{"ip":"104.28.205.74","total_events":164,"verdict":{"verdict":"scanning","label":"Scanning for known vulnerabilities","detail":"9 exploit-path probe(s)","confidence":"medium","network_type":"CDN","why":["9 request(s) matched a known exploit path.","Only GET/HEAD seen, no request body: scanning for the vulnerability, not delivering a payload.","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"53,681 bytes sent","bytes_sent":53681,"session_seconds":0,"persistent":false}},"first_seen":"2026-09-16T06:15:50","last_seen":"2026-09-26T09:27:49","events_24h":0,"events_7d":2,"geo":{"country_code":"VN","country_name":"Vietnam","region":"Ho Chi Minh","city":"Ho Chi Minh City","lat":10.822,"lon":106.6257,"asn":13335,"org":"Cloudflare, Inc."},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as13335","label":"Cloudflare","category":"cdn","url":"https://www.peeringdb.com/asn/13335"},"cve_matches":[],"malware":[],"top_ports":[{"port":8006,"proto":"tcp","label":"","count":162},{"port":8728,"proto":"tcp","label":"","count":2}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":["b11cun060_0004041e_3d0e68c3","b11cun050_0004001e_0c87f8d1"]},"fingerprint_peers":{"b11cun050_0004001e_0c87f8d1":8,"b11cun060_0004041e_3d0e68c3":5},"akin_families":{"b11cun060_0004041e_3d0e68c3":{"head":"b11cun050_0004001e_0c87f8d1","shapes":2,"ips":8},"b11cun050_0004001e_0c87f8d1":{"head":"b11cun050_0004001e_0c87f8d1","shapes":2,"ips":8}},"user_agents":["Mozilla/5.0 (Windows NT 5.1; rv:9.0.1) Gecko/20100101 Firefox/9.0.1"],"timeline":[{"date":"2026-09-16","count":162},{"date":"2026-09-26","count":2}],"recent_events":[{"timestamp":"2026-09-26T09:27:49","port":8728,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0006/login\u000b=name=admin\u0010=password=123456\u0000","payload_hex":"062f6c6f67696e0b3d6e616d653d61646d696e103d70617373776f72643d31323334353600","method":"","user_agent":"","ja3":"","session":"850d5ad5-0e3d-4a2c-9416-601f75af9d33","seq":1,"duration_ms":100,"bytes_in":37,"bytes_out":13,"enriched":{"digest":"5f87283060fd5fe4","strings":["/login","=name=admin","=password=123456"]}},{"timestamp":"2026-09-26T09:27:40","port":8728,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0006/login\u000b=name=admin\u0010=password=123456\u0000","payload_hex":"062f6c6f67696e0b3d6e616d653d61646d696e103d70617373776f72643d31323334353600","method":"","user_agent":"","ja3":"","session":"96c4d3d4-9e06-438a-b56d-ac9dde7c64fd","seq":1,"duration_ms":100,"bytes_in":37,"bytes_out":13,"enriched":{"digest":"5f87283060fd5fe4","strings":["/login","=name=admin","=password=123456"]}},{"timestamp":"2026-09-16T06:19:58","port":8006,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\",\"accept-encoding\":\"deflate, gzip, identity\",\"accept-language\":\"en-US;q=0.6,en;q=0.4\",\"host\":\"<HONEYPOT>:8006\",\"referer\":\"http://<HONEYPOT>:8006/\",\"user-agent\":\"Mozilla/5.0 (Windows NT 5.1; rv:9.0.1) Gecko/20100101 Firefox/9.0.1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/mysql-admin/","summary":"","payload_hex":"474554202f6d7973716c2d61646d696e2f20485454502f312e310d0a486f73743a20<HONEYPOT>3a383030360d0a4163636570743a20746578742f68746d6c2c6170706c69636174696f6e2f7868746d6c2b786d6c2c6170706c69636174696f6e2f786d6c3b713d302e392c2a2f2a3b713d302e380d0a4163636570742d456e636f64696e673a206465666c6174652c20677a69702c206964656e746974790d0a4163636570742d4c616e67756167653a20656e2d55533b713d302e362c656e3b713d302e340d0a526566657265723a20687474703a2f2f<HONEYPOT>3a383030362f0d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e5420352e313b2072763a392e302e3129204765636b6f2f32303130303130312046697265666f782f392e302e310d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 