{"ip":"35.188.55.233","total_events":1256,"verdict":{"verdict":"scanning","label":"Scanning for known vulnerabilities","detail":"18 exploit-path probe(s)","confidence":"medium","network_type":null,"why":["18 request(s) matched a known exploit path.","Only GET/HEAD seen, no request body: scanning for the vulnerability, not delivering a payload.","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"247,841 bytes sent","bytes_sent":247841,"session_seconds":0,"persistent":false}},"first_seen":"2026-09-05T07:26:22","last_seen":"2026-09-07T20:48:53","events_24h":0,"events_7d":0,"geo":{"country_code":"US","country_name":"United States","region":"Iowa","city":"Council Bluffs","lat":41.2591,"lon":-95.8517,"asn":396982,"org":"Google LLC"},"source_domain":"233.55.188.35.bc.googleusercontent.com","known_scanners":[],"scanner_tag":{"key":"gcp","label":"Google Cloud","category":"hosting_provider","url":"https://cloud.google.com/"},"cve_matches":[],"malware":[],"top_ports":[{"port":16686,"proto":"tcp","label":"","count":93},{"port":7676,"proto":"tcp","label":"","count":93},{"port":6080,"proto":"tcp","label":"","count":93},{"port":20080,"proto":"tcp","label":"","count":93},{"port":8140,"proto":"tcp","label":"","count":93},{"port":8600,"proto":"tcp","label":"","count":93},{"port":1443,"proto":"tcp","label":"","count":93},{"port":8040,"proto":"tcp","label":"","count":93},{"port":9005,"proto":"tcp","label":"","count":93},{"port":7007,"proto":"tcp","label":"","count":93},{"port":9901,"proto":"tcp","label":"","count":93},{"port":9443,"proto":"tcp","label":"","count":85},{"port":7979,"proto":"tcp","label":"","count":72},{"port":6443,"proto":"tcp","label":"k8s API","count":38},{"port":7171,"proto":"tcp","label":"","count":19}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":[]},"fingerprint_peers":{},"user_agents":["crusader-worker/1.0","Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36"],"timeline":[{"date":"2026-09-05","count":38},{"date":"2026-09-07","count":1218}],"recent_events":[{"timestamp":"2026-09-07T20:48:53","port":9901,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:9901\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/phpinfo.php","summary":"","payload_hex":"474554202f706870696e666f2e70687020485454502f312e310d0a6163636570743a202a2f2a0d0a757365722d6167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132342e30205361666172692f3533372e33360d0a686f73743a20<HONEYPOT>3a393930310d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36","ja3":"","session":"2940a7d9-302a-469d-b02f-0c6181458fd7","seq":1,"duration_ms":102,"bytes_in":180,"bytes_out":78},{"timestamp":"2026-09-07T20:48:53","port":9901,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:9901\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/config.json","summary":"","payload_hex":"474554202f636f6e6669672e6a736f6e20485454502f312e310d0a6163636570743a202a2f2a0d0a757365722d6167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132342e30205361666172692f3533372e33360d0a686f73743a20<HONEYPOT>3a393930310d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36","ja3":"","session":"77825e8f-959a-425d-83f4-ac3b7fa98448","seq":1,"duration_ms":100,"bytes_in":180,"bytes_out":78},{"timestamp":"2026-09-07T20:48:53","port":9901,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:9901\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/config.js","summary":"","payload_hex":"474554202f636f6e6669672e6a7320485454502f312e310d0a6163636570743a202a2f2a0d0a757365722d6167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132342e30205361666172692f3533372e33360d0a686f73743a20<HONEYPOT>3a393930310d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36","ja3":"","session":"a12392ea-449a-4ee3-9769-6a308f2feefb","seq":1,"duration_ms":100,"bytes_in":178,"bytes_out":78},{"timestamp":"2026-09-07T20:48:53","port":9901,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:9901\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/api/phpinfo.php","summary":"","payload_hex":"474554202f6170692f706870696e666f2e70687020485454502f312e310d0a6163636570743a202a2f2a0d0a757365722d6167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132342e30205361666172692f3533372e33360d0a686f73743a20<HONEYPOT>3a393930310d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36","ja3":"","session":"484763f9-39c1-455e-9f29-eef1a9b252ac","seq":1,"duration_ms":100,"bytes_in":184,"bytes_out":78},{"timestamp":"2026-09-07T20:48:53","port":9901,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:9901\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/info.php","summary":"","payload_hex":"474554202f696e666f2e70687020485454502f312