In the past few weeks I have noticed this type of POST activity showing in my honeypot {“id”:0,“jsonrpc”:“2.0”,“method”:“eth_accounts”} looking for ID 0 (root). Activity has a static source port of 65535 and destination port 8080.
Article Link: https://isc.sans.edu/diary/rss/23034