{"ip":"176.65.144.71","total_events":475,"verdict":{"verdict":"scanning","label":"Scanning for known vulnerabilities","detail":"83 exploit-path probe(s)","confidence":"medium","network_type":null,"why":["83 request(s) matched a known exploit path.","Only GET/HEAD seen, no request body: scanning for the vulnerability, not delivering a payload.","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"282,510 bytes sent","bytes_sent":282510,"session_seconds":23,"persistent":false}},"first_seen":"2026-09-10T15:34:59","last_seen":"2026-09-21T15:39:07","events_24h":0,"events_7d":0,"geo":{"country_code":"CH","country_name":"Switzerland","region":"","city":"","lat":47.1449,"lon":8.1551,"asn":209413,"org":"Dedik Services Limited"},"source_domain":null,"known_scanners":[],"scanner_tag":null,"cve_matches":[{"cve_id":"CVE-2026-25892","title":"Adminer 4.6.2 - 5.4.1 Unauthenticated Persistent DoS","severity":"high","actively_exploited":false,"match_field":"url_path","matched_pattern":"/adminer.php"}],"malware":[],"top_ports":[{"port":443,"proto":"tcp","label":"HTTPS","count":187},{"port":80,"proto":"tcp","label":"HTTP","count":68},{"port":3000,"proto":"tcp","label":"Web-alt","count":63},{"port":8080,"proto":"tcp","label":"HTTP-alt","count":62},{"port":8443,"proto":"tcp","label":"HTTPS-alt","count":53},{"port":8000,"proto":"tcp","label":"HTTP-alt","count":42}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i130900_f57a46bbacb6_e7c285222651","t13i131000_f57a46bbacb6_ab7e3b40a677"],"tls_client_hello":"","tls_ja3":["6639916abfac56b9257ca216677085bc","2196848d251b217de8b2c037e356c11d"],"http_akin":["b11cun030_00040014_54d07b6d","b11cun040_00040016_aa48e2c8"]},"fingerprint_peers":{"t13i130900_f57a46bbacb6_e7c285222651":3786,"t13i131000_f57a46bbacb6_ab7e3b40a677":4768,"b11cun030_00040014_54d07b6d":3675,"b11cun040_00040016_aa48e2c8":6196},"akin_families":{},"user_agents":["Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"],"timeline":[{"date":"2026-09-10","count":94},{"date":"2026-09-11","count":93},{"date":"2026-09-21","count":288}],"recent_events":[{"timestamp":"2026-09-21T15:39:07","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:80\",\"user-agent\":\"Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/.env.production","summary":"","payload_hex":"474554202f2e656e762e70726f64756374696f6e20485454502f312e310d0a486f73743a20<HONEYPOT>3a38300d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b20476f6f676c65626f742f322e313b202b687474703a2f2f7777772e676f6f676c652e636f6d2f626f742e68746d6c290d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)","ja3":"","session":"1802b703-2262-4978-951f-2d77780cbc13","seq":3,"duration_ms":893,"bytes_in":473,"bytes_out":234},{"timestamp":"2026-09-21T15:39:07","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:80\",\"user-agent\":\"Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/Jenkinsfile","summary":"","payload_hex":"474554202f4a656e6b696e7366696c6520485454502f312e310d0a486f73743a20<HONEYPOT>3a38300d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b20476f6f676c65626f742f322e313b202b687474703a2f2f7777772e676f6f676c652e636f6d2f626f742e68746d6c290d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)","ja3":"","session":"f0a462dc-52bb-4ca1-8d51-532733027969","seq":3,"duration_ms":889,"bytes_in":460,"bytes_out":234},{"timestamp":"2026-09-21T15:39:07","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:80\",\"user-agent\":\"Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/.env.development","summary":"","payload_hex":"474554202f2e656e762e646576656c6f706d656e7420485454502f312e310d0a486f73743a20<HONEYPOT>3a38300d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b20476f6f676c65626f742f322e313b202b687474703a2f2f7777772e676f6f676c652e636f6d2f626f742e68746d6c290d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)","ja3":"","session":"13cf7531-1e63-4a5b-81da-d93f42e1b809","seq":3,"duration_ms":894,"bytes_in":467,"bytes_out":234},{"timestamp":"2026-09-21T15:39:07","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:80\",\"user-agent\":\"Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/secrets.yaml","summary":"","payload_hex":"474554202f736563726574732e79616d6c20485454502f312e310d0a486f73743a20<HONEYPOT>3a38300d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b20476f6f676c65626f742f322e313b202b687474703a2f2f7777772e676f6f676c652e636f6d2f626f742e68746d6c290d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)","ja3":"","session":"c690fff2-21a3-4d11-a6e9-1eec9c4c42ca","seq":3,"duration_ms":1046,"bytes_in":448,"bytes_out":234},{"timestamp":"2026-09-21T15:39:07","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:80\",\"user-agent\":\"Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/.ssh/id_ed25519","summary":"","payload_hex":"474554202f2e7373682f69645f6564323535313920485454502f312e310d0a486f73743a20<HONEYPOT>3a38300d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