{"ip":"147.185.132.31","total_events":806,"verdict":{"verdict":"scanner","label":"Recognized scanner","detail":"paloaltonetworks","confidence":"high","network_type":null,"why":["Source IP is in a known scanner range (paloaltonetworks).","Known research and commercial scanners are labelled as such, not as threats."],"engagement":{"level":"payload","label":"Sustained payload","detail":"82,627 bytes sent","bytes_sent":82627,"session_seconds":2,"persistent":false}},"first_seen":"2026-02-17T03:53:50","last_seen":"2026-10-06T22:49:00","events_24h":3,"events_7d":54,"geo":{"country_code":"US","country_name":"United States","region":"","city":"","lat":37.751,"lon":-97.822,"asn":396982,"org":"Google LLC"},"source_domain":null,"known_scanners":["paloaltonetworks"],"scanner_tag":null,"cve_matches":[{"cve_id":"CVE-2026-34197","title":"Apache ActiveMQ - Remote Code Execution","severity":"CRITICAL","actively_exploited":true,"match_field":"url_path","matched_pattern":"/api/jolokia/"}],"malware":[],"udp":{"source_verified":false,"window_days":90,"events":1,"protocols":[{"protocol":"udp","events":1}],"ports":[{"port":13746,"events":1}],"dns_questions":[],"quic_clients":[],"first_seen":"2026-10-06T04:37:37","last_seen":"2026-10-06T04:37:37","recent":[{"timestamp":"2026-10-06T04:37:37","port":13746,"src_port":20058,"proto":"udp","app_proto":"","app_protocol":"dtls","summary":"\u0016��\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u00006\u0001\u0000\u0000*\u0000\u0000\u0000\u0000\u0000\u0000\u0000*��\u0000\u0000\u0000\u0000|w@\u001e��\"��\u0018��\bʬ\nd/�\"d�\b�\u0016�\u00190\u0000\u0000\u0000\u0002\u0000/\u0001\u0000","payload_hex":"16feff000000000000000000360100002a000000000000002afefd000000007c77401e8ac822a0a018ff9308caac0a642fc92264bc08a81689193000000002002f0100","sni":"","session":"f2a102ee-fe5e-4445-99e1-9f6f0cdd62a5","bytes_in":67,"source_verified":false}]},"top_ports":[{"port":3389,"proto":"tcp","label":"RDP","count":82},{"port":3390,"proto":"tcp","label":"","count":34},{"port":3388,"proto":"tcp","label":"","count":27},{"port":20256,"proto":"tcp","label":"","count":24},{"port":8088,"proto":"tcp","label":"Hadoop","count":11},{"port":20000,"proto":"tcp","label":"","count":10},{"port":444,"proto":"tcp","label":"","count":9},{"port":8081,"proto":"tcp","label":"","count":8},{"port":5050,"proto":"tcp","label":"","count":8},{"port":8888,"proto":"tcp","label":"HTTP-alt","count":7},{"port":10443,"proto":"tcp","label":"","count":7},{"port":548,"proto":"tcp","label":"","count":6},{"port":22,"proto":"tcp","label":"SSH","count":6},{"port":20257,"proto":"tcp","label":"","count":6},{"port":32569,"proto":"tcp","label":"","count":6}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i190800_9dc949149365_97f8aa674fd9","t13i140900_cbb2034c60b8_e7c285222651","t13i311000_e8f1e7e78f70_24695f2957a7","t13i131000_f57a46bbacb6_ab7e3b40a677"],"tls_client_hello":"16030100e8010000e40303adc4f2c9a3bfb1313e789a0de049f7c5b991e70954727f89b07b72e20f22608820578754101a68d7a171a36b398088580540e19011d659f538c02af139f54423af001cc02bc02fc02cc030cca9cca8c009c013c00ac014c0121301130213030100007f000b00020100ff010001000017000000120000000500050100000000000a000a0008001d001700180019000d001a0018080404030807080508060401050106010503060302010203002b0009080304030303020301003300260024001d0020f91ceae63246b576b7048339ebcf88647449c650ce49fe62e445558b1e75a35a","tls_ja3":["1487bd354c20f20dd642bebc7f706e95","004556e859f3c26c5d19746b3a957c74","19e29534fd49dd27d09234e639c4057e","2196848d251b217de8b2c037e356c11d"],"http_akin":["b11cun030_00040012_13ee3d34","b11cun020_00000014_0a8d7f11","b11cun020_00040010_724c10fb","b11cuq040_02050800_f46b29fb"]},"fingerprint_peers":{"t13i190800_9dc949149365_97f8aa674fd9":3115