{"ip":"94.154.43.98","data_as_of":"2026-10-27T01:05:09+00:00","observed":true,"total_events":699,"verdict":{"verdict":"malicious","label":"Exploit attempts observed","detail":"16 interactive session(s) carried an exploit attempt","confidence":"high","network_type":null,"why":["16 interactive session(s) carried an exploit attempt.","5+ sessions raise confidence to high.","The first-packet sensors recorded 699 event(s) from this address as well.","Not in any known-scanner range.","Sent 233,360 bytes, which is sustained payload delivery."],"engagement":{"level":"payload","label":"Sustained payload","detail":"233,360 bytes sent","bytes_sent":233360,"session_seconds":31,"persistent":false},"basis":"interactive"},"first_seen":"2026-10-18T23:54:16","last_seen":"2026-10-25T19:46:35","events_24h":0,"events_7d":669,"interactive_sessions":105,"interactive_sessions_24h":0,"interactive_sessions_7d":101,"interactive_protocols":[{"protocol":"http","sessions":93}],"geo":{"country_code":"NL","country_name":"The Netherlands","region":"North Holland","city":"Amsterdam","lat":52.3716,"lon":4.8883,"asn":219502,"org":"Storm Industries LLC"},"source_domain":null,"known_scanners":[],"scanner_tag":null,"cve_matches":[{"cve_id":"CVE-2026-35029","title":"LiteLLM - Arbitrary File Read","severity":"high","actively_exploited":false,"match_field":"url_path","matched_pattern":"/health/liveliness","kev_date_added":null},{"cve_id":"CVE-2025-2129","title":"Mage AI - Insecure Default Authentication Setup","severity":"medium","actively_exploited":false,"match_field":"url_path","matched_pattern":"/api/kernels","kev_date_added":null}],"malware":[],"udp":null,"interaction":{"window_days":90,"sessions":105,"first_seen":"2026-10-19T03:18:46","last_seen":"2026-10-25T18:53:14","verdicts":[{"verdict":"scan","sessions":69},{"verdict":"unknown","sessions":20},{"verdict":"exploit-attempt","sessions":16}],"personas":[{"persona":"nginx@1.24.0, wordpress@6.5.2, leaks@2, miner@bfgminer 5.5.0, elasticsearch@6.8.23, winrm@Windows Server 2016, fortigate@7.0.5, gitlab@19.4.2","sessions":45},{"persona":"nginx@1.18.0, wordpress@6.5.2, leaks@1, miner@cgminer 4.11.1, elasticsearch@8.11.1, winrm@Windows Server 2019, fortigate@7.2.1, gitlab@19.4.2","sessions":28},{"persona":"nginx@1.24.0, wordpress@6.5.2, leaks@2, miner@bfgminer 5.5.0, elasticsearch@6.8.23, winrm@Windows Server 2016, fortigate@7.0.5, docker@25.0.3","sessions":8},{"persona":"nginx@1.18.0, wordpress@6.5.2, leaks@1, miner@cgminer 4.11.1, elasticsearch@8.11.1, winrm@Windows Server 2019, dlink-dir645@1.03, fortigate@7.2.1, gitlab@19.4.2","sessions":6},{"persona":"nginx@1.24.0, wordpress@6.5.2, leaks@2, miner@bfgminer 5.5.0, elasticsearch@6.8.23, winrm@Windows Server 2016, dlink-dns@1.10, fortigate@7.0.5","sessions":2},{"persona":"nginx@1.18.0, wordpress@6.5.2, leaks@1, miner@cgminer 4.11.1, elasticsearch@8.11.1, winrm@Windows Server 2019, dlink-dns@1.10, fortigate@7.2.1","sessions":2},{"persona":"nginx@1.24.0, wordpress@6.5.2, leaks@2, miner@bfgminer 5.5.0, elasticsearch@6.8.23, winrm@Windows Server 2016, dlink-dir645@1.01, fortigate@7.0.5, gitlab@19.4.2","sessions":2}],"services":[{"protocol":"http","port":8265,"sessions":27},{"protocol":"http","port":6333,"sessions":17},{"protocol":"http","port":3001,"sessions":9},{"protocol":"http","port":8080,"sessions":8},{"protocol":"http","port":4000,"sessions":8},{"protocol":"http","port":4096,"sessions":4},{"protocol":"http","port":8501,"sessions":4},{"protocol":"http","port":7860,"sessions":4},{"protocol":"http","port":5000,"sessions":4},{"protocol":"tcp","port":3000,"sessions":2},{"protocol":"tcp","port":4000,"sessions":2},{"protocol":"http","port":8000,"sessions":2}],"logins":[],"commands":[],"downloads":[],"files":[],"attack":[{"technique_id":"T1595","technique_name":"Active