{"ip":"149.102.229.157","data_as_of":"2026-10-25T12:31:33+00:00","observed":true,"total_events":63,"verdict":{"verdict":"scanning","label":"Scanning for known vulnerabilities","detail":"1 exploit-path probe(s)","confidence":"medium","network_type":null,"why":["1 request(s) matched a known exploit path.","Only GET and HEAD requests were seen, with no body, which reads as a check for the vulnerability without a payload.","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"13,454 bytes sent","bytes_sent":13454,"session_seconds":0,"persistent":false},"basis":"first_contact"},"first_seen":"2026-10-06T13:58:03","last_seen":"2026-10-06T13:58:38","events_24h":0,"events_7d":0,"interactive_sessions":0,"interactive_sessions_24h":0,"interactive_sessions_7d":0,"interactive_protocols":[],"geo":{"country_code":"TR","country_name":"Türkiye","region":"Istanbul","city":"Istanbul","lat":41.0146,"lon":28.9532,"asn":212238,"org":"Datacamp Limited"},"source_domain":"unn-149-102-229-157.datapacket.com","known_scanners":[],"scanner_tag":null,"cve_matches":[{"cve_id":"CVE-2026-20896","title":"Gitea Docker Image <= 1.26.2 - Reverse Proxy Header Authentication Bypass","severity":"critical","actively_exploited":false,"match_field":"url_path","matched_pattern":"/api/v1/user","kev_date_added":null}],"malware":[],"udp":null,"interaction":null,"top_ports":[{"port":9000,"proto":"tcp","label":"Web-alt","count":63}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i911000_0d5420ba6086_ec21bdc2dd35"],"tls_client_hello":"1603010675010006710303969fb3b51de6922a08bea6586d062ffe2146e218c7a0fa4c3722bc8cad47676d206d30b23fd39d6d74a13def9dd31557ee7c74f7b56232cb01e6bd70f228258fdb00b6130213031301c02cc03000a3009fcca9cca8ccaac0adc09fc05dc061c057c05300a7c02bc02f00a2009ec0acc09ec05cc060c056c05200a6c0afc0aec0a3c0a2c024c028006b006ac073c07700c400c3006d00c5c023c02700670040c072c07600be00bd006c00bfc00ac0140039003800880087c019003a0089c009c01300330032009a009900450044c0180034009b0046009dc09dc051009cc09cc050c0a1c0a0003d00c0003c00ba00350084002f0096004100ff01000572000b00020100000a0012001011ec001d0017001e0018001901000101002300000016000000170000000d003c003a09050906090404030503060308070808081a081b081c0809080a080b080408050806040105010601030302030301020103020202040205020602002b0009080304030303020301002d00020101003304ea04e811ec04c0bb39aa94ab7e3d1a9574e4a2bf42aacc81beed5b5c5128032887a193d80776f8466c4951374c6b13a81fae45646ad98138272a7b8c0141fabc402701776a08c6787ef59c89d8ab662c7aadd37046bcb7bea0985a3093981f4706713156b17cacf8ca94fe08acc9b6b8b36a3b6c58b265993588e9571dd15ef0980538400c171b4b9ab3811990b1a0a53d9b1445291b7cc3971869f8a4ce3cc0e300ae0975166198aa735c3cb47b0de88c21b4a9168c97c8e403414bf55b41eb3ae13c33b8450aa89144cd924a7c68c9b49b24009301f1bc7cc5e7a82af130e2e02dbc10908e5bb7134348747cab5d57b1afb061d143ba1fa36ef6061c07b2014aeb7aa8850922e11bba6c4e06bb20d2f89c70d2381036c69cc74b64da36bff3b485447150434758479582867cca495d28840fd84c62bad32369437c5956aa2c59c43bc93242b86aab99c9930812920081c86490a62828a03c37b7abc918c46601998b2a828e26f086ec8609d6d8b2d6a8bb14225d59510345a15fc21141396a5a3c337ad1d264cb74497624984ef2b9a0d553c03727c92a1d46759d0a79928310170bb09673499f94b1960b7666c6a89535753b0d29708a31165c271a79d3a04ae795d5595d0dc4874a9190b710c890c4ad3f4ab2fac7b07e511087335c8ba392aa3b84ea840935e8469b8cb567c79abfd5a571b697e9e792ae0b5f366a0e42f4bc03c4b647299107629ced045afc59b34080229ad09ca80b7a5a631291098b84d4b77de048085c988b4349a0f62168ab5cc1753eb75aa51168cfae0764ed2910ed10c2de27420586815deb87ab7c53f3c442c009529a2b7d18a12cde3298d531aa2575cbf99287c13cb8bdd9b4bc821b09d68824ebbe032026a08b4695a23fc5537098b8aa18878e4f251ee225ca2257032e73734b3b526be9ab153236bef56e399510e78b0203e584d56572253772bbe770ab738168f3bcc9348b0faac2c46b7defc1aa5a9356cf452e616a971fdc35bcc87ebd632e967987f027a616eb59d620b2c459b6bc8693fbc1115db09278d0a01b4601d389870ff6be8147477efc888