{"ip":"144.172.115.75","data_as_of":"2026-10-26T10:42:17+00:00","observed":true,"total_events":4,"verdict":{"verdict":"malicious","label":"Exploit attempts observed","detail":"12 interactive session(s) ran commands after logging in","confidence":"high","network_type":null,"why":["12 interactive session(s) logged in and ran commands.","The interactive sensors answer as a real service and record what the client did once inside, so this is activity after access.","The first-packet sensors recorded 4 event(s) from this address as well.","Not in any known-scanner range.","Sent 505,283 bytes, which is sustained payload delivery."],"engagement":{"level":"payload","label":"Sustained payload","detail":"505,283 bytes sent","bytes_sent":505283,"session_seconds":15,"persistent":false},"basis":"interactive"},"first_seen":"2026-10-14T00:21:13","last_seen":"2026-10-23T00:04:56","events_24h":0,"events_7d":0,"interactive_sessions":1708,"interactive_sessions_24h":0,"interactive_sessions_7d":1708,"interactive_protocols":[{"protocol":"http","sessions":1700},{"protocol":"http-proxy","sessions":3}],"geo":{"country_code":"US","country_name":"United States","region":"Utah","city":"Ogden","lat":41.2219,"lon":-111.9631,"asn":14956,"org":"RouterHosting LLC"},"source_domain":"75.115.172.144.static.cloudzy.com","known_scanners":[],"scanner_tag":null,"cve_matches":[{"cve_id":"CVE-2015-2051","title":"D-Link DIR-645 HNAP SOAPAction header command injection","severity":"high","actively_exploited":true,"match_field":"interactive_session","matched_pattern":"","confirmed_by":"interactive_session","sessions":12,"kev_date_added":"2022-02-10"},{"cve_id":"CVE-2024-57045","title":"","severity":"","actively_exploited":false,"match_field":"interactive_session","matched_pattern":"","confirmed_by":"interactive_session","sessions":2,"kev_date_added":null}],"malware":[],"udp":{"source_verified":false,"window_days":90,"events":14,"protocols":[{"protocol":"udp","events":14}],"ports":[{"port":69,"events":7},{"port":5060,"events":7}],"dns_questions":[],"quic_clients":[],"first_seen":"2026-10-08T11:56:43","last_seen":"2026-10-20T08:03:50","recent":[{"timestamp":"2026-10-20T08:03:50","port":5060,"src_port":57337,"proto":"udp","app_proto":"","app_protocol":"sip","summary":"REGISTER sip:<HONEYPOT> SIP/2.0\r\nVia: SIP/2.0/UDP 144.172.115.75:57337;branch=z9hG4bK86373811\r\nMax-Forwards: 70\r\nFrom: <sip:check_123@<HONEYPOT>>;tag=117566500\r\nTo: <sip:check_123@<HONEYPOT>>\r\nCall-ID: 1564826878-683369035-1735863037\r\nCSeq: 1 REGISTER\r\nContact: <sip:check_123@144.172.115.75:57337>\r\nContent-Length: 0\r\nUser-Agent: 3CXPhoneSystem\r\n\r\n","payload_hex":"5245474953544552207369703a<HONEYPOT>205349502f322e300d0a5669613a205349502f322e302f554450203134342e3137322e3131352e37353a35373333373b6272616e63683d7a39684734624b38363337333831310d0a4d61782d466f7277617264733a2037300d0a46726f6d3a203c7369703a636865636b5f31323340<HONEYPOT>3e3b7461673d3131373536363530300d0a546f3a203c7369703a636865636b5f31323340<HONEYPOT>3e0d0a43616c6c2d49443a20313536343832363837382d3638333336393033352d313733353836333033370d0a435365713a20312052454749535445520d0a436f6e746163743a203c7369703a636865636b5f313233403134342e3137322e3131352e37353a35373333373e0d0a436f6e74656e742d4c656e6774683a20300d0a557365722d4167656e743a2033435850686f6e6553797374656d0d0a0d0a","sni":"","session":"56021737-0cd0-4350-9fea-232a87c9c481","bytes_in":361,"source_verified":false,"enriched":{"digest":"a15d068c4e34c0be","label":"SIP","strings":["REGISTER sip:<HONEYPOT> SIP/2.0","Via: SIP/2.0/UDP 144.172.115.75:57337;branch=z9hG4bK86373811","Max-Forwards: 70","From: <sip:check_123@<HONEYPOT>>;tag=117566500","To: <sip:check_123@<HONEYPOT>>","Call-ID: 1564826878-683369035-1735863037","CSeq: 1 REGISTER","Contact: <sip:check_123@144.172.115.75:57337>","Content-Length: 0","User-Agent: 3CXPhoneSystem"],"iocs":{"ips":["144.172.115.75"],"paths":["/2.0/UDP"]}}},{"timestamp":"2026-10-19T21:51:31","port":5060,"src_port":61174,"proto":"udp","app_proto":"","app_protocol":"sip","summary":"REGISTER sip:<HONEYPOT> SIP/2.0\r\nVia: SIP/2.0/UDP 144.172.115.75:61174;branch=z9hG4bK662199312\r\nMax-Forwards: 70\r\nFrom: <sip:check_123@<HONEYPOT>>;tag=1966420369\r\nTo: <sip:check_123@<HONEYPOT>>\r\nCall-ID: 1529559016-484812844-331902340\r\nCSeq: 1 REGISTER\r\nContact: <sip:check_123@144.172.115.75:61174>\r\nContent-Length: 0\r\nUser-Agent: 3CXPhoneSystem\r\n\r\n","payload_hex":"5245474953544552207369703a<HONEYPOT>205349502f322e300d0a5669613a205349502f322e302f554450203134342e3137322e3131352e37353a36313137343b6272616e63683d7a39684734624b3636323139393331320d0a4d61782d466f7277617264733a2037300d0a46726f6d3a203c7369703a636865636b5f31323340<HONEYPOT>3e3b7461673d313936363432303336390d0a546f3a203c7369703a636865636b5f31323340<HONEYPOT>3e0d0a43616c6c2d49443a20313532393535393031362d3438343831323834342d3333313930323334300d0a435365713a20312052454749535445520d0a436f6e746163743a203c7369703a636865636b5f313233403134342e3137322e3131352e37353a36313137343e0d0a436f6e74656e742d4c656e6774683a20300d0a557365722d4167656e743a2033435850686f6e6553797374656d0d0a0d0a","sni":"","session":"e05f664a-f1d1-4d03-aa7f-37030a327af8","bytes_in":359,"source_verified":false,"enriched":{"digest":"f0fb569e75c2ac84","label":"SIP","strings":["REGISTER