{"ip":"139.162.164.87","data_as_of":"2026-10-26T10:42:10+00:00","observed":true,"total_events":46,"verdict":{"verdict":"malicious","label":"Exploit attempts observed","detail":"10 exploit-path hits","confidence":"high","network_type":"CDN","why":["10 request(s) matched a known exploit path.","Requests with a body (POST, PUT, PATCH or DELETE) were seen, which carries a payload.","5+ hits raise confidence to high.","Not in any known-scanner range.","Sent 11,376 bytes, which is sustained payload delivery."],"engagement":{"level":"payload","label":"Sustained payload","detail":"11,376 bytes sent","bytes_sent":11376,"session_seconds":0,"persistent":false},"basis":"first_contact"},"first_seen":"2026-10-25T14:30:40","last_seen":"2026-10-25T15:01:05","events_24h":46,"events_7d":46,"interactive_sessions":0,"interactive_sessions_24h":0,"interactive_sessions_7d":0,"interactive_protocols":[],"geo":{"country_code":"DE","country_name":"Germany","region":"Hesse","city":"Frankfurt am Main","lat":50.1169,"lon":8.6837,"asn":63949,"org":"Akamai Connected Cloud"},"source_domain":"139-162-164-87.ip.linodeusercontent.com","known_scanners":[],"scanner_tag":{"key":"linode","label":"Linode (Akamai)","category":"hosting_provider","url":"https://www.linode.com/"},"cve_matches":[{"cve_id":"CVE-2023-35078","title":"Ivanti Endpoint Manager Mobile (EPMM) - Authentication Bypass","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/mifs/aad/api/v2/admins/users","kev_date_added":"2023-07-25"},{"cve_id":"CVE-2017-5521","title":"NETGEAR Routers - Authentication Bypass","severity":"high","actively_exploited":true,"match_field":"url_path","matched_pattern":"/passwordrecovered.cgi","kev_date_added":"2022-09-08"},{"cve_id":"CVE-2019-1653","title":"Cisco Small Business WAN VPN Routers - Sensitive Information Disclosure","severity":"high","actively_exploited":true,"match_field":"url_path","matched_pattern":"/cgi-bin/config.exp","kev_date_added":"2021-11-03"},{"cve_id":"CVE-2020-25078","title":"D-Link DCS-2530L/DCS-2670L - Administrator Password Disclosure","severity":"high","actively_exploited":true,"match_field":"url_path","matched_pattern":"/config/getuser","kev_date_added":"2025-08-05"},{"cve_id":"CVE-2022-24990","title":"TerraMaster TOS < 4.2.30 Server Information Disclosure","severity":"high","actively_exploited":true,"match_field":"url_path","matched_pattern":"/module/api.php","kev_date_added":"2023-02-10"},{"cve_id":"CVE-2001-0537","title":"Cisco IOS HTTP Configuration - Authentication Bypass","severity":"critical","actively_exploited":false,"match_field":"url_path","matched_pattern":"/level/16/exec/show/config/CR","kev_date_added":null},{"cve_id":"CVE-2014-2321","title":"ZTE Cable Modem Web Shell","severity":"critical","actively_exploited":false,"match_field":"url_path","matched_pattern":"/web_shell_cmd.gch","kev_date_added":null},{"cve_id":"CVE-2015-0554","title":"ADB/Pirelli ADSL2/2+ Wireless Router P.DGA4001N - Information Disclosure","severity":"critical","actively_exploited":false,"match_field":"url_path","matched_pattern":"/wlsecurity.html","kev_date_added":null},{"cve_id":"CVE-2016-5649","title":"NETGEAR DGN2200 / DGND3700 - Admin Password Disclosure","severity":"critical","actively_exploited":false,"match_field":"url_path","matched_pattern":"/BSW_cxttongr.htm","kev_date_added":null},{"cve_id":"CVE-2018-0127","title":"Cisco RV132W/RV134W Router - Information Disclosure","severity":"critical","actively_exploited":false,"match_field":"url_path","matched_pattern":"/dumpmdm.cmd","kev_date_added":null},{"cve_id":"CVE-2018-9161","title":"PrismaWEB - Credentials Disclosure","severity":"critical","actively_exploited":false,"match_field":"url_path","matched_pattern":"/user/scripts/login_par.js","kev_date_added":null},{"cve_id":"CVE-2018-9995","title":"TBK