{"ip":"45.115.26.42","data_as_of":"2026-10-26T06:40:19+00:00","observed":true,"total_events":31,"verdict":{"verdict":"probing","label":"Low-level probing","detail":null,"confidence":"low","network_type":null,"why":["31 event(s), fewer than 10 distinct ports, no exploit payloads.","Not in any known-scanner range."],"engagement":{"level":"request","label":"Request traffic","detail":"1,972 bytes sent","bytes_sent":1972,"session_seconds":0,"persistent":false},"basis":"first_contact"},"first_seen":"2026-10-11T05:26:56","last_seen":"2026-10-22T23:02:29","events_24h":0,"events_7d":21,"interactive_sessions":0,"interactive_sessions_24h":0,"interactive_sessions_7d":0,"interactive_protocols":[],"geo":{"country_code":"HK","country_name":"Hong Kong","region":"","city":"","lat":22.2578,"lon":114.1657,"asn":199457,"org":"SolidCore Hosting LTD"},"source_domain":null,"known_scanners":[],"scanner_tag":null,"cve_matches":[{"cve_id":"CVE-2023-38646","title":"Metabase < 0.46.6.1 - Remote Code Execution","severity":"critical","actively_exploited":false,"match_field":"url_path","matched_pattern":"/api/session/properties","kev_date_added":null},{"cve_id":"CVE-2023-29084","title":"ManageEngine ADManager Plus - Command Injection","severity":"high","actively_exploited":false,"match_field":"url_path","matched_pattern":"/j_security_check","kev_date_added":null}],"malware":[],"udp":null,"interaction":null,"top_ports":[{"port":6379,"proto":"tcp","label":"Redis","count":21},{"port":3000,"proto":"tcp","label":"Web-alt","count":3},{"port":80,"proto":"tcp","label":"HTTP","count":2},{"port":4747,"proto":"tcp","label":"","count":2},{"port":5678,"proto":"tcp","label":"","count":1},{"port":4440,"proto":"tcp","label":"","count":1},{"port":8080,"proto":"tcp","label":"HTTP-alt","count":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":["b10cun020_00040010_724c10fb"],"interactive":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[]}},"fingerprint_peers":{"b10cun020_00040010_724c10fb":41},"akin_families":{},"user_agents":["Mozilla/5.0"],"timeline":[{"date":"2026-10-11","count":1},{"date":"2026-10-12","count":7},{"date":"2026-10-13","count":2},{"date":"2026-10-22","count":21}],"recent_events":[{"timestamp":"2026-10-22T23:02:29","port":6379,"proto":"tcp","app_proto":"","app_protocol":"redis","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"*5\r\n$5\r\nhello\r\n$1\r\n3\r\n$4\r\nauth\r\n$5\r\nredis\r\n$9\r\nlcl842077\r\n","payload_hex":"2a350d0a24350d0a68656c6c6f0d0a24310d0a330d0a24340d0a617574680d0a24350d0a72656469730d0a24390d0a6c636c3834323037370d0a","method":"","user_agent":"","ja3":"","session":"4de2a554-9911-4c84-9ca7-b71a1a2a611b","seq":1,"duration_ms":100,"bytes_in":58,"bytes_out":5,"enriched":{"digest":"053a304ec1b8797d","label":"Redis (RESP)","strings":["hello","auth","redis","lcl842077"]}},{"timestamp":"2026-10-22T23:02:29","port":6379,"proto":"tcp","app_proto":"","app_protocol":"redis","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"*5\r\n$5\r\nhello\r\n$1\r\n3\r\n$4\r\nauth\r\n$5\r\nredis\r\n$8\r\nHu8918pi\r\n","payload_hex":"2a350d0a24350d0a68656c6c6f0d0a24310d0a330d0a24340d0a617574680d0a24350d0a72656469730d0a24380d0a48753839313870690d0a","method":"","user_agent":"","ja3":"","session":"e192808e-89be-4a0a-b8c3-0afee76fa05e","seq":1,"duration_ms":101,"bytes_in":57,"bytes_out":5,"enriched":{"digest":"3f41bf5bc4b1c37e","label":"Redis (RESP)","strings":["hello","auth","redis","Hu8918pi"]}},{"timestamp":"2026-10-22T23:02:29","port":6379,"proto":"tcp","app_proto":"","app_protocol":"redis","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"*5\r\n$5\r\nhello\r\n$1\r\n3\r\n$4\r\nauth\r\n$5\r\nredis\r\n$10\r\nA224522342\r\n","payload_hex":"2a350d0a24350d0a68656c6c6f0d0a24310d0a330d0a24340d0a617574680d0a24350d0a72656469730d0a2431300d0a413232343532323334320d0a","method":"","user_agent":"","ja3":"","session":"0eee00d2-86bb-4723-b623-45b7e51e29df","seq":1,"duration_ms":100,"bytes_in":60,"bytes_out":5,"enriched":{"digest":"8790ce5b225bc6c6","label":"Redis (RESP)","strings":["hello","auth","redis","A224522342"]}},{"timestamp":"2026-10-22T23:02:28","port":6379,"proto":"tcp","app_proto":"","app_protocol":"redis","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"*5\r\n$5\r\nhello\r\n$1\r\n3\r\n$4\r\nauth\r\n$5\r\nredis\r\n$8\r\nvoiohwti\r\n","payload_hex":"2a350d0a24350d0a68656c6c6f0d0a24310d0a330d0a24340d0a617574680d0a24350d0a72656469730d0a24380d0a766f696f687774690d0a","method":"","user_agent":"","ja3":"","session":"00cfc380-79d0-4b3d-b639-1c4fa3fe6796","seq":1,"duration_ms":100,"bytes_in":57,"bytes_out":5,"enriched":{"digest":"67eb54b5635de453","label":"Redis (RESP)","strings":["hello","auth","redis","voiohwti"]}},{"timestamp":"2026-10-22T23:02:28","port":6379,"proto":"tcp","app_proto":"","app_protocol":"redis","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"*5\r\n$5\r\nhello\r\n$1\r\n3\r\n$4\r\nauth\r\n$5\r\nredis\r\n$8\r\n88888089\r\n","payload_hex":"2a350d0a24350d0a68656c6c6f0d0a24310d0a330d0a24340d0a617574680d0a24350d0a72656469730d0a24380d0a38383838383038390d0a","method":"","user_agent":"","ja3":"","session":"53097f79-2f26-415e-be1d-30dc4e4cab21","seq":1,"duration_ms":100,"bytes_in":57,"bytes_out":5,"enriched":{"digest":"08adbaa73ba1cfac","label":"Redis (RESP)","strings":["hello","auth","redis","88888089"]}},{"timestamp":"2026-10-22T23:02:28","port":6379,"proto":"tcp","app_proto":"","app_protocol":"redis","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"*5\r\n$5\r\nhello\r\n$1\r\n3\r\n$4\r\nauth\r\n$5\r\nredis\r\n$6\r\nge3nw3\r\n","payload_hex":"2a350d0a24350d0a68656c6c6f0d0a24310d0a330d0a24340d0a617574680d0a24350d0a72656469730d0a24360d0a6765336e77330d0a","method":"","user_agent":"","ja3":"","session":"4c453620-baa9-4ba9-b7c2-06316e384ced","seq":1,"duration_ms":100,"bytes_in":55,"bytes_out":5,"enriched":{"digest":"273a97fdd027d717","label":"Redis (RESP)","strings":["hello","auth","redis","ge3nw3"]}},{"timestamp":"2026-10-22T23:02:28","port":6379,"proto":"tcp","app_proto":"","app_protocol":"redis","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"*5\r\n$5\r\nhello\r\n$1\r\n3\r\n$4\r\nauth\r\n$5\r\nredis\r\n$8\r\ncpsvzphx\r\n","payload_hex":"2a350d0a24350d0a68656c6c6f0d0a24310d0a330d0a24340d0a617574680d0a24350d0a72656469730d0a24380d0a637073767a7068780d0a","method":"","user_agent":"","ja3":"","session":"33b9e2ad-b6a6-4d3d-b227-c48654c2fec4","seq":1,"duration_ms":100,"bytes_in":57,"bytes_out":5,"enriched":{"digest":"4ec515fcacfd8f59","label":"Redis (RESP)","strings":["hello","auth","redis","cpsvzphx"]}},{"timestamp":"2026-10-22T23:02:27","port":6379,"proto":"tcp","app_proto":"","app_protocol":"redis","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"*5\r\n$5\r\nhello\r\n$1\r\n3\r\n$4\r\nauth\r\n$5\r\nredis\r\n$6\r\n1fp3hb\r\n","payload_hex":"2a350d0a24350d0a68656c6c6f0d0a24310d0a330d0a24340d0a617574680d0a24350d0a72656469730d0a24360d0a3166703368620d0a","method":"","user_agent":"","ja3":"","session":"6d49ca5d-5c9f-42fe-a9c1-8f030b35192c","seq":1,"duration_ms":101,"bytes_in":55,"bytes_out":5,"enriched":{"digest":"5677d5388bb30e57","label":"Redis (RESP)","strings":["hello","auth","redis","1fp3hb"]}},{"timestamp":"2026-10-22T23:02:27","port":6379,"proto":"tcp","app_proto":"","app_protocol":"redis","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"*5\r\n$5\r\nhello\r\n$1\r\n3\r\n$4\r\nauth\r\n$5\r\nredis\r\n$4\r\n0203\r\n","payload_hex":"2a350d0a24350d0a68656c6c6f0d0a24310d0a330d0a24340d0a617574680d0a24350d0a72656469730d0a24340d0a303230330d0a","method":"","user_agent":"","ja3":"","session":"26520d15-6053-4309-80d4-2da194ad78ef","seq":1,"duration_ms":100,"bytes_in":53,"bytes_out":5,"enriched":{"digest":"2c417ef3c9bd6cf6","label":"Redis (RESP)","strings":["hello","auth","redis","0203"]}},{"timestamp":"2026-10-22T23:02:27","port":6379,"proto":"tcp","app_proto":"","app_protocol":"redis","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"*5\r\n$5\r\nhello\r\n$1\r\n3\r\n$4\r\nauth\r\n$5\r\nredis\r\n$40\r\n9cea98fdf57c8e91d9d45b04be5a7a991cf6495b\r\n","payload_hex":"2a350d0a24350d0a68656c6c6f0d0a24310d0a330d0a24340d0a617574680d0a24350d0a72656469730d0a2434300d0a396365613938666466353763386539316439643435623034626535613761393931636636343935620d0a","method":"","user_agent":"","ja3":"","session":"feced9a1-d038-46b7-b3e6-e460d82d7132","seq":1,"duration_ms":100,"bytes_in":90,"bytes_out":5,"enriched":{"digest":"b2e801cdec3f85f1","label":"Redis (RESP)","strings":["hello","auth","redis","9cea98fdf57c8e91d9d45b04be5a7a991cf6495b"]}}],"http_methods":[{"method":"GET","count":10}],"distinct_ports_total":7,"top_paths":[{"path":"/api/health","count":2,"ports":1},{"path":"/","count":1,"ports":1},{"path":"/healthz","count":1,"ports":1},{"path":"/v1/user/login","count":1,"ports":1},{"path":"/api/v1/ping","count":1,"ports":1},{"path":"/api/v1/auths/signin","count":1,"ports":1},{"path":"/api/session/properties","count":1,"ports":1},{"path":"/j_security_check","count":1,"ports":1},{"path":"/internal_forms_authentication/","count":1,"ports":1}],"distinct_paths_total":9,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[{"tag_id":"CVE-2023-38646","tag_type":"cve","title":"Metabase < 0.46.6.1 - Remote Code Execution","severity":"critical","actively_exploited":false,"match_field":"url_path","matched_pattern":"/api/session/properties","reference_urls":["https://www.metabase.com/blog/security-advisory","https://github.com/metabase/metabase/releases/tag/v0.46.6.1","https://mp.weixin.qq.com/s/ATFwFl-D8k9QfQfzKjZFDg","https://news.ycombinator.com/item?id=36812256","https://blog.assetnote.io/2023/07/22/pre-auth-rce-metabase/"],"kev_date_added":null},{"tag_id":"CVE-2023-29084","tag_type":"cve","title":"ManageEngine ADManager Plus - Command Injection","severity":"high","actively_exploited":false,"match_field":"url_path","matched_pattern":"/j_security_check","reference_urls":["https://hnd3884.github.io/posts/CVE-2023-29084-Command-injection-in-ManageEngine-ADManager-plus/","https://community.grafana.com/t/release-notes-v6-3-x/19202","http://packetstormsecurity.com/files/172755/ManageEngine-ADManager-Plus-Command-Injection.html","https://manageengine.com","https://www.manageengine.com/products/ad-manager/admanager-kb/cve-2023-29084.html"],"kev_date_added":null}]}