{"ip":"195.178.110.50","total_events":72,"verdict":{"verdict":"malicious","label":"Exploit attempts observed","detail":"2 exploit-path hits","confidence":"high","network_type":null,"why":["2 request(s) matched a known exploit path.","Body-carrying methods (POST/PUT/PATCH/DELETE) seen: payload delivery, not just recon.","Under 5 hits, so confidence is medium.","Not in any known-scanner range.","Sent 18,681 bytes: sustained payload delivery, not a single opportunistic request."],"engagement":{"level":"payload","label":"Sustained payload","detail":"18,681 bytes sent","bytes_sent":18681,"session_seconds":0,"persistent":false}},"first_seen":"2026-09-27T15:05:14","last_seen":"2026-09-28T09:57:17","events_24h":0,"events_7d":72,"geo":{"country_code":"BG","country_name":"Bulgaria","region":"","city":"","lat":42.696,"lon":23.332,"asn":48090,"org":"Techoff Srv Limited"},"source_domain":null,"known_scanners":[],"scanner_tag":null,"cve_matches":[{"cve_id":"CVE-2023-38646","title":"Metabase < 0.46.6.1 - Remote Code Execution","severity":"critical","actively_exploited":false,"match_field":"url_path","matched_pattern":"/api/session/properties"},{"cve_id":"CVE-2026-45397","title":"Open WebUI < 0.9.5 - Information Disclosure","severity":"medium","actively_exploited":false,"match_field":"url_path","matched_pattern":"/api/v1/retrieval"}],"malware":[],"top_ports":[{"port":8081,"proto":"tcp","label":"","count":61},{"port":3000,"proto":"tcp","label":"Web-alt","count":5},{"port":18332,"proto":"tcp","label":"","count":4},{"port":8332,"proto":"tcp","label":"","count":1},{"port":2718,"proto":"tcp","label":"","count":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i311000_e8f1e7e78f70_d41ae481755e"],"tls_client_hello":"1603010200010001fc0303e6853e1772ced8f4efda1c63deda53de414527fe9a26d030afc1b5e322c1c146205497cadbbd948e262f158ee1a9338e3f0efa1f9a474e864461882e0d05d06cf1003e130213031301c02cc030009fcca9cca8ccaac02bc02f009ec024c028006bc023c0270067c00ac0140039c009c0130033009d009c003d003c0035002f00ff01000175000b000403000102000a00160014001d0017001e0019001801000101010201030104002300000016000000170000000d002a0028040305030603080708080809080a080b080408050806040105010601030303010302040205020602002b00050403040303002d00020101003300260024001d00200e216cc74b2d2b265761fd8733eaf27c6e8f94f52b2a750f699870c0863fd338001500dc00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000","tls_ja3":["c12b4ccd5320bbb380ca1a9df90f771d"],"http_akin":["a11cuq060_0000064e_95cc9d02","a11cun051_0000004e_2619b3ac","a11cun040_0000004e_608dab68","a11cun061_0000004f_dca719ef"]},"fingerprint_peers":{"t13i311000_e8f1e7e78f70_d41ae481755e":799,"a11cuq060_0000064e_95cc9d02":10,"a11cun051_0000004e_2619b3ac":17,"a11cun040_0000004e_608dab68":846,"a11cun061_0000004f_dca719ef":1},"akin_families":{"a11cun040_0000004e_608dab68":{"head":"a11cun040_0000004e_608dab68","shapes":2,"ips":848}},"user_agents":["Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36","Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 Chrome/153.0.0.0 Safari/537.36","ghost-pay-hunter","Python-urllib/3.12"],"timeline":[{"date":"2026-09-27","count":20},{"date":"2026-09-28","count":52}],"recent_events":[{"timestamp":"2026-09-28T09:57:17","port":8332,"proto":"tcp","app_proto":"","app_protocol":"mining","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"{\"jsonrpc\":\"1.0\",\"id\":1,\"method\":\"getbalance\",\"params\":[]}\n","payload_hex":"7b226a736f6e727063223a22312e30222c226964223a312c226d6574686f64223a2267657462616c616e6365222c22706172616d73223a5b5d7d0a","method":"","user_agent":"","ja3":"","session":"99ca9947-365f-4bb9-b0ea-d6c6740f0eae","seq":1,"duration_ms":100,"bytes_in":59,"bytes_out":14,"enriched":{"digest":"bf5e36538e49a860","strings":["{\"jsonrpc\":\"1.0\",\"id\":1,\"method\":\"getbalance\",\"params\":[]}"]}},{"timestamp":"2026-09-28T09:19:59","port":3000,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"identity\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:3000\",\"user-agent\":\"ghost-pay-hunter\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/api/v1/retrieval/","summary":"","payload_hex":"474554202f6170692f76312f72657472696576616c2f20485454502f312e310d0a4163636570742d456e636f64696e673a206964656e746974790d0a486f73743a20<HONEYPOT>3a333030300d0a557365722d4167656e743a2067686f73742d7061792d68756e7465720d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"ghost-pay-hunter","ja3":"c12b4ccd5320bbb380ca1a9df90f771d","session":