DVR4104/DVR4216 Devices - Authentication Bypass","severity":"critical","actively_exploited":false,"match_field":"url_path","matched_pattern":"/device.rsp?opt=user&cmd=list","kev_date_added":null},{"cve_id":"CVE-2018-12296","title":"Seagate NAS OS 4.3.15.1 - Server Information Disclosure","severity":"high","actively_exploited":false,"match_field":"url_path","matched_pattern":"/api/external/7.0/system.System.get_infos","kev_date_added":null},{"cve_id":"CVE-2019-16313","title":"ifw8 Router ROM v4.31 - Credential Discovery","severity":"high","actively_exploited":false,"match_field":"url_path","matched_pattern":"/action/usermanager.htm","kev_date_added":null},{"cve_id":"CVE-2021-28937","title":"Acexy Wireless-N WiFi Repeater REV 1.0 - Repeater Password Disclosure","severity":"high","actively_exploited":false,"match_field":"url_path","matched_pattern":"/password.html","kev_date_added":null},{"cve_id":"CVE-2022-28955","title":"D-Link DIR-816L - Improper Access Control","severity":"high","actively_exploited":false,"match_field":"url_path","matched_pattern":"/category_view.php","kev_date_added":null},{"cve_id":"CVE-2022-31846","title":"WAVLINK WN535 G3 - Information Disclosure","severity":"high","actively_exploited":false,"match_field":"url_path","matched_pattern":"/live_mfg.shtml","kev_date_added":null},{"cve_id":"CVE-2022-34046","title":"WAVLINK WN533A8 - Improper Access Control","severity":"high","actively_exploited":false,"match_field":"url_path","matched_pattern":"/sysinit.shtml","kev_date_added":null},{"cve_id":"CVE-2021-27858","title":"FatPipe WARP/IPVPN/MPVPN - Authorization Bypass","severity":"medium","actively_exploited":false,"match_field":"url_path","matched_pattern":"/fpui/jsp/index.jsp","kev_date_added":null},{"cve_id":"CVE-2022-40843","title":"Tenda AC1200 V-W15Ev2 - Authentication Bypass","severity":"medium","actively_exploited":false,"match_field":"url_path","matched_pattern":"/goform/downloadSyslog/syslog.log","kev_date_added":null}],"malware":[],"udp":null,"interaction":null,"top_ports":[{"port":443,"proto":"tcp","label":"HTTPS","count":46}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i190800_9dc949149365_97f8aa674fd9","t13i190900_9dc949149365_e7c285222651"],"tls_client_hello":"16030100f2010000ee0303ff4135457307e6dcea40c555f95407b8b44afc7114dc49f582437fe647c2439b204854163e6088c78d12dc82f76424a515a9cdb366a791d7e82fefacc21281f86e0026c02bc02fc02cc030cca9cca8c009c013c00ac014009c009d002f0035c012000a1301130213030100007f000b00020100ff010001000017000000120000000500050100000000000a000a0008001d001700180019000d001a0018080404030807080508060401050106010503060302010203002b0009080304030303020301003300260024001d00201045d4dc8779db71e69e97b7add272dcd90aa160982439474ec0dae38e49215b","tls_ja3":["9460af62ae0af667130bf0d36514f084","35fa0a83e466acbec1cfbb9016d550ab"],"http_akin":["b11cun060_00040417_9ca62bf2","b11cuq080_0005081f_76504ff6","b11cun040_00040016_aa48e2c8","b11cun050_10040013_2619b3ac","b11cun050_00040017_6b90553b"],"interactive":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[]}},"fingerprint_peers":{"t13i190800_9dc949149365_97f8aa674fd9":3304,"t13i190900_9dc949149365_e7c285222651":400,"b11cun040_00040016_aa48e2c8":5564,"b11cun050_00040017_6b90553b":950,"b11cuq080_0005081f_76504ff6":2,"b11cun060_00040417_9ca62bf2":1,"b11cun050_10040013_2619b3ac":2},"akin_families":{"b11cuq080_0005081f_76504ff6":{"head":"b11cuq070_00050817_ae8383eb","shapes":8,"ips":74},"b11cun050_00040017_6b90553b":{"head":"b11cun050_00040017_6b90553b","shapes":8,"ips":950}},"user_agents":["Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.2 Mobile/15E148 Safari/604.1","Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:85.0) Gecko/20100101 