{"ip":"196.124.225.74","total_events":75,"verdict":{"verdict":"malicious","label":"Exploit attempts observed","detail":"65 exploit-path hits","confidence":"high","network_type":null,"why":["65 request(s) matched a known exploit path.","Body-carrying methods (POST/PUT/PATCH/DELETE) seen: payload delivery, not just recon.","5+ hits raise confidence to high.","Not in any known-scanner range.","Sent 267,141 bytes: sustained payload delivery, not a single opportunistic request."],"engagement":{"level":"payload","label":"Sustained payload","detail":"267,141 bytes sent","bytes_sent":267141,"session_seconds":23,"persistent":false}},"first_seen":"2026-09-29T17:02:43","last_seen":"2026-09-29T17:10:24","events_24h":0,"events_7d":75,"geo":{"country_code":"MA","country_name":"Morocco","region":"Casablanca-Settat","city":"Casablanca","lat":33.5922,"lon":-7.6184,"asn":36925,"org":"MEDITELECOM"},"source_domain":null,"known_scanners":[],"scanner_tag":null,"cve_matches":[],"malware":[],"top_ports":[{"port":80,"proto":"tcp","label":"HTTP","count":67},{"port":37777,"proto":"tcp","label":"","count":4},{"port":8000,"proto":"tcp","label":"HTTP-alt","count":1},{"port":443,"proto":"tcp","label":"HTTPS","count":1},{"port":8088,"proto":"tcp","label":"Hadoop","count":1},{"port":8080,"proto":"tcp","label":"HTTP-alt","count":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i131000_f57a46bbacb6_ab7e3b40a677"],"tls_client_hello":"16030105c6010005c20303b1685a11db5e79b4173845051ff61e04da2b0282c65d2b35ebd262de624e395c20159fda35e7d3ea828493524779c0c6bc09bc3d0bea9c8c580b3b16d30c721f6a001ac02bc02fc02cc030cca9cca8c009c013c00ac0141301130213030100055f000b00020100ff010001000017000000120000000500050100000000000a0010000e11ec11eb11ed001d001700180019000d0016001408040403080708050806040105010601050306030032001a0018080404030807080508060401050106010503060302010203002b00050403040303003304ea04e811ec04c06240a8c6cb032af6955b44cd3eb757f5840b85a1a5876a0683f22961fc595d258fe2a219a40b9f8e84a7b40a06ef92b834265c91d41c5b74c3a1e402c78ba0eb6ca1c2a8aa22a38271b2cea63ab8c06548180a36ca43b185001570ccb473b228585516eebc5e65e14dc3064b364a10dd61934479ccb9668535c52396637c10634910785c57e42f57c5312d4a06bd9cba39f523a43303dca18e6c9cb6bc2abc9b586a9d0c95d913b32a9c311480606033439ab4346c6146d5147217a4ad5c51b81849589a5cce1a829e638125d9f9bcfd56abf6cc5f0c56b373c577de5309ffe3842d081c42517a74820220e487c165349858c8cd02b88fe131dee3131ef5173eabce5f6c5c87c12b3a648c6bb856d3e34ec2940c82893d50472c000c077f187b9ed06f8102816be29dc94353f676b2d6c38c0fe798d874b3daf17ea5894aa9127aae0a2c27567956514924fc00fdb6cde4aa487b0113aff49d84693bcef57ff137a979400b87344ee6b6b3fc1858c3a60e38a6595ffa2b2c795913d0b380a31c70f69042c467d900702e327de40a3a11202c078aba57ab6a379aba2767067f0ac7b4391dc7d00a7aeca828268cb7568d18f4493e6534c279a2c389b85da2bc59520535d54d87dc0098a82649fc01a1a6a35bc65938487c4e5cc10ca6b77957207793cc07409169d04a4c2260a5148cfd49b798c6320e0899349bad2816884ee76242cb524c1550be19a9fda86b708a1207bc6af257604e66520ecc2438606f73c8a3eaa08961509e6fe099a6eaafc406210b140266152e313976fe7075eef67fb8995ddfb96478c3744ba29ee39a903a67551a43a0f76c3cd0945ed10252a2f7064d2c01737900ec6977c438c683998397eac94a494d1471b72d8cca2feacc49742ce0e7103e48ad25e3afaa033fcd4b6c4f0b236868c54f412cc7955ba7fc2dfd441cd1f14ca1dc000983937936bb5b95b3ff0c679afa0a7f40b4bb01d019531370153de64352e668b9abd21ce9f1ca6cdb1741a3adbc8286926ac049122b7d857f6f535d5230129ec0346e17052b325ab42435b7f5720cb5550c340f7ab74c27d153d214b10da5a136d4572efab46d7a0873d47834f779474a65adf63d660bb1c5e67b6ee33a05bb2029026d6317075414688ab563be76a88194a559a258845896f0c705bca05f1241a2fa6837527ca28c92becce94407589ac9f01320d9c2700b6295facd4998074f06c566cbc43e87a1f7204ebbb63b4419b52b19862f7239d01c37b29c6320c8842a4cc68ef54b64e62a38222b487006b8c8170c589d14da5593c62ae9a57fa55778fdd2aa23