{"ip":"143.246.221.223","total_events":245,"verdict":{"verdict":"malicious","label":"Exploit attempts observed","detail":"6 exploit-path hits","confidence":"high","network_type":"enterprise","why":["6 request(s) matched a known exploit path.","Body-carrying methods (POST/PUT/PATCH/DELETE) seen: payload delivery, not just recon.","5+ hits raise confidence to high.","Not in any known-scanner range.","Sent 2,931,107 bytes: sustained payload delivery, not a single opportunistic request."],"engagement":{"level":"payload","label":"Sustained payload","detail":"2,931,107 bytes sent","bytes_sent":2931107,"session_seconds":41,"persistent":false}},"first_seen":"2026-09-24T16:39:01","last_seen":"2026-09-24T16:40:25","events_24h":0,"events_7d":245,"geo":{"country_code":"MD","country_name":"Moldova","region":"Chișinău Municipality","city":"Chisinau","lat":47.0042,"lon":28.8574,"asn":200019,"org":"Alexhost Srl"},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as200019","label":"AlexHost","category":"enterprise","url":"https://www.peeringdb.com/asn/200019"},"cve_matches":[{"cve_id":"CVE-2020-2551","title":"Oracle WebLogic Server - Remote Code Execution","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/console/login/LoginForm.jsp"},{"cve_id":"CVE-2021-35587","title":"Oracle Access Manager - Remote Code Execution","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/oam/server/opensso/sessionservice"},{"cve_id":"CVE-2022-26143","title":"Mitel MiCollab - Information Disclosure & Denial of Service","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/ucs/micollab/version.json"},{"cve_id":"CVE-2024-1709","title":"ConnectWise ScreenConnect 23.9.7 - Authentication Bypass","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/SetupWizard.aspx"},{"cve_id":"CVE-2025-0282","title":"Ivanti Connect Secure - Stack-based Buffer Overflow","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/dana-na/auth/url_default/welcome.cgi"},{"cve_id":"CVE-2020-14864","title":"Oracle Fusion - Directory Traversal/Local File Inclusion","severity":"high","actively_exploited":true,"match_field":"url_path","matched_pattern":"/analytics/saw.dll"},{"cve_id":"CVE-2023-38646","title":"Metabase < 0.46.6.1 - Remote Code Execution","severity":"critical","actively_exploited":false,"match_field":"url_path","matched_pattern":"/api/session/properties"},{"cve_id":"CVE-2024-23917","title":"JetBrains TeamCity > 2023.11.3 - Authentication Bypass","severity":"critical","actively_exploited":false,"match_field":"url_path","matched_pattern":"/app/rest/server"},{"cve_id":"CVE-2024-25723","title":"ZenML ZenML Server - Improper Authentication","severity":"critical","actively_exploited":false,"match_field":"url_path","matched_pattern":"/api/v1/info"},{"cve_id":"CVE-2024-30569","title":"Netgear R6850 - Information Disclosure","severity":"high","actively_exploited":false,"match_field":"url_path","matched_pattern":"/currentsetting.htm"},{"cve_id":"CVE-2026-25892","title":"Adminer 4.6.2 - 5.4.1 Unauthenticated Persistent DoS","severity":"high","actively_exploited":false,"match_field":"url_path","matched_pattern":"/adminer.php"},{"cve_id":"CVE-2026-35029","title":"LiteLLM - Arbitrary File Read","severity":"high","actively_exploited":false,"match_field":"url_path","matched_pattern":"/health/liveliness"},{"cve_id":"CVE-2007-4556","title":"OpenSymphony XWork/Apache Struts2 - Remote Code Execution","severity":"medium","actively_exploited":false,"match_field":"url_path","matched_pattern":"/login.action"},{"cve_id":"CVE-2025-2129","title":"Mage AI - Insecure Default Authentication