{"ip":"35.238.120.46","total_events":20,"verdict":{"verdict":"probing","label":"Low-level probing","detail":null,"confidence":"low","network_type":null,"why":["20 event(s), fewer than 10 distinct ports, no exploit payloads.","Not in any known-scanner range.","Sent 19,959 bytes despite few ports and no known exploit path: focused interaction with one service, worth a look."],"engagement":{"level":"payload","label":"Sustained payload","detail":"19,959 bytes sent","bytes_sent":19959,"session_seconds":2,"persistent":false}},"first_seen":"2026-09-12T10:51:10","last_seen":"2026-09-12T10:53:05","events_24h":0,"events_7d":0,"geo":{"country_code":"US","country_name":"United States","region":"Iowa","city":"Council Bluffs","lat":41.2591,"lon":-95.8517,"asn":396982,"org":"Google LLC"},"source_domain":"46.120.238.35.bc.googleusercontent.com","known_scanners":[],"scanner_tag":{"key":"gcp","label":"Google Cloud","category":"hosting_provider","url":"https://cloud.google.com/"},"cve_matches":[{"cve_id":"CVE-2025-27134","title":"Joplin 3.3.3 Server - Privilege Escalation","severity":"high","actively_exploited":false,"match_field":"url_path","matched_pattern":"/api/sessions"}],"malware":[],"top_ports":[{"port":9119,"proto":"tcp","label":"","count":20}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":[]},"fingerprint_peers":{},"akin_families":{},"user_agents":["Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 Chrome/125.0 Safari/537.36"],"timeline":[{"date":"2026-09-12","count":20}],"recent_events":[{"timestamp":"2026-09-12T10:53:05","port":9119,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"identity\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:9119\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 Chrome/125.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/api/terminals","summary":"","payload_hex":"474554202f6170692f7465726d696e616c7320485454502f312e310d0a486f73743a20<HONEYPOT>3a393131390d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f363429204170706c655765624b69742f3533372e3336204368726f6d652f3132352e30205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a206964656e746974790d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 Chrome/125.0 Safari/537.36","ja3":"","session":"254194b5-91a5-4b3d-b9b1-e2c7f1155a94","seq":10,"duration_ms":2064,"bytes_in":2140,"bytes_out":780},{"timestamp":"2026-09-12T10:53:04","port":9119,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"identity\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:9119\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 Chrome/125.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/api/logs?file=agent","summary":"","payload_hex":"474554202f6170692f6c6f67733f66696c653d6167656e7420485454502f312e310d0a486f73743a20<HONEYPOT>3a393131390d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f363429204170706c655765624b69742f3533372e3336204368726f6d652f3132352e30205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a206964656e746974790d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 Chrome/125.0 Safari/537.36","ja3":"","session":"254194b5-91a5-4b3d-b9b1-e2c7f1155a94","seq":9,"duration_ms":1867,"bytes_in":1929,"bytes_out":702},{"timestamp":"2026-09-12T10:53:04","port":9119,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"identity\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:9119\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 Chrome/125.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/api/messaging/platforms","summary":"","payload_hex":"474554202f6170692f6d6573736167696e672f706c6174666f726d7320485454502f312e310d0a486f73743a20<HONEYPOT>3a393131390d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f363429204170706c655765624b69742f3533372e3336204368726f6d652f3132352e30205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a206964656e746974790d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 Chrome/125.0 Safari/537.36","ja3":"","session":"254194b5-91a5-4b3d-b9b1-e2c7f1155a94","seq":8,"duration_ms":1630,"bytes_in":1712,"bytes_out":624},{"timestamp":"2026-09-12T10:53:04","port":9119,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"identity\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:9119\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 Chrome/125.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/api/credentials/pool","summary":"","payload_hex":"474554202f6170692f63726564656e7469616c732f706f6f6c20485454502f312e310d0a486f73743a20<HONEYPOT>3a393131390d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f363429204170706c655765624b69742f3533372e3336204368726f6d652f3132352e30205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a206964656e746974790d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 Chrome/125.0 Safari/537.36","ja3":"","session":"254194b5-91a5-4b3d-b9b1-e2c7f1155a94","seq":7,"duration_ms":1252,"bytes_in":1491,"bytes_out":546},{"timestamp":"2026-09-12T10:53:04","port":9119,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"identity\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:9119\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 Chrome/125.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/api/sessions?limit=1","summary":"","payload_hex":"474554202f6170692f73657373696f6e733f6c696d69743d3120485454502f312e310d0a486f73743a20<HONEYPOT>3a393131390d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f363429204170706c655765624b69742f3533372e3336204368726f6d652f3132352e30205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a206964656e746974790d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 Chrome/125.0 Safari/537.36","ja3":"","session":"254194b5-91a5-4b3d-b9b1-e2c7f1155a94","seq":6,"duration_ms":1022,"bytes_in":1273,"bytes_out":468},{"timestamp":"2026-09-12T10:53:03","port":9119,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"identity\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:9119\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 Chrome/125.