{"ip":"161.120.180.21","data_as_of":"2026-10-26T21:56:05+00:00","observed":true,"total_events":63,"verdict":{"verdict":"malicious","label":"Exploit attempts observed","detail":"3 exploit-path hits","confidence":"high","network_type":"CDN","why":["3 request(s) matched a known exploit path.","Requests with a body (POST, PUT, PATCH or DELETE) were seen, which carries a payload.","Under 5 hits, so confidence is medium.","Not in any known-scanner range.","Sent 15,290 bytes, which is sustained payload delivery.","Counts include 25 interactive session(s) as well as first-packet events.","Interactive sessions: 3 interactive session(s) carried an exploit attempt."],"engagement":{"level":"payload","label":"Sustained payload","detail":"15,290 bytes sent","bytes_sent":15290,"session_seconds":47,"persistent":false},"basis":"combined"},"first_seen":"2026-10-15T09:31:29","last_seen":"2026-10-26T16:42:25","events_24h":4,"events_7d":45,"interactive_sessions":25,"interactive_sessions_24h":0,"interactive_sessions_7d":20,"interactive_protocols":[{"protocol":"http","sessions":13},{"protocol":"redis","sessions":4},{"protocol":"ssh","sessions":2},{"protocol":"mongodb","sessions":1}],"geo":{"country_code":"CN","country_name":"China","region":"","city":"","lat":34.7732,"lon":113.722,"asn":132203,"org":"Tencent Building, Kejizhongyi Avenue"},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as132203","label":"Tencent Global","category":"cdn","url":"https://www.peeringdb.com/asn/132203"},"cve_matches":[],"malware":[{"sha256":"86f7758739d6a25b6e9e1dced5827618d433e253265689d36adcf2e95968c452","family":"","vt_name":"rs.sh","malicious":0,"total":75,"vt_status":"known","delivery":"interactive session","url_path":"","dest_port":6379,"hits":2,"last_seen":"2026-10-18 09:39:42"}],"udp":null,"interaction":{"window_days":90,"sessions":25,"first_seen":"2026-10-18T09:35:37","last_seen":"2026-10-22T16:26:49","verdicts":[{"verdict":"unknown","sessions":12},{"verdict":"scan","sessions":10},{"verdict":"upload","sessions":2},{"verdict":"exploit-attempt","sessions":1}],"personas":[{"persona":"nginx@1.24.0, wordpress@6.5.2, leaks@2, miner@bfgminer 5.5.0, elasticsearch@6.8.23, winrm@Windows Server 2016, fortigate@7.0.5, gitlab@19.4.2","sessions":9},{"persona":"redis@6.2.14","sessions":3},{"persona":"nginx@1.24.0, wordpress@6.5.2, leaks@2, miner@bfgminer 5.5.0, elasticsearch@6.8.23, winrm@Windows Server 2016, fortigate@7.0.5, docker@25.0.3, gitlab@19.4.2","sessions":2},{"persona":"linux-ubuntu@20.04","sessions":2},{"persona":"nginx@1.24.0, wordpress@6.5.2, leaks@2, miner@bfgminer 5.5.0, elasticsearch@6.8.23, winrm@Windows Server 2016, dlink-dir645@1.01, fortigate@7.0.5, gitlab@19.4.2","sessions":2},{"persona":"redis@7.2.4","sessions":1},{"persona":"mongodb@6.0.15","sessions":1}],"services":[{"protocol":"redis","port":6379,"sessions":4},{"protocol":"http","port":9200,"sessions":2},{"protocol":"http","port":8080,"sessions":2},{"protocol":"ssh","port":22,"sessions":2},{"protocol":"http","port":8983,"sessions":2},{"protocol":"http","port":2375,"sessions":2},{"protocol":"tcp","port":5601,"sessions":1},{"protocol":"http","port":8848,"sessions":1},{"protocol":"tcp","port":8088,"sessions":1},{"protocol":"tcp","port":8500,"sessions":1},{"protocol":"tcp","port":9000,"sessions":1},{"protocol":"http","port":5601,"sessions":1}],"logins":[],"commands":[],"downloads":[{"url":"[http]://89[.]36[.]231[.]178:8080/rs.sh","host":"89[.]36[.]231[.]178","sessions":1,"first_seen":"2026-10-18T09:39:42","last_seen":"2026-10-18T09:39:42","virustotal":{"sha256":"86f7758739d6a25b6e9e1dced5827618d433e253265689d36adcf2e95968c452","status":"known","malicious":0,"total":75,"name":"rs.sh"}}],"files":[{"sha256":"dcebbe88a962afa446af41ec7e6e042e98f01da92433f441d63e3a4501b1a3ab","name":"zz","size":101,"mime_type":"text/plain","