b9aa56294cba4c168c78001bf5747ba4655ca6480b4684dc505f24d30c4ae906c1ac02e60c5b8a562dfebcacc6015be3bb470a638af6015ac51a5a4c4ccc9c8622071452eb87063487b72274c2468862f7521cef75301a8938357146211a20a9f69e3347c665852bdd04a77cb58947d0784cfbb5800026394808fea97b687c4364473fc220a1be730e1722270fa61d1d9a73f787aff2a083333c0901c760f9fa675d8a933fda002fc59166e681da763e0bbb6b0ae225d9ec8da1184dfe55be8bbb3e763323c6f684cf93c74a73846606760375cab9e439e834479312fcefa7c6c4c758cb98cfbc8a4b3f1744f86add9bbef758a82f68aba2730f7164b02fde527f220f137dc8a6deef1c5529b5a8fb2577001d0020f758a82f68aba2730f7164b02fde527f220f137dc8a6deef1c5529b5","tls_ja3":["725543c78edf669194c11dc7a039b56e"],"http_akin":["b11cun030_00040012_13ee3d34","b11cuq072_00050812_b8f6b5c2_xdbf2ff63","b10cun030_00040011_c91eaf54"]},"fingerprint_peers":{"t13i131000_f57a46bbacb6_ab7e3b40a677":4819,"b11cun030_00040012_13ee3d34":5046,"b11cuq072_00050812_b8f6b5c2_xdbf2ff63":1,"b10cun030_00040011_c91eaf54":14},"akin_families":{},"user_agents":["Dahua/2.0","Dahua/2.0; Dahua/3.0","Go-http-client/1.1"],"timeline":[{"date":"2026-09-29","count":75}],"recent_events":[{"timestamp":"2026-09-29T17:10:24","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:80\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/cgi-bin/snapshot.cgi?channel=63","summary":"","payload_hex":"474554202f6367692d62696e2f736e617073686f742e6367693f6368616e6e656c3d363320485454502f312e310d0a486f73743a20<HONEYPOT>3a38300d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"","session":"95019b2a-d864-4b6e-b743-adf1322863e2","seq":64,"duration_ms":23294,"bytes_in":8182,"bytes_out":5056},{"timestamp":"2026-09-29T17:10:24","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:80\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/cgi-bin/snapshot.cgi?channel=62","summary":"","payload_hex":"474554202f6367692d62696e2f736e617073686f742e6367693f6368616e6e656c3d363220485454502f312e310d0a486f73743a20<HONEYPOT>3a38300d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"","session":"95019b2a-d864-4b6e-b743-adf1322863e2","seq":63,"duration_ms":22992,"bytes_in":8054,"bytes_out":4977},{"timestamp":"2026-09-29T17:10:24","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:80\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/cgi-bin/snapshot.cgi?channel=61","summary":"","payload_hex":"474554202f6367692d62696e2f736e617073686f742e6367693f6368616e6e656c3d363120485454502f312e310d0a486f73743a20<HONEYPOT>3a38300d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"","session":"95019b2a-d864-4b6e-b743-adf1322863e2","seq":62,"duration_ms":22725,"bytes_in":7926,"bytes_out":4898},{"timestamp":"2026-09-29T17:10:23","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:80\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/cgi-bin/snapshot.cgi?channel=59","summary":"","payload_hex":"474554202f6367692d62696e2f736e617073686f742e6367693f6368616e6e656c3d353920485454502f312e310d0a486f73743a20<HONEYPOT>3a38300d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"","session":"95019b2a-d864-4b6e-b743-adf1322863e2","seq":60,"duration_ms":21657,"bytes_in":7670,"bytes_out":4740},{"timestamp":"2026-09-29T17:10:23","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:80\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/cgi-bin/snapshot.cgi?channel=60","summary":"","payload_hex":"474554202f6367692d62696e2f736e617073686f742e6367693f6368616e6e656c3d363020485454502f312e310d0a486f73743a20<HONEYPOT>3a38300d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"","session":"95019b2a-d864-4b6e-b743-adf1322863e2","seq":61,"duration_ms":22441,"bytes_in":7798,"bytes_out":4819},{"timestamp":"2026-09-29T17:10:22","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:80\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/cgi-bin/snapshot.cgi?channel=57","summary":"","payload_hex":"474554202f6367692d62696e2f736e617073686f742e6367693f6368616e6e656c3d353720485454502f312e310d0a486f73743a20<HONEYPOT>3a38300d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"","session":"95019b2a-d864-4b6e-b743-adf1322863e2","seq":58,"duration_ms":20594,"bytes_in":7414,"bytes_out":4582},{"timestamp":"2026-09-29T17:10:22","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:80\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/cgi-bin/snapshot.cgi?channel=58","summary":"","payload_hex":"474554202f6367692d62696e2f736e617073686f742e6367693f6368616e6e656c3d353820485454502f312e310d0a486f73743a20<HONEYPOT>3a38300d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"","session":"95019b2a-d864-4b6e-b743-adf1322863e2","seq":59,"duration_ms":21038,"bytes_in":7542,"bytes_out":4661},{"timestamp":"2026-09-29T17:10:21","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:80\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/cgi-bin/snapshot.cgi?channel=55","summary":"","payload_hex":"474554202f6367692d62696e2f736e617073686f742e6367693f6368616e6e656c3d353520485454502f312e310d0a486f73743a20<HONEYPOT>3a38300d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"","session":"95019b2a-d864-4b6e-b743-adf1322863e2","seq":56,"duration_ms":19766,"bytes_in":7158,"bytes_out":4424},{"timestamp":"2026-09-29T17:10:21","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:80\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/cgi-bin/snapshot.cgi?channel=56","summary":"","payload_hex":"474554202f6367692d62696e2f736e617073686f742e6367693f6368616e6e656c3d353620485454502f312e310d0a486f73743a20<HONEYPOT>3a38300d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"","session":"95019b2a-d864-4b6e-b743-adf1322863e2","seq":57,"duration_ms":20230,"bytes_in":7286,"bytes_out":4503},{"timestamp":"2026-09-29T17:10:20","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:80\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/cgi-bin/snapshot.cgi?channel=53","summary":"","payload_hex":"474554202f6367692d62696e2f736e617073686f742e6367693f6368616e6e656c3d353320485454502f312e310d0a486f73743a20<HONEYPOT>3a38300d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"","session":"95019b2a-d864-4b6e-b743-adf1322863e2","seq":54,"duration_ms":19130,"bytes_in":6902,"bytes_out":4266}],"http_methods":[{"method":"GET","count":71},{"method":"POST","count":1}],"distinct_ports_total":6,"top_paths":[{"path":"/","count":6,"ports":6},{"path":"/cgi-bin/snapshot.cgi?channel=11","count":1,"ports":1},{"path":"/cgi-bin/snapshot.cgi?channel=62","count":1,"ports":1},{"path":"/cgi-bin/snapshot.cgi?channel=26","count":1,"ports":1},{"path":"/cgi-bin/snapshot.cgi?channel=49","count":1,"ports":1},{"path":"/cgi-bin/snapshot.cgi?channel=48","count":1,"ports":1},{"path":"/cgi-bin/snapshot.cgi?channel=22","count":1,"ports":1},{"path":"/cgi-bin/snapshot.cgi?channel=23","count":1,"ports":1},{"path":"/cgi-bin/snapshot.cgi?channel=1","count":1,"ports":1},{"path":"/cgi-bin/snapshot.cgi?channel=0","count":1,"ports":1},{"path":"/cgi-bin/snapshot.cgi?channel=28","count":1,"ports":1},{"path":"/cgi-bin/snapshot.cgi?channel=29","count":1,"ports":1},{"path":"/cgi-bin/snapshot.cgi?channel=43","count":1,"ports":1},{"path":"/cgi-bin/snapshot.cgi?channel=42","count":1,"ports":1},{"path":"/cgi-bin/snapshot.cgi?channel=46","count":1,"ports":1}],"distinct_paths_total":67,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept-Encoding","Host","User-Agent"],"representative":[{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Host","value":"<HONEYPOT>:80","notable":false},{"name":"User-Agent","value":"Go-http-client/1.1","notable":false}],"distinct_sets":1,"events_with_headers":10},"tags":[],"data_as_of":"2026-09-30T17:45:23.710970+00:00"}