{"ip":"194.180.48.253","total_events":16,"verdict":{"verdict":"scanning","label":"Scanning for known vulnerabilities","detail":"1 exploit-path probe(s)","confidence":"medium","network_type":"CDN","why":["1 request(s) matched a known exploit path.","Only GET/HEAD seen, no request body: scanning for the vulnerability, not delivering a payload.","Not in any known-scanner range."],"engagement":{"level":"request","label":"Request traffic","detail":"2,232 bytes sent","bytes_sent":2232,"session_seconds":0,"persistent":false}},"first_seen":"2026-06-28T18:19:51","last_seen":"2026-08-14T23:12:09","events_24h":8,"events_7d":14,"geo":{"country_code":"DE","country_name":"Germany","region":"Bavaria","city":"Berngau","lat":49.2497,"lon":11.4038,"asn":201814,"org":"MEVSPACE sp. z o.o."},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as201814","label":"Mevspace","category":"cdn","url":"https://www.peeringdb.com/asn/201814"},"cve_matches":[],"malware":[],"top_ports":[{"port":80,"proto":"tcp","label":"HTTP","count":8},{"port":443,"proto":"tcp","label":"HTTPS","count":5},{"port":3000,"proto":"tcp","label":"Web-alt","count":3}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i130900_f57a46bbacb6_e7c285222651"],"tls_ja3":["6639916abfac56b9257ca216677085bc"],"ja4h":["ge11nn0400_319b7d62f92d","ge11nn0300_71c6a2db0d1f"]},"fingerprint_peers":{"t13i130900_f57a46bbacb6_e7c285222651":3676,"ge11nn0400_319b7d62f92d":1},"user_agents":["Mozilla/5.0 (compatible; SecurityScanner/1.0)","fasthttp"],"timeline":[{"date":"2026-06-28","count":2},{"date":"2026-08-10","count":2},{"date":"2026-08-11","count":3},{"date":"2026-08-12","count":1},{"date":"2026-08-14","count":8}],"recent_events":[{"timestamp":"2026-08-14T23:12:09","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:80\",\"range\":\"bytes=0-20239\",\"user-agent\":\"Mozilla/5.0 (compatible; SecurityScanner/1.0)\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/.env","summary":"","payload_hex":"474554202f2e656e7620485454502f312e310d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b2053656375726974795363616e6e65722f312e30290d0a486f73743a20<HONEYPOT>3a38300d0a52616e67653a2062797465733d302d32303233390d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; SecurityScanner/1.0)","ja3":"","session":"bbf9ff2b-55d7-4165-bda7-657328f527a2","seq":1,"duration_ms":100,"bytes_in":139,"bytes_out":79},{"timestamp":"2026-08-14T21:24:36","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:80\",\"range\":\"bytes=0-20239\",\"user-agent\":\"Mozilla/5.0 (compatible; SecurityScanner/1.0)\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/.env","summary":"","payload_hex":"474554202f2e656e7620485454502f312e310d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b2053656375726974795363616e6e65722f312e30290d0a486f73743a20<HONEYPOT>3a38300d0a52616e67653a2062797465733d302d32303233390d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; SecurityScanner/1.0)","ja3":"","session":"7a975574-0f5f-4c2a-b49f-17f4aa5230a6","seq":1,"duration_ms":100,"bytes_in":141,"bytes_out":79},{"timestamp":"2026-08-14T21:22:41","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:80\",\"range\":\"bytes=0-20239\",\"user-agent\":\"Mozilla/5.0 (compatible; SecurityScanner/1.0)\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/.env","summary":"","payload_hex":"474554202f2e656e7620485454502f312e310d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b2053656375726974795363616e6e65722f312e30290d0a486f73743a20<HONEYPOT>3a38300d0a52616e67653a2062797465733d302d32303233390d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; SecurityScanner/1.0)","ja3":"","session":"722bbca4-dae5-4702-a223-83b50bb1d7bc","seq":1,"duration_ms":100,"bytes_in":141,"bytes_out":79},{"timestamp":"2026-08-14T21:21:45","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:80\",\"range\":\"bytes=0-20239\",\"user-agent\":\"Mozilla/5.0 (compatible; SecurityScanner/1.0)\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/.env","summary":"","payload_hex":"474554202f2e656e7620485454502f312e310d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b2053656375726974795363616e6e65722f312e30290d0a486f73743a20<HONEYPOT>3a38300d0a52616e67653a2062797465733d302d32303233390d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; SecurityScanner/1.0)","ja3":"","session":"da28911a-5c47-4f5a-8403-a4b6ef7b2356","seq":1,"duration_ms":100,"bytes_in":141,"bytes_out":79},{"timestamp":"2026-08-14T21:21:17","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:80\",\"range\":\"bytes=0-20239\",\"user-agent\":\"Mozilla/5.0 (compatible; SecurityScanner/1.0)\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/.env","summary":"","payload_hex":"474554202f2e656e7620485454502f312e310d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b2053656375726974795363616e6e65722f312e30290d0a486f73743a20<HONEYPOT>3a38300d0a52616e67653a2062797465733d302d32303233390d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; SecurityScanner/1.0)","ja3":"","session":"99402bae-0194-44c7-8fea-5e2aeb93c606","seq":1,"duration_ms":101,"bytes_in":141,"bytes_out":79},{"timestamp":"2026-08-14T21:20:54","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:80\",\"range\":\"bytes=0-20239\",\"user-agent\":\"Mozilla/5.0 (compatible; SecurityScanner/1.0)\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/.env","summary":"","payload_hex":"474554202f2e656e7620485454502f312e310d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b2053656375726974795363616e6e65722f312e30290d0a486f73743a20<HONEYPOT>3a38300d0a52616e67653a2062797465733d302d32303233390d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; SecurityScanner/1.0)","ja3":"","session":"22e41efd-70b9-4a53-b05e-d5400d275b3d","seq":1,"duration_ms":100,"bytes_in":141,"bytes_out":79},{"timestamp":"2026-08-14T20:55:54","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:80\",\"range\":\"bytes=0-20239\",\"user-agent\":\"Mozilla/5.0 (compatible; SecurityScanner/1.0)\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/.env","summary":"","payload_hex":"474554202f2e656e7620485454502f312e310d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b2053656375726974795363616e6e65722f312e30290d0a486f73743a20<HONEYPOT>3a38300d0a52616e67653a2062797465733d302d32303233390d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; SecurityScanner/1.0)","ja3":"","session":"58ef9f1c-0760-46d4-b8be-124a609a0287","seq":1,"duration_ms":100,"bytes_in":139,"bytes_out":79},{"timestamp":"2026-08-14T14:24:54","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:80\",\"range\":\"bytes=0-20239\",\"user-agent\":\"Mozilla/5.0 (compatible; SecurityScanner/1.0)\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/.env","summary":"","payload_hex":"474554202f2e656e7620485454502f312e310d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b2053656375726974795363616e6e65722f312e30290d0a486f73743a20<HONEYPOT>3a38300d0a52616e67653a2062797465733d302d32303233390d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; SecurityScanner/1.0)","ja3":"","session":"d777ba45-c276-4270-933c-27a20d407b25","seq":1,"duration_ms":100,"bytes_in":140,"bytes_out":79},{"timestamp":"2026-08-12T01:14:27","port":3000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:3000\",\"range\":\"bytes=0-20239\",\"user-agent\":\"Mozilla/5.0 (compatible; SecurityScanner/1.0)\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/api/swagger","summary":"","payload_hex":"474554202f6170692f7377616767657220485454502f312e310d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b2053656375726974795363616e6e65722f312e30290d0a486f73743a20<HONEYPOT>3a333030300d0a52616e67653a2062797465733d302d32303233390d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; SecurityScanner/1.0)","ja3":"","session":"e5f4499f-e92c-4c7a-85b7-cd88d53bbf0a","seq":1,"duration_ms":100,"bytes_in":148,"bytes_out":79},{"timestamp":"2026-08-11T23:01:58","port":3000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:3000\",\"range\":\"bytes=0-20239\",\"user-agent\":\"Mozilla/5.0 (compatible; SecurityScanner/1.0)\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/api/swagger","summary":"","payload_hex":"474554202f6170692f7377616767657220485454502f312e310d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b2053656375726974795363616e6e65722f312e30290d0a486f73743a20<HONEYPOT>3a333030300d0a52616e67653a2062797465733d302d32303233390d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; SecurityScanner/1.0)","ja3":"","session":"d3c45f1d-034d-4c52-a53f-cef00eab436d","seq":1,"duration_ms":100,"bytes_in":149,"bytes_out":79}],"http_methods":[{"method":"GET","count":16}],"distinct_ports_total":3,"top_paths":[{"path":"/.env","count":8,"ports":1},{"path":"/.git/config","count":3,"ports":1},{"path":"/api/swagger","count":3,"ports":1},{"path":"/.claude/settings.local.json","count":2,"ports":1}],"distinct_paths_total":4,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","Host","Range","User-Agent"],"representative":[{"name":"Accept","value":"*/*","notable":false},{"name":"Host","value":"<HONEYPOT>:80","notable":false},{"name":"Range","value":"bytes=0-20239","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (compatible; SecurityScanner/1.0)","notable":false}],"distinct_sets":1,"events_with_headers":10},"tags":[],"data_as_of":"2026-08-15T12:23:41.981780+00:00"}