{"ip":"185.141.63.27","total_events":245,"verdict":{"verdict":"malicious","label":"Exploit attempts observed","detail":"6 exploit-path hits","confidence":"high","network_type":"CDN","why":["6 request(s) matched a known exploit path.","Body-carrying methods (POST/PUT/PATCH/DELETE) seen: payload delivery, not just recon.","5+ hits raise confidence to high.","Not in any known-scanner range.","Sent 2,929,318 bytes: sustained payload delivery, not a single opportunistic request."],"engagement":{"level":"payload","label":"Sustained payload","detail":"2,929,318 bytes sent","bytes_sent":2929318,"session_seconds":35,"persistent":false}},"first_seen":"2026-09-29T16:41:30","last_seen":"2026-09-29T16:42:36","events_24h":245,"events_7d":245,"geo":{"country_code":"CY","country_name":"Cyprus","region":"","city":"","lat":35.0,"lon":33.0,"asn":44901,"org":"Belcloud LTD"},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as44901","label":"BelCloud Ltd.","category":"cdn","url":"https://www.peeringdb.com/asn/44901"},"cve_matches":[{"cve_id":"CVE-2020-2551","title":"Oracle WebLogic Server - Remote Code Execution","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/console/login/LoginForm.jsp"},{"cve_id":"CVE-2021-35587","title":"Oracle Access Manager - Remote Code Execution","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/oam/server/opensso/sessionservice"},{"cve_id":"CVE-2022-26143","title":"Mitel MiCollab - Information Disclosure & Denial of Service","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/ucs/micollab/version.json"},{"cve_id":"CVE-2024-1709","title":"ConnectWise ScreenConnect 23.9.7 - Authentication Bypass","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/SetupWizard.aspx"},{"cve_id":"CVE-2025-0282","title":"Ivanti Connect Secure - Stack-based Buffer Overflow","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/dana-na/auth/url_default/welcome.cgi"},{"cve_id":"CVE-2020-14864","title":"Oracle Fusion - Directory Traversal/Local File Inclusion","severity":"high","actively_exploited":true,"match_field":"url_path","matched_pattern":"/analytics/saw.dll"},{"cve_id":"CVE-2023-38646","title":"Metabase < 0.46.6.1 - Remote Code Execution","severity":"critical","actively_exploited":false,"match_field":"url_path","matched_pattern":"/api/session/properties"},{"cve_id":"CVE-2024-23917","title":"JetBrains TeamCity > 2023.11.3 - Authentication Bypass","severity":"critical","actively_exploited":false,"match_field":"url_path","matched_pattern":"/app/rest/server"},{"cve_id":"CVE-2024-25723","title":"ZenML ZenML Server - Improper Authentication","severity":"critical","actively_exploited":false,"match_field":"url_path","matched_pattern":"/api/v1/info"},{"cve_id":"CVE-2024-30569","title":"Netgear R6850 - Information Disclosure","severity":"high","actively_exploited":false,"match_field":"url_path","matched_pattern":"/currentsetting.htm"},{"cve_id":"CVE-2026-25892","title":"Adminer 4.6.2 - 5.4.1 Unauthenticated Persistent DoS","severity":"high","actively_exploited":false,"match_field":"url_path","matched_pattern":"/adminer.php"},{"cve_id":"CVE-2026-35029","title":"LiteLLM - Arbitrary File Read","severity":"high","actively_exploited":false,"match_field":"url_path","matched_pattern":"/health/liveliness"},{"cve_id":"CVE-2007-4556","title":"OpenSymphony XWork/Apache Struts2 - Remote Code Execution","severity":"medium","actively_exploited":false,"match_field":"url_path","matched_pattern":"/login.action"},{"cve_id":"CVE-2025-2129","title":"Mage AI - Insecure Default Authentication