{"ip":"213.209.159.148","total_events":2360,"verdict":{"verdict":"scanning","label":"Scanning for known vulnerabilities","detail":"72 exploit-path probe(s)","confidence":"medium","network_type":null,"why":["72 request(s) matched a known exploit path.","Only GET/HEAD seen, no request body: scanning for the vulnerability, not delivering a payload.","Not in any known-scanner range.","Held a session open for 63s, against a median of well under a second."],"engagement":{"level":"payload","label":"Sustained payload, held open","detail":"4,175,382 bytes sent, longest session 63s","bytes_sent":4175382,"session_seconds":63,"persistent":true}},"first_seen":"2026-08-15T15:34:51","last_seen":"2026-08-15T18:09:40","events_24h":2360,"events_7d":2360,"geo":{"country_code":"TW","country_name":"Taiwan","region":"","city":"","lat":24.0,"lon":121.0,"asn":208137,"org":"Feo Prest SRL"},"source_domain":null,"known_scanners":[],"scanner_tag":null,"cve_matches":[],"malware":[],"top_ports":[{"port":5000,"proto":"tcp","label":"Web-alt","count":2360}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i141000_cbb2034c60b8_e5728521abd4"],"tls_ja3":["2079bcc000c9a54e0784733c0142d140"],"ja4h":["ge11nn0400_88d30a62b7ad","ge11nn0700_ed6ea7c6caee","ge11nn0500_cac2c496544b"]},"fingerprint_peers":{"t13i141000_cbb2034c60b8_e5728521abd4":13,"ge11nn0700_ed6ea7c6caee":1,"ge11nn0500_cac2c496544b":100,"ge11nn0400_88d30a62b7ad":4812},"user_agents":["Mozilla/5.0 (Macintosh; Intel Mac OS X 14_4_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36","Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:126.0) Gecko/20100101 Firefox/126.0","Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0","Mozilla/5.0 (Macintosh; Intel Mac OS X 14_5) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.5 Safari/605.1.15","Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36","Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Edg/124.0.0.0","Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36","Mozilla/5.0 (X11; Linux x86_64; rv:126.0) Gecko/20100101 Firefox/126.0"],"timeline":[{"date":"2026-08-15","count":2360}],"recent_events":[{"timestamp":"2026-08-15T18:09:40","port":5000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"identity\",\"connection\":\"close\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:126.0) Gecko/20100101 Firefox/126.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":";@169.254.169.254/latest/meta-data/instance-id","summary":"","payload_hex":"474554203b403136392e3235342e3136392e3235342f6c61746573742f6d6574612d646174612f696e7374616e63652d696420485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b207836343b2072763a3132362e3029204765636b6f2f32303130303130312046697265666f782f3132362e300d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a206964656e746974790d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:126.0) Gecko/20100101 Firefox/126.0","ja3":"","session":"b7ca3f27-8664-4c6d-8147-bed57ce32298","seq":1,"duration_ms":100,"bytes_in":237,"bytes_out":80},{"timestamp":"2026-08-15T18:09:38","port":5000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"identity\",\"connection\":\"close\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"@169.254.169.254/latest/meta-data/instance-id","summary":"","payload_hex":"47455420403136392e3235342e3136392e3235342f6c61746573742f6d6574612d646174612f696e7374616e63652d696420485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132352e302e302e30205361666172692f3533372e33360d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a206964656e746974790d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36","ja3":"","session":"9ef19bdb-0b11-4392-b0c1-e4b4a75108f6","seq":1,"duration_ms":100,"bytes_in":267,"bytes_out":80},{"timestamp":"2026-08-15T18:09:33","port":5000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"127.0.0.1","headers":"{\"\\u001Dhost\":\"<HONEYPOT>\",\"accept\":\"*/*\",\"accept-encoding\":\"identity\",\"connection\":\"close\",\"host\":\"127.0.0.1\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/credentials","summary":"","payload_hex":"474554202f63726564656e7469616c7320485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132352e302e302e30205361666172692f3533372