{"ip":"213.209.159.9","data_as_of":"2026-10-24T15:44:52+00:00","observed":true,"total_events":150,"verdict":{"verdict":"scanning","label":"Scanning for known vulnerabilities","detail":"2 exploit-path probe(s)","confidence":"medium","network_type":null,"why":["2 request(s) matched a known exploit path.","Only GET and HEAD requests were seen, with no body, which reads as a check for the vulnerability without a payload.","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"216,967 bytes sent","bytes_sent":216967,"session_seconds":12,"persistent":false},"basis":"first_contact"},"first_seen":"2026-07-29T13:42:54","last_seen":"2026-10-11T03:08:37","events_24h":0,"events_7d":0,"interactive_sessions":0,"interactive_sessions_24h":0,"interactive_sessions_7d":0,"interactive_protocols":[],"geo":{"country_code":"DE","country_name":"Germany","region":"North Rhine-Westphalia","city":"Aachen","lat":50.7745,"lon":6.0861,"asn":208137,"org":"Feo Prest SRL"},"source_domain":null,"known_scanners":[],"scanner_tag":null,"cve_matches":[{"cve_id":"CVE-2020-2551","title":"Oracle WebLogic Server - Remote Code Execution","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/console/login/LoginForm.jsp","kev_date_added":"2023-11-16"},{"cve_id":"CVE-2022-22963","title":"Spring Cloud - Remote Code Execution","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/functionRouter","kev_date_added":"2022-08-25"},{"cve_id":"CVE-2023-46747","title":"F5 BIG-IP - Unauthenticated RCE via AJP Smuggling","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/tmui/login.jsp","kev_date_added":"2023-10-31"}],"malware":[],"udp":null,"interaction":null,"top_ports":[{"port":10443,"proto":"tcp","label":"","count":68},{"port":8443,"proto":"tcp","label":"HTTPS-alt","count":9},{"port":443,"proto":"tcp","label":"HTTPS","count":9},{"port":1443,"proto":"tcp","label":"","count":7},{"port":4443,"proto":"tcp","label":"","count":7},{"port":4433,"proto":"tcp","label":"","count":6},{"port":444,"proto":"tcp","label":"","count":5},{"port":9443,"proto":"tcp","label":"","count":5},{"port":8080,"proto":"tcp","label":"HTTP-alt","count":2},{"port":8001,"proto":"tcp","label":"","count":2},{"port":8081,"proto":"tcp","label":"","count":2},{"port":4444,"proto":"tcp","label":"","count":2},{"port":7443,"proto":"tcp","label":"","count":2},{"port":20443,"proto":"tcp","label":"","count":2},{"port":6443,"proto":"tcp","label":"k8s API","count":2}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i251000_b78ed14e2fd0_ab7e3b40a677","t13i301000_1d37bd780c83_8e6e362c5eac"],"tls_client_hello":"16030105e2010005de0303fbbf55f31b560c04d3fd7b494a691cbe61d41765e9b900d50155f24cbf3f001a20dc35c8ec16f09d75f32db792bae0f2d8dd6b725a2d5e9c37ce61b4a8b2f993e90032c02bc02fc02cc030cca9cca8c009c013c00ac014009c009d002f0035c012000ac023c027003cc007c011000513011302130301000563000b00020100ff010001000017000000120000000500050100000000000a0010000e11ec11eb11ed001d001700180019000d0016001408040403080708050806040105010601050306030032001a0018080404030807080508060401050106010503060302010203002b0009080304030303020301003304ea04e811ec04c0b655669df04ad8e996be193e3959b8b89b62c8b33858b4b33c738529ccc3aa53c10c00a97d840d636b58c8092096a179b819b3ebb069a467a6c5396c5e2b21879a7c767030b6856bfc27c436d4546ba5c30275342677a48528be8e4a05ca8ca38e46527fe65300339991ec1e0df527c7841ba674bb4d93b5cccb3cf75480a4209977880d89f66e387090ab8b95a6a640c159a22d748997814fd2d28fed5c4b16571075ea7df1a82e16e53c4cfc5e17458c149b4b95896d5343082d9bc5f584c2ffe574d4967f6665cced6526a899265904a556b391a8fc937e3a8e08a618f77a2b1562ae0bd57e2502753e1a553200a103634f3d566589b9cc917500fffa4142231a5794b380bbcc28f3caa8928270ac998cebb9c007a82b6a67fbf10207948d002287bfe7b446aa0b00d9978ac5613c4542c1121c3dba29bd214ebcca7562669b46e276781597d5cc48cfa2bcaba3644eb769ce887d7a554498744679e7cc1441aefe1c67b9e01c2d011c032c5d1865507971386c8283a8683906e2a3d27360ce9bae6578958984a484245ad8cc98724c2ea6ac2c6743534440114435a5bb571be181413e59975261112de769f0bbbe42a18315f12cc2b110a6a33f11993a8869abdbd12502178f98118d058594cfcc82b30286bfa04b3d4abb24d4239f299da06cb375365e1ea999bec7072bb7164f354ae88ba82598be90838db9299402b8caf076be45da73d5dc8355ba3f37742e7a97810d52a81ec263d919644e451b297cb4571a4aa67a45411a58e4a037061b204855702af634c4e2c1108787fe939837e7762044735b786875f88044c0a022d40f65278c67da2abc286ea5285fdcdb1f95e7cf4af86206f3adea602967d19d7480ab309a534af5648aa657e0c79f76c73f558