{"ip":"31.77.144.233","data_as_of":"2026-10-26T20:45:12+00:00","observed":true,"total_events":0,"verdict":{"verdict":"malicious","label":"Exploit attempts observed","detail":"9 interactive session(s) carried an exploit attempt","confidence":"high","network_type":"enterprise","why":["9 interactive session(s) carried an exploit attempt.","5+ sessions raise confidence to high.","Not in any known-scanner range.","Sent 515,153 bytes, which is sustained payload delivery."],"engagement":{"level":"payload","label":"Sustained payload","detail":"515,153 bytes sent","bytes_sent":515153,"session_seconds":38,"persistent":false},"basis":"interactive"},"first_seen":"2026-10-21T21:58:38","last_seen":"2026-10-21T22:43:16","events_24h":0,"events_7d":0,"interactive_sessions":159,"interactive_sessions_24h":0,"interactive_sessions_7d":159,"interactive_protocols":[{"protocol":"http","sessions":159}],"geo":{"country_code":"SE","country_name":"Sweden","region":"","city":"","lat":null,"lon":null,"asn":215439,"org":"Play2go International Limited"},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as215439","label":"PLAY2GO","category":"enterprise","url":"https://www.peeringdb.com/asn/215439"},"cve_matches":[],"malware":[{"sha256":"92db35e07008e7a699d3bcbfa9e8140d9f2421129a793385ed66ca7d1510daa2","family":"","vt_name":"i","malicious":0,"total":75,"vt_status":"uploaded","delivery":"b64","url_path":"/","dest_port":12188,"hits":4,"last_seen":"2026-10-21 21:58:58"}],"udp":null,"interaction":{"window_days":90,"sessions":159,"first_seen":"2026-10-21T21:58:38","last_seen":"2026-10-21T22:43:16","verdicts":[{"verdict":"scan","sessions":150},{"verdict":"exploit-attempt","sessions":9}],"personas":[{"persona":"nginx@1.18.0, wordpress@6.5.2, leaks@1, miner@cgminer 4.11.1, elasticsearch@8.11.1, winrm@Windows Server 2019, fortigate@7.2.1, docker@25.0.3","sessions":159}],"services":[{"protocol":"http","port":12188,"sessions":63},{"protocol":"http","port":8021,"sessions":46},{"protocol":"http","port":9922,"sessions":30},{"protocol":"http","port":10023,"sessions":12},{"protocol":"http","port":12502,"sessions":8}],"logins":[],"commands":[],"downloads":[],"files":[{"sha256":"fce6834b5bc063c3eeebd85f9a87ad18fe7c97e5ea347077ca01703b41786546","name":"php2shell","size":4679,"mime_type":"application/octet-stream","kind":"payload","times":1,"first_seen":"2026-10-21T22:42:47","last_seen":"2026-10-21T22:42:47","virustotal":null},{"sha256":"6d687f9cc5df0bfacb602021b6e3ae7cfc57beba5b54487bef0fdae9c9b9a730","name":"php2shell","size":4679,"mime_type":"application/octet-stream","kind":"payload","times":1,"first_seen":"2026-10-21T22:38:55","last_seen":"2026-10-21T22:38:55","virustotal":null},{"sha256":"4e0a270b24189f25dc69da981e927b436fb94cd94d841b48fefa2078cedaa46b","name":"php2shell","size":4679,"mime_type":"application/octet-stream","kind":"payload","times":1,"first_seen":"2026-10-21T22:38:54","last_seen":"2026-10-21T22:38:54","virustotal":null},{"sha256":"b0c7b06300273ae3ae9e3c186a30b10cd8e751af02154398ca6a1fe72dddd412","name":"php2shell","size":4862,"mime_type":"application/octet-stream","kind":"payload","times":1,"first_seen":"2026-10-21T22:38:54","last_seen":"2026-10-21T22:38:54","virustotal":null},{"sha256":"bbb943bb7abfd24837c81f2f75b7197439423d870431b51fb1ce87286d9a3eaa","name":"php2shell","size":4862,"mime_type":"application/octet-stream","kind":"payload","times":1,"first_seen":"2026-10-21T22:38:53","last_seen":"2026-10-21T22:38:53","virustotal":null},{"sha256":"e42b8424da08902f9d5692b7cd3b9ebd2b2a6f8f6dd5a06c3d1d36ea578d8a5a","name":"php2shell","size":4862,"mime_type":"application/octet-stream","kind":"payload","times":1,"first_