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a393131390d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f363429204170706c655765624b69742f3533372e3336204368726f6d652f3132352e30205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a206964656e746974790d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 Chrome/125.0 Safari/537.36","ja3":"","session":"254194b5-91a5-4b3d-b9b1-e2c7f1155a94","seq":2,"duration_ms":385,"bytes_in":406,"bytes_out":156},{"timestamp":"2026-09-12T10:53:03","port":9119,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"identity\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:9119\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 Chrome/125.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/api/env","summary":"","payload_hex":"474554202f6170692f656e7620485454502f312e310d0a486f73743a20<HONEYPOT>3a393131390d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f363429204170706c655765624b69742f3533372e3336204368726f6d652f3132352e30205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a206964656e746974790d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 Chrome/125.0 Safari/537.36","ja3":"","session":"254194b5-91a5-4b3d-b9b1-e2c7f1155a94","seq":3,"duration_ms":525,"bytes_in":611,"bytes_out":234},{"timestamp":"2026-09-12T10:53:03","port":9119,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"identity\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:9119\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 Chrome/125.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/api/status","summary":"","payload_hex":"474554202f6170692f73746174757320485454502f312e310d0a486f73743a20<HONEYPOT>3a393131390d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f363429204170706c655765624b69742f3533372e3336204368726f6d652f3132352e30205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a206964656e746974790d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 Chrome/125.0 Safari/537.36","ja3":"","session":"254194b5-91a5-4b3d-b9b1-e2c7f1155a94","seq":1,"duration_ms":100,"bytes_in":208,"bytes_out":78},{"timestamp":"2026-09-12T10:53:03","port":9119,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"identity\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:9119\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 Chrome/125.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/api/config","summary":"","payload_hex":"474554202f6170692f636f6e66696720485454502f312e310d0a486f73743a20<HONEYPOT>3a393131390d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f363429204170706c655765624b69742f3533372e3336204368726f6d652f3132352e30205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a206964656e746974790d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 Chrome/125.0 Safari/537.36","ja3":"","session":"254194b5-91a5-4b3d-b9b1-e2c7f1155a94","seq":5,"duration_ms":829,"bytes_in":1055,"bytes_out":390},{"timestamp":"2026-09-12T10:53:03","port":9119,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"identity\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:9119\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 Chrome/125.0 Safari/537.36\",\"x-forwarded-for\":\"127.0.0.1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/api/config","summary":"","payload_hex":"474554202f6170692f636f6e66696720485454502f312e310d0a486f73743a20<HONEYPOT>3a393131390d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f363429204170706c655765624b69742f3533372e3336204368726f6d652f3132352e30205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a206964656e746974790d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a582d466f727761726465642d466f723a203132372e302e302e310d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 Chrome/125.0 Safari/537.36","ja3":"","session":"254194b5-91a5-4b3d-b9b1-e2c7f1155a94","seq":4,"duration_ms":678,"bytes_in":847,"bytes_out":312}],"http_methods":[{"method":"GET","count":20}],"distinct_ports_total":1,"top_paths":[{"path":"/api/config","count":4,"ports":1},{"path":"/","count":2,"ports":1},{"path":"/api/env","count":2,"ports":1},{"path":"/api/status","count":2,"ports":1},{"path":"/api/terminals","count":2,"ports":1},{"path":"/api/credentials/pool","count":2,"ports":1},{"path":"/api/logs?file=agent","count":2,"ports":1},{"path":"/api/sessions?limit=1","count":2,"ports":1},{"path":"/api/messaging/platforms","count":2,"ports":1}],"distinct_paths_total":9,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","Accept-Encoding","Connection","Host","User-Agent","X-Forwarded-For"],"representative":[{"name":"Accept","value":"*/*","notable":false},{"name":"Accept-Encoding","value":"identity","notable":false},{"name":"Connection","value":"keep-alive","notable":false},{"name":"Host","value":"<HONEYPOT>:9119","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 Chrome/125.0 Safari/537.36","notable":false},{"name":"X-Forwarded-For","value":"127.0.0.1","notable":true}],"distinct_sets":2,"events_with_headers":10},"tags":[{"tag_id":"CVE-2025-27134","tag_type":"cve","title":"Joplin 3.3.3 Server - Privilege Escalation","severity":"high","actively_exploited":false,"match_field":"url_path","matched_pattern":"/api/sessions","reference_urls":["https://github.com/laurent22/joplin/security/advisories/GHSA-xj67-649m-3p8x","https://nvd.nist.gov/vuln/detail/CVE-2025-27134"]}],"data_as_of":"2026-09-23T09:26:37.026011+00:00"}