{"ip":"13.72.110.24","total_events":73,"verdict":{"verdict":"probing","label":"Low-level probing","detail":null,"confidence":"low","network_type":"CDN","why":["73 event(s), fewer than 10 distinct ports, no exploit payloads.","Not in any known-scanner range.","Sent 24,153 bytes despite few ports and no known exploit path: focused interaction with one service, worth a look."],"engagement":{"level":"payload","label":"Sustained payload","detail":"24,153 bytes sent","bytes_sent":24153,"session_seconds":0,"persistent":false}},"first_seen":"2026-06-23T05:21:59","last_seen":"2026-09-23T05:37:22","events_24h":4,"events_7d":16,"geo":{"country_code":"US","country_name":"United States","region":"Virginia","city":"Dulles","lat":39.0367,"lon":-77.4209,"asn":8075,"org":"Microsoft Corporation"},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as8075","label":"Microsoft","category":"cdn","url":"https://www.peeringdb.com/asn/8075"},"cve_matches":[{"cve_id":"CVE-2026-41940","title":"cPanel & WHM - Authentication Bypass via Session-File CRLF Injection","severity":"CRITICAL","actively_exploited":true,"match_field":"url_path","matched_pattern":"/login/?login_only=1"}],"malware":[],"top_ports":[{"port":2087,"proto":"tcp","label":"","count":59},{"port":80,"proto":"tcp","label":"HTTP","count":10},{"port":443,"proto":"tcp","label":"HTTPS","count":4}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i191000_9dc949149365_e5728521abd4","t13i131000_f57a46bbacb6_e5728521abd4"],"tls_client_hello":"16030105c6010005c203036ca7cd871de3460044f2e715944ec652483fbdde0c9435ec4c0d4f7bff832c352032e8fec78d9d67fe71d567222482dc53f12358efc32be70168545d9b97288ea1001ac02bc02fc02cc030cca9cca8c009c013c00ac0141301130213030100055f000b00020100ff010001000017000000120000000500050100000000000a000c000a11ec001d001700180019000d001a00180804040308070805080604010501060105030603020102030032001a0018080404030807080508060401050106010503060302010203002b00050403040303003304ea04e811ec04c06201136ff414b729348741b3f3b5aaf072a4dbbb27b416b6aa8c536749be5a747c954ba1b9919d197502eea634fc7703892bcb7ebb87d9fb6cd05a6c2e68cd4ea2027854cc8f307b9e9123ff7009876b1f59729362c847413bb25e9cbc94412ebf725aa9dc2de35ccf6cbb5ec0699fff9ac851627d3afa6dd8b89b2c82187db3905fd564fea89b69a58cd0c06636706f7a574750aa2adfab0030e58631e9a5c724a22cd7942d6b761e3030ff0520a8d63e4bc652063835e982af7cba6d28b33a1acb64773b7a4651c0fdd79087b50b88e95dce993260203beb5823501652acd95209a47afb1bc134b9c18b21b4ddf267cee7c08a157878f653d10b4a28774076d55716d77cc1381556b49bf265843fdbb12fc098ad9b6172f78a9accb482a487ddc44d1f51cedd77c86009bb25bbba6dd55875219b53a0768f536299761a4c8404d5064a821043822064447389b1836a94a19258e562a858ccf0f3cb910c6d2127b313e64f1b754959f9c700c4081d6c3cbc84083c37554d04c0b9c1b10e4020e2705ed91c1a22673aab94106978c8d21a146804052b4c001d305935a893f2a124b34b0afab0a26d95c2ec8947961c212e808efb67422793b1b922a54a466ce41bc4aa23108d61114b17034ce982d9d947bbab6861343c95d2b2c3445b87e279130742c2ecc6a75739e10630930cb7ad14998e562255068ce17772a89acc92098e54f9392572a71b629cb61555662030213a30e6d1709ce24313470c42646f08d36baa306551110792a988a86a541a9a35c7b747dd5746f83abc2c88b5782ca1c63bcaebc10202e3c73cd5c0bbc3a4a517cd868cb626577edf35455cb567a585a1917831c75a4883858b2fe25c69e9342fa4347b39450120135d1054c79c8ebd398a07f627287c98cb751e5c8214e47904af095b104059ed32526adba79cf66715a07429964617b1a1f3c7b948670c524b4c370ca167b74a9e5c7c9d88c49a11b14f43208c0b16c2d52daad53f3ec6a8bd465402034e66398d7fa8bb5d4619605c48ddf198ea582f4758ca94451762839b19e20528395a3e5a563a0552b4946a98b564e0884f061a0e035caf0c509a101560d3d7c702686dfaabc766987dd5214ad972562ab14d9e0945c053971bd20618a400f07826a843b79d0ab4dd2583b818a1b590b7dada3abb659054e9297e7cc3cd776bd54aa076b0b8f9fbbc579a3eee300700f751e70283dca645f58b0a4808570095819e6b0d919c13d2357b1a866b9856a49b8086880866e0eb6f9e456243f82a1693c45d228a9b1ac975d453a75c73537829d9b3b1a8ea1232bb25a795ac112775b4fa749791776ff97c99bb4abd903760b22511