{"ip":"72.240.2.223","total_events":245,"verdict":{"verdict":"malicious","label":"Exploit attempts observed","detail":"6 exploit-path hits","confidence":"high","network_type":"residential ISP","why":["6 request(s) matched a known exploit path.","Body-carrying methods (POST/PUT/PATCH/DELETE) seen: payload delivery, not just recon.","5+ hits raise confidence to high.","Not in any known-scanner range.","Sent 2,912,654 bytes: sustained payload delivery, not a single opportunistic request."],"engagement":{"level":"payload","label":"Sustained payload","detail":"2,912,654 bytes sent","bytes_sent":2912654,"session_seconds":49,"persistent":false}},"first_seen":"2026-09-30T06:14:53","last_seen":"2026-09-30T06:16:26","events_24h":245,"events_7d":245,"geo":{"country_code":"US","country_name":"United States","region":"Ohio","city":"Toledo","lat":41.6005,"lon":-83.6251,"asn":13490,"org":"Buckeye Cablevision, Inc."},"source_domain":"cm-72-240-2-223.buckeyecom.net","known_scanners":[],"scanner_tag":{"key":"peeringdb:as13490","label":"Buckeye Cablevision","category":"isp","url":"https://www.peeringdb.com/asn/13490"},"cve_matches":[{"cve_id":"CVE-2020-2551","title":"Oracle WebLogic Server - Remote Code Execution","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/console/login/LoginForm.jsp"},{"cve_id":"CVE-2021-35587","title":"Oracle Access Manager - Remote Code Execution","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/oam/server/opensso/sessionservice"},{"cve_id":"CVE-2022-26143","title":"Mitel MiCollab - Information Disclosure & Denial of Service","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/ucs/micollab/version.json"},{"cve_id":"CVE-2024-1709","title":"ConnectWise ScreenConnect 23.9.7 - Authentication Bypass","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/SetupWizard.aspx"},{"cve_id":"CVE-2025-0282","title":"Ivanti Connect Secure - Stack-based Buffer Overflow","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/dana-na/auth/url_default/welcome.cgi"},{"cve_id":"CVE-2020-14864","title":"Oracle Fusion - Directory Traversal/Local File Inclusion","severity":"high","actively_exploited":true,"match_field":"url_path","matched_pattern":"/analytics/saw.dll"},{"cve_id":"CVE-2023-38646","title":"Metabase < 0.46.6.1 - Remote Code Execution","severity":"critical","actively_exploited":false,"match_field":"url_path","matched_pattern":"/api/session/properties"},{"cve_id":"CVE-2024-23917","title":"JetBrains TeamCity > 2023.11.3 - Authentication Bypass","severity":"critical","actively_exploited":false,"match_field":"url_path","matched_pattern":"/app/rest/server"},{"cve_id":"CVE-2024-25723","title":"ZenML ZenML Server - Improper Authentication","severity":"critical","actively_exploited":false,"match_field":"url_path","matched_pattern":"/api/v1/info"},{"cve_id":"CVE-2024-30569","title":"Netgear R6850 - Information Disclosure","severity":"high","actively_exploited":false,"match_field":"url_path","matched_pattern":"/currentsetting.htm"},{"cve_id":"CVE-2026-25892","title":"Adminer 4.6.2 - 5.4.1 Unauthenticated Persistent DoS","severity":"high","actively_exploited":false,"match_field":"url_path","matched_pattern":"/adminer.php"},{"cve_id":"CVE-2026-35029","title":"LiteLLM - Arbitrary File Read","severity":"high","actively_exploited":false,"match_field":"url_path","matched_pattern":"/health/liveliness"},{"cve_id":"CVE-2007-4556","title":"OpenSymphony XWork/Apache Struts2 - Remote Code Execution","severity":"medium","actively_exploited":false,"match_field":"url_path","matched_pattern":"/login.action"},{"cve_id":"CVE-2025-2129","title":"Mage AI - Insecure Default Authentication