{"ip":"35.241.95.119","total_events":347,"verdict":{"verdict":"scanning","label":"Scanning for known vulnerabilities","detail":"36 exploit-path probe(s)","confidence":"medium","network_type":null,"why":["36 request(s) matched a known exploit path.","Only GET/HEAD seen, no request body: scanning for the vulnerability, not delivering a payload.","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"104,375 bytes sent","bytes_sent":104375,"session_seconds":5,"persistent":false}},"first_seen":"2026-08-31T03:33:42","last_seen":"2026-08-31T03:33:46","events_24h":0,"events_7d":347,"geo":{"country_code":"HK","country_name":"Hong Kong","region":"","city":"Hong Kong","lat":22.2842,"lon":114.1759,"asn":396982,"org":"Google LLC"},"source_domain":"119.95.241.35.bc.googleusercontent.com","known_scanners":[],"scanner_tag":{"key":"gcp","label":"Google Cloud","category":"hosting_provider","url":"https://cloud.google.com/"},"cve_matches":[{"cve_id":"CVE-2024-4836","title":"Edito CMS - Sensitive Data Leak","severity":"high","actively_exploited":false,"match_field":"url_path","matched_pattern":"/config/config.php"}],"malware":[],"top_ports":[{"port":32000,"proto":"tcp","label":"","count":347}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i1010h1_61a7ad8aa9b6_792d2c6655cb","t13i1010h1_61a7ad8aa9b6_3a8073edd8ef"],"tls_ja3":["1dbe67ed35f1123131b2e4e727f16f36","eda874a76b9e575da1051f7499c43f02","7d6e86aaaa5607f08fb09dfdd72f401f","e03779e102bcb63f63aede062b44decc","356a6f5ed37326134a03dddb99480f22"],"ja4h":["ge11nn0300_341eb0d8946c"]},"fingerprint_peers":{"t13i1010h1_61a7ad8aa9b6_792d2c6655cb":329,"t13i1010h1_61a7ad8aa9b6_3a8073edd8ef":1838,"ge11nn0300_341eb0d8946c":2499},"user_agents":["Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36"],"timeline":[{"date":"2026-08-31","count":347}],"recent_events":[{"timestamp":"2026-08-31T03:33:46","port":32000,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:32000\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"/settings/base.py","summary":"","payload_hex":"474554202f73657474696e67732f626173652e707920485454502f312e310d0a6163636570743a202a2f2a0d0a757365722d6167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132342e30205361666172692f3533372e33360d0a686f73743a20<HONEYPOT>3a33323030300d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36","ja3":"24a432a277d85963f528595aea02974a","session":"d1493e7d-1fa5-41de-9658-6937d8817709","seq":3,"duration_ms":1721,"bytes_in":561,"bytes_out":234},{"timestamp":"2026-08-31T03:33:46","port":32000,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:32000\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"/values.yaml","summary":"","payload_hex":"474554202f76616c7565732e79616d6c20485454502f312e310d0a6163636570743a202a2f2a0d0a757365722d6167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132342e30205361666172692f3533372e33360d0a686f73743a20<HONEYPOT>3a33323030300d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36","ja3":"d6ecaf68729e076fcb02ab74abdcd0a5","session":"70ab88a3-b1a5-4fe1-b590-fbe2349fafc9","seq":4,"duration_ms":2299,"bytes_in":730,"bytes_out":312},{"timestamp":"2026-08-31T03:33:46","port":32000,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:32000\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"/mc/config.json","summary":"","payload_hex":"474554202f6d632f636f6e6669672e6a736f6e20485454502f312e310d0a6163636570743a202a2f2a0d0a757365722d6167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132342e30205361666172692f3533372e33360d0a686f73743a20<HONEYPOT>3a33323030300d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36","ja3":"56f88d67987d4cda762547abc69c800d","session":"6c667035-bcd6-434a-a561-ee41bae4eef6","seq":2,"duration_ms":1196,"bytes_in":368,"bytes_out":156},{"timestamp":"2026-08-31T03:33:46","port":32000,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:32000\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"/kubeconfig","summary":"","payload_hex":"474554202f6b756265636f6e66696720485454502f312e310d0a6163636570743a202a2f2a0d0a757365722d6167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132342e30205361666172692f3533372e33360d0a686f73743a20<HONEYPOT>3a33323030300d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36","ja3":"ee91c3e4b335aa69d03041c342b7b5f9","session":"f7d5e156-bffd-442f-8f43-633ad3183cb5","seq":2,"duration_ms":1202,"bytes_in":364,"bytes_out":156},{"timestamp":"2026-08-31T03:33:46","port":32000,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:32000\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"/kubernetes/secrets.yml","summary":"","payload_hex":"474554202f6b756265726e657465732f736563726574732e796d6c20485454502f312e310d0a6163636570743a202a2f2a0d0a757365722d6167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132342e30205361666172692f3533372e33360d0a686f73743a20<HONEYPOT>3a33323030300d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36","ja3":"4c20315f1d91d126991644f7faf77327","session":"6d357f24-4a36-4f54-beba-82d6e625c4e2","seq":2,"duration_ms":1201,"bytes_in":375,"bytes_out":156},{"timestamp":"2026-08-31T03:33:46","port":32000,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:32000\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"/kubernetes.yaml","summary":"","payload_hex":"474554202f6b756265726e657465732e79616d6c20485454502f312e310d0a6163636570743a202a2f2a0d0a757365722d6167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132342e30205361666172692f3533372e33360d0a686f73743a20<HONEYPOT>3a33323030300d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36","ja3":"2f0d5b5eb6eb1f19a7f639e7e0989928","session":"601ebaff-b8d3-45a7-9040-65a208315127","seq":3,"duration_ms":1895,"bytes_in":552,"bytes_out":234},{"timestamp":"2026-08-31T03:33:46","port":32000,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:32000\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"/kubernetes.yml","summary":"","payload_hex":"474554202f6b756265726e657465732e796d6c20485454502f312e310d0a6163636570743a202a2f2a0d0a757365722d6167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132342e30205361666172692f3533372e33360d0a686f73743a20<HONEYPOT>3a33323030300d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36","ja3":"fa4af9f201f29799b33044842c5d9ca6","session":"f7ee4e37-8944-4237-a1e9-2f1a8c11539e","seq":3,"duration_ms":1900,"bytes_in":550,"bytes_out":234},{"timestamp":"2026-08-31T03:33:46","port":32000,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:32000\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"/laravel.log","summary":"","payload_hex":"474554202f6c61726176656c2e6c6f6720485454502f312e310d0a6163636570743a202a2f2a0d0a757365722d6167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132342e30205361666172692f3533372e33360d0a686f73743a20<HONEYPOT>3a33323030300d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36","ja3":"e8a1dbea56e46af4eac81a15b0d87e7f","session":"d0643c86-5b80-4d24-912f-f860c3d823ee","seq":3,"duration_ms":1886,"bytes_in":541,"bytes_out":234},{"timestamp":"2026-08-31T03:33:46","port":32000,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:32000\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"/local-config.php","summary":"","payload_hex":"474554202f6c6f63616c2d636f6e6669672e70687020485454502f312e310d0a6163636570743a202a2f2a0d0a757365722d6167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132342e30205361666172692f3533372e33360d0a686f73743a20<HONEYPOT>3a33323030300d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36","ja3":"433f0f21bf7f8fda0f34b8ff646c50ea","session":"7f8f9d7f-1db2-4563-b315-4d56d7a36889","seq":3,"duration_ms":1887,"bytes_in":560,"bytes_out":234},{"timestamp":"2026-08-31T03:33:46","port":32000,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:32000\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"/log/debug.log","summary":"","payload_hex":"474554202f6c6f672f64656275672e6c6f6720485454502f312e310d0a6163636570743a202a2f2a0d0a757365722d6167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132342e30205361666172692f3533372e33360d0a686f73743a20<HONEYPOT>3a33323030300d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36","ja3":"eda874a76b9e575da1051f7499c43f02","session":"077cda4c-04f0-474f-bfa7-b06702839def","seq":4,"duration_ms":4502,"bytes_in":737,"bytes_out":312}],"http_methods":[{"method":"GET","count":347}],"distinct_ports_total":1,"top_paths":[{"path":"/bucket/phpinfo.php","count":1,"ports":1},{"path":"/backend/docker-compose.prod.yml","count":1,"ports":1},{"path":"/backend/application.properties","count":1,"ports":1},{"path":"/backend/docker-compose.yml","count":1,"ports":1},{"path":"/config/service-account.json","count":1,"ports":1},{"path":"/docker-compose.local.yml","count":1,"ports":1},{"path":"/devops/docker-compose.yml","count":1,"ports":1},{"path":"/config/docker-compose.yml","count":1,"ports":1},{"path":"/.github/workflows/production.yml","count":1,"ports":1},{"path":"/infrastructure/terraform.tfvars","count":1,"ports":1},{"path":"/helm/values-production.yaml","count":1,"ports":1},{"path":"/backend/actuator/heapdump","count":1,"ports":1},{"path":"/api/actuator/configprops","count":1,"ports":1},{"path":"/application/config/config.php","count":1,"ports":1},{"path":"/deploy/service-account.json","count":1,"ports":1}],"distinct_paths_total":200,"top_snis":[],"top_hosts":[],"top_alpns":[{"value":"http/1.1","count":347}],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","Host","User-Agent"],"representative":[{"name":"Accept","value":"*/*","notable":false},{"name":"Host","value":"<HONEYPOT>:32000","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36","notable":false}],"distinct_sets":1,"events_with_headers":10},"tags":[{"tag_id":"CVE-2024-4836","tag_type":"cve","title":"Edito CMS - Sensitive Data Leak","severity":"high","actively_exploited":false,"match_field":"url_path","matched_pattern":"/config/config.php","reference_urls":["https://cert.pl/en/posts/2024/07/CVE-2024-4836/","https://github.com/sleep46/CVE-2024-4836_Check","https://nvd.nist.gov/vuln/detail/CVE-2024-4836"]}],"data_as_of":"2026-09-04T20:57:08.781503+00:00"}