{"ip":"163.172.73.151","total_events":97,"verdict":{"verdict":"scanning","label":"Scanning for known vulnerabilities","detail":"36 exploit-path probe(s)","confidence":"medium","network_type":"CDN","why":["36 request(s) matched a known exploit path.","Only GET/HEAD seen, no request body: scanning for the vulnerability, not delivering a payload.","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"285,884 bytes sent","bytes_sent":285884,"session_seconds":10,"persistent":false}},"first_seen":"2026-08-22T00:39:35","last_seen":"2026-08-30T18:21:31","events_24h":0,"events_7d":74,"geo":{"country_code":"FR","country_name":"France","region":"Île-de-France","city":"Paris","lat":48.8558,"lon":2.3494,"asn":12876,"org":"Scaleway SAS"},"source_domain":"163-172-73-151.rev.poneytelecom.eu","known_scanners":[],"scanner_tag":{"key":"peeringdb:as12876","label":"Scaleway","category":"cdn","url":"https://www.peeringdb.com/asn/12876"},"cve_matches":[{"cve_id":"CVE-2026-39364","title":"Vite Dev Server - Directory Traversal","severity":"high","actively_exploited":false,"match_field":"url_path","matched_pattern":"/.env?raw??"}],"malware":[],"top_ports":[{"port":5173,"proto":"tcp","label":"","count":81},{"port":5174,"proto":"tcp","label":"","count":16}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[],"ja4h":["ge11nn0400_88d30a62b7ad","ge10nn0200_3ed38b250d3d","ge11nn0300_0db47b7d240d","ge11nn0500_d3a2dcb1cd63","ge11nn0500_cac2c496544b"]},"fingerprint_peers":{"ge11nn0400_88d30a62b7ad":5888,"ge10nn0200_3ed38b250d3d":8,"ge11nn0300_0db47b7d240d":5233,"ge11nn0500_d3a2dcb1cd63":1248,"ge11nn0500_cac2c496544b":77},"user_agents":["Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 Chrome/126 Safari/537.36","ctf-service-detector/1.0","Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36","Mozilla/5.0","vite-raw-scanner/1.0"],"timeline":[{"date":"2026-08-22","count":8},{"date":"2026-08-24","count":15},{"date":"2026-08-29","count":16},{"date":"2026-08-30","count":58}],"recent_events":[{"timestamp":"2026-08-30T18:21:31","port":5173,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"host\":\"<HONEYPOT>:5173\",\"user-agent\":\"Mozilla/5.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/.env.development/.","summary":"","payload_hex":"474554202f2e656e762e646576656c6f706d656e742f2e20485454502f312e300d0a486f73743a20<HONEYPOT>3a353137330d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a0d0a","method":"GET","user_agent":"Mozilla/5.0","ja3":"","session":"d14f3997-fa44-4ffb-9c5e-aa0dd8b92630","seq":1,"duration_ms":100,"bytes_in":88,"bytes_out":79},{"timestamp":"2026-08-30T18:21:21","port":5173,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"host\":\"<HONEYPOT>:5173\",\"user-agent\":\"Mozilla/5.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/.env.local/.","summary":"","payload_hex":"474554202f2e656e762e6c6f63616c2f2e20485454502f312e300d0a486f73743a20<HONEYPOT>3a353137330d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a0d0a","method":"GET","user_agent":"Mozilla/5.0","ja3":"","session":"5208f0ca-cc46-429f-bcb9-de504005332c","seq":1,"duration_ms":100,"bytes_in":82,"bytes_out":79},{"timestamp":"2026-08-30T18:21:11","port":5173,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"host\":\"<HONEYPOT>:5173\",\"user-agent\":\"Mozilla/5.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/.env.production/.","summary":"","payload_hex":"474554202f2e656e762e70726f64756374696f6e2f2e20485454502f312e300d0a486f73743a20<HONEYPOT>3a353137330d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a0d0a","method":"GET","user_agent":"Mozilla/5.0","ja3":"","session":"b3a2af87-7b83-45b3-9aa0-6d11b74e3137","seq":1,"duration_ms":100,"bytes_in":87,"bytes_out":79},{"timestamp":"2026-08-30T18:21:01","port":5173,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"host\":\"<HONEYPOT>:5173\",\"user-agent\":\"Mozilla/5.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/.env/.","summary":"","payload_hex":"474554202f2e656e762f2e20485454502f312e300d0a486f73743a20<HONEYPOT>3a353137330d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a0d0a","method":"GET","user_agent":"Mozilla/5.0","ja3":"","session":"6bd43bdb-0600-4920-b79c-7aa42169e4db","seq":1,"duration_ms":100,"bytes_in":76,"bytes_out":79},{"timestamp":"2026-08-30T18:20:59","port":5173,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:5173\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/.env.development?import&url&inline","summary":"","payload_hex":"474554202f2e656e762e646576656c6f706d656e743f696d706f72742675726c26696e6c696e6520485454502f312e310d0a486f73743a20<HONEYPOT>3a353137330d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132