{"ip":"103.120.170.113","data_as_of":"2026-10-26T05:45:34+00:00","observed":true,"total_events":0,"verdict":{"verdict":"malicious","label":"Exploit attempts observed","detail":"390 interactive session(s) carried an exploit attempt","confidence":"high","network_type":"residential ISP","why":["390 interactive session(s) carried an exploit attempt.","5+ sessions raise confidence to high.","Not in any known-scanner range.","Sent 278,939,564 bytes, which is sustained payload delivery."],"engagement":{"level":"payload","label":"Sustained payload","detail":"278,939,564 bytes sent","bytes_sent":278939564,"session_seconds":27,"persistent":false},"basis":"interactive"},"first_seen":"2026-10-21T11:58:41","last_seen":"2026-10-22T15:23:55","events_24h":0,"events_7d":0,"interactive_sessions":709,"interactive_sessions_24h":0,"interactive_sessions_7d":709,"interactive_protocols":[{"protocol":"http","sessions":709}],"geo":{"country_code":"ID","country_name":"Indonesia","region":"","city":"","lat":null,"lon":null,"asn":63859,"org":"PT. Eka Mas Republik"},"source_domain":"host-103-120-170-113.myrepublic.co.id","known_scanners":[],"scanner_tag":{"key":"peeringdb:as63859","label":"PT. Ekamas Mora Republik","category":"isp","url":"https://www.peeringdb.com/asn/63859"},"cve_matches":[],"malware":[],"udp":null,"interaction":{"window_days":90,"sessions":709,"first_seen":"2026-10-21T11:58:41","last_seen":"2026-10-22T15:23:55","verdicts":[{"verdict":"exploit-attempt","sessions":390},{"verdict":"scan","sessions":319}],"personas":[{"persona":"nginx@1.24.0, wordpress@6.5.2, leaks@2, miner@bfgminer 5.5.0, elasticsearch@6.8.23, winrm@Windows Server 2016, fortigate@7.0.5, gitlab@19.4.2","sessions":620},{"persona":"nginx@1.24.0, wordpress@6.5.2, leaks@2, miner@bfgminer 5.5.0, elasticsearch@6.8.23, winrm@Windows Server 2016, fortigate@7.0.5, docker@25.0.3","sessions":86},{"persona":"nginx@1.24.0, wordpress@6.5.2, leaks@2, miner@bfgminer 5.5.0, elasticsearch@6.8.23, winrm@Windows Server 2016, fortigate@7.0.5","sessions":2},{"persona":"nginx@1.24.0, wordpress@6.5.2, leaks@2, miner@bfgminer 5.5.0, elasticsearch@6.8.23, winrm@Windows Server 2016, dlink-dir645@1.01, fortigate@7.0.5","sessions":1}],"services":[{"protocol":"http","port":30005,"sessions":23},{"protocol":"http","port":12171,"sessions":20},{"protocol":"http","port":50580,"sessions":19},{"protocol":"http","port":14430,"sessions":19},{"protocol":"http","port":50001,"sessions":19},{"protocol":"http","port":6688,"sessions":19},{"protocol":"http","port":12164,"sessions":16},{"protocol":"http","port":10002,"sessions":16},{"protocol":"http","port":2087,"sessions":15},{"protocol":"http","port":2078,"sessions":15},{"protocol":"http","port":2096,"sessions":15},{"protocol":"http","port":17988,"sessions":14}],"logins":[],"commands":[],"downloads":[],"files":[{"sha256":"f20a1882d2ab6536fc08e0f8dbbe2f57369f5b20c0a2a4fe965c268505eb0fd5","name":"php-multipart-anomaly","size":262144,"mime_type":"text/plain","kind":"payload","times":133,"first_seen":"2026-10-22T09:07:56","last_seen":"2026-10-22T09:45:49","virustotal":null},{"sha256":"e2a7843bd3cb7a297611f87fbcd1662e90f055e81a42155a169e73e105650020","name":"php2shell-aslr-rest","size":65536,"mime_type":"text/plain","kind":"payload","times":31,"first_seen":"2026-10-22T10:22:25","last_seen":"2026-10-22T10:25:37","virustotal":null},{"sha256":"5d8669a9860e1b6163a00552a6638e97f433997b1b54d7ecc960a871d60ebed9","name":"php2shell-aslr","size":16384,"mime_type":"application/octet-stream","kind":"payload","times":31,"first