{"ip":"34.116.85.1","total_events":2806,"verdict":{"verdict":"scanning","label":"Scanning for known vulnerabilities","detail":"6 exploit-path probe(s)","confidence":"medium","network_type":null,"why":["6 request(s) matched a known exploit path.","Only GET/HEAD seen, no request body: scanning for the vulnerability, not delivering a payload.","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"3,924,828 bytes sent","bytes_sent":3924828,"session_seconds":15,"persistent":false}},"first_seen":"2026-09-06T16:01:16","last_seen":"2026-09-06T16:01:31","events_24h":0,"events_7d":0,"geo":{"country_code":"AU","country_name":"Australia","region":"New South Wales","city":"Sydney","lat":-33.8672,"lon":151.1997,"asn":396982,"org":"Google LLC"},"source_domain":"1.85.116.34.bc.googleusercontent.com","known_scanners":[],"scanner_tag":{"key":"gcp","label":"Google Cloud","category":"hosting_provider","url":"https://cloud.google.com/"},"cve_matches":[],"malware":[],"top_ports":[{"port":2379,"proto":"tcp","label":"","count":2806}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i1010h1_61a7ad8aa9b6_792d2c6655cb","t13i1010h1_61a7ad8aa9b6_3a8073edd8ef"],"tls_client_hello":"","tls_ja3":["0062b19aebe31519bf036f586f687a3d","8dd69ae7620c4492e8a76877a95ce81a","e7aa71b9ed4a9693bd514809817eddea","0f826faed5197859d2eb3620729409cb","d0728ab447efbc9c3c10750499a1c104"]},"fingerprint_peers":{"t13i1010h1_61a7ad8aa9b6_792d2c6655cb":1126,"t13i1010h1_61a7ad8aa9b6_3a8073edd8ef":4581},"user_agents":["Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36"],"timeline":[{"date":"2026-09-06","count":2806}],"recent_events":[{"timestamp":"2026-09-06T16:01:31","port":2379,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:2379\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"/81.bz2","summary":"","payload_hex":"474554202f38312e627a3220485454502f312e310d0a6163636570743a202a2f2a0d0a757365722d6167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132342e30205361666172692f3533372e33360d0a686f73743a20<HONEYPOT>3a323337390d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36","ja3":"ffc08fe5c6993ca8bc4cdf60b9faa49f","session":"09dea655-a395-42ee-8459-12c9fce899a1","seq":17,"duration_ms":6864,"bytes_in":3080,"bytes_out":1292},{"timestamp":"2026-09-06T16:01:31","port":2379,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:2379\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"/backups/81.gz","summary":"","payload_hex":"474554202f6261636b7570732f38312e677a20485454502f312e310d0a6163636570743a202a2f2a0d0a757365722d6167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132342e30205361666172692f3533372e33360d0a686f73743a20<HONEYPOT>3a323337390d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36","ja3":"1a59d8637d22a6e89064fb0348ddf022","session":"e07aea6a-4825-4f90-8b80-4e2144ad3835","seq":11,"duration_ms":4324,"bytes_in":1996,"bytes_out":836},{"timestamp":"2026-09-06T16:01:31","port":2379,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:2379\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"/81.gz","summary":"","payload_hex":"474554202f38312e677a20485454502f312e310d0a6163636570743a202a2f2a0d0a757365722d6167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132342e30205361666172692f3533372e33360d0a686f73743a20<HONEYPOT>3a323337390d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36","ja3":"3b6e04be8ac2e3a9f33ab4d082c775a4","session":"7f29bc3f-41da-45b0-8cc7-a86cdd3c4488","seq":15,"duration_ms":6568,"bytes_in":2712,"bytes_out":1140},{"timestamp":"2026-09-06T16:01:31","port":2379,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:2379\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"/backup_81.gz","summary":"","payload_hex":"474554202f6261636b75705f38312e677a20485454502f312e310d0a6163636570743a202a2f2a0d0a757365722d6167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132342e30205361666172692f3533372e33360d0a686f73743a20<HONEYPOT>3a323337390d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36","ja3":"32aec7d50f0c0c797edfe60648280413","session":"94e89c0a-4589-4510-bf2b-dbff9f765c23","seq":11,"duration_ms":4320,"bytes_in":1999,"bytes_out":836},{"timestamp":"2026-09-06T16:01:31","port":2379,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:2379\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"/81_backup.gz","summary":"","payload_hex":"474554202f38315f6261636b75702e677a20485454502f312e310d0a6163636570743a202a2f2a0d0a757365722d6167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132342e30205361666172692f3533372e33360d0a686f73743a20<HONEYPOT>3a323337390d