{"ip":"169.58.152.74","total_events":25,"verdict":{"verdict":"scanning","label":"Scanning for known vulnerabilities","detail":"1 exploit-path probe(s)","confidence":"medium","network_type":"CDN","why":["1 request(s) matched a known exploit path.","Only GET/HEAD seen, no request body: scanning for the vulnerability, not delivering a payload.","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"4,769 bytes sent","bytes_sent":4769,"session_seconds":0,"persistent":false}},"first_seen":"2026-08-11T21:37:00","last_seen":"2026-08-14T09:14:39","events_24h":1,"events_7d":25,"geo":{"country_code":"FR","country_name":"France","region":"Grand Est","city":"Lauterbourg","lat":48.9742,"lon":8.1851,"asn":51167,"org":"Contabo GmbH"},"source_domain":"vmi3498067.contaboserver.net","known_scanners":[],"scanner_tag":{"key":"contabo","label":"Contabo","category":"hosting_provider","url":"https://contabo.com/"},"cve_matches":[],"malware":[],"top_ports":[{"port":27017,"proto":"tcp","label":"MongoDB","count":21},{"port":80,"proto":"tcp","label":"HTTP","count":4}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[],"ja4h":["ge11nn0400_88d30a62b7ad"]},"fingerprint_peers":{"ge11nn0400_88d30a62b7ad":4815},"user_agents":["Mozilla/5.0 zgrab/0.x"],"timeline":[{"date":"2026-08-11","count":21},{"date":"2026-08-12","count":3},{"date":"2026-08-14","count":1}],"recent_events":[{"timestamp":"2026-08-14T09:14:39","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 zgrab/0.x\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/.env","summary":"","payload_hex":"474554202f2e656e7620485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e30207a677261622f302e780d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 zgrab/0.x","ja3":"","session":"87582d72-e592-4dd5-890b-fb97c286ecba","seq":1,"duration_ms":100,"bytes_in":115,"bytes_out":78},{"timestamp":"2026-08-12T20:50:17","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 zgrab/0.x\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/.env","summary":"","payload_hex":"474554202f2e656e7620485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e30207a677261622f302e780d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 zgrab/0.x","ja3":"","session":"4f9b1094-062c-44f5-8466-194eb11236cc","seq":1,"duration_ms":101,"bytes_in":113,"bytes_out":78},{"timestamp":"2026-08-12T20:33:41","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 zgrab/0.x\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/.env","summary":"","payload_hex":"474554202f2e656e7620485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e30207a677261622f302e780d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 zgrab/0.x","ja3":"","session":"6aaf91d7-b64a-4517-8d4d-f0e57365f94a","seq":1,"duration_ms":100,"bytes_in":113,"bytes_out":78},{"timestamp":"2026-08-12T17:55:17","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 zgrab/0.x\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/.env","summary":"","payload_hex":"474554202f2e656e7620485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e30207a677261622f302e780d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 zgrab/0.x","ja3":"","session":"d796b1be-6601-4608-b809-180a6d6331b2","seq":1,"duration_ms":100,"bytes_in":114,"bytes_out":78},{"timestamp":"2026-08-11T23:02:49","port":27017,"proto":"tcp","app_proto":"","app_protocol":"mongodb","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�\u0000\u0000\u0000��\u001a\u0000\u0000\u0000\u0000\u0000�\u0007\u0000\u0000\u0004\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000�����\u0000\u0000\u0000\u0010isMaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0004compression\u0000\u0005\u0000\u0000\u0000\u0000\u0003client\u0000�\u0000\u0000\u0000\u0003driver\u00003\u0000\u0000\u0000\u0002name\u0000\u0010\u0000\u0000\u0000mongo-go-driver\u0000\u0002version\u0000\u0007\u0000\u0000\u00001.16.0\u0000\u0000\u0003os\u0000-\u0000\u0000\u0000\u0002type\u0000\u0006\u0000\u0000\u0000linux\u0000\u0002architecture\u0000\u0006\u0000\u0000\u0000amd64\u0000\u0000\u0002platform\u0000\t\u0000\u0000\u0000go1.23.4\u0000\u0000\u0000","payload_hex":"e6000000f0b11a0000000000d40700000400000061646d696e2e24636d640000000000ffffffffbf0000001069734d617374657200010000000868656c6c6f4f6b000104636f6d7072657373696f6e00050000000003636c69656e740088000000036472697665720033000000026e616d6500100000006d6f6e676f2d676f2d647269766572000276657273696f6e0007000000312e31362e300000036f73002d000000027479706500060000006c696e757800026172636869746563747572650006000000616d643634000002706c6174666f726d0009000000676f312e32332e34000000","method":"","user_agent":"","ja3":"","session":"164eb925-49b8-47a9-b2cb-3dd265c4791c","seq":1,"duration_ms":100,"bytes_in":230,"bytes_out":13,"enriched":{"digest":"5fcfbcc8cdab9928","strings":["admin.