kind":"redis-value","times":1,"first_seen":"2026-10-18T09:53:24","last_seen":"2026-10-18T09:53:24","virustotal":null},{"sha256":"74a43e15caf918b5e34f00b379e34d50905516fd8abc7e04b9fda49dd3cd91b9","name":"zz","size":77,"mime_type":"text/plain","kind":"redis-value","times":1,"first_seen":"2026-10-18T09:39:27","last_seen":"2026-10-18T09:39:27","virustotal":null},{"sha256":"9824d035d9c0da1b3f1f8bc8bffab824fc4cbc13260def0d4c58703ba98ecb51","name":"zz","size":89,"mime_type":"text/plain","kind":"redis-value","times":1,"first_seen":"2026-10-18T09:39:06","last_seen":"2026-10-18T09:39:06","virustotal":null}],"attack":[{"technique_id":"T1595","technique_name":"Active Scanning","tactic_id":"TA0043","tactic_name":"Reconnaissance","sessions":10},{"technique_id":"T1190","technique_name":"Exploit Public-Facing Application","tactic_id":"TA0001","tactic_name":"Initial Access","sessions":3},{"technique_id":"T1105","technique_name":"Ingress Tool Transfer","tactic_id":"TA0011","tactic_name":"Command and Control","sessions":1}]},"top_ports":[{"port":80,"proto":"tcp","label":"HTTP","count":23,"sessions":0},{"port":443,"proto":"tcp","label":"HTTPS","count":22,"sessions":0},{"port":8983,"proto":"tcp","label":"Solr","count":5,"sessions":2},{"port":8500,"proto":"tcp","label":"","count":2,"sessions":2},{"port":5601,"proto":"tcp","label":"Kibana","count":2,"sessions":2},{"port":8848,"proto":"tcp","label":"","count":2,"sessions":2},{"port":2375,"proto":"tcp","label":"Docker","count":2,"sessions":2},{"port":8088,"proto":"tcp","label":"Hadoop","count":2,"sessions":2},{"port":6379,"proto":"tcp","label":"Redis","count":0,"sessions":4},{"port":9000,"proto":"tcp","label":"Web-alt","count":1,"sessions":2},{"port":9200,"proto":"tcp","label":"Elastic","count":1,"sessions":2},{"port":8080,"proto":"tcp","label":"HTTP-alt","count":1,"sessions":2},{"port":22,"proto":"tcp","label":"SSH","count":0,"sessions":2},{"port":27017,"proto":"tcp","label":"MongoDB","count":0,"sessions":1}],"fingerprints":{"ssh_hassh":["aae6b9604f6f3356543709a376d7f657"],"tls_ja4":["t13i171000_ab0a1bf427ad_8e6e362c5eac","t13i3111h2_e8f1e7e78f70_b26ce05bbdd6"],"tls_client_hello":"1603010200010001fc03030b55dfd3fe9a2b8d4c5f3a989452486bdbc0b868cfdb9630467e68e1641dd801207919b77fbe09504ec18c197a10bacc1800c69e8e64a9ee35a4ba557668192c73003e130213031301c02cc030009fcca9cca8ccaac02bc02f009ec024c028006bc023c0270067c00ac0140039c009c0130033009d009c003d003c0035002f00ff01000175000b000403000102000a00160014001d0017001e00190018010001010102010301040010000e000c02683208687474702f312e31001600000017000000310000000d002a0028040305030603080708080809080a080b080408050806040105010601030303010302040205020602002b00050403040303002d00020101003300260024001d0020bf2e046f6189a99f194d685f777827e708672c9ac95dd63b5555d03ecc5b5273001500ca00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000","tls_ja3":["dbb158bbf02cb040164d288c9b1d8492","78f0dc5ac5b19daf131a133cfdee9691"],"http_akin":["b11cun040_00040013_608dab68","b11cuq050_00050814_6eb31df9","b11cun030_00040014_54d07b6d","b11cun060_0004003e_aca8413f"],"interactive":{"ssh_hassh":["aae6b9604f6f3356543709a376d7f657"],"tls_ja4":["t13i171000_ab0a1bf427ad_8e6e362c5eac"],"tls_ja3":["dbb158bbf02cb040164d288c9b1d8492"]}},"fingerprint_peers":{"t13i3111h2_e8f1e7e78f70_b26ce05bbdd6":20,"b11cun040_00040013_608dab68":4346,"b11cuq050_00050814_6eb31df9":122,"b11cun030_00040014_54d07b6d":3814,"t13i171000_ab0a1bf427ad_8e6e362c5eac":52,"aae6b9604f6f3356543709a376d7f657":1,"b11cun060_0004003e_aca8413f":3},"akin_families":{"b11cuq050_00050814_6eb31df9":{"head":"b11cuq050_00050814_6eb31df9","shapes":4,"ips":122},"b11cun030_00040014_54d07b6d":{"head":"b11cun030_00040014_54d07b6d","shapes":2,"ips":3814}},"user_agents":["Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/131","curl/8.0","Mozilla/5.0","Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"],"timeline":[{"date":"2026-10-15","count":5,"sessions":0},{"date":"2026-10-16","count":3,"sessions":0},{"date":"2026-10-17","count":2,"sessions":0},{"date":"2026-10-18","count":4,"sessions":5},{"date":"2026-10-19","count":4,"sessions":0},{"date":"2026-10-20","count":4,"sessions":0},{"date":"2026-10-21","count":4,"sessions":0},{"date":"2026-10-22","count":21,"sessions":20},{"date":"2026-10-23","count":4,"sessions":0},{"date":"2026-10-24","count":4,"sessions":0},{"date":"2026-10-25","count":4,"sessions":0},{"date":"2026-10-26","count":4,"sessions":0}],"recent_events":[{"timestamp":"2026-10-26T16:42:25","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"content-length\":\"25\",\"content-type\":\"application/x-www-form-urlencoded\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/131\"}","body":"action=super_create_nonce","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/wp-admin/admin-ajax.php","summary":"","payload_hex":"504f5354202f77702d61646d696e2f61646d696e2d616a61782e70687020485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204368726f6d652f3133310d0a4163636570743a202a2f2a0d0a436f6e74656e742d4c656e6774683a2032350d0a436f6e74656e742d547970653a206170706c69636174696f6e2f782d7777772d666f726d2d75726c656e636f6465640d0a0d0a616374696f6e3d73757065725f6372656174655f6e6f6e6365","method":"POST","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/131","ja3":"","session":"37a65ffb-e09b-472f-83a2-27e883c92a90","seq":1,"duration_ms":100,"bytes_in":236,"bytes_out":79},{"timestamp":"2026-10-26T16:42:24","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"content-length\":\"25\",\"content-type\":\"application/x-www-form-urlencoded\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/131\"}","body":"action=super_create_nonce","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/wp-admin/admin-ajax.php","summary":"","payload_hex":"504f5354202f77702d61646d696e2f61646d696e2d616a61782e70687020485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204368726f6d652f3133310d0a4163636570743a202a2f2a0d0a436f6e74656e742d4c656e6774683a2032350d0a436f6e74656e742d547970653a206170706c69636174696f6e2f782d7777772d666f726d2d75726c656e636f6465640d0a0d0a616374696f6e3d73757065725f6372656174655f6e6f6e6365","method":"POST","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/131","ja3":"78f0dc5ac5b19daf131a133cfdee9691","session":"c21bb50e-492d-41e6-ba7b-6f536165c15d","seq":1,"duration_ms":101,"bytes_in":236,"bytes_out":79},{"timestamp":"2026-10-26T04:02:13","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"content-length\":\"25\",\"content-type\":\"application/x-www-form-urlencoded\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/131\"}","body":"action=super_create_nonce","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/wp-admin/admin-ajax.php","summary":"","payload_hex":"504f5354202f77702d61646d696e2f61646d696e2d616a61782e70687020485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204368726f6d652f3133310d0a4163636570743a202a2f2a0d0a436f6e74656e742d4c656e6774683a2032350d0a436f6e74656e742d547970653a206170706c69636174696f6e2f782d7777772d666f726d2d75726c656e636f6465640d0a0d0a616374696f6e3d73757065725f6372656174655f6e6f6e6365","method":"POST","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/131","ja3":"","session":"2d25275f-449e-4593-9f91-5669c4dfe301","seq":1,"duration_ms":100,"bytes_in":236,"bytes_out":79},{"timestamp":"2026-10-26T04:02:12","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"content-length\":\"25\",\"content-type\":\"application/x-www-form-urlencoded\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/131\"}","body":"action=super_create_nonce","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/wp-admin/admin-ajax.php","summary":"","payload_hex":"504f5354202f77702d61646