e33360d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a206964656e746974790d0a436f6e6e656374696f6e3a20636c6f73650d0a486f73743a203132372e302e302e310d0a1d486f73743a20<HONEYPOT>0d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36","ja3":"","session":"0ea82367-aed1-4ec9-a880-8935cd93c812","seq":1,"duration_ms":100,"bytes_in":273,"bytes_out":80},{"timestamp":"2026-08-15T18:09:32","port":5000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"127.0.0.1","headers":"{\"\\u001Dhost\":\"<HONEYPOT>\",\"accept\":\"*/*\",\"accept-encoding\":\"identity\",\"connection\":\"close\",\"host\":\"127.0.0.1\",\"user-agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 14_5) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.5 Safari/605.1.15\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/configuration.php","summary":"","payload_hex":"474554202f636f6e66696775726174696f6e2e70687020485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e3020284d6163696e746f73683b20496e74656c204d6163204f5320582031345f3529204170706c655765624b69742f3630352e312e313520284b48544d4c2c206c696b65204765636b6f292056657273696f6e2f31372e35205361666172692f3630352e312e31350d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a206964656e746974790d0a436f6e6e656374696f6e3a20636c6f73650d0a486f73743a203132372e302e302e310d0a1d486f73743a20<HONEYPOT>0d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 14_5) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.5 Safari/605.1.15","ja3":"","session":"935a71d7-683a-455f-8323-503a1b243c58","seq":1,"duration_ms":100,"bytes_in":282,"bytes_out":80},{"timestamp":"2026-08-15T18:09:32","port":5000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"127.0.0.1","headers":"{\"\\u001Dhost\":\"<HONEYPOT>\",\"accept\":\"*/*\",\"accept-encoding\":\"identity\",\"connection\":\"close\",\"host\":\"127.0.0.1\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:126.0) Gecko/20100101 Firefox/126.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/config.php","summary":"","payload_hex":"474554202f636f6e6669672e70687020485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b207836343b2072763a3132362e3029204765636b6f2f32303130303130312046697265666f782f3132362e300d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a206964656e746974790d0a436f6e6e656374696f6e3a20636c6f73650d0a486f73743a203132372e302e302e310d0a1d486f73743a20<HONEYPOT>0d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:126.0) Gecko/20100101 Firefox/126.0","ja3":"","session":"b714ad4d-45c2-40b8-87a9-9fc39d270a38","seq":1,"duration_ms":100,"bytes_in":241,"bytes_out":80},{"timestamp":"2026-08-15T18:09:32","port":5000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"127.0.0.1","headers":"{\"\\u001Dhost\":\"<HONEYPOT>\",\"accept\":\"*/*\",\"accept-encoding\":\"identity\",\"connection\":\"close\",\"host\":\"127.0.0.1\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64; rv:126.0) Gecko/20100101 Firefox/126.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/config.properties","summary":"","payload_hex":"474554202f636f6e6669672e70726f7065727469657320485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f36343b2072763a3132362e3029204765636b6f2f32303130303130312046697265666f782f3132362e300d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a206964656e746974790d0a436f6e6e656374696f6e3a20636c6f73650d0a486f73743a203132372e302e302e310d0a1d486f73743a20<HONEYPOT>0d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64; rv:126.0) Gecko/20100101 Firefox/126.0","ja3":"","session":"d8dcb982-d5f9-474f-8f1c-91107a56b594","seq":1,"duration_ms":100,"bytes_in":238,"bytes_out":80},{"timestamp":"2026-08-15T18:09:32","port":5000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"127.0.0.1","headers":"{\"\\u001Dhost\":\"<HONEYPOT>\",\"accept\":\"*/*\",\"accept-encoding\":\"identity\",\"connection\":\"close\",\"host\":\"127.0.0.1\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/config.ini","summary":"","payload_hex":"474554202f636f6e6669672e696e6920485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132352e302e302e30205361666172692f3533372e33360d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a206964656e746974790d0a436f6e6e656374696f6e3a20636c6f73650d0a486