sip:<HONEYPOT> SIP/2.0","Via: SIP/2.0/UDP 144.172.115.75:61174;branch=z9hG4bK662199312","Max-Forwards: 70","From: <sip:check_123@<HONEYPOT>>;tag=1966420369","To: <sip:check_123@<HONEYPOT>>","Call-ID: 1529559016-484812844-331902340","CSeq: 1 REGISTER","Contact: <sip:check_123@144.172.115.75:61174>","Content-Length: 0","User-Agent: 3CXPhoneSystem"],"iocs":{"ips":["144.172.115.75"],"paths":["/2.0/UDP"]}}},{"timestamp":"2026-10-19T13:16:00","port":5060,"src_port":58832,"proto":"udp","app_proto":"","app_protocol":"sip","summary":"REGISTER sip:<HONEYPOT> SIP/2.0\r\nVia: SIP/2.0/UDP 144.172.115.75:58832;branch=z9hG4bK503072482\r\nMax-Forwards: 70\r\nFrom: <sip:check_123@<HONEYPOT>>;tag=1013191745\r\nTo: <sip:check_123@<HONEYPOT>>\r\nCall-ID: 358252815-287438245-730349837\r\nCSeq: 1 REGISTER\r\nContact: <sip:check_123@144.172.115.75:58832>\r\nContent-Length: 0\r\nUser-Agent: 3CXPhoneSystem\r\n\r\n","payload_hex":"5245474953544552207369703a<HONEYPOT>205349502f322e300d0a5669613a205349502f322e302f554450203134342e3137322e3131352e37353a35383833323b6272616e63683d7a39684734624b3530333037323438320d0a4d61782d466f7277617264733a2037300d0a46726f6d3a203c7369703a636865636b5f31323340<HONEYPOT>3e3b7461673d313031333139313734350d0a546f3a203c7369703a636865636b5f31323340<HONEYPOT>3e0d0a43616c6c2d49443a203335383235323831352d3238373433383234352d3733303334393833370d0a435365713a20312052454749535445520d0a436f6e746163743a203c7369703a636865636b5f313233403134342e3137322e3131352e37353a35383833323e0d0a436f6e74656e742d4c656e6774683a20300d0a557365722d4167656e743a2033435850686f6e6553797374656d0d0a0d0a","sni":"","session":"902f7452-31a6-46cf-9e92-1ad0bbf22408","bytes_in":358,"source_verified":false,"enriched":{"digest":"6c47676004fe5bf9","label":"SIP","strings":["REGISTER sip:<HONEYPOT> SIP/2.0","Via: SIP/2.0/UDP 144.172.115.75:58832;branch=z9hG4bK503072482","Max-Forwards: 70","From: <sip:check_123@<HONEYPOT>>;tag=1013191745","To: <sip:check_123@<HONEYPOT>>","Call-ID: 358252815-287438245-730349837","CSeq: 1 REGISTER","Contact: <sip:check_123@144.172.115.75:58832>","Content-Length: 0","User-Agent: 3CXPhoneSystem"],"iocs":{"ips":["144.172.115.75"],"paths":["/2.0/UDP"]}}},{"timestamp":"2026-10-15T18:08:18","port":69,"src_port":55684,"proto":"udp","app_proto":"","app_protocol":"tftp","summary":"\u0000\u0001r000000000050.conf\u0000octet\u0000","payload_hex":"0001723030303030303030303035302e636f6e66006f6374657400","sni":"","session":"c8fcd2b6-d45d-4173-ae4e-d162e54de106","bytes_in":27,"source_verified":false,"enriched":{"digest":"ef81cd2c0ff725e9","strings":["r000000000050.conf","octet","r000000000050.confoctet"],"iocs":{"domains":["r000000000050.conf","r000000000050.confoctet"]}}},{"timestamp":"2026-10-15T16:44:37","port":69,"src_port":58923,"proto":"udp","app_proto":"","app_protocol":"tftp","summary":"\u0000\u0001dev00156500006a\u0000octet\u0000","payload_hex":"0001646576303031353635303030303661006f6374657400","sni":"","session":"c9177ddc-ad91-4561-8780-31f80808c1de","bytes_in":24,"source_verified":false,"enriched":{"digest":"c090674b0ea72082","strings":["dev00156500006a","octet","dev00156500006aoctet"]}},{"timestamp":"2026-10-14T17:16:21","port":5060,"src_port":61248,"proto":"udp","app_proto":"","app_protocol":"sip","summary":"REGISTER sip:<HONEYPOT> SIP/2.0\r\nVia: SIP/2.0/UDP 144.172.115.75:61248;branch=z9hG4bK196242233\r\nMax-Forwards: 70\r\nFrom: <sip:check_123@<HONEYPOT>>;tag=1449584825\r\nTo: <sip:check_123@<HONEYPOT>>\r\nCall-ID: 1382444258-499777918-20657376\r\nCSeq: 1 REGISTER\r\nContact: <sip:check_123@144.172.115.75:61248>\r\nContent-Length: 0\r\nUser-Agent: 3CXPhoneSystem\r\n\r\n","payload_hex":"5245474953544552207369703a<HONEYPOT>205349502f322e300d0a5669613a205349502f322e302f554450203134342e3137322e3131352e37353a36313234383b6272616e63683d7a39684734624b3139363234323233330d0a4d61782d466f7277617264733a2037300d0a46726f6d3a203c7369703a636865636b5f31323340<HONEYPOT>3e3b7461673d313434393538343832350d0a546f3a203c7369703a636865636b5f31323340<HONEYPOT>3e0d0a43616c6c2d49443a20313338323434343235382d3439393737373931382d32303635373337360d0a435365713a20312052454749535445520d0a436f6e746163743a203c7369703a636865636b5f313233403134342e3137322e3131352e37353a36313234383e0d0a436f6e74656e742d4c656e6774683a20300d0a557365722d4167656e743a2033435850686f6e6553797374656d0d0a0d0a","sni":"","session":"b7ed3235-2ca4-4f17-b2cf-3f92c4b13fec","bytes_in":355,"source_verified":false,"enriched":{"digest":"03579b8a4af7d668","label":"SIP","strings":["REGISTER sip:<HONEYPOT> SIP/2.0","Via: SIP/2.0/UDP 144.172.115.75:61248;branch=z9hG4bK196242233","Max-Forwards: 70","From: <sip:check_123@<HONEYPOT>>;tag=1449584825","To: <sip:check_123@<HONEYPOT>>","Call-ID: 1382444258-499777918-20657376","CSeq: 1 REGISTER","Contact: <sip:check_123@144.172.115.75:61248>","Content-Length: 0","User-Agent: 3CXPhoneSystem"],"iocs":{"ips":["144.172.115.75"],"paths":["/2.0/UDP"]}}},{"timestamp":"2026-10-14T13:08:30","port":5060,"src_port":62409,"proto":"udp","app_proto":"","app_protocol":"sip","summary":"REGISTER sip:<HONEYPOT> SIP/2.0\r\nVia: SIP/2.0/UDP 144.172.115.75:62409;branch=z9hG4bK941146684\r\nMax-Forwards: 70\r\nFrom: <sip:check_123@<HONEYPOT>>;tag=912612928\r\nTo: <sip:check_123@<HONEYPOT>>\r\nCall-ID: 470312036-2030680319-228210813\r\nCSeq: 1 REGISTER\r\nContact: <sip:check_123@144.172.115.75:62409>\r\nContent-Length: 0\r\nUser-Agent: 3CXPhoneSystem\r\n\r\n","payload_hex":"5245474953544552207369703a<HONEYPOT>205349502f322e300d0a5669613a205349502f322e302f554450203134342e3137322e3131352e37353a36323430393b6272616e63683d7a39684734624b3934313134363638340d0a4d61782d466f7277617264733a2037300d0a46726f6d3a203c7369703a636865636b5f31323340<HONEYPOT>3e3b7461673d3931323631323932380d0a546f3a203c7369703a636865636b5f31323340<HONEYPOT>3e0d0a43616c6c2d49443a203437303331323033362d323033303638303331392d3232383231303831330d0a435365713a20312052454749535445520d0a436f6e746163743a203c7369703a636865636b5f313233403134342e3137322e3131352e37353a36323430393e0d0a436f6e74656e742d4c656e6774683a20300d0a557365722d4167656e743a2033435850686f6e6553797374656d0d0a0d0a","sni":"","session":"4deb0565-69a5-497e-ba0f-b0c568b1b5d8","bytes_in":355,"source_verified":false,"enriched":{"digest":"4811b71b0ecae108","label":"SIP","strings":["REGISTER sip:<HONEYPOT> SIP/2.0","Via: SIP/2.0/UDP 144.172.115.75:62409;branch=z9hG4bK941146684","Max-Forwards: 70","From: <sip:check_123@<HONEYPOT>>;tag=912612928","To: <sip:check_123@<HONEYPOT>>","Call-ID: 470312036-2030680319-228210813","CSeq: 1 REGISTER","Contact: <sip:check_123@144.172.115.75:62409>","Content-Length: 0","User-Agent: 3CXPhoneSystem"],"iocs":{"ips":["144.172.115.75"],"paths":["/2.0/UDP"]}}},{"timestamp":"2026-10-14T07:58:01","port":5060,"src_port":53451,"proto":"udp","app_proto":"","app_protocol":"sip","summary":"REGISTER sip:<HONEYPOT> SIP/2.0\r\nVia: SIP/2.0/UDP 144.172.115.75:53451;branch=z9hG4bK267961848\r\nMax-Forwards: 70\r\nFrom: <sip:check_123@<HONEYPOT>>;tag=530455755\r\nTo: <sip:check_123@<HONEYPOT>>\r\nCall-ID: 1595717053-819858493-93870110\r\nCSeq: 1 REGISTER\r\nContact: <sip:check_123@144.172.115.75:53451>\r\nContent-Length: 0\r\nUser-Agent: 3CXPhoneSystem\r\n\r\n","payload_hex":"5245474953544552207369703a<HONEYPOT>205349502f322e300d0a5669613a205349502f322e302f554450203134342e3137322e3131352e37353a35333435313b6272616e63683d7a39684734624b3236373936313834380d0a4d61782d466f7277617264733a2037300d0a46726f6d3a203c7369703a636865636b5f31323340<HONEYPOT>3e3b7461673d3533303435353735350d0a546f3a203c7369703a636865636b5f31323340<HONEYPOT>3e0d0a43616c6c2d49443a20313539353731373035332d3831393835383439332d39333837303131300d0a435365713a20312052454749535445520d0a436f6e746163743a203c7369703a636865636b5f313233403134342e3137322e3131352e37353a35333435313e0d0a436f6e74656e742d4c656e6774683a20300d0a557365722d4167656e743a2033435850686f6e6553797374656d0d0a0d0a","sni":"","session":"74a93844-8a40-4124-8d03-14cdb787f580","bytes_in":357,"source_verified":false,"enriched":{"digest":"a96ffa6f8cfd7b4b","label":"SIP","strings":["REGISTER sip:<HONEYPOT> SIP/2.0","Via: SIP/2.0/UDP 144.172.115.75:53451;branch=z9hG4bK267961848","Max-Forwards: 70","From: <sip:check_123@<HONEYPOT>>;tag=530455755","To: <sip:check_123@<HONEYPOT>>","Call-ID: 1595717053-819858493-93870110","CSeq: 1 REGISTER","Contact: <sip:check_123@144.172.115.75:53451>","Content-Length: 0","User-Agent: 3CXPhoneSystem"],"iocs":{"ips":["144.172.115.75"],"paths":["/2.0/UDP"]}}},{"timestamp":"2026-10-13T16:26:10","port":5060,"src_port":61334,"proto":"udp","app_proto":"","app_protocol":"sip","summary":"REGISTER sip:<HONEYPOT> SIP/2.0\r\nVia: SIP/2.0/UDP 144.172.115.75:61334;branch=z9hG4bK761188675\r\nMax-Forwards: 70\r\nFrom: <sip:check_123@<HONEYPOT>>;tag=601514542\r\nTo: <sip:check_123@<HONEYPOT>>\r\nCall-ID: 1291613803-200239433-368460202\r\nCSeq: 1 REGISTER\r\nContact: <sip:check_123@144.172.115.75:61334>\r\nContent-Length: 0\r\nUser-Agent: 3CXPhoneSystem\r\n\r\n","payload_hex":"5245474953544552207369703a<HONEYPOT>205349502f322e300d0a5669613a205349502f322e302f554450203134342e3137322e3131352e37353a36313333343b6272616e63683d7a39684734624b3736313138383637350d0a4d61782d466f7277617264733a2037300d0a46726f6d3a203c7369703a636865636b5f31323340<HONEYPOT>3e3b7461673d3630313531343534320d0a546f3a203c7369703a636865636b5f31323340<HONEYPOT>3e0d0a43616c6c2d49443a20313239313631333830332d3230303233393433332d3336383436303230320d0a435365713a20312052454749535445520d0a436f6e746163743a203c7369703a636865636b5f313233403134342e3137322e3131352e37353a36313333343e0d0a436f6e74656e742d4c656e6774683a20300d0a557365722d4167656e743a2033435850686f6e6553797374656d0d0a0d0a","sni":"","session":"83f7996a-54ed-43ff-b5a6-6460dbcc35b7","bytes_in":358,"source_verified":false,"enriched":{"digest":"4a9251b60b90dd99","label":"SIP","strings":["REGISTER sip:<HONEYPOT> SIP/2.0","Via: SIP/2.0/UDP 144.172.115.75:61334;branch=z9hG4bK761188675","Max-Forwards: 70","From: <sip:check_123@<HONEYPOT>>;tag=601514542","To: <sip:check_123@<HONEYPOT>>","Call-ID: 1291613803-200239433-368460202","CSeq: 1 REGISTER","Contact: <sip:check_123@144.172.115.75:61334>","Content-Length: 0","User-Agent: 