{"ip":"176.65.148.226","total_events":253,"verdict":{"verdict":"malicious","label":"Exploit attempts observed","detail":"2 exploit-path hits","confidence":"high","network_type":"network services","why":["2 request(s) matched a known exploit path.","Body-carrying methods (POST/PUT/PATCH/DELETE) seen: payload delivery, not just recon.","Under 5 hits, so confidence is medium.","Not in any known-scanner range.","Sent 46,897 bytes: sustained payload delivery, not a single opportunistic request."],"engagement":{"level":"payload","label":"Sustained payload","detail":"46,897 bytes sent","bytes_sent":46897,"session_seconds":1,"persistent":false}},"first_seen":"2026-04-09T00:49:39","last_seen":"2026-09-08T20:05:52","events_24h":0,"events_7d":40,"geo":{"country_code":"NL","country_name":"The Netherlands","region":"Limburg","city":"Eygelshoven","lat":50.8897,"lon":6.0563,"asn":51396,"org":"Pfcloud UG (haftungsbeschrankt)"},"source_domain":"176.65.148.226.ptr.pfcloud.network","known_scanners":[],"scanner_tag":null,"cve_matches":[{"cve_id":"CVE-2026-34197","title":"Apache ActiveMQ - Remote Code Execution","severity":"CRITICAL","actively_exploited":true,"match_field":"url_path","matched_pattern":"/api/jolokia/"},{"cve_id":"CVE-2023-38646","title":"Metabase < 0.46.6.1 - Remote Code Execution","severity":"critical","actively_exploited":false,"match_field":"url_path","matched_pattern":"/api/session/properties"},{"cve_id":"CVE-2024-23917","title":"JetBrains TeamCity > 2023.11.3 - Authentication Bypass","severity":"critical","actively_exploited":false,"match_field":"url_path","matched_pattern":"/app/rest/server"},{"cve_id":"CVE-2026-25892","title":"Adminer 4.6.2 - 5.4.1 Unauthenticated Persistent DoS","severity":"high","actively_exploited":false,"match_field":"url_path","matched_pattern":"/adminer.php"},{"cve_id":"CVE-2026-5027","title":"Langflow <= 1.8.4 - Path Traversal to RCE via File Upload","severity":"high","actively_exploited":false,"match_field":"url_path","matched_pattern":"/api/v1/auto_login"}],"malware":[],"top_ports":[{"port":80,"proto":"tcp","label":"HTTP","count":61},{"port":443,"proto":"tcp","label":"HTTPS","count":30},{"port":8500,"proto":"tcp","label":"","count":24},{"port":8090,"proto":"tcp","label":"","count":20},{"port":3000,"proto":"tcp","label":"Web-alt","count":18},{"port":2718,"proto":"tcp","label":"","count":16},{"port":8111,"proto":"tcp","label":"","count":14},{"port":8265,"proto":"tcp","label":"","count":13},{"port":2083,"proto":"tcp","label":"","count":10},{"port":7860,"proto":"tcp","label":"","count":10},{"port":8161,"proto":"tcp","label":"ActiveMQ","count":7},{"port":2376,"proto":"tcp","label":"Docker-TLS","count":6},{"port":8000,"proto":"tcp","label":"HTTP-alt","count":6},{"port":8080,"proto":"tcp","label":"HTTP-alt","count":3},{"port":4243,"proto":"tcp","label":"","count":3}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i140900_cbb2034c60b8_e7c285222651","t13i190900_9dc949149365_e7c285222651"],"tls_ja3":["d6828e30ab66774a91a96ae93be4ae4c","ea4a9ae049cfc614efbb3c244abb3fc7"],"ja4h":["ge11nn0500_e2433fe505a0","po11nn0800_a845134eac1f","ge11nn0500_cac2c496544b"]},"fingerprint_peers":{"t13i140900_cbb2034c60b8_e7c285222651":682,"t13i190900_9dc949149365_e7c285222651":2383,"ge11nn0500_e2433fe505a0":42,"po11nn0800_a845134eac1f":3,"ge11nn0500_cac2c496544b":83},"user_agents":["Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36"],"timeline":[{"date":"2026-08-24","count":1},{"date":"2026-08-25","count":18},{"date":"2026-08-26","count":17},{"date":"2026-08-27","count":14},{"date":"2026-08-28","count":21},{"date":"2026-08-29","count":14},{"date":"2026-08-30","count":18},{"date":"2026-08-31","count":28},{"date":"2026-09-01","count":20},{"date":"2026-09-02","count":33},{"date":"2026-09-03","count":21},{"date":"2026-09-04","count":6},{"date":"2026-09-05","count":10},{"date":"2026-09-06","count":8},{"date":"2026-09-07","count":7},{"date":"2026-09-08","count":13}],"recent_events":[{"timestamp":"2026-09-08T20:05:52","port":2377,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"application/json\",\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:2377\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/version","summary":"","payload_hex":"474554202f76657273696f6e20485454502f312e310d0a486f73743a20<HONEYPOT>3a323337370d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f363429204170706c655765624b69742f3533372e33360d0a4163636570743a206170706c69636174696f6e2f6a736f6e0d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36","ja3":"","session":"52c8758a-66e5-4d72-8c19-ed853dd479a6","seq":1,"duration_ms":100,"bytes_in":182,"bytes_out":79},{"timestamp":"2026-09-08T20:05:35","port":2377,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