{"ip":"103.168.66.101","total_events":28,"verdict":{"verdict":"scanning","label":"Scanning for known vulnerabilities","detail":"4 exploit-path probe(s)","confidence":"medium","network_type":null,"why":["4 request(s) matched a known exploit path.","Only GET/HEAD seen, no request body: scanning for the vulnerability, not delivering a payload.","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"9,058 bytes sent","bytes_sent":9058,"session_seconds":1,"persistent":false}},"first_seen":"2026-08-10T23:48:19","last_seen":"2026-08-11T02:18:27","events_24h":0,"events_7d":28,"geo":{"country_code":"US","country_name":"United States","region":"Texas","city":"Dallas","lat":32.7797,"lon":-96.8022,"asn":142430,"org":"DIGI VPS"},"source_domain":"101.66.168.103.in-addr.arpa.digivps.com","known_scanners":[],"scanner_tag":null,"cve_matches":[{"cve_id":"CVE-2026-4020","title":"Gravity SMTP WordPress Plugin - Sensitive Information Exposure","severity":"HIGH","actively_exploited":false,"match_field":"url_path","matched_pattern":"/wp-json/gravitysmtp/v1/tests/mock-data?page=gravitysmtp-settings"}],"malware":[],"top_ports":[{"port":139,"proto":"tcp","label":"SMB","count":12},{"port":4433,"proto":"tcp","label":"","count":10},{"port":23,"proto":"tcp","label":"Telnet","count":4},{"port":9200,"proto":"tcp","label":"Elastic","count":2}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i141000_cbb2034c60b8_e5728521abd4","t13i191000_9dc949149365_e5728521abd4"],"tls_ja3":["2079bcc000c9a54e0784733c0142d140","96458b3de39df5d47bc5c4a9f10f8f26"],"ja4h":["ge11nn0400_88d30a62b7ad","he11nn0200_3ed38b250d3d","ge11nn0400_17292dadbc7b","ge11nn0300_042112399351"]},"fingerprint_peers":{"t13i191000_9dc949149365_e5728521abd4":161,"t13i141000_cbb2034c60b8_e5728521abd4":13,"ge11nn0300_042112399351":3330,"he11nn0200_3ed38b250d3d":15,"ge11nn0400_17292dadbc7b":2848,"ge11nn0400_88d30a62b7ad":4812},"user_agents":["Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Edg/131.0.0.0","vuln_scanner/3.1.0 (CVE-2026-4020)","Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36","Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:133.0) Gecko/20100101 Firefox/133.0","Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.2 Safari/605.1.15","Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36","Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36","Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"],"timeline":[{"date":"2026-08-10","count":2},{"date":"2026-08-11","count":26}],"recent_events":[{"timestamp":"2026-08-11T02:18:27","port":23,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"application/json, */*\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:23\",\"user-agent\":\"vuln_scanner/3.1.0 (CVE-2026-4020)\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/?rest_route=/gravitysmtp/v1/tests/mock-data&page=gravitysmtp-settings","summary":"","payload_hex":"474554202f3f726573745f726f7574653d2f67726176697479736d74702f76312f74657374732f6d6f636b2d6461746126706167653d67726176697479736d74702d73657474696e677320485454502f312e310d0a486f73743a20<HONEYPOT>3a32330d0a557365722d4167656e743a2076756c6e5f7363616e6e65722f332e312e3020284356452d323032362d34303230290d0a4163636570743a206170706c69636174696f6e2f6a736f6e2c202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"vuln_scanner/3.1.0 (CVE-2026-4020)","ja3":"96458b3de39df5d47bc5c4a9f10f8f26","session":"55676f13-2aa7-42e4-ad1c-d5d1fe72e3df","seq":1,"duration_ms":100,"bytes_in":208,"bytes_out":12},{"timestamp":"2026-08-11T02:18:27","port":23,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"application/json, */*\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:23\",\"user-agent\":\"vuln_scanner/3.1.0 (CVE-2026-4020)\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/wp-json/gravitysmtp/v1/tests/mock-data?page=gravitysmtp-settings","summary":"","payload_hex":"474554202f77702d6a736f6e2f67726176697479736d74702f76312f74657374732f6d6f636b2d646174613f706167653d67726176697479736d74702d73657474696e677320485454502f312e310d0a486f73743a20<HONEYPOT>3a32330d0a557365722d4167656e743a2076756c6e5f7363616e6e65722f332e312e3020284356452d323032362d34303230290d0a4163636570743a206170706c69636174696f6e2f6a736f6e2c202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"vuln_scanner/3.1.0 (CVE-2026-4020)","ja3":"96458b3de39df5d47bc5c4a9f10f8f26","session":"7ed3c818-b273-435d-94a1-93749a8cbf6d","seq":1,"duration_ms":100,"bytes_in":203,"bytes_out":12},{"timestamp":"2026-08-11T02:17:35","port":9200,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\",\"host\":\"<HONEYPOT>:9200\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a393230300d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132342e302e302e30205361666172692f3533372e33360d0a4163636570743a20746578742f68746d6c2c6170706c69636174696f6e2f7868746d6c2b786d6c2c6170706c69636174696f6e2f786d6c3b713d302e392c2a2f2a3b713d302e380d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36","ja3":"","session":"5370f246-2c36-4a78-8493-d48445baaffd","seq":1,"duration_ms":100,"bytes_in":242,"bytes_out":79},{"timestamp":"2026-08-11T02:17:34","port":9200,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\",\"host\":\"<HONEYPOT>:9200\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a393230300d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132342e302e302e30205361666172692f3533372e33360d0a4163636570743a20746578742f68746d6c2c6170706c69636174696f6e2f7868746d6c2b786d6c2c6170706c69636174696f6e2f786d6c3b713d302e392c2a2f2a3b713d302e380d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36","ja3":"2079bcc000c9a54e0784733c0142d140","session":"d05261db-a37c-4aff-9aa5-8423b6109594","seq":1,"duration_ms":100,"bytes_in":242,"bytes_out":79},{"timestamp":"2026-08-11T01:55:36","port":139,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\",\"host\":\"<HONEYPOT>:139\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a3133390d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132342e302e302e30205361666172692f3533372e33360d0a4163636570743a20746578742f68746d6c2c6170706c69636174696f6e2f7868746d6c2b786d6c2c6170706c69636174696f6e2f786d6c3b713d302e392c2a2f2a3b713d302e380d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36","ja3":"","session":"7e221913-34ea-47f3-8988-1e23d351db85","seq":1,"duration_ms":100,"bytes_in":240,"bytes_out":79},{"timestamp":"2026-08-11T01:55:35","port":139,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\",\"host\":\"<HONEYPOT>:139\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a3133390d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132342e302e302e30205361666172692f3533372e33360d0a4163636570743a20746578742f68746d6c2c6170706c69636174696f6e2f7868746d6c2b786d6c2c6170706c69636174696f6e2f786d6c3b713d302e392c2a2f2a3b713d302e380d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36","ja3":"2079bcc000c9a54e0784733c0142d140","session":"b11fc1cd-3511-4e0f-bb04-64cd000b2cae","seq":1,"duration_ms":101,"bytes_in":240,"bytes_out":79},{"timestamp":"2026-08-11T01:54:39","port":4433,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"application/json, text/html, */*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:4433\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:133.0) Gecko/20100101 Firefox/133.0\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/wp-login.php","summary":"","payload_hex":"474554202f77702d6c6f67696e2e70687020485454502f312e310d0a486f73743a20<HONEYPOT>3a343433330d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b207836343b2072763a3133332e3029204765636b6f2f32303130303130312046697265666f782f3133332e300d0a4163636570743a206170706c69636174696f6e2f6a736f6e2c20746578742f68746d6c2c202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:133.0) Gecko/20100101 