3CXPhoneSystem"],"iocs":{"ips":["144.172.115.75"],"paths":["/2.0/UDP"]}}},{"timestamp":"2026-10-13T11:42:17","port":69,"src_port":60210,"proto":"udp","app_proto":"","app_protocol":"tftp","summary":"\u0000\u0001dev00156500006a\u0000octet\u0000","payload_hex":"0001646576303031353635303030303661006f6374657400","sni":"","session":"5b9f40d2-0dc9-43b4-b751-855c2642512c","bytes_in":24,"source_verified":false,"enriched":{"digest":"c090674b0ea72082","strings":["dev00156500006a","octet","dev00156500006aoctet"]}},{"timestamp":"2026-10-08T19:36:40","port":69,"src_port":51568,"proto":"udp","app_proto":"","app_protocol":"tftp","summary":"\u0000\u0001r000000000050.conf\u0000octet\u0000","payload_hex":"0001723030303030303030303035302e636f6e66006f6374657400","sni":"","session":"65f44b25-1edd-451c-a5ba-32741ccb6381","bytes_in":27,"source_verified":false,"enriched":{"digest":"ef81cd2c0ff725e9","strings":["r000000000050.conf","octet","r000000000050.confoctet"],"iocs":{"domains":["r000000000050.conf","r000000000050.confoctet"]}}},{"timestamp":"2026-10-08T16:26:34","port":69,"src_port":51562,"proto":"udp","app_proto":"","app_protocol":"tftp","summary":"\u0000\u0001r000000000050.conf\u0000octet\u0000","payload_hex":"0001723030303030303030303035302e636f6e66006f6374657400","sni":"","session":"f003af87-6dc4-4f32-87b4-856d142827be","bytes_in":27,"source_verified":false,"enriched":{"digest":"ef81cd2c0ff725e9","strings":["r000000000050.conf","octet","r000000000050.confoctet"],"iocs":{"domains":["r000000000050.conf","r000000000050.confoctet"]}}},{"timestamp":"2026-10-08T12:39:36","port":69,"src_port":57949,"proto":"udp","app_proto":"","app_protocol":"tftp","summary":"\u0000\u0001dev00156500006a\u0000octet\u0000","payload_hex":"0001646576303031353635303030303661006f6374657400","sni":"","session":"456d9e38-a969-445f-9d72-6e006821f747","bytes_in":24,"source_verified":false,"enriched":{"digest":"c090674b0ea72082","strings":["dev00156500006a","octet","dev00156500006aoctet"]}},{"timestamp":"2026-10-08T11:56:43","port":69,"src_port":59405,"proto":"udp","app_proto":"","app_protocol":"tftp","summary":"\u0000\u0001dev00156500006a\u0000octet\u0000","payload_hex":"0001646576303031353635303030303661006f6374657400","sni":"","session":"4344e19d-5f1a-4b16-9ee7-80dfa1b7410b","bytes_in":24,"source_verified":false,"enriched":{"digest":"c090674b0ea72082","strings":["dev00156500006a","octet","dev00156500006aoctet"]}}]},"interaction":{"window_days":90,"sessions":1718,"first_seen":"2026-10-19T15:24:48","last_seen":"2026-10-23T11:44:14","verdicts":[{"verdict":"scan","sessions":1653},{"verdict":"unknown","sessions":44},{"verdict":"post-exploitation","sessions":12},{"verdict":"credential","sessions":5},{"verdict":"exploit-attempt","sessions":4}],"personas":[{"persona":"nginx@1.24.0, wordpress@6.5.2, leaks@2, miner@bfgminer 5.5.0, elasticsearch@6.8.23, winrm@Windows Server 2016, fortigate@7.0.5, gitlab@19.4.2","sessions":1410},{"persona":"nginx@1.24.0, wordpress@6.5.2, leaks@2, miner@bfgminer 5.5.0, elasticsearch@6.8.23, winrm@Windows Server 2016, dlink-dir645@1.01, fortigate@7.0.5, gitlab@19.4.2","sessions":252},{"persona":"nginx@1.18.0, wordpress@6.5.2, leaks@1, miner@cgminer 4.11.1, elasticsearch@8.11.1, winrm@Windows Server 2019, dlink-dir645@1.03, fortigate@7.2.1","sessions":35},{"persona":"sip@Asterisk PBX 18.10.0","sessions":6},{"persona":"sip@FPBX-16.0.40(18.20.0)","sessions":4},{"persona":"nginx@1.18.0, wordpress@6.5.2, leaks@1, miner@cgminer 4.11.1, elasticsearch@8.11.1, winrm@Windows Server 2019, fortigate@7.2.1","sessions":3},{"persona":"proxy@squid/4.13","sessions":3}],"services":[{"protocol":"http","port":443,"sessions":1007},{"protocol":"http","port":80,"sessions":161},{"protocol":"http","port":8080,"sessions":126},{"protocol":"http","port":8081,"sessions":103},{"protocol":"http","port":9000,"sessions":101},{"protocol":"http","port":8443,"sessions":101},{"protocol":"http","port":8088,"sessions":101},{"protocol":"sip","port":5060,"sessions":10},{"protocol":"tcp","port":8888,"sessions":2},{"protocol":"tcp","port":8088,"sessions":1},{"protocol":"http-proxy","port":8088,"sessions":1},{"protocol":"tcp","port":8443,"sessions":1}],"logins":[{"username":"7008","password":null,"password_sent":false,"service":"sip-digest","outcome":"success","tries":2,"last_seen":"2026-10-23T11:44:13"},{"username":"Admin","password":"casa1969","password_sent":true,"service":"dir645-web","outcome":"success","tries":2,"last_seen":"2026-10-23T00:03:01"},{"username":"check_123","password":null,"password_sent":false,"service":"sip-digest","outcome":"success","tries":1,"last_seen":"2026-10-19T15:24:49"}],"commands":[],"downloads":[],"files":[{"sha256":"88a6bed04764e1f54f61405bd19c942ee7c388886a90c045e49a29f03b273cc8","name":"temp.sh","size":48,"mime_type":"text/plain","kind":"executed","times":3,"first_seen":"2026-10-23T00:02:59","last_seen":"2026-10-23T00:02:59","virustotal":null},{"sha256":"eca7fee1c069b3ca27961d57094133a3cc4a1d4d095b2c115c6ad6a43105838c","name":"temp.js","size":46,"mime_type":"text/plain","kind":"shell-write","times":2,"first_seen":"2026-10-23T00:02:59","last_seen":"2026-10-23T00:02:59","virustotal":null},{"sha256":"7c00b280644c94026e95ed0554447b6a6d4c605add7192dfadc34af3b9475814","name":"temp.sh","size":6,"mime