d696e2f61646d696e2d616a61782e70687020485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204368726f6d652f3133310d0a4163636570743a202a2f2a0d0a436f6e74656e742d4c656e6774683a2032350d0a436f6e74656e742d547970653a206170706c69636174696f6e2f782d7777772d666f726d2d75726c656e636f6465640d0a0d0a616374696f6e3d73757065725f6372656174655f6e6f6e6365","method":"POST","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/131","ja3":"78f0dc5ac5b19daf131a133cfdee9691","session":"0fcdd644-b8ff-4f09-bac2-3b3c6f556464","seq":1,"duration_ms":101,"bytes_in":236,"bytes_out":79},{"timestamp":"2026-10-25T15:28:35","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"content-length\":\"25\",\"content-type\":\"application/x-www-form-urlencoded\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/131\"}","body":"action=super_create_nonce","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/wp-admin/admin-ajax.php","summary":"","payload_hex":"504f5354202f77702d61646d696e2f61646d696e2d616a61782e70687020485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204368726f6d652f3133310d0a4163636570743a202a2f2a0d0a436f6e74656e742d4c656e6774683a2032350d0a436f6e74656e742d547970653a206170706c69636174696f6e2f782d7777772d666f726d2d75726c656e636f6465640d0a0d0a616374696f6e3d73757065725f6372656174655f6e6f6e6365","method":"POST","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/131","ja3":"","session":"93ffb8e8-d6d3-44e8-b6f9-7df1d8075453","seq":1,"duration_ms":100,"bytes_in":236,"bytes_out":79},{"timestamp":"2026-10-25T15:28:34","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"content-length\":\"25\",\"content-type\":\"application/x-www-form-urlencoded\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/131\"}","body":"action=super_create_nonce","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/wp-admin/admin-ajax.php","summary":"","payload_hex":"504f5354202f77702d61646d696e2f61646d696e2d616a61782e70687020485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204368726f6d652f3133310d0a4163636570743a202a2f2a0d0a436f6e74656e742d4c656e6774683a2032350d0a436f6e74656e742d547970653a206170706c69636174696f6e2f782d7777772d666f726d2d75726c656e636f6465640d0a0d0a616374696f6e3d73757065725f6372656174655f6e6f6e6365","method":"POST","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/131","ja3":"78f0dc5ac5b19daf131a133cfdee9691","session":"8f71546e-7fef-4602-ae45-454cd66952aa","seq":1,"duration_ms":100,"bytes_in":236,"bytes_out":79},{"timestamp":"2026-10-25T03:00:30","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"content-length\":\"25\",\"content-type\":\"application/x-www-form-urlencoded\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/131\"}","body":"action=super_create_nonce","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/wp-admin/admin-ajax.php","summary":"","payload_hex":"504f5354202f77702d61646d696e2f61646d696e2d616a61782e70687020485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204368726f6d652f3133310d0a4163636570743a202a2f2a0d0a436f6e74656e742d4c656e6774683a2032350d0a436f6e74656e742d547970653a206170706c69636174696f6e2f782d7777772d666f726d2d75726c656e636f6465640d0a0d0a616374696f6e3d73757065725f6372656174655f6e6f6e6365","method":"POST","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/131","ja3":"","session":"e432624b-c163-4c9e-8e9b-38138dc69d3c","seq":1,"duration_ms":100,"bytes_in":236,"bytes_out":79},{"timestamp":"2026-10-25T03:00:30","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"content-length\":\"25\",\"content-type\":\"application/x-www-form-urlencoded\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/131\"}","body":"action=super_create_nonce","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/wp-admin/admin-ajax.php","summary":"","payload_hex":"504f5354202f77702d61646d696e2f61646d696e2d616a61782e70687020485