{"ip":"157.254.194.17","total_events":61,"verdict":{"verdict":"probing","label":"Low-level probing","detail":null,"confidence":"low","network_type":"CDN","why":["61 event(s), fewer than 10 distinct ports, no exploit payloads.","Not in any known-scanner range."]},"first_seen":"2026-07-06T09:07:54","last_seen":"2026-07-08T05:43:31","events_24h":3,"events_7d":61,"geo":{"country_code":"US","country_name":"United States","region":"","city":"","lat":37.751,"lon":-97.822,"asn":399486,"org":"12651980 CANADA INC."},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as399486","label":"Virtuo.Host (AS399486)","category":"cdn","url":"https://www.peeringdb.com/asn/399486"},"cve_matches":[{"cve_id":"CVE-2025-2129","title":"Mage AI - Insecure Default Authentication Setup","severity":"medium","actively_exploited":false,"match_field":"url_path","matched_pattern":"/api/kernels"}],"malware":[],"top_ports":[{"port":8888,"proto":"tcp","label":"HTTP-alt","count":45},{"port":8265,"proto":"tcp","label":"","count":16}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[],"ja4h":["ge11nn0400_c3abebcf3d28","ge11nn0400_17292dadbc7b","ge11nn0500_cac2c496544b"]},"fingerprint_peers":{"ge11nn0400_c3abebcf3d28":58,"ge11nn0500_cac2c496544b":183,"ge11nn0400_17292dadbc7b":232},"user_agents":["Python/3.12 aiohttp/3.14.1","local-jupyter-audit","jupyter-local-audit","jupyter-audit"],"timeline":[{"date":"2026-07-06","count":14},{"date":"2026-07-07","count":44},{"date":"2026-07-08","count":3}],"recent_events":[{"timestamp":"2026-07-08T05:43:31","port":8888,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"application/json\",\"accept-encoding\":\"identity\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8888\",\"user-agent\":\"jupyter-audit\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/api/kernels","summary":"","payload_hex":"474554202f6170692f6b65726e656c7320485454502f312e310d0a486f73743a20<HONEYPOT>3a383838380d0a557365722d4167656e743a206a7570797465722d61756469740d0a4163636570743a206170706c69636174696f6e2f6a736f6e0d0a4163636570742d456e636f64696e673a206964656e746974790d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"jupyter-audit","community_id":"1:twpjKCVsWBoRR5jpGLRZbFGQPB0=","ja3":"","session":"702bbc2e-183c-4076-a8af-3ec80198014a","seq":1,"duration_ms":100,"bytes_in":153,"bytes_out":79},{"timestamp":"2026-07-08T04:30:05","port":8888,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"application/json\",\"accept-encoding\":\"identity\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8888\",\"user-agent\":\"jupyter-audit\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/api/kernels","summary":"","payload_hex":"474554202f6170692f6b65726e656c7320485454502f312e310d0a486f73743a20<HONEYPOT>3a383838380d0a557365722d4167656e743a206a7570797465722d61756469740d0a4163636570743a206170706c69636174696f6e2f6a736f6e0d0a4163636570742d456e636f64696e673a206964656e746974790d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"jupyter-audit","community_id":"1:wqi2wm++uo0CX+7CDj11l7nfN+0=","ja3":"","session":"5159d37c-8e95-4fe5-a496-bc4a54e2f4e8","seq":1,"duration_ms":100,"bytes_in":153,"bytes_out":79},{"timestamp":"2026-07-08T04:26:31","port":8888,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"application/json\",\"accept-encoding\":\"identity\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8888\",\"user-agent\":\"jupyter-audit\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/api/kernels","summary":"","payload_hex":"474554202f6170692f6b65726e656c7320485454502f312e310d0a486f73743a20<HONEYPOT>3a383838380d0a557365722d4167656e743a206a7570797465722d61756469740d0a4163636570743a206170706c69636174696f6e2f6a736f6e0d0a4163636570742d456e636f64696e673a206964656e746974790d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"jupyter-audit","community_id":"1:QWYt/HxRCUDt+MEXIwhv5NOBqIs=","ja3":"","session":"3438792e-dbd4-4692-a1d9-29228513fc99","seq":1,"duration