{"ip":"45.138.12.14","total_events":585,"verdict":{"verdict":"scanning","label":"Scanning for known vulnerabilities","detail":"58 exploit-path probe(s)","confidence":"medium","network_type":null,"why":["58 request(s) matched a known exploit path.","Only GET/HEAD seen, no request body: scanning for the vulnerability, not delivering a payload.","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"1,306,125 bytes sent","bytes_sent":1306125,"session_seconds":39,"persistent":false}},"first_seen":"2026-09-21T02:18:13","last_seen":"2026-10-03T20:51:27","events_24h":0,"events_7d":584,"geo":{"country_code":"LT","country_name":"Lithuania","region":"","city":"","lat":55.4167,"lon":24.0,"asn":218785,"org":"Tc Datacenter Limited"},"source_domain":null,"known_scanners":[],"scanner_tag":null,"cve_matches":[{"cve_id":"CVE-2024-44000","title":"LiteSpeed Cache <= 6.4.1 - Sensitive Information Exposure","severity":"high","actively_exploited":false,"match_field":"url_path","matched_pattern":"/wp-content/debug.log"},{"cve_id":"CVE-2024-50340","title":"Symfony Profiler - Remote Access via Injected Arguments","severity":"high","actively_exploited":false,"match_field":"url_path","matched_pattern":"/_profiler/phpinfo"}],"malware":[],"udp":null,"top_ports":[{"port":3306,"proto":"tcp","label":"MySQL","count":584},{"port":9000,"proto":"tcp","label":"Web-alt","count":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i131000_f57a46bbacb6_e5728521abd4"],"tls_client_hello":"16030105c6010005c20303261070dc0d5f234cd0ddb190138f3723cdcb10ea77cae74bea2d18dd56d8146f20885184588eaedca490e93c969a0488f58d349f039e5c6c5fdde302625bb2222e001ac02bc02fc02cc030cca9cca8c009c013c00ac0141301130213030100055f000b00020100ff010001000017000000120000000500050100000000000a000c000a11ec001d001700180019000d001a00180804040308070805080604010501060105030603020102030032001a0018080404030807080508060401050106010503060302010203002b00050403040303003304ea04e811ec04c0faeb9d5df998b2960c39748cc817a0f5760846f172031c9808e2c55dd469b0c584dc5b228eea935b178dd2b84caf2975c7a3160b9a3fa81672dd4142e8dc5a9c5a8d94758c4a278ab771552a0b8b88e47a5b491259a047ece962a5e25c39c7a417a242bc92253c26c096fa77092b12abc0cd2b15ac6e6a7401826cfa790a9fd068ed47702e3140d4cbc485d732593c04fdcb77e1db9b6bb714e13833a3e14880b888726badebeca502a4c361276791eb1ed45c03236c129ce82445954f04b8c52431add4d6b3b8813516f40b9c449b9ee667711804c5472eeeaa4aa2313abb37b98987b2501478ca9439aae668ce1b9c00016eb75968bbeb52662a9c57d57228928c2c6a39312748717721c1320b3fca44c12a78a042923851445eec13046236bb554f5766bca35ca4c455baabba14e2c389f18cb17815aa2010908fe6693f830260d76bab0bb5a40839eb868f7c9048add880f1e21e556626de5121d561630b2261a0313c1df8978b29785b5cb0bd181af9069467c69db915232d436b01f7c502905043d956d692043d784284900941f6936b0acc1c867ac54010c1cba273b541b5c02ea023087371358f5a876fd0b3dc27b1c005bdac859799d23b17b3192ff825c9628f0d483d97453309ac2fcf8336ca819e6e8882c6b572d81b655554939b61100560a42251c0a583c951f085ab07beafa47c29470612c62e545884e0b9ad3102a18589a369d733bd4a8afaebb4c5773c5aa771e47149a4f712b5a472a586756e6b1946992e0642a4b9cc31c9947ad4838a5f134e5174366d03c61054bea9628b4855abf3059410eaae928305af869882145f1e9a72b810a8eaa6c10bbb0fcc28478488a4344b5c11f3c331c8b9970607b0028c661ca6e5856ec2830dea5c90c4f3a7d7311abcf0bf7b588a72288b4e696cac6c4cdcf24ce85aa1189b6ca0f3676e689b96290429887402c3379b5762255a5096a14a1bf82a05136d2b1612e5448bf720a128e68c4c4807cc80bdf997516af90d958441f1b17b4865b133ca924e8a6ec8265576d4952c59a737bb918af44c41f1cfe33b0f546b6340a18a909428fed958d62627fd287a57eab9d04a39390a13ec65995b408811d869f0fb25e1a77ed4fb3fe6a41335b7cf4e86377ad8621f8052709b0650735c4c275b024483e84bb436f325be21cbe15bcbdb94c4790160b9d24eacb39b594cbe4c5c4c269c4d64f9ae59c7957cc52cf2b28d05fc2a1c640971db0030a0a086989b54c80a62e105d8f17f5bd80917912aed77721f418e176890dd2bc512730d3113209c0c22eda2aa547c2c65b95bc1b96df590b8a20ac8f9dc3b62981430c91f4f5c