Firefox/85.0","Mozilla/5.0 (Kubuntu; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36","Mozilla/5.0 (Ubuntu; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36","Mozilla/5.0 (Windows NT 6.3; Win64; x64; rv:87.0) Gecko/20100101 Firefox/87.0","Mozilla/5.0 (Macintosh Intel Mac OS X 10.15 rv:91.0) Gecko/20100101 Firefox/91.0;","Mozilla/5.0 (ZZ; Linux i686; rv:124.0) Gecko/20100101 Firefox/124.0","Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/15.3 Safari/605.1.15"],"timeline":[{"date":"2026-10-25","count":46}],"recent_events":[{"timestamp":"2026-10-25T15:01:05","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"accept-language\":\"en\",\"connection\":\"close\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) LoiLoNote/25.0.1 Version/17.4.1 Safari/605.1.15\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/cgi-bin/ExportSettings.sh","summary":"","payload_hex":"474554202f6367692d62696e2f4578706f727453657474696e67732e736820485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e3020284d6163696e746f73683b20496e74656c204d6163204f5320582031305f31355f3729204170706c655765624b69742f3630352e312e313520284b48544d4c2c206c696b65204765636b6f29204c6f694c6f4e6f74652f32352e302e312056657273696f6e2f31372e342e31205361666172692f3630352e312e31350d0a436f6e6e656374696f6e3a20636c6f73650d0a4163636570743a202a2f2a0d0a4163636570742d4c616e67756167653a20656e0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) LoiLoNote/25.0.1 Version/17.4.1 Safari/605.1.15","ja3":"9460af62ae0af667130bf0d36514f084","session":"929b900e-1d80-4792-a09c-95764365f34f","seq":1,"duration_ms":101,"bytes_in":291,"bytes_out":79},{"timestamp":"2026-10-25T15:00:26","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"accept-language\":\"en\",\"connection\":\"close\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.5 Safari/605.4.26\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/level/16/exec/show/config/CR","summary":"","payload_hex":"474554202f6c6576656c2f31362f657865632f73686f772f636f6e6669672f435220485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e3020284d6163696e746f73683b20496e74656c204d6163204f5320582031305f31355f3729204170706c655765624b69742f3630352e312e313520284b48544d4c2c206c696b65204765636b6f292056657273696f6e2f31372e35205361666172692f3630352e342e32360d0a436f6e6e656374696f6e3a20636c6f73650d0a4163636570743a202a2f2a0d0a4163636570742d4c616e67756167653a20656e0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.5 Safari/605.4.26","ja3":"9460af62ae0af667130bf0d36514f084","session":"31f48414-1503-4213-b07c-0135256dc272","seq":1,"duration_ms":104,"bytes_in":275,"bytes_out":79},{"timestamp":"2026-10-25T14:59:47","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"accept-language\":\"en\",\"connection\":\"close\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (ZZ; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/xmldata?item=CpqKey","summary":"","payload_hex":"474554202f786d6c646174613f6974656d3d4370714b657920485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285a5a3b204c696e7578206936383629204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132322e302e302e30205361666172692f3533372e33360d0a436f6e6e656374696f6e3a20636c6f73650d0a4163636570743a202a2f2a0d0a4163636570742d4c616e67756167653a20656e0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (ZZ; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36","ja3":"9460af62ae0af667130bf0d36514f084","session":"6a1422fe-4ef1-4243-9331-741f6dcd77b9","seq":1,"duration_ms":103,"bytes_in":247,"bytes_out":79},{"timestamp":"2026-10-25T14:59:08","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"accept-language\":\"en\",\"connection\":\"close\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (Fedora; Linux i686; rv:126.0) Gecko/20100101 