{"ip":"204.76.203.9","total_events":24,"verdict":{"verdict":"scanning","label":"Scanning for known vulnerabilities","detail":"2 exploit-path probe(s)","confidence":"medium","network_type":"network services","why":["2 request(s) matched a known exploit path.","Only GET/HEAD seen, no request body: scanning for the vulnerability, not delivering a payload.","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"4,364 bytes sent","bytes_sent":4364,"session_seconds":0,"persistent":false}},"first_seen":"2026-09-09T01:16:42","last_seen":"2026-09-13T06:26:06","events_24h":0,"events_7d":0,"geo":{"country_code":"NL","country_name":"The Netherlands","region":"Limburg","city":"Eygelshoven","lat":50.8897,"lon":6.0563,"asn":51396,"org":"Pfcloud UG (haftungsbeschrankt)"},"source_domain":"neko.awa","known_scanners":[],"scanner_tag":null,"cve_matches":[{"cve_id":"CVE-2026-34197","title":"Apache ActiveMQ - Remote Code Execution","severity":"CRITICAL","actively_exploited":true,"match_field":"url_path","matched_pattern":"/api/jolokia/"},{"cve_id":"CVE-2023-38646","title":"Metabase < 0.46.6.1 - Remote Code Execution","severity":"critical","actively_exploited":false,"match_field":"url_path","matched_pattern":"/api/session/properties"},{"cve_id":"CVE-2026-25892","title":"Adminer 4.6.2 - 5.4.1 Unauthenticated Persistent DoS","severity":"high","actively_exploited":false,"match_field":"url_path","matched_pattern":"/adminer.php"},{"cve_id":"CVE-2026-35029","title":"LiteLLM - Arbitrary File Read","severity":"high","actively_exploited":false,"match_field":"url_path","matched_pattern":"/health/liveliness"}],"malware":[],"top_ports":[{"port":80,"proto":"tcp","label":"HTTP","count":10},{"port":3000,"proto":"tcp","label":"Web-alt","count":3},{"port":8081,"proto":"tcp","label":"","count":2},{"port":2375,"proto":"tcp","label":"Docker","count":2},{"port":8090,"proto":"tcp","label":"","count":2},{"port":2083,"proto":"tcp","label":"","count":2},{"port":4000,"proto":"tcp","label":"","count":1},{"port":8161,"proto":"tcp","label":"ActiveMQ","count":1},{"port":4243,"proto":"tcp","label":"","count":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i140900_cbb2034c60b8_e7c285222651"],"tls_client_hello":"","tls_ja3":["ea4a9ae049cfc614efbb3c244abb3fc7"],"http_akin":["b11cun050_00040017_6b90553b","b11cun050_00040017_e873236c"]},"fingerprint_peers":{"t13i140900_cbb2034c60b8_e7c285222651":658,"b11cun050_00040017_6b90553b":1269,"b11cun050_00040017_e873236c":680},"akin_families":{"b11cun050_00040017_6b90553b":{"head":"b11cun050_00040017_6b90553b","shapes":12,"ips":1269},"b11cun050_00040017_e873236c":{"head":"b11cun040_00040015_4c87b06e","shapes":4,"ips":1521}},"user_agents":["Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36"],"timeline":[{"date":"2026-09-09","count":23},{"date":"2026-09-13","count":1}],"recent_events":[{"timestamp":"2026-09-13T06:26:06","port":4000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"application/json\",\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:4000\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/health/liveliness","summary":"","payload_hex":"474554202f6865616c74682f6c6976656c696e65737320485454502f312e310d0a486f73743a20<HONEYPOT>3a343030300d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f363429204170706c655765624b69742f3533372e33360d0a4163636570743a206170706c69636174696f6e2f6a736f6e0d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36","ja3":"","session":"3b244105-3e5d-4827-9a4b-9b9147f6d1f1","seq":1,"duration_ms":101,"bytes_in":192,"bytes_out":77},{"timestamp":"2026-09-09T12:13:30","port":2375,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"application/json\",\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:2375\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/version","summary":"","payload_hex":"474554202f76657273696f6e20485454502f312e310d0a486f73743a20<HONEYPOT>3a323337350d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f363429204170706c655765624b69742f3533372e33360d0a4163636570