{"ip":"72.46.85.71","total_events":224,"verdict":{"verdict":"malicious","label":"Exploit attempts observed","detail":"34 exploit-path hits","confidence":"high","network_type":"CDN","why":["34 request(s) matched a known exploit path.","Body-carrying methods (POST/PUT/PATCH/DELETE) seen: payload delivery, not just recon.","5+ hits raise confidence to high.","Not in any known-scanner range.","Sent 60,103 bytes: sustained payload delivery, not a single opportunistic request."],"engagement":{"level":"payload","label":"Sustained payload","detail":"60,103 bytes sent","bytes_sent":60103,"session_seconds":3,"persistent":false}},"first_seen":"2026-09-23T21:24:04","last_seen":"2026-09-23T21:24:53","events_24h":224,"events_7d":224,"geo":{"country_code":"US","country_name":"United States","region":"Texas","city":"Dallas","lat":32.7797,"lon":-96.8022,"asn":396356,"org":"Latitude.sh"},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as396356","label":"Latitude.sh AS396356","category":"cdn","url":"https://www.peeringdb.com/asn/396356"},"cve_matches":[{"cve_id":"CVE-2023-39141","title":"Aria2 WebUI - Path traversal","severity":"high","actively_exploited":false,"match_field":"url_path","matched_pattern":"/../../../../etc/passwd"}],"malware":[],"top_ports":[{"port":4173,"proto":"tcp","label":"","count":221},{"port":9230,"proto":"tcp","label":"","count":1},{"port":9258,"proto":"tcp","label":"","count":1},{"port":9229,"proto":"tcp","label":"","count":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i1711h1_ab0a1bf427ad_8e6e362c5eac"],"tls_client_hello":"16030105e4010005e003036ac13c66fdd1681ec6f1e1d73005c1f4ca1b4a1758bcbf7a03a682d5fb603f4b20027aeeb8dc5e02de743fa22d6e853efaeef672bff6167f6d5cfe00b77da96c320022130213031301c02cc030c02bc02fcca9cca8c024c028c023c027009f009e006b006701000575ff01000100000b000403000102000a0012001011ec001d0017001e0018001901000101002300000010000b000908687474702f312e310016000000170000000d0036003409050906090404030503060308070808081a081b081c0809080a080b080408050806040105010601030303010302040205020602002b00050403040303002d00020101003304ea04e811ec04c0fa70a4f60971b6105293419aba2ccb50f94a56e834da66a764691bad525ac2e48561652ed2c35c0f26c28ca88eeb7282dbe006190095d9b24135375493c15de47c7112c2a283e87841868a6f292b37764b2147b30b9039dbb826189264aa70bcd7f7418aa761385b1dfc6839daea7a90ca4d902601e0404e8cc44ae518ad0c8638ec8133c0d614edcb50dbb9a579c70f918ca9043a0b0976076c376c15c48fc0d801a21084f1a4cfb0f32619a37b142846d79ba62306c070c80567801c65ba67e2d1bace273d0a2938d8b144be991f0e40b77be453ddb941098844d45ac34ed59e579a376a9744444308b65c90ec91b100276ac1377588b4c62e4023f7d00174897128fb5a5b1a7cb49b9f7f803fa8a595390c4041b36ca107cf9c3a85140269aafb2a21037c758c781914945b67a46850c09e5aa495191b13425cf1a735b287799c4b28f22466901bc032c27f233683b9f79992bcaba4c30160a8468c238415ab8d967b38f2b4540723437bcba249642dae7b6e57cc7122c61b5b0c56f8f4a9a5fb0e17fa6a80621de4f23f6b08bf52069023fc1eedd61b3d89a2b42a31df5231ec936b39a96248f70f88c47f2ad10ed9c746d903a7c9ca692e2262ca073c5f540c8005563c2b3e4ce239453c90572400bc984ab103ae83791fae6482835161dfb1c260f4453663cd9b9c3aac957b842c3567396f09958ab7b33fa791288c682d93dccca0f79feba2689a929fd13273e83c8af0ab2cf0c91d91da73d6fbc98463c285d78c09c80ac0f3bb1fb77b27ea6818290c4e83b5a5b00dd2546d339143ed103c2109689a68ac2a7188162ab73e3b6e3bd35a4a807ace22b054ebba7a22049b23b608cc17f3f5102508b75cf109c3ac16d3c56a630872326621d157bec1302561a73084e4a61f573ab5237342169bd71c6af433aab445401181a88db5703b8c558db64006698a5b90538911bba3540ff3bb3f6f8c9fa49921bad541cf4a57a990bdddc67e2d9916cde7076fec0debe84885f2b7909587632cc3cce9ac978434185c9e3c95ceaf3586eca317c2a674ab306510e1218976000dac4da4604ec4033b7db26bd366cb71c6a3b8026f231a0aa0c336acc36cf68ac99597082a479f37e853748219eea2c37558cec1f72b1f4b27a106cdbc592f270123bd5728bf2219fe921bed9742c5f1b443a473dbc44d747b81d94b490fb95b974c9b34a9ba2a7bbe70fb8fe2f638116935d6535151195ac3c6bfccf84a536642370414c9a73b52e4311763ae2d76269309984bfab5a655ce9104a9ee3c2531cb52834b2a23a6ad11492d9da98bb757358f72adb4606afa7bbc9b964ec769415112cd6723c1607a4ef9c74ff12526a1fc864be7ac0dbc7bea907df1b25adbe9cc5d5605d97b7c87c46a59a15553888e6ae685a6a008bc4401f18418ac136bfb96a8f8211937d748e22b1964688ba471bf7899298ab9024fbbbec5704db683a9f7f53936283d647941d5a9cf1fb7bab1e9679cc45b7f9a7177f27ff57198ab953e83bbad671bbc0ecb163bd64da5fb2ab5d2ce56775a35f17aaf427842939624520556001189d68728858e5fcb97bd5c0a7605c470f26cd8520ef6c41d30a63178fb639d1b74a35d5a18fb2f50716357b8515daa116aedd6dd99969862429bb34b5db0e652499cb7a0a67dbdd88abf244f0d54293f5914f9606d819060bf61d65772fc4fee77001d0020e5e6bd19da158063afc5547c4e2751096c4704d790ae8c3f9072202d","tls_ja3":["696ab274b8c77f6b712e1f50142c1460"],"http_akin":["a11cuq060_0000064b_30319a11","a11cun040_0000004d_1d05953d","a11cun040_0000004b_4c87b06e","a11cun060_e000004a_ffe60107","a11cuq051_0000024a_985b9497"]},"fingerprint_peers":{"t13i1711h1_ab0a1bf427ad_8e6e362c5eac":3,"a11cun040_0000004b_4c87b06e":134,"a11cuq060_0000064b_30319a11":2,"a11cun060_e000004a_ffe60107":14,"a11cuq051_0000024a_985b9497":1,"a11cun040_0000004d_1d05953d":2},"akin_families":{"a11cun060_e000004a_ffe60107":{"head":"a11cun060_e000004a_ffe60107","shapes":2,"ips":14}},"user_agents":["CryptoHunter-Vite-2026/1.0"],"timeline":[{"date":"2026-09-23","count":224}],"recent_events":[{"timestamp":"2026-09-23T21:24:53","port":4173,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:4173\",\"user-agent\":\"CryptoHunter-Vite-2026/1.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/assets?unstable_path=/_nextjs_public_symlink/config.py","summary":"","payload_hex":"474554202f6173736574733f756e737461626c655f706174683d2f5f6e6578746a735f7075626c69635f73796d6c696e6b2f636f6e6669672e707920485454502f312e310d0a486f73743a20<HONEYPOT>3a343137330d0a557365722d4167656e743a2043727970746f48756e7465722d566974652d323032362f312e300d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"CryptoHunter-Vite-2026/1.0","ja3":"","session":"4e47a955-5a7d-474a-9631-a0a0b25f5305","seq":1,"duration_ms":100,"bytes_in":170,"bytes_out":76},{"timestamp":"2026-09-23T21:24:52","port":4173,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:4173\",\"user-agent\":\"CryptoHunter-Vite-2026/1.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/assets?unstable_path=/_nextjs_public_symlink/broadcast/Deploy.s.sol/10/run-latest.json","summary":"","payload_hex":"474554202f6173736574733f756e737461626c655f706174683d2f5f6e6578746a735f7075626c69635f73796d6c696e6b2f62726f6164636173742f4465706c6f792e732e736f6c2f31302f72756e2d6c61746573742e6a736f6e20485454502f312e310d0a486f73743a20<HONEYPOT>3a343137330d0a557365722d4167656e743a2043727970746f48756e7465722d566974652d323032362f312e300d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"CryptoHunter-Vite-2026/1.0","ja3":"","session":"3cc50f99-104c-4c09-ad82-31ed74fd5117","seq":1,"duration_ms":100,"bytes_in":202,"bytes_out":76},{"timestamp":"2026-09-23T21:24:52","port":4173,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:4173\",\"user-agent\":\"CryptoHunter-Vite-2026/1.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/assets?unstable_path=/_nextjs_public_symlink/broadcast/Deploy.s.sol/137/run-latest.json","summary":"","payload_hex":"474554202f6173736574733f756e737461626c655f706174683d2f5f6e6578746a735f7075626c69635f73796d6c696e6b2f62726f6164636173742f4465706c6f792e732e736f6c2f3133372f72756e2d6c61746573742e6a736f6e20485454502f312e310d0a486f73743a20<HONEYPOT>3a343137330d0a557365722d4167656e743a2043727970746f48756e7465722d566974652d323032362f312e300d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"CryptoHunter-Vite-2026/1.0","ja3":"","session":"5c5c1b7e-89d7-4161-98e4-5282b9a75250","seq":1,"duration_ms":100,"bytes_in":203,"bytes_out":76},{"timestamp":"2026-09-23T21:24:52","port":4173,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:4173\",\"user-agent\":\"CryptoHunter-Vite-2026/1.