Firefox/126.0\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/dumpmdm.cmd","summary":"","payload_hex":"474554202f64756d706d646d2e636d6420485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e3020284665646f72613b204c696e757820693638363b2072763a3132362e3029204765636b6f2f32303130303130312046697265666f782f3132362e300d0a436f6e6e656374696f6e3a20636c6f73650d0a4163636570743a202a2f2a0d0a4163636570742d4c616e67756167653a20656e0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Fedora; Linux i686; rv:126.0) Gecko/20100101 Firefox/126.0","ja3":"9460af62ae0af667130bf0d36514f084","session":"6651a739-dccb-4210-83ef-7772ceeff6cb","seq":1,"duration_ms":100,"bytes_in":212,"bytes_out":79},{"timestamp":"2026-10-25T14:58:04","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"accept-language\":\"en\",\"connection\":\"close\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.0 Safari/605.1.26\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/folder_view.php","summary":"","payload_hex":"474554202f666f6c6465725f766965772e70687020485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e3020284d6163696e746f73683b20496e74656c204d6163204f5320582031305f31355f3729204170706c655765624b69742f3630352e312e313520284b48544d4c2c206c696b65204765636b6f292056657273696f6e2f31382e30205361666172692f3630352e312e32360d0a436f6e6e656374696f6e3a20636c6f73650d0a4163636570743a202a2f2a0d0a4163636570742d4c616e67756167653a20656e0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.0 Safari/605.1.26","ja3":"9460af62ae0af667130bf0d36514f084","session":"9b84cba0-bf47-4e22-98e8-c75c6707e542","seq":1,"duration_ms":118,"bytes_in":262,"bytes_out":79},{"timestamp":"2026-10-25T14:58:01","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"accept-language\":\"en\",\"connection\":\"close\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.5 Safari/605.6.18\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/category_view.php","summary":"","payload_hex":"474554202f63617465676f72795f766965772e70687020485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e3020284d6163696e746f73683b20496e74656c204d6163204f5320582031305f31355f3729204170706c655765624b69742f3630352e312e313520284b48544d4c2c206c696b65204765636b6f292056657273696f6e2f31372e35205361666172692f3630352e362e31380d0a436f6e6e656374696f6e3a20636c6f73650d0a4163636570743a202a2f2a0d0a4163636570742d4c616e67756167653a20656e0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.5 Safari/605.6.18","ja3":"9460af62ae0af667130bf0d36514f084","session":"abe2ffed-089b-4e77-a875-8764abf40e3e","seq":1,"duration_ms":111,"bytes_in":264,"bytes_out":79},{"timestamp":"2026-10-25T14:57:09","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"accept-language\":\"en\",\"connection\":\"close\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (Fedora; Linux x86_64; rv:123.0) Gecko/20100101 Firefox/123.0\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/wifi_base.shtml","summary":"","payload_hex":"474554202f776966695f626173652e7368746d6c20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e3020284665646f72613b204c696e7578207838365f36343b2072763a3132332e3029204765636b6f2f32303130303130312046697265666f782f3132332e300d0a436f6e6e656374696f6e3a20636c6f73650d0a4163636570743a202a2f2a0d0a4163636570742d4c616e67756167653a20656e0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Fedora; Linux x86_64; rv:123.0) Gecko/20100101 