{"ip":"104.236.19.165","total_events":70,"verdict":{"verdict":"probing","label":"Low-level probing","detail":null,"confidence":"low","network_type":"CDN","why":["70 event(s), fewer than 10 distinct ports, no exploit payloads.","Not in any known-scanner range.","Sent 67,311 bytes despite few ports and no known exploit path: focused interaction with one service, worth a look."],"engagement":{"level":"payload","label":"Sustained payload","detail":"67,311 bytes sent","bytes_sent":67311,"session_seconds":0,"persistent":false}},"first_seen":"2026-07-14T18:28:50","last_seen":"2026-09-15T00:41:41","events_24h":0,"events_7d":0,"geo":{"country_code":"US","country_name":"United States","region":"New Jersey","city":"Clifton","lat":40.8364,"lon":-74.1403,"asn":14061,"org":"DigitalOcean, LLC"},"source_domain":"whm.omnyads.com","known_scanners":[],"scanner_tag":{"key":"peeringdb:as14061","label":"DigitalOcean","category":"cdn","url":"https://www.peeringdb.com/asn/14061"},"cve_matches":[{"cve_id":"CVE-2026-41940","title":"cPanel & WHM - Authentication Bypass via Session-File CRLF Injection","severity":"CRITICAL","actively_exploited":true,"match_field":"url_path","matched_pattern":"/login/?login_only=1"}],"malware":[],"top_ports":[{"port":2087,"proto":"tcp","label":"","count":44},{"port":59855,"proto":"tcp","label":"","count":18},{"port":7681,"proto":"tcp","label":"","count":4},{"port":8882,"proto":"tcp","label":"","count":2},{"port":22,"proto":"tcp","label":"SSH","count":2}],"fingerprints":{"ssh_hassh":["f555226df1963d1d3c09daf865abdc9a","c70169683f416ecb6afc5aed972ec23c"],"tls_ja4":["t13i1811h1_85036bcba153_8d633dac7124"],"tls_client_hello":"","tls_ja3":["4b510481e2e54d5956f56d2177fb122d"],"http_akin":["b11cuq070_00050817_9c017ed9","b11cun060_00440017_a9482ae2","b11cun050_00040017_976354f0"]},"fingerprint_peers":{"t13i1811h1_85036bcba153_8d633dac7124":1,"f555226df1963d1d3c09daf865abdc9a":318,"c70169683f416ecb6afc5aed972ec23c":2,"b11cuq070_00050817_9c017ed9":12,"b11cun060_00440017_a9482ae2":1,"b11cun050_00040017_976354f0":1282},"akin_families":{"b11cuq070_00050817_9c017ed9":{"head":"b11cuq070_00050817_9c017ed9","shapes":2,"ips":12},"b11cun050_00040017_976354f0":{"head":"b11cun050_00040017_976354f0","shapes":3,"ips":1283}},"user_agents":["Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36","Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36","python-requests/2.34.2","Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36"],"timeline":[{"date":"2026-07-14","count":1},{"date":"2026-08-21","count":2},{"date":"2026-08-22","count":3},{"date":"2026-08-23","count":13},{"date":"2026-08-24","count":4},{"date":"2026-08-25","count":2},{"date":"2026-08-26","count":5},{"date":"2026-08-28","count":3},{"date":"2026-08-31","count":2},{"date":"2026-09-01","count":4},{"date":"2026-09-02","count":8},{"date":"2026-09-03","count":1},{"date":"2026-09-04","count":4},{"date":"2026-09-06","count":2},{"date":"2026-09-07","count":6},{"date":"2026-09-08","count":2},{"date":"2026-09-09","count":4},{"date":"2026-09-13","count":1},{"date":"2026-09-14","count":2},{"date":"2026-09-15","count":1}],"recent_events":[{"timestamp":"2026-09-15T00:41:41","port":59855,"proto":"tcp","app_proto":"","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"SSH-2.0-AsyncSSH_2.24.0\r\n\u0000\u0000\b�\n\u0014�@Qb6\u001b��\u0018��#g�dK\u0000\u0000\u0002\tmlkem768x25519-sha256,mlkem768nistp256-sha256,mlkem1024nistp384-sha384,curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256@ssh.com,diffie-hellman-group14-sha1,rsa2048-sha256,ext-info-c,kex-strict-c-v00@openssh.com\u0000\u0000\u0002�rsa-sha2-256-cert-v01@openssh.com,rsa-sha2-512-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,sk-ssh-ed25519-cert-v01@openssh.com,sk-ecdsa-sha2-nistp256-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,rsa-sha2-256,rsa-sha2-512,ssh-rsa-