{"ip":"34.175.154.165","data_as_of":"2026-10-24T20:08:23+00:00","observed":true,"total_events":563,"verdict":{"verdict":"scanning","label":"Scanning for known vulnerabilities","detail":"33 exploit-path probe(s)","confidence":"medium","network_type":null,"why":["33 request(s) matched a known exploit path.","Only GET and HEAD requests were seen, with no body, which reads as a check for the vulnerability without a payload.","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"142,986 bytes sent","bytes_sent":142986,"session_seconds":1,"persistent":false},"basis":"first_contact"},"first_seen":"2026-06-30T07:10:01","last_seen":"2026-06-30T07:10:04","events_24h":0,"events_7d":0,"interactive_sessions":0,"interactive_sessions_24h":0,"interactive_sessions_7d":0,"interactive_protocols":[],"geo":{"country_code":"ES","country_name":"Spain","region":"Madrid","city":"Madrid","lat":40.4153,"lon":-3.694,"asn":396982,"org":"Google LLC"},"source_domain":"165.154.175.34.bc.googleusercontent.com","known_scanners":[],"scanner_tag":{"key":"gcp","label":"Google Cloud","category":"hosting_provider","url":"https://cloud.google.com/"},"cve_matches":[],"malware":[],"udp":null,"interaction":null,"top_ports":[{"port":55000,"proto":"tcp","label":"","count":563}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i190800_9dc949149365_97f8aa674fd9"],"tls_client_hello":"","tls_ja3":["19e29534fd49dd27d09234e639c4057e"],"http_akin":["b11cun050_00060013_3ef9a8f6"],"interactive":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[]}},"fingerprint_peers":{"t13i190800_9dc949149365_97f8aa674fd9":3252,"b11cun050_00060013_3ef9a8f6":158},"akin_families":{},"user_agents":["Mozilla/5.0 (hp-tablet; Linux; hpwOS/3.0.2; U; de-DE) AppleWebKit/534.6 (KHTML, like Gecko) wOSBrowser/234.40.1 Safari/534.6 TouchPad/1.0","Mozilla/5.0 (Linux; Android 9; STF-L09) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/76.0.3809.111 Mobile Safari/537.36","Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.142 Safari/537.36","Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.172 Safari/537.36 Vivaldi/2.5.1525.48","Mozilla/5.0 (Linux; Android 9; MI 8 Lite Build/PKQ1.181007.001; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/66.0.3359.126 MQQBrowser/6.2 TBS/044807 Mobile Safari/537.36 MMWEBID/1409 MicroMessenger/7.0.6.1460(0x27000634) Process/tools NetType/4G Language/zh_CN","Mozilla/5.0 (Linux; Android 7.0; KIICAA POWER) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.101 Mobile Safari/537.36","Mozilla/5.0 (Windows NT 6.2) AppleWebKit/536.6 (KHTML, like Gecko) Chrome/20.0.1090.0 Safari/536.6","Mozilla/5.0 (Linux; Android 9; SM-G950F) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.143 Mobile Safari/537.36"],"timeline":[],"recent_events":[{"timestamp":"2026-06-30T07:10:04","port":55000,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-charset\":\"utf-8\",\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:55000\",\"user-agent\":\"Mozilla/5.0 (Linux; Android 5.1.1; SM-E700H) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.157 Mobile Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/.mailrc","summary":"","payload_hex":"474554202f2e6d61696c726320485454502f312e310d0a486f73743a20<HONEYPOT>3a35353030300d0a557365722d4167656e743a204d6f7a696c6c612f352e3020284c696e75783b20416e64726f696420352e312e313b20534d2d453730304829204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f37342e302e333732392e313537204d6f62696c65205361666172692f3533372e33360d0a4163636570742d436861727365743a207574662d380d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Linux; Android 5.1.1; SM-E700H) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.157 Mobile Safari/537.36","ja3":"19e29534fd49dd27d09234e639c4057e","session":"9c2968a1-82c6-45d5-ad76-c451f682e4db","seq":1,"duration_ms":100,"bytes_in":255,"bytes_out":79},{"timestamp":"2026-06-30T07:10:04","port":55000,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-charset\":\"utf-8\",\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:55000\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.93 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/config/postmark.php","summary":"","payload_hex":"474554202f636f6e6669672f706f73746d61726b2e70687020485454502f312e310d0a486f73743a20<HONEYPOT>3a35353030300d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f34332e302e323335372e3933205361666172692f3533372e33360d0a4163636570742d436861727365743a207574662d380d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.93 