Firefox/123.0","ja3":"9460af62ae0af667130bf0d36514f084","session":"3c20a1d1-c53d-4d20-ae97-5c7167d1ae82","seq":1,"duration_ms":110,"bytes_in":218,"bytes_out":79},{"timestamp":"2026-10-25T14:56:30","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"accept-language\":\"en\",\"connection\":\"close\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/110.0\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/action/usermanager.htm","summary":"","payload_hex":"474554202f616374696f6e2f757365726d616e616765722e68746d20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b207836343b2072763a3130392e3029204765636b6f2f32303130303130312046697265666f782f3131302e300d0a436f6e6e656374696f6e3a20636c6f73650d0a4163636570743a202a2f2a0d0a4163636570742d4c616e67756167653a20656e0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/110.0","ja3":"9460af62ae0af667130bf0d36514f084","session":"184d0aa9-5502-4a24-ac68-8d5341552804","seq":1,"duration_ms":102,"bytes_in":232,"bytes_out":79},{"timestamp":"2026-10-25T14:55:51","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"accept-language\":\"en\",\"connection\":\"close\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:88.0) Gecko/20100101 Firefox/88.0\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/cgi-bin/config.exp","summary":"","payload_hex":"474554202f6367692d62696e2f636f6e6669672e65787020485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e3020284d6163696e746f73683b20496e74656c204d6163204f5320582031302e31333b2072763a38382e3029204765636b6f2f32303130303130312046697265666f782f38382e300d0a436f6e6e656374696f6e3a20636c6f73650d0a4163636570743a202a2f2a0d0a4163636570742d4c616e67756167653a20656e0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:88.0) Gecko/20100101 Firefox/88.0","ja3":"9460af62ae0af667130bf0d36514f084","session":"ed59ef2d-fbdc-4c88-b2b7-625c76cc2bde","seq":1,"duration_ms":102,"bytes_in":230,"bytes_out":79},{"timestamp":"2026-10-25T14:55:11","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"accept-language\":\"en\",\"connection\":\"close\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"TNAS\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/module/api.php?mobile/webNasIPS","summary":"","payload_hex":"474554202f6d6f64756c652f6170692e7068703f6d6f62696c652f7765624e617349505320485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a20544e41530d0a436f6e6e656374696f6e3a20636c6f73650d0a4163636570743a202a2f2a0d0a4163636570742d4c616e67756167653a20656e0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"TNAS","ja3":"9460af62ae0af667130bf0d36514f084","session":"9e026fec-37a4-4c0a-a695-9be32fad8eb2","seq":1,"duration_ms":101,"bytes_in":165,"bytes_out":79}],"http_methods":[{"method":"GET","count":43},{"method":"POST","count":3}],"distinct_ports_total":1,"top_paths":[{"path":"/cgi-bin/ExportLogs.sh","count":2,"ports":1},{"path":"/WAN_wan.htm?.gif","count":2,"ports":1},{"path":"/","count":1,"ports":1},{"path":"/mifs/aad/api/v2/admins/users","count":1,"ports":1},{"path":"/folder_view.php","count":1,"ports":1},{"path":"/rootDesc.xml","count":1,"ports":1},{"path":"/wlsecurity.html","count":1,"ports":1},{"path":"/_syslog.txt","count":1,"ports":1},{"path":"/login.php","count":1,"ports":1},{"path":"/getcfg.php","count":1,"ports":1},{"path":"/password.cgi","count":1,"ports":1},{"path":"/index.asp","count":1,"ports":1},{"path":"/password.html","count":1,"ports":1},{"path":"/manage/wizard/","count":1,"ports":1},{"path":"/live_mfg.shtml","count":1,"ports":1}],"distinct_paths_total":44,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","Accept-Encoding","Accept-Language","Connection","Host","User-Agent"],"representative":[{"name":"Accept","value":"*/*","notable":false},{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Accept-Language","value":"en","notable":false},{"name":"Connection","value":"close","notable":false},{"name":"Host","value":"<HONEYPOT>","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) LoiLoNote/25.0.1 Version/17.4.1 Safari/605.1.15","notable":false}],"distinct_sets":1,"events_with_headers":10},"tags":[{"tag_id":"CVE-2001-0537","tag_type":"cve","title":"Cisco