{"ip":"169.58.152.72","total_events":100,"verdict":{"verdict":"scanning","label":"Scanning for known vulnerabilities","detail":"2 exploit-path probe(s)","confidence":"medium","network_type":"CDN","why":["2 request(s) matched a known exploit path.","Only GET/HEAD seen, no request body: scanning for the vulnerability, not delivering a payload.","Not in any known-scanner range."],"engagement":{"level":"request","label":"Request traffic","detail":"3,604 bytes sent","bytes_sent":3604,"session_seconds":0,"persistent":false}},"first_seen":"2026-08-09T22:06:16","last_seen":"2026-08-15T01:39:50","events_24h":60,"events_7d":100,"geo":{"country_code":"FR","country_name":"France","region":"Grand Est","city":"Lauterbourg","lat":48.9742,"lon":8.1851,"asn":51167,"org":"Contabo GmbH"},"source_domain":"vmi3498066.contaboserver.net","known_scanners":[],"scanner_tag":{"key":"contabo","label":"Contabo","category":"hosting_provider","url":"https://contabo.com/"},"cve_matches":[],"malware":[],"top_ports":[{"port":465,"proto":"tcp","label":"SMTPS","count":90},{"port":80,"proto":"tcp","label":"HTTP","count":10}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i130900_f57a46bbacb6_e7c285222651"],"tls_ja3":["674c9b60629e4885877f5ec76f21723e"],"ja4h":["ge11nn0400_88d30a62b7ad"]},"fingerprint_peers":{"t13i130900_f57a46bbacb6_e7c285222651":3667,"ge11nn0400_88d30a62b7ad":4814},"user_agents":["Mozilla/5.0 zgrab/0.x"],"timeline":[{"date":"2026-08-09","count":1},{"date":"2026-08-10","count":2},{"date":"2026-08-11","count":6},{"date":"2026-08-13","count":31},{"date":"2026-08-15","count":60}],"recent_events":[{"timestamp":"2026-08-15T01:39:50","port":465,"proto":"tcp","app_proto":"tls","app_protocol":"ftp","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"AUTH LOGIN\r\n","payload_hex":"41555448204c4f47494e0d0a","method":"","user_agent":"","ja3":"674c9b60629e4885877f5ec76f21723e","session":"9293fa6f-140f-4dff-a488-f4e55f2b097d","seq":2,"duration_ms":299,"bytes_in":33,"bytes_out":54,"enriched":{"digest":"b4b21d02637630bf","label":"FTP","strings":["AUTH LOGIN"]}},{"timestamp":"2026-08-15T01:39:50","port":465,"proto":"tcp","app_proto":"tls","app_protocol":"smtp","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"EHLO maxximus.local\r\n","payload_hex":"45484c4f206d617878696d75732e6c6f63616c0d0a","method":"","user_agent":"","ja3":"674c9b60629e4885877f5ec76f21723e","session":"9293fa6f-140f-4dff-a488-f4e55f2b097d","seq":1,"duration_ms":200,"bytes_in":21,"bytes_out":40,"enriched":{"digest":"dde67e2504fb591f","label":"SMTP","strings":["EHLO maxximus.local"],"iocs":{"domains":["maxximus.local"]}}},{"timestamp":"2026-08-15T01:39:47","port":465,"proto":"tcp","app_proto":"tls","app_protocol":"ftp","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"AUTH LOGIN\r\n","payload_hex":"41555448204c4f47494e0d0a","method":"","user_agent":"","ja3":"674c9b60629e4885877f5ec76f21723e","session":"149eaab8-8980-4da3-b71f-b54d25fa0913","seq":2,"duration_ms":299,"bytes_in":33,"bytes_out":54,"enriched":{"digest":"b4b21d02637630bf","label":"FTP","strings":["AUTH LOGIN"]}},{"timestamp":"2026-08-15T01:39:47","port":465,"proto":"tcp","app_proto":"tls","app_protocol":"smtp","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"EHLO maxximus.local\r\n","payload_hex":"45484c4f206d617878696d75732e6c6f63616c0d0a","method":"","user_agent":"","ja3":"674c9b60629e4885877f5ec76f21723e","session":"149eaab8-8980-4da3-b71f-b54d25fa0913","seq":1,"duration_ms":200,"bytes_in":21,"bytes_out":40,"enriched":{"digest":"dde67e2504fb591f","label":"SMTP","strings":["EHLO