{"ip":"130.12.180.127","total_events":1453,"verdict":{"verdict":"scanning","label":"Scanning for known vulnerabilities","detail":"4 exploit-path probe(s)","confidence":"medium","network_type":null,"why":["4 request(s) matched a known exploit path.","Only GET/HEAD seen, no request body: scanning for the vulnerability, not delivering a payload.","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"258,733 bytes sent","bytes_sent":258733,"session_seconds":2,"persistent":false}},"first_seen":"2026-02-21T10:02:51","last_seen":"2026-09-17T14:03:34","events_24h":0,"events_7d":1449,"geo":{"country_code":"NL","country_name":"The Netherlands","region":"North Holland","city":"Amsterdam","lat":52.3716,"lon":4.8883,"asn":202412,"org":"Omegatech LTD"},"source_domain":null,"known_scanners":[],"scanner_tag":null,"cve_matches":[{"cve_id":"CVE-2007-4556","title":"OpenSymphony XWork/Apache Struts2 - Remote Code Execution","severity":"medium","actively_exploited":false,"match_field":"url_path","matched_pattern":"/login.action"}],"malware":[],"top_ports":[{"port":8081,"proto":"tcp","label":"","count":22},{"port":88,"proto":"tcp","label":"","count":20},{"port":111,"proto":"tcp","label":"RPC","count":20},{"port":81,"proto":"tcp","label":"","count":20},{"port":2001,"proto":"tcp","label":"","count":20},{"port":106,"proto":"tcp","label":"","count":20},{"port":79,"proto":"tcp","label":"","count":20},{"port":135,"proto":"tcp","label":"MSRPC","count":20},{"port":7,"proto":"tcp","label":"","count":20},{"port":2121,"proto":"tcp","label":"","count":20},{"port":119,"proto":"tcp","label":"NNTP","count":20},{"port":873,"proto":"tcp","label":"Rsync","count":20},{"port":80,"proto":"tcp","label":"HTTP","count":20},{"port":37,"proto":"tcp","label":"","count":20},{"port":514,"proto":"tcp","label":"Syslog","count":19}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i141000_cbb2034c60b8_e5728521abd4","t13i1411h1_cbb2034c60b8_e5728521abd4"],"tls_ja3":["2079bcc000c9a54e0784733c0142d140","3a36ab98a37de7a3799aab6ef1c5b9f8"],"ja4h":["ge11nn06en_34bb3a836f3b","ge11nn0100_4740ae6347b0","ge11nn0400_9c3956fad5da","he11nn0200_f24fcf356134"]},"fingerprint_peers":{"t13i141000_cbb2034c60b8_e5728521abd4":10,"ge11nn0400_9c3956fad5da":1551,"t13i1411h1_cbb2034c60b8_e5728521abd4":1,"ge11nn0100_4740ae6347b0":644,"ge11nn06en_34bb3a836f3b":6,"he11nn0200_f24fcf356134":1},"user_agents":["Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36"],"timeline":[{"date":"2026-09-17","count":1449}],"recent_events":[{"timestamp":"2026-09-17T14:03:34","port":3128,"proto":"tcp","app_proto":"","app_protocol":"smtp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"EHLO [127.0.0.1]\r\n","payload_hex":"45484c4f205b3132372e302e302e315d0d0a","method":"","user_agent":"","ja3":"","session":"c329c9d8-bdb5-4dca-8b38-74d1b005a135","seq":1,"duration_ms":100,"bytes_in":18,"bytes_out":14,"enriched":{"digest":"0938082a62ad7dae","label":"SMTP","strings":["EHLO [127.0.0.1]"],"iocs":{"ips":["127.0.0.1"]}}},{"timestamp":"2026-09-17T14:03:33","port":49152,"proto":"tcp","app_proto":"","app_protocol":"smtp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"EHLO [127.0.0.1]\r\n","payload_hex":"45484c4f205b3132372e302e302e315d0d0a","method":"","user_agent":"","ja3":"","session":"2992d82c-e9d6-45d7-9254-ce9f9bcad662","seq":1,"duration_ms":101,"bytes_in":18,"bytes_out":14,"enriched":{"digest":"0938082a62ad7dae","label":"SMTP","strings":["EHLO [127.0.0.1]"],"iocs":{"ips":["127.0.0.1"]}}},{"timestamp":"2026-09-17T14:03:33","port":8081,"proto":"tcp","app_proto":"","app_protocol":"smtp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"EHLO [127.0.0.1]\r\n","payload_hex":"45484c4f205b3132372e302e302e315d0d0a","method":"","user_agent":"","ja3":"","session":"894c6a85-1873-4eca-a0b6-21443f6a1098","seq":1,"duration_ms":101,"bytes_in":18,"bytes_out":14,"enriched":{"digest":"0938082a62ad7dae","label":"SMTP","strings":["EHLO [127.0.0.1]"],"iocs":{"ips":["127.0.0.1"]}}},{"timestamp":"2026-09-17T14:03:33","port":49154,"proto":"tcp","app_proto":"","app_protocol":"smtp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"EHLO [127.0.0.1]\r\n","payload_hex":"45484c4f205b3132372e302e302e315d0d0a","method":"","user_agent":"","ja3":"","session":"77c85fa5-c3b5-4ea1-a1de-f411f77726d3","seq":1,"duration_ms":100,"bytes_in":18,"bytes_out":14,"enriched":{"digest":"0938082a62ad7dae","label":"SMTP","strings":["EHLO [127.0.0.1]"],"iocs":{"ips":["127.0.0.1"]}}},{"timestamp":"2026-09-17T14:03:33","port":8443,"proto":"tcp","app_proto":"","app_protocol":"smtp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"EHLO [127.0.0.1]\r\n","payload_hex":"45484c4f205b3132372e302e302e315d0d0a","method":"","user_agent":"","ja3":"","session":"519a79ad-406b-445c-a9ad-d1901c425165","seq":1,"duration_ms":100,"bytes_in":18,"bytes_out":14,"enriched":{"digest":"0938082a62ad7dae","label":"SMTP","strings":["EHLO [127.0.0.1]"],"iocs":{"ips":["127.0.0.1"]}}},{"timestamp":"2026-09-17T14:03:33","port":8009,"proto":"tcp","app_proto":"","app_protocol":"smtp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"EHLO [127.0.0.1]\r\n","payload_hex":"45484c4f205b3132372e302e302e315d0d0a","method":"","user_agent":"","ja3":"","session":"8459a395-6d34-4cb4-b7bb-97ad3a9ef286","seq":1,"duration_ms":100,"bytes_in":18,"bytes_out":14,"enriched":{"digest":"0938082a62ad7dae","label":"SMTP","strings":["EHLO [127.0.0.1]"],"iocs":{"ips":["127.0.0.1"]}}},{"timestamp":"2026-09-17T14:03:33","port":9100,"proto":"tcp","app_proto":"","app_protocol":"smtp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"EHLO [127.0.0.1]\r\n","payload_hex":"45484c4f205b3132372e302e302e315d0d0a","method":"","user_agent":"","ja3":"","session":"be02d1fb-700b-4cba-ad0f-1624694d1fc0","seq":1,"duration_ms":100,"bytes_in":18,"bytes_out":14,"enriched":{"digest":"0938082a62ad7dae","label":"SMTP","strings":["EHLO [127.0.0.1]"],"iocs":{"ips":["127.0.0.1"]}}},{"timestamp":"2026-09-17T14:03:33","port":3306,"proto":"tcp","app_proto":"","app_protocol":"smtp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"EHLO [127.0.0.1]\r\n","payload_hex":"45484c4f205b3132372e302e302e315d0d0a","method":"","user_agent":"","ja3":"","session":"f2d4f2ac-7131-491a-bf40-ecf8cff445a5","seq":1,"duration_ms":100,"bytes_in":18,"bytes_out":14,"enriched":{"digest":"0938082a62ad7dae","label":"SMTP","strings":["EHLO [127.0.0.1]"],"iocs":{"ips":["127.0.0.1"]}}},{"timestamp":"2026-09-17T14:03:33","port":10000,"proto":"tcp","app_proto":"","app_protocol":"smtp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"EHLO [127.0.0.1]\r\n","payload_hex":"45484c4f205b3132372e302e302e315d0d0a","method":"","user_agent":"","ja3":"","session":"ca949d87-dabe-4432-8b07-0bf68dc0a203","seq":1,"duration_ms":100,"bytes_in":18,"bytes_out":14,"enriched":{"digest":"0938082a62ad7dae","label":"SMTP","strings":["EHLO [127.0.0.1]"],"iocs":{"ips":["127.0.0.1"]}}},{"timestamp":"2026-09-17T14:03:33","port":9999,"proto":"tcp","app_proto":"","app_protocol":"smtp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"EHLO [127.0.0.1]\r\n","payload_hex":"45484c4f205b3132372e302e302e315d0d0a","method":"","user_agent":"","ja3":"","session":"62076368-ae0a-481d-8c32-87ce83b90cf4","seq":1,"duration_ms":100,"bytes_in":18,"bytes_out":14,"enriched":{"digest":"0938082a62ad7dae","label":"SMTP","strings":["EHLO [127.0.0.1]"],"iocs":{"ips":["127.0.0.1"]}}}],"http_methods":[{"method":"GET","count":1075},{"method":"HEAD","count":9}],"distinct_ports_total":94,"top_paths":[{"path":"/","count":199,"ports":93},{"path":"/favicon.ico","count":75,"ports":75},{"path":"/wp-login.php","count":68,"ports":68},{"path":"/api/status","count":66,"ports":66},{"path":"/core/misc/drupal.js","count":66,"ports":66},{"path":"/login.action","count":64,"ports":64},{"path":"/dede/login.php","count":63,"ports":63},{"path":"/phpmyadmin/","count":63,"ports":63},{"path":"/admin/login.php","count":62,"ports":62},{"path":"/administrator/","count":61,"ports":61},{"path":"/users/sign_in","count":61,"ports":61},{"path":"/login","count":60,"ports":60},{"path":"/user-login.html","count":60,"ports":60},{"path":"/forum.php","count":60,"ports":60},{"path":"/api/health","count":56,"ports":56}],"distinct_paths_total":15,"top_snis":[],"top_hosts":[{"value":"localhost","count":93}],"top_alpns":[{"value":"http/1.1","count":1}],"banners":[{"value":"SSH-2.0-OpenSSH_9.2p1","count":92}],"credentials":[],"header_profile":null,"tags":[{"tag_id":"CVE-2007-4556","tag_type":"cve","title":"OpenSymphony XWork/Apache Struts2 - Remote Code Execution","severity":"medium","actively_exploited":false,"match_field":"url_path","matched_pattern":"/login.action","reference_urls":["https://www.guildhab.top/?p=2326","https://nvd.nist.gov/vuln/detail/CVE-2007-4556","https://cwiki.apache.org/confluence/display/WW/S2-001","http://forums.opensymphony.com/ann.jspa?annID=54","http://issues.apache.org/struts/browse/WW-2030"]}],"data_as_of":"2026-09-19T15:17:23.115087+00:00"}