seen":"2026-10-21T22:38:53","last_seen":"2026-10-21T22:38:53","virustotal":null},{"sha256":"f6f0c6874478d180f7dc44909afb0e2623554d43b16fb1dfdb243608b0f4f099","name":"php2shell","size":4862,"mime_type":"application/octet-stream","kind":"payload","times":1,"first_seen":"2026-10-21T22:38:53","last_seen":"2026-10-21T22:38:53","virustotal":null},{"sha256":"b74b33997501576aa2dd908cd19843232b5717bd9322429d562b2d2d1cba96dd","name":"php2shell","size":4679,"mime_type":"application/octet-stream","kind":"payload","times":1,"first_seen":"2026-10-21T22:34:23","last_seen":"2026-10-21T22:34:23","virustotal":null},{"sha256":"3e968f118c22c57a7ea72b68ad4b5c59fb858cf0006b38d06556099aba269c5f","name":"php2shell","size":4679,"mime_type":"application/octet-stream","kind":"payload","times":1,"first_seen":"2026-10-21T22:34:22","last_seen":"2026-10-21T22:34:22","virustotal":null},{"sha256":"9fda4609d1e0f5b815249bc2da7ab7c24c8a4776b01a0d68c290dc84eb4f74b8","name":"php2shell","size":4862,"mime_type":"application/octet-stream","kind":"payload","times":1,"first_seen":"2026-10-21T22:34:22","last_seen":"2026-10-21T22:34:22","virustotal":null},{"sha256":"215bbc21bef1c045b3b999b18e2824d5532b3b09e5b2a813f84f54fccadba873","name":"php2shell","size":4862,"mime_type":"application/octet-stream","kind":"payload","times":1,"first_seen":"2026-10-21T22:34:22","last_seen":"2026-10-21T22:34:22","virustotal":null},{"sha256":"73ab0f3afcb4e695d3807f17f62d9b141fc094339d36b2f58b4e3223fdf580f1","name":"php2shell","size":4862,"mime_type":"application/octet-stream","kind":"payload","times":1,"first_seen":"2026-10-21T22:34:21","last_seen":"2026-10-21T22:34:21","virustotal":null},{"sha256":"7978e6af943368d3abc72214aee04c2f7aeca7c3c6dd179beb637f8394281b31","name":"php2shell","size":4862,"mime_type":"application/octet-stream","kind":"payload","times":1,"first_seen":"2026-10-21T22:34:21","last_seen":"2026-10-21T22:34:21","virustotal":null},{"sha256":"1ca15d1a03edff0c2688082043a0cc323b627cef9b61d3ff77f7500c51a85327","name":"php2shell","size":4679,"mime_type":"application/octet-stream","kind":"payload","times":1,"first_seen":"2026-10-21T22:34:04","last_seen":"2026-10-21T22:34:04","virustotal":null},{"sha256":"8a4d55e7d088f9e7f2f7b6c1ae8f8f35b07dbb337c3b49f86358b03a6162d722","name":"php2shell","size":4679,"mime_type":"application/octet-stream","kind":"payload","times":1,"first_seen":"2026-10-21T22:34:03","last_seen":"2026-10-21T22:34:03","virustotal":null},{"sha256":"5d2d38da7d93599c74b6c17b788770aebda83bc101db07ed0b9452ed325bc674","name":"php2shell","size":4862,"mime_type":"application/octet-stream","kind":"payload","times":1,"first_seen":"2026-10-21T22:34:03","last_seen":"2026-10-21T22:34:03","virustotal":null},{"sha256":"b1293132d878ac13c467cf1047ad744b9994ced6425eb28be01c20d9d12efd95","name":"php2shell","size":4862,"mime_type":"application/octet-stream","kind":"payload","times":1,"first_seen":"2026-10-21T22:34:02","last_seen":"2026-10-21T22:34:02","virustotal":null},{"sha256":"3f0c830efc7cd07aaa7ed83369af0bbb9783e8066af4acf5c0bee83ed7e58152","name":"php2shell","size":4862,"mime_type":"application/octet-stream","kind":"payload","times":1,"first_seen":"2026-10-21T22:34:02","last_seen":"2026-10-21T22:34:02","virustotal":null},{"sha256":"ebd48646222547cd184ebb64b3a6f3fdebf19ab9bb7b236ada9e60fc74e814de","name":"php2shell","size":4862,"mime_type":"application/octet-stream","kind":"payload","times":1,"first_seen":"2026-10-21T22:34:02","last_seen":"2026-10-21T22:34:02","virustotal":null},{"sha256":"8e9625dc2b14f64132f60d5312211c42a4feee54c6d6330abdb6eca9995a6c53","name":"php2shell","size":4679,"mime_type":"application/octet-stream","kind":"payload","