{"ip":"104.251.180.112","observed":true,"total_events":13,"verdict":{"verdict":"scanning","label":"Scanning for known vulnerabilities","detail":"3 exploit-path probe(s)","confidence":"medium","network_type":"network services","why":["3 request(s) matched a known exploit path.","Only GET/HEAD seen, no request body: scanning for the vulnerability, not delivering a payload.","Not in any known-scanner range."],"engagement":{"level":"request","label":"Request traffic","detail":"2,212 bytes sent","bytes_sent":2212,"session_seconds":1,"persistent":false},"basis":"first_contact"},"first_seen":"2026-10-10T07:58:26","last_seen":"2026-10-16T19:10:34","events_24h":1,"events_7d":13,"interactive_sessions":0,"interactive_sessions_24h":0,"interactive_sessions_7d":0,"interactive_protocols":[],"geo":{"country_code":"CH","country_name":"Switzerland","region":"Zurich","city":"Zurich","lat":47.3643,"lon":8.5437,"asn":402253,"org":"SKN Subnet & Telecom Ltd"},"source_domain":null,"known_scanners":[],"scanner_tag":null,"cve_matches":[],"malware":[],"udp":null,"interaction":null,"top_ports":[{"port":443,"proto":"tcp","label":"HTTPS","count":12},{"port":80,"proto":"tcp","label":"HTTP","count":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i131000_f57a46bbacb6_a089bac06eae"],"tls_client_hello":"160301010c0100010803032defb36b779daba75f5573c8fc2c1414efa0ae8608605831af63c965a7b93b4e20951acb184f741200a581a86af353e7f7d29baa12a197869303c0bb87005a7699001ac02bc02fc02cc030cca9cca8c009c013c00ac014130113021303010000a5000b00020100ff010001000017000000120000000500050100000000000a000a0008001d001700180019000d0020001e09040905090608040403080708050806040105010601050306030201020300320020001e090409050906080404030807080508060401050106010503060302010203002b00050403040303003300260024001d002054adcd7712d7aad0bc1ee8c9c951820ca0e1a93b8e3a5f45c5bedc39","tls_ja3":["ad8e2ddea9ec0a77edc063c36fc6cecc"],"http_akin":["b11cun030_00040012_13ee3d34"],"interactive":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[]}},"fingerprint_peers":{"t13i131000_f57a46bbacb6_a089bac06eae":6,"b11cun030_00040012_13ee3d34":5105},"akin_families":{},"user_agents":["Go-http-client/1.1"],"timeline":[{"date":"2026-10-10","count":4},{"date":"2026-10-12","count":8},{"date":"2026-10-16","count":1}],"recent_events":[{"timestamp":"2026-10-16T19:10:34","port":80,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:80\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a38300d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"ad8e2ddea9ec0a77edc063c36fc6cecc","session":"1f6eb54b-0d25-42b1-834e-c9dc579d8af3","seq":1,"duration_ms":100,"bytes_in":97,"bytes_out":80},{"timestamp":"2026-10-12T06:56:56","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/.env.production","summary":"","payload_hex":"474554202f2e656e762e70726f64756374696f6e20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"ad8e2ddea9ec0a77edc063c36fc6cecc","session":"05e1b119-a3f1-4e32-bff5-ffd0c845840f","seq":3,"duration_ms":541,"bytes_in":311,"bytes_out":240},{"timestamp":"2026-10-12T06:56:55","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/.env","summary":"","payload_hex":"474554202f2e656e7620485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"ad8e2ddea9ec0a77edc063c36fc6cecc","session":"05e1b119-a3f1-4e32-bff5-ffd0c845840f","seq":1,"duration_ms":100,"bytes_in":98,"bytes_out":80},{"timestamp":"2026-10-12T06:56:55","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/.env.local","summary":"","payload_hex":"474554202f2e656e762e6c6f63616c20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"ad8e2ddea9ec0a77edc063c36fc6cecc","session":"05e1b119-a3f1-4e32-bff5-ffd0c845840f","seq":2,"duration_ms":321,"bytes_in":202,"bytes_out":160},{"timestamp":"2026-10-12T06:43:35","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"ad8e2ddea9ec0a77edc063c36fc6cecc","session":"83c48b7a-6f19-43a0-92cf-9bdeaac5b9cb","seq":1,"duration_ms":108,"bytes_in":94,"bytes_out":80},{"timestamp":"2026-10-12T05:40:46","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/.env","summary":"","payload_hex":"474554202f2e656e7620485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"ad8e2ddea9ec0a77edc063c36fc6cecc","session":"3c75f51b-1284-4d2f-af8e-e12aaff7d7ca","seq":1,"duration_ms":100,"bytes_in":99,"bytes_out":80},{"timestamp":"2026-10-12T05:40:46","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/.env.local","summary":"","payload_hex":"474554202f2e656e762e6c6f63616c20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"ad8e2ddea9ec0a77edc063c36fc6cecc","session":"3c75f51b-1284-4d2f-af8e-e12aaff7d7ca","seq":2,"duration_ms":222,"bytes_in":204,"bytes_out":160},{"timestamp":"2026-10-12T05:40:46","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/.env.production","summary":"","payload_hex":"474554202f2e656e762e70726f64756374696f6e20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"ad8e2ddea9ec0a77edc063c36fc6cecc","session":"3c75f51b-1284-4d2f-af8e-e12aaff7d7ca","seq":3,"duration_ms":344,"bytes_in":314,"bytes_out":240},{"timestamp":"2026-10-12T04:44:10","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"ad8e2ddea9ec0a77edc063c36fc6cecc","session":"f86abbd1-0860-43ff-8d00-7bed9a7d566a","seq":1,"duration_ms":110,"bytes_in":95,"bytes_out":80},{"timestamp":"2026-10-10T12:00:28","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/.env.local","summary":"","payload_hex":"474554202f2e656e762e6c6f63616c20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"ad8e2ddea9ec0a77edc063c36fc6cecc","session":"515d61ce-96fe-4e8f-9d33-ca88222fa900","seq":2,"duration_ms":320,"bytes_in":200,"bytes_out":160}],"http_methods":[{"method":"GET","count":13}],"distinct_ports_total":2,"top_paths":[{"path":"/","count":4,"ports":2},{"path":"/.env","count":3,"ports":1},{"path":"/.env.local","count":3,"ports":1},{"path":"/.env.production","count":3,"ports":1}],"distinct_paths_total":4,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept-Encoding","Host","User-Agent"],"representative":[{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Host","value":"<HONEYPOT>:80","notable":false},{"name":"User-Agent","value":"Go-http-client/1.1","notable":false}],"distinct_sets":1,"events_with_headers":10},"tags":[],"data_as_of":"2026-10-17T04:33:07.694199+00:00"}