,"t13i140900_cbb2034c60b8_e7c285222651":675,"t13i311000_e8f1e7e78f70_24695f2957a7":517,"t13i131000_f57a46bbacb6_ab7e3b40a677":3775,"b11cun030_00040012_13ee3d34":4795,"b11cun020_00040010_724c10fb":1492,"b11cuq040_02050800_f46b29fb":180,"b11cun020_00000014_0a8d7f11":144},"akin_families":{"b11cun030_00040012_13ee3d34":{"head":"b11cun030_00040012_13ee3d34","shapes":2,"ips":4795}},"user_agents":["Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity","curl/7.68.0"],"timeline":[{"date":"2026-07-09","count":5},{"date":"2026-07-11","count":3},{"date":"2026-07-12","count":3},{"date":"2026-07-13","count":5},{"date":"2026-07-14","count":5},{"date":"2026-07-15","count":12},{"date":"2026-07-16","count":2},{"date":"2026-07-17","count":1},{"date":"2026-07-18","count":3},{"date":"2026-07-19","count":3},{"date":"2026-07-20","count":3},{"date":"2026-07-21","count":1},{"date":"2026-07-22","count":1},{"date":"2026-07-23","count":3},{"date":"2026-07-24","count":2},{"date":"2026-07-26","count":4},{"date":"2026-07-27","count":2},{"date":"2026-07-28","count":3},{"date":"2026-07-29","count":12},{"date":"2026-07-30","count":5},{"date":"2026-07-31","count":2},{"date":"2026-08-01","count":7},{"date":"2026-08-02","count":3},{"date":"2026-08-03","count":1},{"date":"2026-08-04","count":3},{"date":"2026-08-06","count":1},{"date":"2026-08-07","count":2},{"date":"2026-08-08","count":2},{"date":"2026-08-09","count":4},{"date":"2026-08-10","count":1},{"date":"2026-08-11","count":2},{"date":"2026-08-12","count":6},{"date":"2026-08-13","count":3},{"date":"2026-08-14","count":8},{"date":"2026-08-15","count":2},{"date":"2026-08-16","count":7},{"date":"2026-08-17","count":3},{"date":"2026-08-18","count":2},{"date":"2026-08-19","count":5},{"date":"2026-08-20","count":3},{"date":"2026-08-21","count":4},{"date":"2026-08-22","count":3},{"date":"2026-08-23","count":3},{"date":"2026-08-24","count":2},{"date":"2026-08-25","count":3},{"date":"2026-08-26","count":5},{"date":"2026-08-27","count":2},{"date":"2026-08-28","count":4},{"date":"2026-08-29","count":2},{"date":"2026-08-30","count":2},{"date":"2026-08-31","count":5},{"date":"2026-09-01","count":2},{"date":"2026-09-02","count":2},{"date":"2026-09-03","count":1},{"date":"2026-09-04","count":1},{"date":"2026-09-05","count":6},{"date":"2026-09-06","count":2},{"date":"2026-09-07","count":2},{"date":"2026-09-08","count":1},{"date":"2026-09-10","count":2},{"date":"2026-09-11","count":6},{"date":"2026-09-12","count":2},{"date":"2026-09-13","count":3},{"date":"2026-09-14","count":3},{"date":"2026-09-15","count":1},{"date":"2026-09-16","count":3},{"date":"2026-09-17","count":4},{"date":"2026-09-18","count":2},{"date":"2026-09-19","count":2},{"date":"2026-09-20","count":2},{"date":"2026-09-21","count":2},{"date":"2026-09-22","count":3},{"date":"2026-09-23","count":9},{"date":"2026-09-24","count":4},{"date":"2026-09-25","count":2},{"date":"2026-09-26","count":7},{"date":"2026-09-27","count":13},{"date":"2026-09-28","count":5},{"date":"2026-09-29","count":1},{"date":"2026-09-30","count":5},{"date":"2026-10-01","count":2},{"date":"2026-10-02","count":16},{"date":"2026-10-03","count":1},{"date":"2026-10-04","count":14},{"date":"2026-10-05","count":12},{"date":"2026-10-06","count":4}],"recent_events":[{"timestamp":"2026-10-06T22:49:00","port":8080,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:8080\",\"user-agent\":\"Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a383038300d0a557365722d4167656e743a2048656c6c6f2066726f6d2050616c6f20416c746f204e6574776f726b732c2066696e64206f7574206d6f72652061626f7574206f7572207363616e7320696e2068747470733a2f2f646f63732d636f727465782e70616c6f616c746f6e6574776f726b732e636f6d2f722f312f436f727465782d5870