sha224@ssh.com,ssh-rsa-sha256@ssh.com,ssh-rsa-sha384@ssh.com,ssh-rsa-sha512@ssh.com,ssh-rsa,sk-ssh-ed25519@openssh.com,sk-ecdsa-sha2-nistp256@openssh.com,webauthn-sk-ecdsa-sha2-nistp256@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10\u0000\u0000\u0000lchacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr\u0000\u0000\u0000lchacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr\u0000\u0000\u0001;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha256-2@ssh.com,hmac-sha224@ssh.com,hmac-sha256@ssh.com,hmac-sha384@ssh.com,hmac-sha512@ssh.com\u0000\u0000\u0001;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha256-2@ssh.com,hmac-sha224@ssh.com,hmac-sha256@ssh.com,hmac-sha384@ssh.com,hmac-sha512@ssh.com\u0000\u0000\u0000\u0015none,zlib@openssh.com\u0000\u0000\u0000\u0015none,zlib@openssh.com\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000�#��OT\u001fQ|T","payload_hex":"5353482d322e302d4173796e635353485f322e32342e300d0a000008b40a14dc405162361bbf821899ef2367df644b000002096d6c6b656d3736387832353531392d7368613235362c6d6c6b656d3736386e697374703235362d7368613235362c6d6c6b656d313032346e697374703338342d7368613338342c637572766532353531392d7368613235362c637572766532353531392d736861323536406c69627373682e6f72672c63757276653434382d7368613531322c656364682d736861322d6e697374703532312c656364682d736861322d6e697374703338342c656364682d736861322d6e697374703235362c656364682d736861322d312e332e3133322e302e31302c6469666669652d68656c6c6d616e2d67726f75702d65786368616e67652d7368613235362c6469666669652d68656c6c6d616e2d67726f757031342d7368613235362c6469666669652d68656c6c6d616e2d67726f757031352d7368613531322c6469666669652d68656c6c6d616e2d67726f757031362d7368613531322c6469666669652d68656c6c6d616e2d67726f757031372d7368613531322c6469666669652d68656c6c6d616e2d67726f757031382d7368613531322c6469666669652d68656c6c6d616e2d67726f757031342d736861323536407373682e636f6d2c6469666669652d68656c6c6d616e2d67726f757031342d736861312c727361323034382d7368613235362c6578742d696e666f2d632c6b65782d7374726963742d632d763030406f70656e7373682e636f6d000002ea7273612d736861322d3235362d636572742d763031406f70656e7373682e636f6d2c7273612d736861322d3531322d636572742d763031406f70656e7373682e636f6d2c7373682d7273612d636572742d763031406f70656e7373682e636f6d2c736b2d7373682d656432353531392d636572742d763031406f70656e7373682e636f6d2c736b2d65636473612d736861322d6e697374703235362d636572742d763031406f70656e7373682e636f6d2c7373682d656432353531392d636572742d763031406f70656e7373682e636f6d2c7373682d65643434382d636572742d763031406f70656e7373682e636f6d2c65636473612d736861322d6e697374703532312d636572742d763031406f70656e7373682e636f6d2c65636473612d736861322d6e697374703338342d636572742d763031406f70656e7373682e636f6d2c65636473612d736861322d6e697374703235362d636572742d763031406f70656e7373682e636f6d2c65636473612d736861322d312e332e3133322e302e31302d636572742d763031406f70656e7373682e636f6d2c7273612d736861322d3235362c7273612d736861322d3531322c7373682d7273612d736861323234407373682e636f6d2c7373682d7273612d736861323536407373682e636f6d2c7373682d7273612d736861333834407373682e636f6d2c7373682d7273612d736861353132407373682e636f6d2c7373682d7273612c736b2d7373682d65643235353139406f70656e7373682e636f6d2c736b2d65636473612d736861322d6e69737470323536406f70656e7373682e636f6d2c776562617574686e2d736b2d65636473612d736861322d6e69737470323536406f70656e7373682e636f6d2c7373682d656432353531392c7373682d65643434382c65636473612d736861322d6e697374703532312c65636473612d736861322d6e697374703338342c65636473612d736861322d6e697374703235362c65636473612d736861322d312e332e3133322e302e31300000006c63686163686132302d706f6c7931333035406f70656e7373682e636f6d2c6165733235362d67636d406f70656e7373682e636f6d2c6165733132382d67636d406f70656e7373682e636f6d2c6165733235362d6374722c6165733139322d6374722c6165733132382d6374720000006c63686163686132302d706f6c7931333035406f70656e7373682e636f6d2c6165