{"ip":"34.64.63.6","total_events":166,"verdict":{"verdict":"scanning","label":"Scanning for known vulnerabilities","detail":"151 exploit-path probe(s)","confidence":"medium","network_type":null,"why":["151 request(s) matched a known exploit path.","Only GET/HEAD seen, no request body: scanning for the vulnerability, not delivering a payload.","Not in any known-scanner range."]},"first_seen":"2026-06-25T17:23:37","last_seen":"2026-06-25T17:23:39","events_24h":0,"events_7d":0,"geo":{"country_code":"KR","country_name":"South Korea","region":"Seoul","city":"Seoul","lat":37.5658,"lon":126.978,"asn":396982,"org":"Google LLC"},"source_domain":"6.63.64.34.bc.googleusercontent.com","known_scanners":[],"scanner_tag":{"key":"gcp","label":"Google Cloud","category":"hosting_provider","url":"https://cloud.google.com/"},"cve_matches":[{"cve_id":"CVE-2024-36527","title":"Puppeteer Renderer - Directory Traversal","severity":"medium","actively_exploited":false,"match_field":"url_path","matched_pattern":"/html"}],"malware":[],"top_ports":[{"port":6443,"proto":"tcp","label":"k8s API","count":166}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i190800_9dc949149365_97f8aa674fd9"],"tls_ja3":["19e29534fd49dd27d09234e639c4057e"],"ja4h":["ge11nn0500_9af7e0472034"]},"fingerprint_peers":{"t13i190800_9dc949149365_97f8aa674fd9":7209,"ge11nn0500_9af7e0472034":5952},"user_agents":["Mozilla/5.0 (Linux; Android 8.0.0; moto e5 cruise Build/OCPS27.91-157-12) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/68.0.3440.91 Mobile Safari/537.36","Mozilla/5.0 (iPhone; CPU iPhone OS 12_4 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Mobile/15E148 Safari/605.1.15 Version/12.2.1.0.4","Mozilla/5.0 (Windows Phone 8.1; ARM; Trident/7.0; Touch; rv:11.0; IEMobile/11.0; NOKIA; Lumia 530) like Gecko","Mozilla/5.0 (Linux; Android 9; SM-G960U1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/76.0.3809.111 Mobile Safari/537.36","Mozilla/4.77 [en] (X11; I; IRIX;64 6.5 IP30)","Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; Trident/4.0)","Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.8 (KHTML, like Gecko) Beamrise/17.2.0.9 Chrome/17.0.939.0 Safari/535.8","Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/73.0.3683.103 Safari/537.36"],"timeline":[{"date":"2026-06-25","count":166}],"recent_events":[{"timestamp":"2026-06-25T17:23:39","port":6443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-charset\":\"utf-8\",\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:6443\",\"user-agent\":\"Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML like Gecko) Chrome/28.0.1469.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/config/sendgrid.env","summary":"","payload_hex":"474554202f636f6e6669672f73656e64677269642e656e7620485454502f312e310d0a486f73743a20<HONEYPOT>3a363434330d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e5420362e313b20574f57363429204170706c655765624b69742f3533372e333620284b48544d4c206c696b65204765636b6f29204368726f6d652f32382e302e313436392e30205361666172692f3533372e33360d0a4163636570742d436861727365743a207574662d380d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML like Gecko) Chrome/28.0.1469.0 Safari/537.36","community_id":"1:H4yN/K7jZDSgop/mGmfMMsZhOvk=","ja3":"19e29534fd49dd27d09234e639c4057e","session":"8b4e4272-e4f4-4ab6-b37f-bf9a7574e74c","seq":1,"duration_ms":101,"bytes_in":247,"bytes_out":75},{"timestamp":"2026-06-25T17:23:39","port":6443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-charset\":\"utf-8\",\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:6443\",\"user-agent\":\"Gregarius/0.5.2 ( http://devlog.gregarius.net/docs/ua)\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/src/sendgrid.env","summary":"","payload_hex":"474554202f7372632f73656e64677269642e656e7620485454502f312e310d0a486f73743a20<HONEYPOT>3a363434330d0a557365722d4167656e743a204772656761726975732f302e352e32202820687474703a2f2f6465766c6f672e6772656761726975732e6e65742f646f63732f7561290d0a4163636570742d436861727365743a207574662d380d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Gregarius/0.5.2 ( http://devlog.gregarius.net/docs/ua)","community_id":"1:GoXcmiO5bvwrdgr/Hvf7Jl75XMw=","ja3":"19e29534fd49dd27d09234e639c4057e","session":"4e22d812-c8c6-4f03-91b5-e68e8fb5daf5","seq":1,"duration_ms":100,"bytes_in":192,"bytes_out":75},{"timestamp":"2026-06-25T17:23:39","port":6443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-charset\":\"utf-8\",\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:6443\",\"user-agent\":\"Mozilla/5.0 (iPad; CPU OS 7_1_2 like Mac OS X) AppleWebKit/537.51.2 (KHTML, like Gecko) Version/7.0 Mobile/11D257 Safari/9537.53\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/sendgrid/.env.backup","summary":"","payload_hex":"474554202f73656e64677269642f2e656e762e6261636b757020485454502f312e310d0a486f73743a20<HONEYPOT>3a363434330d0a557365722d4167656e743a204d6f7a696c6c612f352e302028695061643b20435055204f5320375f315f32206c696b65204d6163204f53205829204170706c655765624b69742f3533372e35312e3220284b48544d4c2c206c696b65204765636b6f292056657273696f6e2f372e30204d6f62696c652f313144323537205361666172692f393533372e35330d0a4163636570742d436861727365743a207574662d380d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (iPad; CPU OS 7_1_2 like Mac OS X) AppleWebKit/537.51.2 (KHTML, like Gecko) Version/7.0 Mobile/11D257 Safari/9537.53","community_id":"1:T/d+QFfTDK7ilZ/oFvvUygAv/PM=","ja3":"19e29534fd49dd27d09234e639c4057e","session":"50ca30a2-10be-4b50-9f42-c6d7fe8becf4","seq":1,"duration_ms":110,"bytes_in":270,"bytes_out":75},{"timestamp":"2026-06-25T17:23:39","port":6443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-charset\":\"utf-8\",\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:6443\",\"user-agent\":\"SEC-SGHX820/1.0 NetFront/3.2 Profile/MIDP-2.0 Configuration/CLDC-1.1\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/sendgrid/.env.local","summary":"","payload_hex":"474554202f73656e64677269642f2e656e762e6c6f63616c20485454502f312e310d0a486f73743a20<HONEYPOT>3a363434330d0a557365722d4167656e743a205345432d534748583832302f312e30204e657446726f6e742f332e322050726f66696c652f4d4944502d322e3020436f6e66696775726174696f6e2f434c44432d312e310d0a4163636570742d436861727365743a207574662d380d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"SEC-SGHX820/1.0 NetFront/3.2 Profile/MIDP-2.0 Configuration/CLDC-1.1","community_id":"1:MIkgZ0/6bu4m/AisqKoNZJEuCiA=","ja3":"19e29534fd49dd27d09234e639c4057e","session":"b9411440-47f3-4c7c-9f80-d7c2c030bb1e","seq":1,"duration_ms":102,"bytes_in":209,"bytes_out":75},{"timestamp":"2026-06-25T17:23:39","port":6443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-charset\":\"utf-8\",\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:6443\",\"user-agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.75.14 (KHTML, like Gecko) Version/7.0.3 Safari/7046A194A\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/backend/sendgrid.env","summary":"","payload_hex":"474554202f6261636b656e642f73656e64677269642e656e7620485454502f312e310d0a486f73743a20<HONEYPOT>3a363434330d0a557365722d4167656e743a204d6f7a696c6c612f352e3020284d6163696e746f73683b20496e74656c204d6163204f5320582031305f395f3329204170706c655765624b69742f3533372e37352e313420284b48544d4c2c206c696b65204765636b6f292056657273696f6e2f372e302e33205361666172692f3730343641313934410d0a4163636570742d436861727365743a207574662d380d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.75.14 (KHTML, like Gecko) Version/7.0.3 Safari/7046A194A","community_id":"1:ssbjIEI7gJpa6ubrmoPe6j4VskU=","ja3":"19e29534fd49dd27d09234e639c4057e","session":"cf6f5d4a-82dc-4b41-bc82-1ef5f7d855a4","seq":1,"duration_ms":109,"bytes_in":261,"bytes_out":75},{"timestamp":"2026-06-25T17:23:39","port":6443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-charset\":\"utf-8\",\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:6443\",\"user-agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/71.0.3578.98 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/email/sendgrid.env","summary":"","payload_hex":"474554202f656d61696c2f73656e64677269642e656e7620485454502f312e310d0a486f73743a20<HONEYPOT>3a363434330d0a557365722d4167656e743a204d6f7a696c6c612f352e3020284d6163696e746f73683b20496e74656c204d6163204f5320582031305f31345f3429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f37312e302e333537382e3938205361666172692f3533372e33360d0a4163636570742d436861727365743a207574662d380d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/71.0.3578.98 Safari/537.36","community_id":"1:/QCzb9Y3l70Tjd2syXl5i3AfJI8=","ja3":"19e29534fd49dd27d09234e639c4057e","session":"7c4374d8-bd83-44c0-9ade-1b4965b8af14","seq":1,"duration_ms":103,"bytes_in":260,"bytes_out":75},{"timestamp":"2026-06-25T17:23:39","port":6443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-charset\":\"utf-8\",\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:6443\",\"user-agent\":\"Mozilla/5.0 (Linux; Android 9; SM-G960W) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/76.0.3809.111 Mobile Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/app/sendgrid.env","summary":"","payload_hex":"474554202f6170702f73656e64677269642e656e7620485454502f312e310d0a486f73743a20<HONEYPOT>3a363434330d0a557365722d4167656e743a204d6f7a696c6c612f352e3020284c696e75783b20416e64726f696420393b20534d2d473936305729204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f37362e302e333830392e313131204d6f62696c65205361666172692f3533372e33360d0a4163636570742d436861727365743a207574662d380d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Linux; Android 9; SM-G960W) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/76.0.3809.111 Mobile Safari/537.36","community_id":"1:hIEH9JqvXDLDqZmBmKE6jV1zVAo=","ja3":"19e29534fd49dd27d09234e639c4057e","session":"8974d6f7-61f2-4a80-85d9-7f9094c46524","seq":1,"duration_ms":101,"bytes_in":259,"bytes_out":75},{"timestamp":"2026-06-25T17:23:39","port":6443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-charset\":\"utf-8\",\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:6443\",\"user-agent\":\"Links/0.9.1 (Linux 2.4.24; i386;)\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/mailer/sendgrid.env","summary":"","payload_hex":"474554202f6d61696c65722f73656e64677269642e656e7620485454502f312e310d0a486f73743a20<HONEYPOT>3a363434330d0a557365722d4167656e743a204c696e6b732f302e392e3120284c696e757820322e342e32343b20693338363b290d0a4163636570742d436861727365743a207574662d380d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Links/0.9.1 (Linux 2.4.24; i386;)","community_id":"1:A+p6R4npH4wwAEeU/aT6/LyKMb4=","ja3":"19e29534fd49dd27d09234e639c4057e","session":"f53d639b-7dc2-47b3-bad2-bb8486bd577e","seq":1,"duration_ms":101,"bytes_in":174,"bytes_out":75},{"timestamp":"2026-06-25T17:23:39","port":6443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-charset\":\"utf-8\",\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:6443\",\"user-agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.142 