f73743a203132372e302e302e310d0a1d486f73743a20<HONEYPOT>0d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36","ja3":"","session":"0e2f2e3d-6831-4688-b377-b7560a3dcb6a","seq":1,"duration_ms":100,"bytes_in":272,"bytes_out":80},{"timestamp":"2026-08-15T18:09:32","port":5000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"127.0.0.1","headers":"{\"\\u001Dhost\":\"<HONEYPOT>\",\"accept\":\"*/*\",\"accept-encoding\":\"identity\",\"connection\":\"close\",\"host\":\"127.0.0.1\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/config.cfg","summary":"","payload_hex":"474554202f636f6e6669672e63666720485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132352e302e302e30205361666172692f3533372e33360d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a206964656e746974790d0a436f6e6e656374696f6e3a20636c6f73650d0a486f73743a203132372e302e302e310d0a1d486f73743a20<HONEYPOT>0d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36","ja3":"","session":"a19f0196-de97-4d2e-ae33-6c72d6a562d0","seq":1,"duration_ms":101,"bytes_in":262,"bytes_out":80},{"timestamp":"2026-08-15T18:09:32","port":5000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"127.0.0.1","headers":"{\"\\u001Dhost\":\"<HONEYPOT>\",\"accept\":\"*/*\",\"accept-encoding\":\"identity\",\"connection\":\"close\",\"host\":\"127.0.0.1\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/bootstrap.yml","summary":"","payload_hex":"474554202f626f6f7473747261702e796d6c20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132352e302e302e30205361666172692f3533372e33360d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a206964656e746974790d0a436f6e6e656374696f6e3a20636c6f73650d0a486f73743a203132372e302e302e310d0a1d486f73743a20<HONEYPOT>0d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36","ja3":"","session":"4f60b412-21c3-4c2d-ae82-68cf444e72b3","seq":1,"duration_ms":100,"bytes_in":275,"bytes_out":80},{"timestamp":"2026-08-15T18:09:31","port":5000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"127.0.0.1","headers":"{\"\\u001Dhost\":\"<HONEYPOT>\",\"accept\":\"*/*\",\"accept-encoding\":\"identity\",\"connection\":\"close\",\"host\":\"127.0.0.1\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/bootstrap.properties","summary":"","payload_hex":"474554202f626f6f7473747261702e70726f7065727469657320485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132352e302e302e30205361666172692f3533372e33360d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a206964656e746974790d0a436f6e6e656374696f6e3a20636c6f73650d0a486f73743a203132372e302e302e310d0a1d486f73743a20<HONEYPOT>0d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36","ja3":"","session":"843fbec6-9fb0-43f2-baf3-fe850336daa4","seq":1,"duration_ms":100,"bytes_in":282,"bytes_out":80}],"http_methods":[{"method":"GET","count":2360}],"distinct_ports_total":1,"top_paths":[{"path":"/.dockercfg","count":12,"ports":1},{"path":"/.env.local","count":12,"ports":1},{"path":"/.docker/config.json","count":12,"ports":1},{"path":"/.env.example","count":12,"ports":1},{"path":"/.env.development","count":12,"ports":1},{"path":"/.env","count":12,"ports":1},{"path":"/.env.encrypted","count":12,"ports":1},{"path":"/.env.docker","count":12,"ports":1},{"path":"/.aws/config","count":12,"ports":1},{"path":"/.aws/credentials","count":12,"ports":1},{"path":"/.azure/credentials","count":12,"ports":1},{"path":"/.env.ci","count":12,"ports":1},{"path":"/.env.test","count":8,"ports":1},{"path":"/.env.production","count":8,"ports":1},{"path":"/.env.template","count":8,"ports":1}],"distinct_paths_total":200,"top_snis":[],"top_hosts":[{"value":"127.0.0.1","count":192}],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["\u001dhost","Accept","Accept-Encoding","Connection","Host","User-Agent"],"representative":[{"name":"\u001dhost","value":"<HONEYPOT>","notable":false},{"name":"Accept","value":"*/*","notable":false},{"name":"Accept-Encoding","value":"identity","notable":false},{"name":"Connection","value":"close","notable":false},{"name":"Host","value":"127.0.0.1","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36","notable":false}],"distinct_sets":2,"events_with_headers":10},"tags":[],"data_as_of":"2026-08-15T20:40:39.649384+00:00"}