733235362d67636d406f70656e7373682e636f6d2c6165733132382d67636d406f70656e7373682e636f6d2c6165733235362d6374722c6165733139322d6374722c6165733132382d6374720000013b756d61632d36342d65746d406f70656e7373682e636f6d2c756d61632d3132382d65746d406f70656e7373682e636f6d2c686d61632d736861322d3235362d65746d406f70656e7373682e636f6d2c686d61632d736861322d3531322d65746d406f70656e7373682e636f6d2c686d61632d736861312d65746d406f70656e7373682e636f6d2c756d61632d3634406f70656e7373682e636f6d2c756d61632d313238406f70656e7373682e636f6d2c686d61632d736861322d3235362c686d61632d736861322d3531322c686d61632d736861312c686d61632d7368613235362d32407373682e636f6d2c686d61632d736861323234407373682e636f6d2c686d61632d736861323536407373682e636f6d2c686d61632d736861333834407373682e636f6d2c686d61632d736861353132407373682e636f6d0000013b756d61632d36342d65746d406f70656e7373682e636f6d2c756d61632d3132382d65746d406f70656e7373682e636f6d2c686d61632d736861322d3235362d65746d406f70656e7373682e636f6d2c686d61632d736861322d3531322d65746d406f70656e7373682e636f6d2c686d61632d736861312d65746d406f70656e7373682e636f6d2c756d61632d3634406f70656e7373682e636f6d2c756d61632d313238406f70656e7373682e636f6d2c686d61632d736861322d3235362c686d61632d736861322d3531322c686d61632d736861312c686d61632d7368613235362d32407373682e636f6d2c686d61632d736861323234407373682e636f6d2c686d61632d736861323536407373682e636f6d2c686d61632d736861333834407373682e636f6d2c686d61632d736861353132407373682e636f6d000000156e6f6e652c7a6c6962406f70656e7373682e636f6d000000156e6f6e652c7a6c6962406f70656e7373682e636f6d000000000000000000000000009b23b1af4f541f517c54","method":"","user_agent":"","ja3":"","session":"314db8f1-79b9-4827-bf40-856d49cd17e4","seq":1,"duration_ms":180,"bytes_in":2257,"bytes_out":14,"enriched":{"digest":"9cb324147f2d5c82","label":"SSH","strings":["SSH-2.0-AsyncSSH_2.24.0","@Qb6","mlkem768x25519-sha256,mlkem768nistp256-sha256,mlkem1024nistp384-sha384,curve2551…","rsa-sha2-256-cert-v01@openssh.com,rsa-sha2-512-cert-v01@openssh.com,ssh-rsa-cert…","lchacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes…",";umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,…","none,zlib@openssh.com"],"iocs":{"domains":["openssh.com"]}}},{"timestamp":"2026-09-14T14:58:07","port":59855,"proto":"tcp","app_proto":"","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"SSH-2.0-AsyncSSH_2.24.0\r\n\u0000\u0000\b�\n\u0014s>5���̲ �\b�\u0004�U�\u0000\u0000\u0002\tmlkem768x25519-sha256,mlkem768nistp256-sha256,mlkem1024nistp384-sha384,curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256@ssh.com,diffie-hellman-group14-sha1,rsa2048-sha256,ext-info-c,kex-strict-c-v00@openssh.com\u0000\u0000\u0002�rsa-sha2-256-cert-v01@openssh.com,rsa-sha2-512-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,sk-ssh-ed25519-cert-v01@openssh.com,sk-ecdsa-sha2-nistp256-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,rsa-sha2-256,rsa-sha2-512,ssh-rsa-sha224@ssh.com,ssh-rsa-sha256@ssh.com,ssh-rsa-sha384@ssh.com,ssh-rsa-sha512@ssh.com,ssh-rsa,sk-ssh-ed25519@openssh.com,sk-ecdsa-sha2-nistp256@openssh.com,webauthn-sk-ecdsa-sha2-nistp256@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10\u0000\u0000\u0000lchacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr\u0000\u0000\u0000lchacha20-poly1305@openssh.com,aes25","payload_hex":"5353482d322e302d4173796e635353485f322e32342e300d0a000008b40a14733e35c8e8cfccb220d3089a048355f3000002096d6c6b656d3736387832353531392d7368613235362c6d6c6b656d3736386e697374703235362d7368613235362c6d6c6b656d313032346e697374703338342d7368613338342c637572766532353531392d7368613235362c637572766532353531392d736861323536406c69627373682e6f72672c63757276653434382d7368613531322c656364682d736861322d6e697374703532312c656364682d736861322d6e697374703338342c656364682d736861322d6e697374703235362c656364682d736861322d312e332e3133322e302e31302c6469666669652d68656c6c6d616e2d67726f75702d65786