{"ip":"45.198.224.26","total_events":1325,"verdict":{"verdict":"malicious","label":"Exploit attempts observed","detail":"70 loader / command-injection payload(s)","confidence":"high","network_type":"CDN","why":["70 request(s) carried a loader or command-injection payload (wget, curl, tftp, busybox, chmod or a known bot name).","This is the same evidence that puts an address in the public exploiter feed, so the feed and this page now agree.","Payload evidence stands on its own: one request that fetches a botnet binary is exploitation, not probing.","Not in any known-scanner range.","Sent 201,129 bytes: sustained payload delivery, not a single opportunistic request."],"engagement":{"level":"payload","label":"Sustained payload","detail":"201,129 bytes sent","bytes_sent":201129,"session_seconds":0,"persistent":false}},"first_seen":"2026-07-28T20:04:25","last_seen":"2026-08-15T07:41:35","events_24h":71,"events_7d":443,"geo":{"country_code":"US","country_name":"United States","region":"","city":"","lat":37.751,"lon":-97.822,"asn":215925,"org":"Vpsvault.host Ltd"},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as215925","label":"VPSVAULTHOST","category":"cdn","url":"https://www.peeringdb.com/asn/215925"},"cve_matches":[{"cve_id":"CVE-2026-41940","title":"cPanel & WHM - Authentication Bypass via Session-File CRLF Injection","severity":"CRITICAL","actively_exploited":true,"match_field":"url_path","matched_pattern":"/login/?login_only=1"}],"malware":[],"top_ports":[{"port":80,"proto":"tcp","label":"HTTP","count":303},{"port":8080,"proto":"tcp","label":"HTTP-alt","count":165},{"port":12375,"proto":"tcp","label":"","count":122},{"port":12376,"proto":"tcp","label":"","count":114},{"port":2087,"proto":"tcp","label":"","count":101},{"port":2375,"proto":"tcp","label":"Docker","count":98},{"port":8090,"proto":"tcp","label":"","count":89},{"port":2376,"proto":"tcp","label":"Docker-TLS","count":85},{"port":8888,"proto":"tcp","label":"HTTP-alt","count":83},{"port":8081,"proto":"tcp","label":"","count":82},{"port":18080,"proto":"tcp","label":"","count":81},{"port":5000,"proto":"tcp","label":"Web-alt","count":2}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i131000_f57a46bbacb6_ab7e3b40a677"],"tls_ja3":["2196848d251b217de8b2c037e356c11d"],"ja4h":["po11cn0400_1be6d51fc57d","po11nn0600_f8bf768a441b","po11nr0600_b2e34cd3a6f1","ge11nr0300_c54a30255bdf","ge11nn0400_ef4d07580f66"]},"fingerprint_peers":{"t13i131000_f57a46bbacb6_ab7e3b40a677":5328,"ge11nn0400_ef4d07580f66":2774,"po11nr0600_b2e34cd3a6f1":3,"po11cn0400_1be6d51fc57d":6,"ge11nr0300_c54a30255bdf":2,"po11nn0600_f8bf768a441b":53},"user_agents":["Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36","Go-http-client/1.1","Mozilla/5.0 (X11; Linux x86_64; rv:128.0) Gecko/20100101 Firefox/128.0"],"timeline":[{"date":"2026-07-28","count":6},{"date":"2026-07-29","count":82},{"date":"2026-07-30","count":96},{"date":"2026-07-31","count":95},{"date":"2026-08-01","count":99},{"date":"2026-08-02","count":77},{"date":"2026-08-03","count":102},{"date":"2026-08-04","count":90},{"date":"2026-08-05","count":80},{"date":"2026-08-06","count":67},{"date":"2026-08-07","count":78},{"date":"2026-08-08","count":53},{"date":"2026-08-09","count":1},{"date":"2026-08-10","count":88},{"date":"2026-08-11","count":64},{"date":"2026-08-12","count":79},{"date":"2026-08-13","count":73},{"date":"2026-08-14","count":68},{"date":"2026-08-15","count":27}],"recent_events":[{"timestamp":"2026-08-15T07:41:35","port":12376,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:12376\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/_ping","summary":"","payload_hex":"474554202f5f70696e6720485454502f312e310d0a486f73743a20<HONEYPOT>3a31323337360d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"","session":"c0acb0f3-e648-4f08-b27f-fdb737e50ee2","seq":1,"duration_ms":100,"bytes_in":124,"bytes_out":78},{"timestamp":"2026-08-15T07:27:51","port":12375,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:12375\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/_ping","summary":"","payload_hex":"474554202f5f70696e6720485454502f312e310d0a486f73743a20<HONEYPOT>3a31323337350d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"","session":"61869262-fe23-4145-96a3-770aff4d2bf1","seq":1,"duration_ms":101,"bytes_in":123,"bytes_out":78},{"timestamp":"2026-08-15T07:14:02","port":12375,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:12375\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/_ping","summary":"","payload_hex":"474554202f5f70696e6720485454502f312e310d0a486f73743a20<HONEYPOT>3a31323337350d