{"ip":"167.172.182.242","total_events":92,"verdict":{"verdict":"scanning","label":"Scanning for known vulnerabilities","detail":"10 exploit-path probe(s)","confidence":"medium","network_type":"CDN","why":["10 request(s) matched a known exploit path.","Only GET/HEAD seen, no request body: scanning for the vulnerability, not delivering a payload.","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"113,620 bytes sent","bytes_sent":113620,"session_seconds":2,"persistent":false}},"first_seen":"2026-09-25T20:22:10","last_seen":"2026-09-27T17:41:40","events_24h":0,"events_7d":92,"geo":{"country_code":"DE","country_name":"Germany","region":"Hesse","city":"Frankfurt am Main","lat":50.1169,"lon":8.6837,"asn":14061,"org":"DigitalOcean, LLC"},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as14061","label":"DigitalOcean","category":"cdn","url":"https://www.peeringdb.com/asn/14061"},"cve_matches":[],"malware":[],"top_ports":[{"port":8500,"proto":"tcp","label":"","count":20},{"port":5984,"proto":"tcp","label":"CouchDB","count":20},{"port":8082,"proto":"tcp","label":"","count":20},{"port":9990,"proto":"tcp","label":"","count":10},{"port":444,"proto":"tcp","label":"","count":10},{"port":81,"proto":"tcp","label":"","count":10},{"port":8181,"proto":"tcp","label":"","count":2}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i251000_b78ed14e2fd0_f50d94e863eb"],"tls_client_hello":"16030105ee010005ea03036b17bf689f43a22ce6293e8bdb2f0a23a08e637fbdbc83f50bdd74a0e078d2702084cc6d691107d30b5433477e365aadd89bdd7b916862168f4d9756451f75fe5c0032c02bc02fc02cc030cca9cca8c009c013c00ac014009c009d002f0035c012000ac023c027003cc007c01100051301130213030100056f000b00020100ff010001000017000000120000000500050100000000000a0010000e11ec11eb11ed001d001700180019000d001c001a090409050906080404030807080508060401050106010503060300320020001e090409050906080404030807080508060401050106010503060302010203002b0009080304030303020301003304ea04e811ec04c0d1b89cfdd92ccb559b7db74492308321f55d1d62835b65b64cc8b0bf312791bb98b9391b9c640a2f245046db8463dc6add14724d5a946a20223fe954da0354c6f618f754b346593d6a7cabc72a597e62c013c111ce244821b5ad4f9048e8e7598f86ab09c6258e0746980850b8c7a891888789cac2f7ca95d510a960b72add8b9832b1af7532080253c2b4c0252cab289e1967d1927e217bccb1c8694b249dfc1360a48c65419c080897436dd7c77489c27ada8f0b81711b117b6989155b4571cde6cd286549ea101bd7701c78e26605138f12d6bc84cac629c96710b57839b809ba6b6709da1667f5623b3b94a45503d3a459c08a4f6dc5a362c89f2e0aa11bb94d10dca70c029b35f32ef7e14525fa263691566455a351b7c2fa0202df9c9e94ea5ba16983868598ccc4087032cc498c3ffde182e1695d63d5654ad234c727244d7a86d3c1c3afd74c1902b52064583256420297cdbe44503552b6bbc57c73e17894991251b63b009da8dfa261e82117a80a02ff38b7d3988c33b573951aae6a8c98ed820cf12c958b196fb54c93d1a662a74c2bfaea8422f51f31691fdd0711315031bb226178b4091f5c790daa6c8b05b66d450886135a2ce8cbe0255a0ef080120188975340af1635460277c7727afd56ab754a762d60cfaaa0c7c820cc42c76040380e9a916cb6b029dd1166b0f89c998ba96d388b97730dd10086bd42c547e3c741f68a87e4acddc407961a3aedc66cb7629d8bd5c9eca07443742a2be39971018572c45877e264c0317655080c651b29702872c2f60232e03a064b319f096323103d27f89958799c93da1efe76405c5a44ca4bb6a2034e8319bb912c81893c8c9e1c520180607d2541e791912580a188e29b73a91d9bab2936ab8dcdf31352ec6e4db01a8f2c043796c3ad7374295c28df667cab2a8f61c3324c5480c06caa1699942a083cf9cc8a53c66042c5811926498cd21dcd3748fe745a69234f96e709c26cb49f93222261b50e83855dd2077c8c34f4ab5b7faa40fbb84fd9d424b6d3a0bc671d3a8b97ca0b0a8e9803f6c2bbfde43ddb4846bcf08723333a3cc72f19403368a7ae8166a2eb9c67acc1851a0166cb05a64c126bdb0102a9179f701b6ec9fa0f486b8fe88a79c78278cf2a174a330ab70342fef90794e580aec8633549829d65cc5f3b1de92058baec567276202fa640e17caabeb558df4402fc9a10f0143e172405e188ce208171d8aa4e0ea99348508aa52caa004404e427959945bc94b03c9a4b05e36b1a8ab88ccdbb3efdd26d0ce4c858950054c05abee5a4dd6180f1aa83820ba800c248c4e4bbe901b24dec2bfdf89fe38c097179083a5637937caab