{"ip":"45.148.10.125","total_events":3243,"verdict":{"verdict":"scanning","label":"Scanning for known vulnerabilities","detail":"14 exploit-path probe(s)","confidence":"medium","network_type":null,"why":["14 request(s) matched a known exploit path.","Only GET/HEAD seen, no request body: scanning for the vulnerability, not delivering a payload.","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"375,794 bytes sent","bytes_sent":375794,"session_seconds":0,"persistent":false}},"first_seen":"2026-08-01T20:16:46","last_seen":"2026-08-14T14:36:18","events_24h":311,"events_7d":1623,"geo":{"country_code":"NL","country_name":"The Netherlands","region":"North Holland","city":"Amsterdam","lat":52.3716,"lon":4.8883,"asn":48090,"org":"Techoff Srv Limited"},"source_domain":null,"known_scanners":[],"scanner_tag":null,"cve_matches":[],"malware":[],"top_ports":[{"port":80,"proto":"tcp","label":"HTTP","count":1772},{"port":443,"proto":"tcp","label":"HTTPS","count":1076},{"port":8080,"proto":"tcp","label":"HTTP-alt","count":395}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i191000_9dc949149365_e5728521abd4"],"tls_ja3":["96458b3de39df5d47bc5c4a9f10f8f26"],"ja4h":["ge11nn0300_86b6b04cb9cc","ge11nn0400_9c3956fad5da","ge11nn0100_4740ae6347b0"]},"fingerprint_peers":{"t13i191000_9dc949149365_e5728521abd4":161,"ge11nn0100_4740ae6347b0":615,"ge11nn0400_9c3956fad5da":1493,"ge11nn0300_86b6b04cb9cc":5632},"user_agents":["l9tcpid/v1.1.0","l9explore/1.2.2"],"timeline":[{"date":"2026-08-01","count":201},{"date":"2026-08-02","count":568},{"date":"2026-08-03","count":548},{"date":"2026-08-04","count":303},{"date":"2026-08-09","count":14},{"date":"2026-08-10","count":391},{"date":"2026-08-11","count":222},{"date":"2026-08-12","count":302},{"date":"2026-08-13","count":358},{"date":"2026-08-14","count":336}],"recent_events":[{"timestamp":"2026-08-14T14:36:18","port":80,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:80\",\"user-agent\":\"l9explore/1.2.2\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/.git/HEAD","summary":"","payload_hex":"474554202f2e6769742f4845414420485454502f312e310d0a486f73743a20<HONEYPOT>3a38300d0a557365722d4167656e743a206c396578706c6f72652f312e322e320d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"l9explore/1.2.2","ja3":"96458b3de39df5d47bc5c4a9f10f8f26","session":"2dfa1898-2a3e-4e88-9292-066cac56f1fb","seq":1,"duration_ms":100,"bytes_in":123,"bytes_out":78},{"timestamp":"2026-08-14T14:36:18","port":80,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:80\",\"user-agent\":\"l9explore/1.2.2\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/.git-credentials","summary":"","payload_hex":"474554202f2e6769742d63726564656e7469616c7320485454502f312e310d0a486f73743a20<HONEYPOT>3a38300d0a557365722d4167656e743a206c396578706c6f72652f312e322e320d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"l9explore/1.2.2","ja3":"96458b3de39df5d47bc5c4a9f10f8f26","session":"d8d3487a-5795-44d7-beef-6f6d7f9ec457","seq":1,"duration_ms":100,"bytes_in":130,"bytes_out":78},{"timestamp":"2026-08-14T14:36:18","port":80,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:80\",\"user-agent\":\"l9explore/1.2.2\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/.env.bak","summary":"","payload_hex":"474554202f2e656e762e62616b20485454502f312e310d0a486f73743a20<HONEYPOT>3a38300d0a557365722d4167656e743a206c396578706c6f72652f312e322e320d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"l9explore/1.2.2","ja3":"96458b3de39df5d47bc5c4a9f10f8f26","session":"8cee9a9f-255c-49de-8521-4d2ac23e3b12","seq":1,"duration_ms":100,"bytes_in":122,"bytes_out":78},{"timestamp":"2026-08-14T14:36:18","port":80,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:80\",\"user-agent\":\"l9explore/1.2.2\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/.env.staging","summary":"","payload_hex":"474554202f2e656e762e73746167696e6720485454502f312e310d0a486f73743a20<HONEYPOT>3a38300d0a557365722d4167656e743a206c396578706c6f72652f312e322e320d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"l9explore/1.2.2","ja3":"96458b3de39df5d47bc5c4a9f10f8f26","session":"460f25d1-a85f-47c3-a8a0-cf91dbbc6192","seq":1,"duration_ms":100,"bytes_in":126,"bytes_out":78},{"timestamp":"2026-08-14T14:36:18","port":80,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:80\",\"user-agent\":\"l9explore/1.2.2\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/info.php","summary":"","payload_hex":"474554202f696e666f2e70687020485454502f312e310d0a486