{"ip":"85.122.114.177","total_events":32,"verdict":{"verdict":"probing","label":"Low-level probing","detail":null,"confidence":"low","network_type":"enterprise","why":["32 event(s), fewer than 10 distinct ports, no exploit payloads.","Not in any known-scanner range."]},"first_seen":"2026-04-11T08:08:29","last_seen":"2026-04-13T23:34:01","events_24h":0,"events_7d":0,"geo":{"country_code":"RO","country_name":"","region":"","city":"","lat":45.9968,"lon":24.997,"asn":200019,"org":"Alexhost Srl"},"source_domain":"ninjabing.com","known_scanners":[],"scanner_tag":{"key":"peeringdb:as200019","label":"AlexHost","category":"enterprise","url":"https://www.peeringdb.com/asn/200019"},"cve_matches":[{"cve_id":"CVE-2026-41940","title":"cPanel & WHM - Authentication Bypass via Session-File CRLF Injection","severity":"CRITICAL","actively_exploited":true,"match_field":"url_path","matched_pattern":"/login/?login_only=1"}],"malware":[],"top_ports":[{"port":2087,"proto":"tcp","label":"","count":32}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i3713h1_91ec122131b4_97a66a8f4cb1"],"tls_ja3":[],"ja4h":["po11nn0800_7f1c8260dcfe"]},"fingerprint_peers":{},"user_agents":["Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:90.0) Gecko/20100101 Firefox/90.0"],"timeline":[],"recent_events":[{"timestamp":"2026-04-13T23:34:01","port":2087,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"","summary":"user=root&pass=92UoRGmHNpYf&goto_uri=%2F","payload_hex":"757365723d726f6f7426706173733d3932556f52476d484e70596626676f746f5f7572693d253246","method":"","user_agent":"","community_id":"1:VaQQ08C4E0QyFfqYcjo5Q0SekVo=","ja3":"","session":"6650fb4d-784f-4592-91fd-6592d23d7d5d","seq":0,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"5790b79b581a154c","strings":["user=root&pass=92UoRGmHNpYf&goto_uri=%2F"]}},{"timestamp":"2026-04-13T23:34:01","port":2087,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate\",\"connection\":\"keep-alive\",\"content-length\":\"40\",\"content-type\":\"application/x-www-form-urlencoded\",\"host\":\"<HONEYPOT>:2087\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:90.0) Gecko/20100101 Firefox/90.0\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"/login/?login_only=1","summary":"","payload_hex":"504f5354202f6c6f67696e2f3f6c6f67696e5f6f6e6c793d3120485454502f312e310d0a486f73743a20<HONEYPOT>3a323038370d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b207836343b2072763a39302e3029204765636b6f2f32303130303130312046697265666f782f39302e300d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a436f6e74656e742d547970653a206170706c69636174696f6e2f782d7777772d666f726d2d75726c656e636f6465640d0a557067726164652d496e7365637572652d52657175657374733a20310d0a436f6e74656e742d4c656e6774683a2034300d0a0d0a","method":"POST","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:90.0) Gecko/20100101 Firefox/90.0","community_id":"1:VaQQ08C4E0QyFfqYcjo5Q0SekVo=","ja3":"","session":"6650fb4d-784f-4592-91fd-6592d23d7d5d","seq":0,"duration_ms":0,"bytes_in":0,"bytes_out":0},{"timestamp":"2026-04-13T23:33:58","port":2087,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"","summary":"user=root&pass=92UoRGmHNpYf&goto_uri=%2F","payload_hex":"757365723d726f6f7426706173733d3932556f52476d484e70596626676f746f5f7572693d253246","method":"","user_agent":"","community_id":"1:5nAdxlU0CkAUKGFvB/eFXcZSvnw=","ja3":"","session":"b2621f81-69b7-48dd-902f-0e896f204509","seq":0,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"5790b79b581a154c","strings":["user=root&pass=92UoRGmHNpYf&goto_uri=%2F"]}},{"timestamp":"2026-04-13T23:33:58","port":2087,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate\",\"connection\":\"keep-alive\",\"content-length\":\"40\",\"content-type\":\"application/x-www-form-urlencoded\",\"host\":\"<HONEYPOT>:2087\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:90.0) Gecko/20100101 