{"ip":"172.110.223.73","total_events":44,"verdict":{"verdict":"probing","label":"Low-level probing","detail":null,"confidence":"low","network_type":"CDN","why":["44 event(s), fewer than 10 distinct ports, no exploit payloads.","Not in any known-scanner range.","Sent 6,553 bytes despite few ports and no known exploit path: focused interaction with one service, worth a look."],"engagement":{"level":"payload","label":"Sustained payload","detail":"6,553 bytes sent","bytes_sent":6553,"session_seconds":8,"persistent":false}},"first_seen":"2026-07-09T11:27:14","last_seen":"2026-08-11T10:08:56","events_24h":0,"events_7d":24,"geo":{"country_code":"HK","country_name":"Hong Kong","region":"","city":"","lat":22.2578,"lon":114.1657,"asn":23470,"org":"ReliableSite.Net LLC"},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as23470","label":"ReliableSite.Net","category":"cdn","url":"https://www.peeringdb.com/asn/23470"},"cve_matches":[{"cve_id":"CVE-2018-13379","title":"Fortinet FortiOS SSL VPN path traversal","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/remote/fgt_lang"}],"malware":[],"top_ports":[{"port":5038,"proto":"tcp","label":"","count":24},{"port":1720,"proto":"tcp","label":"","count":12},{"port":1723,"proto":"tcp","label":"PPTP","count":4},{"port":5060,"proto":"tcp","label":"SIP","count":3},{"port":5061,"proto":"tcp","label":"SIPS","count":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t12i700500_b8b0f76b4bb5_a1e935682795"],"tls_ja3":["7233131c9641dc3d3c77395c1ff2e9b6"],"ja4h":["ge11nn0500_7a35dc74a363"]},"fingerprint_peers":{"t12i700500_b8b0f76b4bb5_a1e935682795":1,"ge11nn0500_7a35dc74a363":38},"user_agents":["python-requests/2.6.0 CPython/2.7.5 Linux/3.10.0-1160.119.1.el7.x86_64"],"timeline":[{"date":"2026-07-09","count":6},{"date":"2026-07-10","count":3},{"date":"2026-07-11","count":3},{"date":"2026-07-12","count":1},{"date":"2026-07-14","count":3},{"date":"2026-07-15","count":3},{"date":"2026-08-02","count":1},{"date":"2026-08-09","count":2},{"date":"2026-08-10","count":20},{"date":"2026-08-11","count":2}],"recent_events":[{"timestamp":"2026-08-11T10:08:56","port":5038,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"Action: Logoff\r\n\r\n","payload_hex":"416374696f6e3a204c6f676f66660d0a0d0a","method":"","user_agent":"","ja3":"","session":"f8e6c51d-406e-4118-9118-e97963abbbcc","seq":2,"duration_ms":8127,"bytes_in":82,"bytes_out":28,"enriched":{"digest":"6c27d86ef315dc5e","strings":["Action: Logoff"]}},{"timestamp":"2026-08-11T10:08:48","port":5038,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"Action: Login\r\nUsername: mark\r\nSecret: mysecret\r\nEvents: off\r\n\r\n","payload_hex":"416374696f6e3a204c6f67696e0d0a557365726e616d653a206d61726b0d0a5365637265743a206d797365637265740d0a4576656e74733a206f66660d0a0d0a","method":"","user_agent":"","ja3":"","session":"f8e6c51d-406e-4118-9118-e97963abbbcc","seq":1,"duration_ms":100,"bytes_in":64,"bytes_out":14,"enriched":{"digest":"c9d208ede8b842d5","strings":["Action: Login","Username: mark","Secret: mysecret","Events: off"]}},{"timestamp":"2026-08-10T20:33:22","port":5038,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"Action: Logoff\r\n\r\n","payload_hex":"416374696f6e3a204c6f676f66660d0a0d0a","method":"","user_agent":"","ja3":"","session":"e3ad703d-f007-4d94-984c-a6352a018687","seq":2,"duration_ms":8185,"bytes_in":96,"bytes_out":28,"enriched":{"digest":"6c27d86ef315dc5e","strings":["Action: Logoff"]}},{"timestamp":"2026-08-10T20:33:13","port":5038,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"Action: Login\r\nUsername: eventmanager\r\nSecret: asterisksecret\r\nEvents: off\r\n\r\n","payload_hex":"416374696f6e3a204c6f67696e0d0a557365726e616d653a206576656e746d616e616765720d0a5365637265743a20617374657269736b7365637265740d0a4576656e74733a206f66660d0a0d0a","method":"","user_agent":"","ja3":"","session":"e3ad703d-f007-4d94-984c-a6352a018687","seq":1,"duration_ms":100,"bytes_in":78,"bytes_out":14,"enriched":{"digest":"376d5bc926b7b4b3","strings":["Action: Login","Username: eventmanager","Secret: asterisksecret","Events: off"]}},{"timestamp":"2026-08-10T12:16:41","port":5038,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"Action: Logoff\r\n\r\n","payload_hex":"416374696f6e3a204c6f676f66660d0a0d0a","method":"","user_agent":"","ja3":"","session":"14ad636b-4693-4e1d-a267-ab1548cd9178","seq":2,"duration_ms":7197,"bytes_in":83,"bytes_out":28,"enriched":{"digest":"6c27d86ef315dc5e","strings":["Action: Logoff"]}},{"timestamp":"2026-08-10T12:16:33","port":5038,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"Action: Login\r\nUsername: admin\r\nSecret: password\r\nEvents: off\r\n\r\n","payload_hex":"416374696f6e3a204c6f67696e0d0a557365726e616d653a2061646d696e0d0a5365637265743a2070617373776f72640d0a4576656e74733a206f66660d0a0d0a","method":"","user_agent":"","ja3":"","session":"14ad636b-4693-4e1d-a267-ab1548cd9178","seq":1,"duration_ms":100,"bytes_in":65,"bytes_out":14,"enriched":{"digest":"5181d0e94effa4a7","strings":["Action: Login","Username: admin","Secret: password","Events: off"]}},{"timestamp":"2026-08-10T10:29:07","port":5038,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"Action: Logoff\r\n\r\n","payload_hex":"416374696f6e3a204c6f676f66660d0a0d0a","method":"","user_agent":"","ja3":"","session":"8e475bdf-44b7-4a4c-a928-9d268945af01","seq":2,"duration_ms":8195,"bytes_in":82,"bytes_out":28,"enriched":{"digest":"6c27d86ef315dc5e","strings":["Action: Logoff"]}},{"timestamp":"2026-08-10T10:28:59","port":5038,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"Action: Login\r\nUsername: mark\r\nSecret: mysecret\r\nEvents: off\r\n\r\n","payload_hex":"416374696f6e3a204c6f67696e0d0a557365726e616d653a206d61726b0d0a5365637265743a206d797365637265740d0a4576656e74733a206f66660d0a0d0a","method":"","user_agent":"","ja3":"","session":"8e475bdf-44b7-4a4c-a928-9d268945af01","seq":1,"duration_ms":100,"bytes_in":64,"bytes_out":14,"enriched":{"digest":"c9d208ede8b842d5","strings":["Action: Login","Username: mark","Secret: mysecret","Events: off"]}},{"timestamp":"2026-08-10T10:02:29","port":5038,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"Action: Logoff\r\n\r\n","payload_hex":"416374696f6e3a204c6f676f66660d0a0d0a","method":"","user_agent":"","ja3":"","session":"e222cbcf-8104-4f0b-9914-3b169c3f10b5","seq":2,"duration_ms":7195,"bytes_in":82,"bytes_out":28,"enriched":{"digest":"6c27d86ef315dc5e","strings":["Action: Logoff"]}},{"timestamp":"2026-08-10T10:02:21","port":5038,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"Action: Login\r\nUsername: mark\r\nSecret: mysecret\r\nEvents: off\r\n\r\n","payload_hex":"416374696f6e3a204c6f67696e0d0a557365726e616d653a206d61726b0d0a5365637265743a206d797365637265740d0a4576656e74733a206f66660d0a0d0a","method":"","user_agent":"","ja3":"","session":"e222cbcf-8104-4f0b-9914-3b169c3f10b5","seq":1,"duration_ms":100,"bytes_in":64,"bytes_out":14,"enriched":{"digest":"c9d208ede8b842d5","strings":["Action: Login","Username: mark","Secret: mysecret","Events: off"]}}],"http_methods":[{"method":"GET","count":19}],"distinct_ports_total":5,"top_paths":[{"path":"/remote/fgt_lang?lang=/../../../..//////////dev/","count":19,"ports":4}],"distinct_paths_total":1,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[{"tag_id":"CVE-2018-13379","tag_type":"cve","title":"Fortinet FortiOS SSL VPN path traversal","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/remote/fgt_lang","reference_urls":["https://nvd.nist.gov/vuln/detail/CVE-2018-13379"]}],"data_as_of":"2026-08-15T06:00:58.811338+00:00"}