616e73652f5363616e6e696e672d61637469766974790d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity","ja3":"","session":"fe802433-a17c-47af-9c1f-aa89ea823225","seq":1,"duration_ms":100,"bytes_in":221,"bytes_out":79},{"timestamp":"2026-10-06T13:24:23","port":2000,"proto":"tcp","app_proto":"","app_protocol":"ciscoskinny","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"8\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000SEP000943665758\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000���\u001d\b\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0005\u0000\u0000�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000","payload_hex":"380000000000000001000000534550303030393433363635373538000000000001000000c0a8da1d080000000000000000000000050000840000000000000000","method":"","user_agent":"","ja3":"","session":"ab2bbcac-033d-4a4f-8eca-5929a1c42712","seq":1,"duration_ms":100,"bytes_in":64,"bytes_out":14,"enriched":{"digest":"61eed033b34e02a9","strings":["SEP000943665758"]}},{"timestamp":"2026-10-06T10:34:51","port":1911,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"fox a 1 -1 fox hello\n{\nfox.version=s:1.0\nid=i:1\nhostName=s:xpvm-0omdc01xmy\nhostAddress=s:192.168.1.125\napp.name=s:Workbench\napp.version=s:3.7.44\nvm.name=s:Java HotSpot(TM) Server VM\nvm.version=s:20.4-b02\nos.name=s:Windows XP\nos.version=s:5.1\nlang=s:en\ntimeZone=s:America/Los_Angeles;-28800000;3600000;02:00:00.000,wall,march,8,on or after,sunday,undefined;02:00:00.000,wall,november,1,on or after,sunday,undefined\nhostId=s:Win-99CB-D49D-5442-07BB\nvmUuid=s:8b530bc8-76c5-4139-a2ea-0fabd394d305\nbrandId=s:vykon\n};;\n","payload_hex":"666f7820612031202d3120666f782068656c6c6f0a7b0a666f782e76657273696f6e3d733a312e300a69643d693a310a686f73744e616d653d733a7870766d2d306f6d64633031786d790a686f7374416464726573733d733a3139322e3136382e312e3132350a6170702e6e616d653d733a576f726b62656e63680a6170702e76657273696f6e3d733a332e372e34340a766d2e6e616d653d733a4a61766120486f7453706f7428544d292053657276657220564d0a766d2e76657273696f6e3d733a32302e342d6230320a6f732e6e616d653d733a57696e646f77732058500a6f732e76657273696f6e3d733a352e310a6c616e673d733a656e0a74696d655a6f6e653d733a416d65726963612f4c6f735f416e67656c65733b2d32383830303030303b333630303030303b30323a30303a30302e3030302c77616c6c2c6d617263682c382c6f6e206f722061667465722c73756e6461792c756e646566696e65643b30323a30303a30302e3030302c77616c6c2c6e6f76656d6265722c312c6f6e206f722061667465722c73756e6461792c756e646566696e65640a686f737449643d733a57696e2d393943422d443439442d353434322d303742420a766d557569643d733a38623533306263382d373663352d343133392d613265612d3066616264333934643330350a6272616e6449643d733a76796b6f6e0a7d3b3b0a","method":"","user_agent":"","ja3":"","session":"73932164-6bec-45f7-b889-132841709a0c","seq":1,"duration_ms":101,"bytes_in":513,"bytes_out":14,"enriched":{"digest":"fe39c976bf6d2d07","strings":["fox a 1 -1 fox hello","fox.version=s:1.0","id=i:1","hostName=s:xpvm-0omdc01xmy","hostAddress=s:192.168.1.125","app.name=s:Workbench","app.version=s:3.7.44","vm.name=s:Java HotSpot(TM) Server VM","vm.version=s:20.4-b02","os.name=s:Windows XP"],"iocs":{"ips":["192.168.1.125"],"domains":["fox.version","app.name","app.version","vm.name","vm.version","os.name"]}}},{"timestamp":"2026-10-06T00:31:50","port":2628,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\r\n\r\n","payload_hex":"0d0a0d0a","method":"","user_agent":"","ja3":"","session":"b83196f2-fefc-4f63-8c1b-ae3e267670f8","seq":1,"duration_ms":100,"bytes_in":4,"bytes_out":14},{"timestamp":"2026-10-05T16:44:00","port":3389,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000'\"�\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=LreEFsZLt\r\n","payload_hex":"0300002722e00000000000436f6f6b69653a206d737473686173683d4c72654546735a4c740d0a","method":"","user_agent":"","ja3":"","session":"01f9d441-61e0-4549-b5b6-62135a3f144e","seq":1,"duration_ms":100,"bytes_in":39,"bytes_out":14,"enriched":{"digest":"2842e151bd8e9962","label":"RDP (X.224)","strings":["Cookie: mstshash=LreEFsZLt"]}},{"timestamp":"2026-10-05T16:44:00","port":3389,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0001�\u0002��e�\u0001�\u0004\u0001\u0001\u0004\u0001\u0001\u0001\u0001�0\u0019\u0002\u0001\"\u0002\u0001\u0002\u0002\u0001\u0000\u0002\u0001\u0001\u0002\u0001\u0000\u0002\u0001\u0001\u0002\u0002��\u0002\u0001\u00020\u0019\u0002\u0001\u0001\u0002\u0001\u0001\u0002\u0001\u0001\u0002\u0001\u0001\u0002\u0001\u0000\u0002\u0001\u0001\u0002\u0002\u0004 \u0002\u0001\u00020\u001c\u0002\u0002��\u0002\u0002�\u0017\u0002\u0002��\u0002\u0001\u0001\u0002\u0001\u0000\u0002\u0001\u0001\u0002\u0002��\u0002\u0001\u0002\u0004�\u0001/\u0000\u0005\u0000\u0014|\u0000\u0001�&\u0000\b\u0000\u0010\u0000\u0001�\u0000Duca�\u0018\u0001��\u0000\u0004\u0000\b\u0000\u0000\u0005 \u0003\u0001�\u0003�\t\b\u0000\u0000(\n\u0000\u0000E\u0000M\u0000P\u0000-\u0000L\u0000A\u0000P\u0000-\u00000\u00000\u00001\u00004\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0004\u0000\u0000\u0000\u0000\u0000\u0000\u0000\f\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001�\u0001\u0000\u0000\u0000\u0000\u0000\u0010\u0000\u0007\u0000\u0001\u00007\u00006\u00004\u00008\u00007\u0000-\u0000O\u0000E\u0000M\u0000-\u00000\u00000\u00001\u00001\u00009\u00000\u00003\u0000-\u00000\u00000\u00001\u00000\u00007\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0004�\f\u0000\t\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002�\f\u0000\u0016\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0003�,\u0000\u0003\u0000\u0000\u0000rdpdr\u0000\u0000\u0000\u0000\u0000��cliprdr\u0000\u0000\u0000��rdpsnd\u0000\u0000\u0000\u0000\u0000�","payload_hex":"0300019c02f0807f658201900401010401010101ff30190201220201020201000201010201000201010202ffff020102301902010102010102010102010102010002010102020420020102301c0202ffff0202fc170202ffff0201010201000201010202ffff0201020482012f000500147c00018126000800100001c00044756361811801c0d400040008000005200301ca03aa09080000280a000045004d0050002d004c00410050002d003000300031003400000000000000000004000000000000000c0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001ca010000000000100007000100370036003400380037002d004f0045004d002d0030003000310031003900300033002d0030003000310030003700000000000000000000000000000000000000000004c00c00090000000000000002c00c00160000000000000003c02c0003000000726470647200000000008080636c6970726472000000a0c0726470736e640000000000c0","method":"","user_agent":"","ja3":"","session":"01f9d441-61e0-4549-b5b6-62135a3f144e","seq":2,"duration_ms":227,"bytes_in":451,"bytes_out":28,"enriched":{"digest":"ba65d28dc51cff33","label":"RDP (X.224)","strings":["Duca","rdpdr","cliprdr","rdpsnd","EMP-LAP-0014","76487-OEM-0011903-00107"]}},{"timestamp":"2026-10-05T16:44:00","port":3389,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000,'�\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=biGXzu\r\n\u0001\u0000\b\u0000\u0001\u0000\u0000\u0000","payload_hex":"0300002c27e00000000000436f6f6b69653a206d737473686173683d626947587a750d0a0100080001000000","method":"","user_agent":"","ja3":"","session":"0f9d5ca6-7b8a-4f14-8d50-41472e3e4ccc","seq":1,"duration_ms":101,"bytes_in":44,"bytes_out":14,"enriched":{"digest":"e773f7c5da9d2e9b","label":"RDP (X.224)","strings":["Cookie: mstshash=biGXzu"]}},{"timestamp":"2026-10-05T16:44:00","port":3389,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000,'�\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=JSDLwA\r\n\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","payload_hex":"0300002c27e00000000000436f6f6b69653a206d737473686173683d4a53444c77410d0a0100080003000000","method":"","user_agent":"","ja3":"","session":"492daf3d-eab3-4e6c-ba52-638c57e5343b","seq":1,"duration_ms":100,"bytes_in":44,"bytes_out":14,"enriched":{"digest":"664283eab56b2cc4","label":"RDP (X.224)","strings":["Cookie: mstshash=JSDLwA"]}},{"timestamp":"2026-10-05T16:44:00","port":3389,"proto":"tcp","app_proto":"","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0016\u0003\u0001\u0000�\u0001\u0000\u0000�\u0003\u0003�2�uq����2\u000e׈\"�Xu7�Ct#���A\u0012��9 � � Em\u001fװ�K\b�\u00111Q��t�JV�m�\u0007�f���?�\u0007\u0000&�+�/�,�0̨̩�\t�\u0013�\n�\u0014\u0000�\u0000�\u0000/\u00005�\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000{\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003�\u0001\u0000\u0001\u0000\u0000\u0012\u0000\u0000\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 zgI)�.�d��\u0010�\u0007�\u0002ȅ\t�}R���\rRFs�ӂ>","payload_hex":"16030100ee010000ea0303a932cd7571f68ab3c3320ed78822bd5875378843742391ae8a411292c639209420eb20456d1fd7b0c54b08fe113151f8e8749d4a56cd6ddf07c066b0e08a3fb9070026c02bc02fc02cc030cca9cca8c009c013c00ac014009c009d002f0035c012000a1301130213030100007b000500050100000000000a000a0008001d001700180019000b00020100000d001a0018080404030807080508060401050106010503060302010203ff0100010000120000002b0009080304030303020301003300260024001d00207a674929aa2ecc64e38e10aa07ee02c88509ff7d5280b1ee0d524673d7d3823e","method":"","user_agent":"","ja3":"","session":"492daf3d-eab3-4e6c-ba52-638c57e5343b","seq":2,"duration_ms":227,"bytes_in":287,"bytes_out":28,"enriched":{"digest":"6b7872391d3cb7b8","label":"TLS/SSL","strings":["zgI)"]}},{"timestamp":"2026-10-05T16:43:59","port":3389,"proto":"tcp","app_proto":"","app_protocol":"rdp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000'\"�\u0000\u0000\u0000\u0000\u0000Cookie: mstshash=qChZFhhMD\r\n","payload_hex":"0300002722e00000000000436f6f6b69653a206d737473686173683d7143685a4668684d440d0a","method":"","user_agent":"","ja3":"","session":"49d3afdc-48c4-4e98-8afe-3871afaa1843","seq":1,"duration_ms":100,"bytes_in":39,"bytes_out":14,"enriched":{"digest":"93928e1f638d6a0e","label":"RDP (X.224)","strings":["Cookie: mstshash=qChZFhhMD"]}}],"http_methods":[{"method":"GET","count":378},{"method":"POST","count":4}],"distinct_ports_total":270,"top_paths":[{"path":"/","count":323,"ports":156},{"path":"/.well-known/security.txt","count":38,"ports":34},{"path":"/api/jolokia/version","count":6,"ports":6},{"path":"/wsman","count":4,"ports":1},{"path":"/api/jolokia","count":3,"ports":3},{"path":"/jolokia","count":2,"ports":2},{"path":"/_config","count":2,"ports":1},{"path":"/jolokia/version","count":1,"ports":1},{"path":"/jolokia/exec","count":1,"ports":1},{"path":"/jolokia/list","count":1,"ports":1},{"path":"/actuator/jolokia/version","count":1,"ports":1}],"distinct_paths_total":11,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[{"value":"SSH-2.0-ZGrab ZGrab SSH Survey","count":6}],"credentials":[],"header_profile":{"signature":["Accept-Encoding","Host","User-Agent"],"representative":[{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Host","value":"<HONEYPOT>:8080","notable":false},{"name":"User-Agent","value":"Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity","notable":false}],"distinct_sets":1,"events_with_headers":1},"tags":[{"tag_id":"CVE-2026-34197","tag_type":"cve","title":"Apache ActiveMQ - Remote Code Execution","severity":"CRITICAL","actively_exploited":true,"match_field":"url_path","matched_pattern":"/api/jolokia/","reference_urls":[]}],"data_as_of":"2026-10-07T00:58:00.040427+00:00"}