"4a351ffe-3ce9-47fc-a50a-a05b74e4288a","seq":1,"duration_ms":100,"bytes_in":150,"bytes_out":79},{"timestamp":"2026-09-28T09:19:58","port":3000,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"identity\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:3000\",\"user-agent\":\"ghost-pay-hunter\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/api/config","summary":"","payload_hex":"474554202f6170692f636f6e66696720485454502f312e310d0a4163636570742d456e636f64696e673a206964656e746974790d0a486f73743a20<HONEYPOT>3a333030300d0a557365722d4167656e743a2067686f73742d7061792d68756e7465720d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"ghost-pay-hunter","ja3":"c12b4ccd5320bbb380ca1a9df90f771d","session":"0ec56527-272f-4523-94f4-5b8c9398f64d","seq":1,"duration_ms":100,"bytes_in":143,"bytes_out":79},{"timestamp":"2026-09-28T04:19:48","port":8081,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"identity\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8081\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 Chrome/153.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/.htpasswd","summary":"","payload_hex":"474554202f2e687470617373776420485454502f312e310d0a4163636570742d456e636f64696e673a206964656e746974790d0a486f73743a20<HONEYPOT>3a383038310d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f363429204170706c655765624b69742f3533372e3336204368726f6d652f3135332e302e302e30205361666172692f3533372e33360d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 Chrome/153.0.0.0 Safari/537.36","ja3":"","session":"f5fd38e6-8b71-4908-a678-0c9a09e92601","seq":1,"duration_ms":100,"bytes_in":194,"bytes_out":79},{"timestamp":"2026-09-28T04:19:47","port":8081,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"identity\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8081\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 Chrome/153.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/.bash_history","summary":"","payload_hex":"474554202f2e626173685f686973746f727920485454502f312e310d0a4163636570742d456e636f64696e673a206964656e746974790d0a486f73743a20<HONEYPOT>3a383038310d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f363429204170706c655765624b69742f3533372e3336204368726f6d652f3135332e302e302e30205361666172692f3533372e33360d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 Chrome/153.0.0.0 Safari/537.36","ja3":"","session":"552d3d05-061f-4ea2-a25f-b93b15dc39f2","seq":1,"duration_ms":100,"bytes_in":198,"bytes_out":79},{"timestamp":"2026-09-28T04:19:47","port":8081,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"identity\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8081\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 Chrome/153.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/.aws/credentials","summary":"","payload_hex":"474554202f2e6177732f63726564656e7469616c7320485454502f312e310d0a4163636570742d456e636f64696e673a206964656e746974790d0a486f73743a20<HONEYPOT>3a383038310d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f363429204170706c655765624b69742f3533372e3336204368726f6d652f3135332e302e302e30205361666172692f3533372e33360d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 Chrome/153.0.0.0 Safari/537.36","ja3":"","session":"a6e312b1-666a-4949-b2bf-a3e1c0c6b839","seq":1,"duration_ms":100,"bytes_in":201,"bytes_out":79},{"timestamp":"2026-09-28T04:19:47","port":8081,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"identity\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8081\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 Chrome/153.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/secrets.json","summary":"","payload_hex":"474554202f736563726574732e6a736f6e20485454502f312e310d0a4163636570742d456e636f64696e673a206964656e746974790d0a486f73743a20<HONEYPOT>3a383038310d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f363429204170706c655765624b69742f3533372e3336204368726f6d652f3135332e302e302e30205361666172692f3533372e33360d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 Chrome/153.0.0.0 Safari/537.36","ja3":"","session":"06f713d4-2939-46f2-81dd-609e5837c3d8","seq":1,"duration_ms":100,"bytes_in":197,"bytes_out":79},{"timestamp":"2026-09-28T04:19:47","port":8081,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"identity\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8081\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 Chrome/153.