{"ip":"135.119.20.36","data_as_of":"2026-10-26T12:35:15+00:00","observed":true,"total_events":5,"verdict":{"verdict":"probing","label":"Low-level probing","detail":null,"confidence":"low","network_type":"CDN","why":["11 event(s), fewer than 10 distinct ports, no exploit payloads.","Not in any known-scanner range.","Counts include 6 interactive session(s) as well as first-packet events."],"engagement":{"level":"request","label":"Request traffic","detail":"716 bytes sent","bytes_sent":716,"session_seconds":10,"persistent":false},"basis":"combined"},"first_seen":"2026-10-20T20:22:41","last_seen":"2026-10-26T11:12:54","events_24h":1,"events_7d":5,"interactive_sessions":6,"interactive_sessions_24h":1,"interactive_sessions_7d":6,"interactive_protocols":[{"protocol":"smb","sessions":2},{"protocol":"http","sessions":1}],"geo":{"country_code":"US","country_name":"United States","region":"Iowa","city":"Des Moines","lat":41.6015,"lon":-93.6127,"asn":8075,"org":"Microsoft Corporation"},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as8075","label":"Microsoft","category":"cdn","url":"https://www.peeringdb.com/asn/8075"},"cve_matches":[{"cve_id":"CVE-2025-31324","title":"SAP NetWeaver Visual Composer Metadata Uploader - Deserialization","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/developmentserver/metadatauploader","kev_date_added":"2025-04-29"}],"malware":[],"udp":null,"interaction":{"window_days":90,"sessions":6,"first_seen":"2026-10-20T20:22:41","last_seen":"2026-10-26T11:12:54","verdicts":[{"verdict":"scan","sessions":4},{"verdict":"unknown","sessions":2}],"personas":[{"persona":"smb@Windows Server 2016","sessions":2},{"persona":"nginx@1.24.0, wordpress@6.5.2, leaks@2, miner@bfgminer 5.5.0, elasticsearch@6.8.23, winrm@Windows Server 2016, fortigate@7.0.5, gitlab@19.4.2, plex@1.43.2.10687","sessions":1}],"services":[{"protocol":"smb","port":139,"sessions":2},{"protocol":"tcp","port":4786,"sessions":2},{"protocol":"tcp","port":7574,"sessions":1},{"protocol":"http","port":4443,"sessions":1}],"logins":[],"commands":[],"downloads":[],"files":[],"attack":[{"technique_id":"T1595","technique_name":"Active Scanning","tactic_id":"TA0043","tactic_name":"Reconnaissance","sessions":4}]},"top_ports":[{"port":18245,"proto":"tcp","label":"","count":2,"sessions":0},{"port":139,"proto":"tcp","label":"SMB","count":0,"sessions":2},{"port":4786,"proto":"tcp","label":"Cisco-SCM","count":0,"sessions":2},{"port":9042,"proto":"tcp","label":"Cassandra","count":1,"sessions":0},{"port":443,"proto":"tcp","label":"HTTPS","count":1,"sessions":0},{"port":8080,"proto":"tcp","label":"HTTP-alt","count":1,"sessions":0},{"port":4443,"proto":"tcp","label":"HTTP","count":0,"sessions":1},{"port":7574,"proto":"tcp","label":"","count":0,"sessions":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i190800_9dc949149365_97f8aa674fd9"],"tls_client_hello":"16030100ee010000ea030375d0c8ecbf0ad9b680390321551a7ed0b303d19d498b1215372944a49d36775b2087e8faa8a77c0b516069b901457abb624c575ccdf6f3ac943d8e4f3b7ce0fb960026cca8cca9c02fc030c02bc02cc013c009c014c00a009c009d002f0035c012000a1303130113020100007b000500050100000000000a000a0008001d001700180019000b00020100000d001a0018080404030807080508060401050106010503060302010203ff0100010000120000002b0009080304030303020301003300260024001d00209b21c61f07a6818313b8e0dd8555c67be601141b7412b4a6eb2e908a","tls_ja3":["35fa0a83e466acbec1cfbb9016d550ab"],"http_akin":["b11cun040_00040016_aa48e2c8"],"interactive":{"ssh_hassh":[],"tls_ja4":["t13i190800_9dc949149365_97f8aa674fd9"],"tls_ja3":["35fa0a83e466acbec1cfbb9016d550ab"]}},"fingerprint_peers":{"t13i190800_9dc949149365_97f8aa674fd9":3303,"b11cun040_00040016_aa48e2c8":5564},"akin_families":{},"user_agents":["Mozilla/5.0 zgrab/0.x"],"timeline":[{"date":"2026-10-20","count":0,"sessions":2},{"date":"2026-10-21","count":1,"sessions":1},{"date":"2026-10-23","count":2,"sessions":0},{"date":"2026-10-24","count":1,"sessions":2},{"date":"2026-10-25","count":1,"sessions":0},{"date":"2026-10-26","count":0,"sessions":1}],"recent_events":[{"timestamp":"2026-10-26T11:12:54","port":4443,"proto":"tcp","app_proto":"http","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:4443\",\"user-agent\":\"Mozilla/5.0 zgrab/0.x\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"1.3","alpn":[],"url_path":"/ReportServer","summary":"","payload_hex":"474554202f5265706f727453657276657220485454502f312e310d0a486f73743a203c484f4e4559504f543e3a343434330d0a557365722d4167656e743a204d6f7a696c6c612f352e30207a677261622f302e780d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 