{"ip":"165.227.141.56","total_events":79,"verdict":{"verdict":"scanning","label":"Scanning for known vulnerabilities","detail":"10 exploit-path probe(s)","confidence":"medium","network_type":"CDN","why":["10 request(s) matched a known exploit path.","Only GET/HEAD seen, no request body: scanning for the vulnerability, not delivering a payload.","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"89,991 bytes sent","bytes_sent":89991,"session_seconds":2,"persistent":false}},"first_seen":"2026-09-25T16:08:37","last_seen":"2026-09-27T18:18:24","events_24h":0,"events_7d":79,"geo":{"country_code":"DE","country_name":"Germany","region":"Hesse","city":"Frankfurt am Main","lat":50.1169,"lon":8.6837,"asn":14061,"org":"DigitalOcean, LLC"},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as14061","label":"DigitalOcean","category":"cdn","url":"https://www.peeringdb.com/asn/14061"},"cve_matches":[],"malware":[],"top_ports":[{"port":9990,"proto":"tcp","label":"","count":40},{"port":8443,"proto":"tcp","label":"HTTPS-alt","count":10},{"port":4443,"proto":"tcp","label":"","count":10},{"port":8080,"proto":"tcp","label":"HTTP-alt","count":10},{"port":5001,"proto":"tcp","label":"","count":2},{"port":4848,"proto":"tcp","label":"","count":2},{"port":2375,"proto":"tcp","label":"Docker","count":2},{"port":3001,"proto":"tcp","label":"","count":2},{"port":888,"proto":"tcp","label":"","count":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i251000_b78ed14e2fd0_f50d94e863eb"],"tls_client_hello":"16030105ee010005ea0303c58e55bf865c02e6c0eae30df02da67e662f65f5b03665d3573bd489dc645586200827c91ea8edb34116245a1f5d01a79c1cec430a3ad8d55696382439fb8c5fc70032c02bc02fc02cc030cca9cca8c009c013c00ac014009c009d002f0035c012000ac023c027003cc007c01100051301130213030100056f000b00020100ff010001000017000000120000000500050100000000000a0010000e11ec11eb11ed001d001700180019000d001c001a090409050906080404030807080508060401050106010503060300320020001e090409050906080404030807080508060401050106010503060302010203002b0009080304030303020301003304ea04e811ec04c0ef0153a0870832f0003fc3a565f22c6e125e94d70bf7740ce4576f1e4546afeca53a4c6ebb699852852433e32af07586d6f35fe99b79c39959198aa9baa0a4096babf9b45d70c6ce13b573d2401a8e6188a7fcc2ba82ba38c8ca4146c98806a36d2a19507cbd1ae07e5d53ae3d378a9a753c9409745cc71167790cb91cc6f873a1446851f1d427fd31171f196f7fd4839739c118cc237d74a1c6d03cc76215e3388c2e6205c3d6c885b20a5d1c693084cb9061772b5a5eefa66416361481cb0ed83602af7658c072c4fc3888f6392601016b326b452988a824b0cf935b64ff67c05dd97b1d7845d9302d6b12948bcb5475e2250bc026ca2659ac01200b080a56235ec850b4cce44abfaa328c01a597a05d12193156e91ba98199eb88a418c0997a442d0e52642b37278862a6ca942fc0e3950ac14afec43a825bb3eb411711566eb5739f6e67329e0030b52822825374e231a67215489fe54103037a091177b6939f9be45a6944259c69ce338478ee73bf39f800069c85cea314d0e4a642b0a9dfb3ae8a34b594054b47a7a058115372ab177d94c8ba0c0fbf089ddd33b656c645842170db4432b1f2a8f90755748799fa494cea06c5d866a5e01980d7f4c3ec6b83216423ca874f2ad0c204e9a6b3551c27a3ba83e645b4fc2b86015278475f18187da5b3af8d72aca82167aae299b0507049b860f2f3914318123f888ce0e7144e500ba4170c6375b2b6955ccb8a6bb20b3c5d8c4f2814b1dd51721be353d513408a21adfe40cca42b01be779f33491fd9039d1291c049550c31b7ab1d8602c8c393a73734357627ec72a3d94c8d4f40553a15082755ad853c012dc22e52400883465fc437903799785e066ce16474c15414198a0c3bdc1e03cc515c458398250d367273206c251318119de76f63932d073863d500a5bf887449622e31dc3e66026cfef5b8771c4ca7a457214c2083877d80854d365baf61186c71856ed7f6000d531a7cda34a9ccc16d096573d08182a6ae30240b839a8259c823d82b40c24897465357687496afa09a81032a16b5a14bab7b5c99106385a1056927c5b4ce22643804dab89e80599cfa6f36b66d3e5a761dbc33edf30f768c9428ec4c4df033676515cfdb2b79499bdac56ab83876df007fb200860e4a2f55526a9cea90dfcbb604c5ae2d60728ed9b78264490c53306f11927f10464b55514fa7669a982384e