{"ip":"74.208.250.89","total_events":27,"verdict":{"verdict":"scanning","label":"Scanning for known vulnerabilities","detail":"1 exploit-path probe(s)","confidence":"medium","network_type":"nsp","why":["1 request(s) matched a known exploit path.","Only GET/HEAD seen, no request body: scanning for the vulnerability, not delivering a payload.","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"33,570 bytes sent","bytes_sent":33570,"session_seconds":1,"persistent":false}},"first_seen":"2026-09-09T15:12:44","last_seen":"2026-09-09T15:12:47","events_24h":0,"events_7d":27,"geo":{"country_code":"US","country_name":"United States","region":"","city":"","lat":37.751,"lon":-97.822,"asn":8560,"org":"IONOS SE"},"source_domain":"ip74-208-250-89.pbiaas.com","known_scanners":[],"scanner_tag":{"key":"peeringdb:as8560","label":"IONOS SE","category":"isp","url":"https://www.peeringdb.com/asn/8560"},"cve_matches":[],"malware":[],"top_ports":[{"port":3000,"proto":"tcp","label":"Web-alt","count":27}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i131000_f57a46bbacb6_ab7e3b40a677"],"tls_ja3":["2196848d251b217de8b2c037e356c11d"],"ja4h":["ge11nn0400_88d30a62b7ad"]},"fingerprint_peers":{"t13i131000_f57a46bbacb6_ab7e3b40a677":5367,"ge11nn0400_88d30a62b7ad":5910},"user_agents":["Go-http-client/1.1","Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"],"timeline":[{"date":"2026-09-09","count":27}],"recent_events":[{"timestamp":"2026-09-09T15:12:47","port":3000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"text/html,application/json,*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:3000\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/api/trpc/settings.ai?batch=1&input=%7B%7D","summary":"","payload_hex":"474554202f6170692f747270632f73657474696e67732e61693f62617463683d3126696e7075743d25374225374420485454502f312e310d0a486f73743a20<HONEYPOT>3a333030300d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a4163636570743a20746578742f68746d6c2c6170706c69636174696f6e2f6a736f6e2c2a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"","session":"8a77edee-34f9-4fc3-a31d-54cc3653c5e0","seq":5,"duration_ms":552,"bytes_in":764,"bytes_out":390},{"timestamp":"2026-09-09T15:12:47","port":3000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"text/html,application/json,*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:3000\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/api/auth/get-session","summary":"","payload_hex":"474554202f6170692f617574682f6765742d73657373696f6e20485454502f312e310d0a486f73743a20<HONEYPOT>3a333030300d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a4163636570743a20746578742f68746d6c2c6170706c69636174696f6e2f6a736f6e2c2a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"","session":"8a77edee-34f9-4fc3-a31d-54cc3653c5e0","seq":4,"duration_ms":439,"bytes_in":585,"bytes_out":312},{"timestamp":"2026-09-09T15:12:47","port":3000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"text/html,application/json,*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:3000\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/login","summary":"","payload_hex":"474554202f6c6f67696e20485454502f312e310d0a486f73743a20<HONEYPOT>3a333030300d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a4163636570743a20746578742f68746d6c2c6170706c69636174696f6e2f6a736f6e2c2a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"","session":"8a77edee-34f9-4fc3-a31d-54cc3653c5e0","seq":3,"duration_ms":326,"bytes_in":427,"bytes_out":234},{"timestamp":"2026-09-09T15:12:47","port":3000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"text/html,application/json,*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:3000\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/register","summary":"","payload_hex":"474554202f726567697374657220485454502f312e310d0a486f73743a20<HONEYPOT>3a333030300d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a4163636570743a20746578742f68746d6c2c6170706c69636174696f6e2f6a736f6e2c2a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"","session":"8a77edee-34f9-4fc3-a31d-54cc3653c5e0","seq":2,"duration_ms":213,"bytes_in":284,"bytes_out":156},{"timestamp":"2026-09-09T15:12:46","port":3000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"text/html,application/json,*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:3000\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a333030300d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a4163636570743a20746578742f68746d6c2c6170706c69636174696f6e2f6a736f6e2c2a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"","session":"8a77edee-34f9-4fc3-a31d-54cc3653c5e0","seq":1,"duration_ms":100,"bytes_in":138,"bytes_out":78},{"timestamp":"2026-09-09T15:12:46","port":3000,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"text/html,application