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/appsettings.json","summary":"","payload_hex":"474554202f61707073657474696e67732e6a736f6e20485454502f312e310d0a4163636570742d456e636f64696e673a206964656e746974790d0a486f73743a20<HONEYPOT>3a383038310d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f363429204170706c655765624b69742f3533372e3336204368726f6d652f3135332e302e302e30205361666172692f3533372e33360d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 Chrome/153.0.0.0 Safari/537.36","ja3":"","session":"4e64fa4a-dd1a-4f9e-8202-5b857da52ce3","seq":1,"duration_ms":100,"bytes_in":201,"bytes_out":79},{"timestamp":"2026-09-28T04:19:46","port":8081,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"identity\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8081\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 Chrome/153.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/server.js","summary":"","payload_hex":"474554202f7365727665722e6a7320485454502f312e310d0a4163636570742d456e636f64696e673a206964656e746974790d0a486f73743a20<HONEYPOT>3a383038310d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f363429204170706c655765624b69742f3533372e3336204368726f6d652f3135332e302e302e30205361666172692f3533372e33360d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 Chrome/153.0.0.0 Safari/537.36","ja3":"","session":"c4189213-47fa-49b6-91a3-2606bd46227b","seq":1,"duration_ms":100,"bytes_in":194,"bytes_out":79},{"timestamp":"2026-09-28T04:19:46","port":8081,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"identity\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8081\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 Chrome/153.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/app.py","summary":"","payload_hex":"474554202f6170702e707920485454502f312e310d0a4163636570742d456e636f64696e673a206964656e746974790d0a486f73743a20<HONEYPOT>3a383038310d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f363429204170706c655765624b69742f3533372e3336204368726f6d652f3135332e302e302e30205361666172692f3533372e33360d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 Chrome/153.0.0.0 Safari/537.36","ja3":"","session":"51ce91d7-9fce-4aee-b853-dfda28e09bfe","seq":1,"duration_ms":100,"bytes_in":191,"bytes_out":79}],"http_methods":[{"method":"GET","count":53},{"method":"POST","count":14}],"distinct_ports_total":5,"top_paths":[{"path":"/v1/models","count":17,"ports":1},{"path":"/model/new","count":9,"ports":1},{"path":"/v1/chat/completions","count":6,"ports":1},{"path":"/model/info","count":4,"ports":1},{"path":"/models","count":1,"ports":1},{"path":"/api/session/properties","count":1,"ports":1},{"path":"/main.py","count":1,"ports":1},{"path":"/api/org","count":1,"ports":1},{"path":"/config","count":1,"ports":1},{"path":"/.bash_history","count":1,"ports":1},{"path":"/secrets.json","count":1,"ports":1},{"path":"/config.yaml","count":1,"ports":1},{"path":"/app.py","count":1,"ports":1},{"path":"/config.json","count":1,"ports":1},{"path":"/config/yaml","count":1,"ports":1}],"distinct_paths_total":35,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","Accept-Encoding","Connection","Host","User-Agent"],"representative":[{"name":"Accept","value":"*/*","notable":false},{"name":"Accept-Encoding","value":"identity","notable":false},{"name":"Connection","value":"close","notable":false},{"name":"Host","value":"<HONEYPOT>:3000","notable":false},{"name":"User-Agent","value":"ghost-pay-hunter","notable":false}],"distinct_sets":2,"events_with_headers":9},"tags":[{"tag_id":"CVE-2023-38646","tag_type":"cve","title":"Metabase < 0.46.6.1 - Remote Code Execution","severity":"critical","actively_exploited":false,"match_field":"url_path","matched_pattern":"/api/session/properties","reference_urls":["https://www.metabase.com/blog/security-advisory","https://github.com/metabase/metabase/releases/tag/v0.46.6.1","https://mp.weixin.qq.com/s/ATFwFl-D8k9QfQfzKjZFDg","https://news.ycombinator.com/item?id=36812256","https://blog.assetnote.io/2023/07/22/pre-auth-rce-metabase/"]},{"tag_id":"CVE-2026-45397","tag_type":"cve","title":"Open WebUI < 0.9.5 - Information Disclosure","severity":"medium","actively_exploited":false,"match_field":"url_path","matched_pattern":"/api/v1/retrieval","reference_urls":["https://github.com/open-webui/open-webui/security/advisories/GHSA-65pg-qhhw-mxwg","https://github.com/open-webui/open-webui","https://nvd.nist.gov/vuln/detail/CVE-2026-45397"]}],"data_as_of":"2026-09-30T03:56:19.403574+00:00"}