160e59bca24a867812b42c93924daeb247a80c4b149818fa007d68ab3dd576131c1ae7ce93370695ddfbc03bf81baa2a72b5f050f69b7bc7e3b1c8247c794e1ab6f591e37dc5054ca0f38e1c8cc1288b34488a2e06e411b3ceb54306a707526859e8cd0a0e0c28f74c86a30f6510d650f8ed8603b3491907a24b22b5c1e6cb905dc6b82643f9eb856b0cbbd61ccadad305a58ea8732d97c2eac4bef492bbf2479815aba5fa1a7e75b9f5fa8ca01a08e0a8080b5f93eec271bf38b1b63b40dcbacc232703a0d54c4b44528b2d11dbaf473efe12fa8d88a586399e2e817c24893ce5a7d5e473d73e33c0945531777079516767d146b931aa03a3085fdb3ca68a58d2cd555145508e7136a7e04b5dd537d0454b85ac0ac20fa637c3ace8c51a5088560af4a5cb0b8b8e9e09d3e7abdc1d0343db2a2ea595021f51182034508321b89125729fc989df7246746041deb338ff970ad8a40646496d1b30caf240558e800f1278ab268b70d17481d83a33e9c8a0126a5cfc0ad182a60a8398a674c38b1386bcac45101e447e9c2b13476a44ff65fae24195e639c773165d6bb397bab5a8dd9c11745700e10b8c4842a7d701419d64ade6bb62e859b928a318dfbb13622b1a91c280a241caaa6825e60701f4199d719a7bdc823885137c4fb81de3396af8130d0f9718fc9cc330a88c0f02d623baac82c62d484625a50975a16b60373587e51024e62c077b273f3fb239c9307bffb584709242b6593c79d61313882945924d4aec2cb7001d0acd517efb43d46252c379c2e62c11970150309325a001d002082945924d4aec2cb7001d0acd517efb43d46252c379c2e62c11970150309325a","tls_ja3":["416eca07dcaad72dec6f76d1277b3eff","afff01903e7daf79afab4226ff5bf67f"],"http_akin":["b11cun030_00040012_13ee3d34","b11cun050_00060013_3ef9a8f6","b11cun010_00040000_c4b2c4aa","b11cun040_00040013_608dab68"],"interactive":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[]}},"fingerprint_peers":{"t13i251000_b78ed14e2fd0_ab7e3b40a677":96,"t13i301000_1d37bd780c83_8e6e362c5eac":7,"b11cun030_00040012_13ee3d34":5337,"b11cun050_00060013_3ef9a8f6":159,"b11cun040_00040013_608dab68":4335,"b11cun010_00040000_c4b2c4aa":942},"akin_families":{"b11cun030_00040012_13ee3d34":{"head":"b11cun030_00040012_13ee3d34","shapes":2,"ips":5337},"b11cun040_00040013_608dab68":{"head":"b11cun040_00040013_608dab68","shapes":2,"ips":4334}},"user_agents":["Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:70.0) Gecko/20100101 Firefox/70.0","Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/124","Go-http-client/1.1","Mozilla/5.0 (Macintosh, Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.1 Safari/605.1.15","Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:140.0) Gecko/20100101 Firefox/140.9","Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/124.0.0.0","Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36"],"timeline":[{"date":"2026-07-29","count":50},{"date":"2026-09-30","count":60},{"date":"2026-10-01","count":9},{"date":"2026-10-07","count":7},{"date":"2026-10-10","count":14},{"date":"2026-10-11","count":10}],"recent_events":[{"timestamp":"2026-10-11T03:08:37","port":8443,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"host\":\"<HONEYPOT>:8443\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a383434330d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"21359829-5011-4ed7-b45e-37432600b5bf","seq":1,"duration_ms":100,"bytes_in":43,"bytes_out":78},{"timestamp":"2026-10-11T03:08:02","port":8443,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"host\":\"<HONEYPOT>:8443\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a383434330d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"fa3491b8-e744-4248-b2d2-cadbb0d1b4a7","seq":1,"duration_ms":100,"bytes_in":44,"bytes_out":78},{"timestamp":"2026-10-11T03:06:21","port":444,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"host\":\"<HONEYPOT>:444\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a3434340d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"5b18381a-4074-460d-8a3d-936cf153fa61","seq":1,"duration_ms":100,"bytes_in":42,"bytes_out":78},{"timestamp":"2026-10-11T03:06:17","port":4443,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"host\":\"<HONEYPOT>:4443\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a343434330d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"27e1473e-c3e7-4498-bca9-2f653a02c48f","seq":1,"duration_ms":100,"bytes_in":43,"bytes_out":78},{"timestamp":"2026-10-11T03:06:16","port":4443,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"host\":\"<HONEYPOT>:4443\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a343434330d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"f8e6efb0-7a33-4d44-b7a7-c32479e0e401","seq":1,"duration_ms":101,"bytes_in":44,"bytes_out":78},{"timestamp":"2026-10-11T02:17:09","port":443,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"host\":\"<HONEYPOT>:443\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a3434330d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"5a748060-e8b4-4d9f-bf70-6dcca0d0f907","seq":1,"duration_ms":100,"bytes_in":42,"bytes_out":78},{"timestamp":"2026-10-11T01:33:33","port":1443,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"host\":\"<HONEYPOT>:1443\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a313434330d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"b4d18277-4579-44d4-9f23-d97f2d551870","seq":1,"duration_ms":100,"bytes_in":44,"bytes_out":78},{"timestamp":"2026-10-11T01:33:14","port":1443,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"host\":\"<HONEYPOT>:1443\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a313434330d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"af469a3c-5c3e-4354-b33c-baf4680ad2fd","seq":1,"duration_ms":100,"bytes_in":43,"bytes_out":78},{"timestamp":"2026-10-11T01:33:12","port":10443,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"host\":\"<HONEYPOT>:10443\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a31303434330d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"b6a3f5aa-c4e9-434b-92ce-0262542fbd22","seq":1,"duration_ms":100,"bytes_in":44,"bytes_out":78},{"timestamp":"2026-10-11T01:33:12","port":10443,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"host\":\"<HONEYPOT>:10443\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a31303434330d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"a83229ff-20a2-446e-894f-075f47487cbf","seq":1,"duration_ms":100,"bytes_in":45,"bytes_out":78}],"http_methods":[{"method":"GET","count":150}],"distinct_ports_total":25,"top_paths":[{"path":"/","count":90,"ports":25},{"path":"/jenkins","count":2,"ports":1},{"path":"/login/img/product_logo.png","count":2,"ports":1},{"path":"/nacos/","count":2,"ports":1},{"path":"/emm-api","count":2,"ports":1},{"path":"/ueditor","count":2,"ports":1},{"path":"/k3cloud","count":2,"ports":1},{"path":"/solr","count":2,"ports":1},{"path":"/zabbix","count":2,"ports":1},{"path":"/OAapp","count":2,"ports":1},{"path":"/poserver.zz","count":2,"ports":1},{"path":"/swagger-ui.html","count":2,"ports":1},{"path":"/ht-login.jsp","count":2,"ports":1},{"path":"/xxl-job-admin","count":2,"ports":1},{"path":"/tmui/login.jsp","count":2,"ports":1}],"distinct_paths_total":33,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Host"],"representative":[{"name":"Host","value":"<HONEYPOT>:8443","notable":false}],"distinct_sets":1,"events_with_headers":10},"tags":[{"tag_id":"CVE-2020-2551","tag_type":"cve","title":"Oracle WebLogic Server - Remote Code Execution","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/console/login/LoginForm.jsp","reference_urls":["https://github.com/hktalent/CVE-2020-2551","https://nvd.nist.gov/vuln/detail/CVE-2020-2551","https://www.oracle.com/security-alerts/cpujan2020.html","https://github.com/neilzhang1/Chinese-Charts","https://github.com/pjgmonteiro/Pentest-tools"],"kev_date_added":"2023-11-16"},{"tag_id":"CVE-2022-22963","tag_type":"cve","title":"Spring Cloud - Remote Code Execution","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/functionRouter","reference_urls":["https://github.com/spring-cloud/spring-cloud-function/commit/0e89ee27b2e76138c16bcba6f4bca906c4f3744f","https://github.com/cckuailong/spring-cloud-function-SpEL-RCE","https://tanzu.vmware.com/security/cve-2022-22963","https://nsfocusglobal.com/spring-cloud-function-spel-expression-injection-vulnerability-alert/","https://github.com/vulhub/vulhub/tree/scf-spel/spring/spring-cloud-function-spel-injection"],"kev_date_added":"2022-08-25"},{"tag_id":"CVE-2023-46747","tag_type":"cve","title":"F5 BIG-IP - Unauthenticated RCE via AJP Smuggling","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/tmui/login.jsp","reference_urls":["https://www.praetorian.com/blog/refresh-compromising-f5-big-ip-with-request-smuggling-cve-2023-46747/","https://my.f5.com/manage/s/article/K000137353","http://packetstormsecurity.com/files/175673/F5-BIG-IP-TMUI-AJP-Smuggling-Remote-Command-Execution.html","https://www.secpod.com/blog/f5-issues-warning-big-ip-vulnerability-used-in-active-exploit-chain/","https://github.com/f1tao/awesome-iot-security-resource"],"kev_date_added":"2023-10-31"}]}