5.1; rv:9.0.1) Gecko/20100101 Firefox/9.0.1","ja3":"","session":"9442d2f0-28b9-4928-9e6d-6cd901298eec","seq":1,"duration_ms":100,"bytes_in":326,"bytes_out":78},{"timestamp":"2026-09-16T06:19:57","port":8006,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\",\"accept-encoding\":\"deflate, gzip, identity\",\"accept-language\":\"en-US;q=0.6,en;q=0.4\",\"host\":\"<HONEYPOT>:8006\",\"referer\":\"http://<HONEYPOT>:8006/\",\"user-agent\":\"Mozilla/5.0 (Windows NT 5.1; rv:9.0.1) Gecko/20100101 Firefox/9.0.1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/mysqladmin/","summary":"","payload_hex":"474554202f6d7973716c61646d696e2f20485454502f312e310d0a486f73743a20<HONEYPOT>3a383030360d0a4163636570743a20746578742f68746d6c2c6170706c69636174696f6e2f7868746d6c2b786d6c2c6170706c69636174696f6e2f786d6c3b713d302e392c2a2f2a3b713d302e380d0a4163636570742d456e636f64696e673a206465666c6174652c20677a69702c206964656e746974790d0a4163636570742d4c616e67756167653a20656e2d55533b713d302e362c656e3b713d302e340d0a526566657265723a20687474703a2f2f<HONEYPOT>3a383030362f0d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e5420352e313b2072763a392e302e3129204765636b6f2f32303130303130312046697265666f782f392e302e310d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 5.1; rv:9.0.1) Gecko/20100101 Firefox/9.0.1","ja3":"","session":"755299c4-c6ca-4b08-92b5-8dc04a7b3deb","seq":1,"duration_ms":100,"bytes_in":325,"bytes_out":78},{"timestamp":"2026-09-16T06:19:54","port":8006,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\",\"accept-encoding\":\"deflate, gzip, identity\",\"accept-language\":\"en-US;q=0.6,en;q=0.4\",\"host\":\"<HONEYPOT>:8006\",\"referer\":\"http://<HONEYPOT>:8006/\",\"user-agent\":\"Mozilla/5.0 (Windows NT 5.1; rv:9.0.1) Gecko/20100101 Firefox/9.0.1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/webdb/","summary":"","payload_hex":"474554202f77656264622f20485454502f312e310d0a486f73743a20<HONEYPOT>3a383030360d0a4163636570743a20746578742f68746d6c2c6170706c69636174696f6e2f7868746d6c2b786d6c2c6170706c69636174696f6e2f786d6c3b713d302e392c2a2f2a3b713d302e380d0a4163636570742d456e636f64696e673a206465666c6174652c20677a69702c206964656e746974790d0a4163636570742d4c616e67756167653a20656e2d55533b713d302e362c656e3b713d302e340d0a526566657265723a20687474703a2f2f<HONEYPOT>3a383030362f0d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e5420352e313b2072763a392e302e3129204765636b6f2f32303130303130312046697265666f782f392e302e310d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 5.1; rv:9.0.1) Gecko/20100101 Firefox/9.0.1","ja3":"","session":"7f5460e3-d435-4931-a91b-440a28234aae","seq":1,"duration_ms":100,"bytes_in":320,"bytes_out":78},{"timestamp":"2026-09-16T06:19:53","port":8006,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\",\"accept-encoding\":\"deflate, gzip, identity\",\"accept-language\":\"en-US;q=0.6,en;q=0.4\",\"host\":\"<HONEYPOT>:8006\",\"referer\":\"http://<HONEYPOT>:8006/\",\"user-agent\":\"Mozilla/5.0 (Windows NT 5.1; rv:9.0.1) Gecko/20100101 Firefox/9.0.1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/websql/","summary":"","payload_hex":"474554202f77656273716c2f20485454502f312e310d0a486f73743a20<HONEYPOT>3a383030360d0a4163636570743a20746578742f68746d6c2c6170706c69636174696f6e2f7868746d6c2b786d6c2c6170706c69636174696f6e2f786d6c3b713d302e392c2a2f2a3b713d302e380d0a4163636570742d456e636f64696e673a206465666c6174652c20677a69702c206964656e746974790d0a4163636570742d4c616e67756167653a20656e2d55533b713d302e362c656e3b713d302e340d0a526566657265723a20687474703a2f2f<HONEYPOT>3a383030362f0d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e5420352e313b2072763a392e302e3129204765636b6f2f32303130303130312046697265666f782f392e302e310d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 