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/assets?unstable_path=/_nextjs_public_symlink/deploy.js","summary":"","payload_hex":"474554202f6173736574733f756e737461626c655f706174683d2f5f6e6578746a735f7075626c69635f73796d6c696e6b2f6465706c6f792e6a7320485454502f312e310d0a486f73743a20<HONEYPOT>3a343137330d0a557365722d4167656e743a2043727970746f48756e7465722d566974652d323032362f312e300d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"CryptoHunter-Vite-2026/1.0","ja3":"","session":"c1e4a34a-eb32-45a6-ad1b-82774c62fa99","seq":1,"duration_ms":100,"bytes_in":170,"bytes_out":76},{"timestamp":"2026-09-23T21:24:51","port":4173,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:4173\",\"user-agent\":\"CryptoHunter-Vite-2026/1.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/assets?unstable_path=/_nextjs_public_symlink/turnkey-private-key.pem","summary":"","payload_hex":"474554202f6173736574733f756e737461626c655f706174683d2f5f6e6578746a735f7075626c69635f73796d6c696e6b2f7475726e6b65792d707269766174652d6b65792e70656d20485454502f312e310d0a486f73743a20<HONEYPOT>3a343137330d0a557365722d4167656e743a2043727970746f48756e7465722d566974652d323032362f312e300d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"CryptoHunter-Vite-2026/1.0","ja3":"","session":"60e70ec7-a786-432a-9b28-d0b92da80e54","seq":1,"duration_ms":100,"bytes_in":184,"bytes_out":76},{"timestamp":"2026-09-23T21:24:51","port":4173,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:4173\",\"user-agent\":\"CryptoHunter-Vite-2026/1.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/assets?unstable_path=/_nextjs_public_symlink/backend/.env.production","summary":"","payload_hex":"474554202f6173736574733f756e737461626c655f706174683d2f5f6e6578746a735f7075626c69635f73796d6c696e6b2f6261636b656e642f2e656e762e70726f64756374696f6e20485454502f312e310d0a486f73743a20<HONEYPOT>3a343137330d0a557365722d4167656e743a2043727970746f48756e7465722d566974652d323032362f312e300d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"CryptoHunter-Vite-2026/1.0","ja3":"","session":"f73cfa88-5046-4b6c-a9c3-3bdbba067327","seq":1,"duration_ms":101,"bytes_in":184,"bytes_out":76},{"timestamp":"2026-09-23T21:24:50","port":4173,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:4173\",\"user-agent\":\"CryptoHunter-Vite-2026/1.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/assets?unstable_path=/_nextjs_public_symlink/server/.env.production","summary":"","payload_hex":"474554202f6173736574733f756e737461626c655f706174683d2f5f6e6578746a735f7075626c69635f73796d6c696e6b2f7365727665722f2e656e762e70726f64756374696f6e20485454502f312e310d0a486f73743a20<HONEYPOT>3a343137330d0a557365722d4167656e743a2043727970746f48756e7465722d566974652d323032362f312e300d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"CryptoHunter-Vite-2026/1.0","ja3":"","session":"ea366d74-9f2f-48e5-ab63-68fb6da42ca5","seq":1,"duration_ms":100,"bytes_in":183,"bytes_out":76},{"timestamp":"2026-09-23T21:24:50","port":4173,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:4173\",\"user-agent\":\"CryptoHunter-Vite-2026/1.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/assets?unstable_path=/_nextjs_public_symlink/broadcast/Deploy.s.sol/1/run-latest.json","summary":"","payload_hex":"474554202f6173736574733f756e737461626c655f706174683d2f5f6e6578746a735f7075626c69635f73796d6c696e6b2f62726f6164636173742f4465706c6f792e732e736f6c2f312f72756e2d6c61746573742e6a736f6e20485454502f312e310d0a486f73743a20<HONEYPOT>3a343137330d0a557365722d4167656e743a2043727970746f48756e7465722d566974652d323032362f312e300d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"CryptoHunter-Vite-2026/1.0","ja3":"","session":"01902cab-fdf0-4454-8a86-844edc7947aa","seq":1,"duration_ms":100,"bytes_in":201,"bytes_out":76},{"timestamp":"2026-09-23T21:24:49","port":4173,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:4173\",\"user-agent\":\"CryptoHunter-Vite-2026/1.