{"ip":"34.81.25.124","total_events":2555,"verdict":{"verdict":"scanning","label":"Scanning for known vulnerabilities","detail":"6 exploit-path probe(s)","confidence":"medium","network_type":null,"why":["6 request(s) matched a known exploit path.","Only GET/HEAD seen, no request body: scanning for the vulnerability, not delivering a payload.","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"3,293,996 bytes sent","bytes_sent":3293996,"session_seconds":9,"persistent":false}},"first_seen":"2026-09-06T12:56:54","last_seen":"2026-09-06T12:57:08","events_24h":0,"events_7d":0,"geo":{"country_code":"TW","country_name":"Taiwan","region":"Taipei City","city":"Taipei","lat":25.053,"lon":121.5259,"asn":396982,"org":"Google LLC"},"source_domain":"124.25.81.34.bc.googleusercontent.com","known_scanners":[],"scanner_tag":{"key":"gcp","label":"Google Cloud","category":"hosting_provider","url":"https://cloud.google.com/"},"cve_matches":[],"malware":[],"top_ports":[{"port":84,"proto":"tcp","label":"","count":2555}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i1010h1_61a7ad8aa9b6_792d2c6655cb","t13i1010h1_61a7ad8aa9b6_3a8073edd8ef"],"tls_client_hello":"","tls_ja3":["2d08de73217c0230fd3810afa00f0b3e","293e73e4296ef7b1be9a0e7f3df8c1a6","02888999a3de275d0d2f85717a67ce98","33005e953e76a6d51e939ef00aa26c30","6f49cdc2bb515f0ef216716e60f74618"]},"fingerprint_peers":{"t13i1010h1_61a7ad8aa9b6_792d2c6655cb":1126,"t13i1010h1_61a7ad8aa9b6_3a8073edd8ef":4581},"user_agents":["Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36"],"timeline":[{"date":"2026-09-06","count":2555}],"recent_events":[{"timestamp":"2026-09-06T12:57:08","port":84,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:84\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"/backups/81.254.sql.bz2","summary":"","payload_hex":"474554202f6261636b7570732f38312e3235342e73716c2e627a3220485454502f312e310d0a6163636570743a202a2f2a0d0a757365722d6167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132342e30205361666172692f3533372e33360d0a686f73743a20<HONEYPOT>3a38340d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36","ja3":"b3351311fd768360ed141e793ef8638e","session":"5b282fa1-85bf-4fa3-8cf6-ad04d33bcc87","seq":17,"duration_ms":5221,"bytes_in":3090,"bytes_out":1309},{"timestamp":"2026-09-06T12:57:08","port":84,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:84\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"/81.254_backup.sql","summary":"","payload_hex":"474554202f38312e3235345f6261636b75702e73716c20485454502f312e310d0a6163636570743a202a2f2a0d0a757365722d6167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132342e30205361666172692f3533372e33360d0a686f73743a20<HONEYPOT>3a38340d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36","ja3":"74508a32d011fcf8b9b2c7624d53ba02","session":"99ea9325-83ce-4460-ad15-d4cf782cd255","seq":17,"duration_ms":5141,"bytes_in":3060,"bytes_out":1309},{"timestamp":"2026-09-06T12:57:08","port":84,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:84\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"/81.254.sql","summary":"","payload_hex":"474554202f38312e3235342e73716c20485454502f312e310d0a6163636570743a202a2f2a0d0a757365722d6167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132342e30205361666172692f3533372e33360d0a686f73743a20<HONEYPOT>3a38340d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36","ja3":"27af01ff1e1ca6b39501f00437954842","session":"f89aa457-ff9f-4b5e-9d2a-00c95ab90898","seq":16,"duration_ms":4951,"bytes_in":2876,"bytes_out":1232},{"timestamp":"2026-09-06T12:57:08","port":84,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:84\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"/backup_81.254.sql","summary":"","payload_hex":"474554202f6261636b75705f38312e3235342e73716c20485454502f312e310d0a6163636570743a202a2f2a0d0a757365722d6167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132342e30205361666172692f3533372e33360d0a686f73743a20<HONEYPOT>3a38340d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36","ja3":"39289621f77255ee11aebd486c988a0f","session":"2a2d917f-216d-40d5-bbd0-c54a0e7e1f91","seq":16,"duration_ms":4968,"bytes_in":2885,"bytes_out":1232},{"timestamp":"2026-09-06T12:57:08","port":84,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:84\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"/backups/81.254.sql.gz","summary":"","payload_hex":"474554202f6261636b7570732f38312e3235342e73716c2e677a20485454502f312e310d0a6163636570743a202a2f2a0d0a757365722d6167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132342e30205361666172692f3533372e33360d0a686f73743a20<HONEYPOT>3a38340d