5.1; rv:9.0.1) Gecko/20100101 Firefox/9.0.1","ja3":"","session":"8a58668c-aa52-4fe1-8277-7237698d62cf","seq":1,"duration_ms":100,"bytes_in":321,"bytes_out":78},{"timestamp":"2026-09-16T06:19:49","port":8006,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\",\"accept-encoding\":\"deflate, gzip, identity\",\"accept-language\":\"en-US;q=0.6,en;q=0.4\",\"host\":\"<HONEYPOT>:8006\",\"referer\":\"http://<HONEYPOT>:8006/\",\"user-agent\":\"Mozilla/5.0 (Windows NT 5.1; rv:9.0.1) Gecko/20100101 Firefox/9.0.1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/sqlweb/","summary":"","payload_hex":"474554202f73716c7765622f20485454502f312e310d0a486f73743a20<HONEYPOT>3a383030360d0a4163636570743a20746578742f68746d6c2c6170706c69636174696f6e2f7868746d6c2b786d6c2c6170706c69636174696f6e2f786d6c3b713d302e392c2a2f2a3b713d302e380d0a4163636570742d456e636f64696e673a206465666c6174652c20677a69702c206964656e746974790d0a4163636570742d4c616e67756167653a20656e2d55533b713d302e362c656e3b713d302e340d0a526566657265723a20687474703a2f2f<HONEYPOT>3a383030362f0d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e5420352e313b2072763a392e302e3129204765636b6f2f32303130303130312046697265666f782f392e302e310d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 5.1; rv:9.0.1) Gecko/20100101 Firefox/9.0.1","ja3":"","session":"31bff6d4-c9d3-4960-a1c7-3a96a41d6715","seq":1,"duration_ms":101,"bytes_in":321,"bytes_out":78},{"timestamp":"2026-09-16T06:19:48","port":8006,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\",\"accept-encoding\":\"deflate, gzip, identity\",\"accept-language\":\"en-US;q=0.6,en;q=0.4\",\"host\":\"<HONEYPOT>:8006\",\"referer\":\"http://<HONEYPOT>:8006/\",\"user-agent\":\"Mozilla/5.0 (Windows NT 5.1; rv:9.0.1) Gecko/20100101 Firefox/9.0.1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/webadmin/","summary":"","payload_hex":"474554202f77656261646d696e2f20485454502f312e310d0a486f73743a20<HONEYPOT>3a383030360d0a4163636570743a20746578742f68746d6c2c6170706c69636174696f6e2f7868746d6c2b786d6c2c6170706c69636174696f6e2f786d6c3b713d302e392c2a2f2a3b713d302e380d0a4163636570742d456e636f64696e673a206465666c6174652c20677a69702c206964656e746974790d0a4163636570742d4c616e67756167653a20656e2d55533b713d302e362c656e3b713d302e340d0a526566657265723a20687474703a2f2f<HONEYPOT>3a383030362f0d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e5420352e313b2072763a392e302e3129204765636b6f2f32303130303130312046697265666f782f392e302e310d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 5.1; rv:9.0.1) Gecko/20100101 Firefox/9.0.1","ja3":"","session":"f4614dfe-d493-452b-a9c8-1e7556159905","seq":1,"duration_ms":100,"bytes_in":323,"bytes_out":78},{"timestamp":"2026-09-16T06:19:11","port":8006,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\",\"accept-encoding\":\"deflate, gzip, identity\",\"accept-language\":\"en-US;q=0.6,en;q=0.4\",\"host\":\"<HONEYPOT>:8006\",\"referer\":\"http://<HONEYPOT>:8006/\",\"user-agent\":\"Mozilla/5.0 (Windows NT 5.1; rv:9.0.1) Gecko/20100101 