{"ip":"34.178.28.115","total_events":93,"verdict":{"verdict":"scanning","label":"Scanning for known vulnerabilities","detail":"5 exploit-path probe(s)","confidence":"medium","network_type":null,"why":["5 request(s) matched a known exploit path.","Only GET/HEAD seen, no request body: scanning for the vulnerability, not delivering a payload.","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"19,498 bytes sent","bytes_sent":19498,"session_seconds":1,"persistent":false}},"first_seen":"2026-09-06T15:33:05","last_seen":"2026-09-06T15:33:06","events_24h":0,"events_7d":93,"geo":{"country_code":"NL","country_name":"The Netherlands","region":"Groningen","city":"Groningen","lat":53.2222,"lon":6.5664,"asn":396982,"org":"Google LLC"},"source_domain":"115.28.178.34.bc.googleusercontent.com","known_scanners":[],"scanner_tag":{"key":"gcp","label":"Google Cloud","category":"hosting_provider","url":"https://cloud.google.com/"},"cve_matches":[],"malware":[],"top_ports":[{"port":8585,"proto":"tcp","label":"","count":93}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i1010h1_61a7ad8aa9b6_3a8073edd8ef"],"tls_ja3":["db2684b3d0467adefac70bef8dab220e","4920d0234d49d546483ad54df85d3ab2","85d2e04c2bec9c3587807fd4bd64c8e4","b3e09324e508b52b84a89304a4b0fbeb","3bfabf30bbcd5d1f62737041b4ccb09a"],"ja4h":["ge11nn0300_341eb0d8946c"]},"fingerprint_peers":{"t13i1010h1_61a7ad8aa9b6_3a8073edd8ef":4561,"ge11nn0300_341eb0d8946c":5983},"user_agents":["Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36"],"timeline":[{"date":"2026-09-06","count":93}],"recent_events":[{"timestamp":"2026-09-06T15:33:06","port":8585,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:8585\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"/appsettings.json","summary":"","payload_hex":"474554202f61707073657474696e67732e6a736f6e20485454502f312e310d0a6163636570743a202a2f2a0d0a757365722d6167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132342e30205361666172692f3533372e33360d0a686f73743a20<HONEYPOT>3a383538350d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36","ja3":"8d4489a658c69ecb5637a72f09815f1a","session":"e7ef3e60-b574-4c14-b882-34f18c83c81a","seq":1,"duration_ms":117,"bytes_in":183,"bytes_out":78},{"timestamp":"2026-09-06T15:33:06","port":8585,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:8585\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"/api/config.json","summary":"","payload_hex":"474554202f6170692f636f6e6669672e6a736f6e20485454502f312e310d0a6163636570743a202a2f2a0d0a757365722d6167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132342e30205361666172692f3533372e33360d0a686f73743a20<HONEYPOT>3a383538350d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36","ja3":"e2809f891d27e22f69e80266ffbb99de","session":"2cba4162-bcd4-4e73-be8d-0f35ea350a3b","seq":1,"duration_ms":117,"bytes_in":182,"bytes_out":78},{"timestamp":"2026-09-06T15:33:06","port":8585,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:8585\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"/google.json","summary":"","payload_hex":"474554202f676f6f676c652e6a736f6e20485454502f312e310d0a6163636570743a202a2f2a0d0a757365722d6167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132342e30205361666172692f3533372e33360d0a686f73743a20<HONEYPOT>3a383538350d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36","ja3":"b23bfc650ea0b7e15458654466cd83b8","session":"00d14a05-802c-4abb-aa56-a43bcaf873c4","seq":1,"duration_ms":117,"bytes_in":178,"bytes_out":78},{"timestamp":"2026-09-06T15:33:06","port":8585,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:8585\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"/firebase.json","summary":"","payload_hex":"474554202f66697265626173652e6a736f6e20485454502f312e310d0a6163636570743a202a2f2a0d0a757365722d6167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132342e30205361666172692f3533372e33360d0a686f73743a20<HONEYPOT>3a383538350d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36","ja3":"a4bebe021e2b392064c00c44b34aafc7","session":"e7213fae-60de-4ea8-baa2-687da373da02","seq":1,"duration_ms":117,"bytes_in":180,"bytes_out":78},{"timestamp":"2026-09-06T15:33:06","port":8585,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:8585\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"/gcp.json","summary":"","payload_hex":"474554202f6763702e6a736f6e20485454502f312e310d0a6163636570743a202a2f2a0d0a757365722d6167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132342e30205361666172692f3533372e33360d0a686f73743a20<HONEYPOT>3a383538350d