{"ip":"143.246.203.108","data_as_of":"2026-10-24T00:12:22+00:00","observed":true,"total_events":14,"verdict":{"verdict":"scanning","label":"Scanning for known vulnerabilities","detail":"5 exploit-path probe(s)","confidence":"medium","network_type":"enterprise","why":["5 request(s) matched a known exploit path.","Only GET and HEAD requests were seen, with no body, which reads as a check for the vulnerability without a payload.","Not in any known-scanner range.","Counts include 2 interactive session(s) as well as first-packet events."],"engagement":{"level":"request","label":"Request traffic","detail":"2,437 bytes sent","bytes_sent":2437,"session_seconds":1,"persistent":false},"basis":"combined"},"first_seen":"2026-10-14T23:09:18","last_seen":"2026-10-17T05:26:22","events_24h":0,"events_7d":14,"interactive_sessions":2,"interactive_sessions_24h":0,"interactive_sessions_7d":0,"interactive_protocols":[{"protocol":"http","sessions":2}],"geo":{"country_code":"MD","country_name":"Moldova","region":"","city":"","lat":47.0188,"lon":28.8128,"asn":200019,"org":"Alexhost Srl"},"source_domain":"funky.nigga","known_scanners":[],"scanner_tag":{"key":"peeringdb:as200019","label":"AlexHost","category":"enterprise","url":"https://www.peeringdb.com/asn/200019"},"cve_matches":[],"malware":[],"udp":null,"interaction":{"window_days":90,"sessions":2,"first_seen":"2026-10-14T23:09:18","last_seen":"2026-10-14T23:09:18","verdicts":[{"verdict":"unknown","sessions":2}],"personas":[{"persona":"nginx@1.18.0, wordpress@6.5.2, leaks@1, miner@cgminer 4.11.1, elasticsearch@8.11.1, winrm@Windows Server 2019, discovery@igd 1.0, fortigate@7.2.1","sessions":2}],"services":[{"protocol":"http","port":443,"sessions":1},{"protocol":"http","port":80,"sessions":1}],"logins":[],"commands":[],"downloads":[],"files":[],"attack":[]},"top_ports":[{"port":443,"proto":"tcp","label":"HTTPS","count":14,"sessions":1},{"port":80,"proto":"tcp","label":"HTTP","count":0,"sessions":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i131000_f57a46bbacb6_ab7e3b40a677"],"tls_client_hello":"16030105c2010005be03039427f2e7b27abe17a5f2cb984c861643a1ba69b47655b8f2dfa270bec8e2ef1f20ef732d13c4c34d0210430d54a968b98a1793ea2c8e6a5749fe62632f686cc97a001acca9cca8c02bc02fc02cc030c009c013c00ac0141303130113020100055b000b00020100ff010001000017000000120000000500050100000000000a000c000a11ec001d001700180019000d0016001408040403080708050806040105010601050306030032001a0018080404030807080508060401050106010503060302010203002b00050403040303003304ea04e811ec04c0554631117bc63ff59fdb27422a0259c9438278a75b1266151097cdbb530e50e4b0ee61c036c8a7075b337123c6b1e2785e560ef9eba9fb89b86f2bcaf578c321ba820215a89683c736c74c36f41ba47090d7d0b099a06fc6f2834405563ab2b1e4bb0d1b46c2f2c07d54582b5ca28dddb5b6c1e624d3135e39487bcca4af17187cc2a83d1b27a8b5013d8f5a8c77bc4a2c288de2653d3f451071c50b08c60114a5a6f0a791a2dc4946553be90737435440b64325530a0ffbe8c02451384de41c5d154bb96a5ea4605559e537d1f2c6933b214ef7711e8682d5873cd19a172bd0927857364abc084ea72d7eb04239d93f2ec15b0e94919aecb4e9ca7c4f647e6e650ebb726eca751f1097086910c377678234a3a16a5b919e871d35c5974a277ce9f3baa2367e322208bd37527082a06f51bfa5c177401a581af507e365ae1685895e87c96c0c617ae948113a0a9fd70888ec0b5d970b0bec66a17bb33e3cad0ca42721f9cb35b7c1b6e5606fac4805b0821ce9a24afa7c3249c759da06bda91ebeba5d229c28af94a19030b1edf22494eb192b678bbb291feefa1b56b5b7df503a2014a2e2c524b41b62979b4643878bcc55cc32b86077e1c98837c2cc00caa7114d7c3735785b2715e0c19f048becac5068da1e6de2988cab804fd30d4642760781a7d7d72bd631cd47011d9904c6c1d3460e3a013b180453d73c10a5502dc32ebc1282479aa01d05bc26f838be2a17ef122e7b38adb31077e75b568b4b212e72a9eab8872a6bc45f3bb91c0c48f0cb7ebf95a12a21a02778cf5bab42267ab12649315929659b4232c00894bfe647c32cc32c525818acac0d87b04cc3203bb06b102bca9ad015cb47cd8dcb3c0668225deb805a5106c70cb2e80b4a3767478569185113b985c487a561290767b84fe3bf51764cf05209e63c379074b527a15ef29576b5f8cf76e678e363abcfd679e92812cdfb537dfbcf84737396542dd670310830b3fd11c2b8da9