{"ip":"107.173.44.199","total_events":336,"verdict":{"verdict":"scanning","label":"Scanning for known vulnerabilities","detail":"3 exploit-path probe(s)","confidence":"medium","network_type":"nsp","why":["3 request(s) matched a known exploit path.","Only GET/HEAD seen, no request body: scanning for the vulnerability, not delivering a payload.","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"53,296 bytes sent","bytes_sent":53296,"session_seconds":1,"persistent":false}},"first_seen":"2026-09-03T13:32:53","last_seen":"2026-09-03T13:32:54","events_24h":0,"events_7d":0,"geo":{"country_code":"US","country_name":"United States","region":"New York","city":"Buffalo","lat":42.8864,"lon":-78.8784,"asn":36352,"org":"HostPapa"},"source_domain":"107-173-44-199-host.colocrossing.com","known_scanners":[],"scanner_tag":{"key":"peeringdb:as36352","label":"ColoCrossing","category":"isp","url":"https://www.peeringdb.com/asn/36352"},"cve_matches":[],"malware":[],"top_ports":[{"port":8081,"proto":"tcp","label":"","count":24},{"port":4000,"proto":"tcp","label":"","count":24},{"port":8888,"proto":"tcp","label":"HTTP-alt","count":24},{"port":8443,"proto":"tcp","label":"HTTPS-alt","count":24},{"port":80,"proto":"tcp","label":"HTTP","count":24},{"port":8000,"proto":"tcp","label":"HTTP-alt","count":24},{"port":9876,"proto":"tcp","label":"","count":24},{"port":443,"proto":"tcp","label":"HTTPS","count":24},{"port":5000,"proto":"tcp","label":"Web-alt","count":24},{"port":8090,"proto":"tcp","label":"","count":24},{"port":8765,"proto":"tcp","label":"","count":24},{"port":8080,"proto":"tcp","label":"HTTP-alt","count":24},{"port":9090,"proto":"tcp","label":"Prometheus","count":24},{"port":8899,"proto":"tcp","label":"","count":24}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i161000_46e7e9700bed_ab7e3b40a677"],"tls_ja3":["a23d8d043eedecfd177525149813dad0"],"ja4h":["ge11nn0400_20ad1e35775f"]},"fingerprint_peers":{"t13i161000_46e7e9700bed_ab7e3b40a677":1,"ge11nn0400_20ad1e35775f":1},"user_agents":["opendirme-credhunt/1.0"],"timeline":[{"date":"2026-09-03","count":336}],"recent_events":[{"timestamp":"2026-09-03T13:32:54","port":8443,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"application/json,*/*;q=0.1\",\"host\":\"<HONEYPOT>:8443\",\"range\":\"bytes=0-262143\",\"user-agent\":\"opendirme-credhunt/1.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/.claude/.credentials.json","summary":"","payload_hex":"474554202f2e636c617564652f2e63726564656e7469616c732e6a736f6e20485454502f312e310d0a486f73743a20<HONEYPOT>3a383434330d0a557365722d4167656e743a206f70656e6469726d652d6372656468756e742f312e300d0a4163636570743a206170706c69636174696f6e2f6a736f6e2c2a2f2a3b713d302e310d0a52616e67653a2062797465733d302d3236323134330d0a0d0a","method":"GET","user_agent":"opendirme-credhunt/1.0","ja3":"","session":"fa3ae640-8b18-4305-89cb-44dcdd89926b","seq":2,"duration_ms":485,"bytes_in":319,"bytes_out":158},{"timestamp":"2026-09-03T13:32:53","port":8888,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"application/json,*/*;q=0.1\",\"host\":\"<HONEYPOT>:8888\",\"range\":\"bytes=0-262143\",\"user-agent\":\"opendirme-credhunt/1.0\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/.env","summary":"","payload_hex":"474554202f2e656e7620485454502f312e310d0a486f73743a20<HONEYPOT>3a383838380d0a557365722d4167656e743a206f70656e6469726d652d6372656468756e742f312e300d0a4163636570743a206170706c69636174696f6e2f6a736f6e2c2a2f2a3b713d302e310d0a52616e67653a2062797465733d302d3236323134330d0a0d0a","method":"GET","user_agent":"opendirme-credhunt/1.0","ja3":"a23d8d043eedecfd177525149813dad0","session":"e9a1040f-33e9-4d58-9e0f-b123f234bc7b","seq":2,"duration_ms":294,"bytes_in":298,"bytes_out":158},{"timestamp":"2026-09-03T13:32:53","port":8899,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"application/json,*/*;q=0.1\",\"host\":