{"ip":"143.244.165.137","total_events":104,"verdict":{"verdict":"scanning","label":"Scanning for known vulnerabilities","detail":"25 exploit-path probe(s)","confidence":"medium","network_type":"CDN","why":["25 request(s) matched a known exploit path.","Only GET/HEAD seen, no request body: scanning for the vulnerability, not delivering a payload.","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"12,994 bytes sent","bytes_sent":12994,"session_seconds":2,"persistent":false}},"first_seen":"2026-09-21T18:15:58","last_seen":"2026-09-24T18:32:34","events_24h":0,"events_7d":78,"geo":{"country_code":"US","country_name":"United States","region":"New Jersey","city":"North Bergen","lat":40.7964,"lon":-74.0203,"asn":14061,"org":"DigitalOcean, LLC"},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as14061","label":"DigitalOcean","category":"cdn","url":"https://www.peeringdb.com/asn/14061"},"cve_matches":[],"malware":[],"top_ports":[{"port":8443,"proto":"tcp","label":"HTTPS-alt","count":104}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i311000_e8f1e7e78f70_d41ae481755e"],"tls_client_hello":"1603010200010001fc0303b8149e59618df4930e00c4377c1a813590fed0b4b27cc20b0c1a2d7434978c7820f85c75fc1b97f6f6d7b5b2c107d05e83d7faa433c088761ef716dded0d386226003e130213031301c02cc030009fcca9cca8ccaac02bc02f009ec024c028006bc023c0270067c00ac0140039c009c0130033009d009c003d003c0035002f00ff01000175000b000403000102000a00160014001d0017001e0019001801000101010201030104002300000016000000170000000d002a0028040305030603080708080809080a080b080408050806040105010601030303010302040205020602002b00050403040303002d00020101003300260024001d0020b6c9f4823e851824c86ffdf5d1478be93bb34c97037f89673642474c773c3a05001500dc00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000","tls_ja3":["c12b4ccd5320bbb380ca1a9df90f771d"],"http_akin":["a11cun040_0000004e_608dab68"]},"fingerprint_peers":{"t13i311000_e8f1e7e78f70_d41ae481755e":799,"a11cun040_0000004e_608dab68":846},"akin_families":{"a11cun040_0000004e_608dab68":{"head":"a11cun040_0000004e_608dab68","shapes":2,"ips":848}},"user_agents":["Mozilla/5.0"],"timeline":[{"date":"2026-09-21","count":26},{"date":"2026-09-23","count":52},{"date":"2026-09-24","count":26}],"recent_events":[{"timestamp":"2026-09-24T18:32:34","port":8443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"identity\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8443\",\"user-agent\":\"Mozilla/5.0\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/config.backup","summary":"","payload_hex":"474554202f636f6e6669672e6261636b757020485454502f312e310d0a4163636570742d456e636f64696e673a206964656e746974790d0a486f73743a20<HONEYPOT>3a383434330d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0","ja3":"c12b4ccd5320bbb380ca1a9df90f771d","session":"bc101ee5-14b9-4bd5-a1d5-7eda9b748824","seq":1,"duration_ms":101,"bytes_in":127,"bytes_out":80},{"timestamp":"2026-09-24T18:32:33","port":8443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"identity\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8443\",\"user-agent\":\"Mozilla/5.0\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/bak/.env","summary":"","payload_hex":"474554202f62616b2f2e656e7620485454502f312e310d0a4163636570742d456e636f64696e673a206964656e746974790d0a486f73743a20<HONEYPOT>3a383434330d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0","ja3":"c12b4ccd5320bbb380ca1a9df90f771d","session":"7e32f09e-ad9e-498b-8cea-6f8be12ea321","seq":1,"duration_ms":230,"bytes_in":122,"bytes_out":80},{"timestamp":"2026-09-24T18:32:33","port":8443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"identity\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8443\",\"user-agent\":\"Mozilla/5.0\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/old/.env","summary":"","payload_hex":"474554202f6f6c642f2e656e7620485454502f312e310d0a4163636570742d456e636f64696e673a206964656e746974790d0a486f73743a20<HONEYPOT>3a383434330d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0","ja3":"c12b4ccd5320bbb380ca1a9df90f771d","session":"95386a08-14e4-4e0b-b7a9-feae6aada798","seq":1,"duration_ms":282,"bytes_in":122,"bytes_out":80},{"timestamp":"2026-09-24T18:32:32","port":8443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"identity\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8443\",\"user-agent\":\"Mozilla/5.0\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/backups/.env","summary":"","payload_hex":"474554202f6261636b7570732f2e656e7620485454502f312e310d0a4163636570742d456e636f64696e673a206964656e746974790d0a486f73743a20<HONEYPOT>3a383434330d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0","ja3":"c12b4ccd5320bbb380ca1a9df90f771d","session":"8b6224ed-1f29-4424-88f2-a5b4cc625399","seq":1,"duration_ms":147,"bytes_in":126,"bytes_out":80},{"timestamp":"2026-09-24T18:32:31","port":8443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"identity\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