{"ip":"23.132.164.94","total_events":82,"verdict":{"verdict":"scanning","label":"Scanning for known vulnerabilities","detail":"18 exploit-path probe(s)","confidence":"medium","network_type":null,"why":["18 request(s) matched a known exploit path.","Only GET/HEAD seen, no request body: scanning for the vulnerability, not delivering a payload.","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"32,528 bytes sent","bytes_sent":32528,"session_seconds":1,"persistent":false}},"first_seen":"2026-09-30T11:27:57","last_seen":"2026-09-30T11:27:59","events_24h":82,"events_7d":82,"geo":{"country_code":"US","country_name":"United States","region":"","city":"","lat":37.751,"lon":-97.822,"asn":401626,"org":"Netiface America, Inc."},"source_domain":null,"known_scanners":[],"scanner_tag":null,"cve_matches":[],"malware":[],"top_ports":[{"port":80,"proto":"tcp","label":"HTTP","count":82}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":["b11cun020_00040002_d6a4d258"]},"fingerprint_peers":{"b11cun020_00040002_d6a4d258":1},"akin_families":{},"user_agents":[],"timeline":[{"date":"2026-09-30","count":82}],"recent_events":[{"timestamp":"2026-09-30T11:27:59","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip, deflate, br\",\"host\":\"<HONEYPOT>\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/error_log","summary":"","payload_hex":"474554202f6572726f725f6c6f6720485454502f312e310d0a486f73743a20<HONEYPOT>0d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174652c2062720d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"c520713f-b708-45d4-90b3-b606029b4427","seq":7,"duration_ms":723,"bytes_in":612,"bytes_out":546},{"timestamp":"2026-09-30T11:27:59","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip, deflate, br\",\"host\":\"<HONEYPOT>\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/.git/logs/HEAD","summary":"","payload_hex":"474554202f2e6769742f6c6f67732f4845414420485454502f312e310d0a486f73743a20<HONEYPOT>0d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174652c2062720d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"f2fed95e-5690-4479-8ea5-a3646a74b51f","seq":8,"duration_ms":833,"bytes_in":699,"bytes_out":624},{"timestamp":"2026-09-30T11:27:59","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip, deflate, br\",\"host\":\"<HONEYPOT>\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/settings.php","summary":"","payload_hex":"474554202f73657474696e67732e70687020485454502f312e310d0a486f73743a20<HONEYPOT>0d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174652c2062720d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"565b72d9-e36c-41d6-9784-aff2618aa552","seq":7,"duration_ms":724,"bytes_in":632,"bytes_out":546},{"timestamp":"2026-09-30T11:27:59","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip, deflate, br\",\"host\":\"<HONEYPOT>\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/deploy.sh","summary":"","payload_hex":"474554202f6465706c6f792e736820485454502f312e310d0a486f73743a20<HONEYPOT>0d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174652c2062720d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"8ea6e95d-a7cb-4a01-b3a1-2008381ffe16","seq":7,"duration_ms":729,"bytes_in":620,"bytes_out":546},{"timestamp":"2026-09-30T11:27:59","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip, deflate, br\",\"host\":\"<HONEYPOT>\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/deploy.yml","summary":"","payload_hex":"474554202f6465706c6f792e796d6c20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174652c2062720d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"ac0a76b3-452d-4cf5-beff-70552a52ce6b","seq":9,"duration_ms":1338,"bytes_in":798,"bytes_out":702},{"timestamp":"2026-09-30T11:27:59","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip, deflate, br\",\"host\":\"<HONEYPOT>\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/serverless.yml","summary":"","payload_hex":"474554202f7365727665726c6573732e796d6c20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174652c2062720d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"0b6ef2dc-bfcc-493b-b0f5-8430e368f612","seq":8,"duration_ms":828,"bytes_in":726,"bytes_out":624},{"timestamp":"2026-09-30T11:27:59","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip, deflate, br\",\"host\":\"<HONEYPOT>\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/access.log","summary":"","payload_hex":"474554202f6163636573732e6c6f6720485454502f312e310d0a486f73743a20<HONEYPOT>0d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174652c2062720d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"f2fed95e-5690-4479-8ea5-a3646a74b51f","seq":7,"duration_ms":728,"bytes_in":610,"bytes_out":546},{"timestamp":"2026-09-30T11:27:59","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip, deflate, br\",\"host\":\"<HONEYPOT>\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/.git/config","summary":"","payload_hex":"474554202f2e6769742f636f6e66696720485454502f312e310d0a486f73743a20<HONEYPOT>0d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174652c2062720d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"c520713f-b708-45d4-90b3-b606029b4427","seq":8,"duration_ms":825,"bytes_in":698,"bytes_out":624},{"timestamp":"2026-09-30T11:27:59","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip, deflate, br\",\"host\":\"<HONEYPOT>\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/.git/COMMIT_EDITMSG","summary":"","payload_hex":"474554202f2e6769742f434f4d4d49545f454449544d534720485454502f312e310d0a486f73743a20<HONEYPOT>0d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174652c2062720d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"db6fbb88-b4fc-4205-95bc-0d9df9e5ac96","seq":8,"duration_ms":830,"bytes_in":704,"bytes_out":624},{"timestamp":"2026-09-30T11:27:59","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip, deflate, br\",\"host\":\"<HONEYPOT>\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/.idea/workspace.xml","summary":"","payload_hex":"474554202f2e696465612f776f726b73706163652e786d6c20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174652c2062720d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"565b72d9-e36c-41d6-9784-aff2618aa552","seq":8,"duration_ms":828,"bytes_in":726,"bytes_out":624}],"http_methods":[{"method":"GET","count":82}],"distinct_ports_total":1,"top_paths":[{"path":"/","count":2,"ports":1},{"path":"/app.log","count":1,"ports":1},{"path":"/docker-compose.yml","count":1,"ports":1},{"path":"/db.php","count":1,"ports":1},{"path":"/debug.log","count":1,"ports":1},{"path":"/database.json","count":1,"ports":1},{"path":"/settings.php","count":1,"ports":1},{"path":"/.git/logs/HEAD","count":1,"ports":1},{"path":"/config.js","count":1,"ports":1},{"path":"/.travis.yml","count":1,"ports":1},{"path":"/.env.staging","count":1,"ports":1},{"path":"/secrets.json","count":1,"ports":1},{"path":"/keyfile.json","count":1,"ports":1},{"path":"/laravel.log","count":1,"ports":1},{"path":"/wp-config.bak","count":1,"ports":1}],"distinct_paths_total":81,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept-Encoding","Host"],"representative":[{"name":"Accept-Encoding","value":"gzip, deflate, br","notable":false},{"name":"Host","value":"<HONEYPOT>","notable":false}],"distinct_sets":1,"events_with_headers":10},"tags":[],"data_as_of":"2026-09-30T17:48:18.276804+00:00"}