_seen":"2026-10-22T10:22:25","last_seen":"2026-10-22T10:25:37","virustotal":null},{"sha256":"24ca4c981ff5df696c12ffc2c4192c1dc8d5f35d3cf5e693ee9718389d3d691c","name":"php2shell-aslr","size":16384,"mime_type":"text/plain","kind":"payload","times":19,"first_seen":"2026-10-22T10:22:29","last_seen":"2026-10-22T10:25:45","virustotal":null},{"sha256":"cadea24e96559a7e85c9aa7a3d4fe630e929a11f994567ea273adf5d3d0d79ef","name":"php2shell-chain","size":68598,"mime_type":"text/plain","kind":"payload","times":19,"first_seen":"2026-10-22T10:22:29","last_seen":"2026-10-22T10:25:45","virustotal":null},{"sha256":"77b9f8208e54ce598d4015997dd17929523a5c39c71124d8e2194b34db32986f","name":"php2shell-chain","size":262144,"mime_type":"application/octet-stream","kind":"payload","times":19,"first_seen":"2026-10-22T10:22:25","last_seen":"2026-10-22T10:25:22","virustotal":null},{"sha256":"b9fbadd385e03a555c4664cdd08e5e13035ca2a01cc0ed231d51bae99882bd8c","name":"php2shell-chain","size":262144,"mime_type":"application/octet-stream","kind":"payload","times":6,"first_seen":"2026-10-22T10:24:07","last_seen":"2026-10-22T10:25:37","virustotal":null},{"sha256":"85a50b0e2a93fe75043a09840205011524cbd40d50c489b48c431895e18618a5","name":"php2shell-chain","size":262144,"mime_type":"application/octet-stream","kind":"payload","times":6,"first_seen":"2026-10-22T10:24:03","last_seen":"2026-10-22T10:25:28","virustotal":null},{"sha256":"f885a7a723373e0151900c199c89e6cc64e26eeadbbbac44d8ecb9c2c9522e18","name":"php2shell-chain","size":262144,"mime_type":"text/plain","kind":"payload","times":4,"first_seen":"2026-10-22T09:08:24","last_seen":"2026-10-22T09:38:31","virustotal":null},{"sha256":"a9e7aade2576c9dbe5752ef4a8dd7d3506ca079c13526bafc2bb6e3df3e7025c","name":"php2shell-chain","size":248,"mime_type":"text/plain","kind":"payload","times":4,"first_seen":"2026-10-22T09:08:23","last_seen":"2026-10-22T09:38:31","virustotal":null},{"sha256":"a45738a1078a4a5763db9cc7d2220a334e1b92e870bf7330cff3e358c9cad55a","name":"php2shell-chain","size":138,"mime_type":"text/plain","kind":"payload","times":4,"first_seen":"2026-10-22T09:08:22","last_seen":"2026-10-22T09:38:30","virustotal":null},{"sha256":"eccb8ffe1795ac5796119308fe42d29432cb294e2b549094bd7338789a6212fb","name":"php2shell-chain","size":262144,"mime_type":"text/plain","kind":"payload","times":3,"first_seen":"2026-10-22T09:08:42","last_seen":"2026-10-22T09:39:03","virustotal":null},{"sha256":"a6556499ba5c38c399e1dc428baf6ddabeb59add8234d330aaf58e83d21c7d97","name":"php2shell-chain","size":262144,"mime_type":"text/plain","kind":"payload","times":3,"first_seen":"2026-10-22T09:08:42","last_seen":"2026-10-22T09:39:03","virustotal":null},{"sha256":"104040053c5fb0662676b75e22c53930e15dd447f83a8155fdee7ebfa4dbd77f","name":"php2shell-chain","size":248,"mime_type":"text/plain","kind":"payload","times":3,"first_seen":"2026-10-22T09:08:41","last_seen":"2026-10-22T09:39:02","virustotal":null},{"sha256":"637da7151fbe9f7e9d97c933d74a9d967f1fb2d384fa816f1eaa0475aebe4a83","name":"php2shell-chain","size":247,"mime_type":"text/plain","kind":"payload","times":3,"first_seen":"2026-10-22T09:08:41","last_seen":"2026-10-22T09:39:02","virustotal":null},{"sha256":"d71e6e765fd8145da0de8fe0174174f7a22577c55c2b686e367e9bc49a3c3a8d","name":"php2shell-chain","size":137,"mime_type":"text/plain","kind":"payload","times":3,"first_seen":"2026-10-22T09:08:41","last_seen":"2026-10-22T09:39:01","virustotal":null},{"sha256":"5f99bd777129e603e5033a2fb79ce31f94bd583e27c1accaa216b3da23d2669d","name":"php