{"ip":"34.178.255.58","total_events":288,"verdict":{"verdict":"scanning","label":"Scanning for known vulnerabilities","detail":"35 exploit-path probe(s)","confidence":"medium","network_type":null,"why":["35 request(s) matched a known exploit path.","Only GET/HEAD seen, no request body: scanning for the vulnerability, not delivering a payload.","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"94,000 bytes sent","bytes_sent":94000,"session_seconds":0,"persistent":false}},"first_seen":"2026-08-30T13:31:22","last_seen":"2026-08-30T13:31:22","events_24h":0,"events_7d":288,"geo":{"country_code":"NL","country_name":"The Netherlands","region":"Groningen","city":"Groningen","lat":53.2222,"lon":6.5664,"asn":396982,"org":"Google LLC"},"source_domain":"58.255.178.34.bc.googleusercontent.com","known_scanners":[],"scanner_tag":{"key":"gcp","label":"Google Cloud","category":"hosting_provider","url":"https://cloud.google.com/"},"cve_matches":[{"cve_id":"CVE-2024-4836","title":"Edito CMS - Sensitive Data Leak","severity":"high","actively_exploited":false,"match_field":"url_path","matched_pattern":"/config/config.php"}],"malware":[],"top_ports":[{"port":9980,"proto":"tcp","label":"","count":288}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i1010h1_61a7ad8aa9b6_792d2c6655cb","t13i1010h1_61a7ad8aa9b6_3a8073edd8ef"],"tls_ja3":["d7e85d7b7e1da092bb4a50a3ff24742d","c5c20c5717dd2470f2e22b4fff1e5397","91fa2a097505cd0dba551ee6f7f54f60","32c2c477715c50dfe555904b7d3e221f","10abc71faf62c24e09a0ec373bbee80c"],"ja4h":["ge11nn0300_341eb0d8946c"]},"fingerprint_peers":{"t13i1010h1_61a7ad8aa9b6_792d2c6655cb":329,"t13i1010h1_61a7ad8aa9b6_3a8073edd8ef":1838,"ge11nn0300_341eb0d8946c":2501},"user_agents":["Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36"],"timeline":[{"date":"2026-08-30","count":288}],"recent_events":[{"timestamp":"2026-08-30T13:31:22","port":9980,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:9980\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"/info.php","summary":"","payload_hex":"474554202f696e666f2e70687020485454502f312e310d0a6163636570743a202a2f2a0d0a757365722d6167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132342e30205361666172692f3533372e33360d0a686f73743a20<HONEYPOT>3a393938300d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36","ja3":"a4a125671c9314969b5bae91a407ba36","session":"2b139e17-6ba9-4048-a670-bb841e9a457b","seq":3,"duration_ms":332,"bytes_in":546,"bytes_out":234},{"timestamp":"2026-08-30T13:31:22","port":9980,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:9980\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"/infra/terraform.tfvars","summary":"","payload_hex":"474554202f696e6672612f7465727261666f726d2e74667661727320485454502f312e310d0a6163636570743a202a2f2a0d0a757365722d6167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132342e30205361666172692f3533372e33360d0a686f73743a20<HONEYPOT>3a393938300d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36","ja3":"8816ebd37eee078856627720c22f77b8","session":"1745ae06-8021-4ceb-a09b-4825454d01f1","seq":1,"duration_ms":100,"bytes_in":191,"bytes_out":78},{"timestamp":"2026-08-30T13:31:22","port":9980,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:9980\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"/.idea/WebServers.xml","summary":"","payload_hex":"474554202f2e696465612f576562536572766572732e786d6c20485454502f312e310d0a6163636570743a202a2f2a0d0a757365722d6167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132342e30205361666172692f3533372e33360d0a686f73743a20<HONEYPOT>3a393938300d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36","ja3":"6558e96676b27859c434b60d810ed400","session":"d9948337-cf2b-40b8-a754-24f78460d2da","seq":3,"duration_ms":348,"bytes_in":561,"bytes_out":234},{"timestamp":"2026-08-30T13:31:22","port":9980,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:9980\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"/infra/docker-compose.yml","summary":"","payload_hex":"474554202f696e6672612f646f636b65722d636f6d706f73652e796d6c20485454502f312e310d0a6163636570743a202a2f2a0d0a757365722d6167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132342e30205361666172692f3533372e33360d0a686f73743a20<HONEYPOT>3a393938300d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36","ja3":"f8464a79abc2f9fe970ef08f8dd52772","session":"896c7c45-9311-4493-ad82-1de4b538a69f","seq":2,"duration_ms":243,"bytes_in":378,"bytes_out":156},{"timestamp":"2026-08-30T13:31:22","port":9980,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:9980\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"/google-credentials.json","summary":"","payload_hex":"474554202f676f6f676c652d63726564656e7469616c732e6a736f6e20485454502f312e310d0a6163636570743a202a2f2a0d0a757365722d6167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132342e30205361666172692f3533372e33360d0a686f73743a20<HONEYPOT>3a393938300d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36","ja3":"9ad3f8b40bbf83a9e30881db0f42ba74","session":"858f829c-f720-446b-ac2a-3e6055124cd0","seq":3,"