Setup","severity":"medium","actively_exploited":false,"match_field":"url_path","matched_pattern":"/api/kernels"}],"malware":[],"top_ports":[{"port":10001,"proto":"tcp","label":"","count":245}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i131000_f57a46bbacb6_f50d94e863eb","t13i251000_b78ed14e2fd0_f50d94e863eb"],"tls_client_hello":"16030105ee010005ea0303981b167da3e92d2adb812159b607f8b0de6fff5f6d13d6c996e04f6e4375846e20d348fe12dace4e62e23b76c7a65961fed9290c2d8a5cfd82a698e32a5ca12cab0032cca9cca8c02bc02fc02cc030c009c013c00ac014009c009d002f0035c012000ac023c027003cc007c01100051303130113020100056f000b00020100ff010001000017000000120000000500050100000000000a0010000e11ec11eb11ed001d001700180019000d001c001a090409050906080404030807080508060401050106010503060300320020001e090409050906080404030807080508060401050106010503060302010203002b0009080304030303020301003304ea04e811ec04c0bbe816b3c3433becb86b81388e96595fc15219d86293fca0e7c63c07462f081560d4d82975d20be6aa68372aa90865ac621aa4d6d2a92fa83616b14dfb0ca23dd5399817a7665335a2e98c65c0becde47094d0b645a61817c40c5111abe0d954a879209d58a8398436896158f73b32fc79b2d75c8cd49594b617c123d90ef29b45b7698653da32b4a766e72835c0485bf1e981876a3122101551e44334553f36f91db5303418b5cc7328c99ed474b8a161f836b19e0b3c37082a0a53498fac20779ac80f33655f5193338a9cff175bacb3b0a517104c8cb7e5f46ff51a5ab18ba3ad0099b80bbe19a3a40222bad7670ef8301e06a632e9cba9f2192d9ba110cca2216e403b83fa369575ca7bf29a3342a2f67406c795255645b194786c9968abbdb12d6dca84da15831052cb7768b221688dff92a8fe678bbfa880b8b6431a531ada884fcac512b23207111317fa70252b4b71313b7343dc100a419cfc70b0d9e0957f4a2838b8c423013a8ba6cf2b1983c5e10a0eca9799c2baae78a1d289050b833661f0503563c8461c33d9087bc646c0184cca7429ab9a779da95a2b2286b9b8067a2c01574b5a0510f92ed0d2c4b5c244590b2311cc54f75238e6d2530282a0a124c16cdbbf336223dbeb23cb2476fcd90ee1163bade71ec6c9c6145051ac1229481396180389a913c7c2396c78a5572c1195f321ce873610a5f53ac785b310c388e852956828958ceb2aeec6bc7782c91ac9116af681ac620c33b61083ca891cc586cc3610a52c82ee803347d8bf16aabd0d7ca824396acaba5086e58944a4ca3d02c16139aa6394abf936738102cd6c875360e47d0b36b0be9696ae64ad3948a56324716e2645c2b075bee5a592437b25236fbffa235df007fb74875c8626fe0c5e96f59c828b8a2539415e955ae3da87b0c9c30a21191a432dba777f53167ff8e088e69996a6213b7b81307370af57b9056e81cb234ca4fbb8b5a2c10d557822cfa241c15b9b60b6abe387753d83aa5b022d81da3829487016131c88624419f881cf705ca0eccfdfb021088a453c670bdd624a8a9b05559b689909124b21ccafa8840148c0e524436e4a15bca47470072ea3616127174f0650227fa8a7df151d0a7290c7350825f7182ed455e4a07b926ca3c5ab0a6ebb23ff8367cef0927a3b7a4ea672f78311a209d02464857d028aaf4c650dfa552ac9b102577163b9a1c89caca983cee3b59f27887b87c6c027903228d237cec25072770fef317fa6e55bff45b3146583a4785b1c832536600b33f6758c234cb9431f7f9567d070bcd0a4aa5d3b523f79c6ac8b4b30e720b3472a1fa92fe8101a2e57233a65b9f9a770a2f39eab6ba111c339dac416b381a14dc48d0e255e4ff15f0ba241a452cebbc74b105365e504948c6cbe738c0e1a3b831f99c5cf919cebfb776ae1c05302bcf254329cb599faaaabe3465dc218ca2d95649d50c03dc07aea81641326049726caeb936f4cc34ea5690f66207ce86022a5327178379b969767aee0443182755462b3ea0b5d62a3681cc11ad2dc1e942baaeb4696a63ca82625018a8142d414811c349960519a7807c20f70a828e7c97e346d25d415f9c785f2781f5d0252e31f0066d456c7d47d78fb5475c1c1ac4a44aedd19d08a90211c3954529bb5c861f427dfc021823831f8d242cdee968ee76064432790bbdac4116d483be87a4a001d002061f427dfc021823831f8d242cdee968ee76064432790bbdac4116d48","tls_ja3":["9404b4852d44353f69b8b33aaff15be4","56b0f6febc953849f7ace70c5a2ae34d"],"http_akin":["b11cun030_00040012_13ee3d34","b11cuq060_00850811_ffe60107","b11cun040_00040016_50f90888","b11cun030_00040005_4c75231d"]},"fingerprint_peers":{"t13i131000_f57a46bbacb6_f50d94e863eb":2741,"t13i251000_b78ed14e2fd0_f50d94e863eb":42,"b11cun030_00040012_13ee3d34":5046,"b11cuq060_00850811_ffe60107":5,"b11cun040_00040016_50f90888":69,"b11cun030_00040005_4c75231d":5},"akin_families":{"b11cun040_00040016_50f90888":{"head":"b11cun040_00040016_50f90888","shapes":4,"ips":69}},"user_agents":["nerva/1.0","Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36"],"timeline":[{"date":"2026-09-30","count":245}],"recent_events":[{"timestamp":"2026-09-30T06:16:26","port":10001,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"application/json\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:10001\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/api/version","summary":"","payload_hex":"474554202f6170692f76657273696f6e20485454502f312e310d0a486f73743a20<HONEYPOT>3a31303030310d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132372e302e302e30205361666172692f3533372e33360d0a4163636570743a206170706c69636174696f6e2f6a736f6e0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36","ja3":"9404b4852d44353f69b8b33aaff15be4","session":"f66b70b2-c38e-4691-a7b4-1d00a8211b6b","seq":158,"duration_ms":48515,"bytes_in":36417,"bytes_out":12166},{"timestamp":"2026-09-30T06:16:25","port":10001,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"application/json\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:10001\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/nerva-fp-nonexistent-path","summary":"","payload_hex":"474554202f6e657276612d66702d6e6f6e6578697374656e742d7061746820485454502f312e310d0a486f73743a20<HONEYPOT>3a31303030310d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132372e302e302e30205361666172692f3533372e33360d0a4163636570743a206170706c69636174696f6e2f6a736f6e0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36","ja3":"9404b4852d44353f69b8b33aaff15be4","session":"f66b70b2-c38e-4691-a7b4-1d00a8211b6b","seq":155,"duration_ms":47592,"bytes_in":35739,"bytes_out":11935},{"timestamp":"2026-09-30T06:16:25","port":10001,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"application/json\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:10001\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/hub/api/users","summary":"","payload_hex":"474554202f6875622f6170692f757365727320485454502f312e310d0a486f73743a20<HONEYPOT>3a31303030310d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132372e302e302e30205361666172692f3533372e33360d0a4163636570743a206170706c69636174696f6e2f6a736f6e0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36","ja3":"9404b4852d44353f69b8b33aaff15be4","session":"f66b70b2-c38e-4691-a7b4-1d00a8211b6b","seq":156,"duration_ms":47907,"bytes_in":35970,"bytes_out":12012},{"timestamp":"2026-09-30T06:16:25","port":10001,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"text/html\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:10001\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/c/login","summary":"","payload_hex":"474554202f632f6c6f67696e20485454502f312e310d0a486f73743a20<HONEYPOT>3a31303030310d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132372e302e302e30205361666172692f3533372e33360d0a4163636570743a20746578742f68746d6c0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36","ja3":"9404b4852d44353f69b8b33aaff15be4","session":"f66b70b2-c38e-4691-a7b4-1d00a8211b6b","seq":157,"duration_ms":48215,"bytes_in":36188,"bytes_out":12089},{"timestamp":"2026-09-30T06:16:24","port":10001,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"application/json\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:10001\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/api/overview","summary":"","payload_hex":"474554202f6170692f6f7665727669657720485454502f312e310d0a486f73743a20<HONEYPOT>3a31303030310d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132372e302e302e30205361666172692f3533372e33360d0a4163636570743a206170706c69636174696f6e2f6a736f6e0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36","ja3":"9404b4852d44353f69b8b33aaff15be4","session":"f66b70b2-c38e-4691-a7b4-1d00a8211b6b","seq":152,"duration_ms":46644,"bytes_in":35040,"bytes_out":11704},{"timestamp":"2026-09-30T06:16:24","port