{"ip":"68.183.78.151","total_events":84,"verdict":{"verdict":"scanning","label":"Scanning for known vulnerabilities","detail":"10 exploit-path probe(s)","confidence":"medium","network_type":"CDN","why":["10 request(s) matched a known exploit path.","Only GET/HEAD seen, no request body: scanning for the vulnerability, not delivering a payload.","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"98,539 bytes sent","bytes_sent":98539,"session_seconds":3,"persistent":false}},"first_seen":"2026-09-25T16:24:51","last_seen":"2026-09-27T18:14:54","events_24h":0,"events_7d":84,"geo":{"country_code":"DE","country_name":"Germany","region":"Hesse","city":"Frankfurt am Main","lat":50.1169,"lon":8.6837,"asn":14061,"org":"DigitalOcean, LLC"},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as14061","label":"DigitalOcean","category":"cdn","url":"https://www.peeringdb.com/asn/14061"},"cve_matches":[],"malware":[],"top_ports":[{"port":9200,"proto":"tcp","label":"Elastic","count":30},{"port":8181,"proto":"tcp","label":"","count":20},{"port":15672,"proto":"tcp","label":"RabbitMQ","count":10},{"port":3000,"proto":"tcp","label":"Web-alt","count":10},{"port":81,"proto":"tcp","label":"","count":10},{"port":2376,"proto":"tcp","label":"Docker-TLS","count":2},{"port":7474,"proto":"tcp","label":"","count":1},{"port":444,"proto":"tcp","label":"","count":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i251000_b78ed14e2fd0_f50d94e863eb"],"tls_client_hello":"16030105ee010005ea0303cbee3d52218ce8c49838c37f95ce0274f34a684e5d06cd27f931a523112a6a242010b1e016705272303bd76284da143eabb317b2194253c22dc804b7a959c47bd20032c02bc02fc02cc030cca9cca8c009c013c00ac014009c009d002f0035c012000ac023c027003cc007c01100051301130213030100056f000b00020100ff010001000017000000120000000500050100000000000a0010000e11ec11eb11ed001d001700180019000d001c001a090409050906080404030807080508060401050106010503060300320020001e090409050906080404030807080508060401050106010503060302010203002b0009080304030303020301003304ea04e811ec04c0346a8b19b21d04833dcfa4cb42d43189d7cf0ae5638fc26277ab56e36a83adb88b62049ccac6280c6a36661753a3a683240c0847b55ef094738377917b3813cd88131e584707fc620c4406fde25c77fbb02bf9668ff2a6dd362d715b90834891cb9007a4b2076dec9a4bebc3d1cc3d50116f0d7307073b5e1781ae93e8439ce9c40d24cca85527dd582ebccba73622b3f3a347415bbb412735551c7bf32456e3d96698143ad9f4b2979a526dbb18c559b9d1e79358cb5c091406a6d0bb20eb4c7eda057d1686bf6704909b862b993a78c72c266366645984c94492cf1096806a2a2739655eb5ca883683caf44ddeda5acae78111309f557b205768227a155e9e034eaae087471981d3cbc81ac75f0de54da68a4b1a9b0cfa5bbf1165a040860cdf14c230cbb9eb995aa78c568611587c15750e5487e578881ddc0768e6524c9553fbf5aadf3a2613cc21dbea4c9c66c705b685c1b55e21d58105f603bb090e951a493bd17c129c07de7b361c142243e75ca4fa19c5b9ba55e119adb23aa5b0558c809c93b04a44609139c41dd4931d9d029e6a138806c12d3f7205a21c8ce13a4949b85af3263df5b6947df4779b025da7a16f89f337b5801ad26985a010c7f40b8efa4b8e4043696e56714ac3bb93e55b63841da4385d958b6bcc717774411ae7095519bc5034583b2e38a1f43c75887b3324187d711187972762f9bb314664c8eed53db2ea03cfab9714b19cbef244fdb122f5ccb37c7804ec6902268086af572926a4b22cc60e1492cf84d81692722aac67b63ceb7173231ebf3a143f76120e295efeeca5f510b2171bc9632c85295269e0743a1a0c7f4c3605b6b95c51aa1670272edd4b0c37e8765a664d9b7a0761c39c5cf1ae1ada829ab329175337ffdc0eafd39d726673354a565451892f74bf08bb3414738b5c062902db58c4977a0fc0a1eae05ae7d44a9c8c6af80b0f5685c12da329850848e930cb6d8a38ff651dd505726226647d529dc16820637a40a014148ce4654241925832558fd9b487e1a22e98997d5608b850c7c2b53afdfc8bc2020b1cdb5b1c101794046ace5c1bad06b3a39ab367c59c527c2cb167140995ca8d299a33d21f3a860d60889540c91cb8b489ad64752de298ab913922e6529d54ad3b17a1f54147cbda5a9dc4c8bb09744e809b151ca943e09988551bb9c5a20d261a54501921397801837035fc2b1ac1b4ebf8cd6332c5d4a19ef031cf06629a10a67fead63e4f83b6f23a855b15bd005392e825778d73ab3104c6af270bd78992707b640a25132216a4919bc87a70b8ca11b97c65