zgrab/0.x","ja3":"35fa0a83e466acbec1cfbb9016d550ab","session":"3d8a6622-a1a9-462d-b902-a33da5bac7dc-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-25T13:26:19","port":9042,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_9042\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f393034320a","method":"","user_agent":"","ja3":"","session":"d63ed8cf-b959-41ec-b8f0-475fce3af950","seq":1,"duration_ms":67,"bytes_in":26,"bytes_out":13,"enriched":{"digest":"5c92a5bdc9e65c58","strings":["MGLNDD_<HONEYPOT>_9042"]}},{"timestamp":"2026-10-24T23:21:36","port":4786,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_4786\n","payload_hex":"4d474c4e44445f3c484f4e4559504f543e5f343738360a","method":"","user_agent":"","ja3":"","session":"be524371-fb2c-437a-b804-692084226b6c-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"a49dda8baf5fe430","strings":["MGLNDD_<HONEYPOT>_4786"]},"interactive":true},{"timestamp":"2026-10-24T19:39:04","port":8080,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:8080\",\"user-agent\":\"Mozilla/5.0 zgrab/0.x\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/hudson","summary":"","payload_hex":"474554202f687564736f6e20485454502f312e310d0a486f73743a20<HONEYPOT>3a383038300d0a557365722d4167656e743a204d6f7a696c6c612f352e30207a677261622f302e780d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 zgrab/0.x","ja3":"","session":"5275e2f6-43d7-4a47-9004-6b76edf63be3","seq":1,"duration_ms":100,"bytes_in":120,"bytes_out":78},{"timestamp":"2026-10-23T21:32:23","port":18245,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_18245\n","payload_hex":"4d474c4e44445f<HONEYPOT>5f31383234350a","method":"","user_agent":"","ja3":"","session":"9cc4b134-0a0f-47ec-825a-13e1e0fe267f","seq":1,"duration_ms":61,"bytes_in":27,"bytes_out":13,"enriched":{"digest":"3f43707931f767b4","strings":["MGLNDD_<HONEYPOT>_18245"]}},{"timestamp":"2026-10-23T21:32:23","port":18245,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:18245\",\"user-agent\":\"Mozilla/5.0 zgrab/0.x\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a31383234350d0a557365722d4167656e743a204d6f7a696c6c612f352e30207a677261622f302e780d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 zgrab/0.x","ja3":"","session":"596df193-fa14-4b8f-aa5c-bb225d409720","seq":1,"duration_ms":100,"bytes_in":116,"bytes_out":78},{"timestamp":"2026-10-21T01:23:49","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 zgrab/0.x\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/developmentserver/metadatauploader","summary":"","payload_hex":"474554202f646576656c6f706d656e747365727665722f6d6574616461746175706c6f6164657220485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e30207a677261622f302e780d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 zgrab/0.x","ja3":"35fa0a83e466acbec1cfbb9016d550ab","session":"e76499e2-523a-48fb-bc1b-41f7ca5272d8","seq":1,"duration_ms":104,"bytes_in":143,"bytes_out":78},{"timestamp":"2026-10-20T20:22:41","port":139,"proto":"tcp","app_proto":"smb","app_protocol":"smb","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"MGLNDD_<HONEYPOT>_139\n","payload_hex":"4d474c4e44445f3c484f4e4559504f543e5f3133390a","method":"","user_agent":"","ja3":"","session":"271848eb-ab42-4303-83cd-8ccaac0efac3-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"c6b7de44939720a9","strings":["MGLNDD_<HONEYPOT>_139"]},"interactive":true},{"timestamp":"2026-10-20T20:22:41","port":139,"proto":"tcp","app_proto":"smb","app_protocol":"smb","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000f�SMB@\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000$\u0000\u0001\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0010\u0002","payload_hex":"00000066fe534d424000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002400010001000000000000000000000000000000000000000000000000000000000000001002","method":"","user_agent":"","ja3":"","session":"ebd4d428-9080-4d1b-b933-3b4a3a662267-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"042813e3ac56b4a4","strings":["SMB@"]},"interactive":true}],"http_methods":[{"method":"GET","count":4}],"distinct_ports_total":8,"top_paths":[{"path":"/","count":1,"ports":1},{"path":"/hudson","count":1,"ports":1},{"path":"/developmentserver/metadatauploader","count":1,"ports":1},{"path":"/ReportServer","count":1,"ports":1}],"distinct_paths_total":4,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","Accept-Encoding","Host","User-Agent"],"representative":[{"name":"Accept","value":"*/*","notable":false},{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Host","value":"<HONEYPOT>:4443","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 zgrab/0.x","notable":false}],"distinct_sets":1,"events_with_headers":4},"tags":[{"tag_id":"CVE-2025-31324","tag_type":"cve","title":"SAP NetWeaver Visual Composer Metadata Uploader - Deserialization","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/developmentserver/metadatauploader","reference_urls":["https://www.bleepingcomputer.com/news/security/sap-fixes-suspected-netweaver-zero-day-exploited-in-attacks/","https://www.theregister.com/2025/04/25/sap_netweaver_patch/","https://me.sap.com/notes/3594142","https://url.sap/sapsecuritypatchday"],"kev_date_added":"2025-04-29"}]}