{"ip":"160.119.76.106","total_events":106,"verdict":{"verdict":"scanning","label":"Scanning for known vulnerabilities","detail":"1 exploit-path probe(s)","confidence":"medium","network_type":"residential ISP","why":["1 request(s) matched a known exploit path.","Only GET/HEAD seen, no request body: scanning for the vulnerability, not delivering a payload.","Not in any known-scanner range."]},"first_seen":"2026-07-05T18:50:41","last_seen":"2026-07-15T19:38:21","events_24h":0,"events_7d":0,"geo":{"country_code":"SC","country_name":"Seychelles","region":"","city":"","lat":-4.5833,"lon":55.6667,"asn":49870,"org":"Alsycon B.V."},"source_domain":"160-119-76-106.ptr.as49870.net","known_scanners":[],"scanner_tag":{"key":"peeringdb:as49870","label":"Alsycon AS49870","category":"isp","url":"https://www.peeringdb.com/asn/49870"},"cve_matches":[{"cve_id":"CVE-2025-64328","title":"FreePBX  >= 17.0.2.36 && < 17.0.3 - Authenticated Command Injection","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/admin/config.php"}],"malware":[],"top_ports":[{"port":443,"proto":"tcp","label":"HTTPS","count":40},{"port":80,"proto":"tcp","label":"HTTP","count":37},{"port":8080,"proto":"tcp","label":"HTTP-alt","count":29}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t12i700500_b8b0f76b4bb5_a1e935682795"],"tls_ja3":["7233131c9641dc3d3c77395c1ff2e9b6"],"ja4h":["ge11nn0500_7a35dc74a363"]},"fingerprint_peers":{"t12i700500_b8b0f76b4bb5_a1e935682795":2,"ge11nn0500_7a35dc74a363":41},"user_agents":["python-requests/2.6.0 CPython/2.7.5 Linux/3.10.0-1160.119.1.el7.x86_64"],"timeline":[{"date":"2026-07-05","count":22},{"date":"2026-07-06","count":24},{"date":"2026-07-12","count":26},{"date":"2026-07-14","count":12},{"date":"2026-07-15","count":22}],"recent_events":[{"timestamp":"2026-07-15T19:38:21","port":80,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:80\",\"user-agent\":\"python-requests/2.6.0 CPython/2.7.5 Linux/3.10.0-1160.119.1.el7.x86_64\"}","body":"","sni":"","tls_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","tls_version":"TLSv1.2","alpn":[],"url_path":"//admin/config.php","summary":"","payload_hex":"474554202f2f61646d696e2f636f6e6669672e70687020485454502f312e310d0a486f73743a20<HONEYPOT>3a38300d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a4163636570743a202a2f2a0d0a557365722d4167656e743a20707974686f6e2d72657175657374732f322e362e302043507974686f6e2f322e372e35204c696e75782f332e31302e302d313136302e3131392e312e656c372e7838365f36340d0a0d0a","method":"GET","user_agent":"python-requests/2.6.0 CPython/2.7.5 Linux/3.10.0-1160.119.1.el7.x86_64","community_id":"1:uXT6ZLcX+w/COzkL6YRD9JPZvuA=","ja3":"7233131c9641dc3d3c77395c1ff2e9b6","session":"791fc718-a26f-42c7-9340-426202da138e","seq":1,"duration_ms":204,"bytes_in":211,"bytes_out":79},{"timestamp":"2026-07-15T19:38:21","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"python-requests/2.6.0 CPython/2.7.5 Linux/3.10.0-1160.119.1.el7.x86_64\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"//admin/config.php","summary":"","payload_hex":"474554202f2f61646d696e2f636f6e6669672e70687020485454502f312e310d0a486f73743a20<HONEYPOT>0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a4163636570743a202a2f2a0d0a557365722d4167656e743a20707974686f6e2d72657175657374732f322e362e302043507974686f6e2f322e372e35204c696e75782f332e31302e302d313136302e3131392e312e656c372e7838365f36340d0a0d0a","method":"GET","user_agent":"python-requests/2.6.0 CPython/2.7.5 Linux/3.10.0-1160.119.1.el7.x86_64","community_id":"1:sVhybJKDODoPYsnerJkfBhplFHg=","ja3":"","session":"42c6848d-64d9-4ea1-a9cd-e97aed600879","seq":1,"duration_ms":100,"bytes_in":208,"bytes_out":79},{"timestamp":"2026-07-15T19:36:49","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"python-requests/2.6.0 CPython/2.7.5 