{"ip":"34.170.15.1","total_events":10,"verdict":{"verdict":"probing","label":"Low-level probing","detail":null,"confidence":"low","network_type":null,"why":["10 event(s), fewer than 10 distinct ports, no exploit payloads.","Not in any known-scanner range.","Sent 11,672 bytes despite few ports and no known exploit path: focused interaction with one service, worth a look."],"engagement":{"level":"payload","label":"Sustained payload","detail":"11,672 bytes sent","bytes_sent":11672,"session_seconds":1,"persistent":false}},"first_seen":"2026-09-12T11:05:06","last_seen":"2026-09-12T11:05:07","events_24h":0,"events_7d":0,"geo":{"country_code":"US","country_name":"United States","region":"Iowa","city":"Council Bluffs","lat":41.2591,"lon":-95.8517,"asn":396982,"org":"Google LLC"},"source_domain":"1.15.170.34.bc.googleusercontent.com","known_scanners":[],"scanner_tag":{"key":"gcp","label":"Google Cloud","category":"hosting_provider","url":"https://cloud.google.com/"},"cve_matches":[{"cve_id":"CVE-2025-27134","title":"Joplin 3.3.3 Server - Privilege Escalation","severity":"high","actively_exploited":false,"match_field":"url_path","matched_pattern":"/api/sessions"}],"malware":[],"top_ports":[{"port":9119,"proto":"tcp","label":"","count":10}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":[]},"fingerprint_peers":{},"akin_families":{},"user_agents":["Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 Chrome/125.0 Safari/537.36"],"timeline":[{"date":"2026-09-12","count":10}],"recent_events":[{"timestamp":"2026-09-12T11:05:07","port":9119,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"identity\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:9119\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 Chrome/125.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/api/messaging/platforms","summary":"","payload_hex":"474554202f6170692f6d6573736167696e672f706c6174666f726d7320485454502f312e310d0a486f73743a20<HONEYPOT>3a393131390d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f363429204170706c655765624b69742f3533372e3336204368726f6d652f3132352e30205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a206964656e746974790d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 Chrome/125.0 Safari/537.36","ja3":"","session":"834081dc-9682-4a09-8554-0d4ff4b09aae","seq":8,"duration_ms":979,"bytes_in":1712,"bytes_out":608},{"timestamp":"2026-09-12T11:05:07","port":9119,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"identity\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:9119\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 Chrome/125.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/api/logs?file=agent","summary":"","payload_hex":"474554202f6170692f6c6f67733f66696c653d6167656e7420485454502f312e310d0a486f73743a20<HONEYPOT>3a393131390d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f363429204170706c655765624b69742f3533372e3336204368726f6d652f3132352e30205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a206964656e746974790d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 Chrome/125.0 Safari/537.36","ja3":"","session":"834081dc-9682-4a09-8554-0d4ff4b09aae","seq":9,"duration_ms":1096,"bytes_in":1929,"bytes_out":684},{"timestamp":"2026-09-12T11:05:07","port":9119,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"identity\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:9119\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 Chrome/125.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/api/terminals","summary":"","payload_hex":"474554202f6170692f7465726d696e616c7320485454502f312e310d0a486f73743a20<HONEYPOT>3a393131390d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f363429204170706c655765624b69742f3533372e3336204368726f6d652f3132352e30205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a206964656e746974790d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 Chrome/125.0 Safari/537.36","ja3":"","session":"834081dc-9682-4a09-8554-0d4ff4b09aae","seq":10,"duration_ms":1230,"bytes_in":2140,"bytes_out":760},{"timestamp":"2026-09-12T11:05:06","port":9119,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"identity\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:9119\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 Chrome/125.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/api/status","summary":"","payload_hex":"474554202f6170692f73746174757320485454502f312e310d0a486f73743a20<HONEYPOT>3a393131390d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f363429204170706c655765624b69742f3533372e3336204368726f6d652f3132352e30205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a206964656e746974790d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 Chrome/125.0 Safari/537.36","ja3":"","session":"834081dc-9682-4a09-8554-0d4ff4b09aae","seq":1,"duration_ms":100,"bytes_in":208,"bytes_out":76},{"timestamp":"2026-09-12T11:05:06","port":9119,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"identity\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:9119\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 Chrome/125.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a393131390d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f363429204170706c655765624b69742f3533372e3336204368726f6d652f3132352e30205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a206964656e746974790d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 Chrome/125.0 Safari/537.36","ja3":"","session":"834081dc-9682-4a09-8554-0d4ff4b09aae","seq":2,"duration_ms":216,"bytes_in":406,"bytes_out":152},{"timestamp":"2026-09-12T11:05:06","port":9119,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"identity\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:9119\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 Chrome/125.