{"ip":"204.76.203.14","total_events":425,"verdict":{"verdict":"scanning","label":"Scanning for known vulnerabilities","detail":"15 exploit-path probe(s)","confidence":"medium","network_type":"network services","why":["15 request(s) matched a known exploit path.","Only GET/HEAD seen, no request body: scanning for the vulnerability, not delivering a payload.","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"148,311 bytes sent","bytes_sent":148311,"session_seconds":9,"persistent":false}},"first_seen":"2026-08-10T20:52:33","last_seen":"2026-08-26T02:05:30","events_24h":0,"events_7d":424,"geo":{"country_code":"NL","country_name":"The Netherlands","region":"Limburg","city":"Eygelshoven","lat":50.8897,"lon":6.0563,"asn":51396,"org":"Pfcloud UG (haftungsbeschrankt)"},"source_domain":"204.76.203.14.ptr.pfcloud.network","known_scanners":[],"scanner_tag":null,"cve_matches":[],"malware":[],"top_ports":[{"port":443,"proto":"tcp","label":"HTTPS","count":80},{"port":4443,"proto":"tcp","label":"","count":77},{"port":80,"proto":"tcp","label":"HTTP","count":39},{"port":8000,"proto":"tcp","label":"HTTP-alt","count":38},{"port":3000,"proto":"tcp","label":"Web-alt","count":38},{"port":5173,"proto":"tcp","label":"","count":38},{"port":5175,"proto":"tcp","label":"","count":38},{"port":5174,"proto":"tcp","label":"","count":38},{"port":8080,"proto":"tcp","label":"HTTP-alt","count":38},{"port":8443,"proto":"tcp","label":"HTTPS-alt","count":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13d1315h1_f57a46bbacb6_3b244d8fbcc8","t13i1314h1_f57a46bbacb6_3b244d8fbcc8","t13i1313h1_f57a46bbacb6_fb48f8b98a29"],"tls_ja3":["e56c72ec790d5898f89528f5c080ca3b","bbfe3507a810aa6c11c659bd4c7b4cbd","95d89cdb32022f73a6a999104183c564"],"ja4h":["ge11nn0500_d3a2dcb1cd63"]},"fingerprint_peers":{"t13d1315h1_f57a46bbacb6_3b244d8fbcc8":1,"t13i1314h1_f57a46bbacb6_3b244d8fbcc8":3,"t13i1313h1_f57a46bbacb6_fb48f8b98a29":3,"ge11nn0500_d3a2dcb1cd63":1244},"user_agents":["Mozilla/5.0 (compatible; research-scan/1.0)"],"timeline":[{"date":"2026-08-10","count":1},{"date":"2026-08-26","count":424}],"recent_events":[{"timestamp":"2026-08-26T02:05:30","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"localhost","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"connection\":\"keep-alive\",\"host\":\"localhost\",\"user-agent\":\"Mozilla/5.0 (compatible; research-scan/1.0)\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"/app.js","summary":"","payload_hex":"474554202f6170702e6a7320485454502f312e310d0a486f73743a206c6f63616c686f73740d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b2072657365617263682d7363616e2f312e30290d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; research-scan/1.0)","ja3":"bbfe3507a810aa6c11c659bd4c7b4cbd","session":"d39b86d9-c0fa-4874-b182-ba95cad392b9","seq":4,"duration_ms":6544,"bytes_in":660,"bytes_out":312},{"timestamp":"2026-08-26T02:05:29","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"localhost","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"connection\":\"keep-alive\",\"host\":\"localhost\",\"user-agent\":\"Mozilla/5.0 (compatible; research-scan/1.0)\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"/.git-credentials","summary":"","payload_hex":"474554202f2e6769742d63726564656e7469616c7320485454502f312e310d0a486f73743a206c6f63616c686f73740d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b2072657365617263682d7363616e2f312e30290d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; research-scan/1.0)","ja3":"bbfe3507a810aa6c11c659bd4c7b4cbd","session":"287fcf98-4afc-441d-ad55-2138c2e7b252","seq":3,"duration_ms":6307,"bytes_in":497,"bytes_out":234},{"timestamp":"2026-08-26T02:05:29","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"localhost","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"connection\":\"keep-alive\",\"host\":\"localhost\",\"user-agent\":\"Mozilla/5.0 (compatible; research-scan/1.0)\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"/server.js","summary":"","payload_hex":"474554202f7365727665722e6a7320485454502f312e310d0a486f73743a206c6f63616c686f73740d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b2072657365617263682d7363616e2f312e30290d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; research-scan/1.0)","ja3":"bbfe3507a810aa6c11c659bd4c7b4cbd","session":"fcc0bd8b-74fc-4d6d-95ba-2a38ea317bf2","seq":4,"duration_ms":5820,"bytes_in":645,"bytes_out":312},{"timestamp":"2026-08-26T02:05:29","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"localhost","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"connection\":\"keep-alive\",\"host\":\"localhost\",\"user-agent\":\"Mozilla/5.0 (compatible; research-scan/1.0)\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"/.aws/credentials","summary":"","payload_hex":"474554202f2e6177732f63726564656e7469616c7320485454502f312e310d0a486f73743a206c6f63616c686f73740d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b2072657365617263682d7363616e2f312e30290d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; research-scan/1.0)","ja3":"bbfe3507a810aa6c11c659bd4c7b4cbd","session":"e364fd80-befe-4b8a-b87c-bd40f639cf42","seq":4,"duration_ms":6012,"bytes_in":679,"bytes_out":312},{"timestamp":"2026-08-26T02:05:29","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"localhost","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"connection\":\"keep-alive\",\"host\":\"localhost\",\"user-agent\":\"Mozilla/5.0 (compatible; research-scan/1.0)\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"/docker-compose.yaml","summary":"","payload_hex":"474554202f646f636b65722d636f6d706f73652e79616d6c20485454502f312e310d0a486f73743a206c6f63616c686f73740d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b2072657365617263682d7363616e2f312e30290d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; research-scan/1.0)","ja3":"bbfe3507a810aa6c11c659bd4c7b4cbd","session":"e5600c57-5dcc-46c4-84a5-af3b4005b0c0","seq":3,"duration_ms":4673,"bytes_in":496,"bytes_out":234},{"timestamp":"2026-08-26T02:05:29","port":4443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"localhost","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"connection\":\"keep-alive\",\"host\":\"localhost\",\"user-agent\":\"Mozilla/5.0 (compatible; research-scan/1.0)\"}","body":"","sni":"localhost","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"/docker-compose.yaml","summary":"","payload_hex":"474554202f646f636b65722d636f6d706f73652e79616d6c20485454502f312e310d0a486f73743a206c6f63616c686f73740d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b2072657365617263682d7363616e2f312e30290d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; research-scan/1.0)","ja3":"95d89cdb32022f73a6a999104183c564","session":"4681bfc0-f536-4792-b992-a23913b3fe3f","seq":1,"duration_ms":853,"bytes_in":171,"bytes_out":78},{"timestamp":"2026-08-26T02:05:29","port":4443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"localhost","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"connection\":\"keep-alive\",\"host\":\"localhost\",\"user-agent\":\"Mozilla/5.0 (compatible; research-scan/1.0)\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"/terraform.tfvars","summary":"","payload_hex":"474554202f7465727261666f726d2e74667661727320485454502f312e310d0a486f73743a206c6f63616c686f73740d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b2072657365617263682d7363616e2f312e30290d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; research-scan/1.0)","ja3":"bbfe3507a810aa6c11c659bd4c7b4cbd","session":"11e76653-52d9-46ae-95b3-2dd28c68b4a9","seq":5,"duration_ms":8822,"bytes_in":849,"bytes_out":390},{"timestamp":"2026-08-26T02:05:29","port":4443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"localhost","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"connection\":\"keep-alive\",\"host\":\"localhost\",\"user-agent\":\"Mozilla/5.0 (compatible; research-scan/1.0)\"}","body":"","sni":"localhost","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"/.aws/credentials","summary":"","payload_hex":"474554202f2e6177732f63726564656e7469616c7320485454502f312e310d0a486f73743a206c6f63616c686f73740d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b2072657365617263682d7363616e2f312e30290d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; research-scan/1.0)","ja3":"95d89cdb32022f73a6a999104183c564","session":"26fe6b1e-2857-40ac-b47a-887d3a2815e4","seq":1,"duration_ms":717,"bytes_in":168,"bytes_out":78},{"timestamp":"2026-08-26T02:05:29","port":4443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"localhost","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"connection\":\"keep-alive\",\"host\":\"localhost\",\"user-agent\":\"Mozilla/5.0 (compatible; research-scan/1.0)\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"/credentials.json","summary":"","payload_hex":"474554202f63726564656e7469616c732e6a736f6e20485454502f312e310d0a486f73743a206c6f63616c686f73740d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b2072657365617263682d7363616e2f312e30290d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; research-scan/1.0)","ja3":"bbfe3507a810aa6c11c659bd4c7b4cbd","session":"e601a942-4445-45ce-9abb-d42a0549f4ad","seq":3,"duration_ms":6225,"bytes_in":498,"bytes_out":234},{"timestamp":"2026-08-26T02:05:29","port":4443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"localhost","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"connection\":\"keep-alive\",\"host\":\"localhost\",\"user-agent\":\"Mozilla/5.0 (compatible; research-scan/1.0)\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"/secrets.json","summary":"","payload_hex":"474554202f736563726574732e6a736f6e20485454502f312e310d0a486f73743a206c6f63616c686f73740d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b2072657365617263682d7363616e2f312e30290d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; research-scan/1.0)","ja3":"bbfe3507a810aa6c11c659bd4c7b4cbd","session":"15f981e8-c337-46ae-b9ec-44a3a20fa05c","seq":5,"duration_ms":8814,"bytes_in":828,"bytes_out":390}],"http_methods":[{"method":"GET","count":425}],"distinct_ports_total":10,"top_paths":[{"path":"/","count":13,"ports":10},{"path":"/backup.tar.gz","count":12,"ports":9},{"path":"/site.zip","count":12,"ports":9},{"path":"/.env.bak","count":12,"ports":9},{"path":"/.env.gz","count":12,"ports":9},{"path":"/www.zip","count":12,"ports":9},{"path":"/backup.zip","count":12,"ports":9},{"path":"/actuator/env","count":11,"ports":9},{"path":"/wp-config.php.bak","count":11,"ports":9},{"path":"/secrets.json","count":11,"ports":9},{"path":"/config.yaml","count":11,"ports":9},{"path":"/@vite/client","count":11,"ports":9},{"path":"/config.json","count":11,"ports":9},{"path":"/phpinfo.php","count":11,"ports":9},{"path":"/config.js","count":11,"ports":9}],"distinct_paths_total":38,"top_snis":[{"value":"localhost","count":4}],"top_hosts":[{"value":"localhost","count":76}],"top_alpns":[{"value":"http/1.1","count":158}],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","Accept-Encoding","Connection","Host","User-Agent"],"representative":[{"name":"Accept","value":"*/*","notable":false},{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Connection","value":"keep-alive","notable":false},{"name":"Host","value":"localhost","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (compatible; research-scan/1.0)","notable":false}],"distinct_sets":1,"events_with_headers":10},"tags":[],"data_as_of":"2026-08-27T18:20:08.287319+00:00"}