/json,*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:3000\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/wp-login.php","summary":"","payload_hex":"474554202f77702d6c6f67696e2e70687020485454502f312e310d0a486f73743a20<HONEYPOT>3a333030300d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3133312e302e302e30205361666172692f3533372e33360d0a4163636570743a20746578742f68746d6c2c6170706c69636174696f6e2f6a736f6e2c2a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36","ja3":"2196848d251b217de8b2c037e356c11d","session":"15480888-2351-485b-b507-692dd9e6eb90","seq":11,"duration_ms":1231,"bytes_in":2633,"bytes_out":858},{"timestamp":"2026-09-09T15:12:46","port":3000,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"text/html,application/json,*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:3000\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/manager/html","summary":"","payload_hex":"474554202f6d616e616765722f68746d6c20485454502f312e310d0a486f73743a20<HONEYPOT>3a333030300d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3133312e302e302e30205361666172692f3533372e33360d0a4163636570743a20746578742f68746d6c2c6170706c69636174696f6e2f6a736f6e2c2a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36","ja3":"2196848d251b217de8b2c037e356c11d","session":"15480888-2351-485b-b507-692dd9e6eb90","seq":10,"duration_ms":1118,"bytes_in":2390,"bytes_out":780},{"timestamp":"2026-09-09T15:12:46","port":3000,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"text/html,application/json,*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:3000\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/server-status","summary":"","payload_hex":"474554202f7365727665722d73746174757320485454502f312e310d0a486f73743a20<HONEYPOT>3a333030300d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3133312e302e302e30205361666172692f3533372e33360d0a4163636570743a20746578742f68746d6c2c6170706c69636174696f6e2f6a736f6e2c2a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36","ja3":"2196848d251b217de8b2c037e356c11d","session":"15480888-2351-485b-b507-692dd9e6eb90","seq":9,"duration_ms":1005,"bytes_in":2147,"bytes_out":702},{"timestamp":"2026-09-09T15:12:46","port":3000,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"text/html,application/json,*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:3000\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/api/trpc","summary":"","payload_hex":"474554202f6170692f7472706320485454502f312e310d0a486f73743a20<HONEYPOT>3a333030300d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3133312e302e302e30205361666172692f3533372e33360d0a4163636570743a20746578742f68746d6c2c6170706c69636174696f6e2f6a736f6e2c2a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36","ja3":"2196848d251b217de8b2c037e356c11d","session":"15480888-2351-485b-b507-692dd9e6eb90","seq":8,"duration_ms":892,"bytes_in":1903,"bytes_out":624},{"timestamp":"2026-09-09T15:12:46","port":3000,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"text/html,application/json,*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:3000\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/api/status","summary":"","payload_hex":"474554202f6170692f73746174757320485454502f312e310d0a486f73743a20<HONEYPOT>3a333030300d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3133312e302e302e30205361666172692f3533372e33360d0a4163636570743a20746578742f68746d6c2c6170706c69636174696f6e2f6a736f6e2c2a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36","ja3":"2196848d251b217de8b2c037e356c11d","session":"15480888-2351-485b-b507-692dd9e6eb90","seq":7,"duration_ms":779,"bytes_in":1664,"bytes_out":546}],"http_methods":[{"method":"GET","count":27}],"distinct_ports_total":1,"top_paths":[{"path":"/","count":3,"ports":1},{"path":"/login","count":3,"ports":1},{"path":"/register","count":3,"ports":1},{"path":"/admin","count":2,"ports":1},{"path":"/manager/html","count":2,"ports":1},{"path":"/wp-login.php","count":2,"ports":1},{"path":"/server-status","count":2,"ports":1},{"path":"/api/trpc","count":2,"ports":1},{"path":"/api/config","count":2,"ports":1},{"path":"/dashboard","count":2,"ports":1},{"path":"/api/status","count":2,"ports":1},{"path":"/api/auth/get-session","count":1,"ports":1},{"path":"/api/trpc/settings.ai?batch=1&input=%7B%7D","count":1,"ports":1}],"distinct_paths_total":13,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","Accept-Encoding","Host","User-Agent"],"representative":[{"name":"Accept","value":"text/html,application/json,*/*","notable":false},{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Host","value":"<HONEYPOT>:3000","notable":false},{"name":"User-Agent","value":"Go-http-client/1.1","notable":false}],"distinct_sets":1,"events_with_headers":10},"tags":[],"data_as_of":"2026-09-11T07:00:41.758156+00:00"}