{"ip":"52.24.112.111","total_events":3146,"verdict":{"verdict":"scanning","label":"Sustained targeting","detail":"3,146 events across 8 port(s)","confidence":"medium","network_type":"enterprise","why":["3,146 requests against only 8 service(s), which is depth rather than a sweep.","Typical of credential stuffing or a single-service campaign; the median address here sends three requests.","No exploit payload observed, so this describes volume and focus, not a confirmed compromise attempt.","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"591,407 bytes sent","bytes_sent":591407,"session_seconds":0,"persistent":false}},"first_seen":"2026-09-01T21:44:04","last_seen":"2026-09-02T04:32:48","events_24h":0,"events_7d":3146,"geo":{"country_code":"US","country_name":"United States","region":"Oregon","city":"Boardman","lat":45.8401,"lon":-119.705,"asn":16509,"org":"Amazon.com, Inc."},"source_domain":"ec2-52-24-112-111.us-west-2.compute.amazonaws.com","known_scanners":[],"scanner_tag":{"key":"aws","label":"Amazon AWS","category":"hosting_provider","url":"https://aws.amazon.com/"},"cve_matches":[{"cve_id":"CVE-2024-25723","title":"ZenML ZenML Server - Improper Authentication","severity":"critical","actively_exploited":false,"match_field":"url_path","matched_pattern":"/api/v1/info"},{"cve_id":"CVE-2026-26341","title":"Tattile Camera < 1.181.5 - Default Login","severity":"high","actively_exploited":false,"match_field":"url_path","matched_pattern":"/api/v1/security/login"},{"cve_id":"CVE-2025-2129","title":"Mage AI - Insecure Default Authentication Setup","severity":"medium","actively_exploited":false,"match_field":"url_path","matched_pattern":"/api/kernels"}],"malware":[],"top_ports":[{"port":3000,"proto":"tcp","label":"Web-alt","count":655},{"port":5001,"proto":"tcp","label":"","count":633},{"port":9000,"proto":"tcp","label":"Web-alt","count":487},{"port":8888,"proto":"tcp","label":"HTTP-alt","count":419},{"port":5000,"proto":"tcp","label":"Web-alt","count":359},{"port":8000,"proto":"tcp","label":"HTTP-alt","count":264},{"port":8080,"proto":"tcp","label":"HTTP-alt","count":263},{"port":3001,"proto":"tcp","label":"","count":66}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[],"ja4h":["po11nn0600_36b368ee4bc7","ge11nn0400_9c3956fad5da"]},"fingerprint_peers":{"po11nn0600_36b368ee4bc7":17,"ge11nn0400_9c3956fad5da":1581},"user_agents":["Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36"],"timeline":[{"date":"2026-09-01","count":982},{"date":"2026-09-02","count":2164}],"recent_events":[{"timestamp":"2026-09-02T04:32:48","port":8080,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8080\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a383038300d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f363429204170706c655765624b69742f3533372e33360d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36","ja3":"","session":"57d1f98c-059f-493e-b192-d9b22aeb1a18","seq":1,"duration_ms":0,"bytes_in":149,"bytes_out":78},{"timestamp":"2026-09-02T04:32:34","port":8080,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8080\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a383038300d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f363429204170706c655765624b69742f3533372e33360d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36","ja3":"","session":"d93e5c02-6320-4884-9f64-c92e412d27a9","seq":1,"duration_ms":83,"bytes_in":149,"bytes_out":78},{"timestamp":"2026-09-02T04:32:30","port":5001,"proto":"tcp","app_proto":"","app_protocol":"targusdataspeed","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:5001\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a353030310d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f363429204170706c655765624b69742f3533372e33360d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36","ja3":"","session":"016b4114-d344-4c4e-8b08-4b820b7839a9","seq":1,"duration_ms":100,"bytes_in":149,"bytes_out":78},{"timestamp":"2026-09-02T04:31:45","port":5000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:5000\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a353030300d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f363429204170706c655765624b69742f3533372e33360d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36","ja3":"","session":"6bea539d-52ed-4ae7-95cf-0d9bea4f876a","seq":1,"duration_ms":0,"bytes_in":149,"bytes_out":78},{"timestamp":"2026-09-02T04:31:31","port":8888,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8888\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/api/health","summary":"","payload_hex":"474554202f6170692f6865616c746820485454502f312e310d0a486f73743a20<HONEYPOT>3a383838380d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f363429204170706c655765624b69742f3533372e33360d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36","ja3":"","session":"be02ea79-5036-463a-8683-08b18c52e50f","seq":1,"duration_ms":101,"bytes_in":159,"bytes_out":78},{"timestamp":"2026-09-02T04:31:31","port":8080,