368616e67652d7368613235362c6469666669652d68656c6c6d616e2d67726f757031342d7368613235362c6469666669652d68656c6c6d616e2d67726f757031352d7368613531322c6469666669652d68656c6c6d616e2d67726f757031362d7368613531322c6469666669652d68656c6c6d616e2d67726f757031372d7368613531322c6469666669652d68656c6c6d616e2d67726f757031382d7368613531322c6469666669652d68656c6c6d616e2d67726f757031342d736861323536407373682e636f6d2c6469666669652d68656c6c6d616e2d67726f757031342d736861312c727361323034382d7368613235362c6578742d696e666f2d632c6b65782d7374726963742d632d763030406f70656e7373682e636f6d000002ea7273612d736861322d3235362d636572742d763031406f70656e7373682e636f6d2c7273612d736861322d3531322d636572742d763031406f70656e7373682e636f6d2c7373682d7273612d636572742d763031406f70656e7373682e636f6d2c736b2d7373682d656432353531392d636572742d763031406f70656e7373682e636f6d2c736b2d65636473612d736861322d6e697374703235362d636572742d763031406f70656e7373682e636f6d2c7373682d656432353531392d636572742d763031406f70656e7373682e636f6d2c7373682d65643434382d636572742d763031406f70656e7373682e636f6d2c65636473612d736861322d6e697374703532312d636572742d763031406f70656e7373682e636f6d2c65636473612d736861322d6e697374703338342d636572742d763031406f70656e7373682e636f6d2c65636473612d736861322d6e697374703235362d636572742d763031406f70656e7373682e636f6d2c65636473612d736861322d312e332e3133322e302e31302d636572742d763031406f70656e7373682e636f6d2c7273612d736861322d3235362c7273612d736861322d3531322c7373682d7273612d736861323234407373682e636f6d2c7373682d7273612d736861323536407373682e636f6d2c7373682d7273612d736861333834407373682e636f6d2c7373682d7273612d736861353132407373682e636f6d2c7373682d7273612c736b2d7373682d65643235353139406f70656e7373682e636f6d2c736b2d65636473612d736861322d6e69737470323536406f70656e7373682e636f6d2c776562617574686e2d736b2d65636473612d736861322d6e69737470323536406f70656e7373682e636f6d2c7373682d656432353531392c7373682d65643434382c65636473612d736861322d6e697374703532312c65636473612d736861322d6e697374703338342c65636473612d736861322d6e697374703235362c65636473612d736861322d312e332e3133322e302e31300000006c63686163686132302d706f6c7931333035406f70656e7373682e636f6d2c6165733235362d67636d406f70656e7373682e636f6d2c6165733132382d67636d406f70656e7373682e636f6d2c6165733235362d6374722c6165733139322d6374722c6165733132382d6374720000006c63686163686132302d706f6c7931333035406f70656e7373682e636f6d2c6165733235","method":"","user_agent":"","ja3":"","session":"eb60e68e-3b49-45d9-8232-79a97e2ac6ad","seq":1,"duration_ms":190,"bytes_in":1473,"bytes_out":14,"enriched":{"digest":"99e75813986f957a","label":"SSH","strings":["SSH-2.0-AsyncSSH_2.24.0","mlkem768x25519-sha256,mlkem768nistp256-sha256,mlkem1024nistp384-sha384,curve2551…","rsa-sha2-256-cert-v01@openssh.com,rsa-sha2-512-cert-v01@openssh.com,ssh-rsa-cert…","lchacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes…","lchacha20-poly1305@openssh.com,aes25"],"iocs":{"domains":["openssh.com"]}}},{"timestamp":"2026-09-14T14:58:07","port":59855,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"6-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr\u0000\u0000\u0001;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha256-2@ssh.com,hmac-sha224@ssh.com,hmac-sha256@ssh.com,hmac-sha384@ssh.com,hmac-sha512@ssh.com\u0000\u0000\u0001;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha256-2@ssh.com,hmac-sha224@ssh.com,hmac-sha256@ssh.com,hmac-sha384@ssh.com,hmac-sha512@ssh.com\u0000\u0000\u0000\u0015none,zlib@openssh.com\u0000\u0000\u0000\u0015none,zlib@openssh.com\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000���|�\u000b`�c�","payload_hex":"362d67636d406f70656e7373682e636f6d2c6165733132382d67636d406f70656e7373682e636f6d2c6165733235362d6374722c6165733139322d6374722c6165733132382d6374720000013b756d61632d36342d65746d406f70656e7373682e636f6d2c756d61632d3132382d65746d406f70656e7373682e636f6d2c686d61632