_ms":100,"bytes_in":154,"bytes_out":79},{"timestamp":"2026-07-07T17:52:08","port":8888,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"application/json,text/html,*/*\",\"accept-encoding\":\"identity\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8888\",\"user-agent\":\"jupyter-local-audit\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/login","summary":"","payload_hex":"474554202f6c6f67696e20485454502f312e310d0a486f73743a20<HONEYPOT>3a383838380d0a557365722d4167656e743a206a7570797465722d6c6f63616c2d61756469740d0a4163636570743a206170706c69636174696f6e2f6a736f6e2c746578742f68746d6c2c2a2f2a0d0a4163636570742d456e636f64696e673a206964656e746974790d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"jupyter-local-audit","community_id":"1:R+JQ2aI2q5Ce9MgHWSz+ni+Rr4c=","ja3":"","session":"dace27ea-a20c-4fc2-af2f-83af15c9c8e9","seq":1,"duration_ms":100,"bytes_in":167,"bytes_out":79},{"timestamp":"2026-07-07T17:52:08","port":8888,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"application/json,text/html,*/*\",\"accept-encoding\":\"identity\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8888\",\"user-agent\":\"jupyter-local-audit\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/tree","summary":"","payload_hex":"474554202f7472656520485454502f312e310d0a486f73743a20<HONEYPOT>3a383838380d0a557365722d4167656e743a206a7570797465722d6c6f63616c2d61756469740d0a4163636570743a206170706c69636174696f6e2f6a736f6e2c746578742f68746d6c2c2a2f2a0d0a4163636570742d456e636f64696e673a206964656e746974790d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"jupyter-local-audit","community_id":"1:8nP6G79+wtBtUQ9xugC9+C7qe4Q=","ja3":"","session":"1bab840e-a6b5-4736-a18e-1509ee0f7ca8","seq":1,"duration_ms":100,"bytes_in":166,"bytes_out":79},{"timestamp":"2026-07-07T17:52:08","port":8888,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"application/json,text/html,*/*\",\"accept-encoding\":\"identity\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8888\",\"user-agent\":\"jupyter-local-audit\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/lab","summary":"","payload_hex":"474554202f6c616220485454502f312e310d0a486f73743a20<HONEYPOT>3a383838380d0a557365722d4167656e743a206a7570797465722d6c6f63616c2d61756469740d0a4163636570743a206170706c69636174696f6e2f6a736f6e2c746578742f68746d6c2c2a2f2a0d0a4163636570742d456e636f64696e673a206964656e746974790d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"jupyter-local-audit","community_id":"1:msXFELlaI2w8GMGQ4zqKHWHxTiI=","ja3":"","session":"5a2e9b6c-a0df-4aa4-93b0-a61565acdc1f","seq":1,"duration_ms":100,"bytes_in":165,"bytes_out":79},{"timestamp":"2026-07-07T17:52:08","port":8888,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"application/json,text/html,*/*\",\"accept-encoding\":\"identity\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8888\",\"user-agent\":\"jupyter-local-audit\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/api","summary":"","payload_hex":"474554202f61706920485454502f312e310d0a486f73743a20<HONEYPOT>3a383838380d0a557365722d4167656e743a206a7570797465722d6c6f63616c2d61756469740d0a4163636570743a206170706c69636174696f6e2f6a736f6e2c746578742f68746d6c2c2a2f2a0d0a4163636570742d456e636f64696e673a206964656e746974790d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"jupyter-local-audit","community_id":"1:0VUERIpLcJaqfOBBimgFG99aTEc=","ja3":"","session":"0ebf2d97-45d2-42e2-b451-9679794801c1","seq":1,"duration_ms":100,"bytes_in":165,"bytes_out":79},{"timestamp":"2026-07-07T17:52:08","port":8888,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"application/json,text/html,*/*\",\"accept-encoding\":\"identity\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8888\",\"user-agent\":\"jupyter-local-audit\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/api/contents","summary":"","payload_hex":"474554202f6170692f636f6e74656e747320485454502f312e310d0a486