\"<HONEYPOT>:8899\",\"range\":\"bytes=0-262143\",\"user-agent\":\"opendirme-credhunt/1.0\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/.credentials.json","summary":"","payload_hex":"474554202f2e63726564656e7469616c732e6a736f6e20485454502f312e310d0a486f73743a20<HONEYPOT>3a383839390d0a557365722d4167656e743a206f70656e6469726d652d6372656468756e742f312e300d0a4163636570743a206170706c69636174696f6e2f6a736f6e2c2a2f2a3b713d302e310d0a52616e67653a2062797465733d302d3236323134330d0a0d0a","method":"GET","user_agent":"opendirme-credhunt/1.0","ja3":"a23d8d043eedecfd177525149813dad0","session":"2e3c0320-cae4-42ef-9383-afa7b4d75024","seq":2,"duration_ms":294,"bytes_in":309,"bytes_out":158},{"timestamp":"2026-09-03T13:32:53","port":8765,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"application/json,*/*;q=0.1\",\"host\":\"<HONEYPOT>:8765\",\"range\":\"bytes=0-262143\",\"user-agent\":\"opendirme-credhunt/1.0\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/.git-credentials","summary":"","payload_hex":"474554202f2e6769742d63726564656e7469616c7320485454502f312e310d0a486f73743a20<HONEYPOT>3a383736350d0a557365722d4167656e743a206f70656e6469726d652d6372656468756e742f312e300d0a4163636570743a206170706c69636174696f6e2f6a736f6e2c2a2f2a3b713d302e310d0a52616e67653a2062797465733d302d3236323134330d0a0d0a","method":"GET","user_agent":"opendirme-credhunt/1.0","ja3":"a23d8d043eedecfd177525149813dad0","session":"7a3971bb-b324-4f73-9a1c-e88d0b87867c","seq":2,"duration_ms":291,"bytes_in":325,"bytes_out":158},{"timestamp":"2026-09-03T13:32:53","port":8090,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"application/json,*/*;q=0.1\",\"host\":\"<HONEYPOT>:8090\",\"range\":\"bytes=0-262143\",\"user-agent\":\"opendirme-credhunt/1.0\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/.hermes/.env","summary":"","payload_hex":"474554202f2e6865726d65732f2e656e7620485454502f312e310d0a486f73743a20<HONEYPOT>3a383039300d0a557365722d4167656e743a206f70656e6469726d652d6372656468756e742f312e300d0a4163636570743a206170706c69636174696f6e2f6a736f6e2c2a2f2a3b713d302e310d0a52616e67653a2062797465733d302d3236323134330d0a0d0a","method":"GET","user_agent":"opendirme-credhunt/1.0","ja3":"a23d8d043eedecfd177525149813dad0","session":"62c403bc-a403-4b7b-92f7-78521387f5f3","seq":2,"duration_ms":298,"bytes_in":307,"bytes_out":158},{"timestamp":"2026-09-03T13:32:53","port":8765,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"application/json,*/*;q=0.1\",\"host\":\"<HONEYPOT>:8765\",\"range\":\"bytes=0-262143\",\"user-agent\":\"opendirme-credhunt/1.0\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/.hermes/.env","summary":"","payload_hex":"474554202f2e6865726d65732f2e656e7620485454502f312e310d0a486f73743a20<HONEYPOT>3a383736350d0a557365722d4167656e743a206f70656e6469726d652d6372656468756e742f312e300d0a4163636570743a206170706c69636174696f6e2f6a736f6e2c2a2f2a3b713d302e310d0a52616e67653a2062797465733d302d3236323134330d0a0d0a","method":"GET","user_agent":"opendirme-credhunt/1.0","ja3":"a23d8d043eedecfd177525149813dad0","session":"81dc1b30-3727-45b8-8aaa-be4b67701f30","seq":1,"duration_ms":100,"bytes_in":151,"bytes_out":79},{"timestamp":"2026-09-03T13:32:53","port":8443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"application/json,*/*;q=0.1\",\"host\":\"<HONEYPOT>:8443\",\"range\":\"bytes=0-262143\",\"user-agent\":\"opendirme-credhunt/1.0\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/.claude/.credentials.json","summary":"","payload_hex":"474554202f2e636c617564652f2e63726564656e7469616c732e6a736f6e20485454502f312e310d0a486f73743a20<HONEYPOT>3a383434330d0a557365722d4167656e743a206f70656e6469726d652d6372656468756e742f312e300d0a4163636570743a206170706c69636174696f6e2f6a736f6e2c2a2f2a3b713d302e310d0a52616e67653a2062797465733d302d3236323134330d0a0d0a","method":"GET","user_agent":"opendirme-credhunt/1.0","