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/api/sendgrid.env","summary":"","payload_hex":"474554202f6170692f73656e64677269642e656e7620485454502f312e310d0a486f73743a20<HONEYPOT>3a363434330d0a557365722d4167656e743a204d6f7a696c6c612f352e3020284d6163696e746f73683b20496e74656c204d6163204f5320582031305f31325f3429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f37352e302e333737302e313432205361666172692f3533372e33360d0a4163636570742d436861727365743a207574662d380d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.142 Safari/537.36","community_id":"1:YwmD0FykfBbSkUbAnOvPFdxshkk=","ja3":"19e29534fd49dd27d09234e639c4057e","session":"cfc1fa56-fd48-4402-9832-b0032daac59f","seq":1,"duration_ms":100,"bytes_in":259,"bytes_out":75},{"timestamp":"2026-06-25T17:23:38","port":6443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-charset\":\"utf-8\",\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:6443\",\"user-agent\":\"Mozilla/5.0 (Linux; U; Android 2.3.4; en-us; BNTV250 Build/GINGERBREAD) AppleWebKit/533.1 (KHTML, like Gecko) Version/4.0 Safari/533.1\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/config/.env","summary":"","payload_hex":"474554202f636f6e6669672f2e656e7620485454502f312e310d0a486f73743a20<HONEYPOT>3a363434330d0a557365722d4167656e743a204d6f7a696c6c612f352e3020284c696e75783b20553b20416e64726f696420322e332e343b20656e2d75733b20424e5456323530204275696c642f47494e474552425245414429204170706c655765624b69742f3533332e3120284b48544d4c2c206c696b65204765636b6f292056657273696f6e2f342e30205361666172692f3533332e310d0a4163636570742d436861727365743a207574662d380d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Linux; U; Android 2.3.4; en-us; BNTV250 Build/GINGERBREAD) AppleWebKit/533.1 (KHTML, like Gecko) Version/4.0 Safari/533.1","community_id":"1:ZN3W1m7me/BhunRNwkN9QRQv8bI=","ja3":"19e29534fd49dd27d09234e639c4057e","session":"41905349-e3ee-4cce-a97f-4dd29079fbc9","seq":1,"duration_ms":101,"bytes_in":267,"bytes_out":75}],"http_methods":[{"method":"GET","count":166}],"distinct_ports_total":1,"top_paths":[{"path":"/.env.old","count":1,"ports":1},{"path":"/api/sendgrid.env","count":1,"ports":1},{"path":"/.env.test","count":1,"ports":1},{"path":"/var/.env","count":1,"ports":1},{"path":"/.env.qa","count":1,"ports":1},{"path":"/env.old","count":1,"ports":1},{"path":"/env.txt","count":1,"ports":1},{"path":"/.env~","count":1,"ports":1},{"path":"/qa/.env","count":1,"ports":1},{"path":"/wp/.env","count":1,"ports":1},{"path":"/env","count":1,"ports":1},{"path":"/v1/.env","count":1,"ports":1},{"path":"/app/.env.dev","count":1,"ports":1},{"path":"/public/.env","count":1,"ports":1},{"path":"/staging/.env","count":1,"ports":1}],"distinct_paths_total":166,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept-Charset","Accept-Encoding","Connection","Host","User-Agent"],"representative":[{"name":"Accept-Charset","value":"utf-8","notable":false},{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Connection","value":"close","notable":false},{"name":"Host","value":"<HONEYPOT>:6443","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML like Gecko) Chrome/28.0.1469.0 Safari/537.36","notable":false}],"distinct_sets":1,"events_with_headers":10},"tags":[{"tag_id":"CVE-2024-36527","tag_type":"cve","title":"Puppeteer Renderer - Directory Traversal","severity":"medium","actively_exploited":false,"match_field":"url_path","matched_pattern":"/html","reference_urls":["https://github.com/zenato/puppeteer-renderer/issues/97","https://gist.github.com/7a6163/25fef08f75eed219c8ca21e332d6e911"]}],"data_as_of":"2026-07-04T10:05:18.053516+00:00"}