maxximus.local"],"iocs":{"domains":["maxximus.local"]}}},{"timestamp":"2026-08-15T01:39:44","port":465,"proto":"tcp","app_proto":"tls","app_protocol":"ftp","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"AUTH LOGIN\r\n","payload_hex":"41555448204c4f47494e0d0a","method":"","user_agent":"","ja3":"674c9b60629e4885877f5ec76f21723e","session":"11b28928-5824-40b8-81a4-51204e39552f","seq":2,"duration_ms":299,"bytes_in":33,"bytes_out":54,"enriched":{"digest":"b4b21d02637630bf","label":"FTP","strings":["AUTH LOGIN"]}},{"timestamp":"2026-08-15T01:39:44","port":465,"proto":"tcp","app_proto":"tls","app_protocol":"smtp","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"EHLO maxximus.local\r\n","payload_hex":"45484c4f206d617878696d75732e6c6f63616c0d0a","method":"","user_agent":"","ja3":"674c9b60629e4885877f5ec76f21723e","session":"11b28928-5824-40b8-81a4-51204e39552f","seq":1,"duration_ms":199,"bytes_in":21,"bytes_out":40,"enriched":{"digest":"dde67e2504fb591f","label":"SMTP","strings":["EHLO maxximus.local"],"iocs":{"domains":["maxximus.local"]}}},{"timestamp":"2026-08-15T01:39:41","port":465,"proto":"tcp","app_proto":"tls","app_protocol":"ftp","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"AUTH LOGIN\r\n","payload_hex":"41555448204c4f47494e0d0a","method":"","user_agent":"","ja3":"674c9b60629e4885877f5ec76f21723e","session":"208e42eb-ad96-4b42-a5f7-6e8723837843","seq":2,"duration_ms":299,"bytes_in":33,"bytes_out":54,"enriched":{"digest":"b4b21d02637630bf","label":"FTP","strings":["AUTH LOGIN"]}},{"timestamp":"2026-08-15T01:39:41","port":465,"proto":"tcp","app_proto":"tls","app_protocol":"smtp","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"EHLO maxximus.local\r\n","payload_hex":"45484c4f206d617878696d75732e6c6f63616c0d0a","method":"","user_agent":"","ja3":"674c9b60629e4885877f5ec76f21723e","session":"208e42eb-ad96-4b42-a5f7-6e8723837843","seq":1,"duration_ms":199,"bytes_in":21,"bytes_out":40,"enriched":{"digest":"dde67e2504fb591f","label":"SMTP","strings":["EHLO maxximus.local"],"iocs":{"domains":["maxximus.local"]}}},{"timestamp":"2026-08-15T01:39:38","port":465,"proto":"tcp","app_proto":"tls","app_protocol":"ftp","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"AUTH LOGIN\r\n","payload_hex":"41555448204c4f47494e0d0a","method":"","user_agent":"","ja3":"674c9b60629e4885877f5ec76f21723e","session":"d67cbe30-57d1-42b5-8497-2291e328dd5a","seq":2,"duration_ms":305,"bytes_in":33,"bytes_out":54,"enriched":{"digest":"b4b21d02637630bf","label":"FTP","strings":["AUTH LOGIN"]}},{"timestamp":"2026-08-15T01:39:38","port":465,"proto":"tcp","app_proto":"tls","app_protocol":"smtp","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"EHLO maxximus.local\r\n","payload_hex":"45484c4f206d617878696d75732e6c6f63616c0d0a","method":"","user_agent":"","ja3":"674c9b60629e4885877f5ec76f21723e","session":"d67cbe30-57d1-42b5-8497-2291e328dd5a","seq":1,"duration_ms":202,"bytes_in":21,"bytes_out":40,"enriched":{"digest":"dde67e2504fb591f","label":"SMTP","strings":["EHLO maxximus.local"],"iocs":{"domains":["maxximus.local"]}}}],"http_methods":[{"method":"GET","count":10}],"distinct_ports_total":2,"top_paths":[{"path":"/.env.local","count":6,"ports":1},{"path":"/.env","count":4,"ports":1}],"distinct_paths_total":2,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-08-15T06:49:49.486451+00:00"}