1b92612b17bb688c44d5a6ceba424e8352f93052001677511c33446046024fb91b0a310f82872177a2dec9067126a2afd10989d5270602b9beeb625304ab9235876f1f1076824344fa4b5143498ca7693f2985dc8aabf13089728f33e532b2398838fba091588c4acabf2afbd60bb1aa345ca69b5dd068a4496194ba11a8198c7b6f39deb4295967cb1ffc49b5f793a59995c303923808a7f4c7c9d1bb76e84aac60957612103ac90796faa9676b1772598c22aab1a54e1a12ec298e4b9472ac0dbe6d020db4773b8c34830f08cc59a2808b869388a254ba082de9d9265dde82a6ea93c3c2511e6b5764716d3fb00e2a8971d8f8989faac627f001d0020de9d9265dde82a6ea93c3c2511e6b5764716d3fb00e2a8971d8f8989","tls_ja3":["416eca07dcaad72dec6f76d1277b3eff"],"http_akin":["a11cun060_00c0004e_0af44bea","a11cun050_0000005d_7266f93a"]},"fingerprint_peers":{"t13i251000_b78ed14e2fd0_f50d94e863eb":38,"a11cun060_00c0004e_0af44bea":39,"a11cun050_0000005d_7266f93a":43},"akin_families":{},"user_agents":["Mozilla/5.0 (Fedora; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36","Mozilla/5.0 (SS; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36","Mozilla/5.0 (Windows NT 6.2; Win64; x64) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.1.2 Safari/605.1.15","Mozilla/5.0 (ZZ; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36","Mozilla/5.0 (X11; Linux i686; rv:1.9.6.20) Gecko/ Firefox/3.6.2","Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.190 Safari/537.36","Mozilla/5.0 (Macintosh; Intel Mac OS X 10.11; rv:140.0) Gecko/20100101 Firefox/140.0","Mozilla/5.0 (Debian; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36"],"timeline":[{"date":"2026-09-25","count":2},{"date":"2026-09-27","count":90}],"recent_events":[{"timestamp":"2026-09-27T17:41:40","port":8500,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"accept-language\":\"en\",\"host\":\"<HONEYPOT>:8500\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) Gecko/20100101 Firefox/140.0.2 (x64 de)\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/app/.env","summary":"","payload_hex":"474554202f6170702f2e656e7620485454502f312e310d0a486f73743a20<HONEYPOT>3a383530300d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204765636b6f2f32303130303130312046697265666f782f3134302e302e322028783634206465290d0a4163636570743a202a2f2a0d0a4163636570742d4c616e67756167653a20656e0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) Gecko/20100101 Firefox/140.0.2 (x64 de)","ja3":"","session":"36e5c9e3-f290-4055-a213-f61ae805ad82","seq":10,"duration_ms":1080,"bytes_in":2205,"bytes_out":800},{"timestamp":"2026-09-27T17:41:40","port":9990,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"accept-language\":\"en\",\"host\":\"<HONEYPOT>:9990\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64; rv:1.9.5.20) Gecko/ Firefox/9.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/app/.env","summary":"","payload_hex":"474554202f6170702f2e656e7620485454502f312e310d0a486f73743a20<HONEYPOT>3a393939300d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f36343b2072763a312e392e352e323029204765636b6f2f2046697265666f782f392e300d0a4163636570743a202a2f2a0d0a4163636570742d4c616e67756167653a20656e0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64; rv:1.9.5.20) Gecko/ Firefox/9.0","ja3":"","session":"e53af541-8167-4dbf-8904-f58c7073a104","seq":10,"duration_ms":1057,"bytes_in":2205,"bytes_out":800},{"timestamp":"2026-09-27T17:41:40","port":8500,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"accept-language\":\"en\",\"host\":\"<HONEYPOT>:8500\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:88.0) Gecko/20100101 Firefox/88.