a49323632df87c86c22b38ebf08551fb0f293a81c47b6c6b4a2c896c4594f71a296156b4454e1038c1350ab357b0365b964ba838c294c87f8b45ad7857688c09064538ce0658549a087c257a4505e2cb52fc0186e265bfe6ad8bb37dcd1304c675239d270f72e28f2ccbb37ca711d4708567448f5742b952d01bc811ac2ce754359c157354307a2630807abf15cb9ebdf5667ff17cae18281b2162af5a0b623acb80cb0fad894dacc77d8fba2b59d32613a81ff765572e48ac2e36fed2230cce70bab58b80543d33429c727b0b0915f765708524019401f872899e161f90ee6bf007522f9f8fe891a76f5c5387bd07493d19eacb3ed3f8656c001d0020899e161f90ee6bf007522f9f8fe891a76f5c5387bd07493d19eacb3e","tls_ja3":["96458b3de39df5d47bc5c4a9f10f8f26","2196848d251b217de8b2c037e356c11d"],"http_akin":["a11cuq060_0000064e_be5a5cc7","a11cun040_0000004e_36fbce14"]},"fingerprint_peers":{"t13i191000_9dc949149365_e5728521abd4":195,"t13i131000_f57a46bbacb6_e5728521abd4":63,"a11cun040_0000004e_36fbce14":318,"a11cuq060_0000064e_be5a5cc7":2},"akin_families":{},"user_agents":["Go-http-client/1.1","Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.2 Safari/605.1.15","Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0","Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36","Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Edg/120.0.0.0","Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36"],"timeline":[{"date":"2026-06-28","count":2},{"date":"2026-06-30","count":2},{"date":"2026-07-04","count":2},{"date":"2026-07-13","count":2},{"date":"2026-07-27","count":2},{"date":"2026-07-29","count":2},{"date":"2026-07-31","count":2},{"date":"2026-08-01","count":5},{"date":"2026-08-04","count":2},{"date":"2026-08-05","count":4},{"date":"2026-08-06","count":2},{"date":"2026-08-07","count":4},{"date":"2026-08-09","count":4},{"date":"2026-08-10","count":2},{"date":"2026-08-20","count":4},{"date":"2026-08-29","count":4},{"date":"2026-09-03","count":2},{"date":"2026-09-04","count":2},{"date":"2026-09-06","count":2},{"date":"2026-09-15","count":2},{"date":"2026-09-17","count":6},{"date":"2026-09-19","count":2},{"date":"2026-09-21","count":4},{"date":"2026-09-22","count":2},{"date":"2026-09-23","count":2}],"recent_events":[{"timestamp":"2026-09-23T05:37:22","port":2087,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"192.3.118.146","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"content-length\":\"20\",\"content-type\":\"application/x-www-form-urlencoded\",\"host\":\"192.3.118.146:2087\",\"user-agent\":\"Go-http-client/1.1\"}","body":"pass=wrong&user=root","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/login/?login_only=1","summary":"","payload_hex":"504f5354202f6c6f67696e2f3f6c6f67696e5f6f6e6c793d3120485454502f312e310d0a486f73743a203139322e332e3131382e3134363a323038370d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a436f6e74656e742d4c656e6774683a2032300d0a436f6e6e656374696f6e3a20636c6f73650d0a436f6e74656e742d547970653a206170706c69636174696f6e2f782d7777772d666f726d2d75726c656e636f6465640d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a706173733d77726f6e6726757365723d726f6f74","method":"POST","user_agent":"Go-http-client/1.1","ja3":"2196848d251b217de8b2c037e356c11d","session":"b5887817-2239-496c-ae19-998c58004c49","seq":1,"duration_ms":101,"bytes_in":227,"bytes_out":77},{"timestamp":"2026-09-23T05:37:21","port":2087,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"192.3.118.146","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"192.3.118.146:2087\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/openid_connect/cpanelid","summary":"","payload_hex":"474554202f6f70656e69645f636f6e6e6563742f6370616e656c696420485454502f312e310d0a486f73743a203139322e332e3131382e3134363a323038370d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a436f6e6e656374696f6e3a20636c6f73650d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"2196848d251b217de8b2c037e356c11d","session":"8b978c5c-b3e1-4307-aedb-cf60ba864853","seq":1,"duration_ms":100,"bytes_in":141,"bytes