IOS HTTP Configuration - Authentication Bypass","severity":"critical","actively_exploited":false,"match_field":"url_path","matched_pattern":"/level/16/exec/show/config/CR","reference_urls":["https://www.rapid7.com/db/modules/auxiliary/scanner/http/cisco_ios_auth_bypass/","https://nvd.nist.gov/vuln/detail/CVE-2001-0537","http://www.ciac.org/ciac/bulletins/l-106.shtml","https://exchange.xforce.ibmcloud.com/vulnerabilities/6749","https://github.com/ARPSyndicate/cvemon"],"kev_date_added":null},{"tag_id":"CVE-2014-2321","tag_type":"cve","title":"ZTE Cable Modem Web Shell","severity":"critical","actively_exploited":false,"match_field":"url_path","matched_pattern":"/web_shell_cmd.gch","reference_urls":["https://yosmelvin.wordpress.com/2017/09/21/f660-modem-hack/","https://jalalsela.com/zxhn-h108n-router-web-shell-secrets/","https://nvd.nist.gov/vuln/detail/CVE-2014-2321","http://www.kb.cert.org/vuls/id/600724","http://www.myxzy.com/post-411.html"],"kev_date_added":null},{"tag_id":"CVE-2015-0554","tag_type":"cve","title":"ADB/Pirelli ADSL2/2+ Wireless Router P.DGA4001N - Information Disclosure","severity":"critical","actively_exploited":false,"match_field":"url_path","matched_pattern":"/wlsecurity.html","reference_urls":["https://www.exploit-db.com/exploits/35721","http://packetstormsecurity.com/files/129828/Pirelli-ADSL2-2-Wireless-Router-P.DGA4001N-Information-Disclosure.html","https://nvd.nist.gov/vuln/detail/CVE-2015-0554","http://www.exploit-db.com/exploits/35721","https://github.com/ARPSyndicate/cvemon"],"kev_date_added":null},{"tag_id":"CVE-2016-5649","tag_type":"cve","title":"NETGEAR DGN2200 / DGND3700 - Admin Password Disclosure","severity":"critical","actively_exploited":false,"match_field":"url_path","matched_pattern":"/BSW_cxttongr.htm","reference_urls":["https://nvd.nist.gov/vuln/detail/CVE-2016-5649","https://packetstormsecurity.com/files/140342/Netgear-DGN2200-DGND3700-WNDR4500-Information-Disclosure.html","http://packetstormsecurity.com/files/152675/Netgear-DGN2200-DGND3700-Admin-Password-Disclosure.html","https://github.com/ARPSyndicate/cvemon","https://github.com/ARPSyndicate/kenzer-templates"],"kev_date_added":null},{"tag_id":"CVE-2018-0127","tag_type":"cve","title":"Cisco RV132W/RV134W Router - Information Disclosure","severity":"critical","actively_exploited":false,"match_field":"url_path","matched_pattern":"/dumpmdm.cmd","reference_urls":["https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180207-rv13x_2","http://web.archive.org/web/20211207054802/https://securitytracker.com/id/1040345","https://nvd.nist.gov/vuln/detail/CVE-2018-0127","http://www.securitytracker.com/id/1040345","https://github.com/ARPSyndicate/kenzer-templates"],"kev_date_added":null},{"tag_id":"CVE-2018-9161","tag_type":"cve","title":"PrismaWEB - Credentials Disclosure","severity":"critical","actively_exploited":false,"match_field":"url_path","matched_pattern":"/user/scripts/login_par.js","reference_urls":["https://www.zeroscience.mk/en/vulnerabilities/ZSL-2018-5453.php","https://nvd.nist.gov/vuln/detail/CVE-2018-9161","https://www.exploit-db.com/exploits/44276/","https://github.com/ARPSyndicate/kenzer-templates"],"kev_date_added":null},{"tag_id":"CVE-2018-9995","tag_type":"cve","title":"TBK DVR4104/DVR4216 Devices - Authentication Bypass","severity":"critical","actively_exploited":false,"match_field":"url_path","matched_pattern":"/device.rsp?opt=user&cmd=list","reference_urls":["https://www.exploit-db.com/exploits/44577/","http://misteralfa-hack.blogspot.cl/2018/04/tbk-vision-dvr-login-bypass.html","http://misteralfa-hack.blogspot.cl/2018/04/update-dvr-login-bypass-cve-2018-9995.html","https://www.bleepingcomputer.com/news/security/new-hacking-tool-lets-users-access-a-bunch-of-dvrs-and-their-video-feeds/","https://nvd.nist.gov/vuln/detail/CVE-2018-9995"],"kev_date_added":null},{"tag_id":"CVE-2023-35078","tag_type":"cve","title":"Ivanti