{"ip":"23.254.232.55","total_events":36,"verdict":{"verdict":"scanning","label":"Scanning for known vulnerabilities","detail":"3 exploit-path probe(s)","confidence":"medium","network_type":"nsp","why":["3 request(s) matched a known exploit path.","Only GET/HEAD seen, no request body: scanning for the vulnerability, not delivering a payload.","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"9,478 bytes sent","bytes_sent":9478,"session_seconds":0,"persistent":false}},"first_seen":"2026-09-08T15:48:50","last_seen":"2026-09-08T15:49:02","events_24h":0,"events_7d":0,"geo":{"country_code":"US","country_name":"United States","region":"","city":"","lat":37.751,"lon":-97.822,"asn":36352,"org":"HostPapa"},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as36352","label":"ColoCrossing","category":"isp","url":"https://www.peeringdb.com/asn/36352"},"cve_matches":[],"malware":[],"top_ports":[{"port":80,"proto":"tcp","label":"HTTP","count":17},{"port":443,"proto":"tcp","label":"HTTPS","count":17},{"port":554,"proto":"tcp","label":"","count":2}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i181100_2fc7df0f2c24_ecd0401ec68b","t13i1812h1_2fc7df0f2c24_ecd0401ec68b"],"tls_client_hello":"","tls_ja3":["9e147609e34f51d8eddc26ca9e0cf11c","c244a0f87cc26e1ee42a7c05ce4a6307","c68cabdc68128b136a5d47c29090ea36","e6204cfb72dfbdeecedd2ece744ca01e"],"http_akin":["b11cun050_00040017_67f56447","b11cun050_0004001d_7129ba85"]},"fingerprint_peers":{"t13i181100_2fc7df0f2c24_ecd0401ec68b":2,"t13i1812h1_2fc7df0f2c24_ecd0401ec68b":2,"b11cun050_00040017_67f56447":2,"b11cun050_0004001d_7129ba85":2},"akin_families":{},"user_agents":["Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36","Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36"],"timeline":[{"date":"2026-09-08","count":36}],"recent_events":[{"timestamp":"2026-09-08T15:49:02","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"image/avif,image/webp,*/*;q=0.8\",\"accept-encoding\":\"identity\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:80\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/cgi-bin/snapshot.cgi","summary":"","payload_hex":"474554202f6367692d62696e2f736e617073686f742e63676920485454502f312e310d0a4163636570742d456e636f64696e673a206964656e746974790d0a486f73743a20<HONEYPOT>3a38300d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132362e302e302e30205361666172692f3533372e33360d0a4163636570743a20696d6167652f617669662c696d6167652f776562702c2a2f2a3b713d302e380d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36","ja3":"","session":"1a8eabcf-8222-4730-a3f8-540eb66464fa","seq":1,"duration_ms":100,"bytes_in":263,"bytes_out":78},{"timestamp":"2026-09-08T15:49:02","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"image/avif,image/webp,*/*;q=0.8\",\"accept-encoding\":\"identity\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:80\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/img/snapshot.cgi","summary":"","payload_hex":"474554202f696d672f736e617073686f742e63676920485454502f312e310d0a4163636570742d456e636f64696e673a206964656e746974790d0a486f73743a20<HONEYPOT>3a38300d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132362e302e302e30205361666172692f3533372e33360d0a4163636570743a20696d6167652f617669662c696d6167652f776562702c2a2f2a3b713d302e380d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36","ja3":"","session":"5370604f-27e4-4bdc-963b-44cef1674030","seq":1,"duration_ms":100,"bytes_in":259,"bytes_out":78},{"timestamp":"2026-09-08T15:49:02","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"image/avif,image/webp,*/*;q=0.8\",\"accept-encoding\":\"identity\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:443\",\"user-agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"/cgi-bin/snapshot.cgi","summary":"","payload_hex":"474554202f6367692d62696e2f736e617073686f742e63676920485454502f312e310d0a4163636570742d456e636f64696e673a206964656e746974790d0a486f73743a20<HONEYPOT>3a3434330d0a557365722d4167656e743a204d6f7a696c6c612f352e3020284d6163696e746f73683