{"ip":"195.178.110.70","total_events":220,"verdict":{"verdict":"scanning","label":"Scanning for known vulnerabilities","detail":"11 exploit-path probe(s)","confidence":"medium","network_type":null,"why":["11 request(s) matched a known exploit path.","Only GET/HEAD seen, no request body: scanning for the vulnerability, not delivering a payload.","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"24,641 bytes sent","bytes_sent":24641,"session_seconds":0,"persistent":false}},"first_seen":"2026-09-03T06:12:33","last_seen":"2026-09-06T08:38:17","events_24h":0,"events_7d":0,"geo":{"country_code":"BG","country_name":"Bulgaria","region":"","city":"","lat":42.696,"lon":23.332,"asn":48090,"org":"Techoff Srv Limited"},"source_domain":null,"known_scanners":[],"scanner_tag":null,"cve_matches":[],"malware":[],"top_ports":[{"port":443,"proto":"tcp","label":"HTTPS","count":134},{"port":80,"proto":"tcp","label":"HTTP","count":44},{"port":8080,"proto":"tcp","label":"HTTP-alt","count":27},{"port":8443,"proto":"tcp","label":"HTTPS-alt","count":15}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i191000_9dc949149365_e5728521abd4","t13i131000_f57a46bbacb6_ab7e3b40a677"],"tls_client_hello":"","tls_ja3":["96458b3de39df5d47bc5c4a9f10f8f26","2196848d251b217de8b2c037e356c11d"],"http_akin":[]},"fingerprint_peers":{"t13i191000_9dc949149365_e5728521abd4":187,"t13i131000_f57a46bbacb6_ab7e3b40a677":5144},"user_agents":["Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36","l9tcpid/v1.1.0","l9explore/1.2.2"],"timeline":[{"date":"2026-09-03","count":158},{"date":"2026-09-04","count":47},{"date":"2026-09-06","count":15}],"recent_events":[{"timestamp":"2026-09-06T08:38:17","port":8443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8443\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/_profiler/","summary":"","payload_hex":"474554202f5f70726f66696c65722f20485454502f312e310d0a486f73743a20<HONEYPOT>3a383434330d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f363429204170706c655765624b69742f3533372e33360d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36","ja3":"2196848d251b217de8b2c037e356c11d","session":"a7b65505-5294-49f1-99c2-8ee52d186282","seq":1,"duration_ms":100,"bytes_in":161,"bytes_out":79},{"timestamp":"2026-09-06T08:38:17","port":8443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8443\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/telescope/requests","summary":"","payload_hex":"474554202f74656c6573636f70652f726571756573747320485454502f312e310d0a486f73743a20<HONEYPOT>3a383434330d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f363429204170706c655765624b69742f3533372e33360d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36","ja3":"2196848d251b217de8b2c037e356c11d","session":"9900bd3a-6579-4de2-bbd5-a97d6fd017b7","seq":1,"duration_ms":100,"bytes_in":169,"bytes_out":79},{"timestamp":"2026-09-06T08:38:16","port":8443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8443\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/actuator/heapdump","summary":"","payload_hex":"474554202f6163747561746f722f6865617064756d7020485454502f312e310d0a486f73743a20<HONEYPOT>3a383434330d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f363429204170706c655765624b69742f3533372e33360d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36","ja3":"2196848d251b217de8b2c037e356c11d","session":"3c0179d4-10ae-47c5-a9c8-b90b3ab5ebe9","seq":1,"duration_ms":100,"bytes_in":168,"bytes_out":79},{"timestamp":"2026-09-06T08:38:16","port":8443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8443\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/actuator/env","summary":"","payload_hex":"474554202f6163747561746f722f656e7620485454502f312e310d0a486f73743a20<HONEYPOT>3a383434330d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f363429204170706c655765624b69742f3533372e33360d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36","ja3":"2196848d251b217de8b2c037e356c11d","session":"22d800b2-6822-458e-8221-86645d2086c0","seq":1,"duration_ms":100,"bytes_in":163,"bytes_out":79},{"timestamp":"2026-09-06T08:38:16","port":8443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8443\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/config.json","summary":"","payload_hex":"474554202f636f6e6669672e6a736f6e20485454502f312e310d0a486f73743a20<HONEYPOT>3a383434330d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f363429204170706c655765624b69742