{"ip":"41.143.201.169","total_events":2,"verdict":{"verdict":"scanning","label":"Scanning for known vulnerabilities","detail":"1 exploit-path probe(s)","confidence":"medium","network_type":null,"why":["1 request(s) matched a known exploit path.","Only GET/HEAD seen, no request body: scanning for the vulnerability, not delivering a payload.","Not in any known-scanner range."],"engagement":{"level":"request","label":"Request traffic","detail":"131 bytes sent","bytes_sent":131,"session_seconds":0,"persistent":false}},"first_seen":"2026-09-27T07:03:57","last_seen":"2026-09-27T07:04:26","events_24h":0,"events_7d":2,"geo":{"country_code":"MA","country_name":"Morocco","region":"Rabat-Salé-Kénitra","city":"Kenitra","lat":34.2619,"lon":-6.5821,"asn":36903,"org":"Office National des Postes et Telecommunications ONPT (Maroc Telecom) / IAM"},"source_domain":null,"known_scanners":[],"scanner_tag":null,"cve_matches":[],"malware":[],"top_ports":[{"port":443,"proto":"tcp","label":"HTTPS","count":2}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13d301100_1d37bd780c83_8e6e362c5eac"],"tls_client_hello":"160301060e0100060a0303f1cf88752a232316fa56f073f000749b31263ce20fabcf852ba54ca593fb9245200ba527441625d366f2a385df114582f711ffdd7a723c898de78caca10e31ee72003c130213031301c02cc030009fcca9cca8ccaac02bc02f009ec024c028006bc023c0270067c00ac0140039c009c0130033009d009c003d003c0035002f01000585ff010001000000001d001b0000187069686f6c652e6368696361676f2e76706e69676f2e6465000b00020100000a0012001011ec001d0017001e0018001901000101002300000016000000170000000d0036003409050906090404030503060308070808081a081b081c0809080a080b080408050806040105010601030303010302040205020602002b00050403040303002d00020101003304ea04e811ec04c0dde541fcb698727c553f7c981a77ba91919207490a5da322eda9919eeb14c8906669e3a948d82a9dbc240cbc80e37c567994a588e4cbb36953e3185382441fc5dbb3871977dbf05b41bb16ce2970462704f124c28574b548e44cb2e550de08a39f595c0160a37d1c074d8a60b0132d345563295bad2d813cb207b03d68cc2c188d5e6a0010d6cf087685dcc397783c67eb57592944c25f31a7b79075af2c509ebac539497f4e624a322c608fe0aa413b8ced282e2b883d1adca52ef365591689bbfcaa5648c18999c5dd354914bcb850cb9566b8aea71cb8100a6ce6a8761dc48835204d93b096a4b98cd46a550a84cf3012a3dbf31f5b83c6e8a5b5f1f3ac062ac8c197b286fa558b6805fee0bdc69b0a4ed875dc4661fb87844ab555f630696d0c88427cb3e07cc1eda4212e8022e3d76c0db70a70d7a2ac80398df2ad208471c3fa717c66303c720b77a90718fa389ef868ade5255ce279601b68eedb39363045a4e4675f15aff8e3175acbc89113665bcc1714431632e457cc91c849d8931069a1f9f88b0864b75ff62a321c1c61734f563b6a7f196378627d43a9cf1195a620c23f1336cf72820461551480769bca643db076adab0c119a118e7f92180ab10a3d4119ef12c5673807a833381f3c744d60ba51a70b6c461ddf7c1c836b4e1bc12a2404b18f570bfe45a0ceb8474fe3813f169275125399a06b3d5a02d4117b689423735600315633152528cd0a04e4da663ad1c9f85c72d412233bb97817e4989ca19d1a35be162a6e6efab7c0bb90e157aa4d6a6a34b02ae698486d119ff06a2cfd23ca33ca73207976d4465e47e90b7b2214fd6747453605ac91bcfbb4c3857a2142566429038f1db05050fa5c256419d5002218d0883aac7e3dbbbb0ee27ae242c3bd6a7b05804634c56c19f391de7354be1609ec760f4965069723068d1276a883360e8bb22af11ba6661d55e312bf2c7a8d4cc71818abd05ca694c332cc1b11c059809d244c30e53586427b86b232fe4933c2618b7e8513e4d416818672756460eed12