{"ip":"185.91.69.38","total_events":93,"verdict":{"verdict":"probing","label":"Low-level probing","detail":null,"confidence":"low","network_type":null},"first_seen":"2026-06-16T02:24:53","last_seen":"2026-06-23T05:13:35","events_24h":0,"events_7d":31,"geo":{"country_code":"GB","country_name":"United Kingdom","region":"England","city":"Redditch","lat":52.2713,"lon":-1.8875,"asn":201579,"org":"Hostgnome Ltd"},"source_domain":null,"known_scanners":[],"scanner_tag":null,"cve_matches":[{"cve_id":"CVE-2022-40734","title":"Laravel Filemanager v2.5.1 - Local File Inclusion","severity":"medium","actively_exploited":false,"match_field":"url_path","matched_pattern":"/download"}],"top_ports":[{"port":445,"proto":"tcp","label":"SMB","count":93}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i181000_85036bcba153_d41ae481755e"],"tls_ja3":["8a9d5d0f12f7d43ee3af1c51d2998d99"],"ja4h":["ge11nn06en_1257db3eebd3","po11nn07en_e8e145d78e03","ge11nn0400_9795830020a3","po11nn09en_7560d3ae9ff8"]},"fingerprint_peers":{"t13i181000_85036bcba153_d41ae481755e":83,"ge11nn06en_1257db3eebd3":10,"ge11nn0400_9795830020a3":10,"po11nn07en_e8e145d78e03":10,"po11nn09en_7560d3ae9ff8":10},"user_agents":["Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0; ; NCLIENT50_AAPCDA5841E333)","Go-http-client/1.1","cloudflared/2025.11.1","Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko","Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36"],"timeline":[{"date":"2026-06-16","count":31},{"date":"2026-06-17","count":31},{"date":"2026-06-23","count":31}],"recent_events":[{"timestamp":"2026-06-23T05:13:35","port":445,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"��\u0001u�Ng͜l\u0013��+E��\"\b�� E��-\u000b�� \u0013��/\n��tE��J��|V��x_��wV��vJ��y^��V��cT��R��|P��{W��c\u0013��>E��;\u0014��\u0011\u0014��l]��cV��cU��Q��z^��}_��P��zV��~J��{V��zU��cR��lK��=\u0002�� \u0006��l]��*\n��lK�� \u000e��/\u000b��'\n��tE��|R��~I��nW��~T��vE��+\u001f��<\t��\u0011\u000e��tE��vI��}I��`U��bE��-\u0006��!\t��l�FV��pǪ�k\u0001����l\u0000��;\u0017��l^��(\u0003��zS��}S��|^��z\u0006��z_��_��E��<\u0002��<\f��lE��!\u0014��+\n��7E��\u0019\u000e��!\u0010��W��xS��z ��bE��/\u0015��>8��/\u0013��l]�\u0001���\u0002����","payload_hex":"81fe0175e74e67cd9c6c13b4972b45f7c52208aa8e2045e1c52d0ba482201392892f0aa8c574459eca7f4af8ca7c56e0d6785ff8d37756fed4764af9d6795efbd37f56fbd76354f5d27f52fbd37c50f5ca7b57fdca6313a88a3e45e1c53b14a8951114a4836c5defb46356e0d26355fcca7f51f5d27a5efcd47d5fe0d37f50f4d17a56fcd17e4afedf7b56f8d17a55fadf6352fdd76c4bef923d02bfb82006a0826c5defa62a0aa4896c4bef8e200eb98e2f0b9293270aa8c57445ffd77c52e3d67e49fed66e57f5dd7e54f7d57645e1c52b1fb9823c09ac8b110ebdc57445fcd27649fcd07d49ffd46055fac56245a1882d06b98e2109efdd6c8f4656abfc70c7aadb6b01dbc1efcb6c00bf883b17efdd6c5eae862803f5de7a53f4857d53fdd17c5eff857a06f9d17a5ff9817f5ff8867f45e1c53c02a0863c0cefdd6c45e1c52114928a2b0aa2953745f7c5190ea3832110bec77f57ed9f7853e1c77a208fc56245be932f15b9923e38be932f13b8946c5def01d6c8e202e3ffef9a","method":"","user_agent":"","community_id":"1:yZdABRUhnkNukNTwkpWhT4iH4Eo=","ja3":"8a9d5d0f12f7d43ee3af1c51d2998d99","session":"7834ede2-cd91-4b96-9a1f-4f1b9bec84be","seq":2,"duration_ms":385,"bytes_in":547,"bytes_out":89},{"timestamp":"2026-06-23T05:13:35","port":445,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"Upgrade,Keep-Alive\",\"host\":\"<HONEYPOT>:445\",\"sec-websocket-key\":\"s6FNtxtiJS+DqGjVExTxYg==\",\"sec-websocket-version\":\"13\",\"upgrade\":\"websocket\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a436f6e6e656374696f6e3a20557067726164652c4b6565702d416c6976650d0a557067726164653a20776562736f636b65740d0a5365632d576562536f636b65742d4b65793a207336464e747874694a532b4471476a564578