":10001,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"application/json\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:10001\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/api/session","summary":"","payload_hex":"474554202f6170692f73657373696f6e20485454502f312e310d0a486f73743a20<HONEYPOT>3a31303030310d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132372e302e302e30205361666172692f3533372e33360d0a4163636570743a206170706c69636174696f6e2f6a736f6e0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36","ja3":"9404b4852d44353f69b8b33aaff15be4","session":"f66b70b2-c38e-4691-a7b4-1d00a8211b6b","seq":153,"duration_ms":46957,"bytes_in":35269,"bytes_out":11781},{"timestamp":"2026-09-30T06:16:24","port":10001,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"application/json\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:10001\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/_layouts/","summary":"","payload_hex":"474554202f5f6c61796f7574732f20485454502f312e310d0a486f73743a20<HONEYPOT>3a31303030310d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132372e302e302e30205361666172692f3533372e33360d0a4163636570743a206170706c69636174696f6e2f6a736f6e0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36","ja3":"9404b4852d44353f69b8b33aaff15be4","session":"f66b70b2-c38e-4691-a7b4-1d00a8211b6b","seq":154,"duration_ms":47281,"bytes_in":35496,"bytes_out":11858},{"timestamp":"2026-09-30T06:16:23","port":10001,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"application/json\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:10001\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/zimbra/","summary":"","payload_hex":"474554202f7a696d6272612f20485454502f312e310d0a486f73743a20<HONEYPOT>3a31303030310d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132372e302e302e30205361666172692f3533372e33360d0a4163636570743a206170706c69636174696f6e2f6a736f6e0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36","ja3":"9404b4852d44353f69b8b33aaff15be4","session":"f66b70b2-c38e-4691-a7b4-1d00a8211b6b","seq":149,"duration_ms":45720,"bytes_in":34368,"bytes_out":11473},{"timestamp":"2026-09-30T06:16:23","port":10001,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"application/json\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:10001\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/v2/","summary":"","payload_hex":"474554202f76322f20485454502f312e310d0a486f73743a20<HONEYPOT>3a31303030310d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132372e302e302e30205361666172692f3533372e33360d0a4163636570743a206170706c69636174696f6e2f6a736f6e0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36","ja3":"9404b4852d44353f69b8b33aaff15be4","session":"f66b70b2-c38e-4691-a7b4-1d00a8211b6b","seq":150,"duration_ms":46027,"bytes_in":34589,"bytes_out":11550},{"timestamp":"2026-09-30T06:16:23","port":10001,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"text/html\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:10001\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/MagicInfo/","summary":"","payload_hex":"474554202f4d61676963496e666f2f20485454502f312e310d0a486f73743a20<HONEYPOT>3a31303030310d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132372e302e302e30205361666172692f3533372e33360d0a4163636570743a20746578742f68746d6c0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36","ja3":"9404b4852d44353f69b8b33aaff15be4","session":"f66b70b2-c38e-4691-a7b4-1d00a8211b6b","seq":151,"duration_ms":46336,"bytes_in":34810,"bytes_out":11627}],"http_methods":[{"method":"GET","count":238},{"method":"POST","count":1}],"distinct_ports_total":1,"top_paths":[{"path":"/","count":9,"ports":1},{"path":"/api/v1/version","count":4,"ports":1},{"path":"/api/version","count":4,"ports":1},{"path":"/version","count":4,"ports