Firefox/133.0","ja3":"2079bcc000c9a54e0784733c0142d140","session":"37b7a546-7cb6-416b-9b7a-ef9b4201b372","seq":4,"duration_ms":1329,"bytes_in":931,"bytes_out":316},{"timestamp":"2026-08-11T01:54:39","port":4433,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"application/json, text/html, */*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:4433\",\"user-agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/?rest_route=/","summary":"","payload_hex":"474554202f3f726573745f726f7574653d2f20485454502f312e310d0a486f73743a20<HONEYPOT>3a343433330d0a557365722d4167656e743a204d6f7a696c6c612f352e3020284d6163696e746f73683b20496e74656c204d6163204f5320582031305f31355f3729204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3133312e302e302e30205361666172692f3533372e33360d0a4163636570743a206170706c69636174696f6e2f6a736f6e2c20746578742f68746d6c2c202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36","ja3":"2079bcc000c9a54e0784733c0142d140","session":"37b7a546-7cb6-416b-9b7a-ef9b4201b372","seq":3,"duration_ms":1001,"bytes_in":715,"bytes_out":237},{"timestamp":"2026-08-11T01:54:39","port":4433,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"application/json, text/html, */*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:4433\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Edg/131.0.0.0\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a343433330d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3133312e302e302e30205361666172692f3533372e3336204564672f3133312e302e302e300d0a4163636570743a206170706c69636174696f6e2f6a736f6e2c20746578742f68746d6c2c202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Edg/131.0.0.0","ja3":"2079bcc000c9a54e0784733c0142d140","session":"37b7a546-7cb6-416b-9b7a-ef9b4201b372","seq":2,"duration_ms":665,"bytes_in":461,"bytes_out":158},{"timestamp":"2026-08-11T01:54:38","port":4433,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"application/json, text/html, */*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:4433\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:133.0) Gecko/20100101 Firefox/133.0\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/wp-json/","summary":"","payload_hex":"474554202f77702d6a736f6e2f20485454502f312e310d0a486f73743a20<HONEYPOT>3a343433330d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b207836343b2072763a3133332e3029204765636b6f2f32303130303130312046697265666f782f3133332e300d0a4163636570743a206170706c69636174696f6e2f6a736f6e2c20746578742f68746d6c2c202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:133.0) Gecko/20100101 Firefox/133.0","ja3":"2079bcc000c9a54e0784733c0142d140","session":"37b7a546-7cb6-416b-9b7a-ef9b4201b372","seq":1,"duration_ms":101,"bytes_in":212,"bytes_out":79}],"http_methods":[{"method":"GET","count":26},{"method":"HEAD","count":2}],"distinct_ports_total":4,"top_paths":[{"path":"/","count":14,"ports":4},{"path":"/wp-json/gravitysmtp/v1/tests/mock-data?page=gravitysmtp-settings","count":3,"ports":3},{"path":"/?rest_route=/gravitysmtp/v1/tests/mock-data&page=gravitysmtp-settings","count":3,"ports":3},{"path":"/wp-login.php","count":2,"ports":2},{"path":"/wp-json/","count":2,"ports":2},{"path":"/?rest_route=/","count":2,"ports":2},{"path":"/wp-json/gravitysmtp/v1/tests/mock-data","count":2,"ports":2}],"distinct_paths_total":7,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","Connection","Host","User-Agent"],"representative":[{"name":"Accept","value":"application/json, */*","notable":false},{"name":"Connection","value":"close","notable":false},{"name":"Host","value":"<HONEYPOT>:23","notable":false},{"name":"User-Agent","value":"vuln_scanner/3.1.0 (CVE-2026-4020)","notable":false}],"distinct_sets":3,"events_with_headers":10},"tags":[{"tag_id":"CVE-2026-4020","tag_type":"cve","title":"Gravity SMTP WordPress Plugin - Sensitive Information Exposure","severity":"HIGH","actively_exploited":false,"match_field":"url_path","matched_pattern":"/wp-json/gravitysmtp/v1/tests/mock-data?page=gravitysmtp-settings","reference_urls":[]}],"data_as_of":"2026-08-15T20:40:39.649624+00:00"}