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8080\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/api/v1/info","summary":"","payload_hex":"474554202f6170692f76312f696e666f20485454502f312e310d0a486f73743a20<HONEYPOT>3a383038300d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f363429204170706c655765624b69742f3533372e33360d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36","ja3":"","session":"a15608d5-728c-46b9-be07-73fef45a3eb5","seq":1,"duration_ms":100,"bytes_in":160,"bytes_out":78},{"timestamp":"2026-09-02T04:31:30","port":8080,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8080\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/api/2.0/mlflow/experiments/list","summary":"","payload_hex":"474554202f6170692f322e302f6d6c666c6f772f6578706572696d656e74732f6c69737420485454502f312e310d0a486f73743a20<HONEYPOT>3a383038300d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f363429204170706c655765624b69742f3533372e33360d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36","ja3":"","session":"aac83873-1711-4460-8a20-215b46b2edd3","seq":1,"duration_ms":100,"bytes_in":180,"bytes_out":78},{"timestamp":"2026-09-02T04:31:30","port":8888,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8888\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/api/v1/info","summary":"","payload_hex":"474554202f6170692f76312f696e666f20485454502f312e310d0a486f73743a20<HONEYPOT>3a383838380d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f363429204170706c655765624b69742f3533372e33360d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36","ja3":"","session":"e7b71c24-792b-498d-a90d-7461ae0eb46e","seq":1,"duration_ms":101,"bytes_in":160,"bytes_out":78},{"timestamp":"2026-09-02T04:31:29","port":8080,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8080\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a383038300d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f363429204170706c655765624b69742f3533372e33360d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36","ja3":"","session":"d901ed70-0d3d-46da-993e-8a9a87a7c229","seq":1,"duration_ms":100,"bytes_in":149,"bytes_out":78},{"timestamp":"2026-09-02T04:31:29","port":8888,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8888\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a383838380d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f363429204170706c655765624b69742f3533372e33360d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36","ja3":"","session":"9f30f0b1-351a-45ca-8494-88e5e33376a7","seq":1,"duration_ms":100,"bytes_in":149,"bytes_out":78}],"http_methods":[{"method":"GET","count":2537},{"method":"POST","count":609}],"distinct_ports_total":8,"top_paths":[{"path":"/api/v1/security/login","count":609,"ports":8},{"path":"/api/health","count":468,"ports":8},{"path":"/","count":429,"ports":8},{"path":"/api/status","count":241,"ports":8},{"path":"/api/v1/version","count":238,"ports":8},{"path":"/api/2.0/mlflow/experiments/list","count":238,"ports":8},{"path":"/api/v1/security/csrf_token/","count":235,"ports":8},{"path":"/api/v1/info","count":230,"ports":8},{"path":"/api/cluster_status","count":230,"ports":8},{"path":"/api/kernels","count":228,"ports":8}],"distinct_paths_total":10,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept-Encoding","Connection","Host","User-Agent"],"representative":[{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Connection","value":"close","notable":false},{"name":"Host","value":"<HONEYPOT>:8080","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36","notable":false}],"distinct_sets":1,"events_with_headers":10},"tags":[{"tag_id":"CVE-2024-25723","tag_type":"cve","title":"ZenML ZenML Server - Improper Authentication","severity":"critical","actively_exploited":false,"match_field":"url_path","matched_pattern":"/api/v1/info","reference_urls":["https://www.zenml.io/blog/critical-security-update-for-zenml-users","https://github.com/zenml-io/zenml","https://github.com/zenml-io/zenml/compare/0.42.1...0.42.2","https://github.com/zenml-io/zenml/compare/0.43.0...0.43.1","https://github.com/zenml-io/zenml/compare/0.44.3...0.44.4"]},{"tag_id":"CVE-2026-26341","tag_type":"cve","title":"Tattile Camera < 1.181.5 - Default Login","severity":"high","actively_exploited":false,"match_field":"url_path","matched_pattern":"/api/v1/security/login","reference_urls":["https://www.cve.org/CVERecord?id=CVE-2026-26341"]},{"tag_id":"CVE-2025-2129","tag_type":"cve","title":"Mage AI - Insecure Default Authentication Setup","severity":"medium","actively_exploited":false,"match_field":"url_path","matched_pattern":"/api/kernels","reference_urls":["https://nvd.nist.gov/vuln/detail/CVE-2025-2129","https://github.com/zn9988/publications/blob/main/2.Mage-AI%20-%20Insecure%20Default%20Authentication%20Setup%20Leading%20to%20Zero-Click%20RCE/README.md","https://vuldb.com/?ctiid.299049","https://vuldb.com/?id.299049","https://vuldb.com/?submit.510690"]}],"data_as_of":"2026-09-04T21:01:50.550887+00:00"}