{"ip":"41.234.97.25","total_events":718,"verdict":{"verdict":"scanning","label":"Scanning for known vulnerabilities","detail":"87 exploit-path probe(s)","confidence":"medium","network_type":"nsp","why":["87 request(s) matched a known exploit path.","Only GET/HEAD seen, no request body: scanning for the vulnerability, not delivering a payload.","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"9,195,248 bytes sent","bytes_sent":9195248,"session_seconds":21,"persistent":false}},"first_seen":"2026-09-30T04:02:13","last_seen":"2026-09-30T04:05:19","events_24h":718,"events_7d":718,"geo":{"country_code":"EG","country_name":"Egypt","region":"Cairo Governorate","city":"Cairo","lat":30.0507,"lon":31.2489,"asn":8452,"org":"IDDQD-AS"},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as8452","label":"Telecom Egypt","category":"isp","url":"https://www.peeringdb.com/asn/8452"},"cve_matches":[],"malware":[],"top_ports":[{"port":8080,"proto":"tcp","label":"HTTP-alt","count":92},{"port":8081,"proto":"tcp","label":"","count":87},{"port":8000,"proto":"tcp","label":"HTTP-alt","count":87},{"port":443,"proto":"tcp","label":"HTTPS","count":82},{"port":80,"proto":"tcp","label":"HTTP","count":77},{"port":8180,"proto":"tcp","label":"","count":77},{"port":8001,"proto":"tcp","label":"","count":77},{"port":9090,"proto":"tcp","label":"Prometheus","count":77},{"port":8082,"proto":"tcp","label":"","count":62}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":["b11cun040_08040012_cfad16f7","b11cun030_00040012_13ee3d34"]},"fingerprint_peers":{"b11cun030_00040012_13ee3d34":5089,"b11cun040_08040012_cfad16f7":1},"akin_families":{},"user_agents":["Mozilla/5.0 (QtEmbedded; U; Linux; C) AppleWebKit/533.3 (KHTML, like Gecko) MAG200 stbapp ver: 4 rev: 2116 Mobile Safari/533.3"],"timeline":[{"date":"2026-09-30","count":718}],"recent_events":[{"timestamp":"2026-09-30T04:05:19","port":8180,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"cookie\":\"mac=00:1A:79:9C:00:00\",\"host\":\"<HONEYPOT>:8180\",\"user-agent\":\"Mozilla/5.0 (QtEmbedded; U; Linux; C) AppleWebKit/533.3 (KHTML, like Gecko) MAG200 stbapp ver: 4 rev: 2116 Mobile Safari/533.3\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/tv/mini/portal.php?action=handshake&type=stb&token=&JsHttpRequest=1-xml","summary":"","payload_hex":"474554202f74762f6d696e692f706f7274616c2e7068703f616374696f6e3d68616e647368616b6526747970653d73746226746f6b656e3d264a7348747470526571756573743d312d786d6c20485454502f312e310d0a486f73743a20<HONEYPOT>3a383138300d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285174456d6265646465643b20553b204c696e75783b204329204170706c655765624b69742f3533332e3320284b48544d4c2c206c696b65204765636b6f29204d414732303020737462617070207665723a2034207265763a2032313136204d6f62696c65205361666172692f3533332e330d0a436f6f6b69653a206d61633d30303a31413a37393a39433a30303a30300d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (QtEmbedded; U; Linux; C) AppleWebKit/533.3 (KHTML, like Gecko) MAG200 stbapp ver: 4 rev: 2116 Mobile Safari/533.3","ja3":"","session":"ebe9a277-020e-4139-ad1e-7daf78eb315c","seq":77,"duration_ms":20417,"bytes_in":23664,"bytes_out":5929},{"timestamp":"2026-09-30T04:05:19","port":8180,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:8180\",\"user-agent\":\"Mozilla/5.0 (QtEmbedded; U; Linux; C) AppleWebKit/533.3 (KHTML, like Gecko) MAG200 stbapp ver: 4 rev: 2116 Mobile