d736861322d3235362d65746d406f70656e7373682e636f6d2c686d61632d736861322d3531322d65746d406f70656e7373682e636f6d2c686d61632d736861312d65746d406f70656e7373682e636f6d2c756d61632d3634406f70656e7373682e636f6d2c756d61632d313238406f70656e7373682e636f6d2c686d61632d736861322d3235362c686d61632d736861322d3531322c686d61632d736861312c686d61632d7368613235362d32407373682e636f6d2c686d61632d736861323234407373682e636f6d2c686d61632d736861323536407373682e636f6d2c686d61632d736861333834407373682e636f6d2c686d61632d736861353132407373682e636f6d0000013b756d61632d36342d65746d406f70656e7373682e636f6d2c756d61632d3132382d65746d406f70656e7373682e636f6d2c686d61632d736861322d3235362d65746d406f70656e7373682e636f6d2c686d61632d736861322d3531322d65746d406f70656e7373682e636f6d2c686d61632d736861312d65746d406f70656e7373682e636f6d2c756d61632d3634406f70656e7373682e636f6d2c756d61632d313238406f70656e7373682e636f6d2c686d61632d736861322d3235362c686d61632d736861322d3531322c686d61632d736861312c686d61632d7368613235362d32407373682e636f6d2c686d61632d736861323234407373682e636f6d2c686d61632d736861323536407373682e636f6d2c686d61632d736861333834407373682e636f6d2c686d61632d736861353132407373682e636f6d000000156e6f6e652c7a6c6962406f70656e7373682e636f6d000000156e6f6e652c7a6c6962406f70656e7373682e636f6d000000000000000000000000008a818f7ce60b608263d2","method":"","user_agent":"","ja3":"","session":"eb60e68e-3b49-45d9-8232-79a97e2ac6ad","seq":2,"duration_ms":291,"bytes_in":2257,"bytes_out":28,"enriched":{"digest":"62ce395983163dfa","strings":["6-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr",";umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,…","none,zlib@openssh.com"],"iocs":{"domains":["openssh.com"]}}},{"timestamp":"2026-09-13T10:32:11","port":59855,"proto":"tcp","app_proto":"","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"SSH-2.0-AsyncSSH_2.24.0\r\n\u0000\u0000\b�\n\u0014l\u001bt��d�PV�͕��$�\u0000\u0000\u0002\tmlkem768x25519-sha256,mlkem768nistp256-sha256,mlkem1024nistp384-sha384,curve25519-sha256,curve25519-sha256@libssh.org,curve448-sha512,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,ecdh-sha2-1.3.132.0.10,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group15-sha512,diffie-hellman-group16-sha512,diffie-hellman-group17-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256@ssh.com,diffie-hellman-group14-sha1,rsa2048-sha256,ext-info-c,kex-strict-c-v00@openssh.com\u0000\u0000\u0002�rsa-sha2-256-cert-v01@openssh.com,rsa-sha2-512-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,sk-ssh-ed25519-cert-v01@openssh.com,sk-ecdsa-sha2-nistp256-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com,ssh-ed448-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-1.3.132.0.10-cert-v01@openssh.com,rsa-sha2-256,rsa-sha2-512,ssh-rsa-sha224@ssh.com,ssh-rsa-sha256@ssh.com,ssh-rsa-sha384@ssh.com,ssh-rsa-sha512@ssh.com,ssh-rsa,sk-ssh-ed25519@openssh.com,sk-ecdsa-sha2-nistp256@openssh.com,webauthn-sk-ecdsa-sha2-nistp256@openssh.com,ssh-ed25519,ssh-ed448,ecdsa-sha2-nistp521,ecdsa-sha2-nistp384,ecdsa-sha2-nistp256,ecdsa-sha2-1.3.132.0.10\u0000\u0000\u0000lchacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr\u0000\u0000\u0000lchacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr\u0000\u0000\u0001;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha256-2@ssh.com,hmac-sha224@ssh.com,hmac-sha256@ssh.com,hmac-sha384@ssh.com,hmac-sha512@ssh.com\u0000\u0000\u0001;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha256-2@ssh.com,hmac-sha224@ssh.com,hmac-sha256@ssh.com,hmac-sha384@ssh.com,hmac-sha512@ssh.com\u0000\u0000\u0000\u0015none,zlib@openssh.com\u0000\u0000\u0000\u0015none,zlib@openssh.com\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000+v�ܥ֫ߏ�","payload_hex":"5353482d322e302d4173796e635353485f322e32342e300d0a000008b40a146c1b74abfe64a15056ddcd9587a924a9000002096d6c6b656d3736387832353531392d