{"ip":"185.177.72.66","total_events":9,"verdict":{"verdict":"scanning","label":"Scanning for known vulnerabilities","detail":"1 exploit-path probe(s)","confidence":"medium","network_type":null,"why":["1 request(s) matched a known exploit path.","Only GET/HEAD seen, no request body: scanning for the vulnerability, not delivering a payload.","Not in any known-scanner range."],"engagement":{"level":"request","label":"Request traffic","detail":"1,180 bytes sent","bytes_sent":1180,"session_seconds":0,"persistent":false}},"first_seen":"2026-04-05T01:06:22","last_seen":"2026-08-10T14:19:40","events_24h":0,"events_7d":3,"geo":{"country_code":"FR","country_name":"France","region":"","city":"","lat":48.8582,"lon":2.3387,"asn":211590,"org":"Bucklog SARL"},"source_domain":null,"known_scanners":[],"scanner_tag":null,"cve_matches":[{"cve_id":"CVE-2026-4020","title":"Gravity SMTP WordPress Plugin - Sensitive Information Exposure","severity":"HIGH","actively_exploited":false,"match_field":"url_path","matched_pattern":"/wp-json/gravitysmtp/v1/tests/mock-data?page=gravitysmtp-settings"}],"malware":[],"top_ports":[{"port":3702,"proto":"tcp","label":"","count":4},{"port":993,"proto":"tcp","label":"IMAPS","count":3},{"port":53,"proto":"tcp","label":"DNS","count":2}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i1010h2_18ef40b21276_879711aa9f16"],"tls_ja3":["a1b77074bab81e5056ba398e26f31871"],"ja4h":["ge11nn14en_068ebe3632ec"]},"fingerprint_peers":{"t13i1010h2_18ef40b21276_879711aa9f16":5,"ge11nn14en_068ebe3632ec":17},"user_agents":["curl/8.7.1"],"timeline":[{"date":"2026-08-10","count":3}],"recent_events":[{"timestamp":"2026-08-10T14:19:40","port":993,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"accept-language\":\"en-US,en;q=0.9\",\"host\":\"<HONEYPOT>:993\",\"true-client-ip\":\"127.0.0.1\",\"user-agent\":\"curl/8.7.1\",\"x-azure-clientip\":\"127.0.0.1\",\"x-azure-socketip\":\"127.0.0.1\",\"x-client-ip\":\"127.0.0.1\",\"x-forwarded-for\":\"127.0.0.1\",\"x-forwared\":\"127.0.0.1\",\"x-host\":\"127.0.0.1\",\"x-originating-ip\":\"127.0.0.1\",\"x-real-ip\":\"127.0.0.1\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/%2egit/%63onfig","summary":"","payload_hex":"474554202f2532656769742f2536336f6e66696720485454502f312e310d0a486f73743a20<HONEYPOT>3a3939330d0a557365722d4167656e743a206375726c2f382e372e310d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a4163636570742d4c616e67756167653a20656e2d55532c656e3b713d302e390d0a582d466f727761726465642d466f723a203132372e302e302e310d0a582d5265616c2d49503a203132372e302e302e310d0a582d4f726967696e6174696e672d49503a203132372e302e302e310d0a582d436c69656e742d49503a203132372e302e302e310d0a547275652d436c69656e742d49503a203132372e302e302e310d0a582d417a7572652d436c69656e7449503a203132372e302e302e310d0a582d417a7572652d536f636b657449503a203132372e302e302e310d0a582d486f73743a203132372e302e302e310d0a582d466f7277617265643a203132372e302e302e310d0a0d0a","method":"GET","user_agent":"curl/8.7.1","ja3":"a1b77074bab81e5056ba398e26f31871","session":"2e3cfaa1-0166-4492-b9c4-e90ae635cf5f","seq":1,"duration_ms":100,"bytes_in":380,"bytes_out":20},{"timestamp":"2026-08-10T14:19:40","port":993,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"accept-language\":\"en-US,en;q=0.9\",\"host\":\"<HONEYPOT>:993\",\"true-client-ip\":\"127.0.0.1\",\"user-agent\":\"curl/8.7.1\",\"x-azure-clientip\":\"127.0.0.1\",\"x-azure-socketip\":\"127.0.0.1\",\"x-client-ip\":\"127.0.0.1\",\"x-forwarded