{"ip":"204.76.203.11","total_events":131,"verdict":{"verdict":"malicious","label":"Exploit attempts observed","detail":"1 exploit-path hits","confidence":"high","network_type":"network services","why":["1 request(s) matched a known exploit path.","Body-carrying methods (POST/PUT/PATCH/DELETE) seen: payload delivery, not just recon.","Under 5 hits, so confidence is medium.","Not in any known-scanner range.","Sent 26,947 bytes: sustained payload delivery, not a single opportunistic request."],"engagement":{"level":"payload","label":"Sustained payload","detail":"26,947 bytes sent","bytes_sent":26947,"session_seconds":12,"persistent":false}},"first_seen":"2026-09-09T06:53:27","last_seen":"2026-09-15T22:12:05","events_24h":0,"events_7d":12,"geo":{"country_code":"NL","country_name":"The Netherlands","region":"Limburg","city":"Eygelshoven","lat":50.8897,"lon":6.0563,"asn":51396,"org":"Pfcloud UG (haftungsbeschrankt)"},"source_domain":"204.76.203.11.ptr.pfcloud.network","known_scanners":[],"scanner_tag":null,"cve_matches":[{"cve_id":"CVE-2026-34197","title":"Apache ActiveMQ - Remote Code Execution","severity":"CRITICAL","actively_exploited":true,"match_field":"url_path","matched_pattern":"/api/jolokia/"},{"cve_id":"CVE-2023-38646","title":"Metabase < 0.46.6.1 - Remote Code Execution","severity":"critical","actively_exploited":false,"match_field":"url_path","matched_pattern":"/api/session/properties"},{"cve_id":"CVE-2024-23917","title":"JetBrains TeamCity > 2023.11.3 - Authentication Bypass","severity":"critical","actively_exploited":false,"match_field":"url_path","matched_pattern":"/app/rest/server"},{"cve_id":"CVE-2026-35029","title":"LiteLLM - Arbitrary File Read","severity":"high","actively_exploited":false,"match_field":"url_path","matched_pattern":"/health/liveliness"}],"malware":[],"top_ports":[{"port":8080,"proto":"tcp","label":"HTTP-alt","count":26},{"port":3000,"proto":"tcp","label":"Web-alt","count":19},{"port":4243,"proto":"tcp","label":"","count":15},{"port":8111,"proto":"tcp","label":"","count":14},{"port":2376,"proto":"tcp","label":"Docker-TLS","count":11},{"port":8161,"proto":"tcp","label":"ActiveMQ","count":9},{"port":8000,"proto":"tcp","label":"HTTP-alt","count":9},{"port":8265,"proto":"tcp","label":"","count":6},{"port":2375,"proto":"tcp","label":"Docker","count":5},{"port":4000,"proto":"tcp","label":"","count":4},{"port":5678,"proto":"tcp","label":"","count":4},{"port":2377,"proto":"tcp","label":"","count":4},{"port":4244,"proto":"tcp","label":"","count":4},{"port":5000,"proto":"tcp","label":"Web-alt","count":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i140900_cbb2034c60b8_e7c285222651"],"tls_client_hello":"","tls_ja3":["ea4a9ae049cfc614efbb3c244abb3fc7"]},"fingerprint_peers":{"t13i140900_cbb2034c60b8_e7c285222651":780},"user_agents":["Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36"],"timeline":[{"date":"2026-09-09","count":1},{"date":"2026-09-13","count":77},{"date":"2026-09-14","count":41},{"date":"2026-09-15","count":12}],"recent_events":[{"timestamp":"2026-09-15T22:12:05","port":8080,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"application/json\",\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8080\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/api/json?tree=displayName","summary":"","payload_hex":"474554202f6170692f6a736f6e3f747265653d646973706c61794e616d6520485454502f312e310d0a486f73743a20<HONEYPOT>3a383038300d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f363429204170706c655765624b69742f3533372e33360d0a4163636570743a206170706c69636174696f6e2f6a736f6e0d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36","ja3":"","session":"40c8d7c1-5855-49f5-8251-5bb2f29ae8cf","seq":1,"duration_ms":100,"bytes_in":200,"bytes_out":78},{"timestamp":"2026-09-15T22:08:11","port":4243,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"application/json\",\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:4243\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/version","summary":"","payload_hex":"474554202f76657273696f6e20485454502f312e310d0a486f73743a20<HONEYPOT>3a343234330d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f363429204170706c655765624b69742f3533372e33360d0a4163636570743a206170706c69636174696f6e2f6a736f6e0d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36","ja3":"","session":"cf6739eb-e5f2-431d-8ca0-3c8f3cf433