Firefox/9.0.1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/p/m/a/","summary":"","payload_hex":"474554202f702f6d2f612f20485454502f312e310d0a486f73743a20<HONEYPOT>3a383030360d0a4163636570743a20746578742f68746d6c2c6170706c69636174696f6e2f7868746d6c2b786d6c2c6170706c69636174696f6e2f786d6c3b713d302e392c2a2f2a3b713d302e380d0a4163636570742d456e636f64696e673a206465666c6174652c20677a69702c206964656e746974790d0a4163636570742d4c616e67756167653a20656e2d55533b713d302e362c656e3b713d302e340d0a526566657265723a20687474703a2f2f<HONEYPOT>3a383030362f0d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e5420352e313b2072763a392e302e3129204765636b6f2f32303130303130312046697265666f782f392e302e310d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 5.1; rv:9.0.1) Gecko/20100101 Firefox/9.0.1","ja3":"","session":"ea414180-4737-4ba6-b00c-1418f9cd4b60","seq":1,"duration_ms":100,"bytes_in":320,"bytes_out":78},{"timestamp":"2026-09-16T06:19:11","port":8006,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\",\"accept-encoding\":\"deflate, gzip, identity\",\"accept-language\":\"en-US;q=0.6,en;q=0.4\",\"host\":\"<HONEYPOT>:8006\",\"referer\":\"http://<HONEYPOT>:8006/\",\"user-agent\":\"Mozilla/5.0 (Windows NT 5.1; rv:9.0.1) Gecko/20100101 Firefox/9.0.1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/mysqladmin/","summary":"","payload_hex":"474554202f6d7973716c61646d696e2f20485454502f312e310d0a486f73743a20<HONEYPOT>3a383030360d0a4163636570743a20746578742f68746d6c2c6170706c69636174696f6e2f7868746d6c2b786d6c2c6170706c69636174696f6e2f786d6c3b713d302e392c2a2f2a3b713d302e380d0a4163636570742d456e636f64696e673a206465666c6174652c20677a69702c206964656e746974790d0a4163636570742d4c616e67756167653a20656e2d55533b713d302e362c656e3b713d302e340d0a526566657265723a20687474703a2f2f<HONEYPOT>3a383030362f0d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e5420352e313b2072763a392e302e3129204765636b6f2f32303130303130312046697265666f782f392e302e310d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 5.1; rv:9.0.1) Gecko/20100101 Firefox/9.0.1","ja3":"","session":"4b2cabe9-3c80-471a-a5c6-2eac5f008b96","seq":1,"duration_ms":100,"bytes_in":325,"bytes_out":78}],"http_methods":[{"method":"GET","count":162}],"distinct_ports_total":2,"top_paths":[{"path":"/phpMyAdmin-2.6.2-rc1/","count":4,"ports":1},{"path":"/phpMyAdmin-2.6.3/","count":4,"ports":1},{"path":"/","count":2,"ports":1},{"path":"/phpMyAdmin-2.8.1-rc1/","count":2,"ports":1},{"path":"/sqlweb/","count":2,"ports":1},{"path":"/agSearch/SQlite/main.php","count":2,"ports":1},{"path":"/websql/","count":2,"ports":1},{"path":"http://www.msftncsi.com/ncsi.txt","count":2,"ports":1},{"path":"/webdb/","count":2,"ports":1},{"path":"/script","count":2,"ports":1},{"path":"/p/m/a/","count":2,"ports":1},{"path":"/test/sqlite/SQLiteManager-1.2.0/SQLiteManager-1.2.0/main.php","count":2,"ports":1},{"path":"/phpMyAdmin-2.5.6/","count":2,"ports":1},{"path":"/phpMyAdmin-2.5.1/","count":2,"ports":1},{"path":"/phpMyAdmin-2.8.0/","count":2,"ports":1}],"distinct_paths_total":100,"top_snis":[],"top_hosts":[{"value":"www.msftncsi.com","count":2}],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","Accept-Encoding","Accept-Language","Host","Referer","User-Agent"],"representative":[{"name":"Accept","value":"text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8","notable":false},{"name":"Accept-Encoding","value":"deflate, gzip, identity","notable":false},{"name":"Accept-Language","value":"en-US;q=0.6,en;q=0.4","notable":false},{"name":"Host","value":"<HONEYPOT>:8006","notable":false},{"name":"Referer","value":"http://<HONEYPOT>:8006/","notable":true},{"name":"User-Agent","value":"Mozilla/5.0 (Windows NT 5.1; rv:9.0.1) Gecko/20100101 Firefox/9.0.1","notable":false}],"distinct_sets":1,"events_with_headers":8},"tags":[],"data_as_of":"2026-09-30T13:31:40.762265+00:00"}