Setup","severity":"medium","actively_exploited":false,"match_field":"url_path","matched_pattern":"/api/kernels"}],"malware":[],"top_ports":[{"port":10001,"proto":"tcp","label":"","count":245}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i131000_f57a46bbacb6_f50d94e863eb","t13i251000_b78ed14e2fd0_f50d94e863eb"],"tls_client_hello":"16030105ee010005ea0303574ea7831d2c181e70713f668c36816330882f0208fd2d18d3e7cf5a97e5208d20fd7c6690b87698b5d93358ed6a082215ec507f6fdc6c5f104979660557b1f5930032cca9cca8c02bc02fc02cc030c009c013c00ac014009c009d002f0035c012000ac023c027003cc007c01100051303130113020100056f000b00020100ff010001000017000000120000000500050100000000000a0010000e11ec11eb11ed001d001700180019000d001c001a090409050906080404030807080508060401050106010503060300320020001e090409050906080404030807080508060401050106010503060302010203002b0009080304030303020301003304ea04e811ec04c01237c10cea8c5860489094aab720096a916db7e930795b43652a978779926dc71c7b1bba58d02095226143aa1aab50736547a5615a9eb19c87803b164ad00d024a8b7c44c49fb73b49d08320b87418da948f427aeb7c36e02ccae27148df8141df55a3a907472f43952e482dfe8c166bba2238d444bda142e003777a4ccb553157079454d3347e941486912c9c78821a927b63561b82123cb0cff675aac12a81e929e83686bdf9081b26699b2b93fcf358d713a3fcaa38a5619c64bc57bf7b99633050bb96ad7d27824ca876cbcaaffbb50cf73a1598b92bace2a69706180763039ad00b06c0bec98577962a03f469873d5121fc799ae9397e81178d74905226b57941839388016de606b6b19a223c763e82b9cfcb4552e857c6948b963a38bd068b784d0377e4b574e271944636b1d93468efe58b6811173d189bfdcb56c576288064ae2494cc3f856d7a0a161f283158c333ffb0ac3d5b679672516c12c553c26b3e196a8282c90b4cc3f93a3b38aa9200920f9cac310419aa8b8b863cfc3f33483694e88a9ce87563a925bdf675ebb44aafe60be42378cc1750df04c1b182782f83b8e662844908a48349968d50b78c5481df2b00243a2f8d99ca87a69b4aa5328252a72cf82d12e9c890c9cddd4a73ce41132767c1b28c48cc721aad6bae9241a90f61c420c99b6fa065fbe2abf039cc1331406bf0a29f178960131a4a49081ca09f356c947c148d5d51b308e70762333f94a81173cc8b642063351c508e7529b148c685f23d0ce323e1257b52733e18e45478a6bf2b45c11c7700d48b17619abfceb117efe1c84247613e587733eac681341f3f938aa4916f07b61c6b9657a414c44cd709dc66b88c6435215a4a4411a8e5296ce1ec4d5d40a66b14a691813e7a824d7f000ae259a49c90ae10610ecd2270500a579be142e985496166a8eef699ff4300d65b1a73fa76f069c38eab6e6a504d3599bdcca178180c7e9289c9a500249c6631d8b879c642b739271881080591f9620a3c14ab02c1312a0a5eaa95b208c04c463144bca3851592d48464fa17c5343ac17781ce87fb957cd4ca777636e8986f63e99a72f3b0ddab6e44d181aff20ac3421384f85b76a3b8e9f31918238c294abab2d54582b22958bbbe265782913577c6b48c537333e89ac3275a51b7591853978417579c992c4fd1130f1d011ec36ca3cbe7c67fd26ef38b4600cd6dc659769e3a2e72f3a3234c819e0683833147dd2780dbbb9898f98d1417734f745a25e762ac96881316346742b99c858995a020be1110e0a3bc211316a61c1ff5317b8c916bc7c072de839e8c9b8d9ef205991bc5ee08b1dbebb8ff191aaabb2baeb2689b97209a64589edb88f14c9346b980f619a77ef3270832332f2c0ced9341ea67bd43a6232f66bdb3d1789126907700be2d3097204709810100cc4174bd79397484b547f35669a396e67184d3ca89a7069fd54bc2185b3e0ea75dfd3b8edd9c6384bac3c56192eeda0ba62403a23781f010212d2b8f5b976323574fd0ba53f129bbba79871cdc5119183ba2528eb626ad1cac87432809154b351489a96f4295b5b307e1d6512140b1d70070a10c959df101cc8b4e521346910bb5b6d4c042be6700abba03e13c6f2690946600b5910f9736e67d3690819684119326e2605d6560179bc4dc3d8fab6715769e86598fbb30c069d237c5575ffb370e001d002026e2605d6560179bc4dc3d8fab6715769e86598fbb30c069d237c557","tls_ja3":["9404b4852d44353f69b8b33aaff15be4","56b0f6febc953849f7ace70c5a2ae34d"],"http_akin":["a11cuq061_0000064a_ffe60107","a11cun040_0000004d_50f90888","a11cun030_0000000b_4c75231d","a11cun030_0000004c_13ee3d34"]},"fingerprint_peers":{"t13i131000_f57a46bbacb6_f50d94e863eb":2712,"t13i251000_b78ed14e2fd0_f50d94e863eb":38,"a11cun040_0000004d_50f90888":26,"a11cun030_0000000b_4c75231d":3,"a11cun030_0000004c_13ee3d34":2540,"a11cuq061_0000064a_ffe60107":42},"akin_families":{"a11cun040_0000004d_50f90888":{"head":"a11cun040_0000004d_aa48e2c8","shapes":4,"ips":3280},"a11cun030_0000004c_13ee3d34":{"head":"a11cun030_0000004c_13ee3d34","shapes":3,"ips":2540}},"user_agents":["nerva/1.0","Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36"],"timeline":[{"date":"2026-09-24","count":245}],"recent_events":[{"timestamp":"2026-09-24T16:40:25","port":10001,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"application/json\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:10001\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/libs/granite/core/content/login.html","summary":"","payload_hex":"474554202f6c6962732f6772616e6974652f636f72652f636f6e74656e742f6c6f67696e2e68746d6c20485454502f312e310d0a486f73743a20<HONEYPOT>3a31303030310d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132372e302e302e30205361666172692f3533372e33360d0a4163636570743a206170706c69636174696f6e2f6a736f6e0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36","ja3":"9404b4852d44353f69b8b33aaff15be4","session":"be974222-cac4-40ac-95fd-caf7f800996e","seq":158,"duration_ms":41217,"bytes_in":36575,"bytes_out":12640},{"timestamp":"2026-09-24T16:40:25","port":10001,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"application/json\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:10001\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/_stcore/health","summary":"","payload_hex":"474554202f5f7374636f72652f6865616c746820485454502f312e310d0a486f73743a20<HONEYPOT>3a31303030310d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132372e302e302e30205361666172692f3533372e33360d0a4163636570743a206170706c69636174696f6e2f6a736f6e0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36","ja3":"9404b4852d44353f69b8b33aaff15be4","session":"be974222-cac4-40ac-95fd-caf7f800996e","seq":156,"duration_ms":40725,"bytes_in":36090,"bytes_out":12480},{"timestamp":"2026-09-24T16:40:25","port":10001,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"application/json\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:10001\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/v2/api-docs","summary":"","payload_hex":"474554202f76322f6170692d646f637320485454502f312e310d0a486f73743a20<HONEYPOT>3a31303030310d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132372e302e302e30205361666172692f3533372e33360d0a4163636570743a206170706c69636174696f6e2f6a736f6e0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36","ja3":"9404b4852d44353f69b8b33aaff15be4","session":"be974222-cac4-40ac-95fd-caf7f800996e","seq":157,"duration_ms":40974,"bytes_in":36320,"bytes_out":12560},{"timestamp":"2026-09-24T16:40:24","port":10001,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"text/html\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:10001\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/p6/action/login","summary":"","payload_hex":"474554202f70362f616374696f6e2f6c6f67696e20485454502f312e310d0a486f73743a20<HONEYPOT>3a31303030310d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132372e302e302e30205361666172692f3533372e33360d0a4163636570743a20746578742f68746d6c0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36","ja3":"9404b4852d44353f69b8b33aaff15be4","session":"be974222-cac4-40ac-95fd-caf7f800996e","seq":152,"duration_ms":39726,"bytes_in":35174,"bytes_out":12160},{"timestamp":"2026-09-24T16:40:24","port":10001,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:10001\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/favicon.ico","summary":"","payload_hex":"474554202f66617669636f6e2e69636f20485454502f312e310d0a486f73743a20<HONEYPOT>3a31303030310d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132372e302e302e30205361666172692f3533372e33360d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36","ja3":"9404b4852d44353f69b8b33aaff15be4","session":"be974222-cac4-40ac-95fd-caf7f800996e","seq":153,"duration_ms":39973,"bytes_in":35391,"bytes_out":12240},{"timestamp":"2026-09-24T16:40:24","port":10001,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"application