duration_ms":349,"bytes_in":566,"bytes_out":234},{"timestamp":"2026-08-30T13:31:22","port":9980,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:9980\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"/.htaccess","summary":"","payload_hex":"474554202f2e687461636365737320485454502f312e310d0a6163636570743a202a2f2a0d0a757365722d6167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132342e30205361666172692f3533372e33360d0a686f73743a20<HONEYPOT>3a393938300d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36","ja3":"887cfc38c4da4adfc7ec6bfe66b7c47f","session":"80ef024c-7b4f-43c2-837a-27b72db7056e","seq":3,"duration_ms":339,"bytes_in":560,"bytes_out":234},{"timestamp":"2026-08-30T13:31:22","port":9980,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:9980\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"/helm/values.yaml","summary":"","payload_hex":"474554202f68656c6d2f76616c7565732e79616d6c20485454502f312e310d0a6163636570743a202a2f2a0d0a757365722d6167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132342e30205361666172692f3533372e33360d0a686f73743a20<HONEYPOT>3a393938300d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36","ja3":"cf4d7b5406ffc3bdcd4b078f30bbbcdd","session":"75cdfc33-eaa1-4fc4-af6a-14f83fbf9ec8","seq":3,"duration_ms":344,"bytes_in":558,"bytes_out":234},{"timestamp":"2026-08-30T13:31:22","port":9980,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:9980\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"/.gemrc","summary":"","payload_hex":"474554202f2e67656d726320485454502f312e310d0a6163636570743a202a2f2a0d0a757365722d6167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132342e30205361666172692f3533372e33360d0a686f73743a20<HONEYPOT>3a393938300d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36","ja3":"10abc71faf62c24e09a0ec373bbee80c","session":"cb0456a3-6a0d-4c0e-9e6e-8e92e6dc973d","seq":4,"duration_ms":465,"bytes_in":724,"bytes_out":312},{"timestamp":"2026-08-30T13:31:22","port":9980,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:9980\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"/.github/workflows/ci.yml","summary":"","payload_hex":"474554202f2e6769746875622f776f726b666c6f77732f63692e796d6c20485454502f312e310d0a6163636570743a202a2f2a0d0a757365722d6167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132342e30205361666172692f3533372e33360d0a686f73743a20<HONEYPOT>3a393938300d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36","ja3":"f506cdeb7ac50fc830b1a49e7414b183","session":"80d65d63-0c7f-466f-a33a-f0825183cb5f","seq":3,"duration_ms":353,"bytes_in":582,"bytes_out":234},{"timestamp":"2026-08-30T13:31:22","port":9980,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:9980\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"/gcp-credentials.json","summary":"","payload_hex":"474554202f6763702d63726564656e7469616c732e6a736f6e20485454502f312e310d0a6163636570743a202a2f2a0d0a757365722d6167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132342e30205361666172692f3533372e33360d0a686f73743a20<HONEYPOT>3a393938300d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36","ja3":"b45290045df355886fe737896d9b9e2d","session":"c6aef2f0-5b4a-46b2-b8f3-bca644167a76","seq":1,"duration_ms":100,"bytes_in":189,"bytes_out":78}],"http_methods":[{"method":"GET","count":288}],"distinct_ports_total":1,"top_paths":[{"path":"/config/mandrill.php","count":1,"ports":1},{"path":"/backend/docker-compose.prod.yml","count":1,"ports":1},{"path":"/backend/application.properties","count":1,"ports":1},{"path":"/backend/docker-compose.yml","count":1,"ports":1},{"path":"/config/service-account.json","count":1,"ports":1},{"path":"/docker-compose.local.yml","count":1,"ports":1},{"path":"/devops/docker-compose.yml","count":1,"ports":1},{"path":"/config/docker-compose.yml","count":1,"ports":1},{"path":"/backend/actuator/heapdump","count":1,"ports":1},{"path":"/api/actuator/configprops","count":1,"ports":1},{"path":"/application/config/config.php","count":1,"ports":1},{"path":"/deploy/service-account.json","count":1,"ports":1},{"path":"/.config/gcloud/credentials.db","count":1,"ports":1},{"path":"/infra/docker-compose.yml","count":1,"ports":1},{"path":"/backend/actuator/configprops","count":1,"ports":1}],"distinct_paths_total":200,"top_snis":[],"top_hosts":[],"top_alpns":[{"value":"http/1.1","count":288}],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","Host","User-Agent"],"representative":[{"name":"Accept","value":"*/*","notable":false},{"name":"Host","value":"<HONEYPOT>:9980","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36","notable":false}],"distinct_sets":1,"events_with_headers":10},"tags":[{"tag_id":"CVE-2024-4836","tag_type":"cve","title":"Edito CMS - Sensitive Data Leak","severity":"high","actively_exploited":false,"match_field":"url_path","matched_pattern":"/config/config.php","reference_urls":["https://cert.pl/en/posts/2024/07/CVE-2024-4836/","https://github.com/sleep46/CVE-2024-4836_Check","https://nvd.nist.gov/vuln/detail/CVE-2024-4836"]}],"data_as_of":"2026-09-04T21:03:36.634972+00:00"}