{"ip":"79.135.120.207","observed":true,"total_events":1012,"verdict":{"verdict":"scanning","label":"Scanning for known vulnerabilities","detail":"4 exploit-path probe(s)","confidence":"medium","network_type":"nsp","why":["4 request(s) matched a known exploit path.","Only GET/HEAD seen, no request body: scanning for the vulnerability, not delivering a payload.","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"175,545 bytes sent","bytes_sent":175545,"session_seconds":6,"persistent":false},"basis":"first_contact"},"first_seen":"2026-10-12T21:55:32","last_seen":"2026-10-12T22:01:06","events_24h":0,"events_7d":1012,"interactive_sessions":0,"interactive_sessions_24h":0,"interactive_sessions_7d":0,"interactive_protocols":[],"geo":{"country_code":"GB","country_name":"United Kingdom","region":"","city":"","lat":51.4964,"lon":-0.1224,"asn":212175,"org":"Stelia Ltd"},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as212175","label":"Stelia","category":"isp","url":"https://www.peeringdb.com/asn/212175"},"cve_matches":[{"cve_id":"CVE-2025-31125","title":"Vite Development Server - Path Traversal","severity":"medium","actively_exploited":true,"match_field":"url_path","matched_pattern":"/@fs/etc/passwd?import&?inline=1.wasm?init"},{"cve_id":"CVE-2025-31486","title":"Vite server.fs.deny Bypass - Local File Inclusion","severity":"medium","actively_exploited":false,"match_field":"url_path","matched_pattern":"/etc/passwd?.svg?.wasm?init"}],"malware":[],"udp":null,"interaction":null,"top_ports":[{"port":5173,"proto":"tcp","label":"","count":995},{"port":24678,"proto":"tcp","label":"","count":4},{"port":5172,"proto":"tcp","label":"","count":4},{"port":5175,"proto":"tcp","label":"","count":3},{"port":5174,"proto":"tcp","label":"","count":3},{"port":5171,"proto":"tcp","label":"","count":3}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i171000_ab0a1bf427ad_8e6e362c5eac"],"tls_client_hello":"16030105d5010005d10303744986be57410cccb75794b76d20cb82356356a4d9dd05e783efca7d64801711201d2a89c0538cfc85ce32752d777f97b2dd299e71931bf2872e61b31fd28cc9820022130213031301c02cc030c02bc02fcca9cca8c024c028c023c027009f009e006b006701000566ff01000100000b000403000102000a0012001011ec001d0017001e0018001901000101002300000016000000170000000d0036003409050906090404030503060308070808081a081b081c0809080a080b080408050806040105010601030303010302040205020602002b00050403040303002d00020101003304ea04e811ec04c0bac4a68696c3a34cc9444c1b93b351c691cd1ecb83234760ff5a5831631a54a7b50f244842654adc7553f78b6adda801fb7305d53718ff3ab784ba1a9cc368858a0616e2368c649c568b8081e3136cc9b549302c8d9ac31fe1c8f7731b39594f5c9b14710c1ecdc03452eb9c4992942855b1a1243db5b4ccc49ac5edc835e392b0d8d59b8efa91578430c7b79319d38f319391762813ecc1bc0ea0284c74a2360ca91c26b9fe86b6952376e5d11b7965991305028a0a6309db070e89c4d00cb4aa99c64696847535827586ce7793b47462028ff7a834a2c7a78796d7f37b502a6a2afb0440bb058ac59a6339103c32b93ad4a62fe06bc48b7a5b676a3983989f5583c0f0a619da74762599cf980296f3256406233ca52382d0486ce91d6320ba3e34b311001360d6c99571819b154cd8835e22645ef7a09e7be725e2dac35ab81b2e0cb7a7b8124ff214e3f19b4c806a4864c1d5848f57248156ea45d854918ab113dd4a4846194e85700e737840932908cfa248f980bc1680af2a7a26ba134a30196c46e69bd9263b52c5861e9a72cc0a208e7997515841e589af10b27b48ab7fcf0261be880a94d417363c7fc3d4c723bc621dac6c44b0b0fe6273a4287342cb248d98789371a8292c2e6e08aa79eabfb9546675f740a92b45de22248a2066b5276a067b30bd549f30d68c6b835ce8fbb35dd6773f8c4a66975526f855378b14c1146e3eb68454e6773ab16273b537b48582f2a98