Safari/537.36","ja3":"19e29534fd49dd27d09234e639c4057e","session":"4e1c1887-192f-4174-a83f-7407b0ae3e85","seq":1,"duration_ms":110,"bytes_in":246,"bytes_out":79},{"timestamp":"2026-06-30T07:10:04","port":55000,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-charset\":\"utf-8\",\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:55000\",\"user-agent\":\"Mozilla/5.0 (Linux; Android 8.0.0; SM-T820) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/76.0.3809.89 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/database.yml.bak","summary":"","payload_hex":"474554202f64617461626173652e796d6c2e62616b20485454502f312e310d0a486f73743a20<HONEYPOT>3a35353030300d0a557365722d4167656e743a204d6f7a696c6c612f352e3020284c696e75783b20416e64726f696420382e302e303b20534d2d5438323029204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f37362e302e333830392e3839205361666172692f3533372e33360d0a4163636570742d436861727365743a207574662d380d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Linux; Android 8.0.0; SM-T820) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/76.0.3809.89 Safari/537.36","ja3":"19e29534fd49dd27d09234e639c4057e","session":"0ebdf746-bf9c-4d4f-abd6-eea594873597","seq":1,"duration_ms":102,"bytes_in":255,"bytes_out":79},{"timestamp":"2026-06-30T07:10:04","port":55000,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-charset\":\"utf-8\",\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:55000\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.25 Safari/537.36 Core/1.70.3722.400 QQBrowser/10.5.3763.400\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/internal/phpinfo.php","summary":"","payload_hex":"474554202f696e7465726e616c2f706870696e666f2e70687020485454502f312e310d0a486f73743a20<HONEYPOT>3a35353030300d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b20574f57363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f37302e302e333533382e3235205361666172692f3533372e333620436f72652f312e37302e333732322e34303020515142726f777365722f31302e352e333736332e3430300d0a4163636570742d436861727365743a207574662d380d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.25 Safari/537.36 Core/1.70.3722.400 QQBrowser/10.5.3763.400","ja3":"19e29534fd49dd27d09234e639c4057e","session":"11e8f799-3546-4ddb-82c6-ca38529650c7","seq":1,"duration_ms":101,"bytes_in":295,"bytes_out":79},{"timestamp":"2026-06-30T07:10:04","port":55000,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-charset\":\"utf-8\",\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:55000\",\"user-agent\":\"W3C_Validator/1.305.2.12 libwww-perl/5.64\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/src/sendgrid.py","summary":"","payload_hex":"474554202f7372632f73656e64677269642e707920485454502f312e310d0a486f73743a20<HONEYPOT>3a35353030300d0a557365722d4167656e743a205733435f56616c696461746f722f312e3330352e322e3132206c69627777772d7065726c2f352e36340d0a4163636570742d436861727365743a207574662d380d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"W3C_Validator/1.305.2.12 libwww-perl/5.64","ja3":"19e29534fd49dd27d09234e639c4057e","session":"0bc64744-57a4-4498-b6ed-25b61aeeeca8","seq":1,"duration_ms":142,"bytes_in":179,"bytes_out":79},{"timestamp":"2026-06-30T07:10:04","port":55000,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-charset\":\"utf-8\",\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:55000\",\"user-agent\":\"Mozilla/5.0 (Linux; Android 9; SM-A505F) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/76.0.3809.111 Mobile Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/config/amazon_ses.php","summary":"","payload_hex":"474554202f636f6e6669672f616d617a6f6e5f7365732e70687020485454502f312e310d0a486f73743a20<HONEYPOT>3a35353030300d0a557365722d4167656e743a204d6f7a696c6c612f352e3020284c696e75783b20416e64726f696420393b20534d2d413530354629204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f37362e302e333830392e313131204d6f62696c65205361666172692f3533372e33360d0a4163636570742d436861727365743a207574662d380d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Linux; Android 9; SM-A505F) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/76.0.3809.111 Mobile Safari/537.36","ja3":"19e29534fd49dd27d09234e639c4057e","session":"06c38f07-cf9b-4a02-aea7-d58d171a394f","seq":1,"duration_ms":109,"bytes_in":265,"bytes_out":79},{"timestamp":"2026-06-30T07:10:04","port":55000,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-charset\":\"utf-8\",\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:55000\",\"user-agent\":\"Mozilla/5.0 (iPad; CPU OS 11_0 like Mac OS X) AppleWebKit/604.1.38 (KHTML, like Gecko) Version/11.0 Mobile/15A5362a