ae","seq":1,"duration_ms":101,"bytes_in":182,"bytes_out":78},{"timestamp":"2026-09-15T22:04:39","port":8265,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"application/json\",\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8265\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/api/version","summary":"","payload_hex":"474554202f6170692f76657273696f6e20485454502f312e310d0a486f73743a20<HONEYPOT>3a383236350d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f363429204170706c655765624b69742f3533372e33360d0a4163636570743a206170706c69636174696f6e2f6a736f6e0d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36","ja3":"ea4a9ae049cfc614efbb3c244abb3fc7","session":"626495a4-0ecb-4538-b59c-27bdf0f378c5","seq":1,"duration_ms":119,"bytes_in":187,"bytes_out":78},{"timestamp":"2026-09-15T21:34:30","port":8161,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"application/json\",\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8161\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/api/jolokia/version","summary":"","payload_hex":"474554202f6170692f6a6f6c6f6b69612f76657273696f6e20485454502f312e310d0a486f73743a20<HONEYPOT>3a383136310d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f363429204170706c655765624b69742f3533372e33360d0a4163636570743a206170706c69636174696f6e2f6a736f6e0d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36","ja3":"","session":"dcb775f9-32ce-436b-b737-0dabd53f2570","seq":1,"duration_ms":100,"bytes_in":194,"bytes_out":78},{"timestamp":"2026-09-15T21:32:31","port":2377,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"application/json\",\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:2377\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/version","summary":"","payload_hex":"474554202f76657273696f6e20485454502f312e310d0a486f73743a20<HONEYPOT>3a323337370d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f363429204170706c655765624b69742f3533372e33360d0a4163636570743a206170706c69636174696f6e2f6a736f6e0d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36","ja3":"","session":"47376d19-9062-4d8a-8934-6a7d93e0164c","seq":1,"duration_ms":100,"bytes_in":182,"bytes_out":78},{"timestamp":"2026-09-15T21:30:05","port":5678,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"application/json\",\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:5678\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/rest/settings","summary":"","payload_hex":"474554202f726573742f73657474696e677320485454502f312e310d0a486f73743a20<HONEYPOT>3a353637380d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f363429204170706c655765624b69742f3533372e33360d0a4163636570743a206170706c69636174696f6e2f6a736f6e0d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36","ja3":"","session":"5afbe245-b2bc-45d9-b684-20b41dad299d","seq":1,"duration_ms":100,"bytes_in":189,"bytes_out":78},{"timestamp":"2026-09-15T20:32:03","port":3000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"application/json\",\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:3000\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/api/v1/version","summary":"","payload_hex":"474554202f6170692f76312f76657273696f6e20485454502f312e310d0a486f73743a20<HONEYPOT>3a333030300d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f363429204170706c655765624b69742f3533372e33360d0a4163636570743a206170706c69636174696f6e2f6a736f6e0d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36","ja3":"","session":"6344bd4c-a39e-4d2f-ac65-6e2ad81a7ec9","seq":1,"duration_ms":100,"bytes_in":190,"bytes_out":78},{"timestamp":"2026-09-15T20:31:56","port":3000,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"application/json\",\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:3000\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/api/session/properties","summary":"","payload_hex":"474554202f6170692f73657373696f6e2f70726f7065727469657320485454502f312e310d0a486f73743a20<HONEYPOT>3a333030300d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f363429204170706c655765624b69742f3533372e33360d0a4163636570743a206170706c69636174696f6e2f6a736f6e0d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36","ja3":"ea4a9ae049cfc614efbb3c244abb3fc7","session":"3e412c37-063e-4030-8d31-58fafeb5c5dc","seq":1,"duration_ms":100,"bytes_in":198,"bytes_out":78},{"timestamp":"2026-09-15T20:31:56","port":3000