2shell-chain","size":138,"mime_type":"text/plain","kind":"payload","times":3,"first_seen":"2026-10-22T09:08:41","last_seen":"2026-10-22T09:39:01","virustotal":null},{"sha256":"b32ceb9ab472142123233f10725c493ef330798d0bdeee1aa9ba1e80e5546ed4","name":"php2shell-chain","size":262144,"mime_type":"text/plain","kind":"payload","times":3,"first_seen":"2026-10-22T09:08:40","last_seen":"2026-10-22T09:38:57","virustotal":null},{"sha256":"4225e460f2aebc4f30a0492fc82784356ddd081de76f39b545a10fcb24e9824f","name":"php2shell-chain","size":262144,"mime_type":"text/plain","kind":"payload","times":3,"first_seen":"2026-10-22T09:08:40","last_seen":"2026-10-22T09:38:57","virustotal":null},{"sha256":"fc1473b63a6f8d63abd98176c846d3871f26b11038b8718a90b63ba14abb2377","name":"php2shell-chain","size":247,"mime_type":"text/plain","kind":"payload","times":3,"first_seen":"2026-10-22T09:08:40","last_seen":"2026-10-22T09:38:56","virustotal":null},{"sha256":"1b11b3adb1a8f0143db8c64c4aa01cbc5ca4bb6820e3feae0dc96b4ffb90e374","name":"php2shell-chain","size":248,"mime_type":"text/plain","kind":"payload","times":3,"first_seen":"2026-10-22T09:08:40","last_seen":"2026-10-22T09:38:56","virustotal":null},{"sha256":"9e13a25ded354d3ce2f4ec60c3ebe2633b48a2c059c32f95d0c28848a2e36123","name":"php2shell-chain","size":137,"mime_type":"text/plain","kind":"payload","times":3,"first_seen":"2026-10-22T09:08:39","last_seen":"2026-10-22T09:38:55","virustotal":null},{"sha256":"e47147e92140f42bf7283af9ba475906e663aedb67c3abc3781cec535f9305a8","name":"php2shell-chain","size":138,"mime_type":"text/plain","kind":"payload","times":3,"first_seen":"2026-10-22T09:08:39","last_seen":"2026-10-22T09:38:55","virustotal":null},{"sha256":"37785c1c8c39949a678ef4f2524aa680dc2836faa4795b80ef8a7a77d03d0521","name":"php2shell-chain","size":262144,"mime_type":"text/plain","kind":"payload","times":3,"first_seen":"2026-10-22T09:08:36","last_seen":"2026-10-22T09:38:51","virustotal":null},{"sha256":"0dd5916d56139f88804da498f63b023b4399dc856fe76b2bc5cbcd37cb3d1bca","name":"php2shell-chain","size":262144,"mime_type":"text/plain","kind":"payload","times":3,"first_seen":"2026-10-22T09:08:35","last_seen":"2026-10-22T09:38:50","virustotal":null}],"attack":[{"technique_id":"T1595","technique_name":"Active Scanning","tactic_id":"TA0043","tactic_name":"Reconnaissance","sessions":399},{"technique_id":"T1190","technique_name":"Exploit Public-Facing Application","tactic_id":"TA0001","tactic_name":"Initial Access","sessions":390}]},"top_ports":[{"port":30005,"proto":"tcp","label":"HTTP","count":0,"sessions":23},{"port":12171,"proto":"tcp","label":"HTTP","count":0,"sessions":20},{"port":6688,"proto":"tcp","label":"HTTP","count":0,"sessions":19},{"port":50001,"proto":"tcp","label":"HTTP","count":0,"sessions":19},{"port":14430,"proto":"tcp","label":"HTTP","count":0,"sessions":19},{"port":50580,"proto":"tcp","label":"HTTP","count":0,"sessions":19},{"port":12164,"proto":"tcp","label":"HTTP","count":0,"sessions":16},{"port":10002,"proto":"tcp","label":"HTTP","count":0,"sessions":16},{"port":2078,"proto":"tcp","label":"HTTP","count":0,"sessions":15},{"port":2087,"proto":"tcp","label":"HTTP","count":0,"sessions":15},{"port":2096,"proto":"tcp","label":"HTTP","count":0,"sessions":15},{"port":17988,"proto":"tcp","label":"HTTP","count":0,"sessions":14},{"port":12165,"proto":"tcp","label":"HTTP","count":0,"sessions":12},{"port":10912,"proto":"tcp","label":"HTTP","count":0,"sessions":12},{"port":2053,"proto":"tcp","label":"HTTP","count":0,"sessions":11}