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/assets?unstable_path=/_nextjs_public_symlink/broadcast/latest.json","summary":"","payload_hex":"474554202f6173736574733f756e737461626c655f706174683d2f5f6e6578746a735f7075626c69635f73796d6c696e6b2f62726f6164636173742f6c61746573742e6a736f6e20485454502f312e310d0a486f73743a20<HONEYPOT>3a343137330d0a557365722d4167656e743a2043727970746f48756e7465722d566974652d323032362f312e300d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"CryptoHunter-Vite-2026/1.0","ja3":"","session":"109c5959-9cd1-44e7-97f0-f10bb24be0ce","seq":1,"duration_ms":100,"bytes_in":182,"bytes_out":76},{"timestamp":"2026-09-23T21:24:49","port":4173,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:4173\",\"user-agent\":\"CryptoHunter-Vite-2026/1.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/assets?unstable_path=/_nextjs_public_symlink/relayer/.env.production","summary":"","payload_hex":"474554202f6173736574733f756e737461626c655f706174683d2f5f6e6578746a735f7075626c69635f73796d6c696e6b2f72656c617965722f2e656e762e70726f64756374696f6e20485454502f312e310d0a486f73743a20<HONEYPOT>3a343137330d0a557365722d4167656e743a2043727970746f48756e7465722d566974652d323032362f312e300d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"CryptoHunter-Vite-2026/1.0","ja3":"","session":"9070b236-afd2-4f9c-bacd-90ffdac2fd40","seq":1,"duration_ms":100,"bytes_in":184,"bytes_out":76}],"http_methods":[{"method":"GET","count":218},{"method":"POST","count":4}],"distinct_ports_total":4,"top_paths":[{"path":"/","count":8,"ports":1},{"path":"/json/version","count":5,"ports":4},{"path":"/@vite/client","count":2,"ports":1},{"path":"/_next/webpack-hmr","count":2,"ports":1},{"path":"/project.json","count":2,"ports":1},{"path":"/..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc%2fpasswd","count":2,"ports":1},{"path":"/_next/hmr","count":2,"ports":1},{"path":"/assets?unstable_path=/_nextjs_public_symlink/paymaster.config.ts","count":1,"ports":1},{"path":"/__parcel_code_frame","count":1,"ports":1},{"path":"/assets?unstable_path=/_nextjs_public_symlink/chainflip.toml","count":1,"ports":1},{"path":"/assets?unstable_path=/_nextjs_public_symlink/secrets.json","count":1,"ports":1},{"path":"/assets?unstable_path=/_nextjs_public_symlink/Anchor.toml","count":1,"ports":1},{"path":"/shared/.config/gh/hosts.yml","count":1,"ports":1},{"path":"/storage/.git-credentials","count":1,"ports":1},{"path":"/%5Bmetro-project%5D/.env.local","count":1,"ports":1}],"distinct_paths_total":200,"top_snis":[],"top_hosts":[],"top_alpns":[{"value":"http/1.1","count":1}],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","Connection","Host","User-Agent"],"representative":[{"name":"Accept","value":"*/*","notable":false},{"name":"Connection","value":"close","notable":false},{"name":"Host","value":"<HONEYPOT>:4173","notable":false},{"name":"User-Agent","value":"CryptoHunter-Vite-2026/1.0","notable":false}],"distinct_sets":1,"events_with_headers":10},"tags":[{"tag_id":"CVE-2023-39141","tag_type":"cve","title":"Aria2 WebUI - Path traversal","severity":"high","actively_exploited":false,"match_field":"url_path","matched_pattern":"/../../../../etc/passwd","reference_urls":["https://twitter.com/win3zz/status/1694239332465520684","https://gist.github.com/JafarAkhondali/528fe6c548b78f454911fb866b23f66e","https://github.com/ziahamza/webui-aria2/blob/109903f0e2774cf948698cd95a01f77f33d7dd2c/node-server.js#L10","https://github.com/codeb0ss/CVE-2023-39141-PoC","https://github.com/nomi-sec/PoC-in-GitHub"]}],"data_as_of":"2026-09-24T21:16:30.035836+00:00"}