8443\",\"user-agent\":\"Mozilla/5.0\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/home/deploy/.env","summary":"","payload_hex":"474554202f686f6d652f6465706c6f792f2e656e7620485454502f312e310d0a4163636570742d456e636f64696e673a206964656e746974790d0a486f73743a20<HONEYPOT>3a383434330d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0","ja3":"c12b4ccd5320bbb380ca1a9df90f771d","session":"33c39612-b528-4a83-b488-1805faeffae1","seq":1,"duration_ms":139,"bytes_in":130,"bytes_out":80},{"timestamp":"2026-09-24T18:32:31","port":8443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"identity\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8443\",\"user-agent\":\"Mozilla/5.0\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/backup/.env","summary":"","payload_hex":"474554202f6261636b75702f2e656e7620485454502f312e310d0a4163636570742d456e636f64696e673a206964656e746974790d0a486f73743a20<HONEYPOT>3a383434330d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0","ja3":"c12b4ccd5320bbb380ca1a9df90f771d","session":"31b81864-d324-4347-ae75-28630650d9fc","seq":1,"duration_ms":124,"bytes_in":125,"bytes_out":80},{"timestamp":"2026-09-24T18:32:30","port":8443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"identity\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8443\",\"user-agent\":\"Mozilla/5.0\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/home/ubuntu/.env","summary":"","payload_hex":"474554202f686f6d652f7562756e74752f2e656e7620485454502f312e310d0a4163636570742d456e636f64696e673a206964656e746974790d0a486f73743a20<HONEYPOT>3a383434330d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0","ja3":"c12b4ccd5320bbb380ca1a9df90f771d","session":"c615872f-c977-4d7a-baf3-6c6a2873600e","seq":1,"duration_ms":196,"bytes_in":130,"bytes_out":80},{"timestamp":"2026-09-24T18:32:29","port":8443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"identity\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8443\",\"user-agent\":\"Mozilla/5.0\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/var/www/html/.env","summary":"","payload_hex":"474554202f7661722f7777772f68746d6c2f2e656e7620485454502f312e310d0a4163636570742d456e636f64696e673a206964656e746974790d0a486f73743a20<HONEYPOT>3a383434330d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0","ja3":"c12b4ccd5320bbb380ca1a9df90f771d","session":"8279c1ef-40cf-4121-9233-054c18297b45","seq":1,"duration_ms":156,"bytes_in":131,"bytes_out":80},{"timestamp":"2026-09-24T18:32:28","port":8443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"identity\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8443\",\"user-agent\":\"Mozilla/5.0\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/var/www/.env","summary":"","payload_hex":"474554202f7661722f7777772f2e656e7620485454502f312e310d0a4163636570742d456e636f64696e673a206964656e746974790d0a486f73743a20<HONEYPOT>3a383434330d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0","ja3":"c12b4ccd5320bbb380ca1a9df90f771d","session":"c03bfa05-8f16-4cba-a075-eb409daa4518","seq":1,"duration_ms":321,"bytes_in":126,"bytes_out":80},{"timestamp":"2026-09-24T18:32:26","port":8443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"identity\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8443\",\"user-agent\":\"Mozilla/5.0\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/web/.env","summary":"","payload_hex":"474554202f7765622f2e656e7620485454502f312e310d0a4163636570742d456e636f64696e673a206964656e746974790d0a486f73743a20<HONEYPOT>3a383434330d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0","ja3":"c12b4ccd5320bbb380ca1a9df90f771d","session":"519aea33-ef72-4038-b99b-6ffaa86f8aee","seq":1,"duration_ms":109,"bytes_in":122,"bytes_out":80}],"http_methods":[{"method":"GET","count":104}],"distinct_ports_total":1,"top_paths":[{"path":"/.env","count":4,"ports":1},{"path":"/.env.production","count":4,"ports":1},{"path":"/.env.staging","count":4,"ports":1},{"path":"/old/.env","count":4,"ports":1},{"path":"/backup/.env","count":4,"ports":1},{"path":"/backups/.env","count":4,"ports":1},{"path":"/bak/.env","count":4,"ports":1},{"path":"/srv/app/.env","count":4,"ports":1},{"path":"/.env.prod","count":4,"ports":1},{"path":"/.env.dev","count":4,"ports":1},{"path":"/.env.local","count":4,"ports":1},{"path":"/api/.env","count":4,"ports":1},{"path":"/var/www/.env","count":4,"ports":1},{"path":"/config.backup","count":4,"ports":1},{"path":"/opt/app/.env","count":4,"ports":1}],"distinct_paths_total":26,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept-Encoding","Connection","Host","User-Agent"],"representative":[{"name":"Accept-Encoding","value":"identity","notable":false},{"name":"Connection","value":"close","notable":false},{"name":"Host","value":"<HONEYPOT>:8443","notable":false},{"name":"User-Agent","value":"Mozilla/5.0","notable":false}],"distinct_sets":1,"events_with_headers":10},"tags":[],"data_as_of":"2026-09-30T03:54:45.890833+00:00"}