_type":"text/plain","kind":"shell-write","times":2,"first_seen":"2026-10-23T00:02:59","last_seen":"2026-10-23T00:02:59","virustotal":null},{"sha256":"0d83ed3813167e2d81195f440ca64df34d9aa4d5053f73be033c610085ec0c2c","name":"temp.sh","size":12,"mime_type":"text/plain","kind":"shell-write","times":2,"first_seen":"2026-10-23T00:02:59","last_seen":"2026-10-23T00:02:59","virustotal":null},{"sha256":"fb0cb754d2657a483fe83d7cfde86c4cb51c1411742970a2bd51aa98cd9c26a5","name":"e5f4a9884569879514571e4f7a","size":347,"mime_type":"text/plain","kind":"sip-sdp","times":1,"first_seen":"2026-10-23T11:44:14","last_seen":"2026-10-23T11:44:14","virustotal":null},{"sha256":"d2c47501cf3a1a5f1cca09de5260653528549872f269268a268e866acc5193c3","name":"e5f4a9122608162031692e4f7a","size":347,"mime_type":"text/plain","kind":"sip-sdp","times":1,"first_seen":"2026-10-23T01:38:23","last_seen":"2026-10-23T01:38:23","virustotal":null},{"sha256":"6f788c1a124e3223f15b660f7783367503373859530432d070f68bb9b3209187","name":"temp.sh","size":37,"mime_type":"text/plain","kind":"shell-write","times":1,"first_seen":"2026-10-23T00:02:59","last_seen":"2026-10-23T00:02:59","virustotal":null},{"sha256":"603301c62f564816981194cc62c1250e9588fd01c2f483e1e141dcf41f0a1cc6","name":"temp.sh","size":19,"mime_type":"text/plain","kind":"shell-write","times":1,"first_seen":"2026-10-23T00:02:59","last_seen":"2026-10-23T00:02:59","virustotal":null},{"sha256":"f67b8aee4c87125ab058c8b34019504ffb26bc4e0b663c7cebc05fa52aa04cd2","name":"temp.sh","size":30,"mime_type":"text/plain","kind":"shell-write","times":1,"first_seen":"2026-10-23T00:02:59","last_seen":"2026-10-23T00:02:59","virustotal":null}],"attack":[{"technique_id":"T1595","technique_name":"Active Scanning","tactic_id":"TA0043","tactic_name":"Reconnaissance","sessions":1653},{"technique_id":"T1190","technique_name":"Exploit Public-Facing Application","tactic_id":"TA0001","tactic_name":"Initial Access","sessions":16},{"technique_id":"T1078","technique_name":"Valid Accounts","tactic_id":"TA0001","tactic_name":"Initial Access","sessions":5},{"technique_id":"T1059.004","technique_name":"Command and Scripting Interpreter: Unix Shell","tactic_id":"TA0002","tactic_name":"Execution","sessions":12},{"technique_id":"T1110","technique_name":"Brute Force","tactic_id":"TA0006","tactic_name":"Credential Access","sessions":5}]},"top_ports":[{"port":443,"proto":"tcp","label":"HTTPS","count":0,"sessions":1007},{"port":80,"proto":"tcp","label":"HTTP","count":4,"sessions":161},{"port":8080,"proto":"tcp","label":"HTTP-alt","count":0,"sessions":126},{"port":8081,"proto":"tcp","label":"HTTP","count":0,"sessions":103},{"port":8088,"proto":"tcp","label":"Hadoop","count":0,"sessions":103},{"port":8443,"proto":"tcp","label":"HTTPS-alt","count":0,"sessions":103},{"port":9000,"proto":"tcp","label":"Web-alt","count":0,"sessions":103},{"port":8888,"proto":"tcp","label":"HTTP-alt","count":0,"sessions":2}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t12d860600_e18388e7f3a3_a1e935682795"],"tls_client_hello":"","tls_ja3":["b22b3950835f7eba2f3be0917e4f949e"],"http_akin":["b11cun030_00040012_13ee3d34","b11cun060_0004041e_3d0e68c3","b11cun050_0004001e_0c87f8d1"],"interactive":{"ssh_hassh":[],"tls_ja4":["t12d860600_e18388e7f3a3_a1e935682795"],"tls_ja3":["b22b3950835f7eba2f3be0917e4f949e"]}},"fingerprint_peers":{"b11cun030_00040012_13ee3d34":5486,"t12d860600_e18388e7f3a3_a1e935682795":1,"b11cun060_0004041e_3d0e68c3":2,"b11cun050_0004001e_0c87f8d1":6},"akin_families":{"b11cun060_0004041e_3d0e68c3":{"head":"b11cun050_0004001e_0c87f8d1","shapes":2,"ips":6},"b11cun050_0004001e_0c87f8d1":{"head":"b11cun050_0004001e_0c87f8d1","shapes":2,"ips":6}},"user_agents":["Mozilla/5.0 (Windows NT 5.1; rv:9.0.1) Gecko/20100101 Firefox/9.0.1","Mozilla/5.0 (Windows; U; Windows NT 5.1; rv:1.7.3) Gecko/20041001 Firefox/0.10.1"],"timeline":[{"date":"2026-10-14","count":4,"sessions":0},{"date":"2026-10-20","count":0,"sessions":38},{"date":"2026-10-21","count":0,"sessions":1},{"date":"2026-10-22","count":0,"sessions":1},{"date":"2026-10-23","count":0,"sessions":1668}],"recent_events":[{"timestamp":"2026-10-23T00:04:56","port":443,"proto":"tcp","app_proto":"http","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\",\"accept-encoding\":\"deflate, gzip, identity\",\"accept-language\":\"en-US;q=0.6,en;q=0.4\",\"host\":\"<HONEYPOT>\",\"referer\":\"https://<HONEYPOT>/\",\"user-agent\":\"Mozilla/5.0 (Windows NT 5.1; rv:9.0.1) Gecko/20100101 Firefox/9.0.1\"}","body":"","sni":"<HONEYPOT>","tls_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","tls_version":"1.2","alpn":[],"url_path":"/mysql-admin/","summary":"","payload_hex":"474554202f6d7973716c2d61646d696e2f20485454502f312e310d0a486f73743a203c484f4e4559504f543e0d0a4163636570743a20746578742f68746d6c2c6170706c69636174696f6e2f7868746d6c2b786d6c2c6170706c69636174696f6e2f786d6c3b713d302e392c2a2f2a3b713d302e380d0a4163636570742d456e636f64696e673a206465666c6174652c20677a69702c206964656e746974790d0a4163636570742d4c616e67756167653a20656e2d55533b713d302e362c656e3b713d302e340d0a526566657265723a2068747470733a2f2f3c484f4e4559504f543e2f0d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e5420352e313b2072763a392e302e3129204765636b6f2f32303130303130312046697265666f782f392e302e310d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 