{"ip":"68.154.119.210","data_as_of":"2026-10-21T15:01:54+00:00","observed":true,"total_events":5,"verdict":{"verdict":"scanning","label":"Scanning for known vulnerabilities","detail":"1 exploit-path probe(s)","confidence":"medium","network_type":"CDN","why":["1 request(s) matched a known exploit path.","Only GET and HEAD requests were seen, with no body, which reads as a check for the vulnerability without a payload.","Not in any known-scanner range.","Counts include 3 interactive session(s) as well as first-packet events."],"engagement":{"level":"request","label":"Request traffic","detail":"195 bytes sent","bytes_sent":195,"session_seconds":1,"persistent":false},"basis":"combined"},"first_seen":"2026-06-03T01:57:38","last_seen":"2026-10-21T11:15:15","events_24h":0,"events_7d":0,"interactive_sessions":3,"interactive_sessions_24h":3,"interactive_sessions_7d":3,"interactive_protocols":[{"protocol":"socks5","sessions":3}],"geo":{"country_code":"US","country_name":"United States","region":"Virginia","city":"Boydton","lat":36.6694,"lon":-78.3877,"asn":8075,"org":"Microsoft Corporation"},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as8075","label":"Microsoft","category":"cdn","url":"https://www.peeringdb.com/asn/8075"},"cve_matches":[],"malware":[],"udp":null,"interaction":{"window_days":90,"sessions":3,"first_seen":"2026-10-21T11:15:14","last_seen":"2026-10-21T11:15:15","verdicts":[{"verdict":"scan","sessions":3}],"personas":[{"persona":"proxy@squid/5.7","sessions":3}],"services":[{"protocol":"socks5","port":1081,"sessions":3}],"logins":[],"commands":[],"downloads":[],"files":[],"attack":[{"technique_id":"T1595","technique_name":"Active Scanning","tactic_id":"TA0043","tactic_name":"Reconnaissance","sessions":3}]},"top_ports":[{"port":2082,"proto":"tcp","label":"","count":3,"sessions":0},{"port":1081,"proto":"tcp","label":"SOCKS5","count":0,"sessions":3},{"port":23,"proto":"tcp","label":"Telnet","count":2,"sessions":0}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13d131000_f57a46bbacb6_e7c285222651"],"tls_client_hello":"","tls_ja3":["8bee49baa010986785a9e74d688ed7e9"],"http_akin":["b11cun040_00040013_608dab68"],"interactive":{"ssh_hassh":[],"tls_ja4":["t13d131000_f57a46bbacb6_e7c285222651"],"tls_ja3":["8bee49baa010986785a9e74d688ed7e9"]}},"fingerprint_peers":{"t13d131000_f57a46bbacb6_e7c285222651":21,"b11cun040_00040013_608dab68":4345},"akin_families":{},"user_agents":["Mozilla/5.0 (X11; Linux x86_64; rv:125.0) Gecko/20100101 Firefox/125.0","Mozilla/5.0 (Macintosh; Intel Mac OS X 14.4; rv:125.0) Gecko/20100101 Firefox/125.0","Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36"],"timeline":[{"date":"2026-09-06","count":2,"sessions":0},{"date":"2026-10-21","count":0,"sessions":3}],"recent_events":[{"timestamp":"2026-10-21T11:15:15","port":1081,"proto":"tcp","app_proto":"socks5","app_protocol":"socks5","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0004\u0001\u0001�h\u001a\r�\u0000","payload_hex":"040101bb681a0dcd00","method":"","user_agent":"","ja3":"","session":"74f5be4b-e2a7-403d-82b9-2579b299874c-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-21T11:15:15","port":1081,"proto":"tcp","app_proto":"socks5","app_protocol":"socks5","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0005\u0001\u0000\u0003\rapi.ipify.org\u0001�","payload_hex":"050100030d6170692e69706966792e6f726701bb","method":"","user_agent":"","ja3":"8bee49baa010986785a9e74d688ed7e9","session":"2ef517fc-7c5c-483c-a211-72c92f423328-3","seq":3,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"426248e751593055","label":"SOCKS5","strings":["api.ipify.org"],"iocs":{"domains":["api.ipify.org"]}},"interactive":true},{"timestamp":"2026-10-21T11:15:15","port":1081,"proto":"tcp","app_proto":"socks5","app_protocol":"socks5","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0005\u0001\u0000","payload_hex":"050100","method":"","user_agent":"","ja3":"8bee49baa010986785a9e74d688ed7e9","session":"2ef517fc-7c5c-483c-a211-72c92f423328-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"11c52e4743758a8a","label":"SOCKS5"},"interactive":true},{"timestamp":"2026-10-21T11:15:14","port":1081,"proto":"tcp","app_proto":"socks5","app_protocol":"http_connect","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CONNECT api.ipify.org:443 HTTP/1.1\r\nHost: api.ipify.org:443\r\nUser-Agent: Mozilla/5.0\r\nProxy-Connection: keep-alive\r\n\r\n","payload_hex":"434f4e4e454354206170692e69706966792e6f72673a34343320485454502f312e310d0a486f73743a206170692e69706966792e6f72673a3434330d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a50726f78792d436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"","user_agent":"","ja3":"","session":"6b2e7873-050e-4bf2-8d28-635f1f8fea88-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"b5da288e59b933cb","label":"HTTP","strings":["CONNECT api.ipify.org:443 HTTP/1.1","Host: api.ipify.org:443","User-Agent: Mozilla/5.0","Proxy-Connection: keep-alive"],"iocs":{"domains":["api.ipify.org"]}},"interactive":true},{"timestamp":"2026-09-06T02:46:58","port":23,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"��'��$��\u0001��\u0003","payload_hex":"fffb27fffb24fffd01fffd03","method":"","user_agent":"","ja3":"","session":"513bec05-8e41-46c9-8052-53b79e54c68c","seq":1,"duration_ms":100,"bytes_in":12,"bytes_out":7},{"timestamp":"2026-09-06T02:46:58","port":23,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"��'\u0000\u0000USER\u0001-f root��\r\n","payload_hex":"fffa27000055534552012d6620726f6f74fff00d0a","method":"","user_agent":"","ja3":"","session":"513bec05-8e41-46c9-8052-53b79e54c68c","seq":2,"duration_ms":640,"bytes_in":33,"bytes_out":19,"enriched":{"digest":"d468383eb05fd69b","strings":["USER","-f root","'USER"]}},{"timestamp":"2026-06-03T01:57:56","port":2082,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:2082\",\"user-agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/.htpasswd","summary":"","payload_hex":"474554202f2e687470617373776420485454502f312e310d0a486f73743a20<HONEYPOT>3a323038320d0a557365722d4167656e743a204d6f7a696c6c612f352e3020284d6163696e746f73683b20496e74656c204d6163204f5320582031305f31355f3729204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132342e302e302e30205361666172692f3533372e33360d0a436f6e6e656374696f6e3a20636c6f73650d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36","ja3":"","session":"f0a872b8-9d4d-4242-95c2-276fd83a2edb","seq":0,"duration_ms":0,"bytes_in":0,"bytes_out":0},{"timestamp":"2026-06-03T01:57:50","port":2082,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:2082\",\"user-agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 14.4; rv:125.0) Gecko/20100101 Firefox/125.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/actuator/env","summary":"","payload_hex":"474554202f6163747561746f722f656e7620485454502f312e310d0a486f73743a20<HONEYPOT>3a323038320d0a557365722d4167656e743a204d6f7a696c6c612f352e3020284d6163696e746f73683b20496e74656c204d6163204f5320582031342e343b2072763a3132352e3029204765636b6f2f32303130303130312046697265666f782f3132352e300d0a436f6e6e656374696f6e3a20636c6f73650d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 14.4; rv:125.0) Gecko/20100101 Firefox/125.0","ja3":"","session":"37714d57-8373-420a-9e8e-a5f0be25e9e1","seq":0,"duration_ms":0,"bytes_in":0,"bytes_out":0},{"timestamp":"2026-06-03T01:57:38","port":2082,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:2082\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64; rv:125.0) Gecko/20100101 Firefox/125.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/.env.production","summary":"","payload_hex":"474554202f2e656e762e70726f64756374696f6e20485454502f312e310d0a486f73743a20<HONEYPOT>3a323038320d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f36343b2072763a3132352e3029204765636b6f2f32303130303130312046697265666f782f3132352e300d0a436f6e6e656374696f6e3a20636c6f73650d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64; rv:125.0) Gecko/20100101 Firefox/125.0","ja3":"","session":"2446cf4f-08c2-4329-af11-ecd46b440c85","seq":0,"duration_ms":0,"bytes_in":0,"bytes_out":0}],"http_methods":[{"method":"GET","count":3}],"distinct_ports_total":3,"top_paths":[{"path":"/actuator/env","count":1,"ports":1},{"path":"/.env.production","count":1,"ports":1},{"path":"/.htpasswd","count":1,"ports":1}],"distinct_paths_total":3,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept-Encoding","Connection","Host","User-Agent"],"representative":[{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Connection","value":"close","notable":false},{"name":"Host","value":"<HONEYPOT>:2082","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36","notable":false}],"distinct_sets":1,"events_with_headers":3},"tags":[]}