{"ip":"193.32.204.199","total_events":3126,"verdict":{"verdict":"scanning","label":"Sustained targeting","detail":"3,126 events across 5 port(s)","confidence":"medium","network_type":null,"why":["3,126 requests against only 5 service(s), which is depth rather than a sweep.","Typical of credential stuffing or a single-service campaign; the median address here sends three requests.","No exploit payload observed, so this describes volume and focus, not a confirmed compromise attempt.","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"394,435 bytes sent","bytes_sent":394435,"session_seconds":2,"persistent":false}},"first_seen":"2026-09-01T18:52:44","last_seen":"2026-09-04T12:38:15","events_24h":1229,"events_7d":3126,"geo":{"country_code":"TR","country_name":"Türkiye","region":"","city":"","lat":41.0214,"lon":28.9948,"asn":153622,"org":"Madina IT"},"source_domain":null,"known_scanners":[],"scanner_tag":null,"cve_matches":[],"malware":[],"top_ports":[{"port":443,"proto":"tcp","label":"HTTPS","count":1161},{"port":80,"proto":"tcp","label":"HTTP","count":934},{"port":8000,"proto":"tcp","label":"HTTP-alt","count":507},{"port":8080,"proto":"tcp","label":"HTTP-alt","count":270},{"port":8888,"proto":"tcp","label":"HTTP-alt","count":254}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i190800_9dc949149365_97f8aa674fd9","t13i191000_9dc949149365_e5728521abd4","t13i190900_9dc949149365_e7c285222651"],"tls_ja3":["d6828e30ab66774a91a96ae93be4ae4c","96458b3de39df5d47bc5c4a9f10f8f26","19e29534fd49dd27d09234e639c4057e"],"ja4h":["ge11nn0300_86b6b04cb9cc","ge11nn0500_9af7e0472034","ge11nn0400_9c3956fad5da","ge11nn0100_4740ae6347b0"]},"fingerprint_peers":{"t13i190800_9dc949149365_97f8aa674fd9":2098,"t13i190900_9dc949149365_e7c285222651":3020,"ge11nn0300_86b6b04cb9cc":5250,"ge11nn0500_9af7e0472034":710,"ge11nn0400_9c3956fad5da":1581,"ge11nn0100_4740ae6347b0":609,"t13i191000_9dc949149365_e5728521abd4":168},"user_agents":["l9explore/1.2.2","Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Silktide","Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_6) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/15.1 Safari/605.1.15","Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Edg/115.0.1901.183","l9tcpid/v1.1.0","Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.0.2 Safari/605.1.15","Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.1 Safari/E7FBAF"],"timeline":[{"date":"2026-09-01","count":76},{"date":"2026-09-02","count":191},{"date":"2026-09-03","count":1885},{"date":"2026-09-04","count":974}],"recent_events":[{"timestamp":"2026-09-04T12:38:15","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"l9explore/1.2.2\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/template/.git/config","summary":"","payload_hex":"474554202f74656d706c6174652f2e6769742f636f6e66696720485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a206c396578706c6f72652f312e322e320d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"l9explore/1.2.2","ja3":"96458b3de39df5d47bc5c4a9f10f8f26","session":"0f4c39af-1764-48bf-809f-135e5b45ae96","seq":1,"duration_ms":100,"bytes_in":131,"bytes_out":79},{"timestamp":"2026-09-04T12:38:15","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"l9explore/1.2.2\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/modules/.git/config","summary":"","payload_hex":"474554202f6d6f64756c65732f2e6769742f636f6e66696720485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a206c396578706c6f72652f312e322e320d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"l9explore/1.2.2","ja3":"96458b3de39df5d47bc5c4a9f10f8f26","session":"fd70f698-0625-42d8-99c9-57fdb2a609bb","seq":1,"duration_ms":577,"bytes_in":130,"bytes_out":79},{"timestamp":"2026-09-04T12:38:14","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"l9explore/1.2.2\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/lib/.git/config","summary":"","payload_hex":"474554202f6c69622f2e6769742f636f6e66696720485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a206c396578706c6f72652f312e322e320d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"l9explore/1.2.2","ja3":"96458b3de39df5d47bc5c4a9f10f8f26","session":"f09a0697-13c0-42c9-9268-35356a691502","seq":1,"duration_ms":391,"bytes_in":126,"bytes_out":79},{"timestamp":"2026-09-04T12:38:13","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"l9explore/1.2.2\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/build/.git/config","summary":"","payload_hex":"474554202f6275696c642f2e6769742f636f6e66696720485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a206c396578706c6f72652f312e322e320d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"l9explore/1.2.2","ja3":"96458b3de39df5d47bc5c4a9f10f8f26","session":"4b2957c1-7711-450c-8cc5-af