Firefox/90.0\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"/login/?login_only=1","summary":"","payload_hex":"504f5354202f6c6f67696e2f3f6c6f67696e5f6f6e6c793d3120485454502f312e310d0a486f73743a20<HONEYPOT>3a323038370d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b207836343b2072763a39302e3029204765636b6f2f32303130303130312046697265666f782f39302e300d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a436f6e74656e742d547970653a206170706c69636174696f6e2f782d7777772d666f726d2d75726c656e636f6465640d0a557067726164652d496e7365637572652d52657175657374733a20310d0a436f6e74656e742d4c656e6774683a2034300d0a0d0a","method":"POST","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:90.0) Gecko/20100101 Firefox/90.0","community_id":"1:5nAdxlU0CkAUKGFvB/eFXcZSvnw=","ja3":"","session":"b2621f81-69b7-48dd-902f-0e896f204509","seq":0,"duration_ms":0,"bytes_in":0,"bytes_out":0},{"timestamp":"2026-04-13T23:28:11","port":2087,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"","summary":"user=root&pass=92UoRGmHNpYf&goto_uri=%2F","payload_hex":"757365723d726f6f7426706173733d3932556f52476d484e70596626676f746f5f7572693d253246","method":"","user_agent":"","community_id":"1:McrXAIy5Xnj+keJM0HtCHZkr1t8=","ja3":"","session":"4de1987d-ccc5-4898-b131-0e828a540f24","seq":0,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"5790b79b581a154c","strings":["user=root&pass=92UoRGmHNpYf&goto_uri=%2F"]}},{"timestamp":"2026-04-13T23:28:11","port":2087,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate\",\"connection\":\"keep-alive\",\"content-length\":\"40\",\"content-type\":\"application/x-www-form-urlencoded\",\"host\":\"<HONEYPOT>:2087\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:90.0) Gecko/20100101 Firefox/90.0\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"/login/?login_only=1","summary":"","payload_hex":"504f5354202f6c6f67696e2f3f6c6f67696e5f6f6e6c793d3120485454502f312e310d0a486f73743a20<HONEYPOT>3a323038370d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b207836343b2072763a39302e3029204765636b6f2f32303130303130312046697265666f782f39302e300d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a436f6e74656e742d547970653a206170706c69636174696f6e2f782d7777772d666f726d2d75726c656e636f6465640d0a557067726164652d496e7365637572652d52657175657374733a20310d0a436f6e74656e742d4c656e6774683a2034300d0a0d0a","method":"POST","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:90.0) Gecko/20100101 Firefox/90.0","community_id":"1:McrXAIy5Xnj+keJM0HtCHZkr1t8=","ja3":"","session":"4de1987d-ccc5-4898-b131-0e828a540f24","seq":0,"duration_ms":0,"bytes_in":0,"bytes_out":0},{"timestamp":"2026-04-13T23:06:38","port":2087,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"","summary":"user=root&pass=92UoRGmHNpYf&goto_uri=%2F","payload_hex":"757365723d726f6f7426706173733d3932556f52476d484e70596626676f746f5f7572693d253246","method":"","user_agent":"","community_id":"1:D3IAqwItj0EhKVMcULySp0Hdwlw=","ja3":"","session":"c8e4d6d9-966d-4294-8dc2-007007749bb7","seq":0,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"5790b79b581a154c","strings":["user=root&pass=92UoRGmHNpYf&goto_uri=%2F"]}},{"timestamp":"2026-04-13T23:06:38","port":2087,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate\",\"connection\":\"keep-alive\",\"content-length\":\"40\",\"content-type\":\"application/x-www-form-urlencoded\",\"host\":\"<HONEYPOT>:2087\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:90.0) Gecko/20100101 