5042ca32370571d328cedab8515ed181d49bb1df6937f5532ca3a98c05674004f39d36b3680d1c026be8a0292c2121baa52f0bcc3c5c7ea2607dddb2ab876276c350011a66337f922347149e686cb76308b55966656c712475516f28f386af0a627e58341316554c5611afc70bc6068085ec4115eb1a772ab63ecb3391a1598f0079b1d4683ff7752b94bf7198be911b8b125caffa7a8f4d4ab40b1c46000041ede1949a62be50a293e8ac1e3857156c5bc2710a358c9b1611e7a0bea78e04615c2de475eb805f2bd5f7b6ab5ef79c5c21e6ce602b7931dce1f58049d233e5cf8625fc812d4edc22209dde98ebabbf4e86c5aa8b24ad13d128c7e1be27764b0461001d002025fc812d4edc22209dde98ebabbf4e86c5aa8b24ad13d128c7e1be27","tls_ja3":["2196848d251b217de8b2c037e356c11d"],"http_akin":["b11cun010_00040000_c4b2c4aa","b11cun040_00040013_608dab68","b11cun020_00040010_724c10fb"]},"fingerprint_peers":{"t13i131000_f57a46bbacb6_e5728521abd4":56,"b11cun010_00040000_c4b2c4aa":665,"b11cun040_00040013_608dab68":4394,"b11cun020_00040010_724c10fb":1547},"akin_families":{"b11cun020_00040010_724c10fb":{"head":"b11cun020_00040010_724c10fb","shapes":3,"ips":1547}},"user_agents":["Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0","Mozilla/5.0","Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0"],"timeline":[{"date":"2026-09-21","count":1},{"date":"2026-10-03","count":584}],"recent_events":[{"timestamp":"2026-10-03T20:51:27","port":3306,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"host\":\"<HONEYPOT>:3306\",\"user-agent\":\"Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/id_rsa.pub?v=18db203346e6b553","summary":"","payload_hex":"474554202f69645f7273612e7075623f763d3138646232303333343665366235353320485454502f312e310d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e5420362e313b2057696e36343b207836343b2072763a34372e3029204765636b6f2f32303130303130312046697265666f782f34372e300d0a486f73743a20<HONEYPOT>3a333330360d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0","ja3":"2196848d251b217de8b2c037e356c11d","session":"06a2df64-15a5-471f-9a24-d522e74626fd","seq":1,"duration_ms":100,"bytes_in":163,"bytes_out":77},{"timestamp":"2026-10-03T20:51:25","port":3306,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"host\":\"<HONEYPOT>:3306\",\"user-agent\":\"Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/server.key?v=18db2033397201b4","summary":"","payload_hex":"474554202f7365727665722e6b65793f763d3138646232303333333937323031623420485454502f312e310d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e5420362e313b2057696e36343b207836343b2072763a34372e3029204765636b6f2f32303130303130312046697265666f782f34372e300d0a486f73743a20<HONEYPOT>3a333330360d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0","ja3":"2196848d251b217de8b2c037e356c11d","session":"69a4d3d8-af6d-40e2-9cd1-636639e69035","seq":53,"duration_ms":23659,"bytes_in":8869,"bytes_out":4081},{"timestamp":"2026-10-03T20:51:25","port":3306,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"host\":\"<HONEYPOT>:3306\",\"user-agent\":\"Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/cert.pem?v=18db20330c77473a","summary":"","payload_hex":"474554202f636572742e70656d3f763d3138646232303333306337373437336120485454502f312e310d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e5420362e313b2057696e36343b207836343b2072763a34372e3029204765636b6f2f32303130303130312046697265666f782f34372e300d0a486f73743a20<HONEYPOT>3a333330360d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0","ja3":"2196848d251b217de8b2c037e356c11d","session":"69a4d3d8-af6d-40e2-9cd1-636639e69035","seq":52,"duration_ms":23297,"bytes_in":8706,"bytes_out":4004},{"timestamp":"2026-10-03T20:51:25","port":3306,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"host\":\"<HONEYPOT>:3306\",\"user-agent\":\"Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/key.pem.bak?v=18db20335bb05a83","summary":"","payload_hex":"474554202f6b65792e70656d2e62616b3f763d3138646232303333356262303561383320485454502f312