times":1,"first_seen":"2026-10-21T22:32:10","last_seen":"2026-10-21T22:32:10","virustotal":null},{"sha256":"e8b5a276e29fb134e48456b178d261d4900add4a106ae1805a394070f3214540","name":"php2shell","size":4679,"mime_type":"application/octet-stream","kind":"payload","times":1,"first_seen":"2026-10-21T22:32:10","last_seen":"2026-10-21T22:32:10","virustotal":null},{"sha256":"053a5d7cc9e5fab2b18b81edcc187ca418f1325b3f37d876bdd12b11fa2b302b","name":"php2shell","size":4862,"mime_type":"application/octet-stream","kind":"payload","times":1,"first_seen":"2026-10-21T22:32:09","last_seen":"2026-10-21T22:32:09","virustotal":null},{"sha256":"bdeea01e7120b0d8782455838e431bc0b47c30e30abfa3a4d5c862cc959e7b27","name":"php2shell","size":4862,"mime_type":"application/octet-stream","kind":"payload","times":1,"first_seen":"2026-10-21T22:32:09","last_seen":"2026-10-21T22:32:09","virustotal":null},{"sha256":"b52e4ea36b4a8b11124491f0fce17cd75385e378fa09ce204ad9c7fb2162913b","name":"php2shell","size":4862,"mime_type":"application/octet-stream","kind":"payload","times":1,"first_seen":"2026-10-21T22:32:08","last_seen":"2026-10-21T22:32:08","virustotal":null},{"sha256":"4b22cfba938d030ff17dc7cfe31c9a783e9226f0f8acb5dec5cdb292de677871","name":"php2shell","size":4862,"mime_type":"application/octet-stream","kind":"payload","times":1,"first_seen":"2026-10-21T22:32:08","last_seen":"2026-10-21T22:32:08","virustotal":null}],"attack":[{"technique_id":"T1595","technique_name":"Active Scanning","tactic_id":"TA0043","tactic_name":"Reconnaissance","sessions":158},{"technique_id":"T1190","technique_name":"Exploit Public-Facing Application","tactic_id":"TA0001","tactic_name":"Initial Access","sessions":9}]},"top_ports":[{"port":12188,"proto":"tcp","label":"HTTP","count":0,"sessions":63},{"port":8021,"proto":"tcp","label":"HTTP","count":0,"sessions":46},{"port":9922,"proto":"tcp","label":"HTTP","count":0,"sessions":30},{"port":10023,"proto":"tcp","label":"HTTP","count":0,"sessions":12},{"port":12502,"proto":"tcp","label":"HTTP","count":0,"sessions":8}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i1712h1_ab0a1bf427ad_8537cf56674e"],"tls_client_hello":"","tls_ja3":["bd40409ee01650fa08f35cdbf3f5ce58"],"http_akin":[],"interactive":{"ssh_hassh":[],"tls_ja4":["t13i1712h1_ab0a1bf427ad_8537cf56674e"],"tls_ja3":["bd40409ee01650fa08f35cdbf3f5ce58"]}},"fingerprint_peers":{"t13i1712h1_ab0a1bf427ad_8537cf56674e":0},"akin_families":{},"user_agents":["Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"],"timeline":[{"date":"2026-10-21","count":0,"sessions":159}],"recent_events":[{"timestamp":"2026-10-21T22:43:05","port":8021,"proto":"tcp","app_proto":"http","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:8021\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"1.3","alpn":[],"url_path":"/wp-includes/css/dist/block-library/style.min.css","summary":"","payload_hex":"474554202f77702d696e636c756465732f6373732f646973742f626c6f636b2d6c6962726172792f7374796c652e6d696e2e63737320485454502f312e310d0a486f73743a203c484f4e4559504f543e3a383032310d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3133312e302e302e30205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36","ja3":"bd40409ee01650fa08f35cdbf3f5ce58","session":"75d17064-470b-475d-bef1-403988036c65-39","seq":39,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-21T22:43:05","port":8021,"proto":"tcp","app_proto":"http","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:8021\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"1.3","alpn":[],"url_path":"/content.php","summary":"","payload_hex":"474554202f636f6e74656e742e70687020485454502f312e310d0a486f73743a203c484f4e4