374436c617373308400000000","sni":"","session":"6ce2306b-8160-4afb-890f-8680276b0d77","bytes_in":51,"source_verified":false,"enriched":{"digest":"312a669a1b89ac2a","strings":["objectClass0"]}},{"timestamp":"2026-10-13T18:21:47","port":1701,"src_port":9531,"proto":"udp","app_proto":"","app_protocol":"","summary":"�\u0002\u0000<\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000�\b\u0000\u0000\u0000\u0000\u0000\u0001�\b\u0000\u0000\u0000\u0002\u0001\u0000�\u000e\u0000\u0000\u0000\u0007nxp-scan�\n\u0000\u0000\u0000\u0003\u0000\u0000\u0000\u0003�\b\u0000\u0000\u0000\t\u0000\u0000","payload_hex":"c802003c000000000000000080080000000000018008000000020100800e000000076e78702d7363616e800a00000003000000038008000000090000","sni":"","session":"20b39129-17c1-4dd1-90b2-66935f93a2a6","bytes_in":60,"source_verified":false,"enriched":{"digest":"1e61134475a676f7","strings":["nxp-scan"]}}]},"interaction":{"window_days":90,"sessions":135,"first_seen":"2026-10-14T23:53:22","last_seen":"2026-10-23T01:26:36","verdicts":[{"verdict":"unknown","sessions":88},{"verdict":"scan","sessions":45},{"verdict":"exploit-attempt","sessions":2}],"personas":[{"persona":"dovecot@2.3.13","sessions":15},{"persona":"vnc@TightVNC 2.8.81","sessions":6},{"persona":"linux-ubuntu@20.04","sessions":6},{"persona":"nginx@1.18.0, wordpress@6.5.2, leaks@1, miner@cgminer 4.11.1, elasticsearch@8.11.1, winrm@Windows Server 2019, dlink-dir645@1.03, fortigate@7.2.1, gitlab@19.4.2","sessions":6},{"persona":"nginx@1.24.0, wordpress@6.5.2, leaks@2, miner@bfgminer 5.5.0, elasticsearch@6.8.23, winrm@Windows Server 2016, fortigate@7.0.5, docker@25.0.3","sessions":5},{"persona":"rdp@Windows Server 2019","sessions":4},{"persona":"nginx@1.24.0, wordpress@6.5.2, leaks@2, miner@bfgminer 5.5.0, elasticsearch@6.8.23, winrm@Windows Server 2016, fortigate@7.0.5","sessions":4},{"persona":"nginx@1.18.0, wordpress@6.5.2, leaks@1, miner@cgminer 4.11.1, elasticsearch@8.11.1, winrm@Windows Server 2019, discovery@igd 1.0, fortigate@7.2.1","sessions":4},{"persona":"smtp@3.4.13","sessions":3},{"persona":"nginx@1.18.0, wordpress@6.5.2, leaks@1, miner@cgminer 4.11.1, elasticsearch@8.11.1, winrm@Windows Server 2019, fortigate@7.2.1, docker@25.0.3","sessions":3},{"persona":"nginx@1.18.0, wordpress@6.5.2, leaks@1, miner@cgminer 4.11.1, elasticsearch@8.11.1, winrm@Windows Server 2019, fortigate@7.2.1","sessions":3}],"services":[{"protocol":"tcp","port":30002,"sessions":18},{"protocol":"pop3","port":995,"sessions":15},{"protocol":"http","port":443,"sessions":9},{"protocol":"tcp","port":18081,"sessions":9},{"protocol":"ssh","port":122,"sessions":6},{"protocol":"vnc","port":5900,"sessions":6},{"protocol":"tcp","port":23023,"sessions":6},{"protocol":"http","port":80,"sessions":6},{"protocol":"tcp","port":4022,"sessions":6},{"protocol":"tcp","port":2087,"sessions":5},{"protocol":"rdp","port":3388,"sessions":4},{"protocol":"tcp","port":55443,"sessions":4}],"logins":[],"commands":[],"downloads":[],"files":[],"attack":[{"technique_id":"T1595","technique_name":"Active Scanning","tactic_id":"TA0043","tactic_name":"Reconnaissance","sessions":45},{"technique_id":"T1078","technique_name":"Valid Accounts","tactic_id":"TA0001","tactic_name":"Initial Access","sessions":2},{"technique_id":"T1190","technique_name":"Exploit Public-Facing Application","tactic_id":"TA0001","tactic_name":"Initial Access","sessions":2},{"technique_id":"T1110","technique_name":"Brute Force","tactic_id":"TA0006","tactic_name":"Credential