{"ip":"207.211.162.170","data_as_of":"2026-10-21T14:58:11+00:00","observed":true,"total_events":1685,"verdict":{"verdict":"malicious","label":"Exploit attempts observed","detail":"8 interactive session(s) carried an exploit attempt","confidence":"high","network_type":"CDN","why":["8 interactive session(s) carried an exploit attempt.","5+ sessions raise confidence to high.","The first-packet sensors recorded 1,685 event(s) from this address as well.","Not in any known-scanner range.","Sent 481,536 bytes, which is sustained payload delivery."],"engagement":{"level":"payload","label":"Sustained payload","detail":"481,536 bytes sent","bytes_sent":481536,"session_seconds":12,"persistent":false},"basis":"interactive"},"first_seen":"2026-10-19T08:48:35","last_seen":"2026-10-20T02:28:29","events_24h":0,"events_7d":1685,"interactive_sessions":32,"interactive_sessions_24h":0,"interactive_sessions_7d":32,"interactive_protocols":[{"protocol":"http","sessions":32}],"geo":{"country_code":"US","country_name":"United States","region":"Illinois","city":"Chicago","lat":41.8486,"lon":-87.6288,"asn":31898,"org":"Oracle Corporation"},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as31898","label":"Oracle Cloud Infrastructure","category":"cdn","url":"https://www.peeringdb.com/asn/31898"},"cve_matches":[{"cve_id":"CVE-2025-27134","title":"Joplin 3.3.3 Server - Privilege Escalation","severity":"high","actively_exploited":false,"match_field":"url_path","matched_pattern":"/api/sessions","kev_date_added":null},{"cve_id":"CVE-2025-2129","title":"Mage AI - Insecure Default Authentication Setup","severity":"medium","actively_exploited":false,"match_field":"url_path","matched_pattern":"/api/kernels","kev_date_added":null}],"malware":[],"udp":null,"interaction":{"window_days":90,"sessions":32,"first_seen":"2026-10-19T11:50:31","last_seen":"2026-10-19T11:50:31","verdicts":[{"verdict":"scan","sessions":24},{"verdict":"exploit-attempt","sessions":8}],"personas":[{"persona":"nginx@1.24.0, wordpress@6.5.2, leaks@2, miner@bfgminer 5.5.0, elasticsearch@6.8.23, winrm@Windows Server 2016, fortigate@7.0.5, docker@25.0.3","sessions":32}],"services":[{"protocol":"http","port":8000,"sessions":32}],"logins":[],"commands":[],"downloads":[],"files":[],"attack":[{"technique_id":"T1595","technique_name":"Active Scanning","tactic_id":"TA0043","tactic_name":"Reconnaissance","sessions":24},{"technique_id":"T1190","technique_name":"Exploit Public-Facing Application","tactic_id":"TA0001","tactic_name":"Initial Access","sessions":8}]},"top_ports":[{"port":8000,"proto":"tcp","label":"HTTP-alt","count":669,"sessions":32},{"port":8443,"proto":"tcp","label":"HTTPS-alt","count":669,"sessions":0},{"port":8080,"proto":"tcp","label":"HTTP-alt","count":288,"sessions":0},{"port":3000,"proto":"tcp","label":"Web-alt","count":59,"sessions":0}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i1010h1_61a7ad8aa9b6_792d2c6655cb","t13i1010h1_61a7ad8aa9b6_3a8073edd8ef"],"tls_client_hello":"16030101800100017c03036abdb516e0360cee1132cb3559e665cf70cbcc58af948f7a57c8f3c13142d1352023a0ef4de947b4dc66dbf16bbf298f1ba25b7fb904386d0fd2195e7031dc21b30014130213011303c02cc02bcca9c030c02fcca800ff0100011f000a00080006001d00170018002d00020101000b00020100002b0005040304030300170000000d001c001a0201020304010403050105030601060308040805080608070808000500050100000000003300260024001d002037b5211c921172df2c7401aa89a13bd1e133605cf4b1afc01f37254d76080c1d0010000b000908687474702f312e3100290094006f0069d92508