$cmd","isMaster","helloOk","compression","client","driver","name","mongo-go-driver","version","1.16.0"]}},{"timestamp":"2026-08-11T23:02:48","port":27017,"proto":"tcp","app_proto":"","app_protocol":"mongodb","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�\u0000\u0000\u0000\f�\u001a\u0000\u0000\u0000\u0000\u0000�\u0007\u0000\u0000\u0004\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000�����\u0000\u0000\u0000\u0010isMaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0004compression\u0000\u0005\u0000\u0000\u0000\u0000\u0003client\u0000�\u0000\u0000\u0000\u0003driver\u00003\u0000\u0000\u0000\u0002name\u0000\u0010\u0000\u0000\u0000mongo-go-driver\u0000\u0002version\u0000\u0007\u0000\u0000\u00001.16.0\u0000\u0000\u0003os\u0000-\u0000\u0000\u0000\u0002type\u0000\u0006\u0000\u0000\u0000linux\u0000\u0002architecture\u0000\u0006\u0000\u0000\u0000amd64\u0000\u0000\u0002platform\u0000\t\u0000\u0000\u0000go1.23.4\u0000\u0000\u0000","payload_hex":"e60000000cb01a0000000000d40700000400000061646d696e2e24636d640000000000ffffffffbf0000001069734d617374657200010000000868656c6c6f4f6b000104636f6d7072657373696f6e00050000000003636c69656e740088000000036472697665720033000000026e616d6500100000006d6f6e676f2d676f2d647269766572000276657273696f6e0007000000312e31362e300000036f73002d000000027479706500060000006c696e757800026172636869746563747572650006000000616d643634000002706c6174666f726d0009000000676f312e32332e34000000","method":"","user_agent":"","ja3":"","session":"15f433bd-c17b-406f-bd2a-90dfec49f12f","seq":1,"duration_ms":101,"bytes_in":230,"bytes_out":13,"enriched":{"digest":"aed905e100cb26fb","strings":["admin.$cmd","isMaster","helloOk","compression","client","driver","name","mongo-go-driver","version","1.16.0"]}},{"timestamp":"2026-08-11T23:02:48","port":27017,"proto":"tcp","app_proto":"","app_protocol":"mongodb","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�\u0000\u0000\u0000\u0017�\u001a\u0000\u0000\u0000\u0000\u0000�\u0007\u0000\u0000\u0004\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000�����\u0000\u0000\u0000\u0010isMaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0004compression\u0000\u0005\u0000\u0000\u0000\u0000\u0003client\u0000�\u0000\u0000\u0000\u0003driver\u00003\u0000\u0000\u0000\u0002name\u0000\u0010\u0000\u0000\u0000mongo-go-driver\u0000\u0002version\u0000\u0007\u0000\u0000\u00001.16.0\u0000\u0000\u0003os\u0000-\u0000\u0000\u0000\u0002type\u0000\u0006\u0000\u0000\u0000linux\u0000\u0002architecture\u0000\u0006\u0000\u0000\u0000amd64\u0000\u0000\u0002platform\u0000\t\u0000\u0000\u0000go1.23.4\u0000\u0000\u0000","payload_hex":"e600000017ae1a0000000000d40700000400000061646d696e2e24636d640000000000ffffffffbf0000001069734d617374657200010000000868656c6c6f4f6b000104636f6d7072657373696f6e00050000000003636c69656e740088000000036472697665720033000000026e616d6500100000006d6f6e676f2d676f2d647269766572000276657273696f6e0007000000312e31362e300000036f73002d000000027479706500060000006c696e757800026172636869746563747572650006000000616d643634000002706c6174666f726d0009000000676f312e32332e34000000","method":"","user_agent":"","ja3":"","session":"df1b0667-60d8-4330-8efd-2e86a9d01d39","seq":1,"duration_ms":100,"bytes_in":230,"bytes_out":13,"enriched":{"digest":"7ecdacf9031b22e5","strings":["admin.$cmd","isMaster","helloOk","compression","client","driver","name","mongo-go-driver","version","1.16.0"]}},{"timestamp":"2026-08-11T23:02:47","port":27017,"proto":"tcp","app_proto":"","app_protocol":"mongodb","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�\u0000\u0000\u0000,�\u001a\u0000\u0000\u0000\u0000\u0000�\u0007\u0000\u0000\u0004\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000�����\u0000\u0000\u0000\u0010isMaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0004compression\u0000\u0005\u0000\u0000\u0000\u0000\u0003client\u0000�\u0000\u0000\u0000\u0003driver\u00003\u0000\u0000\u0000\u0002name\u0000\u0010\u0000\u0000\u0000mongo-go-driver\u0000\u0002version\u0000\u0007\u0000\u0000\u00001.16.0\u0000\u0000\u0003os\u0000-\u0000\u0000\u0000\u0002type\u0000\u0006\u0000\u0000\u0000linux\u0000\u0002architecture\u0000\u0006\u0000\u0000\u0000amd64\u0000\u0000\u0002platform\u0000\t\u0000\u0000\u0000go1.23.4\u0000\u0000\u0000","payload_hex":"e60000002cac1a0000000000d40700000400000061646d696e2e24636d640000000000ffffffffbf0000001069734d617374657200010000000868656c6c6f4f6b000104636f6d7072657373696f6e00050000000003636c69656e740088000000036472697665720033000000026e616d6500100000006d6f6e676f2d676f2d647269766572000276657273696f6e0007000000312e31362e300000036f73002d000000027479706500060000006c696e757800026172636869746563747572650006000000616d643634000002706c6174666f726d0009000000676f312e32332e34000000","method":"","user_agent":"","ja3":"","session":"a4975ddd-3f8d-4d81-b207-386572f48d69","seq":1,"duration_ms":100,"bytes_in":230,"bytes_out":13,"enriched":{"digest":"bba24be74c120c3d","strings":["admin.