{"ip":"154.44.186.37","total_events":245,"verdict":{"verdict":"malicious","label":"Exploit attempts observed","detail":"6 exploit-path hits","confidence":"high","network_type":null,"why":["6 request(s) matched a known exploit path.","Body-carrying methods (POST/PUT/PATCH/DELETE) seen: payload delivery, not just recon.","5+ hits raise confidence to high.","Not in any known-scanner range.","Sent 2,912,497 bytes: sustained payload delivery, not a single opportunistic request."],"engagement":{"level":"payload","label":"Sustained payload","detail":"2,912,497 bytes sent","bytes_sent":2912497,"session_seconds":32,"persistent":false}},"first_seen":"2026-09-24T04:13:24","last_seen":"2026-09-24T04:14:23","events_24h":245,"events_7d":245,"geo":{"country_code":"ES","country_name":"Spain","region":"Madrid","city":"Madrid","lat":40.4153,"lon":-3.694,"asn":214036,"org":"Ultahost, Inc."},"source_domain":null,"known_scanners":[],"scanner_tag":null,"cve_matches":[{"cve_id":"CVE-2020-2551","title":"Oracle WebLogic Server - Remote Code Execution","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/console/login/LoginForm.jsp"},{"cve_id":"CVE-2021-35587","title":"Oracle Access Manager - Remote Code Execution","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/oam/server/opensso/sessionservice"},{"cve_id":"CVE-2022-26143","title":"Mitel MiCollab - Information Disclosure & Denial of Service","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/ucs/micollab/version.json"},{"cve_id":"CVE-2024-1709","title":"ConnectWise ScreenConnect 23.9.7 - Authentication Bypass","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/SetupWizard.aspx"},{"cve_id":"CVE-2025-0282","title":"Ivanti Connect Secure - Stack-based Buffer Overflow","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/dana-na/auth/url_default/welcome.cgi"},{"cve_id":"CVE-2020-14864","title":"Oracle Fusion - Directory Traversal/Local File Inclusion","severity":"high","actively_exploited":true,"match_field":"url_path","matched_pattern":"/analytics/saw.dll"},{"cve_id":"CVE-2023-38646","title":"Metabase < 0.46.6.1 - Remote Code Execution","severity":"critical","actively_exploited":false,"match_field":"url_path","matched_pattern":"/api/session/properties"},{"cve_id":"CVE-2024-23917","title":"JetBrains TeamCity > 2023.11.3 - Authentication Bypass","severity":"critical","actively_exploited":false,"match_field":"url_path","matched_pattern":"/app/rest/server"},{"cve_id":"CVE-2024-25723","title":"ZenML ZenML Server - Improper Authentication","severity":"critical","actively_exploited":false,"match_field":"url_path","matched_pattern":"/api/v1/info"},{"cve_id":"CVE-2024-30569","title":"Netgear R6850 - Information Disclosure","severity":"high","actively_exploited":false,"match_field":"url_path","matched_pattern":"/currentsetting.htm"},{"cve_id":"CVE-2026-25892","title":"Adminer 4.6.2 - 5.4.1 Unauthenticated Persistent DoS","severity":"high","actively_exploited":false,"match_field":"url_path","matched_pattern":"/adminer.php"},{"cve_id":"CVE-2026-35029","title":"LiteLLM - Arbitrary File Read","severity":"high","actively_exploited":false,"match_field":"url_path","matched_pattern":"/health/liveliness"},{"cve_id":"CVE-2007-4556","title":"OpenSymphony XWork/Apache Struts2 - Remote Code Execution","severity":"medium","actively_exploited":false,"match_field":"url_path","matched_pattern":"/login.action"},{"cve_id":"CVE-2025-2129","title":"Mage AI - Insecure Default Authentication