_out":77},{"timestamp":"2026-09-22T22:49:40","port":2087,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:2087\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/openid_connect/cpanelid","summary":"","payload_hex":"474554202f6f70656e69645f636f6e6e6563742f6370616e656c696420485454502f312e310d0a486f73743a20<HONEYPOT>3a323038370d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a436f6e6e656374696f6e3a20636c6f73650d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"2196848d251b217de8b2c037e356c11d","session":"5453cf21-29c1-475a-a509-6b5c0e2d0d71","seq":1,"duration_ms":100,"bytes_in":141,"bytes_out":77},{"timestamp":"2026-09-22T22:49:40","port":2087,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"content-length\":\"20\",\"content-type\":\"application/x-www-form-urlencoded\",\"host\":\"<HONEYPOT>:2087\",\"user-agent\":\"Go-http-client/1.1\"}","body":"pass=wrong&user=root","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/login/?login_only=1","summary":"","payload_hex":"504f5354202f6c6f67696e2f3f6c6f67696e5f6f6e6c793d3120485454502f312e310d0a486f73743a20<HONEYPOT>3a323038370d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a436f6e74656e742d4c656e6774683a2032300d0a436f6e6e656374696f6e3a20636c6f73650d0a436f6e74656e742d547970653a206170706c69636174696f6e2f782d7777772d666f726d2d75726c656e636f6465640d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a706173733d77726f6e6726757365723d726f6f74","method":"POST","user_agent":"Go-http-client/1.1","ja3":"2196848d251b217de8b2c037e356c11d","session":"05ae7ce4-125d-43af-a00a-7246d6a0ba49","seq":1,"duration_ms":100,"bytes_in":227,"bytes_out":77},{"timestamp":"2026-09-21T18:47:45","port":2087,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:2087\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/openid_connect/cpanelid","summary":"","payload_hex":"474554202f6f70656e69645f636f6e6e6563742f6370616e656c696420485454502f312e310d0a486f73743a20<HONEYPOT>3a323038370d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a436f6e6e656374696f6e3a20636c6f73650d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"2196848d251b217de8b2c037e356c11d","session":"c2b0a533-b728-42b9-8c19-fff16f64d490","seq":1,"duration_ms":100,"bytes_in":141,"bytes_out":77},{"timestamp":"2026-09-21T18:47:45","port":2087,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"content-length\":\"20\",\"content-type\":\"application/x-www-form-urlencoded\",\"host\":\"<HONEYPOT>:2087\",\"user-agent\":\"Go-http-client/1.1\"}","body":"pass=wrong&user=root","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/login/?login_only=1","summary":"","payload_hex":"504f5354202f6c6f67696e2f3f6c6f67696e5f6f6e6c793d3120485454502f312e310d0a486f73743a20<HONEYPOT>3a323038370d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a436f6e74656e742d4c656e6774683a2032300d0a436f6e6e656374696f6e3a20636c6f73650d0a436f6e74656e742d547970653a206170706c69636174696f6e2f782d7777772d666f726d2d75726c656e636f6465640d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a706173733d77726f6e6726757365723d726f6f74","method":"POST","user_agent":"Go-http-client/1.1","ja3":"2196848d251b217de8b2c037e356c11d","session":"4b09d8ca-42da-4153-8ba7-3c3fef3ca46b","seq":1,"duration_ms":100,"bytes_in":227,"bytes_out":77},{"timestamp":"2026-09-21T08:31:06","port":2087,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"content-length\":\"20\",\"content-type\":\"application/x-www-form-urlencoded\",\"host\":\"<HONEYPOT>:2087\",\"user-agent\":\"Go-http-client/1.1\"}","body":"pass=wrong&user=root","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/login/?login_only=1","summary":"","payload_hex":"504f5354202f6c6f67696e2f3f6c6f67696e5f6f6e6c793d3120485454502f312e310d0a486f73743a20<HONEYPOT>3a323038370d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a436f6e74656e742d4c656e6774683a2032300d0a436f6e6e656374696f6e3a20636c6f73650d0a436f6e74656e742d547970653