08a93e1a25f2435ef002ee5ca952c96aa8bc46b0fbc9bf95a3c71f013b8855a2c97c965f2c54acb96c573c585246bf54a671d8306db1528f05190394b57b6d8bc4b35b64d17b7b3db2f5a920c604960bb774e76d2254bf9384460c80b4093229701eb0c12c4b14ae9569901da34473cbd805b1bc115cdbba30231d892515cbb7a1662936c4e22e3845be119d443509718b426a42691600cb670365a53c055d5bf17963388406d6ce447756a08c97b3d35b4a81db85154f1382c10141ab6a233324fdb57b7cc09bdcc78acbd6519669235068833b7e6b31e921f06dc855c10b730736a0b48916e250edc155046e1617eb96306124b7a0ccb527896a40668b817ce9c1c4002ca63e0ca175a87438d665956ab4868fa02bc8a452541aa39c7c8ede63809212809522fea96554c0917ef4d86c7bbda6558778a2eac6b5538690593e34db4db86ed298c5697efc429e60772082f0b2deedb9e55635e8b96bdf24e001d002093e34db4db86ed298c5697efc429e60772082f0b2deedb9e55635e8b","tls_ja3":["416eca07dcaad72dec6f76d1277b3eff"],"http_akin":["a11cun060_00c0004e_0af44bea","a11cun050_0000005d_7266f93a"]},"fingerprint_peers":{"t13i251000_b78ed14e2fd0_f50d94e863eb":38,"a11cun060_00c0004e_0af44bea":39,"a11cun050_0000005d_7266f93a":42},"akin_families":{},"user_agents":["Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36","Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_6) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.0.1 Safari/605.1.15","Mozilla/5.0 (Macintosh, Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.7 Safari/605.1.15","Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.32 Safari/537.36","Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko/20100101 Firefox/124.0","Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Whale/4.32.315.22 Safari/537.36","Mozilla/5.0 (X11; Linux x86_64; rv:1.9.5.20) Gecko/ Firefox/3.6.12","Mozilla/5.0 (Windows NT 10.0; rv:128.0) Gecko/20100101 Firefox/128.0"],"timeline":[{"date":"2026-09-25","count":9},{"date":"2026-09-27","count":70}],"recent_events":[{"timestamp":"2026-09-27T18:18:24","port":9990,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"accept-language\":\"en\",\"host\":\"<HONEYPOT>:9990\",\"user-agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/.env.staging","summary":"","payload_hex":"474554202f2e656e762e73746167696e6720485454502f312e310d0a486f73743a20<HONEYPOT>3a393939300d0a557365722d4167656e743a204d6f7a696c6c612f352e3020284d6163696e746f73683b20496e74656c204d6163204f5320582031305f31355f3729204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3131382e302e302e30205361666172692f3533372e33360d0a4163636570743a202a2f2a0d0a4163636570742d4c616e67756167653a20656e0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36","ja3":"","session":"1d184b72-04f8-47cb-a238-f56863e80962","seq":3,"duration_ms":313,"bytes_in":671,"bytes_out":237},{"timestamp":"2026-09-27T18:18:24","port":9990,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"accept-language\":\"en\",\"host\":\"<HONEYPOT>:9990\",\"user-agent\":\"Mozilla/5.0 (X11; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/.env.development","summary":"","payload_hex":"474554202f2e656e762e646576656c6f706d656e7420485454502f312e310d0a486f73743a20<HONEYPOT>3a393939300d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578206936383629204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3134302e302e302e30205361666172692f3533372e33360d0a4163636570743a202a2f2a0d0a4163636570742d4c616e67756167653a20656e0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36","ja3":"","session":"1d184b72-04f8-47cb-a238-f56863e80962","seq":4,"duration_ms":416,"bytes_in":901,"bytes_out":316},{"timestamp":"2026-09-27T18:18:24","port":9990,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"accept-language\":\"en\",\"host\":\"<HONEYPOT>:9990\",\"user-agent\":\"Mozilla/5.0 (Windows NT 6.2; rv:140.) Gecko/20100101 Firefox/140.