{"ip":"192.253.248.163","total_events":2436,"verdict":{"verdict":"scanning","label":"Scanning for known vulnerabilities","detail":"161 exploit-path probe(s)","confidence":"medium","network_type":null,"why":["161 request(s) matched a known exploit path.","Only GET/HEAD seen, no request body: scanning for the vulnerability, not delivering a payload.","Not in any known-scanner range.","Held a session open for 71s, against a median of well under a second."],"engagement":{"level":"payload","label":"Sustained payload, held open","detail":"40,029,287 bytes sent, longest session 71s","bytes_sent":40029287,"session_seconds":71,"persistent":true}},"first_seen":"2026-09-10T11:07:48","last_seen":"2026-09-12T21:22:20","events_24h":0,"events_7d":1204,"geo":{"country_code":"NL","country_name":"The Netherlands","region":"Limburg","city":"","lat":51.2486,"lon":6.006,"asn":213790,"org":"Limited Network LTD"},"source_domain":null,"known_scanners":[],"scanner_tag":null,"cve_matches":[],"malware":[],"top_ports":[{"port":80,"proto":"tcp","label":"HTTP","count":1341},{"port":443,"proto":"tcp","label":"HTTPS","count":1095}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i141000_cbb2034c60b8_e5728521abd4"],"tls_ja3":["2079bcc000c9a54e0784733c0142d140"],"ja4h":["ge11nn0500_b61ccdd104e0","ge11nn0700_ed6ea7c6caee","ge11nn0500_e6b1eaaea03a","ge11nn0500_cac2c496544b"]},"fingerprint_peers":{"t13i141000_cbb2034c60b8_e5728521abd4":10,"ge11nn0500_b61ccdd104e0":206,"ge11nn0700_ed6ea7c6caee":2,"ge11nn0500_e6b1eaaea03a":3,"ge11nn0500_cac2c496544b":58},"user_agents":["Mozilla/5.0 (Macintosh; Intel Mac OS X 14_4_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36","Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:126.0) Gecko/20100101 Firefox/126.0","Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0","Mozilla/5.0 (Macintosh; Intel Mac OS X 14_5) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.5 Safari/605.1.15","Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36","Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Edg/124.0.0.0","Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36","Mozilla/5.0 (X11; Linux x86_64; rv:126.0) Gecko/20100101 Firefox/126.0"],"timeline":[{"date":"2026-09-10","count":354},{"date":"2026-09-12","count":2082}],"recent_events":[{"timestamp":"2026-09-12T21:22:20","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>-host.colocrossing.com","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"identity\",\"host\":\"<HONEYPOT>-host.colocrossing.com\",\"range\":\"bytes=0-511\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/.envnew","summary":"","payload_hex":"474554202f2e656e766e657720485454502f312e310d0a486f73743a2032332d39342d33362d3134312d686f73742e636f6c6f63726f7373696e672e636f6d0d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132352e302e302e30205361666172692f3533372e33360d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a206964656e746974790d0a52616e67653a2062797465733d302d3531310d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36","ja3":"2079bcc000c9a54e0784733c0142d140","session":"591992f5-2995-4150-8850-39b6578d8225","seq":136,"duration_ms":70722,"bytes_in":31231,"bytes_out":10880},{"timestamp":"2026-09-12T21:22:20","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>-host.colocrossing.com","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"identity\",\"host\":\"<HONEYPOT>-host.colocrossing.com\",\"range\":\"bytes=0-511\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/.envNew","summary":"","payload_hex":"474554202f2e656e764e657720485454502f312e310d0a486f73743a2032332d39342d33362d3134312d686f73742e636f6c6f63726f7373696e672e636f6d0d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132352e302e302e30205361666172692f3533372e33360d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a206964656e746974790d0a52616e67653a2062797465733d302d3531310d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36","ja3":"2079bcc000c9a54e0784733c0142d140","session":"2454ea90-0268-4ba9-91d5-e5dc240c9ab8","seq":136,"duration_ms":70716,"bytes_in":31340,"bytes_out":10880},{"timestamp":"2026-09-12T21:22:19","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>-host.colocrossing.com","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"identity\",\"host\":\"<HONEYPOT>-host.colocrossing.com\",\"range\":\"bytes=0-511\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:126.0) Gecko/20100101 