547859673d3d0d0a5365632d576562536f636b65742d56657273696f6e3a2031330d0a486f73743a20<HONEYPOT>3a3434350d0a0d0a","method":"GET","user_agent":"","community_id":"1:yZdABRUhnkNukNTwkpWhT4iH4Eo=","ja3":"8a9d5d0f12f7d43ee3af1c51d2998d99","session":"7834ede2-cd91-4b96-9a1f-4f1b9bec84be","seq":1,"duration_ms":192,"bytes_in":166,"bytes_out":77},{"timestamp":"2026-06-23T05:13:25","port":445,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"��\u0001u�Ng͜l\u0013��+E��\"\b�� E��-\u000b�� \u0013��/\n��tE��J��|V��x_��wV��vJ��y^��V��cT��R��|P��{W��c\u0013��>E��;\u0014��\u0011\u0014��l]��cV��cU��Q��z^��}_��P��zV��~J��{V��zU��cR��lK��=\u0002�� \u0006��l]��*\n��lK�� \u000e��/\u000b��'\n��tE��|R��~I��nW��~T��vE��+\u001f��<\t��\u0011\u000e��tE��vI��}I��`U��bE��-\u0006��!\t��l�FV��pǪ�k\u0001����l\u0000��;\u0017��l^��(\u0003��zS��}S��|^��z\u0006��z_��_��E��<\u0002��<\f��lE��!\u0014��+\n��7E��\u0019\u000e��!\u0010��W��xS��z ��bE��/\u0015��>8��/\u0013��l]�\u0001���\u0002����","payload_hex":"81fe0175e74e67cd9c6c13b4972b45f7c52208aa8e2045e1c52d0ba482201392892f0aa8c574459eca7f4af8ca7c56e0d6785ff8d37756fed4764af9d6795efbd37f56fbd76354f5d27f52fbd37c50f5ca7b57fdca6313a88a3e45e1c53b14a8951114a4836c5defb46356e0d26355fcca7f51f5d27a5efcd47d5fe0d37f50f4d17a56fcd17e4afedf7b56f8d17a55fadf6352fdd76c4bef923d02bfb82006a0826c5defa62a0aa4896c4bef8e200eb98e2f0b9293270aa8c57445ffd77c52e3d67e49fed66e57f5dd7e54f7d57645e1c52b1fb9823c09ac8b110ebdc57445fcd27649fcd07d49ffd46055fac56245a1882d06b98e2109efdd6c8f4656abfc70c7aadb6b01dbc1efcb6c00bf883b17efdd6c5eae862803f5de7a53f4857d53fdd17c5eff857a06f9d17a5ff9817f5ff8867f45e1c53c02a0863c0cefdd6c45e1c52114928a2b0aa2953745f7c5190ea3832110bec77f57ed9f7853e1c77a208fc56245be932f15b9923e38be932f13b8946c5def01d6c8e202e3ffef9a","method":"","user_agent":"","community_id":"1:RcQi1uFAjfihMgutyx346jaxLRs=","ja3":"8a9d5d0f12f7d43ee3af1c51d2998d99","session":"6c856c62-00a5-41b5-b9c9-89579603399b","seq":2,"duration_ms":384,"bytes_in":547,"bytes_out":89},{"timestamp":"2026-06-23T05:13:24","port":445,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"Upgrade,Keep-Alive\",\"host\":\"<HONEYPOT>:445\",\"sec-websocket-key\":\"s6FNtxtiJS+DqGjVExTxYg==\",\"sec-websocket-version\":\"13\",\"upgrade\":\"websocket\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a436f6e6e656374696f6e3a20557067726164652c4b6565702d416c6976650d0a557067726164653a20776562736f636b65740d0a5365632d576562536f636b65742d4b65793a207336464e747874694a532b4471476a564578547859673d3d0d0a5365632d576562536f636b65742d56657273696f6e3a2031330d0a486f73743a20<HONEYPOT>3a3434350d0a0d0a","method":"GET","user_agent":"","community_id":"1:RcQi1uFAjfihMgutyx346jaxLRs=","ja3":"8a9d5d0f12f7d43ee3af1c51d2998d99","session":"6c856c62-00a5-41b5-b9c9-89579603399b","seq":1,"duration_ms":191,"bytes_in":166,"bytes_out":77},{"timestamp":"2026-06-23T05:13:14","port":445,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"���tp`�tp`\u00041�n�tp`^t��","payload_hex":"829094747060847470600431da6e947470605e74b2a6","method":"","user_agent":"","community_id":"1:QqKi5C40hoE/O6dRcpSdppSWgpM=","ja3":"8a9d5d0f12f7d43ee3af1c51d2998d99","session":"11591b6e-bc63-4cde-a0de-d3965076d229","seq":2,"duration_ms":387,"bytes_in":212,"bytes_out":89,"enriched":{"digest":"156bf46aac0ad184","strings":["tp`^t"]}},{"timestamp":"2026-06-23T05:13:14","port":445,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"Upgrade\",\"host\":\"<HONEYPOT>:445\",\"sec-websocket-key\":\"7cFGaG1PCHdL3Z3nEoDtpQ==\",\"sec-websocket-version\":\"13\",\"upgrade\":\"websocket\",\"user-agent\":\"cloudflared/2025.11.1\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a3434350d0a557365722d4167656e743a20636c6f7564666c617265642f323032352e31312