a206170706c69636174696f6e2f782d7777772d666f726d2d75726c656e636f6465640d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a706173733d77726f6e6726757365723d726f6f74","method":"POST","user_agent":"Go-http-client/1.1","ja3":"2196848d251b217de8b2c037e356c11d","session":"5c733966-d95b-40f9-86cb-fa2f6b421a47","seq":1,"duration_ms":100,"bytes_in":226,"bytes_out":77},{"timestamp":"2026-09-21T08:31:05","port":2087,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:2087\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/openid_connect/cpanelid","summary":"","payload_hex":"474554202f6f70656e69645f636f6e6e6563742f6370616e656c696420485454502f312e310d0a486f73743a20<HONEYPOT>3a323038370d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a436f6e6e656374696f6e3a20636c6f73650d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"2196848d251b217de8b2c037e356c11d","session":"b38b7540-1052-4679-b6cb-6c0f6f8a331c","seq":1,"duration_ms":100,"bytes_in":140,"bytes_out":77},{"timestamp":"2026-09-19T09:34:48","port":2087,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:2087\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/openid_connect/cpanelid","summary":"","payload_hex":"474554202f6f70656e69645f636f6e6e6563742f6370616e656c696420485454502f312e310d0a486f73743a20<HONEYPOT>3a323038370d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a436f6e6e656374696f6e3a20636c6f73650d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"2196848d251b217de8b2c037e356c11d","session":"703c2fd5-08c4-406e-ad6f-3f8f98c9a59f","seq":1,"duration_ms":100,"bytes_in":140,"bytes_out":77},{"timestamp":"2026-09-19T09:34:48","port":2087,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"content-length\":\"20\",\"content-type\":\"application/x-www-form-urlencoded\",\"host\":\"<HONEYPOT>:2087\",\"user-agent\":\"Go-http-client/1.1\"}","body":"pass=wrong&user=root","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/login/?login_only=1","summary":"","payload_hex":"504f5354202f6c6f67696e2f3f6c6f67696e5f6f6e6c793d3120485454502f312e310d0a486f73743a20<HONEYPOT>3a323038370d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a436f6e74656e742d4c656e6774683a2032300d0a436f6e6e656374696f6e3a20636c6f73650d0a436f6e74656e742d547970653a206170706c69636174696f6e2f782d7777772d666f726d2d75726c656e636f6465640d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a706173733d77726f6e6726757365723d726f6f74","method":"POST","user_agent":"Go-http-client/1.1","ja3":"2196848d251b217de8b2c037e356c11d","session":"bfd88235-f1f9-4ae1-b6d5-b936d86b5dcd","seq":1,"duration_ms":101,"bytes_in":226,"bytes_out":77}],"http_methods":[{"method":"POST","count":37},{"method":"GET","count":36}],"distinct_ports_total":3,"top_paths":[{"path":"/login/?login_only=1","count":30,"ports":1},{"path":"/openid_connect/cpanelid","count":29,"ports":1},{"path":"/","count":14,"ports":2}],"distinct_paths_total":3,"top_snis":[],"top_hosts":[{"value":"192.3.118.146","count":2}],"top_alpns":[],"banners":[],"credentials":[{"username":"root","password":"wrong","count":30}],"header_profile":{"signature":["Accept-Encoding","Connection","Content-Length","Content-Type","Host","User-Agent"],"representative":[{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Connection","value":"close","notable":false},{"name":"Content-Length","value":"20","notable":false},{"name":"Content-Type","value":"application/x-www-form-urlencoded","notable":true},{"name":"Host","value":"192.3.118.146:2087","notable":false},{"name":"User-Agent","value":"Go-http-client/1.1","notable":false}],"distinct_sets":2,"events_with_headers":10},"tags":[{"tag_id":"CVE-2026-41940","tag_type":"cve","title":"cPanel & WHM - Authentication Bypass via Session-File CRLF Injection","severity":"CRITICAL","actively_exploited":true,"match_field":"url_path","matched_pattern":"/login/?login_only=1","reference_urls":[]}],"data_as_of":"2026-09-23T13:42:43.668799+00:00"}