c8522cb2b343cf306c37a6a544a3190c2b98a418bb86eb6770fe95c14ed1a2b569b3b174bb3c765ec35b068e2018f6759e1e062283f9c3ddd753716966327aa426e9432ee55d2dc621c5596f752c4643b401896106f6b6badc3b7abe1a0d40db6d3988cadd55bcac67a531e78d7f861177ac334202a9eb70ac4cd661715b1e52856645f969918c1e2fa2aa8b642e1c5c863bb6102dba39754770069b45da0495ae96b7834c6bc0c75d971ba3444945bf72a1a710b3bdc0884dc692c20aa921b00cf5334b67944598679d506986bdd1a7ec92a3b42a953a673fd8ad3f417f1b8de6d6f2dd65111f04054334bae5cce4dde064951df9d2a1605604f83444122596bae5903ff59d7d4f8a3fb999d080db5ff58fcccae9acea7f3e001d002004f83444122596bae5903ff59d7d4f8a3fb999d080db5ff58fcccae9","tls_ja3":["416eca07dcaad72dec6f76d1277b3eff"],"http_akin":["a11cun060_00c0004e_0af44bea","a11cun050_0000005d_7266f93a"]},"fingerprint_peers":{"t13i251000_b78ed14e2fd0_f50d94e863eb":38,"a11cun060_00c0004e_0af44bea":39,"a11cun050_0000005d_7266f93a":42},"akin_families":{},"user_agents":["Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36","Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36","Mozilla/5.0 (Ubuntu; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36","Mozilla/5.0 (SS; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36","Mozilla/5.0 (X11; Linux i686; rv:1.9.5.20) Gecko/ Firefox/10.0","Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/119.0","Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:132.0) Gecko/20100101 Firefox/132.0","Mozilla/5.0 (X11; Linux i686; rv:1.9.7.20) Gecko/ Firefox/3.8"],"timeline":[{"date":"2026-09-25","count":4},{"date":"2026-09-27","count":80}],"recent_events":[{"timestamp":"2026-09-27T18:14:54","port":9200,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"accept-language\":\"en\",\"host\":\"<HONEYPOT>:9200\",\"user-agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.1.2 Safari/605.1.15\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/.env.bak","summary":"","payload_hex":"474554202f2e656e762e62616b20485454502f312e310d0a486f73743a20<HONEYPOT>3a393230300d0a557365722d4167656e743a204d6f7a696c6c612f352e3020284d6163696e746f73683b20496e74656c204d6163204f5320582031305f31345f3629204170706c655765624b69742f3630352e312e313520284b48544d4c2c206c696b65204765636b6f292056657273696f6e2f31322e312e32205361666172692f3630352e312e31350d0a4163636570743a202a2f2a0d0a4163636570742d4c616e67756167653a20656e0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.1.2 Safari/605.1.15","ja3":"","session":"b22b3805-0547-42c8-8df1-3bc924d8ce42","seq":7,"duration_ms":1295,"bytes_in":1581,"bytes_out":546},{"timestamp":"2026-09-27T18:14:54","port":9200,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"accept-language\":\"en\",\"host\":\"<HONEYPOT>:9200\",\"user-agent\":\"Mozilla/5.0 (X11; Linux i686; rv:1.9.6.20) Gecko/ Firefox/3.6.15\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/api/.env","summary":"","payload_hex":"474554202f6170692f2e656e7620485454502f312e310d0a486f73743a20<HONEYPOT>3a393230300d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b204c696e757820693638363b2072763a312e392e362e323029204765636b6f2f2046697265666f782f332e362e31350d0a4163636570743a202a2f2a0d0a4163636570742d4c616e67756167653a20656e0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux i686; rv:1.9.6.20) Gecko/ Firefox/3.6.15","ja3":"","session":"b22b3805-0547-42c8-8df1-3bc924d8ce42","seq":8,"duration_ms":1494,"bytes_in":1767,"bytes_out":624},{"timestamp":"2026-09-27T18:14:54","port":9200,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"accept-language\":\"en\",\"host\":\"<HONEYPOT>:9200\",\"user-agent\":\"Mozilla/5.0 (SS; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/backend/.env","summary":"","payload_hex":"474554202f6261636b656e642f2e656e7620485454502f312e310d0a486f73743a20<HONEYPOT>3a393230300d0a557365722d4167656e743a204d6f7a696c6c612f352e30202853533b204c696e7578206936383629204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132392e302e302e30205361666172692f3533372e33360d0a4163636570743a202a2f2a0d0a4163636570742d4c616e67756167653a20656e0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (SS; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36","ja3":"","session":"b22b3805-0547-42c8-8df1-3bc924d8ce42","seq":9,"duration_ms":1693,"bytes_in":1991,"bytes_out":702},{"timestamp":"2026-09-27T18:14:54","port":9200,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"accept-language\":\"en\",\"host\":\"<HONEYPOT>:9200\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; rv:128.0) Gecko/20100101 Firefox/128.