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"","session":"b86dc395-0ce9-45bb-a906-3d3bb46af07e","seq":1,"duration_ms":100,"bytes_in":124,"bytes_out":78},{"timestamp":"2026-08-15T07:10:04","port":12375,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:12375\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/_ping","summary":"","payload_hex":"474554202f5f70696e6720485454502f312e310d0a486f73743a20<HONEYPOT>3a31323337350d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"","session":"f6553fcc-a7ef-4c32-a0b6-1474d9d077ec","seq":1,"duration_ms":100,"bytes_in":125,"bytes_out":78},{"timestamp":"2026-08-15T06:21:24","port":2376,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:2376\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/_ping","summary":"","payload_hex":"474554202f5f70696e6720485454502f312e310d0a486f73743a20<HONEYPOT>3a323337360d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"","session":"3761a3d7-192b-4b3f-979c-2c40249ad1d3","seq":1,"duration_ms":100,"bytes_in":122,"bytes_out":78},{"timestamp":"2026-08-15T06:16:23","port":2376,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:2376\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/_ping","summary":"","payload_hex":"474554202f5f70696e6720485454502f312e310d0a486f73743a20<HONEYPOT>3a323337360d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"","session":"4cb1d67f-b126-41bf-becc-8b8308c5034d","seq":1,"duration_ms":100,"bytes_in":123,"bytes_out":78},{"timestamp":"2026-08-15T05:52:08","port":2375,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:2375\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/_ping","summary":"","payload_hex":"474554202f5f70696e6720485454502f312e310d0a486f73743a20<HONEYPOT>3a323337350d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"","session":"9b83a201-6548-4d5a-bdbd-9a839502351b","seq":1,"duration_ms":100,"bytes_in":122,"bytes_out":78},{"timestamp":"2026-08-15T05:37:00","port":2375,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:2375\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/_ping","summary":"","payload_hex":"474554202f5f70696e6720485454502f312e310d0a486f73743a20<HONEYPOT>3a323337350d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"","session":"c072c169-d5e1-40c4-916a-090586a02f90","seq":1,"duration_ms":100,"bytes_in":123,"bytes_out":78},{"timestamp":"2026-08-15T05:24:00","port":2375,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:2375\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/_ping","summary":"","payload_hex":"474554202f5f70696e6720485454502f312e310d0a486f73743a20<HONEYPOT>3a323337350d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"","session":"1ef48cb8-2c5d-4292-974a-e338e29a7a47","seq":1,"duration_ms":100,"bytes_in":122,"bytes_out":78},{"timestamp":"2026-08-15T05:07:15","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"host\":\"<HONEYPOT>:80\",\"referer\":\"http://<HONEYPOT>:80/cgi-bin/index2.asp\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a38300d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132362e302e302e30205361666172692f3533372e33360d0a526566657265723a20687474703a2f2f<HONEYPOT>3a38302f6367692d62696e2f696e646578322e6173700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36","ja3":"","session":"eaa336b0-136a-4909-b7cf-7e83d19422e8","seq":1,"duration_ms":100,"bytes_in":229,"bytes_out":78}],"http_methods":[{"method":"GET","count":1176},{"method":"POST","count":149}],"distinct_ports_total":12,"top_paths":[{"path":"/login","count":556,"ports":6},{"path":"/_ping","count":421,"ports":5},{"path":"/","count":149,"ports":1},{"path":"/goform/set_LimitClient_cfg","count":70,"ports":1},{"path":"/login/?login_only=1","count":51,"ports":1},{"path":"/openid_connect/cpanelid","count":50,"ports":1},{"path":"/goform/formJsonAjaxReq","count":28,"ports":1}],"distinct_paths_total":7,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[{"username":"root","password":"wrong","count":51}],"header_profile":{"signature":["Accept-Encoding","Connection","Host","User-Agent"],"representative":[{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Connection","value":"close","notable":false},{"name":"Host","value":"<HONEYPOT>:12376","notable":false},{"name":"User-Agent","value":"Go-http-client/1.1","notable":false}],"distinct_sets":2,"events_with_headers":10},"tags":[{"tag_id":"CVE-2026-41940","tag_type":"cve","title":"cPanel & WHM - Authentication Bypass via Session-File CRLF Injection","severity":"CRITICAL","actively_exploited":true,"match_field":"url_path","matched_pattern":"/login/?login_only=1","reference_urls":[]}],"data_as_of":"2026-08-15T07:44:44.234636+00:00"}