a1db0a942e97a0f47843e27a262a710b19717bcbb383aa68f6ed2baf5865e77b9053a630eb704be61a23f9592870190459ff87e2da6938493cf7b21172b008043b5221b44685dea3f6113cc5f027059fc30b6a85dde2863b0466b0cc01d0e397d3d760dcf5876bb5b2adf491f9006b42269b34374cffac8689f719986b4996cc84cb3a378cf9c4854926e70c776a2c753e3f521218715a1634e9c134d0efaa1af935468b09b6c82a5d242387b923bc83991651149a0eb594c1bbf330c642b8417e27c075d84ad7f22521153560874b6bd0479197c8b0ed525eb228559019048d9c84adb78d6188b29692d62ab65111954cdbc86cdb00a0d72735d904d5290010b0233950499addb8ba04887deb92d52a89289485dd98b1528a4349a47152dc488070c7d6be1479e092fa0e11ed4b9cc35a1755b102f55d93b95a68ca8971ff244a8729cc0619bcbcb4c0f837b18ac8ab7f3798049173965e4a51dfc18556057b608a016da1a46fa02dac3c47ac335eed631f1313e0cfc92a5e6481151ad14c6875b3428a4511d90264895e613a9fc07149149042b290807b4b94373a65f9490b45ce7648e9ad005b3ecfc0f7265b5004ceb6057fafe74f3ce8235848e866647f54e456fae5c81fa481ae8b1e75f3155d09054440a978bc926001d002064a52c59cb383c77e6054c7d9e40c750f2171118278446c78643c866","tls_ja3":["0b85eb0d4981e69064e40753e4f0ac5f"],"http_akin":["b11cun020_00040004_1cae80d4"]},"fingerprint_peers":{"t13d301100_1d37bd780c83_8e6e362c5eac":1,"b11cun020_00040004_1cae80d4":14},"akin_families":{},"user_agents":[],"timeline":[{"date":"2026-09-27","count":2}],"recent_events":[{"timestamp":"2026-09-27T07:04:26","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"pihole.chicago.vpnigo.de","headers":"{\"accept\":\"*/*\",\"host\":\"pihole.chicago.vpnigo.de\"}","body":"","sni":"pihole.chicago.vpnigo.de","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/.env","summary":"","payload_hex":"474554202f2e656e7620485454502f312e310d0a6163636570743a202a2f2a0d0a686f73743a207069686f6c652e6368696361676f2e76706e69676f2e64650d0a0d0a","method":"GET","user_agent":"","ja3":"0b85eb0d4981e69064e40753e4f0ac5f","session":"66baf426-770b-4b9b-aee4-d55f3b665c06","seq":1,"duration_ms":100,"bytes_in":67,"bytes_out":79},{"timestamp":"2026-09-27T07:03:57","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"vpn.chicago.vpnigo.de","headers":"{\"accept\":\"*/*\",\"host\":\"vpn.chicago.vpnigo.de\"}","body":"","sni":"vpn.chicago.vpnigo.de","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/.env","summary":"","payload_hex":"474554202f2e656e7620485454502f312e310d0a6163636570743a202a2f2a0d0a686f73743a2076706e2e6368696361676f2e76706e69676f2e64650d0a0d0a","method":"GET","user_agent":"","ja3":"0b85eb0d4981e69064e40753e4f0ac5f","session":"cf382395-2f3e-43ee-88ce-c710bc13db82","seq":1,"duration_ms":100,"bytes_in":64,"bytes_out":79}],"http_methods":[{"method":"GET","count":2}],"distinct_ports_total":1,"top_paths":[{"path":"/.env","count":2,"ports":1}],"distinct_paths_total":1,"top_snis":[{"value":"pihole.chicago.vpnigo.de","count":1},{"value":"vpn.chicago.vpnigo.de","count":1}],"top_hosts":[{"value":"pihole.chicago.vpnigo.de","count":1},{"value":"vpn.chicago.vpnigo.de","count":1}],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","Host"],"representative":[{"name":"Accept","value":"*/*","notable":false},{"name":"Host","value":"pihole.chicago.vpnigo.de","notable":false}],"distinct_sets":1,"events_with_headers":2},"tags":[],"data_as_of":"2026-09-30T17:18:26.234112+00:00"}