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36","ja3":"a6c4a733f6a32f17ccc6102d82e97588","session":"50c46db9-e565-4ddb-b7c1-b95cfbd68383","seq":1,"duration_ms":116,"bytes_in":175,"bytes_out":78},{"timestamp":"2026-09-06T15:33:06","port":8585,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:8585\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"/config.json","summary":"","payload_hex":"474554202f636f6e6669672e6a736f6e20485454502f312e310d0a6163636570743a202a2f2a0d0a757365722d6167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132342e30205361666172692f3533372e33360d0a686f73743a20<HONEYPOT>3a383538350d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36","ja3":"413451be6ee29d8bae987376a95dbe5c","session":"0094edcc-6d84-4512-bb08-6b93d78a45ab","seq":1,"duration_ms":118,"bytes_in":178,"bytes_out":78},{"timestamp":"2026-09-06T15:33:06","port":8585,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:8585\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"/credentials.json","summary":"","payload_hex":"474554202f63726564656e7469616c732e6a736f6e20485454502f312e310d0a6163636570743a202a2f2a0d0a757365722d6167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132342e30205361666172692f3533372e33360d0a686f73743a20<HONEYPOT>3a383538350d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36","ja3":"ca2fff608ee49dced4bd1830e828b576","session":"5f5f5734-fa65-4b17-b1c1-32e624cd7b9f","seq":1,"duration_ms":118,"bytes_in":183,"bytes_out":78},{"timestamp":"2026-09-06T15:33:06","port":8585,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:8585\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"/.htaccess","summary":"","payload_hex":"474554202f2e687461636365737320485454502f312e310d0a6163636570743a202a2f2a0d0a757365722d6167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132342e30205361666172692f3533372e33360d0a686f73743a20<HONEYPOT>3a383538350d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36","ja3":"91d425cc084fa47d501a92470be72d34","session":"c660fd0e-1931-4604-bbe1-bb84ad332ce5","seq":1,"duration_ms":118,"bytes_in":176,"bytes_out":78},{"timestamp":"2026-09-06T15:33:06","port":8585,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:8585\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"/api/aws.json","summary":"","payload_hex":"474554202f6170692f6177732e6a736f6e20485454502f312e310d0a6163636570743a202a2f2a0d0a757365722d6167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132342e30205361666172692f3533372e33360d0a686f73743a20<HONEYPOT>3a383538350d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36","ja3":"6a5b960c87b1c798c09f5b8a007b46d8","session":"36352312-323f-4904-b7f5-7bc96daed9cc","seq":1,"duration_ms":118,"bytes_in":179,"bytes_out":78},{"timestamp":"2026-09-06T15:33:06","port":8585,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:8585\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"/config.js","summary":"","payload_hex":"474554202f636f6e6669672e6a7320485454502f312e310d0a6163636570743a202a2f2a0d0a757365722d6167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132342e30205361666172692f3533372e33360d0a686f73743a20<HONEYPOT>3a383538350d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36","ja3":"e85a4751343b3fa9278755d538071c2b","session":"66f5e3ad-4940-49d4-a145-8a8ff937f308","seq":1,"duration_ms":117,"bytes_in":176,"bytes_out":78}],"http_methods":[{"method":"GET","count":93}],"distinct_ports_total":1,"top_paths":[{"path":"/www.zip","count":1,"ports":1},{"path":"/.vscode/mcp.json","count":1,"ports":1},{"path":"/.openai","count":1,"ports":1},{"path":"/.zshrc","count":1,"ports":1},{"path":"/db.sql","count":1,"ports":1},{"path":"/.bashrc","count":1,"ports":1},{"path":"/ai.json","count":1,"ports":1},{"path":"/sql.gz","count":1,"ports":1},{"path":"/public_html.zip","count":1,"ports":1},{"path":"/backup.rar","count":1,"ports":1},{"path":"/api/config.json","count":1,"ports":1},{"path":"/anthropic.json","count":1,"ports":1},{"path":"/backup.sql","count":1,"ports":1},{"path":"/llm.json","count":1,"ports":1},{"path":"/.fish_history","count":1,"ports":1}],"distinct_paths_total":93,"top_snis":[],"top_hosts":[],"top_alpns":[{"value":"http/1.1","count":93}],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","Host","User-Agent"],"representative":[{"name":"Accept","value":"*/*","notable":false},{"name":"Host","value":"<HONEYPOT>:8585","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36","notable":false}],"distinct_sets":1,"events_with_headers":10},"tags":[],"data_as_of":"2026-09-10T22:15:32.381341+00:00"}