7368613235362c6d6c6b656d3736386e697374703235362d7368613235362c6d6c6b656d313032346e697374703338342d7368613338342c637572766532353531392d7368613235362c637572766532353531392d736861323536406c69627373682e6f72672c63757276653434382d7368613531322c656364682d736861322d6e697374703532312c656364682d736861322d6e697374703338342c656364682d736861322d6e697374703235362c656364682d736861322d312e332e3133322e302e31302c6469666669652d68656c6c6d616e2d67726f75702d65786368616e67652d7368613235362c6469666669652d68656c6c6d616e2d67726f757031342d7368613235362c6469666669652d68656c6c6d616e2d67726f757031352d7368613531322c6469666669652d68656c6c6d616e2d67726f757031362d7368613531322c6469666669652d68656c6c6d616e2d67726f757031372d7368613531322c6469666669652d68656c6c6d616e2d67726f757031382d7368613531322c6469666669652d68656c6c6d616e2d67726f757031342d736861323536407373682e636f6d2c6469666669652d68656c6c6d616e2d67726f757031342d736861312c727361323034382d7368613235362c6578742d696e666f2d632c6b65782d7374726963742d632d763030406f70656e7373682e636f6d000002ea7273612d736861322d3235362d636572742d763031406f70656e7373682e636f6d2c7273612d736861322d3531322d636572742d763031406f70656e7373682e636f6d2c7373682d7273612d636572742d763031406f70656e7373682e636f6d2c736b2d7373682d656432353531392d636572742d763031406f70656e7373682e636f6d2c736b2d65636473612d736861322d6e697374703235362d636572742d763031406f70656e7373682e636f6d2c7373682d656432353531392d636572742d763031406f70656e7373682e636f6d2c7373682d65643434382d636572742d763031406f70656e7373682e636f6d2c65636473612d736861322d6e697374703532312d636572742d763031406f70656e7373682e636f6d2c65636473612d736861322d6e697374703338342d636572742d763031406f70656e7373682e636f6d2c65636473612d736861322d6e697374703235362d636572742d763031406f70656e7373682e636f6d2c65636473612d736861322d312e332e3133322e302e31302d636572742d763031406f70656e7373682e636f6d2c7273612d736861322d3235362c7273612d736861322d3531322c7373682d7273612d736861323234407373682e636f6d2c7373682d7273612d736861323536407373682e636f6d2c7373682d7273612d736861333834407373682e636f6d2c7373682d7273612d736861353132407373682e636f6d2c7373682d7273612c736b2d7373682d65643235353139406f70656e7373682e636f6d2c736b2d65636473612d736861322d6e69737470323536406f70656e7373682e636f6d2c776562617574686e2d736b2d65636473612d736861322d6e69737470323536406f70656e7373682e636f6d2c7373682d656432353531392c7373682d65643434382c65636473612d736861322d6e697374703532312c65636473612d736861322d6e697374703338342c65636473612d736861322d6e697374703235362c65636473612d736861322d312e332e3133322e302e31300000006c63686163686132302d706f6c7931333035406f70656e7373682e636f6d2c6165733235362d67636d406f70656e7373682e636f6d2c6165733132382d67636d406f70656e7373682e636f6d2c6165733235362d6374722c6165733139322d6374722c6165733132382d6374720000006c63686163686132302d706f6c7931333035406f70656e7373682e636f6d2c6165733235362d67636d406f70656e7373682e636f6d2c6165733132382d67636d406f70656e7373682e636f6d2c6165733235362d6374722c6165733139322d6374722c6165733132382d6374720000013b756d61632d36342d65746d406f70656e7373682e636f6d2c756d61632d3132382d65746d406f70656e7373682e636f6d2c686d61632d736861322d3235362d65746d406f70656e7373682e636f6d2c686d61632d736861322d3531322d65746d406f70656e7373682e636f6d2c686d61632d736861312d65746d406f70656e7373682e636f6d2c756d61632d3634406f70656e7373682e636f6d2c756d61632d313238406f70656e7373682e636f6d2c686d61632d736861322d3235362c686d61632d736861322d3531322c686d61632d736861312c686d61632d7368613235362d32407373682e636f6d2c686d61632d736861323234407373682e636f6d2c686d61632d736861323536407373682e636f6d2c686d61632d736861333834407373682e636f6d2c686d61632d736861353132407373682e636f6d0000013b756d61632d36342d65746d406f70656e7373682e636f6d2c756d61632d3132382d65746d406f70656e7373682e636f6d2c686d61632d736861322d3235362d65746d406f70656e7373682e636f6d2c686d61632d736861322d3531322d65746d406f70656e7373682e636f6d2c686d61632d736861312d65746