-for\":\"127.0.0.1\",\"x-forwared\":\"127.0.0.1\",\"x-host\":\"127.0.0.1\",\"x-originating-ip\":\"127.0.0.1\",\"x-real-ip\":\"127.0.0.1\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/%2eenv","summary":"","payload_hex":"474554202f253265656e7620485454502f312e310d0a486f73743a20<HONEYPOT>3a3939330d0a557365722d4167656e743a206375726c2f382e372e310d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a4163636570742d4c616e67756167653a20656e2d55532c656e3b713d302e390d0a582d466f727761726465642d466f723a203132372e302e302e310d0a582d5265616c2d49503a203132372e302e302e310d0a582d4f726967696e6174696e672d49503a203132372e302e302e310d0a582d436c69656e742d49503a203132372e302e302e310d0a547275652d436c69656e742d49503a203132372e302e302e310d0a582d417a7572652d436c69656e7449503a203132372e302e302e310d0a582d417a7572652d536f636b657449503a203132372e302e302e310d0a582d486f73743a203132372e302e302e310d0a582d466f7277617265643a203132372e302e302e310d0a0d0a","method":"GET","user_agent":"curl/8.7.1","ja3":"a1b77074bab81e5056ba398e26f31871","session":"fc050b69-9442-4215-8716-c0891fa2cd8f","seq":1,"duration_ms":100,"bytes_in":371,"bytes_out":20},{"timestamp":"2026-08-10T14:19:39","port":993,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"accept-language\":\"en-US,en;q=0.9\",\"host\":\"<HONEYPOT>:993\",\"true-client-ip\":\"127.0.0.1\",\"user-agent\":\"curl/8.7.1\",\"x-azure-clientip\":\"127.0.0.1\",\"x-azure-socketip\":\"127.0.0.1\",\"x-client-ip\":\"127.0.0.1\",\"x-forwarded-for\":\"127.0.0.1\",\"x-forwared\":\"127.0.0.1\",\"x-host\":\"127.0.0.1\",\"x-originating-ip\":\"127.0.0.1\",\"x-real-ip\":\"127.0.0.1\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/wp-json/gravitysmtp/v1/tests/mock-data?page=gravitysmtp-settings","summary":"","payload_hex":"474554202f77702d6a736f6e2f67726176697479736d74702f76312f74657374732f6d6f636b2d646174613f706167653d67726176697479736d74702d73657474696e677320485454502f312e310d0a486f73743a20<HONEYPOT>3a3939330d0a557365722d4167656e743a206375726c2f382e372e310d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a4163636570742d4c616e67756167653a20656e2d55532c656e3b713d302e390d0a582d466f727761726465642d466f723a203132372e302e302e310d0a582d5265616c2d49503a203132372e302e302e310d0a582d4f726967696e6174696e672d49503a203132372e302e302e310d0a582d436c69656e742d49503a203132372e302e302e310d0a547275652d436c69656e742d49503a203132372e302e302e310d0a582d417a7572652d436c69656e7449503a203132372e302e302e310d0a582d417a7572652d536f636b657449503a203132372e302e302e310d0a582d486f73743a203132372e302e302e310d0a582d466f7277617265643a203132372e302e302e310d0a0d0a","method":"GET","user_agent":"curl/8.7.1","ja3":"a1b77074bab81e5056ba398e26f31871","session":"163ed2e3-6536-48c0-a715-068bcc614beb","seq":1,"duration_ms":100,"bytes_in":429,"bytes_out":20},{"timestamp":"2026-04-15T00:57:43","port":3702,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"ET /development/%2eenv%2eproduction HTTP/1.1\r\nHost: <HONEYPOT>:3702\r\nUser-Agent: curl/8.7.1\r\nAccept: */*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nTrue-Client-IP: 127.0.0.1\r\nX-Azure-ClientIP: 127.0.0.1\r\nX-Azure-SocketIP: 127.0.0.1\r\nX-Host: 127.0.0.1\r\nX-Forwared: 