e310d0a6163636570743a202a2f2a0d0a757365722d6167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132342e30205361666172692f3533372e33360d0a686f73743a20<HONEYPOT>3a393930310d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36","ja3":"","session":"eeadc4b5-8b31-48b3-8284-151ffda81cc0","seq":1,"duration_ms":100,"bytes_in":177,"bytes_out":78},{"timestamp":"2026-09-07T20:48:53","port":9901,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:9901\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/appsettings.json","summary":"","payload_hex":"474554202f61707073657474696e67732e6a736f6e20485454502f312e310d0a6163636570743a202a2f2a0d0a757365722d6167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132342e30205361666172692f3533372e33360d0a686f73743a20<HONEYPOT>3a393930310d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36","ja3":"","session":"8f548376-0a06-47f9-bdb8-6d09a8102228","seq":1,"duration_ms":100,"bytes_in":185,"bytes_out":78},{"timestamp":"2026-09-07T20:48:53","port":9901,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:9901\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/api/aws.json","summary":"","payload_hex":"474554202f6170692f6177732e6a736f6e20485454502f312e310d0a6163636570743a202a2f2a0d0a757365722d6167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132342e30205361666172692f3533372e33360d0a686f73743a20<HONEYPOT>3a393930310d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36","ja3":"","session":"51c230a2-ceec-4240-9874-d14e0cad3eac","seq":1,"duration_ms":100,"bytes_in":181,"bytes_out":78},{"timestamp":"2026-09-07T20:48:53","port":9901,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:9901\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/auth.json","summary":"","payload_hex":"474554202f617574682e6a736f6e20485454502f312e310d0a6163636570743a202a2f2a0d0a757365722d6167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132342e30205361666172692f3533372e33360d0a686f73743a20<HONEYPOT>3a393930310d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36","ja3":"","session":"02d983ec-0100-4df6-9ef2-9345714e31fa","seq":1,"duration_ms":101,"bytes_in":178,"bytes_out":78},{"timestamp":"2026-09-07T20:48:53","port":9901,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:9901\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/admin/phpinfo.php","summary":"","payload_hex":"474554202f61646d696e2f706870696e666f2e70687020485454502f312e310d0a6163636570743a202a2f2a0d0a757365722d6167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132342e30205361666172692f3533372e33360d0a686f73743a20<HONEYPOT>3a393930310d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36","ja3":"","session":"ab5c0d95-d641-43c2-8783-b98d2dfd63f8","seq":1,"duration_ms":100,"bytes_in":186,"bytes_out":78},{"timestamp":"2026-09-07T20:48:53","port":9901,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:9901\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/Admin/phpinfo.php","summary":"","payload_hex":"474554202f41646d696e2f706870696e666f2e70687020485454502f312e310d0a6163636570743a202a2f2a0d0a757365722d6167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132342e30205361666172692f3533372e33360d0a686f73743a20<HONEYPOT>3a393930310d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36","ja3":"","session":"ced89664-6fe7-4ac1-9c99-b3d3c1c01fe8","seq":1,"duration_ms":100,"bytes_in":186,"bytes_out":78}],"http_methods":[{"method":"GET","count":1256}],"distinct_ports_total":16,"top_paths":[{"path":"/.aider.conf.yml","count":14,"ports":14},{"path":"/.aider.model.settings.yml","count":14,"ports":14},{"path":"/.claude/.credentials.json","count":14,"ports":14},{"path":"/.openai","count":14,"ports":14},{"path":"/.cursor/mcp.json","count":14,"ports":14},{"path":"/.continue/config.ts","count":14,"ports":14},{"path":"/.cursor/config.json","count":14,"ports":14},{"path":"/.codeium/settings.json","count":14,"ports":14},{"path":"/.vscode/mcp.json","count":14,"ports":14},{"path":"/.litellm/config.yaml","count":14,"ports":14},{"path":"/.aider.env","count":14,"ports":14},{"path":"/.mcp.json","count":14,"ports":14},{"path":"/mcp_config.json","count":14,"ports":14},{"path":"/.claude.json","count":14,"ports":14},{"path":"/.codeium/windsurf/mcp_config.json","count":14,"ports":14}],"distinct_paths_total":112,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","Host","User-Agent"],"representative":[{"name":"Accept","value":"*/*","notable":false},{"name":"Host","value":"<HONEYPOT>:9901","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36","notable":false}],"distinct_sets":1,"events_with_headers":10},"tags":[],"data_as_of":"2026-09-22T22:29:45.250964+00:00"}