Scanning","tactic_id":"TA0043","tactic_name":"Reconnaissance","sessions":73},{"technique_id":"T1190","technique_name":"Exploit Public-Facing Application","tactic_id":"TA0001","tactic_name":"Initial Access","sessions":16}]},"top_ports":[{"port":6333,"proto":"tcp","label":"","count":153,"sessions":17},{"port":3001,"proto":"tcp","label":"","count":96,"sessions":11},{"port":4000,"proto":"tcp","label":"","count":82,"sessions":10},{"port":8265,"proto":"tcp","label":"","count":60,"sessions":27},{"port":8188,"proto":"tcp","label":"","count":70,"sessions":0},{"port":8888,"proto":"tcp","label":"HTTP-alt","count":60,"sessions":0},{"port":8080,"proto":"tcp","label":"HTTP-alt","count":24,"sessions":8},{"port":11434,"proto":"tcp","label":"","count":24,"sessions":4},{"port":1234,"proto":"tcp","label":"","count":20,"sessions":4},{"port":4096,"proto":"tcp","label":"","count":20,"sessions":4},{"port":7860,"proto":"tcp","label":"","count":20,"sessions":4},{"port":5000,"proto":"tcp","label":"Web-alt","count":20,"sessions":4},{"port":8501,"proto":"tcp","label":"","count":20,"sessions":4},{"port":8000,"proto":"tcp","label":"HTTP-alt","count":15,"sessions":4},{"port":3000,"proto":"tcp","label":"Web-alt","count":15,"sessions":4}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i3111h1_e8f1e7e78f70_d41ae481755e"],"tls_client_hello":"1603010200010001fc0303e8df8027365d553b8bf7b402c4fe063cd441c27274cbc592e08bdd4e512e5cfc20ebabd8206f5ce005b1fed706889a310a4a21f6f2873d865cdf748d6e12677ec7003e130213031301c02cc030009fcca9cca8ccaac02bc02f009ec024c028006bc023c0270067c00ac0140039c009c0130033009d009c003d003c0035002f00ff01000175000b000403000102000a00160014001d0017001e0019001801000101010201030104002300000010000b000908687474702f312e310016000000170000000d002a0028040305030603080708080809080a080b080408050806040105010601030303010302040205020602002b00050403040303002d00020101003300260024001d002006de5274f717f1a7a717013e07de32ee93343dba439dc4efbbfafba427a05577001500cd00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000","tls_ja3":["755cbaaa441626ab9e759e8982278df5"],"http_akin":["b11cun040_00040016_4110f156","b11cun050_00040017_97f1d74f"],"interactive":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[]}},"fingerprint_peers":{"b11cun040_00040016_4110f156":265,"t13i3111h1_e8f1e7e78f70_d41ae481755e":14,"b11cun050_00040017_97f1d74f":44},"akin_families":{"b11cun040_00040016_4110f156":{"head":"b11cun040_00040016_4110f156","shapes":3,"ips":265},"b11cun050_00040017_97f1d74f":{"head":"b11cun050_00040017_97f1d74f","shapes":3,"ips":44}},"user_agents":["Mozilla/5.0"],"timeline":[{"date":"2026-10-18","count":6,"sessions":0},{"date":"2026-10-19","count":24,"sessions":4},{"date":"2026-10-20","count":25,"sessions":8},{"date":"2026-10-21","count":45,"sessions":8},{"date":"2026-10-22","count":60,"sessions":12},{"date":"2026-10-23","count":77,"sessions":14},{"date":"2026-10-24","count":88,"sessions":12},{"date":"2026-10-25","count":374,"sessions":47}],"recent_events":[{"timestamp":"2026-10-25T19:46:35","port":8888,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8888\",\"user-agent\":\"Mozilla/5.