Access","sessions":2}]},"top_ports":[{"port":443,"proto":"tcp","label":"HTTPS","count":42,"sessions":9},{"port":502,"proto":"tcp","label":"","count":42,"sessions":0},{"port":8009,"proto":"tcp","label":"","count":36,"sessions":0},{"port":311,"proto":"tcp","label":"","count":28,"sessions":0},{"port":9443,"proto":"tcp","label":"","count":24,"sessions":0},{"port":2083,"proto":"tcp","label":"","count":22,"sessions":0},{"port":2087,"proto":"tcp","label":"","count":17,"sessions":5},{"port":9943,"proto":"tcp","label":"","count":20,"sessions":0},{"port":444,"proto":"tcp","label":"","count":19,"sessions":0},{"port":6697,"proto":"tcp","label":"","count":18,"sessions":0},{"port":1935,"proto":"tcp","label":"","count":18,"sessions":0},{"port":37215,"proto":"tcp","label":"","count":17,"sessions":1},{"port":30002,"proto":"tcp","label":"","count":0,"sessions":18},{"port":5006,"proto":"tcp","label":"","count":16,"sessions":0},{"port":5001,"proto":"tcp","label":"","count":16,"sessions":0}],"fingerprints":{"ssh_hassh":["a704be057881f0b1d623cd263e477a8b"],"tls_ja4":["t12i570500_2a2bed94251f_a1e935682795","t13i430900_c7886603b240_5ac7197df9d2","t13d311100_e8f1e7e78f70_801c830e80cf","t13d311200_e8f1e7e78f70_83b0a02006cb","t10i370400_72f89a0e462d_282f11336259","t12d6912hq_ea0618708e31_1da015a32102","t12i130500_2d7513195f68_021165082e1c","t13i310900_e8f1e7e78f70_5ac7197df9d2"],"tls_client_hello":"1603010138010001340303d96d370557b6f6b8f00e9d46c37bd4c3206c8389ea6a58dacacc8becdc5ad01c205975544ccb0daae8cdb261423f8134ad0a58ecf51024309684d1524c0ad6dd1b0056130213031301c02cc030c02bc02fcca9cca8009f009eccaac0afc0adc0aec0acc024c028c023c027c00ac014c009c013c0a3c09fc0a2c09e006b006700390033009d009cc0a1c09dc0a0c09c003d003c0035002f00ff01000095000b000403000102000a000c000a001d0017001e00190018002300000016000000170000000d0030002e040305030603080708080809080a080b080408050806040105010601030302030301020103020202040205020602002b0009080304030303020301002d00020101003300260024001d0020886056b705c030c0f88d3d5941a8801c06e101c97bba1499ec3848ac66286770","tls_ja3":["27aa226a438f84089010afba37b2351b","a191bc14b8265666586f22ced37b9df6","588552cc67787a99af4abff0d403246f","46bb4b3029ca544e39e1c0a2783e2de5","c34a54599a1fbaf1786aa6d633545a60","c92fc3ba5f0c4636bf174f137a5b3190","cba7f34191ef2379c1325641f6c6c4f4","db8d4ad49cb378fa370b43a61a9b06b6"],"http_akin":["b11cun020_00040010_724c10fb","b11cun020_00040002_5ff1c0a9","b11cun040_00040016_9e0aeda7","b11cun050_00040017_976354f0"],"interactive":{"ssh_hassh":["a704be057881f0b1d623cd263e477a8b"],"tls_ja4":["t10i370400_72f89a0e462d_282f11336259","t12d6912hq_ea0618708e31_1da015a32102","t12i130500_2d7513195f68_021165082e1c","t13i310900_e8f1e7e78f70_5ac7197df9d2","t13i430900_c7886603b240_5ac7197df9d2"],"tls_ja3":["a191bc14b8265666586f22ced37b9df6","c34a54599a1fbaf1786aa6d633545a60","c92fc3ba5f0c4636bf174f137a5b3190","cba7f34191ef2379c1325641f6c6c4f4","db8d4ad49cb378fa370b43a61a9b06b6"]}},"fingerprint_peers":{"t12d6912hq_ea0618708e31_1da015a32102":0,"b11cun020_00040010_724c10fb":1712,"b11cun050_00040017_976354f0":1240,"t13d311100_e8f1e7e78f70_801c830e80cf":24,"t13i430900_c7886603b240_5ac7197df9d2":24,"t12i570500_2a2bed94251f_a1e935682795":24,"t13d311200_e8f1e7e78f70_83b0a02006cb":24,"t12i130500_2d7513195f68_021165082e1c":47,"t10i370400_72f89a0e462d_282f11336259":0,"t13i310900_e8f1e7e78f70_5ac7197df9d2":0,"a704be057881f0b1d623cd263e477a8b":20,"b11cun020_00040002_5ff1c0a9":91,"b11cun040_00040016_9e0aeda7":42},"akin_families":{"b11cun020_00040002_5ff1c0a9":{"head":"b11cun020_00040002_5ff1c0a9","shapes":2,"ips":91},"b11cun040_00040016_9e0aeda7":{"head":"b11cun050_00040017_976354f0","shapes":5,"ips":1240},"b11cun050_00040017_976354f0":{"head":"b11cun050_00040017_976354f0","shapes":5,"ips":1240}},"user_agents":["Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.63 