Firefox/126.0\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/.env1","summary":"","payload_hex":"474554202f2e656e763120485454502f312e310d0a486f73743a2032332d39342d33362d3134312d686f73742e636f6c6f63726f7373696e672e636f6d0d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b207836343b2072763a3132362e3029204765636b6f2f32303130303130312046697265666f782f3132362e300d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a206964656e746974790d0a52616e67653a2062797465733d302d3531310d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:126.0) Gecko/20100101 Firefox/126.0","ja3":"2079bcc000c9a54e0784733c0142d140","session":"591992f5-2995-4150-8850-39b6578d8225","seq":135,"duration_ms":70205,"bytes_in":30979,"bytes_out":10800},{"timestamp":"2026-09-12T21:22:19","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>-host.colocrossing.com","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"identity\",\"host\":\"<HONEYPOT>-host.colocrossing.com\",\"range\":\"bytes=0-511\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/.env2","summary":"","payload_hex":"474554202f2e656e763220485454502f312e310d0a486f73743a2032332d39342d33362d3134312d686f73742e636f6c6f63726f7373696e672e636f6d0d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b207836343b2072763a3132352e3029204765636b6f2f32303130303130312046697265666f782f3132352e300d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a206964656e746974790d0a52616e67653a2062797465733d302d3531310d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0","ja3":"2079bcc000c9a54e0784733c0142d140","session":"2454ea90-0268-4ba9-91d5-e5dc240c9ab8","seq":135,"duration_ms":70200,"bytes_in":31088,"bytes_out":10800},{"timestamp":"2026-09-12T21:22:18","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>-host.colocrossing.com","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"identity\",\"host\":\"<HONEYPOT>-host.colocrossing.com\",\"range\":\"bytes=0-511\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/.env.vercel","summary":"","payload_hex":"474554202f2e656e762e76657263656c20485454502f312e310d0a486f73743a2032332d39342d33362d3134312d686f73742e636f6c6f63726f7373696e672e636f6d0d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132352e302e302e30205361666172692f3533372e33360d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a206964656e746974790d0a52616e67653a2062797465733d302d3531310d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36","ja3":"2079bcc000c9a54e0784733c0142d140","session":"591992f5-2995-4150-8850-39b6578d8225","seq":134,"duration_ms":69390,"bytes_in":30760,"bytes_out":10720},{"timestamp":"2026-09-12T21:22:18","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>-host.colocrossing.com","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"identity\",\"host\":\"<HONEYPOT>-host.colocrossing.com\",\"range\":\"bytes=0-511\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64; rv:126.0) Gecko/20100101 Firefox/126.0\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/.env.uat","summary":"","payload_hex":"474554202f2e656e762e75617420485454502f312e310d0a486f73743a2032332d39342d33362d3134312d686f73742e636f6c6f63726f7373696e672e636f6d0d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f36343b2072763a3132362e3029204765636b6f2f32303130303130312046697265666f782f3132362e300d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a206964656e746974790d0a52616e67653a2062797465733d302d3531310d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64; rv:126.0) Gecko/20100101 Firefox/126.0","ja3":"2079bcc000c9a54e0784733c0142d140","session":"2454ea90-0268-4ba9-91d5-e5dc240c9ab8","seq":134,"duration_ms":69366,"bytes_in":30869,"bytes_out":10720},{"timestamp":"2026-09-12T21:22:18","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>-host.colocrossing.com","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"identity\",\"host\":\"<HONEYPOT>-host.colocrossing.com\",\"range\":\"bytes=0-511\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:126.0) Gecko/20100101 Firefox/126.0\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/.env.test.local","summary":"","payload_hex":"474554202f2e656e762e746573742e6c6f63616c20485454502f312e310d0a486f73743a2032332d39342d33362d3134312d686f73742e636f6c6f63726f7373696e672e636f6d0d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b207836343b2072763a3132362e3029204765636b6f2f32303130303130312046697265666f782f3132362e300d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a206964656e746974790d0a52616e67653a2062797465733d302d3531310d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:126.0) Gecko/20100101 