362e302e302e30205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36","ja3":"","session":"c577bb99-dc9f-4fb8-9482-db2f816b688c","seq":50,"duration_ms":10337,"bytes_in":10775,"bytes_out":3950},{"timestamp":"2026-08-30T18:20:59","port":5173,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:5173\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/.env.development?raw","summary":"","payload_hex":"474554202f2e656e762e646576656c6f706d656e743f72617720485454502f312e310d0a486f73743a20<HONEYPOT>3a353137330d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132362e302e302e30205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36","ja3":"","session":"c577bb99-dc9f-4fb8-9482-db2f816b688c","seq":49,"duration_ms":10211,"bytes_in":10548,"bytes_out":3871},{"timestamp":"2026-08-30T18:20:59","port":5173,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:5173\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/.env.development?import&raw","summary":"","payload_hex":"474554202f2e656e762e646576656c6f706d656e743f696d706f72742672617720485454502f312e310d0a486f73743a20<HONEYPOT>3a353137330d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132362e302e302e30205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36","ja3":"","session":"c577bb99-dc9f-4fb8-9482-db2f816b688c","seq":48,"duration_ms":10084,"bytes_in":10335,"bytes_out":3792},{"timestamp":"2026-08-30T18:20:59","port":5173,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:5173\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/.env.development?raw?import","summary":"","payload_hex":"474554202f2e656e762e646576656c6f706d656e743f7261773f696d706f727420485454502f312e310d0a486f73743a20<HONEYPOT>3a353137330d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132362e302e302e30205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36","ja3":"","session":"c577bb99-dc9f-4fb8-9482-db2f816b688c","seq":47,"duration_ms":9961,"bytes_in":10115,"bytes_out":3713},{"timestamp":"2026-08-30T18:20:59","port":5173,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:5173\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/.env.development?inline&import","summary":"","payload_hex":"474554202f2e656e762e646576656c6f706d656e743f696e6c696e6526696d706f727420485454502f312e310d0a486f73743a20<HONEYPOT>3a353137330d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132362e302e302e30205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36","ja3":"","session":"c577bb99-dc9f-4fb8-9482-db2f816b688c","seq":46,"duration_ms":9837,"bytes_in":9895,"bytes_out":3634},{"timestamp":"2026-08-30T18:20:59","port":5173,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:5173\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/.env.development?import&raw??","summary":"","payload_hex":"474554202f2e656e762e646576656c6f706d656e743f696d706f7274267261773f3f20485454502f312e310d0a486f73743a20<HONEYPOT>3a353137330d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132362e302e302e30205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36","ja3":"","session":"c577bb99-dc9f-4fb8-9482-db2f816b688c","seq":45,"duration_ms":9710,"bytes_in":9672,"bytes_out":3555}],"http_methods":[{"method":"GET","count":97}],"distinct_ports_total":2,"top_paths":[{"path":"/","count":16,"ports":2},{"path":"/@vite/client","count":13,"ports":2},{"path":"/v1/agent/self","count":3,"ports":1},{"path":"/CFIDE/administrator/index.cfm","count":3,"ports":1},{"path":"/v1/status/leader","count":3,"ports":1},{"path":"/v1/volumes","count":3,"ports":1},{"path":"/.env/.","count":1,"ports":1},{"path":"/.env.development?import&raw??","count":1,"ports":1},{"path":"/.env.local","count":1,"ports":1},{"path":"/__vite_ping","count":1,"ports":1},{"path":"/.env?import&raw","count":1,"ports":1},{"path":"/vite.config.ts","count":1,"ports":1},{"path":"/.git/config","count":1,"ports":1},{"path":"/.env.production","count":1,"ports":1},{"path":"/.env.local?raw","count":1,"ports":1}],"distinct_paths_total":62,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept-Encoding","Host","User-Agent"],"representative":[{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Host","value":"<HONEYPOT>:5173","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36","notable":false}],"distinct_sets":2,"events_with_headers":10},"tags":[{"tag_id":"CVE-2026-39364","tag_type":"cve","title":"Vite Dev Server - Directory Traversal","severity":"high","actively_exploited":false,"match_field":"url_path","matched_pattern":"/.env?raw??","reference_urls":["https://github.com/vitejs/vite/security/advisories/GHSA-cw47-99h4-q43f","https://nvd.nist.gov/vuln/detail/CVE-2026-39364"]}],"data_as_of":"2026-09-04T21:00:40.838256+00:00"}