b20496e74656c204d6163204f5320582031305f31355f3729204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132362e302e302e30205361666172692f3533372e33360d0a4163636570743a20696d6167652f617669662c696d6167652f776562702c2a2f2a3b713d302e380d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36","ja3":"94fa11122ec234d6e8785e33c6bea1b4","session":"10716b4e-bfd4-4fca-a851-6e3a485748ec","seq":1,"duration_ms":100,"bytes_in":280,"bytes_out":78},{"timestamp":"2026-09-08T15:49:02","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"image/avif,image/webp,*/*;q=0.8\",\"accept-encoding\":\"identity\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:443\",\"user-agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"/img/snapshot.cgi","summary":"","payload_hex":"474554202f696d672f736e617073686f742e63676920485454502f312e310d0a4163636570742d456e636f64696e673a206964656e746974790d0a486f73743a20<HONEYPOT>3a3434330d0a557365722d4167656e743a204d6f7a696c6c612f352e3020284d6163696e746f73683b20496e74656c204d6163204f5320582031305f31355f3729204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132362e302e302e30205361666172692f3533372e33360d0a4163636570743a20696d6167652f617669662c696d6167652f776562702c2a2f2a3b713d302e380d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36","ja3":"54c5f0a7d2063d3f66731c7517279ea1","session":"83742b69-16bd-4e51-898e-df3c80f73e62","seq":1,"duration_ms":100,"bytes_in":276,"bytes_out":78},{"timestamp":"2026-09-08T15:49:01","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"image/avif,image/webp,*/*;q=0.8\",\"accept-encoding\":\"identity\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:80\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/image.jpg","summary":"","payload_hex":"474554202f696d6167652e6a706720485454502f312e310d0a4163636570742d456e636f64696e673a206964656e746974790d0a486f73743a20<HONEYPOT>3a38300d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132362e302e302e30205361666172692f3533372e33360d0a4163636570743a20696d6167652f617669662c696d6167652f776562702c2a2f2a3b713d302e380d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36","ja3":"","session":"0495a952-9eef-48e4-beae-69df45056122","seq":1,"duration_ms":101,"bytes_in":252,"bytes_out":78},{"timestamp":"2026-09-08T15:49:01","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"image/avif,image/webp,*/*;q=0.8\",\"accept-encoding\":\"identity\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:80\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/jpg/image.jpg","summary":"","payload_hex":"474554202f6a70672f696d6167652e6a706720485454502f312e310d0a4163636570742d456e636f64696e673a206964656e746974790d0a486f73743a20<HONEYPOT>3a38300d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132362e302e302e30205361666172692f3533372e33360d0a4163636570743a20696d6167652f617669662c696d6167652f776562702c2a2f2a3b713d302e380d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36","ja3":"","session":"ba8a789f-b213-4032-9995-7640dd59c5d6","seq":1,"duration_ms":100,"bytes_in":256,"bytes_out":78},{"timestamp":"2026-09-08T15:49:01","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"image/avif,image/webp,*/*;q=0.8\",\"accept-encoding\":\"identity\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:443\",\"user-agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/jpg/image.jpg","summary":"","payload_hex":"474554202f6a70672f696d6167652e6a706720485454502f312e310d0a4163636570742d456e636f64696e673a206964656e746974790d0a486f73743a20<HONEYPOT>3a3434330d0a557365722d4167656e743a204d6f7a696c6c612f352e3020284d6163696e746f73683b20496e74656c204d6163204f5320582031305f31355f3729204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132362e302e302e30205361666172692f3533372e33360d0a4163636570743a20696d6167652f617669662c696d6167652f776562702c2a2f2a3b713d302e380d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36","ja3":"8c3ab5827943be12f97f86ad50e6af6a","session":"35d7e679-cd5a-4622-9d39-feebb3f08d44","seq":1,"duration_ms":100,"bytes_in":273,"bytes_out":78},{"timestamp":"2