5.1; rv:9.0.1) Gecko/20100101 Firefox/9.0.1","ja3":"b22b3950835f7eba2f3be0917e4f949e","session":"601f169b-6123-4de2-9ede-0829bbd8d3e3-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-23T00:04:55","port":443,"proto":"tcp","app_proto":"http","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\",\"accept-encoding\":\"deflate, gzip, identity\",\"accept-language\":\"en-US;q=0.6,en;q=0.4\",\"host\":\"<HONEYPOT>\",\"referer\":\"https://<HONEYPOT>/\",\"user-agent\":\"Mozilla/5.0 (Windows NT 5.1; rv:9.0.1) Gecko/20100101 Firefox/9.0.1\"}","body":"","sni":"<HONEYPOT>","tls_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","tls_version":"1.2","alpn":[],"url_path":"/mysqladmin/","summary":"","payload_hex":"474554202f6d7973716c61646d696e2f20485454502f312e310d0a486f73743a203c484f4e4559504f543e0d0a4163636570743a20746578742f68746d6c2c6170706c69636174696f6e2f7868746d6c2b786d6c2c6170706c69636174696f6e2f786d6c3b713d302e392c2a2f2a3b713d302e380d0a4163636570742d456e636f64696e673a206465666c6174652c20677a69702c206964656e746974790d0a4163636570742d4c616e67756167653a20656e2d55533b713d302e362c656e3b713d302e340d0a526566657265723a2068747470733a2f2f3c484f4e4559504f543e2f0d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e5420352e313b2072763a392e302e3129204765636b6f2f32303130303130312046697265666f782f392e302e310d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 5.1; rv:9.0.1) Gecko/20100101 Firefox/9.0.1","ja3":"b22b3950835f7eba2f3be0917e4f949e","session":"47818771-80d0-4d1b-a4f5-7a0792bba92a-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-23T00:04:55","port":443,"proto":"tcp","app_proto":"http","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\",\"accept-encoding\":\"deflate, gzip, identity\",\"accept-language\":\"en-US;q=0.6,en;q=0.4\",\"host\":\"<HONEYPOT>\",\"referer\":\"https://<HONEYPOT>/\",\"user-agent\":\"Mozilla/5.0 (Windows NT 5.1; rv:9.0.1) Gecko/20100101 Firefox/9.0.1\"}","body":"","sni":"<HONEYPOT>","tls_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","tls_version":"1.2","alpn":[],"url_path":"/webdb/","summary":"","payload_hex":"474554202f77656264622f20485454502f312e310d0a486f73743a203c484f4e4559504f543e0d0a4163636570743a20746578742f68746d6c2c6170706c69636174696f6e2f7868746d6c2b786d6c2c6170706c69636174696f6e2f786d6c3b713d302e392c2a2f2a3b713d302e380d0a4163636570742d456e636f64696e673a206465666c6174652c20677a69702c206964656e746974790d0a4163636570742d4c616e67756167653a20656e2d55533b713d302e362c656e3b713d302e340d0a526566657265723a2068747470733a2f2f3c484f4e4559504f543e2f0d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e5420352e313b2072763a392e302e3129204765636b6f2f32303130303130312046697265666f782f392e302e310d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 5.1; rv:9.0.1) Gecko/20100101 Firefox/9.0.1","ja3":"b22b3950835f7eba2f3be0917e4f949e","session":"4f5509ec-6afe-4105-a58f-407c8db4ed1c-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-23T00:04:55","port":443,"proto":"tcp","app_proto":"http","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\",\"accept-encoding\":\"deflate, gzip, identity\",\"accept-language\":\"en-US;q=0.6,en;q=0.4\",\"host\":\"<HONEYPOT>\",\"referer\":\"https://<HONEYPOT>/\",\"user-agent\":\"Mozilla/5.0 (Windows NT 5.1; rv:9.0.1) Gecko/20100101 Firefox/9.0.1\"}","body":"","sni":"<HONEYPOT>","tls_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","tls_version":"1.2","alpn":[],"url_path":"/websql/","summary":"","payload_hex":"474554202f77656273716c2f20485454502f312e310d0a486f73743a203c484f4e4559504f543e0d0a4163636570743a20746578742f68746d6c2c6170706c69636174696f6e2f7868746d6c2b786d6c2c6170706c69636174696f6e2f786d6c3b713d302e392c2a2f2a3b713d302e380d0a4163636570742d456e636f64696e673a206465666c6174652c20677a69702c206964656e746974790d0a4163636570742d4c616e67756167653a20656e2d55533b713d302e362c656e3b713d302e340d0a526566657265723a2068747470733a2f2f3c484f4e4559504f543e2f0d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e5420352e313b2072763a392e302e3129204765636b6f2f32303130303130312046697265666f782f392e302e310d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 5.1; rv:9.0.1) Gecko/20100101 Firefox/9.0.1","ja3":"b22b3950835f7eba2f3be0917e4f949e","session":"3ea53271-42b5-48c2-9645-15c726d5bcf9-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-23T00:04:55","port":443,"proto":"tcp","app_proto":"http","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\",\"accept-encoding\":\"deflate, gzip, identity\",\"accept-language\":\"en-US;q=0.6,en;q=0.4\",\"host\":\"<HONEYPOT>\",\"referer\":\"https://<HONEYPOT>/\",\"user-agent\":\"Mozilla/5.0 (Windows NT 5.1; rv:9.0.1) Gecko/20100101 