"application/json\",\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:2377\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/version","summary":"","payload_hex":"474554202f76657273696f6e20485454502f312e310d0a486f73743a20<HONEYPOT>3a323337370d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f363429204170706c655765624b69742f3533372e33360d0a4163636570743a206170706c69636174696f6e2f6a736f6e0d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36","ja3":"","session":"45abac85-447a-4c08-b458-c9ec2038a5d2","seq":1,"duration_ms":100,"bytes_in":182,"bytes_out":79},{"timestamp":"2026-09-08T17:45:48","port":2375,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"application/json\",\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:2375\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/version","summary":"","payload_hex":"474554202f76657273696f6e20485454502f312e310d0a486f73743a20<HONEYPOT>3a323337350d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f363429204170706c655765624b69742f3533372e33360d0a4163636570743a206170706c69636174696f6e2f6a736f6e0d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36","ja3":"","session":"b372c1d0-eb46-442a-96b7-9f9e8c98846b","seq":1,"duration_ms":100,"bytes_in":183,"bytes_out":79},{"timestamp":"2026-09-08T17:45:31","port":2375,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"application/json\",\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:2375\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/version","summary":"","payload_hex":"474554202f76657273696f6e20485454502f312e310d0a486f73743a20<HONEYPOT>3a323337350d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f363429204170706c655765624b69742f3533372e33360d0a4163636570743a206170706c69636174696f6e2f6a736f6e0d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36","ja3":"","session":"d98f6d09-cb21-47e0-b98e-f1cbd7814a8c","seq":1,"duration_ms":101,"bytes_in":183,"bytes_out":79},{"timestamp":"2026-09-08T10:09:33","port":8080,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"application/json\",\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8080\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/jenkins/api/json?tree=displayName","summary":"","payload_hex":"474554202f6a656e6b696e732f6170692f6a736f6e3f747265653d646973706c61794e616d6520485454502f312e310d0a486f73743a20<HONEYPOT>3a383038300d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f363429204170706c655765624b69742f3533372e33360d0a4163636570743a206170706c69636174696f6e2f6a736f6e0d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36","ja3":"","session":"e52cbf41-fa2d-4b59-8bb4-a7af53cfab3b","seq":1,"duration_ms":100,"bytes_in":208,"bytes_out":79},{"timestamp":"2026-09-08T10:09:32","port":8080,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"application/json\",\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8080\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/api/json?tree=displayName","summary":"","payload_hex":"474554202f6170692f6a736f6e3f747265653d646973706c61794e616d6520485454502f312e310d0a486f73743a20<HONEYPOT>3a383038300d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f363429204170706c655765624b69742f3533372e33360d0a4163636570743a206170706c69636174696f6e2f6a736f6e0d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36","ja3":"","session":"32db510a-0597-498c-bbd8-b7b6bde92be0","seq":1,"duration_ms":101,"bytes_in":200,"bytes_out":79},{"timestamp":"2026-09-08T10:09:32","port":8080,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"application/json\",\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8080\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/api/json?tree=displayName","summary":"","payload_hex":"474554202f6170692f6a736f6e3f747265653d646973706c61794e616d6520485454502f312e310d0a486f73743a20<HONEYPOT>3a383038300d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f363429204170706c655765624b69742f3533372e33360d0a4163636570743a206170706c69636174696f6e2f6a736f6e0d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36","ja3":"","session":"f0c55586-b1b0-4fdf-abed-87129a5d0513","seq":1,"duration_ms":100,"bytes_in":200,"bytes_out":79},{"timestamp":"2026-09-08T06:21:00","port":5000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"application/json\",\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:5000\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/version","summary":"","payload_hex":"474554202f76657273696f6e20485454502f312e310d0a486f73743a20<HONEYPOT>3a353030300d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f363429204170706c655765624b69742f3533372e33360d0a4163636570743a206170706c69636174696f6e2f6a736f6e0d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36","ja3":"","session":"a2ed8f8f-bd2c-4672-8