{"ip":"43.128.70.35","data_as_of":"2026-10-24T08:45:50+00:00","observed":true,"total_events":80,"verdict":{"verdict":"scanning","label":"Scanning for known vulnerabilities","detail":"25 exploit-path probe(s)","confidence":"medium","network_type":"CDN","why":["25 request(s) matched a known exploit path.","Only GET and HEAD requests were seen, with no body, which reads as a check for the vulnerability without a payload.","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"10,001 bytes sent","bytes_sent":10001,"session_seconds":0,"persistent":false},"basis":"first_contact"},"first_seen":"2026-10-08T00:24:58","last_seen":"2026-10-16T00:55:40","events_24h":0,"events_7d":0,"interactive_sessions":0,"interactive_sessions_24h":0,"interactive_sessions_7d":0,"interactive_protocols":[],"geo":{"country_code":"SG","country_name":"Singapore","region":"","city":"Singapore","lat":1.2872,"lon":103.8507,"asn":132203,"org":"Tencent Building, Kejizhongyi Avenue"},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as132203","label":"Tencent Global","category":"cdn","url":"https://www.peeringdb.com/asn/132203"},"cve_matches":[],"malware":[],"udp":null,"interaction":null,"top_ports":[{"port":8080,"proto":"tcp","label":"HTTP-alt","count":54},{"port":80,"proto":"tcp","label":"HTTP","count":26}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":["b11cun040_00040013_608dab68"],"interactive":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[]}},"fingerprint_peers":{"b11cun040_00040013_608dab68":4346},"akin_families":{},"user_agents":["Mozilla/5.0"],"timeline":[{"date":"2026-10-08","count":54},{"date":"2026-10-16","count":26}],"recent_events":[{"timestamp":"2026-10-16T00:55:40","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"identity\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:80\",\"user-agent\":\"Mozilla/5.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/config.backup","summary":"","payload_hex":"474554202f636f6e6669672e6261636b757020485454502f312e310d0a4163636570742d456e636f64696e673a206964656e746974790d0a486f73743a20<HONEYPOT>3a38300d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0","ja3":"","session":"97191168-57dd-47be-b7b5-d4b8ebe9af09","seq":1,"duration_ms":100,"bytes_in":126,"bytes_out":77},{"timestamp":"2026-10-16T00:55:40","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"identity\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:80\",\"user-agent\":\"Mozilla/5.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/old/.env","summary":"","payload_hex":"474554202f6f6c642f2e656e7620485454502f312e310d0a4163636570742d456e636f64696e673a206964656e746974790d0a486f73743a20<HONEYPOT>3a38300d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0","ja3":"","session":"40f62a46-5d40-45f7-b756-33fed5d6f0b0","seq":1,"duration_ms":100,"bytes_in":121,"bytes_out":77},{"timestamp":"2026-10-16T00:55:39","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"identity\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:80\",\"user-agent\":\"Mozilla/5.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/bak/.env","summary":"","payload_hex":"474554202f62616b2f2e656e7620485454502f312e310d0a4163636570742d456e636f64696e673a206964656e746974790d0a486f73743a20<HONEYPOT>3a38300d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0","ja3":"","session":"66b86c1f-ad77-4bd5-a6ee-97aba3d67164","seq":1,"duration_ms":100,"bytes_in":121,"bytes_out":77},{"timestamp":"2026-10-16T00:55:39","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"identity\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:80\",\"user-agent\":\"Mozilla/5.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/backups/.env","summary":"","payload_hex":"474554202f6261636b7570732f2e656e7620485454502f312e310d0a4163636570742d456e636f64696e673a206964656e746974790d0a486f73743a20<HONEYPOT>3a38300d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0","ja3":"","session":"e3c4edf0-e3e7-4287-bed1-d0b88bdd1840","seq":1,"duration_ms":100,"bytes_in":125,"bytes_out":77},{"timestamp":"2026-10-16T00:55:38","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"identity\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:80\",\"user-agent\":\"Mozilla/5.