d406f70656e7373682e636f6d2c756d61632d3634406f70656e7373682e636f6d2c756d61632d313238406f70656e7373682e636f6d2c686d61632d736861322d3235362c686d61632d736861322d3531322c686d61632d736861312c686d61632d7368613235362d32407373682e636f6d2c686d61632d736861323234407373682e636f6d2c686d61632d736861323536407373682e636f6d2c686d61632d736861333834407373682e636f6d2c686d61632d736861353132407373682e636f6d000000156e6f6e652c7a6c6962406f70656e7373682e636f6d000000156e6f6e652c7a6c6962406f70656e7373682e636f6d000000000000000000000000002b76b6dca5d6abdf8fd3","method":"","user_agent":"","ja3":"","session":"6820a0a8-220a-4d49-9538-1449969bfef1","seq":1,"duration_ms":121,"bytes_in":2257,"bytes_out":14,"enriched":{"digest":"5e418536ee63974e","label":"SSH","strings":["SSH-2.0-AsyncSSH_2.24.0","mlkem768x25519-sha256,mlkem768nistp256-sha256,mlkem1024nistp384-sha384,curve2551…","rsa-sha2-256-cert-v01@openssh.com,rsa-sha2-512-cert-v01@openssh.com,ssh-rsa-cert…","lchacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes…",";umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,…","none,zlib@openssh.com","none,zlib@openssh.com+v"],"iocs":{"domains":["openssh.com"]}}},{"timestamp":"2026-09-09T14:23:46","port":2087,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate\",\"connection\":\"keep-alive\",\"host\":\":2087\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"/openid_connect/cpanelid","summary":"","payload_hex":"474554202f6f70656e69645f636f6e6e6563742f6370616e656c696420485454502f312e310d0a486f73743a203a323038370d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3131392e302e302e30205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36","ja3":"4b510481e2e54d5956f56d2177fb122d","session":"fab35bc5-39db-4cb9-818c-0b12f6951206","seq":1,"duration_ms":100,"bytes_in":250,"bytes_out":79},{"timestamp":"2026-09-09T14:23:46","port":2087,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate\",\"connection\":\"close\",\"content-length\":\"20\",\"content-type\":\"application/x-www-form-urlencoded\",\"host\":\":2087\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36\"}","body":"user=root&pass=wrong","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"/login/?login_only=1","summary":"","payload_hex":"504f5354202f6c6f67696e2f3f6c6f67696e5f6f6e6c793d3120485454502f312e310d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3131392e302e302e30205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a486f73743a203a323038370d0a436f6e74656e742d4c656e6774683a2032300d0a436f6e74656e742d547970653a206170706c69636174696f6e2f782d7777772d666f726d2d75726c656e636f6465640d0a0d0a757365723d726f6f7426706173733d77726f6e67","method":"POST","user_agent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36","ja3":"4b510481e2e54d5956f56d2177fb122d","session":"fab35bc5-39db-4cb9-818c-0b12f6951206","seq":2,"duration_ms":233,"bytes_in":581,"bytes_out":158},{"timestamp":"2026-09-09T13:37:52","port":2087,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate\",\"connection\":\"keep-alive\",\"host\":\":2087\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"/openid_connect/cpanelid","summary":"","payload_hex":"474554202f6f70656e69645f636f6e6e6563742f6370616e656c696420485454502f312e310d0a486f73743a203a323038370d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3131392e302e302e30205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36","ja3":"4b510481e2e54d5956f56d2177fb122d","session":"29977903-9e9c-43eb-8f9b-f99f8f2c687e","seq":1,"duration_ms":100,"bytes_in":260,"bytes_out":79},{"timestamp":"2026-09-09T13:37:52","port":2087,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate\",\"connection\":\"close\",\"content-length\":\"20\",\"content-type\":\"application/x-www-form-urlencoded\",\"host\":\":2087\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36\"}","body":"user=root&pass=wrong","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