743a206170706c69636174696f6e2f6a736f6e0d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36","ja3":"","session":"e1f79093-25ad-439e-858a-c6934d833936","seq":1,"duration_ms":100,"bytes_in":182,"bytes_out":77},{"timestamp":"2026-09-09T07:35:29","port":2375,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"application/json\",\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:2375\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/version","summary":"","payload_hex":"474554202f76657273696f6e20485454502f312e310d0a486f73743a20<HONEYPOT>3a323337350d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f363429204170706c655765624b69742f3533372e33360d0a4163636570743a206170706c69636174696f6e2f6a736f6e0d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36","ja3":"","session":"b5811dd1-ae69-4ecb-865f-9495de4ebef1","seq":1,"duration_ms":101,"bytes_in":183,"bytes_out":77},{"timestamp":"2026-09-09T04:44:44","port":4243,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"application/json\",\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:4243\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/version","summary":"","payload_hex":"474554202f76657273696f6e20485454502f312e310d0a486f73743a20<HONEYPOT>3a343234330d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f363429204170706c655765624b69742f3533372e33360d0a4163636570743a206170706c69636174696f6e2f6a736f6e0d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36","ja3":"","session":"3865afd2-b038-4f8e-86ce-ab1a73153900","seq":1,"duration_ms":100,"bytes_in":182,"bytes_out":77},{"timestamp":"2026-09-09T02:56:15","port":8090,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"application/json\",\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8090\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a383039300d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f363429204170706c655765624b69742f3533372e33360d0a4163636570743a206170706c69636174696f6e2f6a736f6e0d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36","ja3":"","session":"36bdfcc9-efef-481f-9a43-7761251ac895","seq":1,"duration_ms":100,"bytes_in":175,"bytes_out":77},{"timestamp":"2026-09-09T02:56:15","port":8090,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"application/json\",\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8090\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a383039300d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f363429204170706c655765624b69742f3533372e33360d0a4163636570743a206170706c69636174696f6e2f6a736f6e0d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36","ja3":"ea4a9ae049cfc614efbb3c244abb3fc7","session":"eb6b64d1-0eeb-401f-a4b4-a40f785117ef","seq":1,"duration_ms":100,"bytes_in":175,"bytes_out":77},{"timestamp":"2026-09-09T02:43:45","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:80\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/.aws/credentials","summary":"","payload_hex":"474554202f2e6177732f63726564656e7469616c7320485454502f312e310d0a486f73743a20<HONEYPOT>3a38300d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f363429204170706c655765624b69742f3533372e33360d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36","ja3":"","session":"0841896d-aeb7-4efd-a34c-9da544c555e7","seq":1,"duration_ms":100,"bytes_in":176,"bytes_out":77},{"timestamp":"2026-09-09T02:43:43","port":80,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"application/json\",\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:80\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a38300d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f363429204170706c655765624b69742f3533372e33360d0a4163636570743a206170706c69636174696f6e2f6a736f6e0d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36","ja3":"ea4a9ae049cfc614efbb3c244abb3fc7","session":"42f7ae17-83ae-49d2-8c48-ff2715a8f299","seq":1,"duration_ms":100,"bytes_in":173,"bytes_out":77},{"timestamp":"2026-09-09T02:43:42","port":80,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"application/json\