{"ip":"131.186.5.113","data_as_of":"2026-10-21T14:01:33+00:00","observed":true,"total_events":728,"verdict":{"verdict":"scanning","label":"Scanning for known vulnerabilities","detail":"51 exploit-path probe(s)","confidence":"medium","network_type":"CDN","why":["51 request(s) matched a known exploit path.","Only GET and HEAD requests were seen, with no body, which reads as a check for the vulnerability without a payload.","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"198,842 bytes sent","bytes_sent":198842,"session_seconds":8,"persistent":false},"basis":"first_contact"},"first_seen":"2026-10-19T09:25:31","last_seen":"2026-10-19T19:59:08","events_24h":0,"events_7d":728,"interactive_sessions":0,"interactive_sessions_24h":0,"interactive_sessions_7d":0,"interactive_protocols":[],"geo":{"country_code":"US","country_name":"United States","region":"Illinois","city":"Chicago","lat":41.8486,"lon":-87.6288,"asn":31898,"org":"Oracle Corporation"},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as31898","label":"Oracle Cloud Infrastructure","category":"cdn","url":"https://www.peeringdb.com/asn/31898"},"cve_matches":[{"cve_id":"CVE-2025-27134","title":"Joplin 3.3.3 Server - Privilege Escalation","severity":"high","actively_exploited":false,"match_field":"url_path","matched_pattern":"/api/sessions","kev_date_added":null},{"cve_id":"CVE-2025-2129","title":"Mage AI - Insecure Default Authentication Setup","severity":"medium","actively_exploited":false,"match_field":"url_path","matched_pattern":"/api/kernels","kev_date_added":null}],"malware":[],"udp":null,"interaction":null,"top_ports":[{"port":6006,"proto":"tcp","label":"","count":669},{"port":443,"proto":"tcp","label":"HTTPS","count":59}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i1010h1_61a7ad8aa9b6_3a8073edd8ef"],"tls_client_hello":"16030100ec010000e80303bf95581b9e2a0bdfd54fee9482c2bf9de807e8a82717084475bbd4aa4c841495204dc84bc34a14774f5a802be8d36f7aa94cf440a8dc0b00c4c23af9db793781760014130213011303c02cc02bcca9c030c02fcca800ff0100008b000a00080006001d00170018000b00020100002d00020101000d001c001a02010203040104030501050306010603080408050806080708080010000b000908687474702f312e3100170000002b0005040304030300230000000500050100000000003300260024001d0020490c50aaeb82409be72638401e17d6773f0525d4a8f634c8b3f2566f","tls_ja3":["988d6bc8c3e6ef39eebbec8d1e48b9f9","0d93e15d93e46f1d955f24d642b99711","c30cc801c188efeaf59f229f8e1d688e","161ffb277e30cc5316cfd82623da1541","18fde68d1b4d50de8db0f44fc05e9378"],"http_akin":["b11cun040_00040016_c1d30083"],"interactive":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[]}},"fingerprint_peers":{"b11cun040_00040016_c1d30083":128,"t13i1010h1_61a7ad8aa9b6_3a8073edd8ef":57},"akin_families":{},"user_agents":["WebSiphon/next-0.1"],"timeline":[{"date":"2026-10-19","count":728}],"recent_events":[{"timestamp":"2026-10-19T19:59:08","port":6006,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip,deflate,br\",\"host\":\"<HONEYPOT>:6006\",\"user-agent\":\"WebSiphon/next-0.1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/api/queue","summary":"","payload_hex":"474554202f6170692f717565756520485454502f312e310d0a6163636570743a202a2f2a0d0a757365722d6167656e743a20576562536970686f6e2f6e6578742d302e310d0a6163636570742d656e636f64696e673a20677a69702c6465666c6174652c62720d0a686f73743a20<HONEYPOT>3a363030360d0a0d0a","method":"GET","user_agent":"WebSiphon/next-0.1","ja3":"","session":"350a328b-a834-400b-9b86-16242639469e","seq":5,"duration_ms":4260,"bytes_in":683,"bytes_out":390},{"timestamp":"2026-10-19T19:59:08","port":6006,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip,deflate,br\",\"host\":\"<HONEYPOT>:6006\",\"user-agent\":\"WebSiphon/next-0.1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/api/tags","summary":"","payload_hex":"474554202f6170692f7461677320485454502f312e310d0a6163636570743a202a2f2a0d0a757365722d6167656e743a20576562536970686f6e2f6e6578742d302e310d0a6163636570742d656e636f64696e673a