Firefox/90.0\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"/login/?login_only=1","summary":"","payload_hex":"504f5354202f6c6f67696e2f3f6c6f67696e5f6f6e6c793d3120485454502f312e310d0a486f73743a20<HONEYPOT>3a323038370d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b207836343b2072763a39302e3029204765636b6f2f32303130303130312046697265666f782f39302e300d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a436f6e74656e742d547970653a206170706c69636174696f6e2f782d7777772d666f726d2d75726c656e636f6465640d0a557067726164652d496e7365637572652d52657175657374733a20310d0a436f6e74656e742d4c656e6774683a2034300d0a0d0a","method":"POST","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:90.0) Gecko/20100101 Firefox/90.0","community_id":"1:D3IAqwItj0EhKVMcULySp0Hdwlw=","ja3":"","session":"c8e4d6d9-966d-4294-8dc2-007007749bb7","seq":0,"duration_ms":0,"bytes_in":0,"bytes_out":0},{"timestamp":"2026-04-12T22:33:24","port":2087,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"","summary":"user=root&pass=226677&goto_uri=%2F","payload_hex":"757365723d726f6f7426706173733d32323636373726676f746f5f7572693d253246","method":"","user_agent":"","community_id":"1:q4rgij6np5O7STf9owS+EqAWgSY=","ja3":"","session":"6b253e65-8f12-4883-a1d8-6428f3c6c816","seq":0,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"983b1ae136b8900e","strings":["user=root&pass=226677&goto_uri=%2F"]}},{"timestamp":"2026-04-12T22:33:24","port":2087,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate\",\"connection\":\"keep-alive\",\"content-length\":\"34\",\"content-type\":\"application/x-www-form-urlencoded\",\"host\":\"<HONEYPOT>:2087\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:90.0) Gecko/20100101 Firefox/90.0\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"/login/?login_only=1","summary":"","payload_hex":"504f5354202f6c6f67696e2f3f6c6f67696e5f6f6e6c793d3120485454502f312e310d0a486f73743a20<HONEYPOT>3a323038370d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b207836343b2072763a39302e3029204765636b6f2f32303130303130312046697265666f782f39302e300d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a436f6e74656e742d547970653a206170706c69636174696f6e2f782d7777772d666f726d2d75726c656e636f6465640d0a557067726164652d496e7365637572652d52657175657374733a20310d0a436f6e74656e742d4c656e6774683a2033340d0a0d0a","method":"POST","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:90.0) Gecko/20100101 Firefox/90.0","community_id":"1:q4rgij6np5O7STf9owS+EqAWgSY=","ja3":"","session":"6b253e65-8f12-4883-a1d8-6428f3c6c816","seq":0,"duration_ms":0,"bytes_in":0,"bytes_out":0}],"http_methods":[{"method":"POST","count":16}],"distinct_ports_total":1,"top_paths":[{"path":"/login/?login_only=1","count":16,"ports":1}],"distinct_paths_total":1,"top_snis":[],"top_hosts":[],"top_alpns":[{"value":"http/1.1","count":32}],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","Accept-Encoding","Connection","Content-Length","Content-Type","Host","Upgrade-Insecure-Requests","User-Agent"],"representative":[{"name":"Accept","value":"*/*","notable":false},{"name":"Accept-Encoding","value":"gzip, deflate","notable":false},{"name":"Connection","value":"keep-alive","notable":false},{"name":"Content-Length","value":"40","notable":false},{"name":"Content-Type","value":"application/x-www-form-urlencoded","notable":true},{"name":"Host","value":"<HONEYPOT>:2087","notable":false},{"name":"Upgrade-Insecure-Requests","value":"1","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:90.0) Gecko/20100101 Firefox/90.0","notable":false}],"distinct_sets":1,"events_with_headers":5},"tags":[{"tag_id":"CVE-2026-41940","tag_type":"cve","title":"cPanel & WHM - Authentication Bypass via Session-File CRLF Injection","severity":"CRITICAL","actively_exploited":true,"match_field":"url_path","matched_pattern":"/login/?login_only=1","reference_urls":[]}],"data_as_of":"2026-07-23T13:02:20.096259+00:00"}