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i311000_e8f1e7e78f70_d41ae481755e","t13i3111h1_e8f1e7e78f70_b26ce05bbdd6"],"tls_client_hello":"","tls_ja3":["78f0dc5ac5b19daf131a133cfdee9691","c12b4ccd5320bbb380ca1a9df90f771d"],"http_akin":[],"interactive":{"ssh_hassh":[],"tls_ja4":["t13i311000_e8f1e7e78f70_d41ae481755e","t13i3111h1_e8f1e7e78f70_b26ce05bbdd6"],"tls_ja3":["78f0dc5ac5b19daf131a133cfdee9691","c12b4ccd5320bbb380ca1a9df90f771d"]}},"fingerprint_peers":{"t13i311000_e8f1e7e78f70_d41ae481755e":688,"t13i3111h1_e8f1e7e78f70_b26ce05bbdd6":16},"akin_families":{},"user_agents":["python-requests/2.31.0","Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/131.0.0.0","Mozilla/5.0 php2shell-checker/1.0","Mozilla/5.0"],"timeline":[{"date":"2026-10-21","count":0,"sessions":89},{"date":"2026-10-22","count":0,"sessions":620}],"recent_events":[{"timestamp":"2026-10-22T15:23:55","port":12170,"proto":"tcp","app_proto":"http","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:12170\",\"user-agent\":\"python-requests/2.31.0\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a203c484f4e4559504f543e3a31323137300d0a557365722d4167656e743a20707974686f6e2d72657175657374732f322e33312e300d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"python-requests/2.31.0","ja3":"78f0dc5ac5b19daf131a133cfdee9691","session":"81e047f2-542f-4582-a1b7-a412345b8ab0-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-22T15:23:55","port":12169,"proto":"tcp","app_proto":"http","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:12169\",\"user-agent\":\"python-requests/2.31.0\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a203c484f4e4559504f543e3a31323136390d0a557365722d4167656e743a20707974686f6e2d72657175657374732f322e33312e300d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"python-requests/2.31.0","ja3":"78f0dc5ac5b19daf131a133cfdee9691","session":"9fbb2111-904b-4b1c-bf1b-5ec2bea68eea-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-22T15:23:54","port":12168,"proto":"tcp","app_proto":"http","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:12168\",\"user-agent\":\"python-requests/2.31.0\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a203c484f4e4559504f543e3a31323136380d0a557365722d4167656e743a20707974686f6e2d72657175657374732f322e33312e300d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"python-requests/2.31.0","ja3":"78f0dc5ac5b19daf131a133cfdee9691","session":"09bce236-e104-4b2b-96cd-d9f2da0d4bdb-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-22T15:23:54","port":12167,"proto":"tcp","app_proto":"http","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:12167\",\"user-agent\":\"python-requests/2.31.0\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a203c484f4e4559504f543e3a31323136370d0a557365722d4167656e743a20707974686f6e2d72657175657374732f322e33312e300d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"python-requests/2.31.0","ja3":"78f0dc5ac5b19daf131a133cfdee9691","session":"01145c2a-930a-4df5-ae71-27a763b25a39-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-22T15:23:54","port":12166,"proto":"tcp","app_proto":"http","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:12166\",\"user-agent\":\"python-requests/2.31.0\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a203c484f4e4559504f543e3a31323136360d0a557365722d4167656e743a20707974686f6e2d72657175657374732f322e33312e300d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"python-requests/2.31.0","ja3":"78f0dc5ac5b19daf131a133cfdee9691","session":"8d558a26-5d31-4472-a8d6-8ded668