{"ip":"165.227.167.59","total_events":39,"verdict":{"verdict":"scanning","label":"Scanning for known vulnerabilities","detail":"10 exploit-path probe(s)","confidence":"medium","network_type":"CDN","why":["10 request(s) matched a known exploit path.","Only GET/HEAD seen, no request body: scanning for the vulnerability, not delivering a payload.","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"38,486 bytes sent","bytes_sent":38486,"session_seconds":2,"persistent":false}},"first_seen":"2026-09-25T16:54:21","last_seen":"2026-09-27T16:39:18","events_24h":0,"events_7d":39,"geo":{"country_code":"DE","country_name":"Germany","region":"Hesse","city":"Frankfurt am Main","lat":50.1169,"lon":8.6837,"asn":14061,"org":"DigitalOcean, LLC"},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as14061","label":"DigitalOcean","category":"cdn","url":"https://www.peeringdb.com/asn/14061"},"cve_matches":[],"malware":[],"top_ports":[{"port":82,"proto":"tcp","label":"","count":20},{"port":3000,"proto":"tcp","label":"Web-alt","count":10},{"port":5000,"proto":"tcp","label":"Web-alt","count":3},{"port":3001,"proto":"tcp","label":"","count":3},{"port":2082,"proto":"tcp","label":"","count":1},{"port":10000,"proto":"tcp","label":"Webmin","count":1},{"port":8088,"proto":"tcp","label":"Hadoop","count":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i251000_b78ed14e2fd0_f50d94e863eb"],"tls_client_hello":"16030105ee010005ea0303879ebbff753333c35f73fb92de9e8512c710263a6ca6498d3aeca70fe465348420568647cf59be6960be5b722c10904411d7caace746e07b695b6fc38bd41be3ab0032c02bc02fc02cc030cca9cca8c009c013c00ac014009c009d002f0035c012000ac023c027003cc007c01100051301130213030100056f000b00020100ff010001000017000000120000000500050100000000000a0010000e11ec11eb11ed001d001700180019000d001c001a090409050906080404030807080508060401050106010503060300320020001e090409050906080404030807080508060401050106010503060302010203002b0009080304030303020301003304ea04e811ec04c07a9860375c1aa630653ef001b5a9948930b6941a4f19e825945739c6579657a9c489a72774ca0ecbf025b77232549546692586523555bc0a9f1c209fdf6a9ea4d77f3192a05d2544b38ca15d78a5cf19b941b0c5185b17971a397214af8869c4a2f68e2c45086433b25bd72549305f8e807a8ec29128e1b7ecf213f6100b7dc2a9c1265ae0aa1d49345643f72b3ae05c3082c34032af9ef96df4209342301c8a3261fd352a2fe397db34840ec33778e5bd5a95b8160453d657387f4b4f59ca3cf5186dcde2515ce446a22acdd7c5c2276b3006b2126b2b93a64858c4fb5e83225883f14709063e63f7b8da725379b1a541c0782138989b664cd95216ae327916428da0b0c031440fba737fd9b6538aa2c99d2c8d7c02009b0b8afa015d447c58abc53accfb37239a583f580040dc2bc0d14d6c20c24fb605dab751942a534bf4a7a88b68de96199644516dc8c028195b6bb2c6b4ec0bff581b93549d7ea787acf4ba970348cdab98a7a50a13203fc09b7e39082236083dbfa72ed9c0035eea9d2f491360c0563059b816a7c774fb7f19d9188fd252fb9910657305ebd197fc1c5b6cc49d24c1b7836c6af2bc3a8eb08877f5ccb1a76137e8cb895384a47897db637e42b4aed3933313246125fa9097e9ad97d53612218fc1d313328797efb263608273fe30190c53c016a62da6a245eac43b2eb7706228949b633e0002b5e5146317b2866feb587135bc1e04be0f170ac0552d387a8290c8bd87ca08b7365034844bb81aa0ded718c36919fcf77828f21d6b914e8a778ef588a11c898dd7373e28292a444c2d1d7c9ab8d789a321a91fb8b42b2b9cdea7949e19a68ce16a22cc19f6c08b1eeb3f43fb4e8d079bba8b3e603c6904220fa632805a160526514f12d497fbb70eb9567355ec68e1b6021b39a47a8886676c3ebcab6b0e5c1567802d53578df1c6b5c8a01b95950d8c4088311a3b20e581fea92b5c535abe913afda6b8383cb6a8b71029e29138a90edf769b7f6ca8343aa0fe7bbdaff9b3a3bb4c2772aab56a3e79ec172b0b5b297956801c3e72a4af0c62927769602efb853661623a348019e250b278b849fb373c356faa917895f380b57936d2c511016341b3f567fb78c9a62984dfd61ff213181809017f87b69f396c2c34367cfc07dba79e9dea6f5726a1da7a32dcf869c4e1903b1193c3b27c9da67b00c0bced4c2800a66042dc22e285591b647954c96e537214f2212e6637b8d645c41a95c68c7a0dab96630544144cf31f4a73804b7948cbb8c54499cb4428adb7855bfd23909dc96d65693e1a52b7e7aa85e4046368b3a83d347513430411f13b74