":1},{"path":"/login","count":3,"ports":1},{"path":"/api/","count":2,"ports":1},{"path":"/api/overview","count":2,"ports":1},{"path":"/+CSCOE+/logon.html","count":2,"ports":1},{"path":"/status","count":2,"ports":1},{"path":"/metrics","count":2,"ports":1},{"path":"/auth/login.html","count":1,"ports":1},{"path":"/v3/api-docs","count":1,"ports":1},{"path":"/GC3/glog.webserver.servlet.umt.Login","count":1,"ports":1},{"path":"/nerva-fp-nonexistent-path","count":1,"ports":1},{"path":"/ucs/micollab/version.json","count":1,"ports":1}],"distinct_paths_total":200,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","Accept-Encoding","Host","User-Agent"],"representative":[{"name":"Accept","value":"application/json","notable":false},{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Host","value":"<HONEYPOT>:10001","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36","notable":false}],"distinct_sets":1,"events_with_headers":10},"tags":[{"tag_id":"CVE-2020-2551","tag_type":"cve","title":"Oracle WebLogic Server - Remote Code Execution","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/console/login/LoginForm.jsp","reference_urls":["https://github.com/hktalent/CVE-2020-2551","https://nvd.nist.gov/vuln/detail/CVE-2020-2551","https://www.oracle.com/security-alerts/cpujan2020.html","https://github.com/neilzhang1/Chinese-Charts","https://github.com/pjgmonteiro/Pentest-tools"]},{"tag_id":"CVE-2021-35587","tag_type":"cve","title":"Oracle Access Manager - Remote Code Execution","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/oam/server/opensso/sessionservice","reference_urls":["https://testbnull.medium.com/oracle-access-manager-pre-auth-rce-cve-2021-35587-analysis-1302a4542316","https://nvd.nist.gov/vuln/detail/CVE-2021-35587","https://www.oracle.com/security-alerts/cpujan2022.html","https://github.com/ARPSyndicate/kenzer-templates","https://github.com/GrrrDog/Java-Deserialization-Cheat-Sheet"]},{"tag_id":"CVE-2022-26143","tag_type":"cve","title":"Mitel MiCollab - Information Disclosure & Denial of Service","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/ucs/micollab/version.json","reference_urls":["https://nvd.nist.gov/vuln/detail/CVE-2022-26143"]},{"tag_id":"CVE-2024-1709","tag_type":"cve","title":"ConnectWise ScreenConnect 23.9.7 - Authentication Bypass","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/SetupWizard.aspx","reference_urls":["https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass","https://github.com/watchtowrlabs/connectwise-screenconnect_auth-bypass-add-user-poc","https://www.connectwise.com/company/trust/security-bulletins/connectwise-screenconnect-23.9.8","https://nvd.nist.gov/vuln/detail/CVE-2024-1709","https://github.com/rapid7/metasploit-framework/pull/18870"]},{"tag_id":"CVE-2025-0282","tag_type":"cve","title":"Ivanti Connect Secure - Stack-based Buffer Overflow","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/dana-na/auth/url_default/welcome.cgi","reference_urls":["https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-Policy-Secure-ZTA-Gateways-CVE-2025-0282-CVE-2025-0283","https://labs.watchtowr.com/exploitation-walkthrough-and-techniques-ivanti-connect-secure-rce-cve-2025-0282/","https://cloud.google.com/blog/topics/threat-intelligence/ivanti-connect-secure-vpn-zero-day","https://nvd.nist.gov/vuln/detail/CVE-2025-0282"]},{"tag_id":"CVE-2020-14864","tag_type":"cve","title":"Oracle Fusion - Directory Traversal/Local File Inclusion","severity":"high","actively_exploited":true,"match_field":"url_path","matched_pattern":"/analytics/saw.dll","reference_urls":["http://packetstormsecurity.com/files/159748/Oracle-Business-Intelligence-Enterprise-Edition-5.5.0.0.0-12.2.1.3.0-12.2.1.4.0-LFI.html","https://www.oracle.com/security-alerts/cpuoct2020.html","https://nvd.nist.gov/vuln/detail/CVE-2020-14864","https://github.com/merlinepedra/nuclei-templates","https://github.com/sobinge/nuclei-templates"]},{"tag_id":"CVE-2023-38646","tag_type":"cve","title":"Metabase < 0.46.6.1 - Remote Code Execution","severity":"critical","actively_exploited":false,"match_field":"url_path","matched_pattern":"/api/session/properties","reference_urls":["https://www.metabase.com/blog/security-advisory","https://github.com/metabase/metabase/releases/tag/v0.46.6.1","https://mp.weixin.qq.com/s/ATFwFl-D8k9QfQfzKjZFDg","https://news.ycombinator.com/item?id=36812256","https://blog.assetnote.io/2023/07/22/pre-auth-rce-metabase/"]},{"tag_id":"CVE-2024-23917","tag_type":"cve","title":"JetBrains TeamCity > 2023.11.3 - Authentication Bypass","severity":"critical","actively_exploited":false,"match_field":"url_path","matched_pattern":"/app/rest/server","reference_urls":["https://github.com/fkie-cad/nvd-json-data-feeds","https://www.rapid7.com/db/vulnerabilities/jetbrains-teamcity-cve-2024-23917/"]},{"tag_id":"CVE-2024-25723","tag_type":"cve","title":"ZenML ZenML Server - Improper Authentication","severity":"critical","actively_exploited":false,"match_field":"url_path","matched_pattern":"/api/v1/info","reference_urls":["https://www.zenml.io/blog/critical-security-update-for-zenml-users","https://github.com/zenml-io/zenml","https://github.com/zenml-io/zenml/compare/0.42.1...0.42.2","https://github.com/zenml-io/zenml/compare/0.43.0...0.43.1","https://github.com/zenml-io/zenml/compare/0.44.3...0.44.4"]},{"tag_id":"CVE-2024-30569","tag_type":"cve","title":"Netgear R6850 - Information Disclosure","severity":"high","actively_exploited":false,"match_field":"url_path","matched_pattern":"/currentsetting.htm","reference_urls":["https://github.com/funny-mud-peee/IoT-vuls/blob/main/netgear%20R6850/Info%20Leak%20in%20Netgear-R6850%EF%BC%88currentsetting.htm%EF%BC%89.md","https://nvd.nist.gov/vuln/detail/CVE-2024-30569","https://www.netgear.com/about/security/"]},{"tag_id":"CVE-2026-25892","tag_type":"cve","title":"Adminer 4.6.2 - 5.4.1 Unauthenticated Persistent DoS","severity":"high","actively_exploited":false,"match_field":"url_path","matched_pattern":"/adminer.php","reference_urls":["https://github.com/vrana/adminer/security/advisories/GHSA-q4f2-39gr-45jh","https://github.com/vrana/adminer/commit/21d3a3150388677b18647d68aec93b7850e457d3"]},{"tag_id":"CVE-2026-35029","tag_type":"cve","title":"LiteLLM - Arbitrary File Read","severity":"high","actively_exploited":false,"match_field":"url_path","matched_pattern":"/health/liveliness","reference_urls":["https://github.com/BerriAI/litellm","https://sec-consult.com/vulnerability-lab/advisory/broken-access-control-in-config-endpoint-in-litellm/","https://nvd.nist.gov/vuln/detail/CVE-2026-35029"]},{"tag_id":"CVE-2007-4556","tag_type":"cve","title":"OpenSymphony XWork/Apache Struts2 - Remote Code Execution","severity":"medium","actively_exploited":false,"match_field":"url_path","matched_pattern":"/login.action","reference_urls":["https://www.guildhab.top/?p=2326","https://nvd.nist.gov/vuln/detail/CVE-2007-4556","https://cwiki.apache.org/confluence/display/WW/S2-001","http://forums.opensymphony.com/ann.jspa?annID=54","http://issues.apache.org/struts/browse/WW-2030"]},{"tag_id":"CVE-2025-2129","tag_type":"cve","title":"Mage AI - Insecure Default Authentication Setup","severity":"medium","actively_exploited":false,"match_field":"url_path","matched_pattern":"/api/kernels","reference_urls":["https://nvd.nist.gov/vuln/detail/CVE-2025-2129","https://github.com/zn9988/publications/blob/main/2.Mage-AI%20-%20Insecure%20Default%20Authentication%20Setup%20Leading%20to%20Zero-Click%20RCE/README.md","https://vuldb.com/?ctiid.299049","https://vuldb.com/?id.299049","https://vuldb.com/?submit.510690"]}],"data_as_of":"2026-09-30T17:35:44.546257+00:00"}