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/backend/.env","summary":"","payload_hex":"474554202f6261636b656e642f2e656e7620485454502f312e310d0a486f73743a20<HONEYPOT>3a383530300d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b207836343b2072763a38382e3029204765636b6f2f32303130303130312046697265666f782f38382e300d0a4163636570743a202a2f2a0d0a4163636570742d4c616e67756167653a20656e0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:88.0) Gecko/20100101 Firefox/88.0","ja3":"","session":"36e5c9e3-f290-4055-a213-f61ae805ad82","seq":9,"duration_ms":977,"bytes_in":2001,"bytes_out":720},{"timestamp":"2026-09-27T17:41:40","port":9990,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"accept-language\":\"en\",\"host\":\"<HONEYPOT>:9990\",\"user-agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_6) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/15.3 Mobile/15E148 Safari/604.1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/backend/.env","summary":"","payload_hex":"474554202f6261636b656e642f2e656e7620485454502f312e310d0a486f73743a20<HONEYPOT>3a393939300d0a557365722d4167656e743a204d6f7a696c6c612f352e3020284d6163696e746f73683b20496e74656c204d6163204f5320582031305f31355f3629204170706c655765624b69742f3630352e312e313520284b48544d4c2c206c696b65204765636b6f292056657273696f6e2f31352e33204d6f62696c652f313545313438205361666172692f3630342e310d0a4163636570743a202a2f2a0d0a4163636570742d4c616e67756167653a20656e0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_6) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/15.3 Mobile/15E148 Safari/604.1","ja3":"","session":"e53af541-8167-4dbf-8904-f58c7073a104","seq":9,"duration_ms":954,"bytes_in":2019,"bytes_out":720},{"timestamp":"2026-09-27T17:41:40","port":8500,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"accept-language\":\"en\",\"host\":\"<HONEYPOT>:8500\",\"user-agent\":\"Mozilla/5.0 (X11; Linux i686; rv:1.9.5.20) Gecko/ Firefox/3.6.19\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/api/.env","summary":"","payload_hex":"474554202f6170692f2e656e7620485454502f312e310d0a486f73743a20<HONEYPOT>3a383530300d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b204c696e757820693638363b2072763a312e392e352e323029204765636b6f2f2046697265666f782f332e362e31390d0a4163636570743a202a2f2a0d0a4163636570742d4c616e67756167653a20656e0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux i686; rv:1.9.5.20) Gecko/ Firefox/3.6.19","ja3":"","session":"36e5c9e3-f290-4055-a213-f61ae805ad82","seq":8,"duration_ms":875,"bytes_in":1796,"bytes_out":640},{"timestamp":"2026-09-27T17:41:40","port":9990,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"accept-language\":\"en\",\"host\":\"<HONEYPOT>:9990\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/api/.env","summary":"","payload_hex":"474554202f6170692f2e656e7620485454502f312e310d0a486f73743a20<HONEYPOT>3a393939300d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f36343b2072763a3134302e3029204765636b6f2f32303130303130312046697265666f782f3134302e300d0a4163636570743a202a2f2a0d0a4163636570742d4c616e67756167653a20656e0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0","ja3":"","session":"e53af541-8167-4dbf-8904-f58c7073a104","seq":8,"duration_ms":851,"bytes_in":1764,"bytes_out":640},{"timestamp":"2026-09-27T17:41:40","port":8500,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"accept-language\":\"en\",\"host\":\"<HONEYPOT>:8500\",\"user-agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_6) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.1.2 Safari/605.1.15\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/.env.bak","summary":"","payload_hex":"474554202f2e656e762e62616b20485454502f312e310d0a486f73743a20<HONEYPOT>3a383530300d0a557365722d4167656e743a204d6f7a696c6c612f352e3020284d6163696e746f73683b20496e74656c204d6163204f5320582031305f31355f3629204170706c655765624b69742f3630352e312e313520284b48544d4c2c206c696b65204765636b6f292056657273696f6e2f31332e312e32205361666172692f3630352e312e31350d0a4163636570743a202a2f2a0d0a4163636570742d4c616e67756167653a20656e0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_6) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.1.2 