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/api/contents","summary":"","payload_hex":"474554202f6170692f636f6e74656e747320485454502f312e310d0a486f73743a20<HONEYPOT>3a383838380d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0","ja3":"","session":"aeb34851-ff7d-4130-a71f-674ac7b362bd","seq":1,"duration_ms":105,"bytes_in":145,"bytes_out":77},{"timestamp":"2026-10-25T19:46:35","port":8888,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8888\",\"user-agent\":\"Mozilla/5.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/api/terminals","summary":"","payload_hex":"474554202f6170692f7465726d696e616c7320485454502f312e310d0a486f73743a20<HONEYPOT>3a383838380d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0","ja3":"","session":"5d67797e-298d-4dde-b94f-10165e25009c","seq":1,"duration_ms":100,"bytes_in":146,"bytes_out":77},{"timestamp":"2026-10-25T19:46:35","port":8888,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8888\",\"user-agent\":\"Mozilla/5.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/api/kernels","summary":"","payload_hex":"474554202f6170692f6b65726e656c7320485454502f312e310d0a486f73743a20<HONEYPOT>3a383838380d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0","ja3":"","session":"fe570a06-b948-41a0-abc4-1f183c6443eb","seq":1,"duration_ms":101,"bytes_in":144,"bytes_out":77},{"timestamp":"2026-10-25T19:46:35","port":8888,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8888\",\"user-agent\":\"Mozilla/5.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/api/config","summary":"","payload_hex":"474554202f6170692f636f6e66696720485454502f312e310d0a486f73743a20<HONEYPOT>3a383838380d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0","ja3":"","session":"be34378e-e820-443a-bacd-5dcb0591c72e","seq":1,"duration_ms":102,"bytes_in":143,"bytes_out":77},{"timestamp":"2026-10-25T19:46:35","port":8888,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8888\",\"user-agent\":\"Mozilla/5.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/global/config","summary":"","payload_hex":"474554202f676c6f62616c2f636f6e66696720485454502f312e310d0a486f73743a20<HONEYPOT>3a383838380d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0","ja3":"","session":"26e3207f-b8b9-400a-a7c9-88250a6b21f2","seq":1,"duration_ms":100,"bytes_in":146,"bytes_out":77},{"timestamp":"2026-10-25T19:46:35","port":8888,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8888\",\"user-agent\":\"Mozilla/5.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/lab/api/settings","summary":"","payload_hex":"474554202f6c61622f6170692f73657474696e677320485454502f312e310d0a486f73743a20<HONEYPOT>3a383838380d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0","ja3":"","session":"21884a76-cf22-4b27-87b4-9db41e3687fd","seq":1,"duration_ms":101,"bytes_in":149,"bytes_out":77},{"timestamp":"2026-10-25T19:46:35","port":8888,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8888\",\"user-agent\":\"Mozilla/5.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/config","summary":"","payload_hex":"474554202f636f6e66696720485454502f312e310d0a486f73743a20<HONEYPOT>3a383838380d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0","ja3":"","session":"40bf0c06-0e32-4097-9ee0-409060972802","seq":1,"duration_ms":101,"bytes_in":139,"bytes_out":77},{"timestamp":"2026-10-25T19:32:51","port":8888,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8888\",\"user-agent\":\"Mozilla/5.