c8918a8f7243376bba2b0bd7aef6fd7123301957869469de2a227b7e9b566cb24402876fdfc079e7cb5788d92bd9d9befcd282dc59d1f41f6a5d777591641224b0ca618f351645eecf349ed54686dab6019ea4453d90759a343976e736e955bc1f119428b3a544276116002120684f150dc8b05a1ad29b0c267886b3079558ce34ba7cd33138f2d0c98b3c900f","tls_ja3":["bc44033a81a9162d048e962f251dfd4a","7ef10af34f8d686ccb3043c82301a49b","ceb7b2f8118c69aafd9597b2317e3c13","cfd178a8ee1b3e31dca959e24238d6b6"],"http_akin":["b11cun040_00040016_c1d30083"],"interactive":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[]}},"fingerprint_peers":{"t13i1010h1_61a7ad8aa9b6_3a8073edd8ef":57,"b11cun040_00040016_c1d30083":128,"t13i1010h1_61a7ad8aa9b6_792d2c6655cb":22},"akin_families":{},"user_agents":["WebSiphon/next-0.1"],"timeline":[{"date":"2026-10-19","count":1397,"sessions":32},{"date":"2026-10-20","count":288,"sessions":0}],"recent_events":[{"timestamp":"2026-10-20T02:28:29","port":8080,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip,deflate,br\",\"host\":\"<HONEYPOT>:8080\",\"user-agent\":\"WebSiphon/next-0.1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/oke/kubeconfig.yaml","summary":"","payload_hex":"474554202f6f6b652f6b756265636f6e6669672e79616d6c20485454502f312e310d0a6163636570743a202a2f2a0d0a757365722d6167656e743a20576562536970686f6e2f6e6578742d302e310d0a6163636570742d656e636f64696e673a20677a69702c6465666c6174652c62720d0a686f73743a20<HONEYPOT>3a383038300d0a0d0a","method":"GET","user_agent":"WebSiphon/next-0.1","ja3":"","session":"c0f58f3e-9a84-45e5-bfc1-b83589b8933f","seq":2,"duration_ms":1002,"bytes_in":278,"bytes_out":160},{"timestamp":"2026-10-20T02:28:29","port":8080,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip,deflate,br\",\"host\":\"<HONEYPOT>:8080\",\"user-agent\":\"WebSiphon/next-0.1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/terraform/terraform.tfstate.backup","summary":"","payload_hex":"474554202f7465727261666f726d2f7465727261666f726d2e746673746174652e6261636b757020485454502f312e310d0a6163636570743a202a2f2a0d0a757365722d6167656e743a20576562536970686f6e2f6e6578742d302e310d0a6163636570742d656e636f64696e673a20677a69702c6465666c6174652c62720d0a686f73743a20<HONEYPOT>3a383038300d0a0d0a","method":"GET","user_agent":"WebSiphon/next-0.1","ja3":"","session":"6c4ed421-598e-4b58-a698-662f6c811a39","seq":2,"duration_ms":999,"bytes_in":303,"bytes_out":160},{"timestamp":"2026-10-20T02:28:29","port":8080,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip,deflate,br\",\"host\":\"<HONEYPOT>:8080\",\"user-agent\":\"WebSiphon/next-0.1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/infrastructure/terraform.tfvars","summary":"","payload_hex":"474554202f696e6672617374727563747572652f7465727261666f726d2e74667661727320485454502f312e310d0a6163636570743a202a2f2a0d0a757365722d6167656e743a20576562536970686f6e2f6e6578742d302e310d0a6163636570742d656e636f64696e673a20677a69702c6465666c6174652c62720d0a686f73743a20<HONEYPOT>3a383038300d0a0d0a","method":"GET","user_agent":"WebSiphon/next-0.1","ja3":"","session":"bac3f0e1-725e-41bd-9bcb-6b40ec32d200","seq":2,"duration_ms":954,"bytes_in":289,"bytes_out":160},{"timestamp":"2026-10-20T02:28:29","port":8080,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip,deflate,br\",\"host\":\"<HONEYPOT>:8080\",\"user-agent\":\"WebSiphon/next-0.1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/config/oci/config","summary":"","payload_hex":"474554202f636f6e6669672f6f63692f636f6e66696720485454502f312e310d0a6163636570743a202