Safari/537.36","Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36","python-requests/2.23.0","Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:82.0) Gecko/20100101 Firefox/82.0","Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.102 Safari/537.36"],"timeline":[{"date":"2026-07-25","count":12,"sessions":0},{"date":"2026-07-26","count":14,"sessions":0},{"date":"2026-07-27","count":32,"sessions":0},{"date":"2026-07-28","count":13,"sessions":0},{"date":"2026-07-29","count":20,"sessions":0},{"date":"2026-07-30","count":4,"sessions":0},{"date":"2026-07-31","count":11,"sessions":0},{"date":"2026-08-01","count":18,"sessions":0},{"date":"2026-08-02","count":1,"sessions":0},{"date":"2026-08-03","count":10,"sessions":0},{"date":"2026-08-04","count":2,"sessions":0},{"date":"2026-08-05","count":1,"sessions":0},{"date":"2026-08-06","count":2,"sessions":0},{"date":"2026-08-07","count":6,"sessions":0},{"date":"2026-08-10","count":9,"sessions":0},{"date":"2026-08-11","count":3,"sessions":0},{"date":"2026-08-12","count":7,"sessions":0},{"date":"2026-08-13","count":16,"sessions":0},{"date":"2026-08-14","count":10,"sessions":0},{"date":"2026-08-15","count":9,"sessions":0},{"date":"2026-08-16","count":21,"sessions":0},{"date":"2026-08-17","count":16,"sessions":0},{"date":"2026-08-18","count":8,"sessions":0},{"date":"2026-08-19","count":25,"sessions":0},{"date":"2026-08-20","count":12,"sessions":0},{"date":"2026-08-21","count":15,"sessions":0},{"date":"2026-08-22","count":9,"sessions":0},{"date":"2026-08-23","count":16,"sessions":0},{"date":"2026-08-24","count":11,"sessions":0},{"date":"2026-08-25","count":7,"sessions":0},{"date":"2026-08-26","count":15,"sessions":0},{"date":"2026-08-27","count":7,"sessions":0},{"date":"2026-08-28","count":4,"sessions":0},{"date":"2026-08-29","count":22,"sessions":0},{"date":"2026-08-30","count":3,"sessions":0},{"date":"2026-08-31","count":27,"sessions":0},{"date":"2026-09-01","count":9,"sessions":0},{"date":"2026-09-02","count":6,"sessions":0},{"date":"2026-09-04","count":7,"sessions":0},{"date":"2026-09-05","count":3,"sessions":0},{"date":"2026-09-06","count":9,"sessions":0},{"date":"2026-09-07","count":12,"sessions":0},{"date":"2026-09-08","count":12,"sessions":0},{"date":"2026-09-09","count":17,"sessions":0},{"date":"2026-09-10","count":14,"sessions":0},{"date":"2026-09-11","count":6,"sessions":0},{"date":"2026-09-12","count":17,"sessions":0},{"date":"2026-09-13","count":20,"sessions":0},{"date":"2026-09-14","count":8,"sessions":0},{"date":"2026-09-15","count":27,"sessions":0},{"date":"2026-09-16","count":19,"sessions":0},{"date":"2026-09-17","count":11,"sessions":0},{"date":"2026-09-18","count":16,"sessions":0},{"date":"2026-09-19","count":12,"sessions":0},{"date":"2026-09-20","count":2,"sessions":0},{"date":"2026-09-21","count":7,"sessions":0},{"date":"2026-09-22","count":15,"sessions":0},{"date":"2026-09-23","count":22,"sessions":0},{"date":"2026-09-24","count":10,"sessions":0},{"date":"2026-09-25","count":20,"sessions":0},{"date":"2026-09-26","count":12,"sessions":0},{"date":"2026-09-27","count":21,"sessions":0},{"date":"2026-09-28","count":11,"sessions":0},{"date":"2026-09-29","count":23,"sessions":0},{"date":"2026-09-30","count":19,"sessions":0},{"date":"2026-10-01","count":13,"sessions":0},{"date":"2026-10-02","count":5,"sessions":0},{"date":"2026-10-03","count":1,"sessions":0},{"date":"2026-10-04","count":3,"sessions":0},{"date":"2026-10-05","count":9,"sessions":0},{"date":"2026-10-06","count":2,"sessions":0