f3533372e33360d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36","ja3":"2196848d251b217de8b2c037e356c11d","session":"694dd6a0-4613-45c9-91c5-a2c781442bcb","seq":1,"duration_ms":100,"bytes_in":162,"bytes_out":79},{"timestamp":"2026-09-06T08:38:16","port":8443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8443\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/.git/config.old","summary":"","payload_hex":"474554202f2e6769742f636f6e6669672e6f6c6420485454502f312e310d0a486f73743a20<HONEYPOT>3a383434330d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f363429204170706c655765624b69742f3533372e33360d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36","ja3":"2196848d251b217de8b2c037e356c11d","session":"54d81129-5018-41cf-8f97-8c65795044f4","seq":1,"duration_ms":100,"bytes_in":166,"bytes_out":79},{"timestamp":"2026-09-06T08:38:16","port":8443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8443\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/.git/config.backup","summary":"","payload_hex":"474554202f2e6769742f636f6e6669672e6261636b757020485454502f312e310d0a486f73743a20<HONEYPOT>3a383434330d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f363429204170706c655765624b69742f3533372e33360d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36","ja3":"2196848d251b217de8b2c037e356c11d","session":"4c77997e-836e-4656-96fd-6077be8e8f59","seq":1,"duration_ms":100,"bytes_in":169,"bytes_out":79},{"timestamp":"2026-09-06T08:38:16","port":8443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8443\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/.gitlab-cli.yml","summary":"","payload_hex":"474554202f2e6769746c61622d636c692e796d6c20485454502f312e310d0a486f73743a20<HONEYPOT>3a383434330d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f363429204170706c655765624b69742f3533372e33360d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36","ja3":"2196848d251b217de8b2c037e356c11d","session":"92f12688-0f74-453d-b45e-fec7102c5049","seq":1,"duration_ms":100,"bytes_in":166,"bytes_out":79},{"timestamp":"2026-09-06T08:38:16","port":8443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8443\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/.git/config.bak","summary":"","payload_hex":"474554202f2e6769742f636f6e6669672e62616b20485454502f312e310d0a486f73743a20<HONEYPOT>3a383434330d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f363429204170706c655765624b69742f3533372e33360d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36","ja3":"2196848d251b217de8b2c037e356c11d","session":"c156d700-4846-4c98-8b69-7ab0819ad3e7","seq":1,"duration_ms":100,"bytes_in":166,"bytes_out":79},{"timestamp":"2026-09-06T08:38:15","port":8443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8443\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/.env","summary":"","payload_hex":"474554202f2e656e7620485454502f312e310d0a486f73743a20<HONEYPOT>3a383434330d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f363429204170706c655765624b69742f3533372e33360d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36","ja3":"2196848d251b217de8b2c037e356c11d","session":"f5f6263e-dd7e-4f41-a2ab-3b67ab621748","seq":1,"duration_ms":100,"bytes_in":155,"bytes_out":79}],"http_methods":[{"method":"GET","count":220}],"distinct_ports_total":4,"top_paths":[{"path":"/","count":60,"ports":3},{"path":"/.env.production","count":10,"ports":4},{"path":"/.env","count":9,"ports":3},{"path":"/.env.prod","count":9,"ports":2},{"path":"/.git/config","count":8,"ports":4},{"path":"/.env.development","count":8,"ports":1},{"path":"/.git-credentials","count":7,"ports":3},{"path":"/.aws/credentials","count":7,"ports":2},{"path":"/.env.old","count":7,"ports":3},{"path":"/.env.backup","count":7,"ports":3},{"path":"/.npmrc","count":6,"ports":2},{"path":"/credentials.json","count":6,"ports":3},{"path":"/actuator/env","count":6,"ports":4},{"path":"/secrets.yaml","count":5,"ports":2},{"path":"/.env.local","count":5,"ports":3}],"distinct_paths_total":40,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept-Encoding","Connection","Host","User-Agent"],"representative":[{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Connection","value":"close","notable":false},{"name":"Host","value":"<HONEYPOT>:8443","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36","notable":false}],"distinct_sets":1,"events_with_headers":10},"tags":[],"data_as_of":"2026-09-23T02:40:53.627205+00:00"}