Safari/533.3\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/tv/load.php?type=stb&action=handshake&prehash=0&token=&JsHttpRequest=1-xml","summary":"","payload_hex":"474554202f74762f6c6f61642e7068703f747970653d73746226616374696f6e3d68616e647368616b6526707265686173683d3026746f6b656e3d264a7348747470526571756573743d312d786d6c20485454502f312e310d0a486f73743a20<HONEYPOT>3a383138300d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285174456d6265646465643b20553b204c696e75783b204329204170706c655765624b69742f3533332e3320284b48544d4c2c206c696b65204765636b6f29204d414732303020737462617070207665723a2034207265763a2032313136204d6f62696c65205361666172692f3533332e330d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (QtEmbedded; U; Linux; C) AppleWebKit/533.3 (KHTML, like Gecko) MAG200 stbapp ver: 4 rev: 2116 Mobile Safari/533.3","ja3":"","session":"ebe9a277-020e-4139-ad1e-7daf78eb315c","seq":76,"duration_ms":20137,"bytes_in":23355,"bytes_out":5852},{"timestamp":"2026-09-30T04:05:19","port":8180,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:8180\",\"user-agent\":\"Mozilla/5.0 (QtEmbedded; U; Linux; C) AppleWebKit/533.3 (KHTML, like Gecko) MAG200 stbapp ver: 4 rev: 2116 Mobile Safari/533.3\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/tv/stalker_portal/server/load.php?type=stb&action=handshake&prehash=0&token=&JsHttpRequest=1-xml","summary":"","payload_hex":"474554202f74762f7374616c6b65725f706f7274616c2f7365727665722f6c6f61642e7068703f747970653d73746226616374696f6e3d68616e647368616b6526707265686173683d3026746f6b656e3d264a7348747470526571756573743d312d786d6c20485454502f312e310d0a486f73743a20<HONEYPOT>3a383138300d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285174456d6265646465643b20553b204c696e75783b204329204170706c655765624b69742f3533332e3320284b48544d4c2c206c696b65204765636b6f29204d414732303020737462617070207665723a2034207265763a2032313136204d6f62696c65205361666172692f3533332e330d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (QtEmbedded; U; Linux; C) AppleWebKit/533.3 (KHTML, like Gecko) MAG200 stbapp ver: 4 rev: 2116 Mobile Safari/533.3","ja3":"","session":"ebe9a277-020e-4139-ad1e-7daf78eb315c","seq":74,"duration_ms":19604,"bytes_in":22786,"bytes_out":5698},{"timestamp":"2026-09-30T04:05:19","port":8180,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:8180\",\"user-agent\":\"Mozilla/5.0 (QtEmbedded; U; Linux; C) AppleWebKit/533.3 (KHTML, like Gecko) MAG200 stbapp ver: 4 rev: 2116 Mobile Safari/533.3\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/tv/server/load.php?type=stb&action=handshake&prehash=0&token=&JsHttpRequest=1-xml","summary":"","payload_hex":"474554202f74762f7365727665722f6c6f61642e7068703f747970653d73746226616374696f6e3d68616e647368616b6526707265686173683d3026746f6b656e3d264a7348747470526571756573743d312d786d6c20485454502f312e310d0a486f73743a20<HONEYPOT>3a383138300d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285174456d6265646465643b20553b204c696e75783b204329204170706c655765624b69742f3533332e3320284b48544d4c2c206c696b65204765636b6f29204d414732303020737462617070207665723a2034207265763a2032313136204d6f62696c65205361666172692f3533332e330d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (QtEmbedded; U; Linux; C) AppleWebKit/533.3 (KHTML, like Gecko) MAG200 stbapp ver: 4 rev: 2116 Mobile