c8c3c7c59d3fcc278f595f6f7773876419b3cb537f036dc500c44f7badc374adc56a2de2f29d2f015851c44dfed5ad1a2b255b7544d92391e7b57d6cc2651bf65f9878c999e13157b8253f0cc276604d1cf9caea52579e42279b84800580c89e9b9172e247d5f65a14fb083388c8f45bb9009d1deab8872a74774b74afae38802c19aa73386f19850ab164a9a960a251c74aba087976b371b3648f259722d4579cf1973f481911d30ca77708bbde24647e9a4412644fd1a49cb2308b78500fc5a27fb23433cbf78ec8440998286147028033df079c381c69d9a4a1beae611bb7945c903a736c38db564bc9032798c5e6d8994339a8d7ea33fe514786eb88ebaba1d6af6dc3bd863e001d0020564bc9032798c5e6d8994339a8d7ea33fe514786eb88ebaba1d6af6d","tls_ja3":["416eca07dcaad72dec6f76d1277b3eff"],"http_akin":["a11cun060_00c0004e_0af44bea","a11cun050_0000005d_7266f93a"]},"fingerprint_peers":{"t13i251000_b78ed14e2fd0_f50d94e863eb":38,"a11cun060_00c0004e_0af44bea":39,"a11cun050_0000005d_7266f93a":43},"akin_families":{},"user_agents":["Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:109.0) Gecko/20100101 Firefox/115.0","Mozilla/5.0 (Knoppix; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36","Mozilla/5.0 (Fedora; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36","Mozilla/5.0 (Ubuntu; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36","Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.132 Safari/537.36","Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36","Mozilla/5.0 (Macintosh; Intel Mac OS X 10.11; rv:140.0) Gecko/20100101 Firefox/140.0","Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_6) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.0.3 Safari/605.1.15"],"timeline":[{"date":"2026-09-25","count":9},{"date":"2026-09-27","count":30}],"recent_events":[{"timestamp":"2026-09-27T16:39:18","port":3000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"accept-language\":\"en\",\"host\":\"<HONEYPOT>:3000\",\"user-agent\":\"Mozilla/5.0 (Fedora; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/app/.env","summary":"","payload_hex":"474554202f6170702f2e656e7620485454502f312e310d0a486f73743a20<HONEYPOT>3a333030300d0a557365722d4167656e743a204d6f7a696c6c612f352e3020284665646f72613b204c696e7578207838365f363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132392e302e302e30205361666172692f3533372e33360d0a4163636570743a202a2f2a0d0a4163636570742d4c616e67756167653a20656e0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Fedora; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36","ja3":"","session":"d2fed04e-c1b4-4899-9a17-bd74e775d549","seq":10,"duration_ms":2099,"bytes_in":2215,"bytes_out":790},{"timestamp":"2026-09-27T16:39:17","port":3000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"accept-language\":\"en\",\"host\":\"<HONEYPOT>:3000\",\"user-agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 108) AppleWebKit/536.15 (KHTML like Gecko) Version/6.0 Safari/536.16\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/.env.backup","summary":"","payload_hex":"474554202f2e656e762e6261636b757020485454502f312e310d0a486f73743a20<HONEYPOT>3a333030300d0a557365722d4167656e743a204d6f7a696c6c612f352e3020284d6163696e746f73683b20496e74656c204d6163204f5320582031303829204170706c655765624b69742f3533362e313520284b48544d4c206c696b65204765636b6f292056657273696f6e2f362e30205361666172692f3533362e31360d0a4163636570743a202a2f2a0d0a4163636570742d4c616e67756167653a20656e0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 108) AppleWebKit/536.15 (KHTML like Gecko) Version/6.0 