da6-3177a926bcbe","seq":1,"duration_ms":100,"bytes_in":183,"bytes_out":79},{"timestamp":"2026-09-08T03:11:21","port":4243,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"application/json\",\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:4243\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/version","summary":"","payload_hex":"474554202f76657273696f6e20485454502f312e310d0a486f73743a20<HONEYPOT>3a343234330d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f363429204170706c655765624b69742f3533372e33360d0a4163636570743a206170706c69636174696f6e2f6a736f6e0d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36","ja3":"","session":"51375023-7b51-4bf8-af81-480bb3e2fda5","seq":1,"duration_ms":100,"bytes_in":182,"bytes_out":79},{"timestamp":"2026-09-08T03:11:02","port":4243,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"application/json\",\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:4243\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/version","summary":"","payload_hex":"474554202f76657273696f6e20485454502f312e310d0a486f73743a20<HONEYPOT>3a343234330d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f363429204170706c655765624b69742f3533372e33360d0a4163636570743a206170706c69636174696f6e2f6a736f6e0d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36","ja3":"","session":"c640bed6-cdac-4efa-b1ed-62da76fe5359","seq":1,"duration_ms":100,"bytes_in":182,"bytes_out":79}],"http_methods":[{"method":"GET","count":243},{"method":"POST","count":6}],"distinct_ports_total":21,"top_paths":[{"path":"/","count":104,"ports":6},{"path":"/adminer.php","count":34,"ports":2},{"path":"/media/sourcerer/css/sourcerer.css","count":18,"ports":2},{"path":"/version","count":17,"ports":6},{"path":"/api/session/properties","count":17,"ports":1},{"path":"/app/rest/server/version","count":14,"ports":1},{"path":"/api/version","count":13,"ports":1},{"path":"/api/v1/auto_login","count":10,"ports":1},{"path":"/api/jolokia/version","count":7,"ports":1},{"path":"/en-US/splunkd/__raw/v1/postgres/recovery/backup","count":6,"ports":1},{"path":"/api/json?tree=displayName","count":2,"ports":1},{"path":"/.env","count":1,"ports":1},{"path":"/debug/vars","count":1,"ports":1},{"path":"/actuator/env","count":1,"ports":1},{"path":"/.git/HEAD","count":1,"ports":1}],"distinct_paths_total":18,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","Accept-Encoding","Connection","Host","User-Agent"],"representative":[{"name":"Accept","value":"application/json","notable":false},{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Connection","value":"close","notable":false},{"name":"Host","value":"<HONEYPOT>:2377","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36","notable":false}],"distinct_sets":1,"events_with_headers":10},"tags":[{"tag_id":"CVE-2026-34197","tag_type":"cve","title":"Apache ActiveMQ - Remote Code Execution","severity":"CRITICAL","actively_exploited":true,"match_field":"url_path","matched_pattern":"/api/jolokia/","reference_urls":[]},{"tag_id":"CVE-2023-38646","tag_type":"cve","title":"Metabase < 0.46.6.1 - Remote Code Execution","severity":"critical","actively_exploited":false,"match_field":"url_path","matched_pattern":"/api/session/properties","reference_urls":["https://www.metabase.com/blog/security-advisory","https://github.com/metabase/metabase/releases/tag/v0.46.6.1","https://mp.weixin.qq.com/s/ATFwFl-D8k9QfQfzKjZFDg","https://news.ycombinator.com/item?id=36812256","https://blog.assetnote.io/2023/07/22/pre-auth-rce-metabase/"]},{"tag_id":"CVE-2024-23917","tag_type":"cve","title":"JetBrains TeamCity > 2023.11.3 - Authentication Bypass","severity":"critical","actively_exploited":false,"match_field":"url_path","matched_pattern":"/app/rest/server","reference_urls":["https://github.com/fkie-cad/nvd-json-data-feeds","https://www.rapid7.com/db/vulnerabilities/jetbrains-teamcity-cve-2024-23917/"]},{"tag_id":"CVE-2026-25892","tag_type":"cve","title":"Adminer 4.6.2 - 5.4.1 Unauthenticated Persistent DoS","severity":"high","actively_exploited":false,"match_field":"url_path","matched_pattern":"/adminer.php","reference_urls":["https://github.com/vrana/adminer/security/advisories/GHSA-q4f2-39gr-45jh","https://github.com/vrana/adminer/commit/21d3a3150388677b18647d68aec93b7850e457d3"]},{"tag_id":"CVE-2026-5027","tag_type":"cve","title":"Langflow <= 1.8.4 - Path Traversal to RCE via File Upload","severity":"high","actively_exploited":false,"match_field":"url_path","matched_pattern":"/api/v1/auto_login","reference_urls":["https://github.com/langflow-ai/langflow/pull/12227","https://github.com/0xBlackash/CVE-2026-5027","https://github.com/langflow-ai/langflow/security/advisories/GHSA-g2j9-7rj2-gm6c"]}],"data_as_of":"2026-09-11T08:08:45.252139+00:00"}