{"ip":"163.192.193.212","total_events":369,"verdict":{"verdict":"scanning","label":"Scanning for known vulnerabilities","detail":"15 exploit-path probe(s)","confidence":"medium","network_type":"CDN","why":["15 request(s) matched a known exploit path.","Only GET/HEAD seen, no request body: scanning for the vulnerability, not delivering a payload.","Not in any known-scanner range."]},"first_seen":"2026-04-29T10:03:35","last_seen":"2026-07-08T22:41:48","events_24h":247,"events_7d":353,"geo":{"country_code":"US","country_name":"United States","region":"Illinois","city":"Chicago","lat":41.8486,"lon":-87.6288,"asn":31898,"org":"Oracle Corporation"},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as31898","label":"Oracle Cloud Infrastructure","category":"cdn","url":"https://www.peeringdb.com/asn/31898"},"cve_matches":[{"cve_id":"CVE-2020-15895","title":"D-Link DIR-816L 2.x - Cross-Site Scripting","severity":"medium","actively_exploited":false,"match_field":"url_path","matched_pattern":"/info.php"}],"malware":[],"top_ports":[{"port":8444,"proto":"tcp","label":"","count":95},{"port":8000,"proto":"tcp","label":"HTTP-alt","count":95},{"port":8443,"proto":"tcp","label":"HTTPS-alt","count":93},{"port":9443,"proto":"tcp","label":"","count":15},{"port":443,"proto":"tcp","label":"HTTPS","count":15},{"port":8081,"proto":"tcp","label":"","count":12},{"port":80,"proto":"tcp","label":"HTTP","count":12},{"port":8080,"proto":"tcp","label":"HTTP-alt","count":12},{"port":8888,"proto":"tcp","label":"HTTP-alt","count":10},{"port":8008,"proto":"tcp","label":"HTTP-alt","count":10}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i1010h1_61a7ad8aa9b6_3a8073edd8ef"],"tls_ja3":["6ff0214ef0730ba88bab4623f4625d27","7ed115eff3d96ae84c8c36fb5300ca3e","60f3cd36aca41ce3a70a7a60a28a8182","6833031e95c63532ef20576bb4956d7d"],"ja4h":["ge11nn0400_cf1edba2959c","he11nn0400_cf1edba2959c"]},"fingerprint_peers":{"t13i1010h1_61a7ad8aa9b6_3a8073edd8ef":6,"he11nn0400_cf1edba2959c":2,"ge11nn0400_cf1edba2959c":4},"user_agents":["Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"],"timeline":[{"date":"2026-04-29","count":16},{"date":"2026-07-05","count":71},{"date":"2026-07-07","count":15},{"date":"2026-07-08","count":267}],"recent_events":[{"timestamp":"2026-07-08T22:41:48","port":8000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip,deflate\",\"host\":\"<HONEYPOT>:8000\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/.netrc","summary":"","payload_hex":"474554202f2e6e6574726320485454502f312e310d0a6163636570743a202a2f2a0d0a757365722d6167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3133312e302e302e30205361666172692f3533372e33360d0a6163636570742d656e636f64696e673a20677a69702c6465666c6174650d0a686f73743a20<HONEYPOT>3a383030300d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36","community_id":"1:Oe/4W+qxqgQhVt5GDzzjjam3wQ0=","ja3":"","session":"c5a74467-9990-47b2-9a2c-b757183d955e","seq":10,"duration_ms":1939,"bytes_in":2267,"bytes_out":800},{"timestamp":"2026-07-08T22:41:48","port":8000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip,deflate\",\"host\":\"<HONEYPOT>:8000\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/terraform.tfstate","summary":"","payload_hex":"474554202f7465727261666f726d2e7466737461746520485454502f312e310d0a6163636570743a202a2f2a0d0a757365722d6167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3133312e302e302e30205361666172692f3533372e33360d0a6163636570742d656e636f64696e673a20677a69702c6465666c6174650d0a686f73743a20<HONEYPOT>3a383030300d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36","community_id":"1:2vv8SjFoWRAxdZ+Rh/g40/h3bl0=","ja3":"","session":"051116c0-7f33-4fe8-b604-61cfdde26f8a","seq":10,"duration_ms":1939,"bytes_in":2270,"bytes_out":800},{"timestamp":"2026-07-08T22:41:48","port":8000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip,deflate\",