559504f543e3a383032310d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3133312e302e302e30205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36","ja3":"bd40409ee01650fa08f35cdbf3f5ce58","session":"e3406eb8-856f-4d46-ba75-c0afa588bb9c-11","seq":11,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-21T22:43:05","port":8021,"proto":"tcp","app_proto":"http","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:8021\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"1.3","alpn":[],"url_path":"/content.php","summary":"","payload_hex":"48454144202f636f6e74656e742e70687020485454502f312e310d0a486f73743a203c484f4e4559504f543e3a383032310d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3133312e302e302e30205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"HEAD","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36","ja3":"bd40409ee01650fa08f35cdbf3f5ce58","session":"e3406eb8-856f-4d46-ba75-c0afa588bb9c-9","seq":9,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-21T22:43:05","port":8021,"proto":"tcp","app_proto":"http","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:8021\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"1.3","alpn":[],"url_path":"/wp-includes/css/dist/block-library/style.min.css","summary":"","payload_hex":"48454144202f77702d696e636c756465732f6373732f646973742f626c6f636b2d6c6962726172792f7374796c652e6d696e2e63737320485454502f312e310d0a486f73743a203c484f4e4559504f543e3a383032310d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3133312e302e302e30205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"HEAD","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36","ja3":"bd40409ee01650fa08f35cdbf3f5ce58","session":"75d17064-470b-475d-bef1-403988036c65-37","seq":37,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-21T22:43:04","port":8021,"proto":"tcp","app_proto":"http","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:8021\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"1.3","alpn":[],"url_path":"/page.php","summary":"","payload_hex":"474554202f706167652e70687020485454502f312e310d0a486f73743a203c484f4e4559504f543e3a383032310d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3133312e302e302e30205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36","ja3":"bd40409ee01650fa08f35cdbf3f5ce58","session":"75d17064-470b-475d-bef1-403988036c65-35","seq":35,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-21T22:43:04","port":8021,"proto":"tcp","app_proto":"http","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:8021\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"1.3","alpn":[],"url_path":"/wp-content/themes/twentytwentyfour/style.css","summary":"","payload_hex":"474554202f77702d636f6e74656e742f7468656d65732f7477656e74797477656e7479666f75722f7374796c652e63737320485454502f312e310d0a486f73743a203c484f4e4559504f543e3a383032310d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3133312e302e302e30205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36","ja3":"bd40409ee01650fa08f35cdbf3f5ce58","session":"e3406eb8-856f-4d46-ba75-c0afa588bb9c-7","seq":7,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-21T22:43:04","port":8021,"proto":"tcp","app_proto":"http","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:8021\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"1.3","alpn":[],"url_path":"/page.php","summary":"","payload_hex":"48454144202f706167652e70687020485454502f312e310d0a486f73743a203c484f4e4559504f543e3a383032310d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3133312e302e302e30205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"HEAD","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