Setup","severity":"medium","actively_exploited":false,"match_field":"url_path","matched_pattern":"/api/kernels"}],"malware":[],"top_ports":[{"port":10001,"proto":"tcp","label":"","count":245}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i131000_f57a46bbacb6_f50d94e863eb","t13i251000_b78ed14e2fd0_f50d94e863eb"],"tls_client_hello":"16030105ee010005ea0303449b551ca26c7e497d73feac2900c4e0f0a7f7305cdea22c8b862aa86de7704e203ed8e33df77fcf5d3124f785bfb5f40f29448eb5882106943ce7b34eb8ee17fc0032cca9cca8c02bc02fc02cc030c009c013c00ac014009c009d002f0035c012000ac023c027003cc007c01100051303130113020100056f000b00020100ff010001000017000000120000000500050100000000000a0010000e11ec11eb11ed001d001700180019000d001c001a090409050906080404030807080508060401050106010503060300320020001e090409050906080404030807080508060401050106010503060302010203002b0009080304030303020301003304ea04e811ec04c0a0783cb3823f80ea4cdb9aa040792e1768550cd501764bbad7f47dc956a29357955516151744a4f75c979e037e6decb224ba7c488bbac76c0622d43c9c058b5772cc4069174abb2b86c8209244cbf5d31a14871ca017adbad7c477321f8fc36544a46f9709302fd55379b41e9a1c390b08594bcc77a10c7672163c29cca49dd01c79e03032654a2cb6ac94050726d9bc6152b256291d3dc4283a2caacadc25833b5e37b7304314729ff29c184382eb725849c4cf75693586e033c39c446ddb247e22892f586fc379403414a100b77338588f8ca957f94180ab877d7720958a87052535029d453d621974365b8635928317a50785f87c525b0307b1496d657c725c9f23605c7d4156d12957acb25608217f368804a22c78e598012b860e76c4317b68a298a1af9787395f6c8bcf79994069595423378a4b92dc72706eeb837ff6793cd0909be490c0ab5f98f85ddb8a792f5bc9b90a99925cbe352c6c860ac38fe707d1dc44f975a74d238229eb7e42050b6a98793779b1c593711f65441d50808a1c59a5b18e82f6c4762bba3237bb3bec688a1c5a17e2c8ebac7725e676afb3005bd0423dbabab93067dca4384fb2519e238f8ac14a984716f51b890e5432feeb34c5c947b6e9c7c9f126c8217ee3dca7ef02671b95965f80c70f908ab9445b461b9c5eb6c7e4585d5268b984414840968c1ea208cb5a8d652bb1f72c40aa9b4fb950258889a20c5cc5d1c18603c8959351ba9bc6824a129d8518255cb81655d3543e2738fa11688ad05a7d698464a4507d032e19811bb8aa6df508a889ab459b8a1a725ca91f0158fb64c333739957b12dd8d4bdf79755c59b0f5ce136bbc77240db4c79372607586327d022d12c651a52852f94392657b22af24a71a086511176cee7835eabc4ad8b3b88c99bb02468e734a20154b842c718adc08fb6eb7dc0589c159b7f87f81b55156c8ad2be58272c41110b96911c27b7c5650a8f31f215908543c8902de65c9a9c25c69177a4078ca5b01b4480a5cb2bc72307242152037bca81a977223c6013ade5c1314f287929ab432e6bbe22649d4fb6170767c632a34e9dabaee55577dac6bf823901ea738a2276320e529a3ac1b801b4a48f69b29747634b131a575477c64b8ca7e467d8222e0e4b1a4b7628b9615f729c5da6b22254cb0c6012310f6118970a598333670b23b0e9b47f3581aec42694236221e56b1109ab795184c8839b8e89d3c80f71865a62a05c19a92104495f729d7b1960ff8669d1e04fd4b4178f16742a71c812e8c0b8235a7a231a1fa662b38b3e25654a3dcaa3686c12cffc08c84226309a0db1a36fff999fb92c9a2d27bf526822f9b53e48fc8194485703169d2f7a2c39c45b262b1f9bc8b861ec7af09bbd069608785567aed7cfc0f92310d0312f04ccba17bc6d68732e263202433f28644b3325579f647d0c791b08c178cc435e1145b1bd46adec385a47b1012db94b9c9829443c9791a7cea0b6ce7a32af302ba9cea630e5f52bc18b427116c23c41c696d109b8e54108fa00c8e658cf378bfc5a2e6f7664f5601fa0c8a18612b8b17a007f79be86a666d277093e49510e7148bba99df3977092f32abe92599f127a9241876e241f8dcd33300598ee20cf2484f393b0a6fa1450b4736d3e4e8c3b8c249371b748480b588a33158022e60ea3e030143c35df6eade625cfb7784cb26b376e76001d0020b748480b588a33158022e60ea3e030143c35df6eade625cfb7784cb2","tls_ja3":["9404b4852d44353f69b8b33aaff15be4","56b0f6febc953849f7ace70c5a2ae34d"],"http_akin":["a11cuq061_0000064a_ffe60107","a11cun040_0000004d_50f90888","a11cun030_0000000b_4c75231d","a11cun030_0000004c_13ee3d34"]},"fingerprint_peers":{"t13i131000_f57a46bbacb6_f50d94e863eb":2734,"a11cun040_0000004d_50f90888":30,"a11cun030_0000004c_13ee3d34":2692,"t13i251000_b78ed14e2fd0_f50d94e863eb":40,"a11cun030_0000000b_4c75231d":4,"a11cuq061_0000064a_ffe60107":48},"akin_families":{"a11cun040_0000004d_50f90888":{"head":"a11cun040_0000004d_aa48e2c8","shapes":5,"ips":3517}},"user_agents":["nerva/1.0","Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36"],"timeline":[{"date":"2026-09-29","count":245}],"recent_events":[{"timestamp":"2026-09-29T16:42:36","port":10001,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"text/html\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:10001\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/logon.htm","summary":"","payload_hex":"474554202f6c6f676f6e2e68746d20485454502f312e310d0a486f73743a20<HONEYPOT>3a31303030310d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132372e302e302e30205361666172692f3533372e33360d0a4163636570743a20746578742f68746d6c0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36","ja3":"9404b4852d44353f69b8b33aaff15be4","session":"151ef874-5571-456b-a474-d357f04dbb53","seq":158,"duration_ms":35245,"bytes_in":36575,"bytes_out":12324},{"timestamp":"2026-09-29T16:42:36","port":10001,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"application/json\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:10001\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/+CSCOE+/logon.html","summary":"","payload_hex":"474554202f2b4353434f452b2f6c6f676f6e2e68746d6c20485454502f312e310d0a486f73743a20<HONEYPOT>3a31303030310d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132372e302e302e30205361666172692f3533372e33360d0a4163636570743a206170706c69636174696f6e2f6a736f6e0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36","ja3":"9404b4852d44353f69b8b33aaff15be4","session":"151ef874-5571-456b-a474-d357f04dbb53","seq":157,"duration_ms":35022,"bytes_in":36354,"bytes_out":12246},{"timestamp":"2026-09-29T16:42:36","port":10001,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"application/json\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:10001\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/.backstage/health/v1/readiness","summary":"","payload_hex":"474554202f2e6261636b73746167652f6865616c74682f76312f72656164696e65737320485454502f312e310d0a486f73743a20<HONEYPOT>3a31303030310d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132372e302e302e30205361666172692f3533372e33360d0a4163636570743a206170706c69636174696f6e2f6a736f6e0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36","ja3":"9404b4852d44353f69b8b33aaff15be4","session":"151ef874-5571-456b-a474-d357f04dbb53","seq":156,"duration_ms":34798,"bytes_in":36117,"bytes_out":12168},{"timestamp":"2026-09-29T16:42:35","port":10001,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"application/json\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:10001\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/api/health","summary":"","payload_hex":"474554202f6170692f6865616c746820485454502f312e310d0a486f73743a20<HONEYPOT>3a31303030310d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132372e302e302e30205361666172692f3533372e33360d0a4163636570743a206170706c69636174696f6e2f6a736f6e0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36","ja3":"9404b4852d44353f69b8b33aaff15be4","session":"151ef874-5571-456b-a474-d357f04dbb53","seq":151,"duration_ms":33679,"bytes_in":34929,"bytes_out":11778},{"timestamp":"2026-09-29T16:42:35","port":10001,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"application/json\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:10001\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/hub/login","summary":"","payload_hex":"474554202f6875622f6c6f67696e20485454502f312e310d0a486f73743a20<HONEYPOT>3a31303030310d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132372e302e302e30205361666172692f3533372e33360d0a4163636570743a206170706c69636174696f6e2f6a736f6e0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36","ja3":"9404b4852d44353f69b8b33aaff15be4","session":"151ef874-5571-456b-a474-d357f04dbb53","seq":152,"duration_ms":33902,"bytes_in":35157,"bytes_out":11856},{"timestamp":"2026-09-29T16:42:35","port":10001,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"text/xml, text/html\