\"host\":\"<HONEYPOT>:8000\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/terraform.tfvars","summary":"","payload_hex":"474554202f7465727261666f726d2e74667661727320485454502f312e310d0a6163636570743a202a2f2a0d0a757365722d6167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3133312e302e302e30205361666172692f3533372e33360d0a6163636570742d656e636f64696e673a20677a69702c6465666c6174650d0a686f73743a20<HONEYPOT>3a383030300d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36","community_id":"1:Avs7ltV8+7SjjgorfvSNXf7IyiA=","ja3":"","session":"52d93733-7618-4518-9833-1602d92318a0","seq":10,"duration_ms":1939,"bytes_in":2270,"bytes_out":800},{"timestamp":"2026-07-08T22:41:47","port":8000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip,deflate\",\"host\":\"<HONEYPOT>:8000\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/Procfile","summary":"","payload_hex":"474554202f50726f6366696c6520485454502f312e310d0a6163636570743a202a2f2a0d0a757365722d6167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3133312e302e302e30205361666172692f3533372e33360d0a6163636570742d656e636f64696e673a20677a69702c6465666c6174650d0a686f73743a20<HONEYPOT>3a383030300d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36","community_id":"1:lOJM6+FMFHGYvNvjt8+LLIiJbtI=","ja3":"","session":"0f1f7156-ac4d-47f7-acd5-ad06f11eb9e1","seq":9,"duration_ms":1740,"bytes_in":2066,"bytes_out":720},{"timestamp":"2026-07-08T22:41:47","port":8000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip,deflate\",\"host\":\"<HONEYPOT>:8000\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/Dockerfile","summary":"","payload_hex":"474554202f446f636b657266696c6520485454502f312e310d0a6163636570743a202a2f2a0d0a757365722d6167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3133312e302e302e30205361666172692f3533372e33360d0a6163636570742d656e636f64696e673a20677a69702c6465666c6174650d0a686f73743a20<HONEYPOT>3a383030300d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36","community_id":"1:Id7NLiKpEwL0WdZ9LEpLlhaRllE=","ja3":"","session":"ab7c2e14-1317-40f7-87ad-96645f664a6b","seq":9,"duration_ms":1738,"bytes_in":2052,"bytes_out":720},{"timestamp":"2026-07-08T22:41:47","port":8000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip,deflate\",\"host\":\"<HONEYPOT>:8000\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/id_rsa","summary":"","payload_hex":"474554202f69645f72736120485454502f312e310d0a6163636570743a202a2f2a0d0a757365722d6167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3133312e302e302e30205361666172692f3533372e33360d0a6163636570742d656e636f64696e673a20677a69702c6465666c6174650d0a686f73743a20<HONEYPOT>3a383030300d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36","community_id":"1:r6k2IgdBKm6Wo0JVlZGlra7cLuc=","ja3":"","session":"f4e0401a-3f8f-4ea3-b5f2-d64480f809f3","seq":9,"duration_ms":1738,"bytes_in":2024,"bytes_out":720},{"timestamp":"2026-07-08T22:41:47","port":8000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip,deflate\",\"host\":\"<HONEYPOT>:8000\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/.ssh/authorized_keys","summary":"","payload_hex":"474554202f2e7373682f617574686f72697a65645f6b65797320485454502f312e310d0a6163636570743a202a2f2a0d0a757365722d6167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3133312e302e302e30205361666172692f3533372e33360d0a6163636570742d656e636f64696e673a20677a69702c6465666c6174650d0a686f73743a20<HONEYPOT>3a383030300d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36","community_id":"1:Co90gG/opylq4MiqM5aF/va68SY=","ja3":"","session":"256a8d11-f01e-471c-abf4-ec1c4e6c6ad0","seq":9,"duration_ms":1737,"bytes_in":2056,"bytes_out":720},{"timestamp":"2026-07-08T22:41:47","port":8000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip,deflate\",\"host\":\"<HONEYPOT>:8000\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/.aws/config