},{"date":"2026-10-07","count":8,"sessions":0},{"date":"2026-10-09","count":2,"sessions":0},{"date":"2026-10-12","count":4,"sessions":0},{"date":"2026-10-13","count":5,"sessions":0},{"date":"2026-10-14","count":21,"sessions":9},{"date":"2026-10-15","count":10,"sessions":15},{"date":"2026-10-16","count":28,"sessions":0},{"date":"2026-10-17","count":13,"sessions":9},{"date":"2026-10-18","count":23,"sessions":13},{"date":"2026-10-19","count":41,"sessions":33},{"date":"2026-10-20","count":25,"sessions":22},{"date":"2026-10-21","count":10,"sessions":17},{"date":"2026-10-22","count":10,"sessions":8},{"date":"2026-10-23","count":5,"sessions":3}],"recent_events":[{"timestamp":"2026-10-23T00:18:11","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.63 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/favicon.ico","summary":"","payload_hex":"474554202f66617669636f6e2e69636f20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a4163636570743a202a2f2a0d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3130322e302e353030352e3633205361666172692f3533372e33360d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.63 Safari/537.36","ja3":"","session":"42f1d2c0-d671-45ab-b1d0-97ec48565a2a","seq":1,"duration_ms":101,"bytes_in":247,"bytes_out":77},{"timestamp":"2026-10-23T00:18:08","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"identity\",\"host\":\"<HONEYPOT>\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/.well-known/security.txt","summary":"","payload_hex":"474554202f2e77656c6c2d6b6e6f776e2f73656375726974792e74787420485454502f312e310d0a486f73743a20<HONEYPOT>0d0a4163636570742d456e636f64696e673a206964656e746974790d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"579aa507-dc44-40fb-8ee1-e9571cfcc087","seq":1,"duration_ms":100,"bytes_in":89,"bytes_out":77},{"timestamp":"2026-10-23T00:18:06","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"identity\",\"host\":\"<HONEYPOT>\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/sitemap.xml","summary":"","payload_hex":"474554202f736974656d61702e786d6c20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a4163636570742d456e636f64696e673a206964656e746974790d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"5c3fa55d-cb8f-494b-9066-a3eb0364d2e1","seq":1,"duration_ms":100,"bytes_in":76,"bytes_out":77},{"timestamp":"2026-10-23T00:18:05","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"identity\",\"host\":\"<HONEYPOT>\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/robots.txt","summary":"","payload_hex":"474554202f726f626f74732e74787420485454502f312e310d0a486f73743a20<HONEYPOT>0d0a4163636570742d456e636f64696e673a206964656e746974790d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"b1420585-25e6-4c57-9e84-5fbf96c2d975","seq":1,"duration_ms":100,"bytes_in":75,"bytes_out":77},{"timestamp":"2026-10-23T00:18:03","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\",\"accept-encoding\":\"identity\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a4163636570742d456e636f64696e673a206964656e746974790d0a486f73743a20<HONEYPOT>0d0a4163636570743a20746578742f68746d6c2c6170706c69636174696f6e2f7868746d6c2b786d6c2c6170706c69636174696f6e2f786d6c3b713d302e392c2a2f2a3b713d302e380d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e5420362e3129204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f34312e302e323232382e30205361666172692f3533372e33360d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36","ja3":"","session":"433b7c39-b359-4217-a1ca-dd4146f938ea","seq":1,"duration_ms":101,"bytes_in":252,"bytes_out":77},{"timestamp":"2026-10-22T19:15:58","port":5009,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"acpp\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000","payload_hex":"6163707000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000","method":"","user_agent":"","ja3":"","session":"0ccb7d98-4442-4cb4-8ec3-e75617a23089","seq":1,"duration_ms":100,"bytes_in":128,"bytes_out":12,"enriched":{"digest":"68e37a4d48319c66","strings":["acpp"]}},{"timestamp":"2026-10-22T18:25:06","port":9051,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"authenticate \"\"\n","payload_hex":"61757468656e7469636174652022220a","method":"","user_agent":"","ja3":"","session":"d7bd0da2-1fb7-4171-a659-a5ae69b942d6","seq":1,"duration_ms":100,"bytes_in":16,"bytes_out":12,"enriched":{"digest":"2a44da77a46758f5","strings":["authenticate \"\""]}},{"timestamp":"2026-10-22T18:16:28","port":2003,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"H\u0000\u0000\u0000\b\fc86782122e0f500e93cf","payload_hex":"48000000080c6338363738323132326530663530306539336366","method":"","user_agent":"","ja3":"","session":"09f2f90f-1085-44ec-b01a-26ce18a03f9e","seq":1,"duration_ms":100,"bytes_in":26,"bytes_out":12,"enriched":{"digest":"586be763990d12f8","strings":["c86782122e0f500e93cf"]}},{"timestamp":"2026-10-22T18:16:05","port":2003,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"H\u0000\u0000\u0000\b\fc86782122e0f500e93cf","payload_hex":"48000000080c6338363738323132326530663530306539336366","method":"","user_agent":"","ja3":"","session":"5e928c9b-2691-4647-a0b2-d6e246237d52","seq":1,"duration_ms":100,"bytes_in":26,"bytes_out":12,"enriched":{"digest":"586be763990d12f8","strings":["c86782122e0f500e93cf"]}},{"timestamp":"2026-10-22T18:15:58","port":2003,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"H\u0000\u0000\u0000\b\fc86782122e0f500e93cf","payload_hex":"48000000080c6338363738323132326530663530306539336366","method":"","user_agent":"","ja3":"","session":"5ace7909-5b9e-4519-ae7f-bdd11e2a93f4","seq":1,"duration_ms":100,"bytes_in":26,"bytes_out":12,"enriched":{"digest":"586be763990d12f8","strings":["c86782122e0f500e93cf"]}}],"http_methods":[{"method":"GET","count":1084},{"method":"POST","count":16}],"distinct_ports_total":367,"top_paths":[{"path":"/","count":585,"ports":215},{"path":"/favicon.ico","count":424,"ports":191},{"path":"/robots.txt","count":22,"ports":8},{"path":"/sitemap.xml","count":21,"ports":8},{"path":"/.well-known/security.txt","count":21,"ports":8},{"path":"/wp-content/uploads/2024/03/cropped-favicon-32x32.png","count":9,"ports":1},{"path":"/status","count":3,"ports":2},{"path":"/spConn?action=getInfo","count":3,"ports":1},{"path":"/crawl","count":3,"ports":1},{"path":"/v1/sys/health","count":2,"ports":1},{"path":"/json_rpc","count":2,"ports":1},{"path":"/v1/agent/self","count":2,"ports":1},{"path":"/spotifyconnect?action=getInfo","count":2,"ports":1},{"path":"/zc?action=getInfo","count":1,"ports":1}],"distinct_paths_total":14,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[{"value":"SSH-2.0-paramiko_2.11.0","count":8}],"credentials":[],"header_profile":{"signature":["Accept","Accept-Encoding","Connection","Host","User-Agent"],"representative":[{"name":"Accept","value":"*/*","notable":false},{"name":"Accept-Encoding","value":"gzip, deflate","notable":false},{"name":"Connection","value":"keep-alive","notable":false},{"name":"Host","value":"<HONEYPOT>","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.63 Safari/537.36","notable":false}],"distinct_sets":3,"events_with_headers":5},"tags":[{"tag_id":"logins","tag_type":"interactive","label":"logins","title":"Tried logins","sessions":2}]}