Setup","severity":"medium","actively_exploited":false,"match_field":"url_path","matched_pattern":"/api/kernels"}],"malware":[],"top_ports":[{"port":10001,"proto":"tcp","label":"","count":245}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i131000_f57a46bbacb6_f50d94e863eb","t13i251000_b78ed14e2fd0_f50d94e863eb"],"tls_client_hello":"16030105ee010005ea0303f1d4213215635334b86918852b3b6296dbab5f3171f124fabd0d2248c3ed997420ad12223ff6134861a7cd40ca5c156e43ee22ae83cd18378375b9d10dcc73602a0032cca9cca8c02bc02fc02cc030c009c013c00ac014009c009d002f0035c012000ac023c027003cc007c01100051303130113020100056f000b00020100ff010001000017000000120000000500050100000000000a0010000e11ec11eb11ed001d001700180019000d001c001a090409050906080404030807080508060401050106010503060300320020001e090409050906080404030807080508060401050106010503060302010203002b0009080304030303020301003304ea04e811ec04c0bc86ced7164a0a9718ddfcc7a1431db8250bd718cfa2445614438274897e8a672d0631b7baa33e512108c9f0acf00115f4d363ae746b8de4104ee44c774749b06960a36724a36805c89259b7e39937a05bdd8c53c6bb99e0fa7052da1fdc09ccec416fea717359dc319bc60a6b14198ca4a5fd599928f534ec1a6256caad81128d2b9a364602337ca19c7d5601c85477abc223f5505b68a2ca63d21e70a49b5e32b21de7841412c5feca7e28f4c6414916413b5221f747fd7c823698a29d45b02907410a4361617b3f19c860bfca5e0212200e7867952205fa9930020993265b7217b747b2c4cf91123024083578d1ac1404b527c5969f4a0f8db22180b81ee7020143653082872c0dc3212665961d267d612988ebf4aafbe46db4993898630faa97bbe96161940b8c524cbab786cf9d22b4763552cd896492259d9a5398cb7c881409ced3c66f0e53bde58aa4734b8e33a88414d54eaa5261309c16c4dc9a24204e9a116ddc180420fa6cc5c567424a4756a5648b9a0918f890ede366a829969eb4beb8ea349f3338cd492fdfa16675f3a8f0c18137c34bfab1cbce5710089a971799b7b88954e93015fd39b69e758904a93c96e241e9964b64d98a7db89551144270cbc99080cdb5d696800abad09ace77e4a0300a9843ea90ece5bf012c0ac50b3460a380c9125224bcc55722c0f3e7247d6696c9cc60cb609ac002b17e3a11e98a1389115af699141a77803cd357e9b8aa276b9a02c9430b65797b50c475264f335670a415754fa05da2f5ad68818acba9940d96881d189fce7c5b09da7116859e0a043a0662b1d9d77d2ec6c62855b591f9b02d951b1be84dc7c1c41216a3f4406b2c78bfe47bab77627f3ac494173cb133a1a50322876ca36848d1a004e631302ac373b17ad997b8629a10e3900d3dca24a83b14a16693b69ccc1d966c16b313790b311881ccdba53c0e1bcee215930dc52e15a6cd9b6550943b9c1d0085972553dbaca4bdf69f4b82220e356531d5cadbc7800c1752805ba74c444dcafbac4eccbad065225c13459350cf7d403cab2217ee8aa5cb3a016e91379f598987f1444c4c64436cbe307a5f9bf81b630b2da4a78575c0b758127f8174a718ac000645b7c458614ff985983136ebeb6bffe15fced45fe660a1c7e3a6016a48d70b8a00571d96026d6f3610d32a19da152c89d627205a087a1286cacb1672ec5595d71d663372993690d303ae246a3b2843a9c32a29d0bb13a7a275b3212347727d89414a96688d0e4bc3d9f47ebfb90bf2cc765a67660920422f489d5fb62cf1ca796b2482175b33674ac49bf52a0896ca8a4cce24c831943b44b4d208ce59a9d0039621b99ea1bb68d1ca37d7c5aa2a350f9d233d2376c74950b824297590293ad804b97374c9153a6512cc10b5e1c2ac228e9960680fbcbfc69c09d547b398b536aa7a964dc55d11542b75e509b240434a68ac441530c3e535cabbc6e4f11d38449d00185e3d3c58e283afa1331e22a35eddc8047235090080a18a45a7e6a5a47573cf1e439724b5c9705b8c73f21f8bec873d12cfb09453d429ababcb5437031d15c70d11324844a613e57368c31162871160cc027bea745b984b73a376ab99888250a0451be2241ccb02e62e2eb32d112fdff5318fdad5112aaec3d19971c879caa4b0cb69240b6b655217af0101e81abe3a8bf1139e372f5dadd6608033001d0020c879caa4b0cb69240b6b655217af0101e81abe3a8bf1139e372f5dad","tls_ja3":["9404b4852d44353f69b8b33aaff15be4","56b0f6febc953849f7ace70c5a2ae34d"],"http_akin":["a11cuq061_0000064a_ffe60107","a11cun040_0000004d_50f90888","a11cun030_0000000b_4c75231d","a11cun030_0000004c_13ee3d34"]},"fingerprint_peers":{"t13i131000_f57a46bbacb6_f50d94e863eb":2565,"t13i251000_b78ed14e2fd0_f50d94e863eb":13,"a11cuq061_0000064a_ffe60107":22,"a11cun030_0000000b_4c75231d":2,"a11cun030_0000004c_13ee3d34":2223,"a11cun040_0000004d_50f90888":6},"akin_families":{"a11cun040_0000004d_50f90888":{"head":"a11cun040_0000004d_aa48e2c8","shapes":5,"ips":2056},"a11cun030_0000004c_13ee3d34":{"head":"a11cun030_0000004c_13ee3d34","shapes":3,"ips":2226}},"user_agents":["nerva/1.0","Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36"],"timeline":[{"date":"2026-09-24","count