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:10001\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/EGateway/EGateway.asmx","summary":"","payload_hex":"474554202f45476174657761792f45476174657761792e61736d7820485454502f312e310d0a486f73743a20<HONEYPOT>3a31303030310d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132372e302e302e30205361666172692f3533372e33360d0a4163636570743a20746578742f786d6c2c20746578742f68746d6c0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36","ja3":"9404b4852d44353f69b8b33aaff15be4","session":"151ef874-5571-456b-a474-d357f04dbb53","seq":153,"duration_ms":34126,"bytes_in":35401,"bytes_out":11934},{"timestamp":"2026-09-29T16:42:35","port":10001,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"application/json\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:10001\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/auth1.html","summary":"","payload_hex":"474554202f61757468312e68746d6c20485454502f312e310d0a486f73743a20<HONEYPOT>3a31303030310d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132372e302e302e30205361666172692f3533372e33360d0a4163636570743a206170706c69636174696f6e2f6a736f6e0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36","ja3":"9404b4852d44353f69b8b33aaff15be4","session":"151ef874-5571-456b-a474-d357f04dbb53","seq":154,"duration_ms":34350,"bytes_in":35630,"bytes_out":12012},{"timestamp":"2026-09-29T16:42:35","port":10001,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"application/json\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:10001\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/webpages/login.html","summary":"","payload_hex":"474554202f77656270616765732f6c6f67696e2e68746d6c20485454502f312e310d0a486f73743a20<HONEYPOT>3a31303030310d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132372e302e302e30205361666172692f3533372e33360d0a4163636570743a206170706c69636174696f6e2f6a736f6e0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36","ja3":"9404b4852d44353f69b8b33aaff15be4","session":"151ef874-5571-456b-a474-d357f04dbb53","seq":155,"duration_ms":34574,"bytes_in":35868,"bytes_out":12090},{"timestamp":"2026-09-29T16:42:34","port":10001,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"application/json\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:10001\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/_api/version","summary":"","payload_hex":"474554202f5f6170692f76657273696f6e20485454502f312e310d0a486f73743a20<HONEYPOT>3a31303030310d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132372e302e302e30205361666172692f3533372e33360d0a4163636570743a206170706c69636174696f6e2f6a736f6e0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36","ja3":"9404b4852d44353f69b8b33aaff15be4","session":"151ef874-5571-456b-a474-d357f04dbb53","seq":149,"duration_ms":33231,"bytes_in":34477,"bytes_out":11622},{"timestamp":"2026-09-29T16:42:34","port":10001,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"application/json\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:10001\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/api/version","summary":"","payload_hex":"474554202f6170692f76657273696f6e20485454502f312e310d0a486f73743a20<HONEYPOT>3a31303030310d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132372e302e302e30205361666172692f3533372e33360d0a4163636570743a206170706c69636174696f6e2f6a736f6e0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36","ja3":"9404b4852d44353f69b8b33aaff15be4","session":"151ef874-5571-456b-a474-d357f04dbb53","seq":148,"duration_ms":33008,"bytes_in":34246,"bytes_out":11544}],"http_methods":[{"method":"GET","count":238},{"method":"POST","count":1}],"distinct_ports_total":1,"top_paths":[{"path":"/","count":9,"ports":1},{"path":"/api/v1/version","count":4,"ports":1},{"path":"/api/version","count":4,"ports":1},{"path":"/version