e310d0a436f6e6e656374696f6e3a20557067726164650d0a5365632d576562536f636b65742d4b65793a2037634647614731504348644c335a336e456f447470513d3d0d0a5365632d576562536f636b65742d56657273696f6e3a2031330d0a557067726164653a20776562736f636b65740d0a0d0a","method":"GET","user_agent":"cloudflared/2025.11.1","community_id":"1:QqKi5C40hoE/O6dRcpSdppSWgpM=","ja3":"8a9d5d0f12f7d43ee3af1c51d2998d99","session":"11591b6e-bc63-4cde-a0de-d3965076d229","seq":1,"duration_ms":192,"bytes_in":190,"bytes_out":77},{"timestamp":"2026-06-23T05:13:13","port":445,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9\",\"accept-language\":\"en;q=0.9\",\"cache-control\":\"max-age=0\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:445\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"504f5354202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a3434350d0a436f6e6e656374696f6e3a20636c6f73650d0a43616368652d436f6e74726f6c3a20206d61782d6167653d300d0a4163636570743a20746578742f68746d6c2c6170706c69636174696f6e2f7868746d6c2b786d6c2c6170706c69636174696f6e2f786d6c3b713d302e392c696d6167652f617669662c696d6167652f776562702c696d6167652f61706e672c2a2f2a3b713d302e382c6170706c69636174696f6e2f7369676e65642d65786368616e67653b763d62333b713d302e390d0a4163636570742d4c616e67756167653a20656e3b713d302e390d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f39342e302e343630362e3631205361666172692f3533372e33360d0a0d0a","method":"POST","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36","community_id":"1:WhIQGaIG9BiVR1nM1ZvdgVRHtss=","ja3":"8a9d5d0f12f7d43ee3af1c51d2998d99","session":"9a451835-e7bf-47ab-b0ba-0efc5fdd4ee0","seq":1,"duration_ms":192,"bytes_in":389,"bytes_out":77},{"timestamp":"2026-06-23T05:13:13","port":445,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"Upgrade\",\"host\":\"<HONEYPOT>:445\",\"sec-websocket-key\":\"XohCfELjK/JZn1hFx37O4Q==\",\"sec-websocket-protocol\":\"chisel-v3\",\"sec-websocket-version\":\"13\",\"upgrade\":\"websocket\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a3434350d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a436f6e6e656374696f6e3a20557067726164650d0a5365632d576562536f636b65742d4b65793a20586f684366454c6a4b2f4a5a6e3168467833374f34513d3d0d0a5365632d576562536f636b65742d50726f746f636f6c3a2063686973656c2d76330d0a5365632d576562536f636b65742d56657273696f6e3a2031330d0a557067726164653a20776562736f636b65740d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","community_id":"1:xwFN55L/Qkx72mKTUlvzyG0we94=","ja3":"8a9d5d0f12f7d43ee3af1c51d2998d99","session":"f5840e46-f555-4b26-b0e6-89f2fc02fdea","seq":1,"duration_ms":191,"bytes_in":222,"bytes_out":77},{"timestamp":"2026-06-23T05:13:02","port":445,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0000\u0001\u0000\u0001\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000�o\u0000\u0000\u0000\u0000\u0000\u0000\u0000�{\"version\":\"0.38.0\",\"hostname\":\"\",\"os\":\"windows\",\"arch\":\"amd64\",\"user\":\"\",\"privilege_key\":\"875d91383d2cefef02da1dce0ef4ea0d\",\"timestamp\":1782191582,\"run_id\":\"\",\"metas\":null,\"pool_count\":1}","payload_hex":"0001000100000001000000000000000000000001000000c56f00000000000000bc7b2276657273696f6e223a22302e33382e30222c22686f73746e616d65223a22222c226f73223a2277696e646f7773222c2261726368223a22616d643634222c2275736572223a22222c2270726976696c6567655f6b6579223a223837356439313338336432636566656630326461316463653065663465613064222c2274696d657374616d70223a313738323139313538322c2272756e5f6964223a22222c226d65746173223a6e756c6c2c22706f6f6c5f636f756e74223a317d","method":"","user_agent":"","community_id":"1:5+qoFhShvt8GNJl1uIoBtZahOz0=","ja3":"8a9d5d0f12f7d43ee3af1c51d2998d99","session":"6598b57b-4a8d-4ead-bd0e-9b872789f7c5","seq":1,"duration_ms":192,"bytes_in":221,"bytes_out":12,"enriched":{"digest":"b893e9de6a21a62c","strings":["{\"version\":\"0.38.0\",\"hostname\":\"\",\"os\":\"windows\",\"arch\":\"amd64\",\"user\":\"\",\"privi…"]}},{"timestamp":"2026-06-23T05:13:02","port":445,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9\",\"accept-language\":\"en;q=0.9\",\"authorization\":\"Bearer