b20476f6f676c65626f742f322e313b202b687474703a2f2f7777772e676f6f676c652e636f6d2f626f742e68746d6c290d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)","ja3":"","session":"25f7d166-1298-441e-aa00-4afdb525e75b","seq":3,"duration_ms":1046,"bytes_in":453,"bytes_out":234},{"timestamp":"2026-09-21T15:39:07","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:80\",\"user-agent\":\"Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/db.sql.gz","summary":"","payload_hex":"474554202f64622e73716c2e677a20485454502f312e310d0a486f73743a20<HONEYPOT>3a38300d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b20476f6f676c65626f742f322e313b202b687474703a2f2f7777772e676f6f676c652e636f6d2f626f742e68746d6c290d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)","ja3":"","session":"b147f1c8-32eb-44e8-9a06-7d0279a1aa92","seq":3,"duration_ms":890,"bytes_in":458,"bytes_out":234},{"timestamp":"2026-09-21T15:39:07","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:80\",\"user-agent\":\"Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/dump.sql","summary":"","payload_hex":"474554202f64756d702e73716c20485454502f312e310d0a486f73743a20<HONEYPOT>3a38300d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b20476f6f676c65626f742f322e313b202b687474703a2f2f7777772e676f6f676c652e636f6d2f626f742e68746d6c290d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)","ja3":"","session":"038404c8-7405-4cdb-a0c6-89dda04d3f2b","seq":3,"duration_ms":1050,"bytes_in":463,"bytes_out":234},{"timestamp":"2026-09-21T15:39:07","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:80\",\"user-agent\":\"Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/credentials.json","summary":"","payload_hex":"474554202f63726564656e7469616c732e6a736f6e20485454502f312e310d0a486f73743a20<HONEYPOT>3a38300d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b20476f6f676c65626f742f322e313b202b687474703a2f2f7777772e676f6f676c652e636f6d2f626f742e68746d6c290d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)","ja3":"","session":"97ebd78c-17a7-4a8e-81d8-f68bab0c0189","seq":3,"duration_ms":1049,"bytes_in":460,"bytes_out":234},{"timestamp":"2026-09-21T15:39:07","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:80\",\"user-agent\":\"Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/backup.zip","summary":"","payload_hex":"474554202f6261636b75702e7a697020485454502f312e310d0a486f73743a20<HONEYPOT>3a38300d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b20476f6f676c65626f742f322e313b202b687474703a2f2f7777772e676f6f676c652e636f6d2f626f742e68746d6c290d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)","ja3":"","session":"64920255-908b-476d-b5dc-d4da93b10401","seq":3,"duration_ms":1048,"bytes_in":454,"bytes_out":234},{"timestamp":"2026-09-21T15:39:07","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:80\",\"user-agent\":\"Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/backup.tar.gz","summary":"","payload_hex":"474554202f6261636b75702e7461722e677a20485454502f312e310d0a486f73743a20<HONEYPOT>3a38300d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b20476f6f676c65626f742f322e313b202b687474703a2f2f7777772e676f6f676c652e636f6d2f626f742e68746d6c290d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)","ja3":"","session":"df4198fc-7623-4de3-aee5-5da9531c4d09","seq":3,"duration_ms":1048,"bytes_in":453,"bytes_out":234}],"http_methods":[{"method":"GET","count":475}],"distinct_ports_total":6,"top_paths":[{"path":"/.npmrc","count":7,"ports":6},{"path":"/.env.bak","count":7,"ports":6},{"path":"/wp-config.php","count":7,"ports":6},{"path":"/config.json","count":7,"ports":6},{"path":"/config.js","count":7,"ports":6},{"path":"/.htpasswd","count":6,"ports":5},{"path":"/.env.old","count":6,"ports":5},{"path":"/settings.py","count":6,"ports":5},{"path":"/config.php","count":6,"ports":5},{"path":"/.git/config","count":6,"ports":5},{"path":"/configuration.php","count":6,"ports":5},{"path":"/wp-config.php.bak","count":6,"ports":5},{"path":"/docker-compose.yml","count":6,"ports":5},{"path":"/.env.production","count":6,"ports":5},{"path":"/config.py","count":6,"ports":5}],"distinct_paths_total":171,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","Host","User-Agent"],"representative":[{"name":"Accept","value":"*/*","notable":false},{"name":"Host","value":"<HONEYPOT>:80","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)","notable":false}],"distinct_sets":1,"events_with_headers":10},"tags":[{"tag_id":"CVE-2026-25892","tag_type":"cve","title":"Adminer 4.6.2 - 5.4.1 Unauthenticated Persistent DoS","severity":"high","actively_exploited":false,"match_field":"url_path","matched_pattern":"/adminer.php","reference_urls":["https://github.com/vrana/adminer/security/advisories/GHSA-q4f2-39gr-45jh","https://github.com/vrana/adminer/commit/21d3a3150388677b18647d68aec93b7850e457d3"]}],"data_as_of":"2026-10-01T14:44:34.387219+00:00"}