\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/.env.local","summary":"","payload_hex":"474554202f2e656e762e6c6f63616c20485454502f312e310d0a486f73743a20<HONEYPOT>3a393939300d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e5420362e323b2072763a3134302e29204765636b6f2f32303130303130312046697265666f782f3134302e0d0a4163636570743a202a2f2a0d0a4163636570742d4c616e67756167653a20656e0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 6.2; rv:140.) Gecko/20100101 Firefox/140.","ja3":"","session":"1d184b72-04f8-47cb-a238-f56863e80962","seq":5,"duration_ms":519,"bytes_in":1091,"bytes_out":395},{"timestamp":"2026-09-27T18:18:24","port":9990,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"accept-language\":\"en\",\"host\":\"<HONEYPOT>:9990\",\"user-agent\":\"Mozilla/5.0 (X11; Linux i686; rv:1.9.5.20) Gecko/ Firefox/6.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/.env.backup","summary":"","payload_hex":"474554202f2e656e762e6261636b757020485454502f312e310d0a486f73743a20<HONEYPOT>3a393939300d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b204c696e757820693638363b2072763a312e392e352e323029204765636b6f2f2046697265666f782f362e300d0a4163636570743a202a2f2a0d0a4163636570742d4c616e67756167653a20656e0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux i686; rv:1.9.5.20) Gecko/ Firefox/6.0","ja3":"","session":"1d184b72-04f8-47cb-a238-f56863e80962","seq":6,"duration_ms":621,"bytes_in":1278,"bytes_out":474},{"timestamp":"2026-09-27T18:18:24","port":9990,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"accept-language\":\"en\",\"host\":\"<HONEYPOT>:9990\",\"user-agent\":\"Mozilla/5.0 (Kubuntu; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/.env.bak","summary":"","payload_hex":"474554202f2e656e762e62616b20485454502f312e310d0a486f73743a20<HONEYPOT>3a393939300d0a557365722d4167656e743a204d6f7a696c6c612f352e3020284b7562756e74753b204c696e7578207838365f363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132382e302e302e30205361666172692f3533372e33360d0a4163636570743a202a2f2a0d0a4163636570742d4c616e67756167653a20656e0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Kubuntu; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36","ja3":"","session":"1d184b72-04f8-47cb-a238-f56863e80962","seq":7,"duration_ms":724,"bytes_in":1506,"bytes_out":553},{"timestamp":"2026-09-27T18:18:24","port":9990,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"accept-language\":\"en\",\"host\":\"<HONEYPOT>:9990\",\"user-agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_6) AppleWebKit/608.2.11 (KHTML, like Gecko) Version/13 Safari/608.2.11\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/api/.env","summary":"","payload_hex":"474554202f6170692f2e656e7620485454502f312e310d0a486f73743a20<HONEYPOT>3a393939300d0a557365722d4167656e743a204d6f7a696c6c612f352e3020284d6163696e746f73683b20496e74656c204d6163204f5320582031305f31335f3629204170706c655765624b69742f3630382e322e313120284b48544d4c2c206c696b65204765636b6f292056657273696f6e2f3133205361666172692f3630382e322e31310d0a4163636570743a202a2f2a0d0a4163636570742d4c616e67756167653a20656e0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_6) AppleWebKit/608.2.11 (KHTML, like Gecko) Version/13 Safari/608.2.11","ja3":"","session":"1d184b72-04f8-47cb-a238-f56863e80962","seq":8,"duration_ms":827,"bytes_in":1744,"bytes_out":632},{"timestamp":"2026-09-27T18:18:24","port":9990,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"accept-language\":\"en\",\"host\":\"<HONEYPOT>:9990\",\"user-agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/backend/.env","summary":"","payload_hex":"474554202f6261636b656e642f2e656e7620485454502f312e310d0a486f73743a20<HONEYPOT>3a393939300d0a557365722d4167656e743a204d6f7a696c6c612f352e3020284d6163696e746f73683b20496e74656c204d6163204f5320582031305f31355f3729204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132382e302e302e30205361666172692f3533372e33360d0a4163636570743a202a2f2a0d0a4163636570742d4c616e67756167653a20656e0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36","ja3":"","session":"1d184b72-04f8-47cb-a238-f56863e80962","seq":9,"duration_ms":930,"bytes_in":1988,"bytes_out":711},{"timestamp":"2026-09-27T18:18:24","port":9990,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"accept-language\":\"en\",\"host\":\"<HONEYPOT>:9990\",\"user-agent\":\"Mozilla/5.0 (Kubuntu; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/app/.env","summary":"","payload_hex":"474554202f6170702f2e656e7620485454502f312e310d0a486f73743a20<HONEYPOT>3a393939300d0a557365722d4167656e743a204d6f7a696c6c612f352e3020284b7562756e74753b204c696e7578206936383629204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3133342e302e302e30205361666172692f3533372e33360d0a4163636570743a202a2f2a0d0a4163636570742d4c616e67756167653a20656e0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Kubuntu; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36","ja3":"","session":"1d184b72-04f8-47cb-a238-f56863e80962","seq":10,"duration_ms":1033,"bytes_in":2214,"bytes_out":790},{"timestamp":"2026-09-27T18:18:23","port":9990,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"accept-language\":\"en\",\"host\":\"<HONEYPOT>:9990\",\"user-agent\":\"Mozilla/5.0 (X11; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/.env","summary":"","payload_hex":"474554202f2e656e7620485454502f312e310d0a486f73743a20<HONEYPOT>3a393939300d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578206936383629204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3134322e302e302e30205361666172692f3533372e33360d0a4163636570743a202a2f2a0d0a4163636570742d4c616e67756167653a20656e0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36","ja3":"","session":"1d184b72-04f8-47cb-a238-f56863e80962","seq":1,"duration_ms":100,"bytes_in":218,"bytes_out":79},{"timestamp":"2026-09-27T18:18:23","port":9990,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"accept-language\":\"en\",\"host\":\"<HONEYPOT>:9990\",\"user-agent\":\"Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/.env.production","summary":"","payload_hex":"474554202f2e656e762e70726f64756374696f6e20485454502f312e310d0a486f73743a20<HONEYPOT>3a393939300d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e5420362e313b2057696e36343b207836343b2072763a3130392e3029204765636b6f2f32303130303130312046697265666f782f3131332e300d0a4163636570743a202a2f2a0d0a4163636570742d4c616e67756167653a20656e0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:109.0) Gecko/20100101 Firefox/113.0","ja3":"","session":"1d184b72-04f8-47cb-a238-f56863e80962","seq":2,"duration_ms":211,"bytes_in":427,"bytes_out":158}],"http_methods":[{"method":"GET","count":79}],"distinct_ports_total":9,"top_paths":[{"path":"/","count":9,"ports":5},{"path":"/.env","count":7,"ports":4},{"path":"/.env.staging","count":7,"ports":4},{"path":"/app/.env","count":7,"ports":4},{"path":"/api/.env","count":7,"ports":4},{"path":"/.env.local","count":7,"ports":4},{"path":"/.env.backup","count":7,"ports":4},{"path":"/.env.bak","count":7,"ports":4},{"path":"/backend/.env","count":7,"ports":4},{"path":"/.env.production","count":7,"ports":4},{"path":"/.env.development","count":7,"ports":4}],"distinct_paths_total":11,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","Accept-Encoding","Accept-Language","Host","User-Agent"],"representative":[{"name":"Accept","value":"*/*","notable":false},{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Accept-Language","value":"en","notable":false},{"name":"Host","value":"<HONEYPOT>:9990","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36","notable":false}],"distinct_sets":1,"events_with_headers":10},"tags":[],"data_as_of":"2026-09-28T20:50:48.783513+00:00"}