":245}],"recent_events":[{"timestamp":"2026-09-24T04:14:23","port":10001,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"application/json\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:10001\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/v2/","summary":"","payload_hex":"474554202f76322f20485454502f312e310d0a486f73743a20<HONEYPOT>3a31303030310d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132372e302e302e30205361666172692f3533372e33360d0a4163636570743a206170706c69636174696f6e2f6a736f6e0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36","ja3":"9404b4852d44353f69b8b33aaff15be4","session":"bada55d5-885b-4482-9d2d-a7d936338547","seq":158,"duration_ms":31774,"bytes_in":36417,"bytes_out":12324},{"timestamp":"2026-09-24T04:14:22","port":10001,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"application/json\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:10001\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/status","summary":"","payload_hex":"474554202f73746174757320485454502f312e310d0a486f73743a20<HONEYPOT>3a31303030310d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132372e302e302e30205361666172692f3533372e33360d0a4163636570743a206170706c69636174696f6e2f6a736f6e0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36","ja3":"9404b4852d44353f69b8b33aaff15be4","session":"bada55d5-885b-4482-9d2d-a7d936338547","seq":156,"duration_ms":31371,"bytes_in":35960,"bytes_out":12168},{"timestamp":"2026-09-24T04:14:22","port":10001,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"application/json\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:10001\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/api/workgroup/env-info","summary":"","payload_hex":"474554202f6170692f776f726b67726f75702f656e762d696e666f20485454502f312e310d0a486f73743a20<HONEYPOT>3a31303030310d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132372e302e302e30205361666172692f3533372e33360d0a4163636570743a206170706c69636174696f6e2f6a736f6e0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36","ja3":"9404b4852d44353f69b8b33aaff15be4","session":"bada55d5-885b-4482-9d2d-a7d936338547","seq":155,"duration_ms":31169,"bytes_in":35736,"bytes_out":12090},{"timestamp":"2026-09-24T04:14:22","port":10001,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"application/json\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:10001\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/debug/pprof/","summary":"","payload_hex":"474554202f64656275672f7070726f662f20485454502f312e310d0a486f73743a20<HONEYPOT>3a31303030310d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132372e302e302e30205361666172692f3533372e33360d0a4163636570743a206170706c69636174696f6e2f6a736f6e0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36","ja3":"9404b4852d44353f69b8b33aaff15be4","session":"bada55d5-885b-4482-9d2d-a7d936338547","seq":154,"duration_ms":30968,"bytes_in":35496,"bytes_out":12012},{"timestamp":"2026-09-24T04:14:22","port":10001,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"application/json\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:10001\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/CFIDE/administrator/","summary":"","payload_hex":"474554202f43464944452f61646d696e6973747261746f722f20485454502f312e310d0a486f73743a20<HONEYPOT>3a31303030310d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132372e302e302e30205361666172692f3533372e33360d0a4163636570743a206170706c69636174696f6e2f6a736f6e0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36","ja3":"9404b4852d44353f69b8b33aaff15be4","session":"bada55d5-885b-4482-9d2d-a7d936338547","seq":153,"duration_ms":30767,"bytes_in":35266,"bytes_out":11934},{"timestamp":"2026-09-24T04:14:22","port":10001,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"application/json\