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"application/json\",\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:3000\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/api/session/properties","summary":"","payload_hex":"474554202f6170692f73657373696f6e2f70726f7065727469657320485454502f312e310d0a486f73743a20<HONEYPOT>3a333030300d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f363429204170706c655765624b69742f3533372e33360d0a4163636570743a206170706c69636174696f6e2f6a736f6e0d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36","ja3":"","session":"4fafd798-a3bb-4422-a073-8e1588e7168f","seq":1,"duration_ms":100,"bytes_in":198,"bytes_out":78},{"timestamp":"2026-09-15T19:44:12","port":2375,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"application/json\",\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:2375\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/level/15/exec/show/version/CR","summary":"","payload_hex":"474554202f6c6576656c2f31352f657865632f73686f772f76657273696f6e2f435220485454502f312e310d0a486f73743a20<HONEYPOT>3a323337350d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f363429204170706c655765624b69742f3533372e33360d0a4163636570743a206170706c69636174696f6e2f6a736f6e0d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36","ja3":"ea4a9ae049cfc614efbb3c244abb3fc7","session":"51238b6c-1a17-4f4e-8195-3370b5d710a2","seq":1,"duration_ms":101,"bytes_in":205,"bytes_out":78}],"http_methods":[{"method":"GET","count":122},{"method":"POST","count":9}],"distinct_ports_total":14,"top_paths":[{"path":"/version","count":24,"ports":5},{"path":"/level/15/exec/show/version/CR","count":16,"ports":2},{"path":"/app/rest/server/version","count":14,"ports":1},{"path":"/api/session/properties","count":12,"ports":1},{"path":"/api/json?tree=displayName","count":12,"ports":1},{"path":"/api/jolokia/version","count":9,"ports":1},{"path":"/en-US/splunkd/__raw/v1/postgres/recovery/backup","count":9,"ports":1},{"path":"/api/v1/version","count":7,"ports":1},{"path":"/api/version","count":6,"ports":1},{"path":"/","count":5,"ports":1},{"path":"/cgi-bin/nas_sharing.cgi?user=messagebus&passwd=&cmd=15","count":5,"ports":1},{"path":"/rest/settings","count":4,"ports":1},{"path":"/health/liveliness","count":4,"ports":1},{"path":"/jenkins/api/json?tree=displayName","count":4,"ports":1}],"distinct_paths_total":14,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","Accept-Encoding","Connection","Host","User-Agent"],"representative":[{"name":"Accept","value":"application/json","notable":false},{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Connection","value":"close","notable":false},{"name":"Host","value":"<HONEYPOT>:8080","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36","notable":false}],"distinct_sets":1,"events_with_headers":10},"tags":[{"tag_id":"CVE-2026-34197","tag_type":"cve","title":"Apache ActiveMQ - Remote Code Execution","severity":"CRITICAL","actively_exploited":true,"match_field":"url_path","matched_pattern":"/api/jolokia/","reference_urls":[]},{"tag_id":"CVE-2023-38646","tag_type":"cve","title":"Metabase < 0.46.6.1 - Remote Code Execution","severity":"critical","actively_exploited":false,"match_field":"url_path","matched_pattern":"/api/session/properties","reference_urls":["https://www.metabase.com/blog/security-advisory","https://github.com/metabase/metabase/releases/tag/v0.46.6.1","https://mp.weixin.qq.com/s/ATFwFl-D8k9QfQfzKjZFDg","https://news.ycombinator.com/item?id=36812256","https://blog.assetnote.io/2023/07/22/pre-auth-rce-metabase/"]},{"tag_id":"CVE-2024-23917","tag_type":"cve","title":"JetBrains TeamCity > 2023.11.3 - Authentication Bypass","severity":"critical","actively_exploited":false,"match_field":"url_path","matched_pattern":"/app/rest/server","reference_urls":["https://github.com/fkie-cad/nvd-json-data-feeds","https://www.rapid7.com/db/vulnerabilities/jetbrains-teamcity-cve-2024-23917/"]},{"tag_id":"CVE-2026-35029","tag_type":"cve","title":"LiteLLM - Arbitrary File Read","severity":"high","actively_exploited":false,"match_field":"url_path","matched_pattern":"/health/liveliness","reference_urls":["https://github.com/BerriAI/litellm","https://sec-consult.com/vulnerability-lab/advisory/broken-access-control-in-config-endpoint-in-litellm/","https://nvd.nist.gov/vuln/detail/CVE-2026-35029"]}],"data_as_of":"2026-09-21T23:46:22.335953+00:00"}