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204368726f6d652f3133310d0a4163636570743a202a2f2a0d0a436f6e74656e742d4c656e6774683a2032350d0a436f6e74656e742d547970653a206170706c69636174696f6e2f782d7777772d666f726d2d75726c656e636f6465640d0a0d0a616374696f6e3d73757065725f6372656174655f6e6f6e6365","method":"POST","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/131","ja3":"78f0dc5ac5b19daf131a133cfdee9691","session":"81e78089-7a7a-4bb6-bf00-823d55e4fccf","seq":1,"duration_ms":100,"bytes_in":236,"bytes_out":79},{"timestamp":"2026-10-24T14:51:20","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"content-length\":\"25\",\"content-type\":\"application/x-www-form-urlencoded\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/131\"}","body":"action=super_create_nonce","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/wp-admin/admin-ajax.php","summary":"","payload_hex":"504f5354202f77702d61646d696e2f61646d696e2d616a61782e70687020485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204368726f6d652f3133310d0a4163636570743a202a2f2a0d0a436f6e74656e742d4c656e6774683a2032350d0a436f6e74656e742d547970653a206170706c69636174696f6e2f782d7777772d666f726d2d75726c656e636f6465640d0a0d0a616374696f6e3d73757065725f6372656174655f6e6f6e6365","method":"POST","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/131","ja3":"","session":"5f225326-7e6a-48d4-bff8-8513ffb7ddf7","seq":1,"duration_ms":101,"bytes_in":236,"bytes_out":79},{"timestamp":"2026-10-24T14:51:20","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"content-length\":\"25\",\"content-type\":\"application/x-www-form-urlencoded\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/131\"}","body":"action=super_create_nonce","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/wp-admin/admin-ajax.php","summary":"","payload_hex":"504f5354202f77702d61646d696e2f61646d696e2d616a61782e70687020485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204368726f6d652f3133310d0a4163636570743a202a2f2a0d0a436f6e74656e742d4c656e6774683a2032350d0a436f6e74656e742d547970653a206170706c69636174696f6e2f782d7777772d666f726d2d75726c656e636f6465640d0a0d0a616374696f6e3d73757065725f6372656174655f6e6f6e6365","method":"POST","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/131","ja3":"78f0dc5ac5b19daf131a133cfdee9691","session":"bc5d8a0f-ff9c-41a6-a65a-84e4d01514c0","seq":1,"duration_ms":100,"bytes_in":236,"bytes_out":79}],"http_methods":[{"method":"POST","count":42},{"method":"GET","count":31}],"distinct_ports_total":14,"top_paths":[{"path":"/wp-admin/admin-ajax.php","count":42,"ports":2},{"path":"/solr/admin/cores?wt=json","count":5,"ports":1},{"path":"/api/status","count":5,"ports":2},{"path":"/version","count":3,"ports":1},{"path":"/ws/v1/cluster/info","count":3,"ports":1},{"path":"/v1/status/leader","count":3,"ports":1},{"path":"/nacos/v1/console/health/readiness","count":3,"ports":1},{"path":"/wp-content/plugins/super-forms/readme.txt","count":2,"ports":2},{"path":"/","count":2,"ports":1},{"path":"/api/json","count":2,"ports":1},{"path":"/solr/admin/cores","count":2,"ports":1},{"path":"/wp-login.php","count":1,"ports":1}],"distinct_paths_total":12,"top_snis":[],"top_hosts":[],"top_alpns":[{"value":"h2, http/1.1","count":22}],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","Content-Length","Content-Type","Host","User-Agent"],"representative":[{"name":"Accept","value":"*/*","notable":false},{"name":"Content-Length","value":"25","notable":false},{"name":"Content-Type","value":"application/x-www-form-urlencoded","notable":true},{"name":"Host","value":"<HONEYPOT>","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/131","notable":false}],"distinct_sets":1,"events_with_headers":10},"tags":[{"tag_id":"download","tag_type":"interactive","label":"download","title":"Named a file to download","sessions":1}]}