$cmd","isMaster","helloOk","compression","client","driver","name","mongo-go-driver","version","1.16.0"]}},{"timestamp":"2026-08-11T23:02:47","port":27017,"proto":"tcp","app_proto":"","app_protocol":"mongodb","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�\u0000\u0000\u0000R�\u001a\u0000\u0000\u0000\u0000\u0000�\u0007\u0000\u0000\u0004\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000�����\u0000\u0000\u0000\u0010isMaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0004compression\u0000\u0005\u0000\u0000\u0000\u0000\u0003client\u0000�\u0000\u0000\u0000\u0003driver\u00003\u0000\u0000\u0000\u0002name\u0000\u0010\u0000\u0000\u0000mongo-go-driver\u0000\u0002version\u0000\u0007\u0000\u0000\u00001.16.0\u0000\u0000\u0003os\u0000-\u0000\u0000\u0000\u0002type\u0000\u0006\u0000\u0000\u0000linux\u0000\u0002architecture\u0000\u0006\u0000\u0000\u0000amd64\u0000\u0000\u0002platform\u0000\t\u0000\u0000\u0000go1.23.4\u0000\u0000\u0000","payload_hex":"e600000052aa1a0000000000d40700000400000061646d696e2e24636d640000000000ffffffffbf0000001069734d617374657200010000000868656c6c6f4f6b000104636f6d7072657373696f6e00050000000003636c69656e740088000000036472697665720033000000026e616d6500100000006d6f6e676f2d676f2d647269766572000276657273696f6e0007000000312e31362e300000036f73002d000000027479706500060000006c696e757800026172636869746563747572650006000000616d643634000002706c6174666f726d0009000000676f312e32332e34000000","method":"","user_agent":"","ja3":"","session":"d4b010eb-4ab6-43bf-8a81-7433288082f1","seq":1,"duration_ms":101,"bytes_in":230,"bytes_out":13,"enriched":{"digest":"0da832708b9c45d0","strings":["admin.$cmd","isMaster","helloOk","compression","client","driver","name","mongo-go-driver","version","1.16.0"]}},{"timestamp":"2026-08-11T23:02:46","port":27017,"proto":"tcp","app_proto":"","app_protocol":"mongodb","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�\u0000\u0000\u0000\\�\u001a\u0000\u0000\u0000\u0000\u0000�\u0007\u0000\u0000\u0004\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000�����\u0000\u0000\u0000\u0010isMaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0004compression\u0000\u0005\u0000\u0000\u0000\u0000\u0003client\u0000�\u0000\u0000\u0000\u0003driver\u00003\u0000\u0000\u0000\u0002name\u0000\u0010\u0000\u0000\u0000mongo-go-driver\u0000\u0002version\u0000\u0007\u0000\u0000\u00001.16.0\u0000\u0000\u0003os\u0000-\u0000\u0000\u0000\u0002type\u0000\u0006\u0000\u0000\u0000linux\u0000\u0002architecture\u0000\u0006\u0000\u0000\u0000amd64\u0000\u0000\u0002platform\u0000\t\u0000\u0000\u0000go1.23.4\u0000\u0000\u0000","payload_hex":"e60000005ca81a0000000000d40700000400000061646d696e2e24636d640000000000ffffffffbf0000001069734d617374657200010000000868656c6c6f4f6b000104636f6d7072657373696f6e00050000000003636c69656e740088000000036472697665720033000000026e616d6500100000006d6f6e676f2d676f2d647269766572000276657273696f6e0007000000312e31362e300000036f73002d000000027479706500060000006c696e757800026172636869746563747572650006000000616d643634000002706c6174666f726d0009000000676f312e32332e34000000","method":"","user_agent":"","ja3":"","session":"b9fcfd26-355c-4932-82a1-c45febc937e0","seq":1,"duration_ms":100,"bytes_in":230,"bytes_out":13,"enriched":{"digest":"f256303818be5c08","strings":["admin.$cmd","isMaster","helloOk","compression","client","driver","name","mongo-go-driver","version","1.16.0"]}}],"http_methods":[{"method":"GET","count":4}],"distinct_ports_total":2,"top_paths":[{"path":"/.env","count":4,"ports":1}],"distinct_paths_total":1,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","Accept-Encoding","Host","User-Agent"],"representative":[{"name":"Accept","value":"*/*","notable":false},{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Host","value":"<HONEYPOT>","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 zgrab/0.x","notable":false}],"distinct_sets":1,"events_with_headers":4},"tags":[],"data_as_of":"2026-08-15T06:47:25.615822+00:00"}