ef4a46e750c9815ea5686ec15d9d731a6954ac5447a77768ae0a004180313b9827bf6230e0386025fea987615b6ffa59d29ecbe035784949890fd37ad03519e1709b262c5294c384a6e724ac6d3887f3b087873ab989815245c1597787fcea408cea0ca7dd956fe03bdc898a2f1258033264b18407f408957cb85a2126632a70c756cc4a2ac242c4c0abc66443ce1d5c6f9926a7349a213a2890e134360108b51c65b6fe56b6aa65113e1aa94c260e75c149a39b556c23dc54291c937b61c3a8d969254bcd764e82ca3ae158f1f1596e0e731f9f2c3bb373f9e456253415700367d5c9b5bf100ac8deb0685db693a3b0d605926e9789a0c3447ad7c427c11717ba0b7fd5c41a1470123f051d1042b8c7a252cd60726d776b3f848d1c3400ec43c3b875fd2a440a59a1ce2f7c25cd72b35ba9bb1399bab3a0ae5570350943dbd5863dd60bf780b9f3f3035b0277d010c68e5503b2bf6194c9c113f948120621dd4d42dad4b430fd820903344d2940c7ce67168398e56174ee6d13e3e9728f1954326fca455287c14d2a75bc041fda38d11d95a71460d99a38ac168cfd540bceae41de91c5aa3370d4cf6c1c9fc410d71c4268c5c95564edd3ac0200da7177b99e9896625361fcfc0fd307159d83e4228932be338b0717b39833287a80ca981106b5e5d1d4d6dacb71e51f6e96d78eec2510c23037c777f001d002039833287a80ca981106b5e5d1d4d6dacb71e51f6e96d78eec2510c23037c777f","tls_ja3":["006598cf32b8feecd39e4337bdba9c44"],"http_akin":["b11cun040_00040016_aa48e2c8"],"interactive":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[]}},"fingerprint_peers":{"t13i131000_f57a46bbacb6_ab7e3b40a677":3140,"b11cun040_00040016_aa48e2c8":5378},"akin_families":{},"user_agents":["Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"],"timeline":[{"date":"2026-10-14","count":0,"sessions":2},{"date":"2026-10-17","count":14,"sessions":0}],"recent_events":[{"timestamp":"2026-10-17T05:26:22","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/.git/config","summary":"","payload_hex":"474554202f2e6769742f636f6e66696720485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b20476f6f676c65626f742f322e313b202b687474703a2f2f7777772e676f6f676c652e636f6d2f626f742e68746d6c290d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)","ja3":"006598cf32b8feecd39e4337bdba9c44","session":"d7cfc6f4-051b-4553-8512-a3018d7590c0","seq":1,"duration_ms":108,"bytes_in":173,"bytes_out":80},{"timestamp":"2026-10-17T05:26:21","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/Gemfile.lock","summary":"","payload_hex":"474554202f47656d66696c652e6c6f636b20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b20476f6f676c65626f742f322e313b202b687474703a2f2f7777772e676f6f676c652e636f6d2f626f742e68746d6c290d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)","ja3":"006598cf32b8feecd39e4337bdba9c44","session":"705ab018-0cbb-4deb-ba20-c2509a4b9a72","seq":1,"duration_ms":170,"bytes_in":174,"bytes_out":80},{"timestamp":"2026-10-17T05:26:21","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/.env.2","summary":"","payload_hex":"474554202f2e656e762e3220485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b20476f6f676c65626f742f322e313b202b687474703a2f2f7777772e676f6f676c652e636f6d2f626f742e68746d6c290d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)","ja3":"006598cf32b8feecd39e4337bdba9c44","session":"c6de9de9-42d9-402e-a9dd-a57c4c4c6faf","seq":1,"duration_ms":138,"bytes_in":168,"bytes_out":80},{"timestamp":"2026-10-17T05:26:21","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/.env.copy","summary":"","payload_hex":"474554202f2e656e762e636f707920485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b20476f6f676c65626f742f322e313b202b687474703a2f2f7777772e676f6f676c652e636f6d2f626f742e68746d6c290d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)","ja3":"006598cf32b8feecd39e4337bdba9c44","session":"4c1acb00-6e4d-4ae5-b077-125592c5f37e","seq":1,"duration_ms":127,"bytes_in":171,"bytes_out":80},{"timestamp":"2026-10-17T05:26:21","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/.env.prev","summary":"","payload_hex":"474554202f2e656e762e7072657620485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b20476f6f676c65626f742f322e313b202b687474703a2f2f7777772e676f6f676c652e636f6d2f626f742e68746d6c290d