127.0.0.1\r\n\r\n","payload_hex":"4554202f646576656c6f706d656e742f253265656e7625326570726f64756374696f6e20485454502f312e310d0a486f73743a20<HONEYPOT>3a333730320d0a557365722d4167656e743a206375726c2f382e372e310d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a4163636570742d4c616e67756167653a20656e2d55532c656e3b713d302e390d0a582d466f727761726465642d466f723a203132372e302e302e310d0a582d5265616c2d49503a203132372e302e302e310d0a582d4f726967696e6174696e672d49503a203132372e302e302e310d0a582d436c69656e742d49503a203132372e302e302e310d0a547275652d436c69656e742d49503a203132372e302e302e310d0a582d417a7572652d436c69656e7449503a203132372e302e302e310d0a582d417a7572652d536f636b657449503a203132372e302e302e310d0a582d486f73743a203132372e302e302e310d0a582d466f7277617265643a203132372e302e302e310d0a0d0a","method":"","user_agent":"","ja3":"","session":"e069182f-7928-4d8f-b293-f1fb3c8c0037","seq":0,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"8222e558ced7e1c8","strings":["ET /development/%2eenv%2eproduction HTTP/1.1","Host: <HONEYPOT>:3702","User-Agent: curl/8.7.1","Accept: */*","Accept-Encoding: gzip","Accept-Language: en-US,en;q=0.9","X-Forwarded-For: 127.0.0.1","X-Real-IP: 127.0.0.1","X-Originating-IP: 127.0.0.1","X-Client-IP: 127.0.0.1"],"iocs":{"ips":["127.0.0.1"],"paths":["/development/%2eenv%2eproduction"]}}},{"timestamp":"2026-04-15T00:57:43","port":3702,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"G","payload_hex":"47","method":"","user_agent":"","ja3":"","session":"e069182f-7928-4d8f-b293-f1fb3c8c0037","seq":0,"duration_ms":0,"bytes_in":0,"bytes_out":0},{"timestamp":"2026-04-08T05:43:05","port":3702,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"ET /twilio%2ejson HTTP/1.1\r\nHost: <HONEYPOT>:3702\r\nUser-Agent: curl/8.7.1\r\nAccept: */*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nTrue-Client-IP: 127.0.0.1\r\nX-Azure-ClientIP: 127.0.0.1\r\nX-Azure-SocketIP: 127.0.0.1\r\nX-Host: 127.0.0.1\r\nX-Forwared: 127.0.0.1\r\n\r\n","payload_hex":"4554202f7477696c696f2532656a736f6e20485454502f312e310d0a486f73743a20<HONEYPOT>3a333730320d0a557365722d4167656e743a206375726c2f382e372e310d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a4163636570742d4c616e67756167653a20656e2d55532c656e3b713d302e390d0a582d466f727761726465642d466f723a203132372e302e302e310d0a582d5265616c2d49503a203132372e302e302e310d0a582d4f726967696e6174696e672d49503a203132372e302e302e310d0a582d436c69656e742d49503a203132372e302e302e310d0a547275652d436c69656e742d49503a203132372e302e302e310d0a582d417a7572652d436c69656e7449503a203132372e302e302e310d0a582d417a7572652d536f636b657449503a203132372e302e302e310d0a582d486f73743a203132372e302e302e310d0a582d466f7277617265643a203132372e302e302e310d0a0d0a","method":"","user_agent":"","ja3":"","session":"56204b49-b721-4cc5-9b5c-a4e62752e8ec","seq":0,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"fbf8c3bcd4f46eeb","strings":["ET /twilio%2ejson HTTP/1.1","Host: <HONEYPOT>:3702","User-Agent: curl/8.7.1","Accept: */*","Accept-Encoding: gzip","Accept-Language: en-US,en;q=0.9","X-Forwarded-For: 127.0.0.1","X-Real-IP: 127.0.0.1","X-Originating-IP: 127.0.0.1","X-Client-IP: 127.0.0.1"],"iocs":{"ips":["127.0.0.1"]}}},{"timestamp":"2026-04-08T05:43:05","port":3702,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"G","payload_hex":"47","method":"","user_agent":"","ja3":"","session":"56204b49-b721-4cc5-9b5c-a4e62752e8ec","seq":0,"duration_ms":0,"bytes_in":0,"bytes_out":0},{"timestamp":"2026-04-05T01:06:22","port":53,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"ET / HTTP/1.1\r\nHost: <HONEYPOT>:53\r\nUser-Agent: curl/8.7.1\r\nAccept: */*\r\nAccept-Encoding: gzip\r\nAccept-Language: en-US,en;q=0.9\r\nX-Forwarded-For: 127.0.0.1\r\nX-Real-IP: 127.0.0.1\r\nX-Originating-IP: 