/json\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:10001\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/api/workgroup/env-info","summary":"","payload_hex":"474554202f6170692f776f726b67726f75702f656e762d696e666f20485454502f312e310d0a486f73743a20<HONEYPOT>3a31303030310d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132372e302e302e30205361666172692f3533372e33360d0a4163636570743a206170706c69636174696f6e2f6a736f6e0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36","ja3":"9404b4852d44353f69b8b33aaff15be4","session":"be974222-cac4-40ac-95fd-caf7f800996e","seq":154,"duration_ms":40229,"bytes_in":35632,"bytes_out":12320},{"timestamp":"2026-09-24T16:40:24","port":10001,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"application/json\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:10001\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/system","summary":"","payload_hex":"474554202f73797374656d20485454502f312e310d0a486f73743a20<HONEYPOT>3a31303030310d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132372e302e302e30205361666172692f3533372e33360d0a4163636570743a206170706c69636174696f6e2f6a736f6e0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36","ja3":"9404b4852d44353f69b8b33aaff15be4","session":"be974222-cac4-40ac-95fd-caf7f800996e","seq":155,"duration_ms":40479,"bytes_in":35857,"bytes_out":12400},{"timestamp":"2026-09-24T16:40:23","port":10001,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"application/json\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:10001\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/.backstage/health/v1/readiness","summary":"","payload_hex":"474554202f2e6261636b73746167652f6865616c74682f76312f72656164696e65737320485454502f312e310d0a486f73743a20<HONEYPOT>3a31303030310d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132372e302e302e30205361666172692f3533372e33360d0a4163636570743a206170706c69636174696f6e2f6a736f6e0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36","ja3":"9404b4852d44353f69b8b33aaff15be4","session":"be974222-cac4-40ac-95fd-caf7f800996e","seq":150,"duration_ms":39237,"bytes_in":34716,"bytes_out":12000},{"timestamp":"2026-09-24T16:40:23","port":10001,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"application/json\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:10001\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/debug/pprof/","summary":"","payload_hex":"474554202f64656275672f7070726f662f20485454502f312e310d0a486f73743a20<HONEYPOT>3a31303030310d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132372e302e302e30205361666172692f3533372e33360d0a4163636570743a206170706c69636174696f6e2f6a736f6e0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36","ja3":"9404b4852d44353f69b8b33aaff15be4","session":"be974222-cac4-40ac-95fd-caf7f800996e","seq":151,"duration_ms":39474,"bytes_in":34947,"bytes_out":12080},{"timestamp":"2026-09-24T16:40:23","port":10001,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"text/html\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:10001\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/hub/signup","summary":"","payload_hex":"474554202f6875622f7369676e757020485454502f312e310d0a486f73743a20<HONEYPOT>3a31303030310d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132372e302e302e30205361666172692f3533372e33360d0a4163636570743a20746578742f68746d6c0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36","ja3":"9404b4852d44353f69b8b33aaff15be4","session":"be974222-cac4-40ac-95fd-caf7f800996e","seq":148,"duration_ms":38730,"bytes_in":34233,"bytes_out":11840}],"http_methods":[{"method":"GET","count":238},{"method":"POST","count":1}],"distinct_ports_total":1,"top_paths":[{"path":"/","count":9,"ports":1},{"path":"/api/v1/version","count":4,"ports":1},{"path":"/api/version","count":4,"ports":1},{"path