Firefox/9.0.1\"}","body":"","sni":"<HONEYPOT>","tls_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","tls_version":"1.2","alpn":[],"url_path":"/sqlweb/","summary":"","payload_hex":"474554202f73716c7765622f20485454502f312e310d0a486f73743a203c484f4e4559504f543e0d0a4163636570743a20746578742f68746d6c2c6170706c69636174696f6e2f7868746d6c2b786d6c2c6170706c69636174696f6e2f786d6c3b713d302e392c2a2f2a3b713d302e380d0a4163636570742d456e636f64696e673a206465666c6174652c20677a69702c206964656e746974790d0a4163636570742d4c616e67756167653a20656e2d55533b713d302e362c656e3b713d302e340d0a526566657265723a2068747470733a2f2f3c484f4e4559504f543e2f0d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e5420352e313b2072763a392e302e3129204765636b6f2f32303130303130312046697265666f782f392e302e310d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 5.1; rv:9.0.1) Gecko/20100101 Firefox/9.0.1","ja3":"b22b3950835f7eba2f3be0917e4f949e","session":"fb1cc235-e46b-4771-85bf-5a1f1a2eb306-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-23T00:04:55","port":443,"proto":"tcp","app_proto":"http","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\",\"accept-encoding\":\"deflate, gzip, identity\",\"accept-language\":\"en-US;q=0.6,en;q=0.4\",\"host\":\"<HONEYPOT>\",\"referer\":\"https://<HONEYPOT>/\",\"user-agent\":\"Mozilla/5.0 (Windows NT 5.1; rv:9.0.1) Gecko/20100101 Firefox/9.0.1\"}","body":"","sni":"<HONEYPOT>","tls_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","tls_version":"1.2","alpn":[],"url_path":"/webadmin/","summary":"","payload_hex":"474554202f77656261646d696e2f20485454502f312e310d0a486f73743a203c484f4e4559504f543e0d0a4163636570743a20746578742f68746d6c2c6170706c69636174696f6e2f7868746d6c2b786d6c2c6170706c69636174696f6e2f786d6c3b713d302e392c2a2f2a3b713d302e380d0a4163636570742d456e636f64696e673a206465666c6174652c20677a69702c206964656e746974790d0a4163636570742d4c616e67756167653a20656e2d55533b713d302e362c656e3b713d302e340d0a526566657265723a2068747470733a2f2f3c484f4e4559504f543e2f0d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e5420352e313b2072763a392e302e3129204765636b6f2f32303130303130312046697265666f782f392e302e310d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 5.1; rv:9.0.1) Gecko/20100101 Firefox/9.0.1","ja3":"b22b3950835f7eba2f3be0917e4f949e","session":"9ad6a1e9-99a2-4526-b07c-5ff5ec0b8249-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-23T00:04:54","port":443,"proto":"tcp","app_proto":"http","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\",\"accept-encoding\":\"deflate, gzip, identity\",\"accept-language\":\"en-US;q=0.6,en;q=0.4\",\"host\":\"<HONEYPOT>\",\"referer\":\"https://<HONEYPOT>/\",\"user-agent\":\"Mozilla/5.0 (Windows NT 5.1; rv:9.0.1) Gecko/20100101 Firefox/9.0.1\"}","body":"","sni":"<HONEYPOT>","tls_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","tls_version":"1.2","alpn":[],"url_path":"/phpmy-admin/","summary":"","payload_hex":"474554202f7068706d792d61646d696e2f20485454502f312e310d0a486f73743a203c484f4e4559504f543e0d0a4163636570743a20746578742f68746d6c2c6170706c69636174696f6e2f7868746d6c2b786d6c2c6170706c69636174696f6e2f786d6c3b713d302e392c2a2f2a3b713d302e380d0a4163636570742d456e636f64696e673a206465666c6174652c20677a69702c206964656e746974790d0a4163636570742d4c616e67756167653a20656e2d55533b713d302e362c656e3b713d302e340d0a526566657265723a2068747470733a2f2f3c484f4e4559504f543e2f0d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e5420352e313b2072763a392e302e3129204765636b6f2f32303130303130312046697265666f782f392e302e310d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 5.1; rv:9.0.1) Gecko/20100101 Firefox/9.0.1","ja3":"b22b3950835f7eba2f3be0917e4f949e","session":"78ec7600-d35c-47a8-871c-bbe5e978acd2-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-23T00:04:54","port":443,"proto":"tcp","app_proto":"http","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\",\"accept-encoding\":\"deflate, gzip, identity\",\"accept-language\":\"en-US;q=0.6,en;q=0.4\",\"host\":\"<HONEYPOT>\",\"referer\":\"https://<HONEYPOT>/\",\"user-agent\":\"Mozilla/5.0 (Windows NT 5.1; rv:9.0.1) Gecko/20100101 Firefox/9.0.1\"}","body":"","sni":"<HONEYPOT>","tls_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","tls_version":"1.2","alpn":[],"url_path":"/php-myadmin/","summary":"","payload_hex":"474554202f7068702d6d7961646d696e2f20485454502f312e310d0a486f73743a203c484f4e4559504f543e0d0a4163636570743a20746578742f68746d6c2c6170706c69636174696f6e2f7868746d6c2b786d6c2c6170706c69636174696f6e2f786d6c3b713d302e392c2a2f2a3b713d302e380d0a4163636570742d456e636f64696e673a206465666c6174652c20677a69702c206964656e746974790d0a4163636570742d4c616e67756167653a20656e2d55533b713d302e362c656e3b713d302e340d0a526566657265723a2068747470733a2f2f3c484f4e4559504f543e2f0d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e5420352e313b2072763a392e302e3129204765636b6f2f32303130303130312046697265666f782f392e302e310d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 5.1; rv:9.0.1) Gecko/20100101 Firefox/9.0.1","ja3":"b22b3950835f7eba2f3be0917e4f949e","session":"66595ee0-9853-4c9d-b1b2-fd9698377d15-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-23T00:04:54","port":443,"proto":"tcp","app_proto":"http","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\",\"accept-encoding\":\"deflate, gzip, identity\",\"accept-language\":\"en-US;q=0.6,en;q=0.4\",\"host\":\"<HONEYPOT>\",\"referer\":\"https://<HONEYPOT>/\",\"user-agent\":\"Mozilla/5.0 (Windows NT 5.1; rv:9.0.1) Gecko/20100101 