Linux/3.10.0-1160.119.1.el7.x86_64\"}","body":"","sni":"","tls_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","tls_version":"TLSv1.2","alpn":[],"url_path":"//admin/config.php","summary":"","payload_hex":"474554202f2f61646d696e2f636f6e6669672e70687020485454502f312e310d0a486f73743a20<HONEYPOT>0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a4163636570743a202a2f2a0d0a557365722d4167656e743a20707974686f6e2d72657175657374732f322e362e302043507974686f6e2f322e372e35204c696e75782f332e31302e302d313136302e3131392e312e656c372e7838365f36340d0a0d0a","method":"GET","user_agent":"python-requests/2.6.0 CPython/2.7.5 Linux/3.10.0-1160.119.1.el7.x86_64","community_id":"1:QfqHYTocw1PlpiC0vR2m168LOHQ=","ja3":"7233131c9641dc3d3c77395c1ff2e9b6","session":"e1b374c2-c850-46b5-b09e-88575d39d710","seq":1,"duration_ms":194,"bytes_in":208,"bytes_out":79},{"timestamp":"2026-07-15T19:36:48","port":443,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:443\",\"user-agent\":\"python-requests/2.6.0 CPython/2.7.5 Linux/3.10.0-1160.119.1.el7.x86_64\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"//admin/config.php","summary":"","payload_hex":"474554202f2f61646d696e2f636f6e6669672e70687020485454502f312e310d0a486f73743a20<HONEYPOT>3a3434330d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a4163636570743a202a2f2a0d0a557365722d4167656e743a20707974686f6e2d72657175657374732f322e362e302043507974686f6e2f322e372e35204c696e75782f332e31302e302d313136302e3131392e312e656c372e7838365f36340d0a0d0a","method":"GET","user_agent":"python-requests/2.6.0 CPython/2.7.5 Linux/3.10.0-1160.119.1.el7.x86_64","community_id":"1:zMqw0PEg5a7KWXSQ6GkqXA2xl6o=","ja3":"","session":"1c363bb8-9863-4824-b9a0-2cf259156662","seq":1,"duration_ms":100,"bytes_in":212,"bytes_out":79},{"timestamp":"2026-07-15T19:36:28","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"python-requests/2.6.0 CPython/2.7.5 Linux/3.10.0-1160.119.1.el7.x86_64\"}","body":"","sni":"","tls_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","tls_version":"TLSv1.2","alpn":[],"url_path":"//admin/config.php","summary":"","payload_hex":"474554202f2f61646d696e2f636f6e6669672e70687020485454502f312e310d0a486f73743a20<HONEYPOT>0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a4163636570743a202a2f2a0d0a557365722d4167656e743a20707974686f6e2d72657175657374732f322e362e302043507974686f6e2f322e372e35204c696e75782f332e31302e302d313136302e3131392e312e656c372e7838365f36340d0a0d0a","method":"GET","user_agent":"python-requests/2.6.0 CPython/2.7.5 Linux/3.10.0-1160.119.1.el7.x86_64","community_id":"1:z8p3fnaKXQXktL3qFLPNERhQtpU=","ja3":"7233131c9641dc3d3c77395c1ff2e9b6","session":"d3c1ff59-a34f-4a28-b1a3-0bc84bc484c8","seq":1,"duration_ms":198,"bytes_in":208,"bytes_out":79},{"timestamp":"2026-07-15T19:36:27","port":443,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:443\",\"user-agent\":\"python-requests/2.6.0 CPython/2.7.5 Linux/3.10.0-1160.119.1.el7.x86_64\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"//admin/config.php","summary":"","payload_hex":"474554202f2f61646d696e2f636f6e6669672e70687020485454502f312e310d0a486f73743a20<HONEYPOT>3a3434330d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a4163636570743a202a2f2a0d0a557365722d4167656e743a20707974686f6e2d72657175657374732f322e362e302043507974686f6e2f322e372e35204c696e75782f332e31302e302d313136302e3131392e312e656c372e7838365f36340d0a0d0a","method":"GET","user_agent":"python-requests/2.6.0 CPython/2.7.5 Linux/3.10.0-1160.119.1.el7.x86_64","community_id":"1:Bbc0d1s7m72CQEYyJZVbKmutaOk=","ja3":"","session":"cb6f48df-59e6-4eb8-ad23-b0226fec97e4","seq":1,"duration_ms":100,"bytes_in":212,"bytes_out":79},{"timestamp":"2026-07-15T19:36:16","port":80,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:80\",\"user-agent\":\"python-requests/2.6.0 CPython/2.7.5 Linux/3.10.0-1160.119.1.el7.x86_64\"}","body":"","sni":"","tls_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","tls_version":"TLSv1.2","alpn":[],"url_path":"//admin/config.php","summary":"","payload_hex":"474554202f2f61646d696e2f636f6e6669672e70687020485454502f312e310d0a486f73743a20<HONEYPOT>3a38300d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a4163636570743a202a2f2a0d0a557365722d4167656e743a20707974686f6e2d72657175657374732f322e362e302043507974686f6e2f322e372e35204c696e75782f332e31302e302d313136302e3131392e312e656c372e7838365f36340d0a0d0a","method":"GET","user_agent":"python-requests/2.6.0 