a3b28-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-22T15:23:54","port":12165,"proto":"tcp","app_proto":"http","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:12165\",\"user-agent\":\"python-requests/2.31.0\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a203c484f4e4559504f543e3a31323136350d0a557365722d4167656e743a20707974686f6e2d72657175657374732f322e33312e300d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"python-requests/2.31.0","ja3":"78f0dc5ac5b19daf131a133cfdee9691","session":"60e4f8b5-910f-4454-b5d2-cbdfcdc52644-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-22T15:23:54","port":12164,"proto":"tcp","app_proto":"http","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:12164\",\"user-agent\":\"python-requests/2.31.0\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a203c484f4e4559504f543e3a31323136340d0a557365722d4167656e743a20707974686f6e2d72657175657374732f322e33312e300d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"python-requests/2.31.0","ja3":"78f0dc5ac5b19daf131a133cfdee9691","session":"536fdd5f-aaba-4b17-9815-d1eaa2f9e6b7-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-22T15:23:54","port":12163,"proto":"tcp","app_proto":"http","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:12163\",\"user-agent\":\"python-requests/2.31.0\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a203c484f4e4559504f543e3a31323136330d0a557365722d4167656e743a20707974686f6e2d72657175657374732f322e33312e300d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"python-requests/2.31.0","ja3":"78f0dc5ac5b19daf131a133cfdee9691","session":"b70df8b4-c511-4924-b83a-812709f8328a-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-22T15:23:54","port":11434,"proto":"tcp","app_proto":"http","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:11434\",\"user-agent\":\"python-requests/2.31.0\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a203c484f4e4559504f543e3a31313433340d0a557365722d4167656e743a20707974686f6e2d72657175657374732f322e33312e300d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"python-requests/2.31.0","ja3":"78f0dc5ac5b19daf131a133cfdee9691","session":"eb8cad7c-7f98-418f-8a0b-e87fa75a9a47-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-22T15:23:53","port":10002,"proto":"tcp","app_proto":"http","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:10002\",\"user-agent\":\"python-requests/2.31.0\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a203c484f4e4559504f543e3a31303030320d0a557365722d4167656e743a20707974686f6e2d72657175657374732f322e33312e300d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"python-requests/2.31.0","ja3":"78f0dc5ac5b19daf131a133cfdee9691","session":"a7e83ecc-1b83-400f-aea8-32d3fe4038b3-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true}],"http_methods":[{"method":"GET","count":613},{"method":"POST","count":133},{"method":"HEAD","count":1}],"distinct_ports_total":85,"top_paths":[{"path":"/","count":747,"ports":85},{"path":"/composer.lock","count":3,"ports":3}],"distinct_paths_total":2,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","Accept-Encoding","Connection","Host","User-Agent"],"representative":[{"name":"Accept","value":"*/*","notable":false},{"name":"Accept-Encoding","value":"gzip, deflate","notable":false},{"name":"Connection","value":"keep-alive","notable":false},{"name":"Host","value":"<HONEYPOT>:12170","notable":false},{"name":"User-Agent","value":"python-requests/2.31.0","notable":false}],"distinct_sets":1,"events_with_headers":10},"tags":[]}