{"ip":"209.54.101.24","total_events":109,"verdict":{"verdict":"scanning","label":"Scanning for known vulnerabilities","detail":"20 exploit-path probe(s)","confidence":"medium","network_type":"nsp","why":["20 request(s) matched a known exploit path.","Only GET/HEAD seen, no request body: scanning for the vulnerability, not delivering a payload.","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"16,589 bytes sent","bytes_sent":16589,"session_seconds":24,"persistent":false}},"first_seen":"2026-09-28T07:31:34","last_seen":"2026-09-29T15:04:45","events_24h":106,"events_7d":109,"geo":{"country_code":"US","country_name":"United States","region":"","city":"","lat":37.751,"lon":-97.822,"asn":36352,"org":"HostPapa"},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as36352","label":"ColoCrossing","category":"isp","url":"https://www.peeringdb.com/asn/36352"},"cve_matches":[{"cve_id":"CVE-2020-2551","title":"Oracle WebLogic Server - Remote Code Execution","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/console/login/LoginForm.jsp"}],"malware":[],"top_ports":[{"port":81,"proto":"tcp","label":"","count":24},{"port":8000,"proto":"tcp","label":"HTTP-alt","count":20},{"port":111,"proto":"tcp","label":"RPC","count":7},{"port":2181,"proto":"tcp","label":"","count":4},{"port":8200,"proto":"tcp","label":"","count":4},{"port":10255,"proto":"tcp","label":"","count":4},{"port":10000,"proto":"tcp","label":"Webmin","count":4},{"port":139,"proto":"tcp","label":"SMB","count":4},{"port":2380,"proto":"tcp","label":"","count":4},{"port":2375,"proto":"tcp","label":"Docker","count":4},{"port":2049,"proto":"tcp","label":"NFS","count":4},{"port":8080,"proto":"tcp","label":"HTTP-alt","count":3},{"port":27017,"proto":"tcp","label":"MongoDB","count":3},{"port":2379,"proto":"tcp","label":"","count":3},{"port":11211,"proto":"tcp","label":"Memcached","count":2}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i251000_b78ed14e2fd0_ab7e3b40a677"],"tls_client_hello":"16030105e2010005de030307c9dd39a24039e9f763d87df17c58991e766a63b26cb023815f37d431e2f734201a3d6d43e4b04eff559b7b286a3e1c29444eb87419384d3cdf42134ce1c23a760032c02bc02fc02cc030cca9cca8c009c013c00ac014009c009d002f0035c012000ac023c027003cc007c011000513011302130301000563000b00020100ff010001000017000000120000000500050100000000000a0010000e11ec11eb11ed001d001700180019000d0016001408040403080708050806040105010601050306030032001a0018080404030807080508060401050106010503060302010203002b0009080304030303020301003304ea04e811ec04c084375d8796b10e251d299a6a3fc0a61cc360c0927502900ddba37c3ddc8e0cb8cd762065f4f899cbe6c1adea1ab8ba4d847b48fc494996152eb485245682c9ea26bf63218f399bc21df9686bd263e289a1ae0bb46910a48d93665c4531f49805e845b8c521c71e77ceb577af6b19aa459080c81491d3496787141ea53007a389cf9505a7df0a844cf09a28fa82cd9a91b2891e5a7996a1b9a9d4d93d9feb912c094a32336df606492979c9bc485faf6505b6773274e75bc8257395a60944a34956411f27518340611738190b518b02f409c40bb7c0aa7ca37a01bdf3747e511b93fb9344b87b0ba9ab8cb6552c860b2b626c8fe263436f2883f0d360236475039143a973a7dd4413047801094c5ff5b71e7fe86b91c17cfc056bed1210397a53d7f584fc720994a5bcdebb99a2a6480246060ae0c92d8abc7fd3961f471615da6cb3f529c25109753a81eba582e4c08f3c34b69a814c337c4c13e22c224ab9fff86d727a0ab1370f3d743b5a6b9c56e741d4f437396627d3a7474bd949ac3c3e9fa357a37147fb8c7d3dfcc16d48c868717bd0b3772a81ae9d40ab02280b89ec722d7372a3626b7ed70dfdca79c0537e36237b63c631acf34f7493cdc79acd29dbac2e6938bb8b3d2d383e373260c54c2f382c78a2a28219cbc666768a66420a84689d8d416297978332932c9f494c8cea421a347e14b65066e0a026856743f42db2f90c97c766f983c20257536e651479f52bece944953105dd988b3acc976dc815740b85bdc059444a2688d0c625fc70ef76910aa35c01907ee5b867aa6c0931e79916a87d83d613f1448a4e979d9075a8a8232915510632734769a6655d9052a6a0319644aa820643a56c4994361da77327ff0b065db421e192bad437872cf007d9927dd2394396aa4a57d37fbb4392cd8c924901b6cc2ba93b780fce6894ca03c9b8f8a486cbca06fb8a4c1b7233db4762d839c8027d576a7d592cc6194703f557b3ea51665eeb8b5d0c8b7c0c1d1653ac8461b320bc3583740539d9226d713acfbc95dff8c619c6a587ba9fd654c4717881c91729d9764cb83708700042d7c16766caa1e6982a1cdab084d5970f8bb1b1f86fb1963cbfa013eaf7a34d0472060a3b2e356cab73bc797b4fbfba80b7b4841dd053e9724fafcb353b68cde0b496a325ac1cf7bfd911c8560c9d229479d3b791c2c31225c56c93010d616c953df291200429612256ebacb245f03794628cedd7a8d310b98e5883a16625f6e2b3bd38130c67c26dd6a8d654717971a691625acee66630c5782e602a13b706a4a3687f4198556351f8a04377a152a41a766b972af12acfc6