":"/version","count":4,"ports":1},{"path":"/login","count":3,"ports":1},{"path":"/api/","count":2,"ports":1},{"path":"/api/overview","count":2,"ports":1},{"path":"/+CSCOE+/logon.html","count":2,"ports":1},{"path":"/status","count":2,"ports":1},{"path":"/metrics","count":2,"ports":1},{"path":"/auth/login.html","count":1,"ports":1},{"path":"/v3/api-docs","count":1,"ports":1},{"path":"/GC3/glog.webserver.servlet.umt.Login","count":1,"ports":1},{"path":"/nerva-fp-nonexistent-path","count":1,"ports":1},{"path":"/ucs/micollab/version.json","count":1,"ports":1}],"distinct_paths_total":200,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","Accept-Encoding","Host","User-Agent"],"representative":[{"name":"Accept","value":"application/json","notable":false},{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Host","value":"<HONEYPOT>:10001","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36","notable":false}],"distinct_sets":1,"events_with_headers":10},"tags":[{"tag_id":"CVE-2020-2551","tag_type":"cve","title":"Oracle WebLogic Server - Remote Code Execution","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/console/login/LoginForm.jsp","reference_urls":["https://github.com/hktalent/CVE-2020-2551","https://nvd.nist.gov/vuln/detail/CVE-2020-2551","https://www.oracle.com/security-alerts/cpujan2020.html","https://github.com/neilzhang1/Chinese-Charts","https://github.com/pjgmonteiro/Pentest-tools"]},{"tag_id":"CVE-2021-35587","tag_type":"cve","title":"Oracle Access Manager - Remote Code Execution","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/oam/server/opensso/sessionservice","reference_urls":["https://testbnull.medium.com/oracle-access-manager-pre-auth-rce-cve-2021-35587-analysis-1302a4542316","https://nvd.nist.gov/vuln/detail/CVE-2021-35587","https://www.oracle.com/security-alerts/cpujan2022.html","https://github.com/ARPSyndicate/kenzer-templates","https://github.com/GrrrDog/Java-Deserialization-Cheat-Sheet"]},{"tag_id":"CVE-2022-26143","tag_type":"cve","title":"Mitel MiCollab - Information Disclosure & Denial of Service","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/ucs/micollab/version.json","reference_urls":["https://nvd.nist.gov/vuln/detail/CVE-2022-26143"]},{"tag_id":"CVE-2024-1709","tag_type":"cve","title":"ConnectWise ScreenConnect 23.9.7 - Authentication Bypass","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/SetupWizard.aspx","reference_urls":["https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass","https://github.com/watchtowrlabs/connectwise-screenconnect_auth-bypass-add-user-poc","https://www.connectwise.com/company/trust/security-bulletins/connectwise-screenconnect-23.9.8","https://nvd.nist.gov/vuln/detail/CVE-2024-1709","https://github.com/rapid7/metasploit-framework/pull/18870"]},{"tag_id":"CVE-2025-0282","tag_type":"cve","title":"Ivanti Connect Secure - Stack-based Buffer Overflow","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/dana-na/auth/url_default/welcome.cgi","reference_urls":["https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-Policy-Secure-ZTA-Gateways-CVE-2025-0282-CVE-2025-0283","https://labs.watchtowr.com/exploitation-walkthrough-and-techniques-ivanti-connect-secure-rce-cve-2025-0282/","https://cloud.google.com/blog/topics/threat-intelligence/ivanti-connect-secure-vpn-zero-day","https://nvd.nist.gov/vuln/detail/CVE-2025-0282"]},{"tag_id":"CVE-2020-14864","tag_type":"cve","title":"Oracle Fusion - Directory Traversal/Local File Inclusion","severity":"high","actively_exploited":true,"match_field":"url_path","matched_pattern":"/analytics/saw.dll","reference_urls":["http://packetstormsecurity.com/files/159748/Oracle-Business-Intelligence-Enterprise-Edition-5.5.0.0.0-12.2.1.3.0-12.2.1.4.0-LFI.html","https://www.oracle.com/security-alerts/cpuoct2020.html","https://nvd.nist.gov/vuln/detail/CVE-2020-14864","https://github.com/merlinepedra/nuclei-templates","https://github.com/sobinge/nuclei-templates"]},{"tag_id":"CVE-2023-38646","tag_type":"cve","title":"Metabase < 0.46.6.1 - Remote Code Execution","severity":"critical","actively_exploited":false,"match_field":"url_path","matched_pattern":"/api/session/properties","reference_urls":["https://www.metabase.com/blog/security-advisory","https://github.com/metabase/metabase/releases/tag/v0.46.6.1","https://mp.weixin.qq.com/s/ATFwFl-D8k9QfQfzKjZFDg","https://news.ycombinator.com/item?id=36812256","https://blog.assetnote.io/2023/07/22/pre-auth-rce-metabase/"]},{"tag_id":"CVE-2024-23917","tag_type":"cve","title":"JetBrains TeamCity > 2023.11.3 - Authentication Bypass","severity":"critical","actively_exploited":false,"match_field":"url_path","matched_pattern":"/app/rest/server","reference_urls":["https://github.com/fkie-cad/nvd-json-data-feeds","https://www.rapid7.com/db/vulnerabilities/jetbrains-teamcity-cve-2024-23917/"]},{"tag_id":"CVE-2024-25723","tag_type":"cve","title":"ZenML ZenML Server - Improper Authentication","severity":"critical","actively_exploited":false,"match_field":"url_path","matched_pattern":"/api/v1/info","reference_urls":["https://www.zenml.io/blog/critical-security-update-for-zenml-users","https://github.com/zenml-io/zenml","https://github.com/zenml-io/zenml/compare/0.42.1...0.42.2","https://github.com/zenml-io/zenml/compare/0.43.0...0.43.1","https://github.com/zenml-io/zenml/compare/0.44.3...0.44.4"]},{"tag_id":"CVE-2024-30569","tag_type":"cve","title":"Netgear R6850 - Information Disclosure","severity":"high","actively_exploited":false,"match_field":"url_path","matched_pattern":"/currentsetting.htm","reference_urls":["https://github.com/funny-mud-peee/IoT-vuls/blob/main/netgear%20R6850/Info%20Leak%20in%20Netgear-R6850%EF%BC%88currentsetting.htm%EF%BC%89.md","https://nvd.nist.gov/vuln/detail/CVE-2024-30569","https://www.netgear.com/about/security/"]},{"tag_id":"CVE-2026-25892","tag_type":"cve","title":"Adminer 4.6.2 - 5.4.1 Unauthenticated Persistent DoS","severity":"high","actively_exploited":false,"match_field":"url_path","matched_pattern":"/adminer.php","reference_urls":["https://github.com/vrana/adminer/security/advisories/GHSA-q4f2-39gr-45jh","https://github.com/vrana/adminer/commit/21d3a3150388677b18647d68aec93b7850e457d3"]},{"tag_id":"CVE-2026-35029","tag_type":"cve","title":"LiteLLM - Arbitrary File Read","severity":"high","actively_exploited":false,"match_field":"url_path","matched_pattern":"/health/liveliness","reference_urls":["https://github.com/BerriAI/litellm","https://sec-consult.com/vulnerability-lab/advisory/broken-access-control-in-config-endpoint-in-litellm/","https://nvd.nist.gov/vuln/detail/CVE-2026-35029"]},{"tag_id":"CVE-2007-4556","tag_type":"cve","title":"OpenSymphony XWork/Apache Struts2 - Remote Code Execution","severity":"medium","actively_exploited":false,"match_field":"url_path","matched_pattern":"/login.action","reference_urls":["https://www.guildhab.top/?p=2326","https://nvd.nist.gov/vuln/detail/CVE-2007-4556","https://cwiki.apache.org/confluence/display/WW/S2-001","http://forums.opensymphony.com/ann.jspa?annID=54","http://issues.apache.org/struts/browse/WW-2030"]},{"tag_id":"CVE-2025-2129","tag_type":"cve","title":"Mage AI - Insecure Default Authentication Setup","severity":"medium","actively_exploited":false,"match_field":"url_path","matched_pattern":"/api/kernels","reference_urls":["https://nvd.nist.gov/vuln/detail/CVE-2025-2129","https://github.com/zn9988/publications/blob/main/2.Mage-AI%20-%20Insecure%20Default%20Authentication%20Setup%20Leading%20to%20Zero-Click%20RCE/README.md","https://vuldb.com/?ctiid.299049","https://vuldb.com/?id.299049","https://vuldb.com/?submit.510690"]}],"data_as_of":"2026-09-28T20:50:50.199728+00:00"}