Safari/605.1.15","ja3":"","session":"36e5c9e3-f290-4055-a213-f61ae805ad82","seq":7,"duration_ms":773,"bytes_in":1609,"bytes_out":560},{"timestamp":"2026-09-27T17:41:40","port":9990,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"accept-language\":\"en\",\"host\":\"<HONEYPOT>:9990\",\"user-agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Safari/605.1.22\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/.env.bak","summary":"","payload_hex":"474554202f2e656e762e62616b20485454502f312e310d0a486f73743a20<HONEYPOT>3a393939300d0a557365722d4167656e743a204d6f7a696c6c612f352e3020284d6163696e746f73683b20496e74656c204d6163204f5320582031305f31355f3729204170706c655765624b69742f3630352e312e313520284b48544d4c2c206c696b65204765636b6f292056657273696f6e2f31372e342e31205361666172692f3630352e312e32320d0a4163636570743a202a2f2a0d0a4163636570742d4c616e67756167653a20656e0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Safari/605.1.22","ja3":"","session":"e53af541-8167-4dbf-8904-f58c7073a104","seq":7,"duration_ms":748,"bytes_in":1571,"bytes_out":560},{"timestamp":"2026-09-27T17:41:39","port":8500,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"accept-language\":\"en\",\"host\":\"<HONEYPOT>:8500\",\"user-agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 11) AppleWebKit/617.29 (KHTML, like Gecko) Version/17.7 Safari/617.29\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/.env.backup","summary":"","payload_hex":"474554202f2e656e762e6261636b757020485454502f312e310d0a486f73743a20<HONEYPOT>3a383530300d0a557365722d4167656e743a204d6f7a696c6c612f352e3020284d6163696e746f73683b20496e74656c204d6163204f53205820313129204170706c655765624b69742f3631372e323920284b48544d4c2c206c696b65204765636b6f292056657273696f6e2f31372e37205361666172692f3631372e32390d0a4163636570743a202a2f2a0d0a4163636570742d4c616e67756167653a20656e0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 11) AppleWebKit/617.29 (KHTML, like Gecko) Version/17.7 Safari/617.29","ja3":"","session":"36e5c9e3-f290-4055-a213-f61ae805ad82","seq":6,"duration_ms":671,"bytes_in":1367,"bytes_out":480},{"timestamp":"2026-09-27T17:41:39","port":9990,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"accept-language\":\"en\",\"host\":\"<HONEYPOT>:9990\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.81 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/.env.backup","summary":"","payload_hex":"474554202f2e656e762e6261636b757020485454502f312e310d0a486f73743a20<HONEYPOT>3a393939300d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f39342e302e343630362e3831205361666172692f3533372e33360d0a4163636570743a202a2f2a0d0a4163636570742d4c616e67756167653a20656e0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.81 Safari/537.36","ja3":"","session":"e53af541-8167-4dbf-8904-f58c7073a104","seq":6,"duration_ms":646,"bytes_in":1329,"bytes_out":480}],"http_methods":[{"method":"GET","count":92}],"distinct_ports_total":7,"top_paths":[{"path":"/.env","count":9,"ports":6},{"path":"/.env.staging","count":9,"ports":6},{"path":"/app/.env","count":9,"ports":6},{"path":"/api/.env","count":9,"ports":6},{"path":"/.env.local","count":9,"ports":6},{"path":"/.env.backup","count":9,"ports":6},{"path":"/.env.bak","count":9,"ports":6},{"path":"/backend/.env","count":9,"ports":6},{"path":"/.env.production","count":9,"ports":6},{"path":"/.env.development","count":9,"ports":6},{"path":"/","count":2,"ports":1}],"distinct_paths_total":11,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","Accept-Encoding","Accept-Language","Host","User-Agent"],"representative":[{"name":"Accept","value":"*/*","notable":false},{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Accept-Language","value":"en","notable":false},{"name":"Host","value":"<HONEYPOT>:8500","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) Gecko/20100101 Firefox/140.0.2 (x64 de)","notable":false}],"distinct_sets":1,"events_with_headers":10},"tags":[],"data_as_of":"2026-09-28T21:33:09.103175+00:00"}