aa2ce8e4687174b361bfb18cbe55b32a322b7349ac278494d58a3186605fce6b0362c47296aa50ad2cb37916e1a26c5d3a3a71a8c8d6fba228b016cdbe319bdd15ce561623aeb900850a3e3757b3793cb18480eaac148ada69155458cfb4294c72b95629b2b94c550a7d3bbcf72012832b2cb27bee356142a378633f689e9dbb36fd276e75c6ecb27c69e18baa3192ce2a1a5801813cca6bf46364addf862f53561fe33917ba3b22a6acece9b4e9d996b6fe10da0434ad6c1a31358070144ae9c4c6a6de4a72248c67e74777ce996c10787376c95b6c04d80eb5f11f437d1b083a1167dfcb860dbbaa3378997918b38db7523e9c3c1991c9f647368dcdac2e03c26d861b8fcc08eb928ca1527bae5bc0d56684c232b4604aa4c3b362b0350896cbc730be20901398423f4a31b6cacfa9414c291171283124627c0fb4996d39077aa9670ee5c261397166418969af68563c94a3de31029cb86188036ac7650260400f1c3034cb777ac09174ef926204b546cbc74eae4284d5c4472f91d6fd5b87869a821c10f4113de3f790448159ee3e75086de8c6099a840c1939e2b34778090ed1f247411bdd3e5b26569842ff37aeeca60cbdbdb120fc75ccb7b049a678c269bb8fd4469001d0020e9bf471ff716afb51855a4aba6f1002007b48ec143eea4b25f0d65f73d4fe713001b0005","tls_ja3":["da2e319a5accae0c10cc3d156bbfa65e"],"http_akin":["b11cun050_00040017_e873236c"],"interactive":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[]}},"fingerprint_peers":{"b11cun050_00040017_e873236c":709,"t13i911000_0d5420ba6086_ec21bdc2dd35":5},"akin_families":{"b11cun050_00040017_e873236c":{"head":"b11cun050_00040017_e873236c","shapes":2,"ips":709}},"user_agents":["Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/125.0"],"timeline":[{"date":"2026-10-06","count":63}],"recent_events":[{"timestamp":"2026-10-06T13:58:38","port":9000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"application/json\",\"accept-encoding\":\"identity\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:9000\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/125.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/openapi.json","summary":"","payload_hex":"474554202f6f70656e6170692e6a736f6e20485454502f312e310d0a4163636570742d456e636f64696e673a206964656e746974790d0a486f73743a20<HONEYPOT>3a393030300d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e3336204368726f6d652f3132352e300d0a4163636570743a206170706c69636174696f6e2f6a736f6e0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/125.0","ja3":"","session":"3cc1caf1-73c9-44c0-a32c-00da3eab8b08","seq":1,"duration_ms":100,"bytes_in":215,"bytes_out":80},{"timestamp":"2026-10-06T13:58:38","port":9000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"application/json\",\"accept-encoding\":\"identity\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:9000\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/125.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/.env","summary":"","payload_hex":"474554202f2e656e7620485454502f312e310d0a4163636570742d456e636f64696e673a206964656e746974790d0a486f73743a20<HONEYPOT>3a393030300d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e3336204368726f6d652f3132352e300d0a4163636570743a206170706c69636174696f6e2f6a736f6e0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/125.0","ja3":"","session":"0a6d6499-dbc7-49cf-8963-5741c32385b6","seq":1,"duration_ms":100,"bytes_in":207,"bytes_out":80},{"timestamp":"2026-10-06T13:58:37","port":9000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"application/json\",\"accept-encoding\":\"identity\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:9000\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/125.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/api/v1/balance","summary":"","payload_hex":"474554202f6170692f76312f62616c616e636520485454502f312e310d0a4163636570742d456e636f64696e673a206964656e746974790d0a486f73743a20<HONEYPOT>3a393030300d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e3336204368726f6d652f3132352e300d0a4163636570743a206170706c69636174696f6e2f6a736f6e0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/125.0","ja3":"","session":"128a4425-06fa-480d-ad6d-e0d0a59bbc9c","seq":1,"duration_ms":100,"bytes_in":217,"bytes_out":80},{"timestamp":"2026-10-06T13:58:37","port":9000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"application/json\",\"accept-encoding\":\"identity\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:9000\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/125.