Safari/533.3","ja3":"","session":"ebe9a277-020e-4139-ad1e-7daf78eb315c","seq":75,"duration_ms":19872,"bytes_in":23074,"bytes_out":5775},{"timestamp":"2026-09-30T04:05:18","port":8180,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"cookie\":\"mac=00:1A:79:9C:00:00\",\"host\":\"<HONEYPOT>:8180\",\"user-agent\":\"Mozilla/5.0 (QtEmbedded; U; Linux; C) AppleWebKit/533.3 (KHTML, like Gecko) MAG200 stbapp ver: 4 rev: 2116 Mobile Safari/533.3\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/web/mini/portal.php?action=handshake&type=stb&token=&JsHttpRequest=1-xml","summary":"","payload_hex":"474554202f7765622f6d696e692f706f7274616c2e7068703f616374696f6e3d68616e647368616b6526747970653d73746226746f6b656e3d264a7348747470526571756573743d312d786d6c20485454502f312e310d0a486f73743a20<HONEYPOT>3a383138300d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285174456d6265646465643b20553b204c696e75783b204329204170706c655765624b69742f3533332e3320284b48544d4c2c206c696b65204765636b6f29204d414732303020737462617070207665723a2034207265763a2032313136204d6f62696c65205361666172692f3533332e330d0a436f6f6b69653a206d61633d30303a31413a37393a39433a30303a30300d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (QtEmbedded; U; Linux; C) AppleWebKit/533.3 (KHTML, like Gecko) MAG200 stbapp ver: 4 rev: 2116 Mobile Safari/533.3","ja3":"","session":"ebe9a277-020e-4139-ad1e-7daf78eb315c","seq":72,"duration_ms":19057,"bytes_in":22179,"bytes_out":5544},{"timestamp":"2026-09-30T04:05:18","port":8180,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"cookie\":\"mac=00:1A:79:9C:00:00\",\"host\":\"<HONEYPOT>:8180\",\"user-agent\":\"Mozilla/5.0 (QtEmbedded; U; Linux; C) AppleWebKit/533.3 (KHTML, like Gecko) MAG200 stbapp ver: 4 rev: 2116 Mobile Safari/533.3\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/tv/portal.php?action=handshake&type=stb&token=&JsHttpRequest=1-xml","summary":"","payload_hex":"474554202f74762f706f7274616c2e7068703f616374696f6e3d68616e647368616b6526747970653d73746226746f6b656e3d264a7348747470526571756573743d312d786d6c20485454502f312e310d0a486f73743a20<HONEYPOT>3a383138300d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285174456d6265646465643b20553b204c696e75783b204329204170706c655765624b69742f3533332e3320284b48544d4c2c206c696b65204765636b6f29204d414732303020737462617070207665723a2034207265763a2032313136204d6f62696c65205361666172692f3533332e330d0a436f6f6b69653a206d61633d30303a31413a37393a39433a30303a30300d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (QtEmbedded; U; Linux; C) AppleWebKit/533.3 (KHTML, like Gecko) MAG200 stbapp ver: 4 rev: 2116 Mobile Safari/533.3","ja3":"","session":"ebe9a277-020e-4139-ad1e-7daf78eb315c","seq":73,"duration_ms":19301,"bytes_in":22483,"bytes_out":5621},{"timestamp":"2026-09-30T04:05:18","port":8180,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:8180\",\"user-agent\":\"Mozilla/5.0 (QtEmbedded; U; Linux; C) AppleWebKit/533.3 (KHTML, like Gecko) MAG200 stbapp ver: 4 rev: 2116 Mobile Safari/533.3\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/web/server/load.php?type=stb&action=handshake&prehash=0&token=&JsHttpRequest=1-xml","summary":"","payload_hex":"474554202f7765622f7365727665722f6c6f61642e7068703f747970653d73746226616374696f6e3d68616e647368616b6526707265686173683d3026746f6b656e3d264a7348747470526571756573743d312d786d6c20485454502f312e310d0a486f73743a20<HONEYPOT>3a383138300d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285174456d6265646465643b20553b204c696e75783b204329204170706c655765624b69742f3533332e3320284b48544d4c2c206c696b65204765636b6f29204d414732303020737462617070207665723a2034207265763a2032313136204d6f62696c65205361666172692f3533332e330d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (QtEmbedded; U; Linux; C) AppleWebKit/533.3 (KHTML, like Gecko) MAG200 stbapp ver: 4 rev: 2116 Mobile Safari/533.3","ja3":"","session":"ebe9a277-020e-4139-ad1e-7daf78eb315c","seq":70,"duration_ms":18554,"bytes_in":21587,"bytes_out":5390},{"timestamp":"2026-09-30T04:05:18","port":8180,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:8180\",\"user-agent\":\"Mozilla/5.0 (QtEmbedded; U; Linux; C) AppleWebKit/533.3 (KHTML, like Gecko) MAG200 stbapp ver: 4 rev: 2116 Mobile Safari/533.3\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/web/load.php?type=stb&action=handshake&prehash=0&token=&JsHttpRequest=1-xml","summary":"","payload_hex":"474554202f7765622f6c6f61642e7068703f747970653d73746226616374696f6e3d68616e647368616b6526707265686173683d3026746f6b656e3d264a7348747470526571756573743d312d786d6c20485454502f312e310d0a486f73743a20<HONEYPOT>3a383138300d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285174456d6265646465643b20553b204c696e75783b204329204170706c655765624b69742f3533332e3320284b48544d4c2c206c696b65204765636b6f29204d414732303020737462617070207665723a2034207265763a2032313136204d6f62696c65205361666172692f3533332e330d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (QtEmbedded; U; Linux; C) AppleWebKit/533.3 (KHTML, like Gecko) MAG200 stbapp ver: 4 rev: 2116 Mobile Safari/533.3","ja3":"","session":"ebe9a277-020e-4139-ad1e-7daf78eb315c","seq":71,"duration_ms":18814,"bytes_in":21869,"bytes_out":5467},{"timestamp":"2026-09-30T04:05:17","port":8180,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"cookie\":\"mac=00:1A:79:9C:00:00\",\"host\":\"<HONEYPOT>:8180\",\"user-agent\":\"Mozilla/5.0 (QtEmbedded; U; Linux; C) AppleWebKit/533.3 (KHTML, like Gecko) MAG200 stbapp ver: 4 rev: 2116 Mobile Safari/533.3\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/app/mini/portal.php?action=handshake&type=stb&token=&JsHttpRequest=1-xml","summary":"","payload_hex":"474554202f6170702f6d696e692f706f7274616c2e7068703f616374696f6e3d68616e647368616b6526747970653d73746226746f6b656e3d264a7348747470526571756573743d312d786d6c20485454502f312e310d0a486f73743a20<HONEYPOT>3a383138300d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285174456d6265646465643b20553b204c696e75783b204329204170706c655765624b69742f3533332e3320284b48544d4c2c206c696b65204765636b6f29204d414732303020737462617070207665723a2034207265763a2032313136204d6f62696c65205361666172692f3533332e330d0a436f6f6b69653a206d61633d30303a31413a37393a39433a30303a30300d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (QtEmbedded; U; Linux; C) AppleWebKit/533.3 (KHTML, like Gecko) MAG200 stbapp ver: 4 rev: 2116 Mobile Safari/533.3","ja3":"","session":"ebe9a277-020e-4139-ad1e-7daf78eb315c","seq":67,"duration_ms":17788,"bytes_in":20689,"bytes_out":5159},{"timestamp":"2026-09-30T04:05:17","port":8180,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:8180\",\"user-agent\":\"Mozilla/5.0 (QtEmbedded; U; Linux; C) AppleWebKit/533.3 (KHTML, like Gecko) MAG200 stbapp ver: 4 rev: 2116 Mobile