471b2902295c958b0c88cd00336b4c30121a0ab6876339ba0b40003762e5c487261abc2ac20dfb941fa77b9057184c058a1d3c1880ec09080ab16ffc999027dc9c62b35274c213c9784669f6389040c670b5794fe0c17b76cadd2075a137366f40bfbfa83d2de34f8cd2a96d423ef7f41c3e064faca737f52caee4157286ec98186c332fec751cc4cb472c7a99d142def1809f9a853ae20ec57a7b4fe4848b1c907ffb5c378534a7b889ad892a6569b0a0c8442798072279349c50c2c5ec4c70d7281322650d70b98fa4e734441adb4aff19452a33d3f4f249ecdcaa22d9cbe70ca84cf86ff87559e25f1ddf28ca32a79fff4001e5a9c2bf6e5437864f7f370d80f2d5284ee78241001d0020e25f1ddf28ca32a79fff4001e5a9c2bf6e5437864f7f370d80f2d5284ee78241","tls_ja3":["416eca07dcaad72dec6f76d1277b3eff"],"http_akin":["a11cun050_0000005d_7266f93a","a11cun030_0000004a_c91eaf54","a11cun040_0080004a_0e46e402","a11cun040_0000004b_4c87b06e"]},"fingerprint_peers":{"t13i251000_b78ed14e2fd0_ab7e3b40a677":101,"a11cun050_0000005d_7266f93a":49,"a11cun030_0000004a_c91eaf54":240,"a11cun040_0080004a_0e46e402":3,"a11cun040_0000004b_4c87b06e":225},"akin_families":{"a11cun030_0000004a_c91eaf54":{"head":"a11cun030_0000004a_c91eaf54","shapes":3,"ips":240},"a11cun040_0080004a_0e46e402":{"head":"a11cun030_0000004a_c91eaf54","shapes":3,"ips":240}},"user_agents":["Mozilla/5.0 (compatible; xa-audit/1.0)","Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:82.0) Gecko/20100101 Firefox/82.0","Mozilla/5.0 (Macintosh; Intel Mac OS X 12_5) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/15.4 Safari/605.1.15","Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_6) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/15.6.7 Mobile/15E148 Safari/604.1","Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:126.0) Gecko/20100101 Firefox/126.0","Mozilla/5.0 (Kubuntu; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36","Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0"],"timeline":[{"date":"2026-09-28","count":6},{"date":"2026-09-29","count":103}],"recent_events":[{"timestamp":"2026-09-29T15:04:45","port":2181,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"host\":\"<HONEYPOT>:2181\",\"user-agent\":\"Mozilla/5.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"48454144202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a323138310d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"HEAD","user_agent":"Mozilla/5.0","ja3":"","session":"3b2ba042-3b7b-4c28-bb76-7cdd3508a5f0","seq":1,"duration_ms":100,"bytes_in":90,"bytes_out":78},{"timestamp":"2026-09-29T15:02:40","port":2379,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"host\":\"<HONEYPOT>:2379\",\"user-agent\":\"Mozilla/5.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"48454144202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a323337390d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"HEAD","user_agent":"Mozilla/5.0","ja3":"","session":"6ffcc8f0-c020-49a7-a943-4a26668832e8","seq":1,"duration_ms":100,"bytes_in":90,"bytes_out":78},{"timestamp":"2026-09-29T15:02:25","port":2181,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"envi\r\nquit\r\n","payload_hex":"656e76690d0a717569740d0a","method":"","user_agent":"","ja3":"","session":"c7b8459a-4150-49ff-ad45-23f3b5764a58","seq":1,"duration_ms":100,"bytes_in":12,"bytes_out":13,"enriched":{"digest":"ea8ed8c92978a0fc","strings":["envi","quit"]}},{"timestamp":"2026-09-29T15:02:25","port":2181,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000-\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000u0\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0010\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000","payload_hex":"0000002d000000000000000000000000000075300000000000000000000000100000000000000000000000000000000000","method":"","user_agent":"","ja3":"","session":"57266d0f-98e8-4443-9fbc-f2e98d1bdbae","seq":1,"duration_ms":100,"bytes_in":49,"bytes_out":13},{"timestamp":"2026-09-29T15:02:25","port":2181,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000\u000e\u0000\u0000\u0000\u0001\u0000\u0000\u0000\b\u0000\u0000\u0000\u0001/\u0000","payload_hex":"0000000e0000000100000008000000012f00","method":"","user_agent":"","ja3":"","session":"57266d0f-98e8-4443-9fbc-f2e98d1bdbae","seq":2,"duration_ms":297,"bytes_in":67,"bytes_out":26},{"timestamp":"2026-09-29T15:00:54","port":2379,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"host\":\"<HONEYPOT>:2379\",\"user-agent\":\"Mozilla/5.