127.0.0.1\r\nX-Client-IP: 127.0.0.1\r\nTrue-Client-IP: 127.0.0.1\r\nX-Azure-ClientIP: 127.0.0.1\r\nX-Azure-SocketIP: 127.0.0.1\r\nX-Host: 127.0.0.1\r\nX-Forwared: 127.0.0.1\r\n\r\n","payload_hex":"4554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a35330d0a557365722d4167656e743a206375726c2f382e372e310d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a4163636570742d4c616e67756167653a20656e2d55532c656e3b713d302e390d0a582d466f727761726465642d466f723a203132372e302e302e310d0a582d5265616c2d49503a203132372e302e302e310d0a582d4f726967696e6174696e672d49503a203132372e302e302e310d0a582d436c69656e742d49503a203132372e302e302e310d0a547275652d436c69656e742d49503a203132372e302e302e310d0a582d417a7572652d436c69656e7449503a203132372e302e302e310d0a582d417a7572652d536f636b657449503a203132372e302e302e310d0a582d486f73743a203132372e302e302e310d0a582d466f7277617265643a203132372e302e302e310d0a0d0a","method":"","user_agent":"","ja3":"","session":"c8ef2588-87fd-4c52-acd9-e514a89cb636","seq":0,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"472fd0865932d674","strings":["ET / HTTP/1.1","Host: <HONEYPOT>:53","User-Agent: curl/8.7.1","Accept: */*","Accept-Encoding: gzip","Accept-Language: en-US,en;q=0.9","X-Forwarded-For: 127.0.0.1","X-Real-IP: 127.0.0.1","X-Originating-IP: 127.0.0.1","X-Client-IP: 127.0.0.1"],"iocs":{"ips":["127.0.0.1"]}}},{"timestamp":"2026-04-05T01:06:22","port":53,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"G","payload_hex":"47","method":"","user_agent":"","ja3":"","session":"c8ef2588-87fd-4c52-acd9-e514a89cb636","seq":0,"duration_ms":0,"bytes_in":0,"bytes_out":0}],"http_methods":[{"method":"GET","count":3}],"distinct_ports_total":3,"top_paths":[{"path":"/%2eenv","count":1,"ports":1},{"path":"/%2egit/%63onfig","count":1,"ports":1},{"path":"/wp-json/gravitysmtp/v1/tests/mock-data?page=gravitysmtp-settings","count":1,"ports":1}],"distinct_paths_total":3,"top_snis":[],"top_hosts":[],"top_alpns":[{"value":"h2, http/1.1","count":3}],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","Accept-Encoding","Accept-Language","Host","True-Client-Ip","User-Agent","X-Azure-Clientip","X-Azure-Socketip","X-Client-Ip","X-Forwarded-For","X-Forwared","X-Host","X-Originating-Ip","X-Real-Ip"],"representative":[{"name":"Accept","value":"*/*","notable":false},{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Accept-Language","value":"en-US,en;q=0.9","notable":false},{"name":"Host","value":"<HONEYPOT>:993","notable":false},{"name":"True-Client-Ip","value":"127.0.0.1","notable":false},{"name":"User-Agent","value":"curl/8.7.1","notable":false},{"name":"X-Azure-Clientip","value":"127.0.0.1","notable":true},{"name":"X-Azure-Socketip","value":"127.0.0.1","notable":true},{"name":"X-Client-Ip","value":"127.0.0.1","notable":true},{"name":"X-Forwarded-For","value":"127.0.0.1","notable":true},{"name":"X-Forwared","value":"127.0.0.1","notable":true},{"name":"X-Host","value":"127.0.0.1","notable":true},{"name":"X-Originating-Ip","value":"127.0.0.1","notable":true},{"name":"X-Real-Ip","value":"127.0.0.1","notable":true}],"distinct_sets":1,"events_with_headers":3},"tags":[{"tag_id":"CVE-2026-4020","tag_type":"cve","title":"Gravity SMTP WordPress Plugin - Sensitive Information Exposure","severity":"HIGH","actively_exploited":false,"match_field":"url_path","matched_pattern":"/wp-json/gravitysmtp/v1/tests/mock-data?page=gravitysmtp-settings","reference_urls":[]}],"data_as_of":"2026-08-15T09:47:41.636876+00:00"}