a2f2a0d0a757365722d6167656e743a20576562536970686f6e2f6e6578742d302e310d0a6163636570742d656e636f64696e673a20677a69702c6465666c6174652c62720d0a686f73743a20<HONEYPOT>3a383038300d0a0d0a","method":"GET","user_agent":"WebSiphon/next-0.1","ja3":"","session":"816c10c1-e64a-4008-97de-20ab0e5c4ba2","seq":2,"duration_ms":933,"bytes_in":283,"bytes_out":160},{"timestamp":"2026-10-20T02:28:29","port":8080,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip,deflate,br\",\"host\":\"<HONEYPOT>:8080\",\"user-agent\":\"WebSiphon/next-0.1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/infrastructure/terraform.tfstate.backup","summary":"","payload_hex":"474554202f696e6672617374727563747572652f7465727261666f726d2e746673746174652e6261636b757020485454502f312e310d0a6163636570743a202a2f2a0d0a757365722d6167656e743a20576562536970686f6e2f6e6578742d302e310d0a6163636570742d656e636f64696e673a20677a69702c6465666c6174652c62720d0a686f73743a20<HONEYPOT>3a383038300d0a0d0a","method":"GET","user_agent":"WebSiphon/next-0.1","ja3":"","session":"76a8f3a0-c65c-44e5-bc1a-f583f8492dd4","seq":2,"duration_ms":932,"bytes_in":300,"bytes_out":160},{"timestamp":"2026-10-20T02:28:29","port":8080,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip,deflate,br\",\"host\":\"<HONEYPOT>:8080\",\"user-agent\":\"WebSiphon/next-0.1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/.oci/config.backup","summary":"","payload_hex":"474554202f2e6f63692f636f6e6669672e6261636b757020485454502f312e310d0a6163636570743a202a2f2a0d0a757365722d6167656e743a20576562536970686f6e2f6e6578742d302e310d0a6163636570742d656e636f64696e673a20677a69702c6465666c6174652c62720d0a686f73743a20<HONEYPOT>3a383038300d0a0d0a","method":"GET","user_agent":"WebSiphon/next-0.1","ja3":"","session":"c5441ba9-d5d4-4e2e-bf3e-504b74476b73","seq":2,"duration_ms":998,"bytes_in":280,"bytes_out":160},{"timestamp":"2026-10-20T02:28:29","port":8080,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip,deflate,br\",\"host\":\"<HONEYPOT>:8080\",\"user-agent\":\"WebSiphon/next-0.1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/kubeconfig","summary":"","payload_hex":"474554202f6b756265636f6e66696720485454502f312e310d0a6163636570743a202a2f2a0d0a757365722d6167656e743a20576562536970686f6e2f6e6578742d302e310d0a6163636570742d656e636f64696e673a20677a69702c6465666c6174652c62720d0a686f73743a20<HONEYPOT>3a383038300d0a0d0a","method":"GET","user_agent":"WebSiphon/next-0.1","ja3":"","session":"898ebe8a-becd-463c-92f2-1dad6e8c1ff4","seq":2,"duration_ms":955,"bytes_in":274,"bytes_out":160},{"timestamp":"2026-10-20T02:28:29","port":8080,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip,deflate,br\",\"host\":\"<HONEYPOT>:8080\",\"user-agent\":\"WebSiphon/next-0.1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/terraform/terraform.tfvars.json","summary":"","payload_hex":"474554202f7465727261666f726d2f7465727261666f726d2e7466766172732e6a736f6e20485454502f312e310d0a6163636570743a202a2f2a0d0a757365722d6167656e743a20576562536970686f6e2f6e6578742d302e310d0a6163636570742d656e636f64696e673a20677a69702c6465666c6174652c62720d0a686f73743a20<HONEYPOT>3a383038300d0a0d0a","method":"GET","user_agent":"WebSiphon/next-0.1","ja3":"","session":"5c732a07-048b-4c47-9025-8e2e5448d888","seq":2,"duration_ms":999,"bytes_in":285,"bytes_out":160},{"timestamp":"2026-10-20T02:28:29","port":8080,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip,deflate,br\",\"host\":\"<HONEYPOT>:8080\",\"user-agent\":\"WebSiphon/next-0.1