{"ip":"64.44.141.220","total_events":18,"verdict":{"verdict":"probing","label":"Low-level probing","detail":null,"confidence":"low","network_type":null,"why":["18 event(s), fewer than 10 distinct ports, no exploit payloads.","Not in any known-scanner range."],"engagement":{"level":"request","label":"Request traffic","detail":"1,773 bytes sent","bytes_sent":1773,"session_seconds":0,"persistent":false}},"first_seen":"2026-09-09T12:28:16","last_seen":"2026-09-13T04:50:45","events_24h":3,"events_7d":18,"geo":{"country_code":"US","country_name":"United States","region":"Illinois","city":"Chicago","lat":41.8879,"lon":-88.1998,"asn":27176,"org":"DataWagon LLC"},"source_domain":null,"known_scanners":[],"scanner_tag":null,"cve_matches":[{"cve_id":"CVE-2018-9995","title":"TBK DVR4104/DVR4216 Devices - Authentication Bypass","severity":"critical","actively_exploited":false,"match_field":"url_path","matched_pattern":"/device.rsp?opt=user&cmd=list"}],"malware":[],"top_ports":[{"port":8082,"proto":"tcp","label":"","count":9},{"port":8081,"proto":"tcp","label":"","count":2},{"port":8443,"proto":"tcp","label":"HTTPS-alt","count":2},{"port":5555,"proto":"tcp","label":"","count":2},{"port":80,"proto":"tcp","label":"HTTP","count":1},{"port":34567,"proto":"tcp","label":"","count":1},{"port":8080,"proto":"tcp","label":"HTTP-alt","count":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i140900_cbb2034c60b8_e7c285222651"],"tls_ja3":["ea4a9ae049cfc614efbb3c244abb3fc7"],"ja4h":["ge11nn0300_86b6b04cb9cc","ge10nn0100_4740ae6347b0","ge11nn0400_17292dadbc7b","ge11cn0400_b7a9ba1708f3"]},"fingerprint_peers":{"t13i140900_cbb2034c60b8_e7c285222651":805,"ge11nn0300_86b6b04cb9cc":3318,"ge10nn0100_4740ae6347b0":377,"ge11nn0400_17292dadbc7b":1633,"ge11cn0400_b7a9ba1708f3":1},"user_agents":["Mozilla/5.0 (Windows NT 10.0; Win64; x64)","Mozilla/5.0"],"timeline":[{"date":"2026-09-09","count":2},{"date":"2026-09-10","count":2},{"date":"2026-09-11","count":6},{"date":"2026-09-12","count":5},{"date":"2026-09-13","count":3}],"recent_events":[{"timestamp":"2026-09-13T04:50:45","port":8082,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"host\":\"<HONEYPOT>:8082\",\"user-agent\":\"Mozilla/5.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a383038320d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0","ja3":"","session":"814066d8-ec52-4e13-9504-174a232b8048","seq":1,"duration_ms":100,"bytes_in":88,"bytes_out":78},{"timestamp":"2026-09-13T02:27:55","port":8082,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"host\":\"<HONEYPOT>:8082\",\"user-agent\":\"Mozilla/5.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a383038320d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0","ja3":"","session":"3e04ae76-ad44-421b-87bb-913934cc1e1d","seq":1,"duration_ms":100,"bytes_in":88,"bytes_out":78},{"timestamp":"2026-09-13T02:27:42","port":8082,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"host\":\"<HONEYPOT>:8082\",\"user-agent\":\"Mozilla/5.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a383038320d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0","ja3":"","session":"e31ee462-8ec5-4217-8f80-4629c71c4af6","seq":1,"duration_ms":101,"bytes_in":88,"bytes_out":78},{"timestamp":"2026-09-12T22:09:52","port":8081,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"host\":\"<HONEYPOT>:8081\",\"user-agent\":\"Mozilla/5.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a383038310d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0","ja3":"","session":"5af06d63-a08c-44ab-96d0-eda3e255e9bb","seq":1,"duration_ms":101,"bytes_in":88,"bytes_out":78},{"timestamp":"2026-09-12T22:09:52","port":8082,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"host\":\"<HONEYPOT>:8082\",\"user-agent\":\"Mozilla/5.