f73743a20<HONEYPOT>3a383838380d0a557365722d4167656e743a206a7570797465722d6c6f63616c2d61756469740d0a4163636570743a206170706c69636174696f6e2f6a736f6e2c746578742f68746d6c2c2a2f2a0d0a4163636570742d456e636f64696e673a206964656e746974790d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"jupyter-local-audit","community_id":"1:n6pxP2HeW0fAsZcxRvxtLE4ASYw=","ja3":"","session":"ef1ab294-ecbf-4534-9cfb-82ba905e4a7a","seq":1,"duration_ms":100,"bytes_in":174,"bytes_out":79},{"timestamp":"2026-07-07T17:52:08","port":8888,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"application/json,text/html,*/*\",\"accept-encoding\":\"identity\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8888\",\"user-agent\":\"jupyter-local-audit\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/api/terminals","summary":"","payload_hex":"474554202f6170692f7465726d696e616c7320485454502f312e310d0a486f73743a20<HONEYPOT>3a383838380d0a557365722d4167656e743a206a7570797465722d6c6f63616c2d61756469740d0a4163636570743a206170706c69636174696f6e2f6a736f6e2c746578742f68746d6c2c2a2f2a0d0a4163636570742d456e636f64696e673a206964656e746974790d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"jupyter-local-audit","community_id":"1:1fFeMEmPE0Djo0UgkgDvKkvrjTk=","ja3":"","session":"f0dbae17-0b53-468c-8e09-329b774e0bc5","seq":1,"duration_ms":100,"bytes_in":175,"bytes_out":79},{"timestamp":"2026-07-07T17:52:08","port":8888,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"application/json,text/html,*/*\",\"accept-encoding\":\"identity\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8888\",\"user-agent\":\"jupyter-local-audit\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/api/kernels","summary":"","payload_hex":"474554202f6170692f6b65726e656c7320485454502f312e310d0a486f73743a20<HONEYPOT>3a383838380d0a557365722d4167656e743a206a7570797465722d6c6f63616c2d61756469740d0a4163636570743a206170706c69636174696f6e2f6a736f6e2c746578742f68746d6c2c2a2f2a0d0a4163636570742d456e636f64696e673a206964656e746974790d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"jupyter-local-audit","community_id":"1:tP2sJcjLFHzlAxeh6JaOspUTVSM=","ja3":"","session":"3322b19f-2667-4d4a-90fd-17d11dab2cf3","seq":1,"duration_ms":101,"bytes_in":173,"bytes_out":79}],"http_methods":[{"method":"GET","count":61}],"distinct_ports_total":2,"top_paths":[{"path":"/api/version","count":8,"ports":1},{"path":"/api/kernels","count":8,"ports":1},{"path":"/api","count":6,"ports":1},{"path":"/api/status","count":6,"ports":1},{"path":"/login","count":5,"ports":1},{"path":"/tree","count":5,"ports":1},{"path":"/api/sessions","count":5,"ports":1},{"path":"/lab","count":4,"ports":1},{"path":"/api/nodes","count":4,"ports":1},{"path":"/api/cluster","count":4,"ports":1},{"path":"/api/contents","count":3,"ports":1},{"path":"/api/terminals","count":3,"ports":1}],"distinct_paths_total":12,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","Accept-Encoding","Connection","Host","User-Agent"],"representative":[{"name":"Accept","value":"application/json","notable":false},{"name":"Accept-Encoding","value":"identity","notable":false},{"name":"Connection","value":"close","notable":false},{"name":"Host","value":"<HONEYPOT>:8888","notable":false},{"name":"User-Agent","value":"jupyter-audit","notable":false}],"distinct_sets":1,"events_with_headers":10},"tags":[{"tag_id":"CVE-2025-2129","tag_type":"cve","title":"Mage AI - Insecure Default Authentication Setup","severity":"medium","actively_exploited":false,"match_field":"url_path","matched_pattern":"/api/kernels","reference_urls":["https://nvd.nist.gov/vuln/detail/CVE-2025-2129","https://github.com/zn9988/publications/blob/main/2.Mage-AI%20-%20Insecure%20Default%20Authentication%20Setup%20Leading%20to%20Zero-Click%20RCE/README.md","https://vuldb.com/?ctiid.299049","https://vuldb.com/?id.299049","https://vuldb.com/?submit.510690"]}],"data_as_of":"2026-07-09T04:10:42.121755+00:00"}