{"ip":"85.209.88.76","total_events":34,"verdict":{"verdict":"malicious","label":"Exploit attempts observed","detail":"1 exploit-path hits","confidence":"high","network_type":null,"why":["1 request(s) matched a known exploit path.","Body-carrying methods (POST/PUT/PATCH/DELETE) seen: payload delivery, not just recon.","Under 5 hits, so confidence is medium.","Not in any known-scanner range.","Sent 15,637 bytes: sustained payload delivery, not a single opportunistic request."],"engagement":{"level":"payload","label":"Sustained payload","detail":"15,637 bytes sent","bytes_sent":15637,"session_seconds":1,"persistent":false}},"first_seen":"2026-08-10T15:58:09","last_seen":"2026-08-11T11:40:46","events_24h":0,"events_7d":34,"geo":{"country_code":"NL","country_name":"The Netherlands","region":"Flevoland","city":"Dronten","lat":52.5281,"lon":5.7137,"asn":204601,"org":"NovoServe B.V."},"source_domain":"vm2492466.42ssd.had.wf","known_scanners":[],"scanner_tag":null,"cve_matches":[{"cve_id":"CVE-2022-40684","title":"Fortinet - Authentication Bypass","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/api/v2/cmdb/system/admin"},{"cve_id":"CVE-2025-64446","title":"FortiWeb - Authentication Bypass","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/api/v2.0/cmdb/system/admin%3f/../../../../../cgi-bin/fwbcgi"},{"cve_id":"CVE-2022-39952","title":"Fortinet FortiNAC - Arbitrary File Write","severity":"critical","actively_exploited":false,"match_field":"url_path","matched_pattern":"/configWizard/keyUpload.jsp"},{"cve_id":"CVE-2017-3132","title":"Fortinet FortiOS < 5.6.0 - Cross-Site Scripting","severity":"medium","actively_exploited":false,"match_field":"url_path","matched_pattern":"/p/user/ftoken/activate/user/guest/?action=%3C/script%3E%3Cscript%3Ealert(document.domain)%3C/script%3E%3Cscript%3E"}],"malware":[],"top_ports":[{"port":443,"proto":"tcp","label":"HTTPS","count":18},{"port":1443,"proto":"tcp","label":"","count":16}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i251000_b78ed14e2fd0_ab7e3b40a677"],"tls_ja3":["11a384388ad36777e1a2e121495037fe"],"ja4h":["ge11nn0400_91d9e55fb80a","po11nn0600_3ff20af8936e","ge11nn05en_813e32c09d15","po11nn07en_1d30a0c2f807"]},"fingerprint_peers":{"t13i251000_b78ed14e2fd0_ab7e3b40a677":69,"ge11nn05en_813e32c09d15":32,"po11nn07en_1d30a0c2f807":3,"po11nn0600_3ff20af8936e":2,"ge11nn0400_91d9e55fb80a":32},"user_agents":["Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:137.0) Gecko/20100101 Firefox/137.0","Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/111.0","Mozilla/5.0 (Macintosh, Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.6.1 Safari/605.1.15","Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0","Mozilla/5.0 (Fedora; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36","Mozilla/5.0 (Fedora; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36","Mozilla/5.0 (X11; Linux i686; rv:1.9.5.20) Gecko/ Firefox/3.8"],"timeline":[{"date":"2026-08-10","count":2},{"date":"2026-08-11","count":32}],"recent_events":[{"timestamp":"2026-08-11T11:40:46","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"accept-language\":\"en\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64; rv:138.0) Gecko/20100101 Firefox/138.0\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f36343b2072763a3133382e3029204765636b6f2f32303130303130312046697265666f782f3133382e300d0a4163636570743a202a2f2a0d0a4163636570742d4c616e67756167653a20656e0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64; rv:138.0) Gecko/20100101 Firefox/138.0","ja3":"11a384388ad36777e1a2e121495037fe","session":"721061bb-0cbe-477e-9896-513bc971c921","seq":1,"duration_ms":106,"bytes_in":180,"bytes_out":77},{"timestamp":"2026-08-11T11:40:46","port":1443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"accept-language\":\"en\",\"host\":\"<HONEYPOT>:1443\",\"user-agent\":\"Mozilla/5.0 (X11; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a313434330d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578206936383629204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3133352e302e302e30205361666172692f3533372e33360d0a4163636570743a202a2f2a0d0a4163636570742d4c616e67756167653a20656e0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36","ja3":"11a384388ad36777e1a2e121495037fe","session":"f261ff0f-fb3e-4cb3-ac44-bb70e98bec0b","seq":1,"duration_ms":103,"bytes_in":214,"bytes_out":77},{"timestamp":"2026-08-11T11:29:51","port":1443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"accept-language\":\"en\",\"host\":\"<HONEYPOT>:1443\",\"user-agent\":\"Mozilla/5.0 (Fedora; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a313434330d0a557365722d4167656e743a204d6f7a696c6c612f352e3020284665646f72613b204c696e7578207838365f363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3133332e302e302e30205361666172692f3533372e33360d0a4163636570743a202a2f2a0d0a4163636570742d4c616e67756167653a20656e0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Fedora; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36","ja3":"11a384388ad36777e1a2e121495037fe","session":"71a9a880-6bf4-4cb2-9b5a-d011355f4b2a","seq":2,"duration_ms":1082,"bytes_in":406,"bytes_out":154},{"timestamp":"2026-08-11T11:29:51","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"accept-language\":\"en\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.3\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e3020284d6163696e746f73683b20496e74656c204d6163204f5320582031302e31353b2072763a3132382e3029204765636b6f2f32303130303130312046697265666f782f3132382e330d0a4163636570743a202a2f2a0d0a4163636570742d4c616e67756167653a20656e0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.3","ja3":"11a384388ad36777e1a2e121495037fe","session":"2ae01293-6619-4f97-a7de-597e051c6a19","seq":2,"duration_ms":1061,"bytes_in":408,"bytes_out":154},{"timestamp":"2026-08-11T11:29:50","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"accept-language\":\"en\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (Fedora; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/m/","summary":"","payload_hex":"474554202f6d2f20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e3020284665646f72613b204c696e7578206936383629204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3134322e302e302e30205361666172692f3533372e33360d0a4163636570743a202a2f2a0d0a4163636570742d4c616e67756167653a20656e0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Fedora; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36","ja3":"11a384388ad36777e1a2e121495037fe","session":"2ae01293-6619-4f97-a7de-597e051c6a19","seq":1,"duration_ms":100,"bytes_in":214,"bytes_out":77},{"timestamp":"2026-08-11T11:29:50","port":1443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"accept-language\":\"en\",\"host\":\"<HONEYPOT>:1443\",\"user-agent\":\"Mozilla/5.0 (Windows NT 6.1; WOW64; rv:8.0) Gecko/20100101 Firefox/8.0\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/m/","summary":"","payload_hex":"474554202f6d2f20485454502f312e310d0a486f73743a20<HONEYPOT>3a313434330d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e5420362e313b20574f5736343b2072763a382e3029204765636b6f2f32303130303130312046697265666f782f382e300d0a4163636570743a202a2f2a0d0a4163636570742d4c616e67756167653a20656e0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 6.1; WOW64; rv:8.0) Gecko/20100101 Firefox/8.0","ja3":"11a384388ad36777e1a2e121495037fe","session":"71a9a880-6bf4-4cb2-9b5a-d011355f4b2a","seq":1,"duration_ms":100,"bytes_in":187,"bytes_out":77},{"timestamp":"2026-08-11T11:17:41","port":1443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"accept-language\":\"en\",\"host\":\"<HONEYPOT>:1443\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:103.0) Gecko/20100101 Firefox/103.0\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/login?redir=/ng","summary":"","payload_hex":"474554202f6c6f67696e3f72656469723d2f6e6720485454502f312e310d0a486f73743a20<HONEYPOT>3a313434330d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b207836343b2072763a3130332e3029204765636b6f2f32303130303130312046697265666f782f3130332e300d0a4163636570743a202a2f2a0d0a4163636570742d4c616e67756167653a20656e0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:103.0) Gecko/20100101 Firefox/103.0","ja3":"11a384388ad36777e1a2e121495037fe","session":"4673b719-69de-4be9-b041-3f9aadf5a659","seq":2,"duration_ms":917,"bytes_in":1795,"bytes_out":154},{"timestamp":"2026-08-11T11:17:41","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"accept-language\":\"en\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_6) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/15.6 Safari/605.1.15\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/login?redir=/ng","summary":"","payload_hex":"474554202f6c6f67696e3f72656469723d2f6e6720485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e3020284d6163696e746f73683b20496e74656c204d6163204f5320582031305f31355f3629204170706c655765624b69742f3630352e312e313520284b48544d4c2c206c696b65204765636b6f292056657273696f6e2f31352e36205361666172692f3630352e312e31350d0a4163636570743a202a2f2a0d0a4163636570742d4c616e67756167653a20656e0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_6) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/15.6 