{"ip":"129.213.151.234","total_events":2508,"verdict":{"verdict":"malicious","label":"Exploit attempts observed","detail":"48 exploit-path hits","confidence":"high","network_type":"CDN","why":["48 request(s) matched a known exploit path.","Body-carrying methods (POST/PUT/PATCH/DELETE) seen: payload delivery, not just recon.","5+ hits raise confidence to high.","Not in any known-scanner range.","Sent 1,201,824 bytes: sustained payload delivery, not a single opportunistic request."],"engagement":{"level":"payload","label":"Sustained payload","detail":"1,201,824 bytes sent","bytes_sent":1201824,"session_seconds":9,"persistent":false}},"first_seen":"2026-08-06T04:21:41","last_seen":"2026-08-18T23:44:06","events_24h":0,"events_7d":987,"geo":{"country_code":"US","country_name":"United States","region":"Virginia","city":"Ashburn","lat":39.018,"lon":-77.539,"asn":31898,"org":"Oracle Corporation"},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as31898","label":"Oracle Cloud Infrastructure","category":"cdn","url":"https://www.peeringdb.com/asn/31898"},"cve_matches":[],"malware":[],"top_ports":[{"port":9443,"proto":"tcp","label":"","count":290},{"port":443,"proto":"tcp","label":"HTTPS","count":222},{"port":8443,"proto":"tcp","label":"HTTPS-alt","count":185},{"port":80,"proto":"tcp","label":"HTTP","count":185},{"port":8880,"proto":"tcp","label":"","count":150},{"port":3000,"proto":"tcp","label":"Web-alt","count":144},{"port":4443,"proto":"tcp","label":"","count":132},{"port":8080,"proto":"tcp","label":"HTTP-alt","count":128},{"port":5173,"proto":"tcp","label":"","count":107},{"port":81,"proto":"tcp","label":"","count":95},{"port":8000,"proto":"tcp","label":"HTTP-alt","count":84},{"port":2082,"proto":"tcp","label":"","count":76},{"port":8888,"proto":"tcp","label":"HTTP-alt","count":69},{"port":8181,"proto":"tcp","label":"","count":66},{"port":9000,"proto":"tcp","label":"Web-alt","count":59}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i131300_f57a46bbacb6_3b244d8fbcc8","t13i1314h1_f57a46bbacb6_3b244d8fbcc8","t13i131200_f57a46bbacb6_fb48f8b98a29","t13i131000_f57a46bbacb6_ab7e3b40a677"],"tls_ja3":["37b3769f942aae0789e38e380a532088","14208605ee8a4027cfaf811c4f9b9879","1bc20275bb75de617c2c3628366e80fd","2196848d251b217de8b2c037e356c11d"],"ja4h":["ge11nn0400_88d30a62b7ad","po11nn0600_ed383ed8462e","ge11nn0500_d3a2dcb1cd63","ge11nn0500_cac2c496544b"]},"fingerprint_peers":{"t13i131300_f57a46bbacb6_3b244d8fbcc8":1,"t13i1314h1_f57a46bbacb6_3b244d8fbcc8":2,"t13i131200_f57a46bbacb6_fb48f8b98a29":10,"t13i131000_f57a46bbacb6_ab7e3b40a677":5352,"ge11nn0500_d3a2dcb1cd63":1285,"ge11nn0500_cac2c496544b":85,"po11nn0600_ed383ed8462e":331,"ge11nn0400_88d30a62b7ad":4888},"user_agents":["Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 Chrome/126.0.0.0 Safari/537.36","Mozilla/5.0 (compatible; research-scan/1.0)","Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 Chrome/126.0.0.0 Safari/537.36","wp2shell","Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36","Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/126.0.0.0 Safari/537.36","Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:128.0) Gecko/20100101 Firefox/128.0"],"timeline":[{"date":"2026-08-06","count":1428},{"date":"2026-08-09","count":77},{"date":"2026-08-10","count":16},{"date":"2026-08-17","count":81},{"date":"2026-08-18","count":906}],"recent_events":[{"timestamp":"2026-08-18T23:44:06","port":8443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"localhost","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"connection\":\"keep-alive\",\"host\":\"localhost\",\"user-agent\":\"Mozilla/5.0 (compatible; research-scan/1.0)\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"/docker-compose.yaml","summary":"","payload_hex":"474554202f646f636b65722d636f6d706f73652e79616d6c20485454502f312e310d0a486f73743a206c6f63616c686f73740d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b2072657365617263682d7363616e2f312e30290d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; research-scan/1.0)","ja3":"bbfe3507a810aa6c11c659bd4c7b4cbd","session":"b436442d-8f1c-47a7-aa93-f8281966d4c8","seq":5,"duration_ms":4921,"bytes_in":850,"bytes_out":400},{"timestamp":"2026-08-18T23:44:06","port":8443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"localhost","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"connection\":\"keep-alive\",\"host\":\"localhost\",\"user-agent\":\"Mozilla/5.0 (compatible; research-scan/1.0)\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"/.aws/credentials","summary":"","payload_hex":"474554202f2e6177732f63726564656e7469616c7320485454502f312e310d0a486f73743a206c6f63616c686f73740d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b2072657365617263682d7363616e2f312e30290d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; research-scan/1.0)","ja3":"bbfe3507a810aa6c11c659bd4c7b4cbd","session":"4a176571-833d-4785-a0df-2ec459c5fc57","seq":5,"duration_ms":5292,"bytes_in":837,"bytes_out":400},{"timestamp":"2026-08-18T23:44:06","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"localhost","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"connection\":\"keep-alive\",\"host\":\"localhost\",\"user-agent\":\"Mozilla/5.0 (compatible; research-scan/1.0)\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"/.aws/credentials","summary":"","payload_hex":"474554202f2e6177732f63726564656e7469616c7320485454502f312e310d0a486f73743a206c6f63616c686f73740d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b2072657365617263682d7363616e2f312e30290d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; research-scan/1.0)","ja3":"bbfe3507a810aa6c11c659bd4c7b4cbd","session":"50e8626d-c3f5-48fb-82ef-f789c1285264","seq":5,"duration_ms":4553,"bytes_in":822,"bytes_out":400},{"timestamp":"2026-08-18T23:44:06","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"localhost","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"connection\":\"keep-alive\",\"host\":\"localhost\",\"user-agent\":\"Mozilla/5.0 (compatible; research-scan/1.0)\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"/server.js","summary":"","payload_hex":"474554202f7365727665722e6a7320485454502f312e310d0a486f73743a206c6f63616c686f73740d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b2072657365617263682d7363616e2f312e30290d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; research-scan/1.0)","ja3":"bbfe3507a810aa6c11c659bd4c7b4cbd","session":"9a839b70-071f-4d90-af54-b31315ef1a7e","seq":5,"duration_ms":4343,"bytes_in":820,"bytes_out":400},{"timestamp":"2026-08-18T23:44:06","port":8443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"localhost","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"connection\":\"keep-alive\",\"host\":\"localhost\",\"user-agent\":\"Mozilla/5.0 (compatible; research-scan/1.0)\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"/server.js","summary":"","payload_hex":"474554202f7365727665722e6a7320485454502f312e310d0a486f73743a206c6f63616c686f73740d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b2072657365617263682d7363616e2f312e30290d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; research-scan/1.0)","ja3":"bbfe3507a810aa6c11c659bd4c7b4cbd","session":"faf7534a-2d7c-43ca-a750-ebaf491763f7","seq":5,"duration_ms":4997,"bytes_in":842,"bytes_out":400},{"timestamp":"2026-08-18T23:44:06","port":8443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"localhost","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"connection\":\"keep-alive\",\"host\":\"localhost\",\"user-agent\":\"Mozilla/5.0 (compatible; research-scan/1.0)\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"/app.js","summary":"","payload_hex":"474554202f6170702e6a7320485454502f312e310d0a486f73743a206c6f63616c686f73740d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b2072657365617263682d7363616e2f312e30290d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; research-scan/1.0)","ja3":"bbfe3507a810aa6c11c659bd4c7b4cbd","session":"5d5f107d-3e6e-4172-86ae-8f651e103a53","seq":5,"duration_ms":4997,"bytes_in":834,"bytes_out":400},{"timestamp":"2026-08-18T23:44:06","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"localhost","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"connection\":\"keep-alive\",\"host\":\"localhost\",\"user-agent\":\"Mozilla/5.0 (compatible; research-scan/1.0)\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"/app.js","summary":"","payload_hex":"474554202f6170702e6a7320485454502f312e310d0a486f73743a206c6f63616c686f73740d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b2072657365617263682d7363616e2f312e30290d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; research-scan/1.0)","ja3":"bbfe3507a810aa6c11c659bd4c7b4cbd","session":"ff131729-b825-4584-a7b2-64b2cb3d9705","seq":5,"duration_ms":4339,"bytes_in":812,"bytes_out":400},{"timestamp":"2026-08-18T23:44:06","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"localhost","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"connection\":\"keep-alive\",\"host\":\"localhost\",\"user-agent\":\"Mozilla/5.0 (compatible; research-scan/1.0)\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"/docker-compose.yaml","summary":"","payload_hex":"474554202f646f636b65722d636f6d706f73652e79616d6c20485454502f312e310d0a486f73743a206c6f63616c686f73740d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b2072657365617263682d7363616e2f312e30290d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; research-scan/1.0)","ja3":"bbfe3507a810aa6c11c659bd4c7b4cbd","session":"14f96c7d-8350-43b4-9d66-3da8466be086","seq":5,"duration_ms":4343,"bytes_in":836,"bytes_out":400},{"timestamp":"2026-08-18T23:44:05","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"localhost","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"connection\":\"keep-alive\",\"host\":\"localhost\",\"user-agent\":\"Mozilla/5.0 (compatible; research-scan/1.0)\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"/terraform.tfvars","summary":"","payload_hex":"474554202f7465727261666f726d2e74667661727320485454502f312e310d0a486f73743a206c6f63616c686f73740d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b2072657365617263682d7363616e2f312e30290d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; research-scan/1.0)","ja3":"bbfe3507a810aa6c11c659bd4c7b4cbd","session":"d16ed174-56cc-46da-8dc0-11f22e14ce06","seq":4,"duration_ms":3875,"bytes_in":658,"bytes_out":320},{"timestamp":"2026-08-18T23:44:05","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"localhost","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"connection\":\"keep-alive\",\"host\":\"localhost\",\"user-agent\":\"Mozilla/5.0 (compatible; research-scan/1.0)\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"/docker-compose.yml","summary":"","payload_hex":"474554202f646f636b65722d636f6d706f73652e796d6c20485454502f312e310d0a486f73743a206c6f63616c686f73740d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b2072657365617263682d7363616e2f312e30290d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; research-scan/1.0)","ja3":"bbfe3507a810aa6c11c659bd4c7b4cbd","session":"9f5513c1-e7bd-43b7-8807-c1c5c85d1e44","seq":4,"duration_ms":3879,"bytes_in":670,"bytes_out":320}],"http_methods":[{"method":"GET","count":2507},{"method":"POST","count":1}],"distinct_ports_total":31,"top_paths":[{"path":"/","count":75,"ports":31},{"path":"/.env","count":71,"ports":31},{"path":"/wp-config.php.bak","count":65,"ports":27},{"path":"/.docker/config.json","count":64,"ports":28},{"path":"/.env.bak","count":64,"ports":27},{"path":"/.git/config","count":63,"ports":27},{"path":"/.env.local","count":62,"ports":24},{"path":"/actuator/env","count":61,"ports":25},{"path":"/.env.production","count":61,"ports":25},{"path":"/.git/HEAD","count":61,"ports":25},{"path":"/phpinfo.php","count":59,"ports":24},{"path":"/.git-credentials","count":59,"ports":25},{"path":"/.env.prod","count":58,"ports":26},{"path":"/.env.production.local","count":54,"ports":24},{"path":"/.aws/credentials","count":54,"ports":24}],"distinct_paths_total":140,"top_snis":[],"top_hosts":[{"value":"localhost","count":264}],"top_alpns":[{"value":"http/1.1","count":528}],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","Accept-Encoding","Connection","Host","User-Agent"],"representative":[{"name":"Accept","value":"*/*","notable":false},{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Connection","value":"keep-alive","notable":false},{"name":"Host","value":"localhost","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (compatible; research-scan/1.0)","notable":false}],"distinct_sets":1,"events_with_headers":10},"tags":[],"data_as_of":"2026-08-20T21:23:02.556508+00:00"}