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36","ja3":"df864e86ea292f71200527e2b49c0b95","session":"82ebe2fd-99ae-4e66-a450-14c843c4d6ef","seq":17,"duration_ms":6871,"bytes_in":3075,"bytes_out":1292},{"timestamp":"2026-09-06T16:01:31","port":2379,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:2379\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"/81_backup.rar","summary":"","payload_hex":"474554202f38315f6261636b75702e72617220485454502f312e310d0a6163636570743a202a2f2a0d0a757365722d6167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132342e30205361666172692f3533372e33360d0a686f73743a20<HONEYPOT>3a323337390d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36","ja3":"f3711bd08e7e29dacba05cd3672aa68f","session":"ba85d6fe-fb00-454a-88d9-c713e6b9aebf","seq":16,"duration_ms":6478,"bytes_in":2905,"bytes_out":1216},{"timestamp":"2026-09-06T16:01:31","port":2379,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:2379\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"/81.rar","summary":"","payload_hex":"474554202f38312e72617220485454502f312e310d0a6163636570743a202a2f2a0d0a757365722d6167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132342e30205361666172692f3533372e33360d0a686f73743a20<HONEYPOT>3a323337390d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36","ja3":"ba9f58f790f1d92d1d4acf43c07f4d3b","session":"d537d0e9-61b4-4809-88a0-b4fb236c509b","seq":17,"duration_ms":6859,"bytes_in":3064,"bytes_out":1292},{"timestamp":"2026-09-06T16:01:31","port":2379,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:2379\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"/backups/81.rar","summary":"","payload_hex":"474554202f6261636b7570732f38312e72617220485454502f312e310d0a6163636570743a202a2f2a0d0a757365722d6167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132342e30205361666172692f3533372e33360d0a686f73743a20<HONEYPOT>3a323337390d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36","ja3":"4d5f16eeb6f2597e20512fdeb17104a4","session":"c5bb5c92-342e-43ad-a980-ec3bd0f12997","seq":15,"duration_ms":6046,"bytes_in":2721,"bytes_out":1140},{"timestamp":"2026-09-06T16:01:31","port":2379,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:2379\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"/backup_81.rar","summary":"","payload_hex":"474554202f6261636b75705f38312e72617220485454502f312e310d0a6163636570743a202a2f2a0d0a757365722d6167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132342e30205361666172692f3533372e33360d0a686f73743a20<HONEYPOT>3a323337390d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36","ja3":"f322d5b5a78ffceda5d69391a2676443","session":"054ef0a4-b84f-4b63-b029-5781bc323078","seq":11,"duration_ms":4323,"bytes_in":1997,"bytes_out":836},{"timestamp":"2026-09-06T16:01:31","port":2379,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:2379\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"/81_backup.7z","summary":"","payload_hex":"474554202f38315f6261636b75702e377a20485454502f312e310d0a6163636570743a202a2f2a0d0a757365722d6167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132342e30205361666172692f3533372e33360d0a686f73743a20<HONEYPOT>3a323337390d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36","ja3":"2535201ac0523d4437d50d5aea912b44","session":"b62eb7d9-7dc9-4c88-a86c-0b98ac1f0dad","seq":17,"duration_ms":6850,"bytes_in":3083,"bytes_out":1292}],"http_methods":[{"method":"GET","count":2806}],"distinct_ports_total":1,"top_paths":[{"path":"/snapshot.tar","count":1,"ports":1},{"path":"/deployment.zst","count":1,"ports":1},{"path":"/web.tar.gz","count":1,"ports":1},{"path":"/grav.bz2","count":1,"ports":1},{"path":"/keys.tgz","count":1,"ports":1},{"path":"/store.gz","count":1,"ports":1},{"path":"/codeigniter.gz","count":1,"ports":1},{"path":"/strapi.7z","count":1,"ports":1},{"path":"/directus.sql","count":1,"ports":1},{"path":"/sandbox.sql.gz","count":1,"ports":1},{"path":"/openapi.sql.gz","count":1,"ports":1},{"path":"/nuxtjs.zst","count":1,"ports":1},{"path":"/dist.zip","count":1,"ports":1},{"path":"/tokens.zst","count":1,"ports":1},{"path":"/archive.bz2","count":1,"ports":1}],"distinct_paths_total":200,"top_snis":[],"top_hosts":[],"top_alpns":[{"value":"http/1.1","count":2806}],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","Host","User-Agent"],"representative":[{"name":"Accept","value":"*/*","notable":false},{"name":"Host","value":"<HONEYPOT>:2379","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36","notable":false}],"distinct_sets":1,"events_with_headers":10},"tags":[],"data_as_of":"2026-09-22T16:45:52.756100+00:00"}