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:10001\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/+CSCOE+/logon.html","summary":"","payload_hex":"474554202f2b4353434f452b2f6c6f676f6e2e68746d6c20485454502f312e310d0a486f73743a20<HONEYPOT>3a31303030310d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132372e302e302e30205361666172692f3533372e33360d0a4163636570743a206170706c69636174696f6e2f6a736f6e0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36","ja3":"9404b4852d44353f69b8b33aaff15be4","session":"bada55d5-885b-4482-9d2d-a7d936338547","seq":157,"duration_ms":31572,"bytes_in":36196,"bytes_out":12246},{"timestamp":"2026-09-24T04:14:21","port":10001,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"application/json\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:10001\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/api/v1/heartbeat","summary":"","payload_hex":"474554202f6170692f76312f68656172746265617420485454502f312e310d0a486f73743a20<HONEYPOT>3a31303030310d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132372e302e302e30205361666172692f3533372e33360d0a4163636570743a206170706c69636174696f6e2f6a736f6e0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36","ja3":"9404b4852d44353f69b8b33aaff15be4","session":"bada55d5-885b-4482-9d2d-a7d936338547","seq":152,"duration_ms":30566,"bytes_in":35028,"bytes_out":11856},{"timestamp":"2026-09-24T04:14:21","port":10001,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"application/json\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:10001\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/ucs/micollab/version.json","summary":"","payload_hex":"474554202f7563732f6d69636f6c6c61622f76657273696f6e2e6a736f6e20485454502f312e310d0a486f73743a20<HONEYPOT>3a31303030310d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132372e302e302e30205361666172692f3533372e33360d0a4163636570743a206170706c69636174696f6e2f6a736f6e0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36","ja3":"9404b4852d44353f69b8b33aaff15be4","session":"bada55d5-885b-4482-9d2d-a7d936338547","seq":151,"duration_ms":30364,"bytes_in":34794,"bytes_out":11778},{"timestamp":"2026-09-24T04:14:21","port":10001,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"application/json\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:10001\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/health","summary":"","payload_hex":"474554202f6865616c746820485454502f312e310d0a486f73743a20<HONEYPOT>3a31303030310d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132372e302e302e30205361666172692f3533372e33360d0a4163636570743a206170706c69636174696f6e2f6a736f6e0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36","ja3":"9404b4852d44353f69b8b33aaff15be4","session":"bada55d5-885b-4482-9d2d-a7d936338547","seq":149,"duration_ms":29960,"bytes_in":34304,"bytes_out":11622},{"timestamp":"2026-09-24T04:14:21","port":10001,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"text/html\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:10001\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/adminer/","summary":"","payload_hex":"474554202f61646d696e65722f20485454502f312e310d0a486f73743a20<HONEYPOT>3a31303030310d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132372e302e302e30205361666172692f3533372e33360d0a4163636570743a20746578742f68746d6c0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36","ja3":"9404b4852d44353f69b8b33aaff15be4","session":"bada55d5-885b-4482-9d2d-a7d936338547","seq":148,"duration_ms":29759,"bytes_in":34080,"bytes_out":11544}],"http_methods":[{"method":"GET","count":238},{"method":"POST","count":1}],"distinct_ports_total":1,"top_paths":[{"path":"/","count":9,"ports":1},{"path":"/api/v1/version","count":4,"ports":1},{"path":"/api/version","count":4,"ports":1},{"path":"/version","count":