ja3":"a23d8d043eedecfd177525149813dad0","session":"a5df2012-43fc-4a3b-a77a-2feb4e7fd469","seq":1,"duration_ms":545,"bytes_in":164,"bytes_out":79},{"timestamp":"2026-09-03T13:32:53","port":8090,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"application/json,*/*;q=0.1\",\"host\":\"<HONEYPOT>:8090\",\"range\":\"bytes=0-262143\",\"user-agent\":\"opendirme-credhunt/1.0\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/.openclaw/openclaw.json","summary":"","payload_hex":"474554202f2e6f70656e636c61772f6f70656e636c61772e6a736f6e20485454502f312e310d0a486f73743a20<HONEYPOT>3a383039300d0a557365722d4167656e743a206f70656e6469726d652d6372656468756e742f312e300d0a4163636570743a206170706c69636174696f6e2f6a736f6e2c2a2f2a3b713d302e310d0a52616e67653a2062797465733d302d3236323134330d0a0d0a","method":"GET","user_agent":"opendirme-credhunt/1.0","ja3":"a23d8d043eedecfd177525149813dad0","session":"07616006-1d74-47e3-929b-3a9b6803327c","seq":1,"duration_ms":100,"bytes_in":162,"bytes_out":79},{"timestamp":"2026-09-03T13:32:53","port":8888,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"application/json,*/*;q=0.1\",\"host\":\"<HONEYPOT>:8888\",\"range\":\"bytes=0-262143\",\"user-agent\":\"opendirme-credhunt/1.0\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/.openclaw/openclaw.json","summary":"","payload_hex":"474554202f2e6f70656e636c61772f6f70656e636c61772e6a736f6e20485454502f312e310d0a486f73743a20<HONEYPOT>3a383838380d0a557365722d4167656e743a206f70656e6469726d652d6372656468756e742f312e300d0a4163636570743a206170706c69636174696f6e2f6a736f6e2c2a2f2a3b713d302e310d0a52616e67653a2062797465733d302d3236323134330d0a0d0a","method":"GET","user_agent":"opendirme-credhunt/1.0","ja3":"a23d8d043eedecfd177525149813dad0","session":"36aa090d-2c38-4713-80d2-304cee03aa2a","seq":1,"duration_ms":100,"bytes_in":162,"bytes_out":79},{"timestamp":"2026-09-03T13:32:53","port":8765,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"application/json,*/*;q=0.1\",\"host\":\"<HONEYPOT>:8765\",\"range\":\"bytes=0-262143\",\"user-agent\":\"opendirme-credhunt/1.0\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/.openclaw/.env","summary":"","payload_hex":"474554202f2e6f70656e636c61772f2e656e7620485454502f312e310d0a486f73743a20<HONEYPOT>3a383736350d0a557365722d4167656e743a206f70656e6469726d652d6372656468756e742f312e300d0a4163636570743a206170706c69636174696f6e2f6a736f6e2c2a2f2a3b713d302e310d0a52616e67653a2062797465733d302d3236323134330d0a0d0a","method":"GET","user_agent":"opendirme-credhunt/1.0","ja3":"a23d8d043eedecfd177525149813dad0","session":"66c23af7-17fd-4987-9b96-7021c4cdb654","seq":1,"duration_ms":105,"bytes_in":153,"bytes_out":79}],"http_methods":[{"method":"GET","count":336}],"distinct_ports_total":14,"top_paths":[{"path":"/.env","count":28,"ports":14},{"path":"/.openclaw/.env","count":28,"ports":14},{"path":"/.grok/auth.json","count":28,"ports":14},{"path":"/auth.json","count":28,"ports":14},{"path":"/.git/config","count":28,"ports":14},{"path":"/.hermes/.env","count":28,"ports":14},{"path":"/.git-credentials","count":28,"ports":14},{"path":"/.credentials.json","count":28,"ports":14},{"path":"/.codex/auth.json","count":28,"ports":14},{"path":"/.openclaw/openclaw.json","count":28,"ports":14},{"path":"/.claude/.credentials.json","count":28,"ports":14},{"path":"/.local/share/opencode/auth.json","count":28,"ports":14}],"distinct_paths_total":12,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","Host","Range","User-Agent"],"representative":[{"name":"Accept","value":"application/json,*/*;q=0.1","notable":false},{"name":"Host","value":"<HONEYPOT>:8443","notable":false},{"name":"Range","value":"bytes=0-262143","notable":false},{"name":"User-Agent","value":"opendirme-credhunt/1.0","notable":false}],"distinct_sets":1,"events_with_headers":10},"tags":[],"data_as_of":"2026-09-21T03:54:41.948722+00:00"}