{"ip":"78.128.114.22","total_events":8,"verdict":{"verdict":"probing","label":"Low-level probing","detail":null,"confidence":"low","network_type":"residential ISP","why":["8 event(s), fewer than 10 distinct ports, no exploit payloads.","Not in any known-scanner range."],"engagement":{"level":"request","label":"Request traffic","detail":"1,627 bytes sent","bytes_sent":1627,"session_seconds":0,"persistent":false}},"first_seen":"2026-08-04T01:27:43","last_seen":"2026-09-23T16:54:08","events_24h":0,"events_7d":3,"geo":{"country_code":"BG","country_name":"Bulgaria","region":"","city":"","lat":42.696,"lon":23.332,"asn":50360,"org":"Tamatiya EOOD"},"source_domain":"ip-114-22.4vendeta.com","known_scanners":[],"scanner_tag":{"key":"peeringdb:as50360","label":"4vendeta","category":"isp","url":"https://www.peeringdb.com/asn/50360"},"cve_matches":[{"cve_id":"CVE-2024-1709","title":"ConnectWise ScreenConnect 23.9.7 - Authentication Bypass","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/SetupWizard.aspx"}],"malware":[],"top_ports":[{"port":8040,"proto":"tcp","label":"","count":5},{"port":9191,"proto":"tcp","label":"","count":2},{"port":18190,"proto":"tcp","label":"","count":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":["b11cun050_0004001e_00ecc3a8"]},"fingerprint_peers":{"b11cun050_0004001e_00ecc3a8":84},"akin_families":{},"user_agents":["Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.0.3 Safari/605.1.15","Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0","Mozilla/5.0 (Kubuntu; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36","Mozilla/5.0 (Macintosh; Intel Mac OS X 13_5_2) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.0 Safari/605.1.15","Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:139.0) Gecko/20100101 Firefox/139.0","Mozilla/5.0 (Windows NT 5.1; rv:52.0) Gecko/20100101 Firefox/52.0","Mozilla/5.0 (SS; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36"],"timeline":[{"date":"2026-08-04","count":1},{"date":"2026-09-02","count":2},{"date":"2026-09-03","count":2},{"date":"2026-09-23","count":3}],"recent_events":[{"timestamp":"2026-09-23T16:54:08","port":8040,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"accept-language\":\"en\",\"host\":\"<HONEYPOT>:8040\",\"user-agent\":\"Mozilla/5.0 (Kubuntu; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/SetupWizard.aspx/YhnYjQmAZs","summary":"","payload_hex":"474554202f536574757057697a6172642e617370782f59686e596a516d415a7320485454502f312e310d0a486f73743a20<HONEYPOT>3a383034300d0a557365722d4167656e743a204d6f7a696c6c612f352e3020284b7562756e74753b204c696e7578207838365f363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3133372e302e302e30205361666172692f3533372e33360d0a4163636570743a202a2f2a0d0a4163636570742d4c616e67756167653a20656e0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Kubuntu; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36","ja3":"","session":"793b5cbf-ad7e-4cd9-b5a0-c8dda44b14f2","seq":1,"duration_ms":101,"bytes_in":247,"bytes_out":78},{"timestamp":"2026-09-23T16:11:18","port":8040,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"accept-language\":\"en\",\"host\":\"<HONEYPOT>:8040\",\"user-agent\":\"Mozilla/5.0 (SS; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/SetupWizard.aspx/YhnYjQmAZs","summary":"","payload_hex":"474554202f536574757057697a6172642e617370782f59686e596a516d415a7320485454502f312e310d0a486f73743a20<HONEYPOT>3a383034300d0a557365722d4167656e743a204d6f7a696c6c612f352e30202853533b204c696e7578207838365f363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3133332e302e302e30205361666172692f3533372e33360d0a4163636570743a202a2f2a0d0a4163636570742d4c616e67756167653a20656e0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (SS; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36","ja3":"","session":"284b3bc1-4aca-4a5e-87e5-fc2e61a650fd","seq":1,"duration_ms":100,"bytes_in":241,"bytes_out":78},{"timestamp":"2026-09-23T15:55:13","port":8040,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"accept-language\":\"en\",\"host\":\"<HONEYPOT>:8040\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/SetupWizard.aspx/YhnYjQmAZs","summary":"","payload_hex":"474554202f536574757057697a6172642e617370782f59686e596a516d415a7320485454502f312e310d0a486f73743a20<HONEYPOT>3a383034300d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b207836343b2072763a39392e3029204765636b6f2f32303130303130312046697265666f782f39392e300d0a4163636570743a202a2f2a0d0a4163636570742d4c616e67756167653a20656e0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0","ja3":"","session":"bf9d83ca-be7c-4821-8e25-070e322e157b","seq":1,"duration_ms":100,"bytes_in":220,"bytes_out":78},{"timestamp":"2026-09-03T16:01:12","port":8040,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"accept-language\":\"en\",\"host\":\"<HONEYPOT>:8040\",\"user-agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.0.3 Safari/605.1.15\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/SetupWizard.aspx/VLDQqJcRHP","summary":"","payload_hex":"474554202f536574757057697a6172642e617370782f564c4451714a6352485020485454502f312e310d0a486f73743a20<HONEYPOT>3a383034300d0a557365722d4167656e743a204d6f7a696c6c612f352e3020284d6163696e746f73683b20496e74656c204d6163204f5320582031305f31345f3629204170706c655765624b69742f3630352e312e313520284b48544d4c2c206c696b65204765636b6f292056657273696f6e2f31332e302e33205361666172692f3630352e312e31350d0a4163636570743a202a2f2a0d0a4163636570742d4c616e67756167653a20656e0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.0.3 Safari/605.1.15","ja3":"","session":"5f651b3f-0c3d-42f4-9737-4f68fabdacdc","seq":1,"duration_ms":100,"bytes_in":260,"bytes_out":78},{"timestamp":"2026-09-03T16:01:12","port":8040,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"accept-language\":\"en\",\"host\":\"<HONEYPOT>:8040\",\"user-agent\":\"Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:139.0) Gecko/20100101 Firefox/139.