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a383038320d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0","ja3":"","session":"e2bf6a05-8e61-4c43-96c1-00283cba3912","seq":1,"duration_ms":100,"bytes_in":88,"bytes_out":78},{"timestamp":"2026-09-12T02:10:44","port":8082,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"host\":\"<HONEYPOT>:8082\",\"user-agent\":\"Mozilla/5.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a383038320d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0","ja3":"","session":"59e3265b-926d-4f56-9296-1a92f0ed3374","seq":1,"duration_ms":100,"bytes_in":88,"bytes_out":78},{"timestamp":"2026-09-12T02:10:38","port":8082,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"host\":\"<HONEYPOT>:8082\",\"user-agent\":\"Mozilla/5.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a383038320d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0","ja3":"","session":"5ec5b88c-0faf-4098-8a48-c355be1dc642","seq":1,"duration_ms":100,"bytes_in":88,"bytes_out":78},{"timestamp":"2026-09-12T01:22:43","port":8082,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"host\":\"<HONEYPOT>:8082\",\"user-agent\":\"Mozilla/5.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a383038320d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0","ja3":"","session":"5379e4a6-7d6e-4694-8e27-997245ce3ed4","seq":1,"duration_ms":100,"bytes_in":88,"bytes_out":78},{"timestamp":"2026-09-11T20:13:21","port":8080,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"close\",\"cookie\":\"uid=1\",\"host\":\"<HONEYPOT>:8080\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/device.rsp?opt=user&cmd=list","summary":"","payload_hex":"474554202f6465766963652e7273703f6f70743d7573657226636d643d6c69737420485454502f312e310d0a486f73743a20<HONEYPOT>3a383038300d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b20783634290d0a436f6f6b69653a207569643d310d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64)","ja3":"","session":"f25fb905-6429-4ba5-8251-290e26590a0f","seq":1,"duration_ms":100,"bytes_in":174,"bytes_out":78},{"timestamp":"2026-09-11T20:00:13","port":34567,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000�\u0003%\u0000\u0000\u0000{ \"Ret\" : 100, \"SessionID\" : \"0x0\" }\n","payload_hex":"ff00000000000000000000000000f103250000007b202252657422203a203130302c202253657373696f6e494422203a202230783022207d0a","method":"","user_agent":"","ja3":"","session":"650094c2-0a56-4d9b-bbfd-065b47dbc9a7","seq":1,"duration_ms":100,"bytes_in":57,"bytes_out":13,"enriched":{"digest":"e4dee37170848299","strings":["{ \"Ret\" : 100, \"SessionID\" : \"0x0\" }","%{ \"Ret\" : 100, \"SessionID\" : \"0x0\" }"]}}],"http_methods":[{"method":"GET","count":16}],"distinct_ports_total":7,"top_paths":[{"path":"/","count":15,"ports":5},{"path":"/device.rsp?opt=user&cmd=list","count":1,"ports":1}],"distinct_paths_total":2,"top_snis":[],"top_hosts":[{"value":"lan","count":1}],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","Connection","Cookie","Host","User-Agent"],"representative":[{"name":"Accept","value":"*/*","notable":false},{"name":"Connection","value":"close","notable":false},{"name":"Cookie","value":"uid=1","notable":true},{"name":"Host","value":"<HONEYPOT>:8080","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (Windows NT 10.0; Win64; x64)","notable":false}],"distinct_sets":2,"events_with_headers":9},"tags":[{"tag_id":"CVE-2018-9995","tag_type":"cve","title":"TBK DVR4104/DVR4216 Devices - Authentication Bypass","severity":"critical","actively_exploited":false,"match_field":"url_path","matched_pattern":"/device.rsp?opt=user&cmd=list","reference_urls":["https://www.exploit-db.com/exploits/44577/","http://misteralfa-hack.blogspot.cl/2018/04/tbk-vision-dvr-login-bypass.html","http://misteralfa-hack.blogspot.cl/2018/04/update-dvr-login-bypass-cve-2018-9995.html","https://www.bleepingcomputer.com/news/security/new-hacking-tool-lets-users-access-a-bunch-of-dvrs-and-their-video-feeds/","https://nvd.nist.gov/vuln/detail/CVE-2018-9995"]}],"data_as_of":"2026-09-13T23:12:41.823441+00:00"}