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/lab/api/settings","summary":"","payload_hex":"474554202f6c61622f6170692f73657474696e677320485454502f312e310d0a486f73743a20<HONEYPOT>3a383838380d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0","ja3":"","session":"21a8eb9b-adc7-49dc-a9d0-7822097ae48b","seq":1,"duration_ms":100,"bytes_in":148,"bytes_out":77},{"timestamp":"2026-10-25T19:32:51","port":8888,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8888\",\"user-agent\":\"Mozilla/5.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/api/contents","summary":"","payload_hex":"474554202f6170692f636f6e74656e747320485454502f312e310d0a486f73743a20<HONEYPOT>3a383838380d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0","ja3":"","session":"7a707194-fb93-4abd-984d-a0f60635dcce","seq":1,"duration_ms":101,"bytes_in":144,"bytes_out":77},{"timestamp":"2026-10-25T19:32:51","port":8888,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8888\",\"user-agent\":\"Mozilla/5.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/global/config","summary":"","payload_hex":"474554202f676c6f62616c2f636f6e66696720485454502f312e310d0a486f73743a20<HONEYPOT>3a383838380d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0","ja3":"","session":"c4466e52-87c1-4a9f-b11e-3487c8ece7df","seq":1,"duration_ms":101,"bytes_in":145,"bytes_out":77}],"http_methods":[{"method":"GET","count":864}],"distinct_ports_total":15,"top_paths":[{"path":"/api/config","count":103,"ports":15},{"path":"/.env","count":92,"ports":15},{"path":"/claude.settings.json","count":92,"ports":15},{"path":"/config.json","count":92,"ports":15},{"path":"/","count":83,"ports":15},{"path":"/metrics","count":28,"ports":3},{"path":"/v1/models","count":27,"ports":4},{"path":"/global/config","count":27,"ports":6},{"path":"/config","count":27,"ports":6},{"path":"/collections","count":22,"ports":1},{"path":"/api/settings","count":18,"ports":2},{"path":"/healthz","count":16,"ports":1},{"path":"/dashboard","count":16,"ports":1},{"path":"/readyz","count":15,"ports":1},{"path":"/api/ping","count":14,"ports":1}],"distinct_paths_total":48,"top_snis":[],"top_hosts":[],"top_alpns":[{"value":"http/1.1","count":42}],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","Accept-Encoding","Connection","Host","User-Agent"],"representative":[{"name":"Accept","value":"*/*","notable":false},{"name":"Accept-Encoding","value":"gzip, deflate","notable":false},{"name":"Connection","value":"close","notable":false},{"name":"Host","value":"<HONEYPOT>:8888","notable":false},{"name":"User-Agent","value":"Mozilla/5.0","notable":false}],"distinct_sets":1,"events_with_headers":10},"tags":[{"tag_id":"CVE-2026-35029","tag_type":"cve","title":"LiteLLM - Arbitrary File Read","severity":"high","actively_exploited":false,"match_field":"url_path","matched_pattern":"/health/liveliness","reference_urls":["https://github.com/BerriAI/litellm","https://sec-consult.com/vulnerability-lab/advisory/broken-access-control-in-config-endpoint-in-litellm/","https://nvd.nist.gov/vuln/detail/CVE-2026-35029"],"kev_date_added":null},{"tag_id":"CVE-2025-2129","tag_type":"cve","title":"Mage AI - Insecure Default Authentication Setup","severity":"medium","actively_exploited":false,"match_field":"url_path","matched_pattern":"/api/kernels","reference_urls":["https://nvd.nist.gov/vuln/detail/CVE-2025-2129","https://github.com/zn9988/publications/blob/main/2.Mage-AI%20-%20Insecure%20Default%20Authentication%20Setup%20Leading%20to%20Zero-Click%20RCE/README.md","https://vuldb.com/?ctiid.299049","https://vuldb.com/?id.299049","https://vuldb.com/?submit.510690"],"kev_date_added":null}]}