{"ip":"172.245.12.199","total_events":39,"verdict":{"verdict":"scanning","label":"Scanning for known vulnerabilities","detail":"10 exploit-path probe(s)","confidence":"medium","network_type":"nsp","why":["10 request(s) matched a known exploit path.","Only GET/HEAD seen, no request body: scanning for the vulnerability, not delivering a payload.","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"54,387 bytes sent","bytes_sent":54387,"session_seconds":4,"persistent":false}},"first_seen":"2026-08-06T04:35:41","last_seen":"2026-08-13T23:26:43","events_24h":0,"events_7d":26,"geo":{"country_code":"US","country_name":"United States","region":"New York","city":"Buffalo","lat":42.8864,"lon":-78.8784,"asn":36352,"org":"HostPapa"},"source_domain":"172-245-12-199-host.colocrossing.com","known_scanners":[],"scanner_tag":{"key":"peeringdb:as36352","label":"ColoCrossing","category":"isp","url":"https://www.peeringdb.com/asn/36352"},"cve_matches":[],"malware":[],"top_ports":[{"port":80,"proto":"tcp","label":"HTTP","count":26},{"port":443,"proto":"tcp","label":"HTTPS","count":13}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i1711h1_ab0a1bf427ad_882d495ac381"],"tls_ja3":["fb0c9cea0478d6132076f4cdcb0d5224"],"ja4h":["ge11nn0500_2d30dc89d981"]},"fingerprint_peers":{"t13i1711h1_ab0a1bf427ad_882d495ac381":15,"ge11nn0500_2d30dc89d981":1342},"user_agents":["Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36"],"timeline":[{"date":"2026-08-06","count":13},{"date":"2026-08-09","count":13},{"date":"2026-08-13","count":13}],"recent_events":[{"timestamp":"2026-08-13T23:26:43","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate, zstd\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"/.wp-env.json","summary":"","payload_hex":"474554202f2e77702d656e762e6a736f6e20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e33360d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174652c207a7374640d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36","ja3":"fb0c9cea0478d6132076f4cdcb0d5224","session":"fde477c7-cf52-49ba-a88f-4268029625df","seq":13,"duration_ms":2815,"bytes_in":2570,"bytes_out":1027},{"timestamp":"2026-08-13T23:26:43","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate, zstd\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"/secrets.yml","summary":"","payload_hex":"474554202f736563726574732e796d6c20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e33360d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174652c207a7374640d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36","ja3":"fb0c9cea0478d6132076f4cdcb0d5224","session":"fde477c7-cf52-49ba-a88f-4268029625df","seq":12,"duration_ms":2585,"bytes_in":2369,"bytes_out":948},{"timestamp":"2026-08-13T23:26:43","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate, zstd\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"/.env.aws","summary":"","payload_hex":"474554202f2e656e762e61777320485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e33360d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174652c207a7374640d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36","ja3":"fb0c9cea0478d6132076f4cdcb0d5224","session":"fde477c7-cf52-49ba-a88f-4268029625df","seq":11,"duration_ms":2373,"bytes_in":2169,"bytes_out":869},{"timestamp":"2026-08-13T23:26:43","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate, zstd\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"/.env.ini","summary":"","payload_hex":"474554202f2e656e762e696e6920485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e33360d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174652c207a7374640d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36","ja3":"fb0c9cea0478d6132076f4cdcb0d5224","session":"fde477c7-cf52-49ba-a88f-4268029625df","seq":10,"duration_ms":2138,"bytes_in":1972,"bytes_out":790},{"timestamp":"2026-08-13T23:26:42","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate, zstd\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"/.env.xml","summary":"","payload_hex":"474554202f2e656e762e786d6c20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e33360d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174652c207a7374640d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36","ja3":"fb0c9cea0478d6132076f4cdcb0d5224","session":"fde477c7-cf52-49ba-a88f-4268029625df","seq":9,"duration_ms":1933,"bytes_in":1775,"bytes_out":711},{"timestamp":"2026-08-13T23:26:42","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate, zstd\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"/.env.json","summary":"","payload_hex":"474554202f2e656e762e6a736f6e20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e33360d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174652c207a7374640d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36","ja3":"fb0c9cea0478d6132076f4cdcb0d5224","session":"fde477c7-cf52-49ba-a88f-4268029625df","seq":8,"duration_ms":1660,"bytes_in":1578,"bytes_out":632},{"timestamp":"2026-08-13T23:26:42","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate, zstd\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"/.env.yaml","summary":"","payload_hex":"474554202f2e656e762e79616d6c20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e33360d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174652c207a7374640d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36","ja3":"fb0c9cea0478d6132076f4cdcb0d5224","session":"fde477c7-cf52-49ba-a88f-4268029625df","seq":7,"duration_ms":1451,"bytes_in":1380,"bytes_out":553},{"timestamp":"2026-08-13T23:26:42","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate, zstd\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"/.env.yml","summary":"","payload_hex":"474554202f2e656e762e796d6c20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e33360d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174652c207a7374640d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36","ja3":"fb0c9cea0478d6132076f4cdcb0d5224","session":"fde477c7-cf52-49ba-a88f-4268029625df","seq":6,"duration_ms":1202,"bytes_in":1182,"bytes_out":474},{"timestamp":"2026-08-13T23:26:41","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate, zstd\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"/.env.local","summary":"","payload_hex":"474554202f2e656e762e6c6f63616c20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e33360d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174652c207a7374640d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36","ja3":"fb0c9cea0478d6132076f4cdcb0d5224","session":"fde477c7-cf52-49ba-a88f-4268029625df","seq":5,"duration_ms":1000,"bytes_in":985,"bytes_out":395},{"timestamp":"2026-08-13T23:26:41","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate, zstd\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"/env","summary":"","payload_hex":"474554202f656e7620485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e33360d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174652c207a7374640d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36","ja3":"fb0c9cea0478d6132076f4cdcb0d5224","session":"fde477c7-cf52-49ba-a88f-4268029625df","seq":4,"duration_ms":786,"bytes_in":786,"bytes_out":316}],"http_methods":[{"method":"GET","count":39}],"distinct_ports_total":2,"top_paths":[{"path":"/.env","count":3,"ports":2},{"path":"/env","count":3,"ports":2},{"path":"/.env.yml","count":3,"ports":2},{"path":"/secrets.yml","count":3,"ports":2},{"path":"/.env.aws","count":3,"ports":2},{"path":"/.env.ini","count":3,"ports":2},{"path":"/.env.local","count":3,"ports":2},{"path":"/.wp-env.json","count":3,"ports":2},{"path":"/.env.example","count":3,"ports":2},{"path":"/.env.json","count":3,"ports":2},{"path":"/.env.xml","count":3,"ports":2},{"path":"/.env.backup","count":3,"ports":2},{"path":"/.env.yaml","count":3,"ports":2}],"distinct_paths_total":13,"top_snis":[],"top_hosts":[],"top_alpns":[{"value":"http/1.1","count":39}],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","Accept-Encoding","Connection","Host","User-Agent"],"representative":[{"name":"Accept","value":"*/*","notable":false},{"name":"Accept-Encoding","value":"gzip, deflate, zstd","notable":false},{"name":"Connection","value":"keep-alive","notable":false},{"name":"Host","value":"<HONEYPOT>","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36","notable":false}],"distinct_sets":1,"events_with_headers":10},"tags":[],"data_as_of":"2026-08-15T06:50:02.860715+00:00"}