20677a69702c6465666c6174652c62720d0a686f73743a20<HONEYPOT>3a363030360d0a0d0a","method":"GET","user_agent":"WebSiphon/next-0.1","ja3":"","session":"1119c915-e731-461f-84cc-24dffef60d79","seq":2,"duration_ms":686,"bytes_in":274,"bytes_out":156},{"timestamp":"2026-10-19T19:59:08","port":6006,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip,deflate,br\",\"host\":\"<HONEYPOT>:6006\",\"user-agent\":\"WebSiphon/next-0.1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/api/system-info","summary":"","payload_hex":"474554202f6170692f73797374656d2d696e666f20485454502f312e310d0a6163636570743a202a2f2a0d0a757365722d6167656e743a20576562536970686f6e2f6e6578742d302e310d0a6163636570742d656e636f64696e673a20677a69702c6465666c6174652c62720d0a686f73743a20<HONEYPOT>3a363030360d0a0d0a","method":"GET","user_agent":"WebSiphon/next-0.1","ja3":"","session":"d2647c59-38dc-4160-90af-c33ffc3d2058","seq":4,"duration_ms":3899,"bytes_in":582,"bytes_out":312},{"timestamp":"2026-10-19T19:59:08","port":6006,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip,deflate,br\",\"host\":\"<HONEYPOT>:6006\",\"user-agent\":\"WebSiphon/next-0.1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/openapi.json","summary":"","payload_hex":"474554202f6f70656e6170692e6a736f6e20485454502f312e310d0a6163636570743a202a2f2a0d0a757365722d6167656e743a20576562536970686f6e2f6e6578742d302e310d0a6163636570742d656e636f64696e673a20677a69702c6465666c6174652c62720d0a686f73743a20<HONEYPOT>3a363030360d0a0d0a","method":"GET","user_agent":"WebSiphon/next-0.1","ja3":"","session":"fc72ea23-3b11-4ab2-98af-9492008163ce","seq":3,"duration_ms":2325,"bytes_in":411,"bytes_out":234},{"timestamp":"2026-10-19T19:59:08","port":6006,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip,deflate,br\",\"host\":\"<HONEYPOT>:6006\",\"user-agent\":\"WebSiphon/next-0.1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/api/system_stats","summary":"","payload_hex":"474554202f6170692f73797374656d5f737461747320485454502f312e310d0a6163636570743a202a2f2a0d0a757365722d6167656e743a20576562536970686f6e2f6e6578742d302e310d0a6163636570742d656e636f64696e673a20677a69702c6465666c6174652c62720d0a686f73743a20<HONEYPOT>3a363030360d0a0d0a","method":"GET","user_agent":"WebSiphon/next-0.1","ja3":"","session":"fb0994ea-f260-4048-a8f3-b1baaf249af5","seq":2,"duration_ms":648,"bytes_in":269,"bytes_out":156},{"timestamp":"2026-10-19T19:59:08","port":6006,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip,deflate,br\",\"host\":\"<HONEYPOT>:6006\",\"user-agent\":\"WebSiphon/next-0.1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/health","summary":"","payload_hex":"474554202f6865616c746820485454502f312e310d0a6163636570743a202a2f2a0d0a757365722d6167656e743a20576562536970686f6e2f6e6578742d302e310d0a6163636570742d656e636f64696e673a20677a69702c6465666c6174652c62720d0a686f73743a20<HONEYPOT>3a363030360d0a0d0a","method":"GET","user_agent":"WebSiphon/next-0.1","ja3":"","session":"c1f1f8d4-49f7-46ad-8816-eb1d3b160035","seq":3,"duration_ms":2283,"bytes_in":401,"bytes_out":234},{"timestamp":"2026-10-19T19:59:08","port":6006,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip,deflate,br\",\"host\":\"<HONEYPOT>:6006\",\"user-agent\":\"WebSiphon/next-0.1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/v1/models","summary":"","payload_hex":"474554202f76312f6d6f64656c7320485454502f312e310d0a6163636570743a202a2f2a0d0a757365722d6167656e743a20576562536970686f6e2f6e6578742d302e310d0a6163636570742d656e636f64696e673a20677a69702c6465666c6174652c62720d0a686f73743a20<HONEYPOT>3a363030360d0a0d0a","method":"GET","user_agent":"WebSiphon/next-0.1","ja3":"","session":"40ba47f3-3fc3-413d-82bb-de553c0c15a3","seq":2,"duration_ms":715,"bytes_in":261,"bytes_out":156},{"timestamp":"2026-10-19T19:59:08","port":6006,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip,deflate,br\",\"host\":\"<HONEYPOT>:6006\",\"user-agent\":\"WebSiphon/next-0.1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