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/api/v1/transactions","summary":"","payload_hex":"474554202f6170692f76312f7472616e73616374696f6e7320485454502f312e310d0a4163636570742d456e636f64696e673a206964656e746974790d0a486f73743a20<HONEYPOT>3a393030300d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e3336204368726f6d652f3132352e300d0a4163636570743a206170706c69636174696f6e2f6a736f6e0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/125.0","ja3":"","session":"8ea1c8f1-b38c-43af-9728-4ae9eac5e461","seq":1,"duration_ms":100,"bytes_in":222,"bytes_out":80},{"timestamp":"2026-10-06T13:58:37","port":9000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"application/json\",\"accept-encoding\":\"identity\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:9000\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/125.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/swagger/v1/swagger.json","summary":"","payload_hex":"474554202f737761676765722f76312f737761676765722e6a736f6e20485454502f312e310d0a4163636570742d456e636f64696e673a206964656e746974790d0a486f73743a20<HONEYPOT>3a393030300d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e3336204368726f6d652f3132352e300d0a4163636570743a206170706c69636174696f6e2f6a736f6e0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/125.0","ja3":"","session":"2ff3e4a4-7c79-4c8b-8e8f-f0c345ac986e","seq":1,"duration_ms":100,"bytes_in":226,"bytes_out":80},{"timestamp":"2026-10-06T13:58:36","port":9000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"application/json\",\"accept-encoding\":\"identity\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:9000\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/125.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/api/v1/users","summary":"","payload_hex":"474554202f6170692f76312f757365727320485454502f312e310d0a4163636570742d456e636f64696e673a206964656e746974790d0a486f73743a20<HONEYPOT>3a393030300d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e3336204368726f6d652f3132352e300d0a4163636570743a206170706c69636174696f6e2f6a736f6e0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/125.0","ja3":"","session":"4617bb6f-65a8-47ff-b3c4-f7497f9f64d0","seq":1,"duration_ms":100,"bytes_in":215,"bytes_out":80},{"timestamp":"2026-10-06T13:58:36","port":9000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"application/json\",\"accept-encoding\":\"identity\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:9000\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/125.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/api/v1/wallet","summary":"","payload_hex":"474554202f6170692f76312f77616c6c657420485454502f312e310d0a4163636570742d456e636f64696e673a206964656e746974790d0a486f73743a20<HONEYPOT>3a393030300d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e3336204368726f6d652f3132352e300d0a4163636570743a206170706c69636174696f6e2f6a736f6e0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/125.0","ja3":"","session":"b17ee088-4200-4a40-8d84-02b242242ba8","seq":1,"duration_ms":100,"bytes_in":216,"bytes_out":80},{"timestamp":"2026-10-06T13:58:35","port":9000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"application/json\",\"accept-encoding\":\"identity\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:9000\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/125.