026-09-08T15:49:00","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"image/avif,image/webp,*/*;q=0.8\",\"accept-encoding\":\"identity\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:80\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/snapshot.jpg","summary":"","payload_hex":"474554202f736e617073686f742e6a706720485454502f312e310d0a4163636570742d456e636f64696e673a206964656e746974790d0a486f73743a20<HONEYPOT>3a38300d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132362e302e302e30205361666172692f3533372e33360d0a4163636570743a20696d6167652f617669662c696d6167652f776562702c2a2f2a3b713d302e380d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36","ja3":"","session":"9a1870ce-2726-4b04-9107-5773db6e6c0f","seq":1,"duration_ms":100,"bytes_in":255,"bytes_out":78},{"timestamp":"2026-09-08T15:49:00","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"image/avif,image/webp,*/*;q=0.8\",\"accept-encoding\":\"identity\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:80\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/snap.jpg","summary":"","payload_hex":"474554202f736e61702e6a706720485454502f312e310d0a4163636570742d456e636f64696e673a206964656e746974790d0a486f73743a20<HONEYPOT>3a38300d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132362e302e302e30205361666172692f3533372e33360d0a4163636570743a20696d6167652f617669662c696d6167652f776562702c2a2f2a3b713d302e380d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36","ja3":"","session":"19df533f-744a-4d73-b45e-db03e34d9760","seq":1,"duration_ms":101,"bytes_in":251,"bytes_out":78},{"timestamp":"2026-09-08T15:49:00","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"image/avif,image/webp,*/*;q=0.8\",\"accept-encoding\":\"identity\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:443\",\"user-agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"/snap.jpg","summary":"","payload_hex":"474554202f736e61702e6a706720485454502f312e310d0a4163636570742d456e636f64696e673a206964656e746974790d0a486f73743a20<HONEYPOT>3a3434330d0a557365722d4167656e743a204d6f7a696c6c612f352e3020284d6163696e746f73683b20496e74656c204d6163204f5320582031305f31355f3729204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132362e302e302e30205361666172692f3533372e33360d0a4163636570743a20696d6167652f617669662c696d6167652f776562702c2a2f2a3b713d302e380d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36","ja3":"9e39fe8d17740243a9ebadae84aeab2a","session":"ff17b0fd-a885-4d40-900e-e38621c182f0","seq":1,"duration_ms":100,"bytes_in":268,"bytes_out":78}],"http_methods":[{"method":"GET","count":34}],"distinct_ports_total":3,"top_paths":[{"path":"/","count":2,"ports":2},{"path":"/snap.jpg","count":2,"ports":2},{"path":"/jpg/image.jpg","count":2,"ports":2},{"path":"/image/jpeg.cgi","count":2,"ports":2},{"path":"/snapshot.jpg","count":2,"ports":2},{"path":"/image.jpg","count":2,"ports":2},{"path":"/img/snapshot.cgi","count":2,"ports":2},{"path":"/axis-cgi/jpg/image.cgi","count":2,"ports":2},{"path":"/cgi-bin/snapshot.cgi","count":2,"ports":2},{"path":"/oneshotimage.jpg","count":2,"ports":2},{"path":"/-wvhttp-01-/image.cgi","count":2,"ports":2},{"path":"/onvif-http/snapshot","count":2,"ports":2},{"path":"/record/current.jpg","count":2,"ports":2},{"path":"/ISAPI/Streaming/channels/101/picture","count":2,"ports":2},{"path":"/cgi-bin/api.cgi?cmd=Snap&channel=0","count":2,"ports":2}],"distinct_paths_total":17,"top_snis":[],"top_hosts":[],"top_alpns":[{"value":"http/1.1","count":14}],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","Accept-Encoding","Connection","Host","User-Agent"],"representative":[{"name":"Accept","value":"image/avif,image/webp,*/*;q=0.8","notable":false},{"name":"Accept-Encoding","value":"identity","notable":false},{"name":"Connection","value":"close","notable":false},{"name":"Host","value":"<HONEYPOT>:80","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36","notable":false}],"distinct_sets":1,"events_with_headers":10},"tags":[],"data_as_of":"2026-10-01T13:44:39.528868+00:00"}