CPython/2.7.5 Linux/3.10.0-1160.119.1.el7.x86_64","community_id":"1:LAUdgy2Yiysn/+QApnHMAb1Zg2I=","ja3":"7233131c9641dc3d3c77395c1ff2e9b6","session":"36669905-a62f-47b4-b845-30e9af57870a","seq":1,"duration_ms":194,"bytes_in":211,"bytes_out":79},{"timestamp":"2026-07-15T19:36:16","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"python-requests/2.6.0 CPython/2.7.5 Linux/3.10.0-1160.119.1.el7.x86_64\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"//admin/config.php","summary":"","payload_hex":"474554202f2f61646d696e2f636f6e6669672e70687020485454502f312e310d0a486f73743a20<HONEYPOT>0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a4163636570743a202a2f2a0d0a557365722d4167656e743a20707974686f6e2d72657175657374732f322e362e302043507974686f6e2f322e372e35204c696e75782f332e31302e302d313136302e3131392e312e656c372e7838365f36340d0a0d0a","method":"GET","user_agent":"python-requests/2.6.0 CPython/2.7.5 Linux/3.10.0-1160.119.1.el7.x86_64","community_id":"1:CDMZJnT42h5I9BU1CZwWA7r+m+c=","ja3":"","session":"b106b2ec-e180-423f-8f5b-29961a349c66","seq":1,"duration_ms":100,"bytes_in":208,"bytes_out":79},{"timestamp":"2026-07-15T19:28:04","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"python-requests/2.6.0 CPython/2.7.5 Linux/3.10.0-1160.119.1.el7.x86_64\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a4163636570743a202a2f2a0d0a557365722d4167656e743a20707974686f6e2d72657175657374732f322e362e302043507974686f6e2f322e372e35204c696e75782f332e31302e302d313136302e3131392e312e656c372e7838365f36340d0a0d0a","method":"GET","user_agent":"python-requests/2.6.0 CPython/2.7.5 Linux/3.10.0-1160.119.1.el7.x86_64","community_id":"1:WoTsiPPOah+YEm1jaH4zZmXN3Q4=","ja3":"","session":"dbd59190-1ac7-4dd6-a354-2ab52d9ee53e","seq":1,"duration_ms":100,"bytes_in":191,"bytes_out":79},{"timestamp":"2026-07-15T19:28:04","port":80,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:80\",\"user-agent\":\"python-requests/2.6.0 CPython/2.7.5 Linux/3.10.0-1160.119.1.el7.x86_64\"}","body":"","sni":"","tls_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","tls_version":"TLSv1.2","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a38300d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a4163636570743a202a2f2a0d0a557365722d4167656e743a20707974686f6e2d72657175657374732f322e362e302043507974686f6e2f322e372e35204c696e75782f332e31302e302d313136302e3131392e312e656c372e7838365f36340d0a0d0a","method":"GET","user_agent":"python-requests/2.6.0 CPython/2.7.5 Linux/3.10.0-1160.119.1.el7.x86_64","community_id":"1:Ca3TNPsUhsQqKxsEoK5IuV5Fz0w=","ja3":"7233131c9641dc3d3c77395c1ff2e9b6","session":"a503950e-5fba-404e-ae43-199affc864a7","seq":1,"duration_ms":206,"bytes_in":194,"bytes_out":79}],"http_methods":[{"method":"GET","count":106}],"distinct_ports_total":3,"top_paths":[{"path":"/","count":60,"ports":3},{"path":"//admin/config.php","count":46,"ports":3}],"distinct_paths_total":2,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","Accept-Encoding","Connection","Host","User-Agent"],"representative":[{"name":"Accept","value":"*/*","notable":false},{"name":"Accept-Encoding","value":"gzip, deflate","notable":false},{"name":"Connection","value":"keep-alive","notable":false},{"name":"Host","value":"<HONEYPOT>:80","notable":false},{"name":"User-Agent","value":"python-requests/2.6.0 CPython/2.7.5 Linux/3.10.0-1160.119.1.el7.x86_64","notable":false}],"distinct_sets":1,"events_with_headers":10},"tags":[{"tag_id":"CVE-2025-64328","tag_type":"cve","title":"FreePBX  >= 17.0.2.36 && < 17.0.3 - Authenticated Command Injection","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/admin/config.php","reference_urls":["https://github.com/FreePBX/security-reporting/security/advisories/GHSA-vm9p-46mv-5xvw","https://theyhack.me/CVE-2025-64328-FreePBX-Authenticated-Command-Injection/","https://www.cisa.gov/news-events/alerts/2026/02/03/cisa-adds-four-known-exploited-vulnerabilities-catalog"]}],"data_as_of":"2026-07-27T02:07:47.547182+00:00"}