Endpoint Manager Mobile (EPMM) - Authentication Bypass","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/mifs/aad/api/v2/admins/users","reference_urls":["https://forums.ivanti.com/s/article/CVE-2023-35078-Remote-unauthenticated-API-access-vulnerability","https://forums.ivanti.com/s/article/KB-Remote-unauthenticated-API-access-vulnerability-CVE-2023-35078","https://www.cisa.gov/news-events/alerts/2023/07/24/ivanti-releases-security-updates-endpoint-manager-mobile-epmm-cve-2023-35078","https://www.ivanti.com/blog/cve-2023-35078-new-ivanti-epmm-vulnerability","https://help.ivanti.com/mi/help/en_us/CORE/11.2.0.0/dmgw/DMGfiles/Join_Azure_and_MobileIro.htm"],"kev_date_added":"2023-07-25"},{"tag_id":"CVE-2017-5521","tag_type":"cve","title":"NETGEAR Routers - Authentication Bypass","severity":"high","actively_exploited":true,"match_field":"url_path","matched_pattern":"/passwordrecovered.cgi","reference_urls":["https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/cve-2017-5521-bypassing-authentication-on-netgear-routers/","http://kb.netgear.com/30632/Web-GUI-Password-Recovery-and-Exposure-Security-Vulnerability","https://nvd.nist.gov/vuln/detail/CVE-2017-5521","https://www.exploit-db.com/exploits/41205/","https://github.com/Ostorlab/known_exploited_vulnerbilities_detectors"],"kev_date_added":"2022-09-08"},{"tag_id":"CVE-2018-12296","tag_type":"cve","title":"Seagate NAS OS 4.3.15.1 - Server Information Disclosure","severity":"high","actively_exploited":false,"match_field":"url_path","matched_pattern":"/api/external/7.0/system.System.get_infos","reference_urls":["https://blog.securityevaluators.com/invading-your-personal-cloud-ise-labs-exploits-the-seagate-stcr3000101-ecf89de2170","https://nvd.nist.gov/vuln/detail/CVE-2018-12296","https://github.com/ARPSyndicate/kenzer-templates"],"kev_date_added":null},{"tag_id":"CVE-2019-16313","tag_type":"cve","title":"ifw8 Router ROM v4.31 - Credential Discovery","severity":"high","actively_exploited":false,"match_field":"url_path","matched_pattern":"/action/usermanager.htm","reference_urls":["https://github.com/Mr-xn/Penetration_Testing_POC/blob/master/CVE-2019-16313%20%E8%9C%82%E7%BD%91%E4%BA%92%E8%81%94%E4%BC%81%E4%B8%9A%E7%BA%A7%E8%B7%AF%E7%94%B1%E5%99%A8v4.31%E5%AF%86%E7%A0%81%E6%B3%84%E9%9C%B2%E6%BC%8F%E6%B4%9E.md","https://nvd.nist.gov/vuln/detail/CVE-2019-16313","http://www.iwantacve.cn/index.php/archives/311/","https://github.com/CnHack3r/Penetration_PoC","https://github.com/apachecn-archive/Middleware-Vulnerability-detection"],"kev_date_added":null},{"tag_id":"CVE-2019-1653","tag_type":"cve","title":"Cisco Small Business WAN VPN Routers - Sensitive Information Disclosure","severity":"high","actively_exploited":true,"match_field":"url_path","matched_pattern":"/cgi-bin/config.exp","reference_urls":["https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190123-rv-info","https://www.exploit-db.com/exploits/46262/","https://www.exploit-db.com/exploits/46655/","https://nvd.nist.gov/vuln/detail/CVE-2019-1653","http://packetstormsecurity.com/files/152305/Cisco-RV320-RV325-Unauthenticated-Remote-Code-Execution.html"],"kev_date_added":"2021-11-03"},{"tag_id":"CVE-2020-25078","tag_type":"cve","title":"D-Link DCS-2530L/DCS-2670L - Administrator Password Disclosure","severity":"high","actively_exploited":true,"match_field":"url_path","matched_pattern":"/config/getuser","reference_urls":["https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10180","https://twitter.com/Dogonsecurity/status/1273251236167516161","https://nvd.nist.gov/vuln/detail/CVE-2020-25078","https://github.com/pen4uin/vulnerability-research-list","https://github.com/ArrestX/--POC"],"kev_date_added":"2025-08-05"},{"tag_id":"CVE-2021-28937","tag_type":"cve","title":"Acexy