Safari/605.1.15","ja3":"11a384388ad36777e1a2e121495037fe","session":"af10f7e5-65d8-403a-8284-78caf19c82cf","seq":2,"duration_ms":882,"bytes_in":447,"bytes_out":154},{"timestamp":"2026-08-11T11:17:40","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"accept-language\":\"en\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (Debian; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/api/v1","summary":"","payload_hex":"474554202f6170692f763120485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e30202844656269616e3b204c696e7578206936383629204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3133332e302e302e30205361666172692f3533372e33360d0a4163636570743a202a2f2a0d0a4163636570742d4c616e67756167653a20656e0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Debian; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36","ja3":"11a384388ad36777e1a2e121495037fe","session":"28596755-503e-440c-b648-ffeb7378b350","seq":1,"duration_ms":115,"bytes_in":218,"bytes_out":77},{"timestamp":"2026-08-11T11:17:40","port":1443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:1443\",\"user-agent\":\"Mozilla/5.0 (X11; Linux i686; rv:1.9.5.20) Gecko/ Firefox/3.6.20\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/api/v2/cmdb/system/admin/admin","summary":"","payload_hex":"474554202f6170692f76322f636d64622f73797374656d2f61646d696e2f61646d696e20485454502f312e310d0a486f73743a20<HONEYPOT>3a313434330d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b204c696e757820693638363b2072763a312e392e352e323029204765636b6f2f2046697265666f782f332e362e32300d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux i686; rv:1.9.5.20) Gecko/ Firefox/3.6.20","ja3":"11a384388ad36777e1a2e121495037fe","session":"e121bed5-5069-4d09-b2ad-759127b97019","seq":1,"duration_ms":119,"bytes_in":175,"bytes_out":77}],"http_methods":[{"method":"GET","count":22},{"method":"POST","count":4}],"distinct_ports_total":2,"top_paths":[{"path":"/","count":4,"ports":2},{"path":"/login?redir=/ng","count":4,"ports":2},{"path":"/m/","count":2,"ports":2},{"path":"/api/v1","count":2,"ports":2},{"path":"/p/user/ftoken/activate/user/guest/?action=%3C/script%3E%3Cscript%3Ealert(document.domain)%3C/script%3E%3Cscript%3E","count":2,"ports":2},{"path":"/api/v2.0/cmdb/system/admin%3f/../../../../../cgi-bin/fwbcgi","count":2,"ports":2},{"path":"/remote/login?err=--%3E%3Cscript%3Ealert('3HlTQD83WHF15TZl92pFF8xrrTR')%3C/script%3E%3C!--&lang=en","count":2,"ports":2},{"path":"/api/v2/cmdb/system/admin/admin","count":2,"ports":2},{"path":"/api/fabric/device/status","count":2,"ports":2},{"path":"/configWizard/keyUpload.jsp","count":2,"ports":2},{"path":"/sslmgr","count":1,"ports":1},{"path":"/global-protect/login.esp","count":1,"ports":1}],"distinct_paths_total":12,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","Accept-Encoding","Accept-Language","Host","User-Agent"],"representative":[{"name":"Accept","value":"*/*","notable":false},{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Accept-Language","value":"en","notable":false},{"name":"Host","value":"<HONEYPOT>","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (X11; Linux x86_64; rv:138.0) Gecko/20100101 Firefox/138.0","notable":false}],"distinct_sets":2,"events_with_headers":10},"tags":[{"tag_id":"CVE-2022-40684","tag_type":"cve","title":"Fortinet - Authentication Bypass","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/api/v2/cmdb/system/admin","reference_urls":["https://github.com/horizon3ai/CVE-2022-40684/blob/master/CVE-2022-40684.py","https://securityonline.info/researchers-have-developed-cve-2022-40684-poc-exploit-code/","https://socradar.io/what-do-you-need-to-know-about-fortinet-critical-authentication-bypass-vulnerability-cve-2022-40684/","https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-40684","https://nvd.nist.gov/vuln/detail/CVE-2022-40684"]},{"tag_id":"CVE-2025-64446","tag_type":"cve","title":"FortiWeb - Authentication Bypass","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/api/v2.0/cmdb/system/admin%3f/../../../../../cgi-bin/fwbcgi","reference_urls":["https://nvd.nist.gov/vuln/detail/CVE-2025-64446","https://x.com/defusedcyber/status/1975242250373517373","https://github.com/watchtowrlabs/watchTowr-vs-Fortiweb-AuthBypass","https://github.com/rapid7/metasploit-framework/pull/20698/files"]},{"tag_id":"CVE-2022-39952","tag_type":"cve","title":"Fortinet FortiNAC - Arbitrary File Write","severity":"critical","actively_exploited":false,"match_field":"url_path","matched_pattern":"/configWizard/keyUpload.jsp","reference_urls":["https://fortiguard.com/psirt/FG-IR-22-300","https://www.horizon3.ai/fortinet-fortinac-cve-2022-39952-deep-dive-and-iocs/","https://github.com/horizon3ai/CVE-2022-39952","https://nvd.nist.gov/vuln/detail/CVE-2022-39952","https://github.com/1f3lse/taiE"]},{"tag_id":"CVE-2017-3132","tag_type":"cve","title":"Fortinet FortiOS < 5.6.0 - Cross-Site Scripting","severity":"medium","actively_exploited":false,"match_field":"url_path","matched_pattern":"/p/user/ftoken/activate/user/guest/?action=%3C/script%3E%3Cscript%3Ealert(document.domain)%3C/script%3E%3Cscript%3E","reference_urls":["https://www.exploit-db.com/exploits/42388","https://nvd.nist.gov/vuln/detail/CVE-2017-3132"]}],"data_as_of":"2026-08-14T16:18:49.628735+00:00"}