Firefox/9.0.1\"}","body":"","sni":"<HONEYPOT>","tls_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","tls_version":"1.2","alpn":[],"url_path":"/phpmanager/","summary":"","payload_hex":"474554202f7068706d616e616765722f20485454502f312e310d0a486f73743a203c484f4e4559504f543e0d0a4163636570743a20746578742f68746d6c2c6170706c69636174696f6e2f7868746d6c2b786d6c2c6170706c69636174696f6e2f786d6c3b713d302e392c2a2f2a3b713d302e380d0a4163636570742d456e636f64696e673a206465666c6174652c20677a69702c206964656e746974790d0a4163636570742d4c616e67756167653a20656e2d55533b713d302e362c656e3b713d302e340d0a526566657265723a2068747470733a2f2f3c484f4e4559504f543e2f0d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e5420352e313b2072763a392e302e3129204765636b6f2f32303130303130312046697265666f782f392e302e310d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 5.1; rv:9.0.1) Gecko/20100101 Firefox/9.0.1","ja3":"b22b3950835f7eba2f3be0917e4f949e","session":"26163163-ce6d-438b-9a26-574f896b282b-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-23T00:04:54","port":443,"proto":"tcp","app_proto":"http","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\",\"accept-encoding\":\"deflate, gzip, identity\",\"accept-language\":\"en-US;q=0.6,en;q=0.4\",\"host\":\"<HONEYPOT>\",\"referer\":\"https://<HONEYPOT>/\",\"user-agent\":\"Mozilla/5.0 (Windows NT 5.1; rv:9.0.1) Gecko/20100101 Firefox/9.0.1\"}","body":"","sni":"<HONEYPOT>","tls_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","tls_version":"1.2","alpn":[],"url_path":"/pma2005/","summary":"","payload_hex":"474554202f706d61323030352f20485454502f312e310d0a486f73743a203c484f4e4559504f543e0d0a4163636570743a20746578742f68746d6c2c6170706c69636174696f6e2f7868746d6c2b786d6c2c6170706c69636174696f6e2f786d6c3b713d302e392c2a2f2a3b713d302e380d0a4163636570742d456e636f64696e673a206465666c6174652c20677a69702c206964656e746974790d0a4163636570742d4c616e67756167653a20656e2d55533b713d302e362c656e3b713d302e340d0a526566657265723a2068747470733a2f2f3c484f4e4559504f543e2f0d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e5420352e313b2072763a392e302e3129204765636b6f2f32303130303130312046697265666f782f392e302e310d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 5.1; rv:9.0.1) Gecko/20100101 Firefox/9.0.1","ja3":"b22b3950835f7eba2f3be0917e4f949e","session":"6e181ac2-7a23-4386-b7ae-a504129fe6ad-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true}],"http_methods":[{"method":"GET","count":734},{"method":"POST","count":18},{"method":"CONNECT","count":10}],"distinct_ports_total":8,"top_paths":[{"path":"/HNAP1/","count":14,"ports":7},{"path":"/phpMyAdmin-2.6.3/","count":14,"ports":7},{"path":"/phpMyAdmin-2.6.2-rc1/","count":14,"ports":7},{"path":"/getcfg.php","count":10,"ports":2},{"path":"www.msftncsi.com:443","count":10,"ports":1},{"path":"/","count":9,"ports":7},{"path":"/SQLiteManager-1.2.4/main.php","count":7,"ports":7},{"path":"/phpMyAdmin-2.6.1/","count":7,"ports":7},{"path":"/phpMyAdmin-2.7.0-beta1/","count":7,"ports":7},{"path":"/PMA/","count":7,"ports":7},{"path":"/webdb/","count":7,"ports":7},{"path":"/script","count":7,"ports":7},{"path":"/p/m/a/","count":7,"ports":7},{"path":"/phpMyAdmin/","count":7,"ports":7},{"path":"/dbadmin/","count":7,"ports":7}],"distinct_paths_total":112,"top_snis":[],"top_hosts":[{"value":"www.msftncsi.com","count":16},{"value":"127.0.0.1","count":2}],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","Accept-Encoding","Accept-Language","Host","Referer","User-Agent"],"representative":[{"name":"Accept","value":"text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8","notable":false},{"name":"Accept-Encoding","value":"deflate, gzip, identity","notable":false},{"name":"Accept-Language","value":"en-US;q=0.6,en;q=0.4","notable":false},{"name":"Host","value":"<HONEYPOT>","notable":false},{"name":"Referer","value":"https://<HONEYPOT>/","notable":true},{"name":"User-Agent","value":"Mozilla/5.0 (Windows NT 5.1; rv:9.0.1) Gecko/20100101 Firefox/9.0.1","notable":false}],"distinct_sets":1,"events_with_headers":10},"tags":[{"tag_id":"CVE-2015-2051","tag_type":"cve","title":"D-Link DIR-645 HNAP SOAPAction header command injection","severity":"high","actively_exploited":true,"match_field":"interactive_session","matched_pattern":"","reference_urls":["https://nvd.nist.gov/vuln/detail/CVE-2015-2051","https://www.exploit-db.com/exploits/37171","http://securityadvisories.dlink.com/security/publication.aspx?name=SAP10051","https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2015-2051"],"confirmed_by":"interactive_session","sessions":12,"kev_date_added":"2022-02-10"},{"tag_id":"CVE-2024-57045","tag_type":"cve","title":"","severity":"","actively_exploited":false,"match_field":"interactive_session","matched_pattern":"","reference_urls":[],"confirmed_by":"interactive_session","sessions":2,"kev_date_added":null},{"tag_id":"post-exploitation","tag_type":"interactive","label":"post-exploitation","title":"Ran commands after logging in","sessions":12},{"tag_id":"shell","tag_type":"interactive","label":"shell","title":"Typed shell commands","sessions":12},{"tag_id":"logins","tag_type":"interactive","label":"logins","title":"Tried logins","sessions":2}]}