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36","ja3":"5aecd896ff06dea4d0a862fd07f115c5","session":"692dbe95-eb3f-408f-bd5d-39ffbeeee04c","seq":16,"duration_ms":4994,"bytes_in":2887,"bytes_out":1232},{"timestamp":"2026-09-06T12:57:08","port":84,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:84\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"/backup_81.254.sql.bz2","summary":"","payload_hex":"474554202f6261636b75705f38312e3235342e73716c2e627a3220485454502f312e310d0a6163636570743a202a2f2a0d0a757365722d6167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132342e30205361666172692f3533372e33360d0a686f73743a20<HONEYPOT>3a38340d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36","ja3":"fdf9c053948c64303433f639e33e8390","session":"7d5b3e0c-4258-415e-8dfc-a7a4c2412ba3","seq":16,"duration_ms":4921,"bytes_in":2902,"bytes_out":1232},{"timestamp":"2026-09-06T12:57:08","port":84,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:84\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"/81.zip","summary":"","payload_hex":"474554202f38312e7a697020485454502f312e310d0a6163636570743a202a2f2a0d0a757365722d6167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132342e30205361666172692f3533372e33360d0a686f73743a20<HONEYPOT>3a38340d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36","ja3":"124021aa6c4af1cc496a523c90674c0b","session":"10f6dfc1-164b-4f84-a7ee-35f24d3e4168","seq":14,"duration_ms":4172,"bytes_in":2528,"bytes_out":1078},{"timestamp":"2026-09-06T12:57:08","port":84,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:84\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"/81.254_backup.sql.bz2","summary":"","payload_hex":"474554202f38312e3235345f6261636b75702e73716c2e627a3220485454502f312e310d0a6163636570743a202a2f2a0d0a757365722d6167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132342e30205361666172692f3533372e33360d0a686f73743a20<HONEYPOT>3a38340d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36","ja3":"8f5d5d0329dfa9fb35b23bd52477394f","session":"0ae6e042-4cd9-4b7e-a231-fbc0a1e87ae8","seq":16,"duration_ms":4936,"bytes_in":2868,"bytes_out":1232},{"timestamp":"2026-09-06T12:57:08","port":84,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:84\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"/backups/81.254.sql","summary":"","payload_hex":"474554202f6261636b7570732f38312e3235342e73716c20485454502f312e310d0a6163636570743a202a2f2a0d0a757365722d6167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132342e30205361666172692f3533372e33360d0a686f73743a20<HONEYPOT>3a38340d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36","ja3":"f04f01a8240c92542d71ebec2450dde1","session":"ca5d0e1e-fb5a-4936-9f99-3de63b25a491","seq":17,"duration_ms":5223,"bytes_in":3067,"bytes_out":1309},{"timestamp":"2026-09-06T12:57:08","port":84,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:84\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"/81.254.sql.bz2","summary":"","payload_hex":"474554202f38312e3235342e73716c2e627a3220485454502f312e310d0a6163636570743a202a2f2a0d0a757365722d6167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132342e30205361666172692f3533372e33360d0a686f73743a20<HONEYPOT>3a38340d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36","ja3":"fb5d143e512cc02eea154ad3cd798f4c","session":"400f182d-1317-4c91-899b-d78d71b52239","seq":17,"duration_ms":5217,"bytes_in":3083,"bytes_out":1309}],"http_methods":[{"method":"GET","count":2555}],"distinct_ports_total":1,"top_paths":[{"path":"/export.tar.xz","count":1,"ports":1},{"path":"/upload.gz","count":1,"ports":1},{"path":"/dist.zip","count":1,"ports":1},{"path":"/tokens.zst","count":1,"ports":1},{"path":"/archive.bz2","count":1,"ports":1},{"path":"/artifacts.tar","count":1,"ports":1},{"path":"/sites.rar","count":1,"ports":1},{"path":"/sites.7z","count":1,"ports":1},{"path":"/opencart.sql.gz","count":1,"ports":1},{"path":"/certs.tar.bz2","count":1,"ports":1},{"path":"/preprod.rar","count":1,"ports":1},{"path":"/file.tar","count":1,"ports":1},{"path":"/package.zip","count":1,"ports":1},{"path":"/service.rar","count":1,"ports":1},{"path":"/private.tar.bz2","count":1,"ports":1}],"distinct_paths_total":200,"top_snis":[],"top_hosts":[],"top_alpns":[{"value":"http/1.1","count":2555}],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","Host","User-Agent"],"representative":[{"name":"Accept","value":"*/*","notable":false},{"name":"Host","value":"<HONEYPOT>:84","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36","notable":false}],"distinct_sets":1,"events_with_headers":10},"tags":[],"data_as_of":"2026-09-22T16:45:53.099087+00:00"}