4,"ports":1},{"path":"/login","count":3,"ports":1},{"path":"/api/","count":2,"ports":1},{"path":"/api/overview","count":2,"ports":1},{"path":"/+CSCOE+/logon.html","count":2,"ports":1},{"path":"/status","count":2,"ports":1},{"path":"/metrics","count":2,"ports":1},{"path":"/auth/login.html","count":1,"ports":1},{"path":"/v3/api-docs","count":1,"ports":1},{"path":"/GC3/glog.webserver.servlet.umt.Login","count":1,"ports":1},{"path":"/nerva-fp-nonexistent-path","count":1,"ports":1},{"path":"/ucs/micollab/version.json","count":1,"ports":1}],"distinct_paths_total":200,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","Accept-Encoding","Host","User-Agent"],"representative":[{"name":"Accept","value":"application/json","notable":false},{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Host","value":"<HONEYPOT>:10001","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36","notable":false}],"distinct_sets":1,"events_with_headers":10},"tags":[{"tag_id":"CVE-2020-2551","tag_type":"cve","title":"Oracle WebLogic Server - Remote Code Execution","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/console/login/LoginForm.jsp","reference_urls":["https://github.com/hktalent/CVE-2020-2551","https://nvd.nist.gov/vuln/detail/CVE-2020-2551","https://www.oracle.com/security-alerts/cpujan2020.html","https://github.com/neilzhang1/Chinese-Charts","https://github.com/pjgmonteiro/Pentest-tools"]},{"tag_id":"CVE-2021-35587","tag_type":"cve","title":"Oracle Access Manager - Remote Code Execution","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/oam/server/opensso/sessionservice","reference_urls":["https://testbnull.medium.com/oracle-access-manager-pre-auth-rce-cve-2021-35587-analysis-1302a4542316","https://nvd.nist.gov/vuln/detail/CVE-2021-35587","https://www.oracle.com/security-alerts/cpujan2022.html","https://github.com/ARPSyndicate/kenzer-templates","https://github.com/GrrrDog/Java-Deserialization-Cheat-Sheet"]},{"tag_id":"CVE-2022-26143","tag_type":"cve","title":"Mitel MiCollab - Information Disclosure & Denial of Service","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/ucs/micollab/version.json","reference_urls":["https://nvd.nist.gov/vuln/detail/CVE-2022-26143"]},{"tag_id":"CVE-2024-1709","tag_type":"cve","title":"ConnectWise ScreenConnect 23.9.7 - Authentication Bypass","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/SetupWizard.aspx","reference_urls":["https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass","https://github.com/watchtowrlabs/connectwise-screenconnect_auth-bypass-add-user-poc","https://www.connectwise.com/company/trust/security-bulletins/connectwise-screenconnect-23.9.8","https://nvd.nist.gov/vuln/detail/CVE-2024-1709","https://github.com/rapid7/metasploit-framework/pull/18870"]},{"tag_id":"CVE-2025-0282","tag_type":"cve","title":"Ivanti Connect Secure - Stack-based Buffer Overflow","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/dana-na/auth/url_default/welcome.cgi","reference_urls":["https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-Policy-Secure-ZTA-Gateways-CVE-2025-0282-CVE-2025-0283","https://labs.watchtowr.com/exploitation-walkthrough-and-techniques-ivanti-connect-secure-rce-cve-2025-0282/","https://cloud.google.com/blog/topics/threat-intelligence/ivanti-connect-secure-vpn-zero-day","https://nvd.nist.gov/vuln/detail/CVE-2025-0282"]},{"tag_id":"CVE-2020-14864","tag_type":"cve","title":"Oracle Fusion - Directory Traversal/Local File Inclusion","severity":"high","actively_exploited":true,"match_field":"url_path","matched_pattern":"/analytics/saw.dll","reference_urls":["http://packetstormsecurity.com/files/159748/Oracle-Business-Intelligence-Enterprise-Edition-5.5.0.0.0-12.2.1.3.0-12.2.1.4.0-LFI.html","https://www.oracle.com/security-alerts/cpuoct2020.html","https://nvd.nist.gov/vuln/detail/CVE-2020-14864","https://github.com/merlinepedra/nuclei-templates","https://github.com/sobinge/nuclei-templates"]},{"tag_id":"CVE-2023-38646","tag_type":"cve","title":"Metabase < 0.46.6.1 - Remote Code Execution","severity":"critical","actively_exploited":false,"match_field":"url_path","matched_pattern":"/api/session/properties","reference_urls":["https://www.metabase.com/blog/security-advisory","https://github.com/metabase/metabase/releases/tag/v0.46.6.1","https://mp.weixin.qq.com/s/ATFwFl-D8k9QfQfzKjZFDg","https://news.ycombinator.com/item?id=36812256","https://blog.assetnote.io/2023/07/22/pre-auth-rce-metabase/"]},{"tag_id":"CVE-2024-23917","tag_type":"cve","title":"JetBrains TeamCity > 2023.11.3 - Authentication Bypass","severity":"critical","actively_exploited":false,"match_field":"url_path","matched_pattern":"/app/rest/server","reference_urls":["https://github.com/fkie-cad/nvd-json-data-feeds","https://www.rapid7.com/db/vulnerabilities/jetbrains-teamcity-cve-2024-23917/"]},{"tag_id":"CVE-2024-25723","tag_type":"cve","title":"ZenML ZenML Server - Improper Authentication","severity":"critical","actively_exploited":false,"match_field":"url_path","matched_pattern":"/api/v1/info","reference_urls":["https://www.zenml.io/blog/critical-security-update-for-zenml-users","https://github.com/zenml-io/zenml","https://github.com/zenml-io/zenml/compare/0.42.1...0.42.2","https://github.com/zenml-io/zenml/compare/0.43.0...0.43.1","https://github.com/zenml-io/zenml/compare/0.44.3...0.44.4"]},{"tag_id":"CVE-2024-30569","tag_type":"cve","title":"Netgear R6850 - Information Disclosure","severity":"high","actively_exploited":false,"match_field":"url_path","matched_pattern":"/currentsetting.htm","reference_urls":["https://github.com/funny-mud-peee/IoT-vuls/blob/main/netgear%20R6850/Info%20Leak%20in%20Netgear-R6850%EF%BC%88currentsetting.htm%EF%BC%89.md","https://nvd.nist.gov/vuln/detail/CVE-2024-30569","https://www.netgear.com/about/security/"]},{"tag_id":"CVE-2026-25892","tag_type":"cve","title":"Adminer 4.6.2 - 5.4.1 Unauthenticated Persistent DoS","severity":"high","actively_exploited":false,"match_field":"url_path","matched_pattern":"/adminer.php","reference_urls":["https://github.com/vrana/adminer/security/advisories/GHSA-q4f2-39gr-45jh","https://github.com/vrana/adminer/commit/21d3a3150388677b18647d68aec93b7850e457d3"]},{"tag_id":"CVE-2026-35029","tag_type":"cve","title":"LiteLLM - Arbitrary File Read","severity":"high","actively_exploited":false,"match_field":"url_path","matched_pattern":"/health/liveliness","reference_urls":["https://github.com/BerriAI/litellm","https://sec-consult.com/vulnerability-lab/advisory/broken-access-control-in-config-endpoint-in-litellm/","https://nvd.nist.gov/vuln/detail/CVE-2026-35029"]},{"tag_id":"CVE-2007-4556","tag_type":"cve","title":"OpenSymphony XWork/Apache Struts2 - Remote Code Execution","severity":"medium","actively_exploited":false,"match_field":"url_path","matched_pattern":"/login.action","reference_urls":["https://www.guildhab.top/?p=2326","https://nvd.nist.gov/vuln/detail/CVE-2007-4556","https://cwiki.apache.org/confluence/display/WW/S2-001","http://forums.opensymphony.com/ann.jspa?annID=54","http://issues.apache.org/struts/browse/WW-2030"]},{"tag_id":"CVE-2025-2129","tag_type":"cve","title":"Mage AI - Insecure Default Authentication Setup","severity":"medium","actively_exploited":false,"match_field":"url_path","matched_pattern":"/api/kernels","reference_urls":["https://nvd.nist.gov/vuln/detail/CVE-2025-2129","https://github.com/zn9988/publications/blob/main/2.Mage-AI%20-%20Insecure%20Default%20Authentication%20Setup%20Leading%20to%20Zero-Click%20RCE/README.md","https://vuldb.com/?ctiid.299049","https://vuldb.com/?id.299049","https://vuldb.com/?submit.510690"]}],"data_as_of":"2026-09-24T10:59:43.882577+00:00"}