Safari/533.3\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/web/stalker_portal/server/load.php?type=stb&action=handshake&prehash=0&token=&JsHttpRequest=1-xml","summary":"","payload_hex":"474554202f7765622f7374616c6b65725f706f7274616c2f7365727665722f6c6f61642e7068703f747970653d73746226616374696f6e3d68616e647368616b6526707265686173683d3026746f6b656e3d264a7348747470526571756573743d312d786d6c20485454502f312e310d0a486f73743a20<HONEYPOT>3a383138300d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285174456d6265646465643b20553b204c696e75783b204329204170706c655765624b69742f3533332e3320284b48544d4c2c206c696b65204765636b6f29204d414732303020737462617070207665723a2034207265763a2032313136204d6f62696c65205361666172692f3533332e330d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (QtEmbedded; U; Linux; C) AppleWebKit/533.3 (KHTML, like Gecko) MAG200 stbapp ver: 4 rev: 2116 Mobile Safari/533.3","ja3":"","session":"ebe9a277-020e-4139-ad1e-7daf78eb315c","seq":69,"duration_ms":18319,"bytes_in":21298,"bytes_out":5313}],"http_methods":[{"method":"GET","count":718}],"distinct_ports_total":9,"top_paths":[{"path":"/server/load.php?type=stb&action=handshake&prehash=0&token=&JsHttpRequest=1-xml","count":18,"ports":9},{"path":"/stalker_portal/server/load.php?type=stb&action=handshake&prehash=0&token=&JsHttpRequest=1-xml","count":18,"ports":9},{"path":"/mini/portal.php?action=handshake&type=stb&token=&JsHttpRequest=1-xml","count":18,"ports":9},{"path":"/load.php?type=stb&action=handshake&prehash=0&token=&JsHttpRequest=1-xml","count":9,"ports":9},{"path":"/server/server/load.php?type=stb&action=handshake&prehash=0&token=&JsHttpRequest=1-xml","count":9,"ports":9},{"path":"/stalker/c/server/load.php?type=stb&action=handshake&prehash=0&token=&JsHttpRequest=1-xml&mac=00%3A1A%3A79%3A9C%3A00%3A00","count":9,"ports":9},{"path":"/c/portal.php?action=handshake&type=stb&token=&JsHttpRequest=1-xml","count":9,"ports":9},{"path":"/c/stalker_portal/server/load.php?type=stb&action=handshake&prehash=0&token=&JsHttpRequest=1-xml","count":9,"ports":9},{"path":"/stalker_portal/portal.php?action=handshake&type=stb&token=&JsHttpRequest=1-xml","count":9,"ports":9},{"path":"/s/server/load.php?type=stb&action=handshake&prehash=0&token=&JsHttpRequest=1-xml","count":9,"ports":9},{"path":"/server/stalker_portal/server/load.php?type=stb&action=handshake&prehash=0&token=&JsHttpRequest=1-xml","count":9,"ports":9},{"path":"/stalker_portal/load.php?type=stb&action=handshake&prehash=0&token=&JsHttpRequest=1-xml","count":9,"ports":9},{"path":"/c/server/load.php?type=stb&action=handshake&prehash=0&token=&JsHttpRequest=1-xml&mac=00%3A1A%3A79%3A9C%3A00%3A00","count":9,"ports":9},{"path":"/portal/c/server/load.php?type=stb&action=handshake&prehash=0&token=&JsHttpRequest=1-xml&mac=00%3A1A%3A79%3A9C%3A00%3A00","count":9,"ports":9},{"path":"/portal/c/portal.php?type=stb&action=handshake&prehash=0&token=&JsHttpRequest=1-xml&mac=00%3A1A%3A79%3A9C%3A00%3A00","count":9,"ports":9}],"distinct_paths_total":89,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept-Encoding","Cookie","Host","User-Agent"],"representative":[{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Cookie","value":"mac=00:1A:79:9C:00:00","notable":true},{"name":"Host","value":"<HONEYPOT>:8180","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (QtEmbedded; U; Linux; C) AppleWebKit/533.3 (KHTML, like Gecko) MAG200 stbapp ver: 4 rev: 2116 Mobile Safari/533.3","notable":false}],"distinct_sets":2,"events_with_headers":10},"tags":[],"data_as_of":"2026-09-30T09:59:35.459658+00:00"}