","summary":"","payload_hex":"474554202f2e6177732f636f6e66696720485454502f312e310d0a6163636570743a202a2f2a0d0a757365722d6167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3133312e302e302e30205361666172692f3533372e33360d0a6163636570742d656e636f64696e673a20677a69702c6465666c6174650d0a686f73743a20<HONEYPOT>3a383030300d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36","community_id":"1:vqtGSSE5oQs0qj011xi4+x6stbY=","ja3":"","session":"fefa9180-ecfb-4947-a1aa-eced3e0be3e4","seq":9,"duration_ms":1736,"bytes_in":2024,"bytes_out":720},{"timestamp":"2026-07-08T22:41:47","port":8000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip,deflate\",\"host\":\"<HONEYPOT>:8000\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/.kube/config","summary":"","payload_hex":"474554202f2e6b7562652f636f6e66696720485454502f312e310d0a6163636570743a202a2f2a0d0a757365722d6167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3133312e302e302e30205361666172692f3533372e33360d0a6163636570742d656e636f64696e673a20677a69702c6465666c6174650d0a686f73743a20<HONEYPOT>3a383030300d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36","community_id":"1:Oe/4W+qxqgQhVt5GDzzjjam3wQ0=","ja3":"","session":"c5a74467-9990-47b2-9a2c-b757183d955e","seq":9,"duration_ms":1735,"bytes_in":2047,"bytes_out":720},{"timestamp":"2026-07-08T22:41:47","port":8000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip,deflate\",\"host\":\"<HONEYPOT>:8000\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/.ssh/id_ed25519","summary":"","payload_hex":"474554202f2e7373682f69645f6564323535313920485454502f312e310d0a6163636570743a202a2f2a0d0a757365722d6167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3133312e302e302e30205361666172692f3533372e33360d0a6163636570742d656e636f64696e673a20677a69702c6465666c6174650d0a686f73743a20<HONEYPOT>3a383030300d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36","community_id":"1:Avs7ltV8+7SjjgorfvSNXf7IyiA=","ja3":"","session":"52d93733-7618-4518-9833-1602d92318a0","seq":9,"duration_ms":1734,"bytes_in":2040,"bytes_out":720}],"http_methods":[{"method":"GET","count":286},{"method":"HEAD","count":77}],"distinct_ports_total":10,"top_paths":[{"path":"/","count":141,"ports":10},{"path":"/.pypirc","count":3,"ports":3},{"path":"/.env.development","count":3,"ports":3},{"path":"/id_rsa","count":3,"ports":3},{"path":"/.npmrc","count":3,"ports":3},{"path":"/.netrc","count":3,"ports":3},{"path":"/.kube/config","count":3,"ports":3},{"path":"/backup.sql","count":3,"ports":3},{"path":"/config.js","count":3,"ports":3},{"path":"/settings.yml","count":3,"ports":3},{"path":"/swagger-ui.html","count":3,"ports":3},{"path":"/.travis.yml","count":3,"ports":3},{"path":"/.env.staging","count":3,"ports":3},{"path":"/server-info","count":3,"ports":3},{"path":"/elmah.axd","count":3,"ports":3}],"distinct_paths_total":75,"top_snis":[],"top_hosts":[],"top_alpns":[{"value":"http/1.1","count":228}],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","Accept-Encoding","Host","User-Agent"],"representative":[{"name":"Accept","value":"*/*","notable":false},{"name":"Accept-Encoding","value":"gzip,deflate","notable":false},{"name":"Host","value":"<HONEYPOT>:8000","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36","notable":false}],"distinct_sets":1,"events_with_headers":10},"tags":[{"tag_id":"CVE-2020-15895","tag_type":"cve","title":"D-Link DIR-816L 2.x - Cross-Site Scripting","severity":"medium","actively_exploited":false,"match_field":"url_path","matched_pattern":"/info.php","reference_urls":["https://research.loginsoft.com/bugs/multiple-vulnerabilities-discovered-in-the-d-link-firmware-dir-816l/","https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10169","https://nvd.nist.gov/vuln/detail/CVE-2020-15895","https://github.com/ARPSyndicate/kenzer-templates"]}],"data_as_of":"2026-07-09T05:30:11.072298+00:00"}