","count":4,"ports":1},{"path":"/login","count":3,"ports":1},{"path":"/api/","count":2,"ports":1},{"path":"/api/overview","count":2,"ports":1},{"path":"/+CSCOE+/logon.html","count":2,"ports":1},{"path":"/status","count":2,"ports":1},{"path":"/metrics","count":2,"ports":1},{"path":"/auth/login.html","count":1,"ports":1},{"path":"/v3/api-docs","count":1,"ports":1},{"path":"/GC3/glog.webserver.servlet.umt.Login","count":1,"ports":1},{"path":"/nerva-fp-nonexistent-path","count":1,"ports":1},{"path":"/ucs/micollab/version.json","count":1,"ports":1}],"distinct_paths_total":200,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","Accept-Encoding","Host","User-Agent"],"representative":[{"name":"Accept","value":"text/html","notable":false},{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Host","value":"<HONEYPOT>:10001","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36","notable":false}],"distinct_sets":1,"events_with_headers":10},"tags":[{"tag_id":"CVE-2020-2551","tag_type":"cve","title":"Oracle WebLogic Server - Remote Code Execution","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/console/login/LoginForm.jsp","reference_urls":["https://github.com/hktalent/CVE-2020-2551","https://nvd.nist.gov/vuln/detail/CVE-2020-2551","https://www.oracle.com/security-alerts/cpujan2020.html","https://github.com/neilzhang1/Chinese-Charts","https://github.com/pjgmonteiro/Pentest-tools"]},{"tag_id":"CVE-2021-35587","tag_type":"cve","title":"Oracle Access Manager - Remote Code Execution","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/oam/server/opensso/sessionservice","reference_urls":["https://testbnull.medium.com/oracle-access-manager-pre-auth-rce-cve-2021-35587-analysis-1302a4542316","https://nvd.nist.gov/vuln/detail/CVE-2021-35587","https://www.oracle.com/security-alerts/cpujan2022.html","https://github.com/ARPSyndicate/kenzer-templates","https://github.com/GrrrDog/Java-Deserialization-Cheat-Sheet"]},{"tag_id":"CVE-2022-26143","tag_type":"cve","title":"Mitel MiCollab - Information Disclosure & Denial of Service","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/ucs/micollab/version.json","reference_urls":["https://nvd.nist.gov/vuln/detail/CVE-2022-26143"]},{"tag_id":"CVE-2024-1709","tag_type":"cve","title":"ConnectWise ScreenConnect 23.9.7 - Authentication Bypass","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/SetupWizard.aspx","reference_urls":["https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass","https://github.com/watchtowrlabs/connectwise-screenconnect_auth-bypass-add-user-poc","https://www.connectwise.com/company/trust/security-bulletins/connectwise-screenconnect-23.9.8","https://nvd.nist.gov/vuln/detail/CVE-2024-1709","https://github.com/rapid7/metasploit-framework/pull/18870"]},{"tag_id":"CVE-2025-0282","tag_type":"cve","title":"Ivanti Connect Secure - Stack-based Buffer Overflow","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/dana-na/auth/url_default/welcome.cgi","reference_urls":["https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-Policy-Secure-ZTA-Gateways-CVE-2025-0282-CVE-2025-0283","https://labs.watchtowr.com/exploitation-walkthrough-and-techniques-ivanti-connect-secure-rce-cve-2025-0282/","https://cloud.google.com/blog/topics/threat-intelligence/ivanti-connect-secure-vpn-zero-day","https://nvd.nist.gov/vuln/detail/CVE-2025-0282"]},{"tag_id":"CVE-2020-14864","tag_type":"cve","title":"Oracle Fusion - Directory Traversal/Local File Inclusion","severity":"high","actively_exploited":true,"match_field":"url_path","matched_pattern":"/analytics/saw.dll","reference_urls":["http://packetstormsecurity.com/files/159748/Oracle-Business-Intelligence-Enterprise-Edition-5.5.0.0.0-12.2.1.3.0-12.2.1.4.0-LFI.html","https://www.oracle.com/security-alerts/cpuoct2020.html","https://nvd.nist.gov/vuln/detail/CVE-2020-14864","https://github.com/merlinepedra/nuclei-templates","https://github.com/sobinge/nuclei-templates"]},{"tag_id":"CVE-2023-38646","tag_type":"cve","title":"Metabase < 0.46.6.1 - Remote Code Execution","severity":"critical","actively_exploited":false,"match_field":"url_path","matched_pattern":"/api/session/properties","reference_urls":["https://www.metabase.com/blog/security-advisory","https://github.com/metabase/metabase/releases/tag/v0.46.6.1","https://mp.weixin.qq.com/s/ATFwFl-D8k9QfQfzKjZFDg","https://news.ycombinator.com/item?id=36812256","https://blog.assetnote.io/2023/07/22/pre-auth-rce-metabase/"]},{"tag_id":"CVE-2024-23917","tag_type":"cve","title":"JetBrains TeamCity > 2023.11.3 - Authentication Bypass","severity":"critical","actively_exploited":false,"match_field":"url_path","matched_pattern":"/app/rest/server","reference_urls":["https://github.com/fkie-cad/nvd-json-data-feeds","https://www.rapid7.com/db/vulnerabilities/jetbrains-teamcity-cve-2024-23917/"]},{"tag_id":"CVE-2024-25723","tag_type":"cve","title":"ZenML ZenML Server - Improper Authentication","severity":"critical","actively_exploited":false,"match_field":"url_path","matched_pattern":"/api/v1/info","reference_urls":["https://www.zenml.io/blog/critical-security-update-for-zenml-users","https://github.com/zenml-io/zenml","https://github.com/zenml-io/zenml/compare/0.42.1...0.42.2","https://github.com/zenml-io/zenml/compare/0.43.0...0.43.1","https://github.com/zenml-io/zenml/compare/0.44.3...0.44.4"]},{"tag_id":"CVE-2024-30569","tag_type":"cve","title":"Netgear R6850 - Information Disclosure","severity":"high","actively_exploited":false,"match_field":"url_path","matched_pattern":"/currentsetting.htm","reference_urls":["https://github.com/funny-mud-peee/IoT-vuls/blob/main/netgear%20R6850/Info%20Leak%20in%20Netgear-R6850%EF%BC%88currentsetting.htm%EF%BC%89.md","https://nvd.nist.gov/vuln/detail/CVE-2024-30569","https://www.netgear.com/about/security/"]},{"tag_id":"CVE-2026-25892","tag_type":"cve","title":"Adminer 4.6.2 - 5.4.1 Unauthenticated Persistent DoS","severity":"high","actively_exploited":false,"match_field":"url_path","matched_pattern":"/adminer.php","reference_urls":["https://github.com/vrana/adminer/security/advisories/GHSA-q4f2-39gr-45jh","https://github.com/vrana/adminer/commit/21d3a3150388677b18647d68aec93b7850e457d3"]},{"tag_id":"CVE-2026-35029","tag_type":"cve","title":"LiteLLM - Arbitrary File Read","severity":"high","actively_exploited":false,"match_field":"url_path","matched_pattern":"/health/liveliness","reference_urls":["https://github.com/BerriAI/litellm","https://sec-consult.com/vulnerability-lab/advisory/broken-access-control-in-config-endpoint-in-litellm/","https://nvd.nist.gov/vuln/detail/CVE-2026-35029"]},{"tag_id":"CVE-2007-4556","tag_type":"cve","title":"OpenSymphony XWork/Apache Struts2 - Remote Code Execution","severity":"medium","actively_exploited":false,"match_field":"url_path","matched_pattern":"/login.action","reference_urls":["https://www.guildhab.top/?p=2326","https://nvd.nist.gov/vuln/detail/CVE-2007-4556","https://cwiki.apache.org/confluence/display/WW/S2-001","http://forums.opensymphony.com/ann.jspa?annID=54","http://issues.apache.org/struts/browse/WW-2030"]},{"tag_id":"CVE-2025-2129","tag_type":"cve","title":"Mage AI - Insecure Default Authentication Setup","severity":"medium","actively_exploited":false,"match_field":"url_path","matched_pattern":"/api/kernels","reference_urls":["https://nvd.nist.gov/vuln/detail/CVE-2025-2129","https://github.com/zn9988/publications/blob/main/2.Mage-AI%20-%20Insecure%20Default%20Authentication%20Setup%20Leading%20to%20Zero-Click%20RCE/README.md","https://vuldb.com/?ctiid.299049","https://vuldb.com/?id.299049","https://vuldb.com/?submit.510690"]}],"data_as_of":"2026-09-30T03:51:14.026224+00:00"}