f73743a20<HONEYPOT>3a38300d0a557365722d4167656e743a206c396578706c6f72652f312e322e320d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"l9explore/1.2.2","ja3":"96458b3de39df5d47bc5c4a9f10f8f26","session":"de3d1014-ea4a-44a7-a36e-1311745fc946","seq":1,"duration_ms":101,"bytes_in":122,"bytes_out":78},{"timestamp":"2026-08-14T14:36:18","port":80,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:80\",\"user-agent\":\"l9explore/1.2.2\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/appsettings.json","summary":"","payload_hex":"474554202f61707073657474696e67732e6a736f6e20485454502f312e310d0a486f73743a20<HONEYPOT>3a38300d0a557365722d4167656e743a206c396578706c6f72652f312e322e320d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"l9explore/1.2.2","ja3":"96458b3de39df5d47bc5c4a9f10f8f26","session":"15227d1e-1bf7-4404-991e-cc39255a883f","seq":1,"duration_ms":100,"bytes_in":130,"bytes_out":78},{"timestamp":"2026-08-14T14:36:18","port":80,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:80\",\"user-agent\":\"l9explore/1.2.2\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/app/.env","summary":"","payload_hex":"474554202f6170702f2e656e7620485454502f312e310d0a486f73743a20<HONEYPOT>3a38300d0a557365722d4167656e743a206c396578706c6f72652f312e322e320d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"l9explore/1.2.2","ja3":"96458b3de39df5d47bc5c4a9f10f8f26","session":"6ac76a51-c6cd-4e84-ab20-0b5b2c1ba154","seq":1,"duration_ms":100,"bytes_in":122,"bytes_out":78},{"timestamp":"2026-08-14T14:36:17","port":80,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:80\",\"user-agent\":\"l9explore/1.2.2\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/.env.old","summary":"","payload_hex":"474554202f2e656e762e6f6c6420485454502f312e310d0a486f73743a20<HONEYPOT>3a38300d0a557365722d4167656e743a206c396578706c6f72652f312e322e320d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"l9explore/1.2.2","ja3":"96458b3de39df5d47bc5c4a9f10f8f26","session":"2daa4757-498a-4e2f-bb1d-64d911db481f","seq":1,"duration_ms":100,"bytes_in":122,"bytes_out":78},{"timestamp":"2026-08-14T14:36:17","port":80,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:80\",\"user-agent\":\"l9explore/1.2.2\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/.env.prod","summary":"","payload_hex":"474554202f2e656e762e70726f6420485454502f312e310d0a486f73743a20<HONEYPOT>3a38300d0a557365722d4167656e743a206c396578706c6f72652f312e322e320d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"l9explore/1.2.2","ja3":"96458b3de39df5d47bc5c4a9f10f8f26","session":"64c9e39f-60f0-4ff2-b734-8b444d558639","seq":1,"duration_ms":100,"bytes_in":123,"bytes_out":78},{"timestamp":"2026-08-14T14:36:17","port":80,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:80\",\"user-agent\":\"l9explore/1.2.2\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/.env.local","summary":"","payload_hex":"474554202f2e656e762e6c6f63616c20485454502f312e310d0a486f73743a20<HONEYPOT>3a38300d0a557365722d4167656e743a206c396578706c6f72652f312e322e320d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"l9explore/1.2.2","ja3":"96458b3de39df5d47bc5c4a9f10f8f26","session":"ddd4be72-c020-48ca-91a7-2d771bc09830","seq":1,"duration_ms":100,"bytes_in":124,"bytes_out":78}],"http_methods":[{"method":"GET","count":3243}],"distinct_ports_total":3,"top_paths":[{"path":"/","count":478,"ports":3},{"path":"/.env.prod","count":144,"ports":3},{"path":"/.env","count":133,"ports":3},{"path":"/.env.production","count":133,"ports":3},{"path":"/.git/HEAD","count":132,"ports":3},{"path":"/.env.development","count":132,"ports":3},{"path":"/.env.backup","count":130,"ports":3},{"path":"/.env.staging","count":129,"ports":3},{"path":"/.env.local","count":129,"ports":3},{"path":"/api/.env","count":127,"ports":3},{"path":"/.git/config","count":127,"ports":3},{"path":"/.npmrc","count":126,"ports":3},{"path":"/backend/.env","count":125,"ports":3},{"path":"/.env.old","count":124,"ports":3},{"path":"/.git-credentials","count":124,"ports":3}],"distinct_paths_total":23,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept-Encoding","Connection","Host","User-Agent"],"representative":[{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Connection","value":"close","notable":false},{"name":"Host","value":"<HONEYPOT>:80","notable":false},{"name":"User-Agent","value":"l9explore/1.2.2","notable":false}],"distinct_sets":1,"events_with_headers":10},"tags":[],"data_as_of":"2026-08-15T07:05:25.250956+00:00"}