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/api/env","summary":"","payload_hex":"474554202f6170692f656e7620485454502f312e310d0a486f73743a20<HONEYPOT>3a393131390d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f363429204170706c655765624b69742f3533372e3336204368726f6d652f3132352e30205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a206964656e746974790d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 Chrome/125.0 Safari/537.36","ja3":"","session":"834081dc-9682-4a09-8554-0d4ff4b09aae","seq":3,"duration_ms":347,"bytes_in":611,"bytes_out":228},{"timestamp":"2026-09-12T11:05:06","port":9119,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"identity\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:9119\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 Chrome/125.0 Safari/537.36\",\"x-forwarded-for\":\"127.0.0.1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/api/config","summary":"","payload_hex":"474554202f6170692f636f6e66696720485454502f312e310d0a486f73743a20<HONEYPOT>3a393131390d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f363429204170706c655765624b69742f3533372e3336204368726f6d652f3132352e30205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a206964656e746974790d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a582d466f727761726465642d466f723a203132372e302e302e310d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 Chrome/125.0 Safari/537.36","ja3":"","session":"834081dc-9682-4a09-8554-0d4ff4b09aae","seq":4,"duration_ms":480,"bytes_in":847,"bytes_out":304},{"timestamp":"2026-09-12T11:05:06","port":9119,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"identity\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:9119\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 Chrome/125.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/api/config","summary":"","payload_hex":"474554202f6170692f636f6e66696720485454502f312e310d0a486f73743a20<HONEYPOT>3a393131390d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f363429204170706c655765624b69742f3533372e3336204368726f6d652f3132352e30205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a206964656e746974790d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 Chrome/125.0 Safari/537.36","ja3":"","session":"834081dc-9682-4a09-8554-0d4ff4b09aae","seq":5,"duration_ms":595,"bytes_in":1055,"bytes_out":380},{"timestamp":"2026-09-12T11:05:06","port":9119,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"identity\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:9119\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 Chrome/125.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/api/sessions?limit=1","summary":"","payload_hex":"474554202f6170692f73657373696f6e733f6c696d69743d3120485454502f312e310d0a486f73743a20<HONEYPOT>3a393131390d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f363429204170706c655765624b69742f3533372e3336204368726f6d652f3132352e30205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a206964656e746974790d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 Chrome/125.0 Safari/537.36","ja3":"","session":"834081dc-9682-4a09-8554-0d4ff4b09aae","seq":6,"duration_ms":712,"bytes_in":1273,"bytes_out":456},{"timestamp":"2026-09-12T11:05:06","port":9119,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"identity\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:9119\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 Chrome/125.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/api/credentials/pool","summary":"","payload_hex":"474554202f6170692f63726564656e7469616c732f706f6f6c20485454502f312e310d0a486f73743a20<HONEYPOT>3a393131390d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f363429204170706c655765624b69742f3533372e3336204368726f6d652f3132352e30205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a206964656e746974790d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 Chrome/125.0 Safari/537.36","ja3":"","session":"834081dc-9682-4a09-8554-0d4ff4b09aae","seq":7,"duration_ms":854,"bytes_in":1491,"bytes_out":532}],"http_methods":[{"method":"GET","count":10}],"distinct_ports_total":1,"top_paths":[{"path":"/api/config","count":2,"ports":1},{"path":"/","count":1,"ports":1},{"path":"/api/env","count":1,"ports":1},{"path":"/api/status","count":1,"ports":1},{"path":"/api/terminals","count":1,"ports":1},{"path":"/api/credentials/pool","count":1,"ports":1},{"path":"/api/logs?file=agent","count":1,"ports":1},{"path":"/api/sessions?limit=1","count":1,"ports":1},{"path":"/api/messaging/platforms","count":1,"ports":1}],"distinct_paths_total":9,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","Accept-Encoding","Connection","Host","User-Agent","X-Forwarded-For"],"representative":[{"name":"Accept","value":"*/*","notable":false},{"name":"Accept-Encoding","value":"identity","notable":false},{"name":"Connection","value":"keep-alive","notable":false},{"name":"Host","value":"<HONEYPOT>:9119","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 Chrome/125.0 Safari/537.36","notable":false},{"name":"X-Forwarded-For","value":"127.0.0.1","notable":true}],"distinct_sets":2,"events_with_headers":10},"tags":[{"tag_id":"CVE-2025-27134","tag_type":"cve","title":"Joplin 3.3.3 Server - Privilege Escalation","severity":"high","actively_exploited":false,"match_field":"url_path","matched_pattern":"/api/sessions","reference_urls":["https://github.com/laurent22/joplin/security/advisories/GHSA-xj67-649m-3p8x","https://nvd.nist.gov/vuln/detail/CVE-2025-27134"]}],"data_as_of":"2026-09-23T09:25:48.675744+00:00"}