Safari/536.16","ja3":"","session":"d2fed04e-c1b4-4899-9a17-bd74e775d549","seq":6,"duration_ms":1100,"bytes_in":1391,"bytes_out":474},{"timestamp":"2026-09-27T16:39:17","port":3000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"accept-language\":\"en\",\"host\":\"<HONEYPOT>:3000\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/.env.bak","summary":"","payload_hex":"474554202f2e656e762e62616b20485454502f312e310d0a486f73743a20<HONEYPOT>3a333030300d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b207836343b2072763a39392e3029204765636b6f2f32303130303130312046697265666f782f39392e300d0a4163636570743a202a2f2a0d0a4163636570742d4c616e67756167653a20656e0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0","ja3":"","session":"d2fed04e-c1b4-4899-9a17-bd74e775d549","seq":7,"duration_ms":1255,"bytes_in":1592,"bytes_out":553},{"timestamp":"2026-09-27T16:39:17","port":3000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"accept-language\":\"en\",\"host\":\"<HONEYPOT>:3000\",\"user-agent\":\"Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:125.0) Gecko/20100101 Firefox/125.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/api/.env","summary":"","payload_hex":"474554202f6170692f2e656e7620485454502f312e310d0a486f73743a20<HONEYPOT>3a333030300d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b205562756e74753b204c696e7578207838365f36343b2072763a3132352e3029204765636b6f2f32303130303130312046697265666f782f3132352e300d0a4163636570743a202a2f2a0d0a4163636570742d4c616e67756167653a20656e0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:125.0) Gecko/20100101 Firefox/125.0","ja3":"","session":"d2fed04e-c1b4-4899-9a17-bd74e775d549","seq":8,"duration_ms":1448,"bytes_in":1793,"bytes_out":632},{"timestamp":"2026-09-27T16:39:17","port":3000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"accept-language\":\"en\",\"host\":\"<HONEYPOT>:3000\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; rv:109.0) Gecko/20100101 Firefox/115.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/backend/.env","summary":"","payload_hex":"474554202f6261636b656e642f2e656e7620485454502f312e310d0a486f73743a20<HONEYPOT>3a333030300d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2072763a3130392e3029204765636b6f2f32303130303130312046697265666f782f3131352e300d0a4163636570743a202a2f2a0d0a4163636570742d4c616e67756167653a20656e0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; rv:109.0) Gecko/20100101 Firefox/115.0","ja3":"","session":"d2fed04e-c1b4-4899-9a17-bd74e775d549","seq":9,"duration_ms":1658,"bytes_in":1988,"bytes_out":711},{"timestamp":"2026-09-27T16:39:16","port":3000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"accept-language\":\"en\",\"host\":\"<HONEYPOT>:3000\",\"user-agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5.1 Safari/605.1.15\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/.env","summary":"","payload_hex":"474554202f2e656e7620485454502f312e310d0a486f73743a20<HONEYPOT>3a333030300d0a557365722d4167656e743a204d6f7a696c6c612f352e3020284d6163696e746f73683b20496e74656c204d6163204f5320582031305f31355f3729204170706c655765624b69742f3630352e312e313520284b48544d4c2c206c696b65204765636b6f292056657273696f6e2f31362e352e31205361666172692f3630352e312e31350d0a4163636570743a202a2f2a0d0a4163636570742d4c616e67756167653a20656e0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5.1 Safari/605.1.15","ja3":"","session":"d2fed04e-c1b4-4899-9a17-bd74e775d549","seq":1,"duration_ms":100,"bytes_in":238,"bytes_out":79},{"timestamp":"2026-09-27T16:39:16","port":3000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"accept-language\":\"en\",\"host\":\"<HONEYPOT>:3000\",\"user-agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_6) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.1.2 Safari/605.1.15\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/.env.production","summary":"","payload_hex":"474554202f2e656e762e70726f64756374696f6e20485454502f312e310d0a486f73743a20<HONEYPOT>3a333030300d0a557365722d4167656e743a204d6f7a696c6c612f352e3020284d6163696e746f73683b20496e74656c204d6163204f5320582031305f31335f3629204170706c655765624b69742f3630352e312e313520284b48544d4c2c206c696b65204765636b6f292056657273696f6e2f31332e312e32205361666172692f3630352e312e31350d0a4163636570743a202a2f2a0d0a4163636570742d4c616e67756167653a20656e0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_6) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.1.2 