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/terraform.tfvars.json.bak","summary":"","payload_hex":"474554202f7465727261666f726d2e7466766172732e6a736f6e2e62616b20485454502f312e310d0a6163636570743a202a2f2a0d0a757365722d6167656e743a20576562536970686f6e2f6e6578742d302e310d0a6163636570742d656e636f64696e673a20677a69702c6465666c6174652c62720d0a686f73743a20<HONEYPOT>3a383038300d0a0d0a","method":"GET","user_agent":"WebSiphon/next-0.1","ja3":"","session":"d76ff1dd-dbe1-4700-b95e-339f6bb4fd94","seq":2,"duration_ms":973,"bytes_in":290,"bytes_out":160},{"timestamp":"2026-10-20T02:28:29","port":8080,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip,deflate,br\",\"host\":\"<HONEYPOT>:8080\",\"user-agent\":\"WebSiphon/next-0.1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/backend/.env.production","summary":"","payload_hex":"474554202f6261636b656e642f2e656e762e70726f64756374696f6e20485454502f312e310d0a6163636570743a202a2f2a0d0a757365722d6167656e743a20576562536970686f6e2f6e6578742d302e310d0a6163636570742d656e636f64696e673a20677a69702c6465666c6174652c62720d0a686f73743a20<HONEYPOT>3a383038300d0a0d0a","method":"GET","user_agent":"WebSiphon/next-0.1","ja3":"","session":"d27ff1cd-85d8-4997-a776-e2f2ecce2f2f","seq":2,"duration_ms":909,"bytes_in":278,"bytes_out":160}],"http_methods":[{"method":"GET","count":1717}],"distinct_ports_total":4,"top_paths":[{"path":"/.env.staging","count":5,"ports":4},{"path":"/","count":5,"ports":4},{"path":"/.env","count":5,"ports":4},{"path":"/.env.development","count":5,"ports":4},{"path":"/.env.old","count":5,"ports":4},{"path":"/.env.production","count":5,"ports":4},{"path":"/.runpod/config.toml","count":5,"ports":4},{"path":"/.env.local","count":5,"ports":4},{"path":"/.env.bak","count":5,"ports":4},{"path":"/.env.example","count":5,"ports":4},{"path":"/Dockerfile","count":4,"ports":4},{"path":"/docker-compose.yml","count":4,"ports":4},{"path":"/config.json","count":4,"ports":4},{"path":"/robots.txt","count":4,"ports":4},{"path":"/root/.runpod/config.toml","count":4,"ports":3}],"distinct_paths_total":200,"top_snis":[],"top_hosts":[],"top_alpns":[{"value":"http/1.1","count":669}],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","Accept-Encoding","Host","User-Agent"],"representative":[{"name":"Accept","value":"*/*","notable":false},{"name":"Accept-Encoding","value":"gzip,deflate,br","notable":false},{"name":"Host","value":"<HONEYPOT>:8080","notable":false},{"name":"User-Agent","value":"WebSiphon/next-0.1","notable":false}],"distinct_sets":1,"events_with_headers":10},"tags":[{"tag_id":"CVE-2025-27134","tag_type":"cve","title":"Joplin 3.3.3 Server - Privilege Escalation","severity":"high","actively_exploited":false,"match_field":"url_path","matched_pattern":"/api/sessions","reference_urls":["https://github.com/laurent22/joplin/security/advisories/GHSA-xj67-649m-3p8x","https://nvd.nist.gov/vuln/detail/CVE-2025-27134"],"kev_date_added":null},{"tag_id":"CVE-2025-2129","tag_type":"cve","title":"Mage AI - Insecure Default Authentication Setup","severity":"medium","actively_exploited":false,"match_field":"url_path","matched_pattern":"/api/kernels","reference_urls":["https://nvd.nist.gov/vuln/detail/CVE-2025-2129","https://github.com/zn9988/publications/blob/main/2.Mage-AI%20-%20Insecure%20Default%20Authentication%20Setup%20Leading%20to%20Zero-Click%20RCE/README.md","https://vuldb.com/?ctiid.299049","https://vuldb.com/?id.299049","https://vuldb.com/?submit.510690"],"kev_date_added":null}]}