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/api/admin","summary":"","payload_hex":"474554202f6170692f61646d696e20485454502f312e310d0a4163636570742d456e636f64696e673a206964656e746974790d0a486f73743a20<HONEYPOT>3a393030300d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e3336204368726f6d652f3132352e300d0a4163636570743a206170706c69636174696f6e2f6a736f6e0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/125.0","ja3":"","session":"eb45193a-36ed-4689-9eb6-c9721965c514","seq":1,"duration_ms":100,"bytes_in":212,"bytes_out":80},{"timestamp":"2026-10-06T13:58:35","port":9000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"application/json\",\"accept-encoding\":\"identity\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:9000\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/125.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/api/config","summary":"","payload_hex":"474554202f6170692f636f6e66696720485454502f312e310d0a4163636570742d456e636f64696e673a206964656e746974790d0a486f73743a20<HONEYPOT>3a393030300d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e3336204368726f6d652f3132352e300d0a4163636570743a206170706c69636174696f6e2f6a736f6e0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/125.0","ja3":"","session":"eebaec89-39dc-417a-8831-5cbaa7df3ed5","seq":1,"duration_ms":100,"bytes_in":213,"bytes_out":80},{"timestamp":"2026-10-06T13:58:35","port":9000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"application/json\",\"accept-encoding\":\"identity\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:9000\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/125.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/api/v1/user","summary":"","payload_hex":"474554202f6170692f76312f7573657220485454502f312e310d0a4163636570742d456e636f64696e673a206964656e746974790d0a486f73743a20<HONEYPOT>3a393030300d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e3336204368726f6d652f3132352e300d0a4163636570743a206170706c69636174696f6e2f6a736f6e0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/125.0","ja3":"","session":"c09f98ac-3241-49a6-a22f-ef3d5bb26694","seq":1,"duration_ms":100,"bytes_in":214,"bytes_out":80}],"http_methods":[{"method":"GET","count":63}],"distinct_ports_total":1,"top_paths":[{"path":"/api/","count":2,"ports":1},{"path":"/swagger/v1/swagger.json","count":2,"ports":1},{"path":"/api/v1/","count":2,"ports":1},{"path":"/api","count":2,"ports":1},{"path":"/api/v1","count":2,"ports":1},{"path":"/api/me","count":2,"ports":1},{"path":"/api/users","count":2,"ports":1},{"path":"/api/withdraw","count":2,"ports":1},{"path":"/.env","count":2,"ports":1},{"path":"/api/v1/balance","count":2,"ports":1},{"path":"/api/user","count":2,"ports":1},{"path":"/api/v1/wallet","count":2,"ports":1},{"path":"/api/order","count":2,"ports":1},{"path":"/api/market","count":2,"ports":1},{"path":"/api/balances","count":2,"ports":1}],"distinct_paths_total":32,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","Accept-Encoding","Connection","Host","User-Agent"],"representative":[{"name":"Accept","value":"application/json","notable":false},{"name":"Accept-Encoding","value":"identity","notable":false},{"name":"Connection","value":"close","notable":false},{"name":"Host","value":"<HONEYPOT>:9000","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/125.0","notable":false}],"distinct_sets":1,"events_with_headers":10},"tags":[{"tag_id":"CVE-2026-20896","tag_type":"cve","title":"Gitea Docker Image <= 1.26.2 - Reverse Proxy Header Authentication Bypass","severity":"critical","actively_exploited":false,"match_field":"url_path","matched_pattern":"/api/v1/user","reference_urls":["https://github.com/go-gitea/gitea/security/advisories/GHSA-f75j-4cw6-rmx4","https://blog.gitea.com/release-of-1.26.3-and-1.26.4/","https://github.com/go-gitea/gitea/pull/38151","https://www.ionix.io/threat-center/cve-2026-20896/","https://nvd.nist.gov/vuln/detail/CVE-2026-20896"],"kev_date_added":null}]}