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/SetupWizard.aspx/VLDQqJcRHP","summary":"","payload_hex":"474554202f536574757057697a6172642e617370782f564c4451714a6352485020485454502f312e310d0a486f73743a20<HONEYPOT>3a383034300d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b205562756e74753b204c696e7578207838365f36343b2072763a3133392e3029204765636b6f2f32303130303130312046697265666f782f3133392e300d0a4163636570743a202a2f2a0d0a4163636570742d4c616e67756167653a20656e0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:139.0) Gecko/20100101 Firefox/139.0","ja3":"","session":"68ad6cde-28d9-4913-b2a9-3e1b78c2a239","seq":1,"duration_ms":100,"bytes_in":219,"bytes_out":78},{"timestamp":"2026-09-02T05:21:52","port":9191,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"accept-language\":\"en\",\"host\":\"<HONEYPOT>:9191\",\"user-agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 13_5_2) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.0 Safari/605.1.15\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/user","summary":"","payload_hex":"474554202f7573657220485454502f312e310d0a486f73743a20<HONEYPOT>3a393139310d0a557365722d4167656e743a204d6f7a696c6c612f352e3020284d6163696e746f73683b20496e74656c204d6163204f5320582031335f355f3229204170706c655765624b69742f3630352e312e313520284b48544d4c2c206c696b65204765636b6f292056657273696f6e2f31372e30205361666172692f3630352e312e31350d0a4163636570743a202a2f2a0d0a4163636570742d4c616e67756167653a20656e0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 13_5_2) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.0 Safari/605.1.15","ja3":"","session":"84eae815-2d80-4005-a320-bc696b0e7f24","seq":1,"duration_ms":101,"bytes_in":234,"bytes_out":78},{"timestamp":"2026-09-02T05:21:52","port":9191,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"accept-language\":\"en\",\"host\":\"<HONEYPOT>:9191\",\"user-agent\":\"Mozilla/5.0 (Windows NT 5.1; rv:52.0) Gecko/20100101 Firefox/52.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/user","summary":"","payload_hex":"474554202f7573657220485454502f312e310d0a486f73743a20<HONEYPOT>3a393139310d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e5420352e313b2072763a35322e3029204765636b6f2f32303130303130312046697265666f782f35322e300d0a4163636570743a202a2f2a0d0a4163636570742d4c616e67756167653a20656e0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 5.1; rv:52.0) Gecko/20100101 Firefox/52.0","ja3":"","session":"c3494620-7e8f-47c2-9870-b6040db16b16","seq":1,"duration_ms":100,"bytes_in":183,"bytes_out":78},{"timestamp":"2026-08-04T01:27:43","port":18190,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"Q\u0000\u0000\u0000\u0000\u0000\u0000!\u0000\u0000\u0000\u000bsecuremote\u0000","payload_hex":"51000000000000210000000b7365637572656d6f746500","method":"","user_agent":"","ja3":"","session":"262be250-a212-40c5-936e-fe846c33caf3","seq":1,"duration_ms":100,"bytes_in":23,"bytes_out":13,"enriched":{"digest":"6ebc5ca485a203a3","strings":["securemote"]}}],"http_methods":[{"method":"GET","count":7}],"distinct_ports_total":3,"top_paths":[{"path":"/SetupWizard.aspx/YhnYjQmAZs","count":3,"ports":1},{"path":"/user","count":2,"ports":1},{"path":"/SetupWizard.aspx/VLDQqJcRHP","count":2,"ports":1}],"distinct_paths_total":3,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","Accept-Encoding","Accept-Language","Host","User-Agent"],"representative":[{"name":"Accept","value":"*/*","notable":false},{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Accept-Language","value":"en","notable":false},{"name":"Host","value":"<HONEYPOT>:8040","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (Kubuntu; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36","notable":false}],"distinct_sets":1,"events_with_headers":7},"tags":[{"tag_id":"CVE-2024-1709","tag_type":"cve","title":"ConnectWise ScreenConnect 23.9.7 - Authentication Bypass","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/SetupWizard.aspx","reference_urls":["https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screenconnect-authentication-bypass","https://github.com/watchtowrlabs/connectwise-screenconnect_auth-bypass-add-user-poc","https://www.connectwise.com/company/trust/security-bulletins/connectwise-screenconnect-23.9.8","https://nvd.nist.gov/vuln/detail/CVE-2024-1709","https://github.com/rapid7/metasploit-framework/pull/18870"]}],"data_as_of":"2026-09-30T09:59:41.172014+00:00"}