eyJ\",\"cache-control\":\"max-age=0\",\"connection\":\"close\",\"content-type\":\"application/octet-stream; charset=utf-8\",\"host\":\"<HONEYPOT>:445\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"504f5354202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a3434350d0a436f6e6e656374696f6e3a20636c6f73650d0a43616368652d436f6e74726f6c3a20206d61782d6167653d300d0a4163636570743a20746578742f68746d6c2c6170706c69636174696f6e2f7868746d6c2b786d6c2c6170706c69636174696f6e2f786d6c3b713d302e392c696d6167652f617669662c696d6167652f776562702c696d6167652f61706e672c2a2f2a3b713d302e382c6170706c69636174696f6e2f7369676e65642d65786368616e67653b763d62333b713d302e390d0a4163636570742d4c616e67756167653a20656e3b713d302e390d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f39342e302e343630362e3631205361666172692f3533372e33360d0a417574686f72697a6174696f6e3a204265617265722065794a0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6f637465742d73747265616d3b20636861727365743d7574662d380d0a0d0a","method":"POST","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36","community_id":"1:dsAltgRXW7TE53GZ9uYvy/tGJQ8=","ja3":"8a9d5d0f12f7d43ee3af1c51d2998d99","session":"122e1d98-898a-45cb-90de-938c5a366bc7","seq":1,"duration_ms":192,"bytes_in":471,"bytes_out":77}],"http_methods":[{"method":"GET","count":51},{"method":"POST","count":18}],"distinct_ports_total":1,"top_paths":[{"path":"/","count":39,"ports":1},{"path":"stager64","count":3,"ports":1},{"path":"/WuEL","count":3,"ports":1},{"path":"/a","count":3,"ports":1},{"path":"/mPlayer","count":3,"ports":1},{"path":"/download/popy","count":3,"ports":1},{"path":"/SiteLoader","count":3,"ports":1},{"path":"/en-us/index.html","count":3,"ports":1},{"path":"/ui/authentication","count":3,"ports":1},{"path":"/download/file.ext","count":3,"ports":1},{"path":"/HWi69nR2Ju_iduN3g_cVUQLEOCO3d031o2UIqyYZwAsrVo8gXo9MAQE08r0R1xysXgOB0oD18-94A1Ah0z60/","count":3,"ports":1}],"distinct_paths_total":11,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","Accept-Language","Authorization","Cache-Control","Connection","Content-Type","Host","User-Agent"],"representative":[{"name":"Accept","value":"text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9","notable":false},{"name":"Accept-Language","value":"en;q=0.9","notable":false},{"name":"Authorization","value":"Bearer eyJ","notable":true},{"name":"Cache-Control","value":"max-age=0","notable":false},{"name":"Connection","value":"close","notable":false},{"name":"Content-Type","value":"application/octet-stream; charset=utf-8","notable":true},{"name":"Host","value":"<HONEYPOT>:445","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36","notable":false}],"distinct_sets":5,"events_with_headers":6},"tags":[{"tag_id":"CVE-2022-40734","tag_type":"cve","title":"Laravel Filemanager v2.5.1 - Local File Inclusion","severity":"medium","actively_exploited":false,"match_field":"url_path","matched_pattern":"/download","reference_urls":["https://github.com/UniSharp/laravel-filemanager/issues/1150","https://nvd.nist.gov/vuln/detail/CVE-2022-40734","https://github.com/UniSharp/laravel-filemanager/issues/1150#issuecomment-1320186966","https://github.com/UniSharp/laravel-filemanager/issues/1150#issuecomment-1825310417","https://github.com/ARPSyndicate/cvemon"]}],"data_as_of":"2026-06-24T12:37:41.469822+00:00"}