/healthz","summary":"","payload_hex":"474554202f6865616c74687a20485454502f312e310d0a6163636570743a202a2f2a0d0a757365722d6167656e743a20576562536970686f6e2f6e6578742d302e310d0a6163636570742d656e636f64696e673a20677a69702c6465666c6174652c62720d0a686f73743a20<HONEYPOT>3a363030360d0a0d0a","method":"GET","user_agent":"WebSiphon/next-0.1","ja3":"","session":"655295df-4c8f-461d-97bc-fe55a95c5d81","seq":3,"duration_ms":2279,"bytes_in":428,"bytes_out":234},{"timestamp":"2026-10-19T19:59:08","port":6006,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip,deflate,br\",\"host\":\"<HONEYPOT>:6006\",\"user-agent\":\"WebSiphon/next-0.1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/docs","summary":"","payload_hex":"474554202f646f637320485454502f312e310d0a6163636570743a202a2f2a0d0a757365722d6167656e743a20576562536970686f6e2f6e6578742d302e310d0a6163636570742d656e636f64696e673a20677a69702c6465666c6174652c62720d0a686f73743a20<HONEYPOT>3a363030360d0a0d0a","method":"GET","user_agent":"WebSiphon/next-0.1","ja3":"","session":"070bec36-0b86-48a9-9a59-4bd47a1f58e9","seq":3,"duration_ms":2276,"bytes_in":398,"bytes_out":234},{"timestamp":"2026-10-19T19:59:08","port":6006,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip,deflate,br\",\"host\":\"<HONEYPOT>:6006\",\"user-agent\":\"WebSiphon/next-0.1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/metrics","summary":"","payload_hex":"474554202f6d65747269637320485454502f312e310d0a6163636570743a202a2f2a0d0a757365722d6167656e743a20576562536970686f6e2f6e6578742d302e310d0a6163636570742d656e636f64696e673a20677a69702c6465666c6174652c62720d0a686f73743a20<HONEYPOT>3a363030360d0a0d0a","method":"GET","user_agent":"WebSiphon/next-0.1","ja3":"","session":"c28c54c6-90ab-4cca-b7bc-93f09d811bb5","seq":2,"duration_ms":708,"bytes_in":263,"bytes_out":156}],"http_methods":[{"method":"GET","count":728}],"distinct_ports_total":2,"top_paths":[{"path":"/openapi.json","count":2,"ports":2},{"path":"/","count":2,"ports":2},{"path":"/.env","count":2,"ports":2},{"path":"/healthz","count":2,"ports":2},{"path":"/api/kernels","count":2,"ports":2},{"path":"/health","count":2,"ports":2},{"path":"/entrypoint.sh","count":2,"ports":2},{"path":"/docs","count":2,"ports":2},{"path":"/files/root/.env","count":2,"ports":2},{"path":"/api/env","count":2,"ports":2},{"path":"/config","count":2,"ports":2},{"path":"/.env.example","count":2,"ports":2},{"path":"/files/.env","count":2,"ports":2},{"path":"/api/tags","count":2,"ports":2},{"path":"/config.json","count":2,"ports":2}],"distinct_paths_total":200,"top_snis":[],"top_hosts":[],"top_alpns":[{"value":"http/1.1","count":59}],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","Accept-Encoding","Host","User-Agent"],"representative":[{"name":"Accept","value":"*/*","notable":false},{"name":"Accept-Encoding","value":"gzip,deflate,br","notable":false},{"name":"Host","value":"<HONEYPOT>:6006","notable":false},{"name":"User-Agent","value":"WebSiphon/next-0.1","notable":false}],"distinct_sets":1,"events_with_headers":10},"tags":[{"tag_id":"CVE-2025-27134","tag_type":"cve","title":"Joplin 3.3.3 Server - Privilege Escalation","severity":"high","actively_exploited":false,"match_field":"url_path","matched_pattern":"/api/sessions","reference_urls":["https://github.com/laurent22/joplin/security/advisories/GHSA-xj67-649m-3p8x","https://nvd.nist.gov/vuln/detail/CVE-2025-27134"],"kev_date_added":null},{"tag_id":"CVE-2025-2129","tag_type":"cve","title":"Mage AI - Insecure Default Authentication Setup","severity":"medium","actively_exploited":false,"match_field":"url_path","matched_pattern":"/api/kernels","reference_urls":["https://nvd.nist.gov/vuln/detail/CVE-2025-2129","https://github.com/zn9988/publications/blob/main/2.Mage-AI%20-%20Insecure%20Default%20Authentication%20Setup%20Leading%20to%20Zero-Click%20RCE/README.md","https://vuldb.com/?ctiid.299049","https://vuldb.com/?id.299049","https://vuldb.com/?submit.510690"],"kev_date_added":null}]}