e310d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e5420362e313b2057696e36343b207836343b2072763a34372e3029204765636b6f2f32303130303130312046697265666f782f34372e300d0a486f73743a20<HONEYPOT>3a333330360d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0","ja3":"2196848d251b217de8b2c037e356c11d","session":"69a4d3d8-af6d-40e2-9cd1-636639e69035","seq":54,"duration_ms":23998,"bytes_in":9033,"bytes_out":4158},{"timestamp":"2026-10-03T20:51:24","port":3306,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"host\":\"<HONEYPOT>:3306\",\"user-agent\":\"Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/.ssh/id_dsa?v=18db2034ff9f1531","summary":"","payload_hex":"474554202f2e7373682f69645f6473613f763d3138646232303334666639663135333120485454502f312e310d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e5420362e313b2057696e36343b207836343b2072763a34372e3029204765636b6f2f32303130303130312046697265666f782f34372e300d0a486f73743a20<HONEYPOT>3a333330360d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0","ja3":"2196848d251b217de8b2c037e356c11d","session":"69a4d3d8-af6d-40e2-9cd1-636639e69035","seq":50,"duration_ms":22555,"bytes_in":8386,"bytes_out":3850},{"timestamp":"2026-10-03T20:51:24","port":3306,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"host\":\"<HONEYPOT>:3306\",\"user-agent\":\"Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/id_dsa?v=18db203316033eb8","summary":"","payload_hex":"474554202f69645f6473613f763d3138646232303333313630333365623820485454502f312e310d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e5420362e313b2057696e36343b207836343b2072763a34372e3029204765636b6f2f32303130303130312046697265666f782f34372e300d0a486f73743a20<HONEYPOT>3a333330360d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0","ja3":"2196848d251b217de8b2c037e356c11d","session":"69a4d3d8-af6d-40e2-9cd1-636639e69035","seq":51,"duration_ms":22958,"bytes_in":8545,"bytes_out":3927},{"timestamp":"2026-10-03T20:51:24","port":3306,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"host\":\"<HONEYPOT>:3306\",\"user-agent\":\"Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/.ssh/config?v=18db2034c993a082","summary":"","payload_hex":"474554202f2e7373682f636f6e6669673f763d3138646232303334633939336130383220485454502f312e310d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e5420362e313b2057696e36343b207836343b2072763a34372e3029204765636b6f2f32303130303130312046697265666f782f34372e300d0a486f73743a20<HONEYPOT>3a333330360d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0","ja3":"2196848d251b217de8b2c037e356c11d","session":"69a4d3d8-af6d-40e2-9cd1-636639e69035","seq":49,"duration_ms":22214,"bytes_in":8222,"bytes_out":3773},{"timestamp":"2026-10-03T20:51:23","port":3306,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"host\":\"<HONEYPOT>:3306\",\"user-agent\":\"Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/.ssh/known_hosts?v=18db2034b2363502","summary":"","payload_hex":"474554202f2e7373682f6b6e6f776e5f686f7374733f763d3138646232303334623233363335303220485454502f312e310d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e5420362e313b2057696e36343b207836343b2072763a34372e3029204765636b6f2f32303130303130312046697265666f782f34372e300d0a486f73743a20<HONEYPOT>3a333330360d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0","ja3":"2196848d251b217de8b2c037e356c11d","session":"69a4d3d8-af6d-40e2-9cd1-636639e69035","seq":48,"duration_ms":21738,"bytes_in":8058,"bytes_out":3696},{"timestamp":"2026-10-03T20:51:22","port":3306,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"host\":\"<HONEYPOT>:3306\",\"user-agent\":\"Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/helm/values.yaml?v=18db2034890d7242","summary":"","payload_hex":"474554202f68656c6d2f76616c7565732e79616d6c3f763d3138646232303334383930643732343220485454502f312e310d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