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)","ja3":"006598cf32b8feecd39e4337bdba9c44","session":"3ffa37fe-234d-4353-b9b8-20b6d9041e4b","seq":1,"duration_ms":125,"bytes_in":171,"bytes_out":80},{"timestamp":"2026-10-17T05:26:21","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/.env.tmp","summary":"","payload_hex":"474554202f2e656e762e746d7020485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b20476f6f676c65626f742f322e313b202b687474703a2f2f7777772e676f6f676c652e636f6d2f626f742e68746d6c290d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)","ja3":"006598cf32b8feecd39e4337bdba9c44","session":"fc3545fc-63b6-46e9-94e4-aedf4dafe293","seq":1,"duration_ms":125,"bytes_in":170,"bytes_out":80},{"timestamp":"2026-10-17T05:26:21","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/.aws/config","summary":"","payload_hex":"474554202f2e6177732f636f6e66696720485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b20476f6f676c65626f742f322e313b202b687474703a2f2f7777772e676f6f676c652e636f6d2f626f742e68746d6c290d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)","ja3":"006598cf32b8feecd39e4337bdba9c44","session":"35fae570-a0cc-4b85-a5b5-33e8a7824870","seq":1,"duration_ms":128,"bytes_in":173,"bytes_out":80},{"timestamp":"2026-10-17T05:26:21","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/.env.production","summary":"","payload_hex":"474554202f2e656e762e70726f64756374696f6e20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b20476f6f676c65626f742f322e313b202b687474703a2f2f7777772e676f6f676c652e636f6d2f626f742e68746d6c290d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)","ja3":"006598cf32b8feecd39e4337bdba9c44","session":"74082b68-b1b1-41f9-a192-23a27f136480","seq":1,"duration_ms":127,"bytes_in":177,"bytes_out":80},{"timestamp":"2026-10-17T05:26:21","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/composer.json","summary":"","payload_hex":"474554202f636f6d706f7365722e6a736f6e20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b20476f6f676c65626f742f322e313b202b687474703a2f2f7777772e676f6f676c652e636f6d2f626f742e68746d6c290d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)","ja3":"006598cf32b8feecd39e4337bdba9c44","session":"a12687c7-e988-40ce-95ec-8aee8060d453","seq":1,"duration_ms":131,"bytes_in":175,"bytes_out":80},{"timestamp":"2026-10-17T05:26:21","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/docker-compose.yaml","summary":"","payload_hex":"474554202f646f636b65722d636f6d706f73652e79616d6c20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b20476f6f676c65626f742f322e313b202b687474703a2f2f7777772e676f6f676c652e636f6d2f626f742e68746d6c290d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)","ja3":"006598cf32b8feecd39e4337bdba9c44","session":"5001ecc9-7bd8-4a83-95a0-ac2df3cd75a4","seq":1,"duration_ms":130,"bytes_in":181,"bytes_out":80}],"http_methods":[{"method":"GET","count":14}],"distinct_ports_total":2,"top_paths":[{"path":"/.env.2","count":1,"ports":1},{"path":"/Gemfile.lock","count":1,"ports":1},{"path":"/.env.prev","count":1,"ports":1},{"path":"/yarn.lock","count":1,"ports":1},{"path":"/.env.tmp","count":1,"ports":1},{"path":"/.env.copy","count":1,"ports":1},{"path":"/composer.lock","count":1,"ports":1},{"path":"/.git/config","count":1,"ports":1},{"path":"/.env.production","count":1,"ports":1},{"path":"/composer.json","count":1,"ports":1},{"path":"/.aws/config","count":1,"ports":1},{"path":"/config/settings.py","count":1,"ports":1},{"path":"/docker-compose.yaml","count":1,"ports":1},{"path":"/.aws/credentials","count":1,"ports":1}],"distinct_paths_total":14,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","Accept-Encoding","Host","User-Agent"],"representative":[{"name":"Accept","value":"*/*","notable":false},{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Host","value":"<HONEYPOT>","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)","notable":false}],"distinct_sets":1,"events_with_headers":10},"tags":[]}