Safari/605.1.15","ja3":"","session":"d2fed04e-c1b4-4899-9a17-bd74e775d549","seq":2,"duration_ms":257,"bytes_in":487,"bytes_out":158},{"timestamp":"2026-09-27T16:39:16","port":3000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"accept-language\":\"en\",\"host\":\"<HONEYPOT>:3000\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/.env.staging","summary":"","payload_hex":"474554202f2e656e762e73746167696e6720485454502f312e310d0a486f73743a20<HONEYPOT>3a333030300d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b207836343b2072763a3132332e3029204765636b6f2f32303130303130312046697265666f782f3132332e300d0a4163636570743a202a2f2a0d0a4163636570742d4c616e67756167653a20656e0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0","ja3":"","session":"d2fed04e-c1b4-4899-9a17-bd74e775d549","seq":3,"duration_ms":368,"bytes_in":694,"bytes_out":237},{"timestamp":"2026-09-27T16:39:16","port":3000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"accept-language\":\"en\",\"host\":\"<HONEYPOT>:3000\",\"user-agent\":\"Mozilla/5.0 (Ubuntu; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/.env.development","summary":"","payload_hex":"474554202f2e656e762e646576656c6f706d656e7420485454502f312e310d0a486f73743a20<HONEYPOT>3a333030300d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285562756e74753b204c696e7578207838365f363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3133332e302e302e30205361666172692f3533372e33360d0a4163636570743a202a2f2a0d0a4163636570742d4c616e67756167653a20656e0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Ubuntu; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36","ja3":"","session":"d2fed04e-c1b4-4899-9a17-bd74e775d549","seq":4,"duration_ms":495,"bytes_in":929,"bytes_out":316},{"timestamp":"2026-09-27T16:39:16","port":3000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"accept-language\":\"en\",\"host\":\"<HONEYPOT>:3000\",\"user-agent\":\"Mozilla/5.0 (Fedora; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/.env.local","summary":"","payload_hex":"474554202f2e656e762e6c6f63616c20485454502f312e310d0a486f73743a20<HONEYPOT>3a333030300d0a557365722d4167656e743a204d6f7a696c6c612f352e3020284665646f72613b204c696e7578207838365f363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3133332e302e302e30205361666172692f3533372e33360d0a4163636570743a202a2f2a0d0a4163636570742d4c616e67756167653a20656e0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Fedora; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36","ja3":"","session":"d2fed04e-c1b4-4899-9a17-bd74e775d549","seq":5,"duration_ms":607,"bytes_in":1158,"bytes_out":395}],"http_methods":[{"method":"GET","count":39}],"distinct_ports_total":7,"top_paths":[{"path":"/","count":9,"ports":5},{"path":"/.env","count":3,"ports":2},{"path":"/.env.staging","count":3,"ports":2},{"path":"/app/.env","count":3,"ports":2},{"path":"/api/.env","count":3,"ports":2},{"path":"/.env.local","count":3,"ports":2},{"path":"/.env.backup","count":3,"ports":2},{"path":"/.env.bak","count":3,"ports":2},{"path":"/backend/.env","count":3,"ports":2},{"path":"/.env.production","count":3,"ports":2},{"path":"/.env.development","count":3,"ports":2}],"distinct_paths_total":11,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","Accept-Encoding","Accept-Language","Host","User-Agent"],"representative":[{"name":"Accept","value":"*/*","notable":false},{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Accept-Language","value":"en","notable":false},{"name":"Host","value":"<HONEYPOT>:3000","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (Fedora; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36","notable":false}],"distinct_sets":1,"events_with_headers":10},"tags":[],"data_as_of":"2026-09-28T21:33:08.282436+00:00"}