"/login/?login_only=1","summary":"","payload_hex":"504f5354202f6c6f67696e2f3f6c6f67696e5f6f6e6c793d3120485454502f312e310d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3131392e302e302e30205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a486f73743a203a323038370d0a436f6e74656e742d4c656e6774683a2032300d0a436f6e74656e742d547970653a206170706c69636174696f6e2f782d7777772d666f726d2d75726c656e636f6465640d0a0d0a757365723d726f6f7426706173733d77726f6e67","method":"POST","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36","ja3":"4b510481e2e54d5956f56d2177fb122d","session":"29977903-9e9c-43eb-8f9b-f99f8f2c687e","seq":2,"duration_ms":224,"bytes_in":601,"bytes_out":158},{"timestamp":"2026-09-08T09:03:29","port":2087,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate\",\"connection\":\"keep-alive\",\"host\":\":2087\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"/openid_connect/cpanelid","summary":"","payload_hex":"474554202f6f70656e69645f636f6e6e6563742f6370616e656c696420485454502f312e310d0a486f73743a203a323038370d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3131392e302e302e30205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36","ja3":"4b510481e2e54d5956f56d2177fb122d","session":"cc83540d-226f-4522-a0c2-f9a82d6e32f0","seq":1,"duration_ms":101,"bytes_in":250,"bytes_out":79},{"timestamp":"2026-09-08T09:03:29","port":2087,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate\",\"connection\":\"close\",\"content-length\":\"20\",\"content-type\":\"application/x-www-form-urlencoded\",\"host\":\":2087\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36\"}","body":"user=root&pass=wrong","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"/login/?login_only=1","summary":"","payload_hex":"504f5354202f6c6f67696e2f3f6c6f67696e5f6f6e6c793d3120485454502f312e310d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3131392e302e302e30205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a486f73743a203a323038370d0a436f6e74656e742d4c656e6774683a2032300d0a436f6e74656e742d547970653a206170706c69636174696f6e2f782d7777772d666f726d2d75726c656e636f6465640d0a0d0a757365723d726f6f7426706173733d77726f6e67","method":"POST","user_agent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36","ja3":"4b510481e2e54d5956f56d2177fb122d","session":"cc83540d-226f-4522-a0c2-f9a82d6e32f0","seq":2,"duration_ms":231,"bytes_in":581,"bytes_out":158}],"http_methods":[{"method":"GET","count":26},{"method":"POST","count":22}],"distinct_ports_total":5,"top_paths":[{"path":"/login/?login_only=1","count":22,"ports":1},{"path":"/openid_connect/cpanelid","count":22,"ports":1},{"path":"/","count":4,"ports":1}],"distinct_paths_total":3,"top_snis":[],"top_hosts":[],"top_alpns":[{"value":"http/1.1","count":44}],"banners":[{"value":"SSH-2.0-AsyncSSH_2.24.0","count":20},{"value":"SSH-2.0-libssh_0.9.6","count":1}],"credentials":[{"username":"root","password":"wrong","count":22}],"header_profile":{"signature":["Accept","Accept-Encoding","Connection","Content-Length","Content-Type","Host","User-Agent"],"representative":[{"name":"Accept","value":"*/*","notable":false},{"name":"Accept-Encoding","value":"gzip, deflate","notable":false},{"name":"Connection","value":"close","notable":false},{"name":"Content-Length","value":"20","notable":false},{"name":"Content-Type","value":"application/x-www-form-urlencoded","notable":true},{"name":"Host","value":":2087","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36","notable":false}],"distinct_sets":2,"events_with_headers":6},"tags":[{"tag_id":"CVE-2026-41940","tag_type":"cve","title":"cPanel & WHM - Authentication Bypass via Session-File CRLF Injection","severity":"CRITICAL","actively_exploited":true,"match_field":"url_path","matched_pattern":"/login/?login_only=1","reference_urls":[]}],"data_as_of":"2026-09-30T18:04:33.174863+00:00"}