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/app/.env","summary":"","payload_hex":"474554202f6170702f2e656e7620485454502f312e310d0a486f73743a20<HONEYPOT>3a393230300d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2072763a3132382e3029204765636b6f2f32303130303130312046697265666f782f3132382e300d0a4163636570743a202a2f2a0d0a4163636570742d4c616e67756167653a20656e0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; rv:128.0) Gecko/20100101 Firefox/128.0","ja3":"","session":"b22b3805-0547-42c8-8df1-3bc924d8ce42","seq":10,"duration_ms":1892,"bytes_in":2181,"bytes_out":780},{"timestamp":"2026-09-27T18:14:53","port":9200,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"accept-language\":\"en\",\"host\":\"<HONEYPOT>:9200\",\"user-agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 14) AppleWebKit/620.32 (KHTML, like Gecko) Version/17.1.10 Safari/620.32\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/.env.production","summary":"","payload_hex":"474554202f2e656e762e70726f64756374696f6e20485454502f312e310d0a486f73743a20<HONEYPOT>3a393230300d0a557365722d4167656e743a204d6f7a696c6c612f352e3020284d6163696e746f73683b20496e74656c204d6163204f53205820313429204170706c655765624b69742f3632302e333220284b48544d4c2c206c696b65204765636b6f292056657273696f6e2f31372e312e3130205361666172692f3632302e33320d0a4163636570743a202a2f2a0d0a4163636570742d4c616e67756167653a20656e0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 14) AppleWebKit/620.32 (KHTML, like Gecko) Version/17.1.10 Safari/620.32","ja3":"","session":"b22b3805-0547-42c8-8df1-3bc924d8ce42","seq":2,"duration_ms":299,"bytes_in":436,"bytes_out":156},{"timestamp":"2026-09-27T18:14:53","port":9200,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"accept-language\":\"en\",\"host\":\"<HONEYPOT>:9200\",\"user-agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.1 Safari/605.1.15\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/.env.staging","summary":"","payload_hex":"474554202f2e656e762e73746167696e6720485454502f312e310d0a486f73743a20<HONEYPOT>3a393230300d0a557365722d4167656e743a204d6f7a696c6c612f352e3020284d6163696e746f73683b20496e74656c204d6163204f5320582031305f31355f3729204170706c655765624b69742f3630352e312e313520284b48544d4c2c206c696b65204765636b6f292056657273696f6e2f31362e31205361666172692f3630352e312e31350d0a4163636570743a202a2f2a0d0a4163636570742d4c616e67756167653a20656e0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.1 Safari/605.1.15","ja3":"","session":"b22b3805-0547-42c8-8df1-3bc924d8ce42","seq":3,"duration_ms":499,"bytes_in":679,"bytes_out":234},{"timestamp":"2026-09-27T18:14:53","port":9200,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"accept-language\":\"en\",\"host\":\"<HONEYPOT>:9200\",\"user-agent\":\"Mozilla/5.0 (ZZ; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/.env.development","summary":"","payload_hex":"474554202f2e656e762e646576656c6f706d656e7420485454502f312e310d0a486f73743a20<HONEYPOT>3a393230300d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285a5a3b204c696e7578207838365f363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3133362e302e302e30205361666172692f3533372e33360d0a4163636570743a202a2f2a0d0a4163636570742d4c616e67756167653a20656e0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (ZZ; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36","ja3":"","session":"b22b3805-0547-42c8-8df1-3bc924d8ce42","seq":4,"duration_ms":698,"bytes_in":909,"bytes_out":312},{"timestamp":"2026-09-27T18:14:53","port":9200,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"accept-language\":\"en\",\"host\":\"<HONEYPOT>:9200\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64; rv:1.9.7.20) Gecko/ Firefox/3.6.8\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/.env.local","summary":"","payload_hex":"474554202f2e656e762e6c6f63616c20485454502f312e310d0a486f73743a20<HONEYPOT>3a393230300d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f36343b2072763a312e392e372e323029204765636b6f2f2046697265666f782f332e362e380d0a4163636570743a202a2f2a0d0a4163636570742d4c616e67756167653a20656e0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64; rv:1.9.7.20) Gecko/ Firefox/3.6.8","ja3":"","session":"b22b3805-0547-42c8-8df1-3bc924d8ce42","seq":5,"duration_ms":898,"bytes_in":1098,"bytes_out":390},{"timestamp":"2026-09-27T18:14:53","port":9200,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"accept-language\":\"en\",\"host\":\"<HONEYPOT>:9200\",\"user-agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.0 Safari/605.1.15\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/.env.backup","summary":"","payload_hex":"474554202f2e656e762e6261636b757020485454502f312e310d0a486f73743a20<HONEYPOT>3a393230300d0a557365722d4167656e743a204d6f7a696c6c612f352e3020284d6163696e746f73683b20496e74656c204d6163204f5320582031305f31355f3729204170706c655765624b69742f3630352e312e313520284b48544d4c2c206c696b65204765636b6f292056657273696f6e2f31342e30205361666172692f3630352e312e31350d0a4163636570743a202a2f2a0d0a4163636570742d4c616e67756167653a20656e0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.0 Safari/605.1.15","ja3":"","session":"b22b3805-0547-42c8-8df1-3bc924d8ce42","seq":6,"duration_ms":1096,"bytes_in":1340,"bytes_out":468},{"timestamp":"2026-09-27T18:14:52","port":9200,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"accept-language\":\"en\",\"host\":\"<HONEYPOT>:9200\",\"user-agent\":\"Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:134.0) Gecko/20100101 Firefox/134.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/.env","summary":"","payload_hex":"474554202f2e656e7620485454502f312e310d0a486f73743a20<HONEYPOT>3a393230300d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b205562756e74753b204c696e7578207838365f36343b2072763a3133342e3029204765636b6f2f32303130303130312046697265666f782f3133342e300d0a4163636570743a202a2f2a0d0a4163636570742d4c616e67756167653a20656e0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:134.0) Gecko/20100101 Firefox/134.0","ja3":"","session":"b22b3805-0547-42c8-8df1-3bc924d8ce42","seq":1,"duration_ms":100,"bytes_in":196,"bytes_out":78}],"http_methods":[{"method":"GET","count":84}],"distinct_ports_total":8,"top_paths":[{"path":"/.env","count":8,"ports":5},{"path":"/.env.staging","count":8,"ports":5},{"path":"/app/.env","count":8,"ports":5},{"path":"/api/.env","count":8,"ports":5},{"path":"/.env.local","count":8,"ports":5},{"path":"/.env.backup","count":8,"ports":5},{"path":"/.env.bak","count":8,"ports":5},{"path":"/backend/.env","count":8,"ports":5},{"path":"/.env.production","count":8,"ports":5},{"path":"/.env.development","count":8,"ports":5},{"path":"/","count":4,"ports":3}],"distinct_paths_total":11,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","Accept-Encoding","Accept-Language","Host","User-Agent"],"representative":[{"name":"Accept","value":"*/*","notable":false},{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Accept-Language","value":"en","notable":false},{"name":"Host","value":"<HONEYPOT>:9200","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.1.2 Safari/605.1.15","notable":false}],"distinct_sets":1,"events_with_headers":10},"tags":[],"data_as_of":"2026-09-28T20:47:11.540177+00:00"}