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/backup/.env","summary":"","payload_hex":"474554202f6261636b75702f2e656e7620485454502f312e310d0a4163636570742d456e636f64696e673a206964656e746974790d0a486f73743a20<HONEYPOT>3a38300d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0","ja3":"","session":"cd9cbedb-e6be-42ad-8942-2411773d292f","seq":1,"duration_ms":100,"bytes_in":124,"bytes_out":77},{"timestamp":"2026-10-16T00:55:38","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"identity\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:80\",\"user-agent\":\"Mozilla/5.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/home/deploy/.env","summary":"","payload_hex":"474554202f686f6d652f6465706c6f792f2e656e7620485454502f312e310d0a4163636570742d456e636f64696e673a206964656e746974790d0a486f73743a20<HONEYPOT>3a38300d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0","ja3":"","session":"1c472a85-2466-47d6-a849-aa2c0f456988","seq":1,"duration_ms":100,"bytes_in":129,"bytes_out":77},{"timestamp":"2026-10-16T00:55:37","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"identity\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:80\",\"user-agent\":\"Mozilla/5.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/home/ubuntu/.env","summary":"","payload_hex":"474554202f686f6d652f7562756e74752f2e656e7620485454502f312e310d0a4163636570742d456e636f64696e673a206964656e746974790d0a486f73743a20<HONEYPOT>3a38300d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0","ja3":"","session":"70306f68-8627-4704-a67f-6a8798adb886","seq":1,"duration_ms":100,"bytes_in":129,"bytes_out":77},{"timestamp":"2026-10-16T00:55:37","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"identity\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:80\",\"user-agent\":\"Mozilla/5.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/var/www/html/.env","summary":"","payload_hex":"474554202f7661722f7777772f68746d6c2f2e656e7620485454502f312e310d0a4163636570742d456e636f64696e673a206964656e746974790d0a486f73743a20<HONEYPOT>3a38300d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0","ja3":"","session":"5e1e06fc-6f26-4cdf-8f6d-994fec6f86eb","seq":1,"duration_ms":100,"bytes_in":130,"bytes_out":77},{"timestamp":"2026-10-16T00:55:36","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"identity\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:80\",\"user-agent\":\"Mozilla/5.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/var/www/.env","summary":"","payload_hex":"474554202f7661722f7777772f2e656e7620485454502f312e310d0a4163636570742d456e636f64696e673a206964656e746974790d0a486f73743a20<HONEYPOT>3a38300d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0","ja3":"","session":"aa9e12bc-8ee7-4330-98be-6cf26fc358fb","seq":1,"duration_ms":100,"bytes_in":125,"bytes_out":77},{"timestamp":"2026-10-16T00:55:36","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"identity\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:80\",\"user-agent\":\"Mozilla/5.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/web/.env","summary":"","payload_hex":"474554202f7765622f2e656e7620485454502f312e310d0a4163636570742d456e636f64696e673a206964656e746974790d0a486f73743a20<HONEYPOT>3a38300d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0","ja3":"","session":"984e3d7a-3c90-4a20-bbe5-f6fed3cd7a22","seq":1,"duration_ms":100,"bytes_in":121,"bytes_out":77}],"http_methods":[{"method":"GET","count":80}],"distinct_ports_total":2,"top_paths":[{"path":"/.env","count":3,"ports":2},{"path":"/home/deploy/.env","count":3,"ports":2},{"path":"/srv/app/.env","count":3,"ports":2},{"path":"/.env.staging","count":3,"ports":2},{"path":"/old/.env","count":3,"ports":2},{"path":"/backup/.env","count":3,"ports":2},{"path":"/backups/.env","count":3,"ports":2},{"path":"/home/ubuntu/.env","count":3,"ports":2},{"path":"/bak/.env","count":3,"ports":2},{"path":"/app/.env","count":3,"ports":2},{"path":"/.env.prod","count":3,"ports":2},{"path":"/.env.dev","count":3,"ports":2},{"path":"/.env.local","count":3,"ports":2},{"path":"/api/.env","count":3,"ports":2},{"path":"/var/www/.env","count":3,"ports":2}],"distinct_paths_total":28,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept-Encoding","Connection","Host","User-Agent"],"representative":[{"name":"Accept-Encoding","value":"identity","notable":false},{"name":"Connection","value":"close","notable":false},{"name":"Host","value":"<HONEYPOT>:80","notable":false},{"name":"User-Agent","value":"Mozilla/5.0","notable":false}],"distinct_sets":1,"events_with_headers":10},"tags":[]}