{"ip":"185.231.33.46","total_events":240,"verdict":{"verdict":"scanning","label":"Scanning for known vulnerabilities","detail":"2 exploit-path probe(s)","confidence":"medium","network_type":null,"why":["2 request(s) matched a known exploit path.","Only GET/HEAD seen, no request body: scanning for the vulnerability, not delivering a payload.","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"48,617 bytes sent","bytes_sent":48617,"session_seconds":0,"persistent":false}},"first_seen":"2026-03-10T12:43:26","last_seen":"2026-09-27T02:27:54","events_24h":0,"events_7d":130,"geo":{"country_code":"SC","country_name":"Seychelles","region":"","city":"","lat":-4.5833,"lon":55.6667,"asn":211720,"org":"Datashield, Inc."},"source_domain":"short-tan-rat","known_scanners":[],"scanner_tag":null,"cve_matches":[{"cve_id":"CVE-2018-13379","title":"Fortinet FortiOS SSL VPN path traversal","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/remote/fgt_lang"},{"cve_id":"CVE-2025-64446","title":"FortiWeb - Authentication Bypass","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/api/v2.0/cmdb/system/admin%3f/../../../../../cgi-bin/fwbcgi"},{"cve_id":"CVE-2026-21643","title":"Fortinet FortiClientEMS 7.4.4 - SQL Injection","severity":"CRITICAL","actively_exploited":true,"match_field":"url_path","matched_pattern":"/api/v1/init_consts"}],"malware":[],"top_ports":[{"port":443,"proto":"tcp","label":"HTTPS","count":43},{"port":8080,"proto":"tcp","label":"HTTP-alt","count":20},{"port":3000,"proto":"tcp","label":"Web-alt","count":20},{"port":8443,"proto":"tcp","label":"HTTPS-alt","count":19},{"port":10443,"proto":"tcp","label":"","count":17},{"port":7443,"proto":"tcp","label":"","count":16},{"port":4443,"proto":"tcp","label":"","count":16},{"port":444,"proto":"tcp","label":"","count":16},{"port":9443,"proto":"tcp","label":"","count":16},{"port":4433,"proto":"tcp","label":"","count":16},{"port":4430,"proto":"tcp","label":"","count":16},{"port":8013,"proto":"tcp","label":"","count":12},{"port":65432,"proto":"tcp","label":"","count":5},{"port":8161,"proto":"tcp","label":"ActiveMQ","count":2},{"port":1433,"proto":"tcp","label":"MSSQL","count":2}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i181200_5103eae14fdb_678a800b2221","t13i351200_bfa337485184_678a800b2221","t13i1813h1_5103eae14fdb_97a66a8f4cb1","t13i311200_8c1ae1bbf969_678a800b2221"],"tls_client_hello":"1603010200010001fc03037c601e391ad46a5e0a667977efb74ab7450beea0ac498975758c8d900a077745202644577d640c10f08abf78f8df352bcdb11562226c7c428afe7e865ff6b33d5900461302130313011304c02cc030cca9cca8c0adc02bc02fc0acc023c027c00ac014c009c013009dc09d009cc09c003d003c0035002f009fccaac09f009ec09e006b0067003900330100016dff01000100000b000403000102000a00160014001d0017001e0019001801000101010201030104002300000016000000170000000d00220020040305030603080708080809080a080b08040805080604010501060103030301002b00050403040303002d00020101003300260024001d002086750ec58759f31bfd8fc70c2c02068ae3ccd9bb327a392d8795a90701f74d13001b0003020001001500d000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000","tls_ja3":["afebc28e206410651a1ae4c4c0d39046","7c17d4a502c8c707f215072d841d93d2","36a292c29cfb1781cef242774f3a6e5a","60eb467937ec4cb8aa43b4008a510ad1"],"http_akin":["b11cun050_00040017_97f1d74f","b11cun050_00040017_38043d51","b11cun071_00050017_44096d2b_xfbae","b11cun050_00040017_976354f0"]},"fingerprint_peers":{"t13i181200_5103eae14fdb_678a800b2221":0,"t13i351200_bfa337485184_678a800b2221":3,"t13i1813h1_5103eae14fdb_97a66a8f4cb1":0,"t13i311200_8c1ae1bbf969_678a800b2221":0,"b11cun050_00040017_97f1d74f":38,"b11cun050_00040017_38043d51":31,"b11cun071_00050017_44096d2b_xfbae":0,"b11cun050_00040017_976354f0":1282},"akin_families":{"b11cun050_00040017_97f1d74f":{"head":"b11cun050_00040017_97f1d74f","shapes":3,"ips":38},"b11cun050_00040017_976354f0":{"head":"b11cun050_00040017_976354f0","shapes":3,"ips":1283}},"user_agents":["Mozilla/5.0 (compatible; V1.2040.0)","python-requests/2.34.2","Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36","Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36"],"timeline":[{"date":"2026-07-10","count":4},{"date":"2026-07-16","count":1},{"date":"2026-07-18","count":1},{"date":"2026-07-30","count":10},{"date":"2026-08-02","count":5},{"date":"2026-09-09","count":1},{"date":"2026-09-10","count":54},{"date":"2026-09-25","count":90},{"date":"2026-09-26","count":20},{"date":"2026-09-27","count":20}],"recent_events":[{"timestamp":"2026-09-27T02:27:54","port":3000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:3000\",\"user-agent\":\"Mozilla/5.0 (compatible; V1.2040.0)\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/remote/login","summary":"","payload_hex":"474554202f72656d6f74652f6c6f67696e20485454502f312e310d0a486f73743a20<HONEYPOT>3a333030300d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b2056312e323034302e30290d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; V1.2040.0)","ja3":"","session":"53dab72f-41ff-4b03-83ba-eab6c19d528f","seq":1,"duration_ms":100,"bytes_in":169,"bytes_out":78},{"timestamp":"2026-09-27T02:27:54","port":3000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:3000\",\"user-agent\":\"Mozilla/5.0 (compatible; V1.2040.0)\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a333030300d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b2056312e323034302e30290d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; V1.2040.0)","ja3":"","session":"4f2d3aae-e924-4c62-812b-3752dfff316b","seq":1,"duration_ms":100,"bytes_in":157,"bytes_out":78},{"timestamp":"2026-09-27T02:27:54","port":3000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:3000\",\"user-agent\":\"Mozilla/5.0 (compatible; V1.2040.0)\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/ui/imports-map/imports.json","summary":"","payload_hex":"474554202f75692f696d706f7274732d6d61702f696d706f7274732e6a736f6e20485454502f312e310d0a486f73743a20<HONEYPOT>3a333030300d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b2056312e323034302e30290d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; V1.2040.0)","ja3":"","session":"6929bcb6-20e5-4dcc-9713-6bb1ad08ece7","seq":1,"duration_ms":100,"bytes_in":184,"bytes_out":78},{"timestamp":"2026-09-27T02:27:54","port":3000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:3000\",\"user-agent\":\"Mozilla/5.0 (compatible; V1.2040.0)\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/+CSCOE+/logon.html","summary":"","payload_hex":"474554202f2b4353434f452b2f6c6f676f6e2e68746d6c20485454502f312e310d0a486f73743a20<HONEYPOT>3a333030300d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b2056312e323034302e30290d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; V1.2040.0)","ja3":"","session":"eac5d345-2dfd-4295-b38f-e0628f8896c1","seq":1,"duration_ms":100,"bytes_in":175,"bytes_out":78},{"timestamp":"2026-09-27T02:27:54","port":3000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:3000\",\"user-agent\":\"Mozilla/5.0 (compatible; V1.2040.0)\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/users/sign_in","summary":"","payload_hex":"474554202f75736572732f7369676e5f696e20485454502f312e310d0a486f73743a20<HONEYPOT>3a333030300d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b2056312e323034302e30290d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; V1.2040.0)","ja3":"","session":"090d1e1f-99f1-4d60-997a-30583e388540","seq":1,"duration_ms":100,"bytes_in":170,"bytes_out":78},{"timestamp":"2026-09-27T02:27:54","port":3000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:3000\",\"user-agent\":\"Mozilla/5.0 (compatible; V1.2040.0)\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/explore","summary":"","payload_hex":"474554202f6578706c6f726520485454502f312e310d0a486f73743a20<HONEYPOT>3a333030300d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b2056312e323034302e30290d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; V1.2040.0)","ja3":"","session":"0611212f-71d1-4b98-bd72-1954df16b8e2","seq":1,"duration_ms":100,"bytes_in":164,"bytes_out":78},{"timestamp":"2026-09-27T02:27:54","port":3000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:3000\",\"user-agent\":\"Mozilla/5.0 (compatible; V1.2040.0)\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/help","summary":"","payload_hex":"474554202f68656c7020485454502f312e310d0a486f73743a20<HONEYPOT>3a333030300d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b2056312e323034302e30290d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; V1.2040.0)","ja3":"","session":"e30c93fa-c9e6-498e-a4cc-a5dbf564f134","seq":1,"duration_ms":100,"bytes_in":161,"bytes_out":78},{"timestamp":"2026-09-27T02:27:54","port":3000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:3000\",\"user-agent\":\"Mozilla/5.0 (compatible; V1.2040.0)\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a333030300d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b2056312e323034302e30290d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; V1.2040.0)","ja3":"","session":"39d41367-d47d-4e3d-880e-63848950f291","seq":1,"duration_ms":100,"bytes_in":157,"bytes_out":78},{"timestamp":"2026-09-27T02:27:54","port":3000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:3000\",\"user-agent\":\"Mozilla/5.0 (compatible; V1.2040.0)\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/api/v2/monitor/system/status","summary":"","payload_hex":"474554202f6170692f76322f6d6f6e69746f722f73797374656d2f73746174757320485454502f312e310d0a486f73743a20<HONEYPOT>3a333030300d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b2056312e323034302e30290d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; V1.2040.0)","ja3":"","session":"2cc9eb18-db2a-48fc-8966-06a6b1397afd","seq":1,"duration_ms":100,"bytes_in":185,"bytes_out":78},{"timestamp":"2026-09-27T02:27:53","port":3000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:3000\",\"user-agent\":\"Mozilla/5.0 (compatible; V1.2040.0)\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/remote/info","summary":"","payload_hex":"474554202f72656d6f74652f696e666f20485454502f312e310d0a486f73743a20<HONEYPOT>3a333030300d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b2056312e323034302e30290d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; V1.2040.0)","ja3":"","session":"cc9ccfc6-0777-4579-891c-51cde238511f","seq":1,"duration_ms":100,"bytes_in":168,"bytes_out":78}],"http_methods":[{"method":"GET","count":213},{"method":"HEAD","count":4}],"distinct_ports_total":17,"top_paths":[{"path":"/","count":35,"ports":11},{"path":"/+CSCOE+/logon.html","count":23,"ports":11},{"path":"/remote/login","count":22,"ports":11},{"path":"/remote/info","count":22,"ports":11},{"path":"/api/v2/monitor/system/status","count":22,"ports":11},{"path":"/ui/imports-map/imports.json","count":22,"ports":11},{"path":"/help","count":13,"ports":11},{"path":"/explore","count":13,"ports":11},{"path":"/users/sign_in","count":13,"ports":11},{"path":"/api/v1/init_consts","count":9,"ports":2},{"path":"/api/v2.0/cmdb/system/admin%3F/../../../../../cgi-bin/fwbcgi","count":8,"ports":1},{"path":"/ews/","count":4,"ports":1},{"path":"/owa/auth/logon.aspx?replaceCurrent=1&url=https%3A%2F%2F<HONEYPOT>%2Fowa%2F","count":4,"ports":1},{"path":"/api/v2.0/cmdb/system/admin/../../../../../cgi-bin/fwbcgi","count":3,"ports":1},{"path":"/SimpleAuthWebService/SimpleAuth.asmx","count":2,"ports":1}],"distinct_paths_total":16,"top_snis":[],"top_hosts":[],"top_alpns":[{"value":"http/1.1","count":32}],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","Accept-Encoding","Connection","Host","User-Agent"],"representative":[{"name":"Accept","value":"*/*","notable":false},{"name":"Accept-Encoding","value":"gzip, deflate","notable":false},{"name":"Connection","value":"close","notable":false},{"name":"Host","value":"<HONEYPOT>:3000","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (compatible; V1.2040.0)","notable":false}],"distinct_sets":1,"events_with_headers":10},"tags":[{"tag_id":"CVE-2018-13379","tag_type":"cve","title":"Fortinet FortiOS SSL VPN path traversal","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/remote/fgt_lang","reference_urls":["https://nvd.nist.gov/vuln/detail/CVE-2018-13379"]},{"tag_id":"CVE-2025-64446","tag_type":"cve","title":"FortiWeb - Authentication Bypass","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/api/v2.0/cmdb/system/admin%3f/../../../../../cgi-bin/fwbcgi","reference_urls":["https://nvd.nist.gov/vuln/detail/CVE-2025-64446","https://x.com/defusedcyber/status/1975242250373517373","https://github.com/watchtowrlabs/watchTowr-vs-Fortiweb-AuthBypass","https://github.com/rapid7/metasploit-framework/pull/20698/files"]},{"tag_id":"CVE-2026-21643","tag_type":"cve","title":"Fortinet FortiClientEMS 7.4.4 - SQL Injection","severity":"CRITICAL","actively_exploited":true,"match_field":"url_path","matched_pattern":"/api/v1/init_consts","reference_urls":[]}],"data_as_of":"2026-09-30T18:04:15.678588+00:00"}