e5420362e313b2057696e36343b207836343b2072763a34372e3029204765636b6f2f32303130303130312046697265666f782f34372e300d0a486f73743a20<HONEYPOT>3a333330360d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0","ja3":"2196848d251b217de8b2c037e356c11d","session":"69a4d3d8-af6d-40e2-9cd1-636639e69035","seq":46,"duration_ms":20759,"bytes_in":7716,"bytes_out":3542},{"timestamp":"2026-10-03T20:51:22","port":3306,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"host\":\"<HONEYPOT>:3306\",\"user-agent\":\"Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/k8s/secrets.yaml?v=18db203467680fa3","summary":"","payload_hex":"474554202f6b38732f736563726574732e79616d6c3f763d3138646232303334363736383066613320485454502f312e310d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e5420362e313b2057696e36343b207836343b2072763a34372e3029204765636b6f2f32303130303130312046697265666f782f34372e300d0a486f73743a20<HONEYPOT>3a333330360d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0","ja3":"2196848d251b217de8b2c037e356c11d","session":"69a4d3d8-af6d-40e2-9cd1-636639e69035","seq":45,"duration_ms":20398,"bytes_in":7547,"bytes_out":3465}],"http_methods":[{"method":"GET","count":585}],"distinct_ports_total":2,"top_paths":[{"path":"/","count":3,"ports":2},{"path":"/.env%20?v=18db201e9400e528","count":2,"ports":1},{"path":"/config/claude.json?v=18db1ffc357d2a88","count":1,"ports":1},{"path":"/api/minimax/config.js?v=18db2012f7abed64","count":1,"ports":1},{"path":"/anthropic/.env?v=18db200ad5949411","count":1,"ports":1},{"path":"/anthropic/api_key.txt?v=18db201472cfca9f","count":1,"ports":1},{"path":"/api/anthropic/.env?v=18db201536fb3feb","count":1,"ports":1},{"path":"/.huggingface/token?v=18db201ce5bcbb98","count":1,"ports":1},{"path":"/.claude/settings.json?v=18db2015a6a57fea","count":1,"ports":1},{"path":"/backup/db.sql?v=18db202b78da3356","count":1,"ports":1},{"path":"/.git/packed-refs?v=18db20368f8376df","count":1,"ports":1},{"path":"/adminer/index.php?v=18db202ff5dbbc56","count":1,"ports":1},{"path":"/.git/FETCH_HEAD?v=18db2036b1580c36","count":1,"ports":1},{"path":"/.git/COMMIT_EDITMSG?v=18db20365f191af5","count":1,"ports":1},{"path":"/new/.env?v=18db1feec4c12ff6","count":1,"ports":1}],"distinct_paths_total":200,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Host","User-Agent"],"representative":[{"name":"Host","value":"<HONEYPOT>:3306","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0","notable":false}],"distinct_sets":1,"events_with_headers":10},"tags":[{"tag_id":"CVE-2024-44000","tag_type":"cve","title":"LiteSpeed Cache <= 6.4.1 - Sensitive Information Exposure","severity":"high","actively_exploited":false,"match_field":"url_path","matched_pattern":"/wp-content/debug.log","reference_urls":["https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/litespeed-cache/litespeed-cache-641-unauthenticated-sensitive-information-exposure-via-log-files","https://github.com/absholi7ly/CVE-2024-44000-LiteSpeed-Cache","https://github.com/gbrsh/CVE-2024-44000","https://thehackernews.com/2024/09/critical-security-flaw-found-in.html","https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/wp_litespeed_cookie_theft.rb"]},{"tag_id":"CVE-2024-50340","tag_type":"cve","title":"Symfony Profiler - Remote Access via Injected Arguments","severity":"high","actively_exploited":false,"match_field":"url_path","matched_pattern":"/_profiler/phpinfo","reference_urls":["https://github.com/symfony/symfony/commit/a77b308c3f179ed7c8a8bc295f82b2d6ee3493fa","https://github.com/symfony/symfony/security/advisories/GHSA-x8vp-gf4q-mw5j","https://blog.nollium.com/cve-2024-50340-remote-access-to-symfony-profiler-via-injected-arguments-d2f14b4f6ad7","https://github.com/nollium/CVE-2024-50340-eos-exploit","https://nvd.nist.gov/vuln/detail/CVE-2024-50340"]}],"data_as_of":"2026-10-05T20:49:21.909948+00:00"}