Firefox/126.0","ja3":"2079bcc000c9a54e0784733c0142d140","session":"2454ea90-0268-4ba9-91d5-e5dc240c9ab8","seq":133,"duration_ms":68930,"bytes_in":30657,"bytes_out":10640},{"timestamp":"2026-09-12T21:22:18","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>-host.colocrossing.com","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"identity\",\"host\":\"<HONEYPOT>-host.colocrossing.com\",\"range\":\"bytes=0-511\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64; rv:126.0) Gecko/20100101 Firefox/126.0\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/.env.test","summary":"","payload_hex":"474554202f2e656e762e7465737420485454502f312e310d0a486f73743a2032332d39342d33362d3134312d686f73742e636f6c6f63726f7373696e672e636f6d0d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f36343b2072763a3132362e3029204765636b6f2f32303130303130312046697265666f782f3132362e300d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a206964656e746974790d0a52616e67653a2062797465733d302d3531310d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64; rv:126.0) Gecko/20100101 Firefox/126.0","ja3":"2079bcc000c9a54e0784733c0142d140","session":"591992f5-2995-4150-8850-39b6578d8225","seq":133,"duration_ms":68930,"bytes_in":30504,"bytes_out":10640},{"timestamp":"2026-09-12T21:22:18","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>-host.colocrossing.com","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"identity\",\"host\":\"<HONEYPOT>-host.colocrossing.com\",\"range\":\"bytes=0-511\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/.env.staging","summary":"","payload_hex":"474554202f2e656e762e73746167696e6720485454502f312e310d0a486f73743a2032332d39342d33362d3134312d686f73742e636f6c6f63726f7373696e672e636f6d0d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132352e302e302e30205361666172692f3533372e33360d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a206964656e746974790d0a52616e67653a2062797465733d302d3531310d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36","ja3":"2079bcc000c9a54e0784733c0142d140","session":"2454ea90-0268-4ba9-91d5-e5dc240c9ab8","seq":132,"duration_ms":68653,"bytes_in":30428,"bytes_out":10560},{"timestamp":"2026-09-12T21:22:18","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>-host.colocrossing.com","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"identity\",\"host\":\"<HONEYPOT>-host.colocrossing.com\",\"range\":\"bytes=0-511\",\"user-agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 14_4_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/.env.sandbox","summary":"","payload_hex":"474554202f2e656e762e73616e64626f7820485454502f312e310d0a486f73743a2032332d39342d33362d3134312d686f73742e636f6c6f63726f7373696e672e636f6d0d0a557365722d4167656e743a204d6f7a696c6c612f352e3020284d6163696e746f73683b20496e74656c204d6163204f5320582031345f345f3129204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132342e302e302e30205361666172692f3533372e33360d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a206964656e746974790d0a52616e67653a2062797465733d302d3531310d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 14_4_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36","ja3":"2079bcc000c9a54e0784733c0142d140","session":"591992f5-2995-4150-8850-39b6578d8225","seq":132,"duration_ms":68639,"bytes_in":30291,"bytes_out":10560}],"http_methods":[{"method":"GET","count":2436}],"distinct_ports_total":2,"top_paths":[{"path":"/.development.env","count":21,"ports":2},{"path":"/.env","count":21,"ports":2},{"path":"/.env.qa","count":15,"ports":2},{"path":"/.env.development","count":15,"ports":2},{"path":"/.env.docker","count":15,"ports":2},{"path":"/.env.staging","count":15,"ports":2},{"path":"/.env.local","count":15,"ports":2},{"path":"/.env.prod","count":15,"ports":2},{"path":"/.env.development.local","count":15,"ports":2},{"path":"/.env.azure","count":15,"ports":2},{"path":"/.env.netlify","count":15,"ports":2},{"path":"/.env.example","count":15,"ports":2},{"path":"/.env.aws","count":15,"ports":2},{"path":"/.env.heroku","count":15,"ports":2},{"path":"/.env.github-actions","count":15,"ports":2}],"distinct_paths_total":200,"top_snis":[],"top_hosts":[{"value":"127.0.0.1","count":164},{"value":"<HONEYPOT>-host.colocrossing.com","count":60},{"value":"132.183.175.5.servitro.com","count":30}],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","Accept-Encoding","Host","Range","User-Agent"],"representative":[{"name":"Accept","value":"*/*","notable":false},{"name":"Accept-Encoding","value":"identity","notable":false},{"name":"Host","value":"<HONEYPOT>-host.colocrossing.com","notable":false},{"name":"Range","value":"bytes=0-511","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36","notable":false}],"distinct_sets":1,"events_with_headers":10},"tags":[],"data_as_of":"2026-09-19T15:10:18.613691+00:00"}