Wireless-N WiFi Repeater REV 1.0 - Repeater Password Disclosure","severity":"high","actively_exploited":false,"match_field":"url_path","matched_pattern":"/password.html","reference_urls":["https://blog-ssh3ll.medium.com/acexy-wireless-n-wifi-repeater-vulnerabilities-8bd5d14a2990","http://acexy.com","https://nvd.nist.gov/vuln/detail/CVE-2021-28937","https://github.com/ARPSyndicate/cvemon","https://github.com/ARPSyndicate/kenzer-templates"],"kev_date_added":null},{"tag_id":"CVE-2022-24990","tag_type":"cve","title":"TerraMaster TOS < 4.2.30 Server Information Disclosure","severity":"high","actively_exploited":true,"match_field":"url_path","matched_pattern":"/module/api.php","reference_urls":["https://octagon.net/blog/2022/03/07/cve-2022-24990-terrmaster-tos-unauthenticated-remote-command-execution-via-php-object-instantiation/","https://www.broadcom.com/support/security-center/attacksignatures/detail?asid=33732","https://forum.terra-master.com/en/viewforum.php?f=28","http://packetstormsecurity.com/files/172904/TerraMaster-TOS-4.2.29-Remote-Code-Execution.html","https://github.com/ArrestX/--POC"],"kev_date_added":"2023-02-10"},{"tag_id":"CVE-2022-28955","tag_type":"cve","title":"D-Link DIR-816L - Improper Access Control","severity":"high","actively_exploited":false,"match_field":"url_path","matched_pattern":"/category_view.php","reference_urls":["https://github.com/shijin0925/IOT/blob/master/DIR816/1.md","https://www.dlink.com/en/security-bulletin/","https://nvd.nist.gov/vuln/detail/CVE-2022-28955","https://github.com/ARPSyndicate/cvemon","https://github.com/ARPSyndicate/kenzer-templates"],"kev_date_added":null},{"tag_id":"CVE-2022-31846","tag_type":"cve","title":"WAVLINK WN535 G3 - Information Disclosure","severity":"high","actively_exploited":false,"match_field":"url_path","matched_pattern":"/live_mfg.shtml","reference_urls":["https://github.com/pghuanghui/CVE_Request/blob/main/WAVLINK%20WN535%20G3__live_mfg.md","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-30489","https://nvd.nist.gov/vuln/detail/CVE-2022-31846","https://github.com/ARPSyndicate/cvemon","https://github.com/ARPSyndicate/kenzer-templates"],"kev_date_added":null},{"tag_id":"CVE-2022-34046","tag_type":"cve","title":"WAVLINK WN533A8 - Improper Access Control","severity":"high","actively_exploited":false,"match_field":"url_path","matched_pattern":"/sysinit.shtml","reference_urls":["https://drive.google.com/file/d/18ECQEqZ296LDzZ0wErgqnNfen1jCn0mG/view?usp=sharing","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-34046","http://packetstormsecurity.com/files/167890/Wavlink-WN533A8-Password-Disclosure.html","https://nvd.nist.gov/vuln/detail/CVE-2022-34046","https://github.com/ARPSyndicate/cvemon"],"kev_date_added":null},{"tag_id":"CVE-2021-27858","tag_type":"cve","title":"FatPipe WARP/IPVPN/MPVPN - Authorization Bypass","severity":"medium","actively_exploited":false,"match_field":"url_path","matched_pattern":"/fpui/jsp/index.jsp","reference_urls":["https://www.zeroscience.mk/en/vulnerabilities/ZSL-2021-5682.php","https://www.fatpipeinc.com/support/advisories.php","https://www.fatpipeinc.com/support/cve-list.php","https://www.zeroscience.mk/codes/fatpipe_auth.txt"],"kev_date_added":null},{"tag_id":"CVE-2022-40843","tag_type":"cve","title":"Tenda AC1200 V-W15Ev2 - Authentication Bypass","severity":"medium","actively_exploited":false,"match_field":"url_path","matched_pattern":"/goform/downloadSyslog/syslog.log","reference_urls":["https://boschko.ca/tenda_ac1200_router","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-40843"],"kev_date_added":null}]}