Tags

Scanning for vulnerable CGI scripts

Reconnaissance probe targeting Cisco ASA firewall and VPN infrastructure. Indicates scanning for Cisco ASA devices, typically preceding exploitation attempts.

IPs observed attempting to exploit CVE-2026-20045, an unauthenticated remote code execution vulnerability in the web management interface of Cisco Unified Communications Manager.

IPs observed probing Cisco Unified Communications infrastructure — administrator consoles, self-service portals, version endpoints and voice services across Cisco Unified Communications Manager (CUCM), Unity Connection, IM & Presence and Unified Contact Center Express.

HTTP request targeting Citrix ADC or Citrix Gateway (formerly NetScaler ADC/Gateway) specific URL paths, indicating deliberate reconnaissance or scanning for Citrix remote access infrastructure.

Content management system discovery and enumeration

Scanning for exposed configuration files

Active exploitation of the cPanel and WHM pre-authentication bypass vulnerability, targeting the WHM admin interface and cPanel session authentication endpoints.

Reconnaissance probe targeting cPanel and WHM web hosting control panel infrastructure. Detected via cPanel-specific HTTP paths and connections to native cPanel and WHM management ports.

Scanning for database admin interfaces (phpMyAdmin, etc.)

Path traversal attack attempting to access restricted files

Probing for enterprise software (Confluence, Jenkins, etc.)

Probing Microsoft Exchange for ProxyShell/ProxyLogon vulnerabilities

Attempting to upload potentially malicious files

IPs observed probing the Fortinet FortiOS REST management API — the configuration, monitoring and log endpoints that expose administrator accounts, live device state and traffic records.

IPs observed probing the Fortinet FortiOS SSL-VPN web portal — the remote-access login, credential-check, client-integrity and portal-information endpoints — fingerprinting FortiGate SSL-VPN deployments and identifying reachable versions ahead of exploitation.

Probing Palo Alto GlobalProtect VPN login endpoints

Default credential stuffing attempt on telnet

IPs observed probing Ivanti Connect Secure (formerly Pulse Secure) SSL VPN infrastructure — fingerprinting the DANA session-root surface to identify reachable Ivanti remote access deployments ahead of exploitation.

CVE-2026-1281/CVE-2026-1340 Ivanti Endpoint Manager Mobile pre-auth RCE via Bash arithmetic expansion in /mifs/c/appstore/fob/ and /mifs/c/aftstore/fob/ endpoints

Scanning for exposed Model Context Protocol (MCP) and Server-Sent Events (SSE) endpoints

Mirai-specific IoT default credentials detected in telnet payload

Mirai-style port 23/2323 dual scanning pattern detected

An IP with this tag has been identified as the Outlaw (a.k.a. Dota) SSH cryptojacking botnet — a self-propagating Monero-mining botnet that spreads across SSH servers

An IP with this tag has been identified as the P2PInfect Redis/SSH worm botnet — a self-replicating Rust-based peer-to-peer botnet that spreads across exposed Redis servers and enrolls each victim into its payload-serving mesh

Scanning for exposed PHPUnit eval-stdin.php endpoint allowing arbitrary PHP code execution

Scanning 5+ ports on target host

Remote Desktop Protocol (RDP) connection attempt detected on port 3389

Connection established to a Redis service on port 6379

Attempting router firmware exploits (Netgear, D-Link, etc.)

Active exploitation of SharePoint vulnerabilities

Scanning for SharePoint web shells

SIP VoIP scanning activity on port 5060

Host submitted an SMTP AUTH command to a honeypot mail server. Consistent with open-relay scouting or opportunistic credential submission.

Host made repeated SMTP AUTH attempts within a short window, strongly indicative of credential spraying against a mail server.

Probing for SolarWinds Orion endpoints

IPs observed probing SonicWall Next-Generation Firewall management surfaces, fingerprinting the SonicOS REST API and management GUI to identify reachable SonicWall NGFW deployments ahead of exploitation.

SQL injection attack detected in request

Repeated SSH credential attempts from this IP — username and password submitted multiple times to the SSH honeypot

SSH connection attempt detected on port 22 or 2222

SSH credential attempt observed — attacker submitted a username and password to the SSH honeypot

Multiple username/password submissions to Telnet honeypot

Telnet connection attempt detected on port 23 or 2323

Telnet credential attempt observed — attacker submitted a username and password to a Telnet server

Exploiting ThinkPHP framework invokefunction endpoint for remote code execution

TLS/SSL connection fingerprinting detected via Suricata

Repeated VNC authentication attempts from a single IP address

VNC connection established on port 5900/5901