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/version","summary":"","payload_hex":"474554202f76657273696f6e20485454502f312e310d0a486f73743a20<HONEYPOT>3a323337390d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0","ja3":"","session":"b3050845-95d4-4143-a116-36d6a0502524","seq":1,"duration_ms":100,"bytes_in":96,"bytes_out":78},{"timestamp":"2026-09-29T15:00:54","port":2379,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"host\":\"<HONEYPOT>:2379\",\"user-agent\":\"Mozilla/5.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/health","summary":"","payload_hex":"474554202f6865616c746820485454502f312e310d0a486f73743a20<HONEYPOT>3a323337390d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0","ja3":"","session":"e4cd07c5-afb0-4dc7-9a96-b76a20f20211","seq":1,"duration_ms":100,"bytes_in":95,"bytes_out":78},{"timestamp":"2026-09-29T14:25:04","port":139,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"host\":\"<HONEYPOT>:139\",\"user-agent\":\"Mozilla/5.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"48454144202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a3133390d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"HEAD","user_agent":"Mozilla/5.0","ja3":"","session":"0a6b0b8f-d0b8-4baf-8c4d-c8f845363765","seq":1,"duration_ms":100,"bytes_in":89,"bytes_out":78},{"timestamp":"2026-09-29T14:25:04","port":139,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"host\":\"<HONEYPOT>:139\",\"user-agent\":\"Mozilla/5.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"48454144202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a3133390d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"HEAD","user_agent":"Mozilla/5.0","ja3":"","session":"9bdad42e-d3d3-4293-a2f4-26540941cfca","seq":1,"duration_ms":100,"bytes_in":89,"bytes_out":78},{"timestamp":"2026-09-29T14:20:52","port":139,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000…ÿSMBr\u0000\u0000\u0000\u0000\u0018SÈ\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000ÿþ\u0000\u0000\u0000\u0000\u0000b\u0000\u0002PC NETWORK PROGRAM 1.0\u0000\u0002LANMAN1.0\u0000\u0002Windows for Workgroups 3.1a\u0000\u0002LM1.2X002\u0000\u0002LANMAN2.1\u0000\u0002NT LM 0.12\u0000\u0002SMB 2.002\u0000","payload_hex":"000000c285c3bf534d4272000000001853c3880000000000000000000000000000c3bfc3be00000000006200025043204e4554574f524b2050524f4752414d20312e3000024c414e4d414e312e30000257696e646f777320666f7220576f726b67726f75707320332e316100024c4d312e325830303200024c414e4d414e322e3100024e54204c4d20302e31320002534d4220322e30303200","method":"","user_agent":"","ja3":"","session":"6db0b29f-0dd0-46a4-87e6-3cb9d5fc7c98","seq":1,"duration_ms":100,"bytes_in":153,"bytes_out":13,"enriched":{"digest":"4165b8f85f5ff747","strings":["SMBr","PC NETWORK PROGRAM 1.0","LANMAN1.0","Windows for Workgroups 3.1a","LM1.2X002","LANMAN2.1","NT LM 0.12","SMB 2.002"]}}],"http_methods":[{"method":"GET","count":54},{"method":"HEAD","count":40}],"distinct_ports_total":24,"top_paths":[{"path":"/","count":47,"ports":23},{"path":"/.env.local","count":2,"ports":2},{"path":"/.env_sample","count":2,"ports":2},{"path":"/.env.production.local","count":2,"ports":2},{"path":"/health","count":2,"ports":2},{"path":"/pods","count":2,"ports":1},{"path":"/.env.development.local","count":2,"ports":2},{"path":"/version","count":2,"ports":2},{"path":"/.env.save","count":2,"ports":2},{"path":"/.env_1","count":2,"ports":2},{"path":"/.env.prod.local","count":2,"ports":2},{"path":"/.env.old","count":2,"ports":2},{"path":"/.env.prod","count":2,"ports":2},{"path":"/.env.dev","count":2,"ports":2},{"path":"/.env.backup","count":2,"ports":2}],"distinct_paths_total":30,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Connection","Host","User-Agent"],"representative":[{"name":"Connection","value":"close","notable":false},{"name":"Host","value":"<HONEYPOT>:2181","notable":false},{"name":"User-Agent","value":"Mozilla/5.0","notable":false}],"distinct_sets":1,"events_with_headers":6},"tags":[{"tag_id":"CVE-2020-2551","tag_type":"cve","title":"Oracle WebLogic Server - Remote Code Execution","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/console/login/LoginForm.jsp","reference_urls":["https://github.com/hktalent/CVE-2020-2551","https://nvd.nist.gov/vuln/detail/CVE-2020-2551","https://www.oracle.com/security-alerts/cpujan2020.html","https://github.com/neilzhang1/Chinese-Charts","https://github.com/pjgmonteiro/Pentest-tools"]}],"data_as_of":"2026-09-29T19:36:15.266623+00:00"}