7fc2eba7af","seq":1,"duration_ms":766,"bytes_in":128,"bytes_out":79},{"timestamp":"2026-09-04T12:38:11","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"l9explore/1.2.2\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/backend/.git/config","summary":"","payload_hex":"474554202f6261636b656e642f2e6769742f636f6e66696720485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a206c396578706c6f72652f312e322e320d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"l9explore/1.2.2","ja3":"96458b3de39df5d47bc5c4a9f10f8f26","session":"dfa60abe-c5c7-42d2-956d-9a45ef541e68","seq":1,"duration_ms":101,"bytes_in":130,"bytes_out":79},{"timestamp":"2026-09-04T12:38:10","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"l9explore/1.2.2\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/core/.git/config","summary":"","payload_hex":"474554202f636f72652f2e6769742f636f6e66696720485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a206c396578706c6f72652f312e322e320d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"l9explore/1.2.2","ja3":"96458b3de39df5d47bc5c4a9f10f8f26","session":"9667ff40-6867-4d9a-bf22-a1474a49b860","seq":1,"duration_ms":100,"bytes_in":127,"bytes_out":79},{"timestamp":"2026-09-04T12:38:09","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"l9explore/1.2.2\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/cms/.git/config","summary":"","payload_hex":"474554202f636d732f2e6769742f636f6e66696720485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a206c396578706c6f72652f312e322e320d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"l9explore/1.2.2","ja3":"96458b3de39df5d47bc5c4a9f10f8f26","session":"2e9027e8-94ab-41e1-bfc6-eb29628f4fea","seq":1,"duration_ms":745,"bytes_in":126,"bytes_out":79},{"timestamp":"2026-09-04T12:38:07","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"l9explore/1.2.2\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/plugins/.git/config","summary":"","payload_hex":"474554202f706c7567696e732f2e6769742f636f6e66696720485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a206c396578706c6f72652f312e322e320d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"l9explore/1.2.2","ja3":"96458b3de39df5d47bc5c4a9f10f8f26","session":"109f8e71-c5f9-41bb-90c5-00c73eb84513","seq":1,"duration_ms":414,"bytes_in":130,"bytes_out":79},{"timestamp":"2026-09-04T12:38:06","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"l9explore/1.2.2\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/release/.git/config","summary":"","payload_hex":"474554202f72656c656173652f2e6769742f636f6e66696720485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a206c396578706c6f72652f312e322e320d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"l9explore/1.2.2","ja3":"96458b3de39df5d47bc5c4a9f10f8f26","session":"c3857dde-00ec-4a83-9771-ba906a00005d","seq":1,"duration_ms":100,"bytes_in":130,"bytes_out":79},{"timestamp":"2026-09-04T12:38:03","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"l9explore/1.2.2\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/prod/.git/config","summary":"","payload_hex":"474554202f70726f642f2e6769742f636f6e66696720485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a206c396578706c6f72652f312e322e320d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"l9explore/1.2.2","ja3":"96458b3de39df5d47bc5c4a9f10f8f26","session":"2d35b5ec-06da-4dd3-acc8-1c99db8a770f","seq":1,"duration_ms":101,"bytes_in":127,"bytes_out":79}],"http_methods":[{"method":"GET","count":3126}],"distinct_ports_total":5,"top_paths":[{"path":"/","count":188,"ports":5},{"path":"/.git/config","count":105,"ports":5},{"path":"/static../.git/config","count":60,"ports":5},{"path":"/client/.git/config","count":60,"ports":5},{"path":"/includes/.git/config","count":60,"ports":5},{"path":"/v2/.git/config","count":60,"ports":5},{"path":"/code/.git/config","count":60,"ports":5},{"path":"/config/.git/config","count":60,"ports":5},{"path":"/media../.git/config","count":60,"ports":5},{"path":"/data/.git/config","count":59,"ports":5},{"path":"/portal/.git/config","count":59,"ports":5},{"path":"/www/.git/config","count":59,"ports":5},{"path":"/site/.git/config","count":59,"ports":5},{"path":"/api/.git/config","count":59,"ports":5},{"path":"/legacy/.git/config","count":59,"ports":5}],"distinct_paths_total":51,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept-Encoding","Connection","Host","User-Agent"],"representative":[{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Connection","value":"close","notable":false},{"name":"Host","value":"<HONEYPOT>","notable":false},{"name":"User-Agent","value":"l9explore/1.2.2","notable":false}],"distinct_sets":1,"events_with_headers":10},"tags":[],"data_as_of":"2026-09-04T21:05:20.675256+00:00"}