",\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:80\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/media/sourcerer/css/sourcerer.css","summary":"","payload_hex":"474554202f6d656469612f736f757263657265722f6373732f736f757263657265722e63737320485454502f312e310d0a486f73743a20<HONEYPOT>3a38300d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f363429204170706c655765624b69742f3533372e33360d0a4163636570743a206170706c69636174696f6e2f6a736f6e0d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36","ja3":"ea4a9ae049cfc614efbb3c244abb3fc7","session":"76073314-9a53-495f-84b4-69f8c1d5d7a6","seq":1,"duration_ms":100,"bytes_in":206,"bytes_out":77},{"timestamp":"2026-09-09T02:43:42","port":80,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"application/json\",\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:80\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a38300d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f363429204170706c655765624b69742f3533372e33360d0a4163636570743a206170706c69636174696f6e2f6a736f6e0d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36","ja3":"ea4a9ae049cfc614efbb3c244abb3fc7","session":"24345edd-b817-479c-9f8d-e081293571cc","seq":1,"duration_ms":101,"bytes_in":173,"bytes_out":77}],"http_methods":[{"method":"GET","count":24}],"distinct_ports_total":9,"top_paths":[{"path":"/","count":6,"ports":3},{"path":"/adminer.php","count":4,"ports":2},{"path":"/version","count":3,"ports":2},{"path":"/api/session/properties","count":2,"ports":1},{"path":"/.env","count":1,"ports":1},{"path":"/debug/vars","count":1,"ports":1},{"path":"/actuator/env","count":1,"ports":1},{"path":"/.git/HEAD","count":1,"ports":1},{"path":"/api/v1/version","count":1,"ports":1},{"path":"/api/jolokia/version","count":1,"ports":1},{"path":"/health/liveliness","count":1,"ports":1},{"path":"/.aws/credentials","count":1,"ports":1},{"path":"/media/sourcerer/css/sourcerer.css","count":1,"ports":1}],"distinct_paths_total":13,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","Accept-Encoding","Connection","Host","User-Agent"],"representative":[{"name":"Accept","value":"application/json","notable":false},{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Connection","value":"close","notable":false},{"name":"Host","value":"<HONEYPOT>:4000","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36","notable":false}],"distinct_sets":1,"events_with_headers":10},"tags":[{"tag_id":"CVE-2026-34197","tag_type":"cve","title":"Apache ActiveMQ - Remote Code Execution","severity":"CRITICAL","actively_exploited":true,"match_field":"url_path","matched_pattern":"/api/jolokia/","reference_urls":[]},{"tag_id":"CVE-2023-38646","tag_type":"cve","title":"Metabase < 0.46.6.1 - Remote Code Execution","severity":"critical","actively_exploited":false,"match_field":"url_path","matched_pattern":"/api/session/properties","reference_urls":["https://www.metabase.com/blog/security-advisory","https://github.com/metabase/metabase/releases/tag/v0.46.6.1","https://mp.weixin.qq.com/s/ATFwFl-D8k9QfQfzKjZFDg","https://news.ycombinator.com/item?id=36812256","https://blog.assetnote.io/2023/07/22/pre-auth-rce-metabase/"]},{"tag_id":"CVE-2026-25892","tag_type":"cve","title":"Adminer 4.6.2 - 5.4.1 Unauthenticated Persistent DoS","severity":"high","actively_exploited":false,"match_field":"url_path","matched_pattern":"/adminer.php","reference_urls":["https://github.com/vrana/adminer/security/advisories/GHSA-q4f2-39gr-45jh","https://github.com/vrana/adminer/commit/21d3a3150388677b18647d68aec93b7850e457d3"]},{"tag_id":"CVE-2026-35029","tag_type":"cve","title":"LiteLLM - Arbitrary File Read","severity":"high","actively_exploited":false,"match_field":"url_path","matched_pattern":"/health/liveliness","reference_urls":["https://github.com/BerriAI/litellm","https://sec-consult.com/vulnerability-lab/advisory/broken-access-control-in-config-endpoint-in-litellm/","https://nvd.nist.gov/vuln/detail/CVE-2026-35029"]}],"data_as_of":"2026-09-30T16:17:49.604433+00:00"}