36","ja3":"bd40409ee01650fa08f35cdbf3f5ce58","session":"75d17064-470b-475d-bef1-403988036c65-33","seq":33,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-21T22:43:04","port":8021,"proto":"tcp","app_proto":"http","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:8021\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"1.3","alpn":[],"url_path":"/wp-content/themes/twentytwentyfour/style.css","summary":"","payload_hex":"48454144202f77702d636f6e74656e742f7468656d65732f7477656e74797477656e7479666f75722f7374796c652e63737320485454502f312e310d0a486f73743a203c484f4e4559504f543e3a383032310d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3133312e302e302e30205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"HEAD","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36","ja3":"bd40409ee01650fa08f35cdbf3f5ce58","session":"e3406eb8-856f-4d46-ba75-c0afa588bb9c-5","seq":5,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-21T22:43:01","port":8021,"proto":"tcp","app_proto":"http","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:8021\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"1.3","alpn":[],"url_path":"/xmlrpc.php","summary":"","payload_hex":"474554202f786d6c7270632e70687020485454502f312e310d0a486f73743a203c484f4e4559504f543e3a383032310d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3133312e302e302e30205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36","ja3":"bd40409ee01650fa08f35cdbf3f5ce58","session":"e3406eb8-856f-4d46-ba75-c0afa588bb9c-3","seq":3,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-21T22:43:01","port":8021,"proto":"tcp","app_proto":"http","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:8021\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"1.3","alpn":[],"url_path":"/xmlrpc.php","summary":"","payload_hex":"48454144202f786d6c7270632e70687020485454502f312e310d0a486f73743a203c484f4e4559504f543e3a383032310d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3133312e302e302e30205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"HEAD","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36","ja3":"bd40409ee01650fa08f35cdbf3f5ce58","session":"e3406eb8-856f-4d46-ba75-c0afa588bb9c-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true}],"http_methods":[{"method":"GET","count":506},{"method":"POST","count":252},{"method":"HEAD","count":91}],"distinct_ports_total":5,"top_paths":[{"path":"/","count":103,"ports":5},{"path":"/index.php","count":92,"ports":5},{"path":"/wp-includes/js/dist/hooks.min.js","count":36,"ports":5},{"path":"/wp-json/oembed/1.0/embed","count":25,"ports":5},{"path":"/wp-content/themes/twentytwentyfour/style.css","count":25,"ports":5},{"path":"/wp-includes/css/dist/block-library/style.min.css","count":25,"ports":5},{"path":"/xmlrpc.php","count":25,"ports":5},{"path":"/profile.php","count":19,"ports":5},{"path":"/register.php","count":18,"ports":5},{"path":"/login.php","count":18,"ports":5},{"path":"/include.php","count":16,"ports":4},{"path":"/load.php","count":16,"ports":5},{"path":"/page.php","count":14,"ports":4},{"path":"/download.php","count":12,"ports":3},{"path":"/view.php","count":12,"ports":3}],"distinct_paths_total":58,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","Accept-Encoding","Connection","Host","User-Agent"],"representative":[{"name":"Accept","value":"*/*","notable":false},{"name":"Accept-Encoding","value":"gzip, deflate","notable":false},{"name":"Connection","value":"keep-alive","notable":false},{"name":"Host","value":"<HONEYPOT>:8021","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36","notable":false}],"distinct_sets":1,"events_with_headers":10},"tags":[]}