Safari/604.1\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/.drone.yaml","summary":"","payload_hex":"474554202f2e64726f6e652e79616d6c20485454502f312e310d0a486f73743a20<HONEYPOT>3a35353030300d0a557365722d4167656e743a204d6f7a696c6c612f352e302028695061643b20435055204f532031315f30206c696b65204d6163204f53205829204170706c655765624b69742f3630342e312e333820284b48544d4c2c206c696b65204765636b6f292056657273696f6e2f31312e30204d6f62696c652f3135413533363261205361666172692f3630342e310d0a4163636570742d436861727365743a207574662d380d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (iPad; CPU OS 11_0 like Mac OS X) AppleWebKit/604.1.38 (KHTML, like Gecko) Version/11.0 Mobile/15A5362a Safari/604.1","ja3":"19e29534fd49dd27d09234e639c4057e","session":"84678c09-4179-4161-b282-afa72f7d0676","seq":1,"duration_ms":197,"bytes_in":262,"bytes_out":79},{"timestamp":"2026-06-30T07:10:04","port":55000,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-charset\":\"utf-8\",\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:55000\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3850.0 Iron Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/secrets.json","summary":"","payload_hex":"474554202f736563726574732e6a736f6e20485454502f312e310d0a486f73743a20<HONEYPOT>3a35353030300d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f37342e302e333835302e302049726f6e205361666172692f3533372e33360d0a4163636570742d436861727365743a207574662d380d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3850.0 Iron Safari/537.36","ja3":"19e29534fd49dd27d09234e639c4057e","session":"012176e3-f0a0-4dae-a5f7-cef6ad0faf5a","seq":1,"duration_ms":114,"bytes_in":253,"bytes_out":79},{"timestamp":"2026-06-30T07:10:04","port":55000,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-charset\":\"utf-8\",\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:55000\",\"user-agent\":\"Mozilla/5.0 (PLAYSTATION 3; 2.00)\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/.vscode/launch.json","summary":"","payload_hex":"474554202f2e7673636f64652f6c61756e63682e6a736f6e20485454502f312e310d0a486f73743a20<HONEYPOT>3a35353030300d0a557365722d4167656e743a204d6f7a696c6c612f352e302028504c415953544154494f4e20333b20322e3030290d0a4163636570742d436861727365743a207574662d380d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (PLAYSTATION 3; 2.00)","ja3":"19e29534fd49dd27d09234e639c4057e","session":"cfca4c3b-0baa-457a-9c06-9259d77b2cff","seq":1,"duration_ms":195,"bytes_in":175,"bytes_out":79},{"timestamp":"2026-06-30T07:10:04","port":55000,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-charset\":\"utf-8\",\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:55000\",\"user-agent\":\"Download Demon/3.5.0.11\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/web.config","summary":"","payload_hex":"474554202f7765622e636f6e66696720485454502f312e310d0a486f73743a20<HONEYPOT>3a35353030300d0a557365722d4167656e743a20446f776e6c6f61642044656d6f6e2f332e352e302e31310d0a4163636570742d436861727365743a207574662d380d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Download Demon/3.5.0.11","ja3":"19e29534fd49dd27d09234e639c4057e","session":"80adf50e-9c1f-41dd-a2b5-e7f2188f29c3","seq":1,"duration_ms":203,"bytes_in":156,"bytes_out":79}],"http_methods":[{"method":"GET","count":563}],"distinct_ports_total":1,"top_paths":[{"path":"/docker-compose.prod.yml","count":2,"ports":1},{"path":"/config/app.php","count":2,"ports":1},{"path":"/config/database.yml","count":2,"ports":1},{"path":"/docker-compose.yml","count":2,"ports":1},{"path":"/terraform.tfstate","count":2,"ports":1},{"path":"/docker-compose.yaml","count":2,"ports":1},{"path":"/Dockerfile","count":2,"ports":1},{"path":"/database.php","count":2,"ports":1},{"path":"/database.yml","count":2,"ports":1},{"path":"/infra/terraform.tfvars","count":2,"ports":1},{"path":"/secrets.yml","count":2,"ports":1},{"path":"/api/credentials.json","count":2,"ports":1},{"path":"/secrets.json","count":2,"ports":1},{"path":"/secrets.yaml","count":2,"ports":1},{"path":"/.npmrc","count":2,"ports":1}],"distinct_paths_total":200,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept-Charset","Accept-Encoding","Connection","Host","User-Agent"],"representative":[{"name":"Accept-Charset","value":"utf-8","notable":false},{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Connection","value":"close","notable":false},{"name":"Host","value":"<HONEYPOT>:55000","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (Linux; Android 5.1.1; SM-E700H) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.157 Mobile Safari/537.36","notable":false}],"distinct_sets":1,"events_with_headers":10},"tags":[]}