c7d580ca6745818a2aa3d099c4f838c16d2529bc624c0f70ed2707c74219f3ffc8f7b4226b4400849e28718b0b7cb2c31c4636671d589b012c28d009b3a34ab05eb6ecbf0574f0475634815bd5116ce122cf0f31c1c17453258ca67bb634987770ba82edc6068039aaff2dcba5a277b804496b0651c99eb6700e0447df74a3d5287ed9119657746062934327216de444b5928b45eda6b84f12b491c2df2a196e7c970bfa45cbae6127fe982aeea559a767eda3a7c3cd9bbe8724d797ac120725c4043acc4c4789bd455beac603248b52c153af2887073c69c65eb97fad6b4344275b1d17d1f83c6c39a94ad98a4389ac62a0a10a976b0793a1ab763379d93bbb9281f0481c49f276261b2c8eb3bc8f8928622c786f918651bb39bdc7c351c4574c9c706ad78c4920b25bf20a8249803ec7c085ad24c2fb70cadb952ad395869f875aa7942711ba2f1484dde213bfb0842e33ab6ea1b68f041c5389282fb962116f4cab96a38f010435b6a0111c828050230e2e42be5a1b187b46b286502255884c870858c0865e238c4215568f6d273d90c0473e09072510d091aa9e5e39ccb3a51c4d64497f443e3425c97720ddbfab666a083668a3b902826a7c6866b96cf79093b46125a177b8ef259185513289a0093c5f600b4b2470b90ce94957812a6060e6cb25fd7b6e7e35f358cc90a0b0fb9a6c78c517942f48322876423c745d82a899b0431ff0aca0d3363d7984331188dc3ca948d7019e8d1bca7a676516702f031790b5710d22745be7b750dd91d15171f323782ee565359d2bcb601b9cc76549fe81821b4161e99079dfb9afa3c15d96bb3e49b076b650e1a123c5a942c5a506e22c46dd1994e4c721d25635e18f65ad2d950649de9fbe6956de4bd594efb5d070239f81a9ffa94825a6032fac36599aa3b2b1708d095cbbdefabe8030d687f6c49723c651983699b30001d00203ac0d68f1eefd2b6ffb38cb79adff4eb31d3f67acf80c8202273bd","tls_ja3":["dbb158bbf02cb040164d288c9b1d8492"],"http_akin":["b11cun030_00040011_c91eaf54","b11cun040_00040015_4c87b06e","b11cun050_10040016_1ad00147","b11cun040_00040016_1d05953d","b10cun000_00000000_334359b9"]},"fingerprint_peers":{"b11cun030_00040011_c91eaf54":827,"b11cun040_00040015_4c87b06e":306,"b10cun000_00000000_334359b9":2390,"t13i171000_ab0a1bf427ad_8e6e362c5eac":109,"b11cun040_00040016_1d05953d":9,"b11cun050_10040016_1ad00147":1},"akin_families":{"b11cun040_00040015_4c87b06e":{"head":"b11cun040_00040015_4c87b06e","shapes":3,"ips":306}},"user_agents":["CryptoHunter-Vite-2026/1.0"],"timeline":[{"date":"2026-10-12","count":1012}],"recent_events":[{"timestamp":"2026-10-12T22:01:06","port":5173,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:5173\",\"user-agent\":\"CryptoHunter-Vite-2026/1.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/node_modules/home/deploy/.ssh/production.pem","summary":"","payload_hex":"474554202f6e6f64655f6d6f64756c65732f686f6d652f6465706c6f792f2e7373682f70726f64756374696f6e2e70656d20485454502f312e310d0a486f73743a20<HONEYPOT>3a353137330d0a557365722d4167656e743a2043727970746f48756e7465722d566974652d323032362f312e300d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"CryptoHunter-Vite-2026/1.0","ja3":"","session":"b055ed13-300d-40d2-bb8a-a255eeb4ec91","seq":1,"duration_ms":100,"bytes_in":160,"bytes_out":79},{"timestamp":"2026-10-12T22:00:57","port":5173,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:5173\",\"user-agent\":\"CryptoHunter-Vite-2026/1.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/node_modules/home/deploy/.ssh/prod.pem","summary":"","payload_hex":"474554202f6e6f64655f6d6f64756c65732f686f6d652f6465706c6f792f2e7373682f70726f642e70656d20485454502f312e310d0a486f73743a20<HONEYPOT>3a353137330d0a557365722d4167656e743a2043727970746f48756e7465722d566974652d323032362f312e300d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"CryptoHunter-Vite-2026/1.0","ja3":"","session":"7d3f0ad3-ca46-4c10-bf32-9da4886850b9","seq":1,"duration_ms":101,"bytes_in":154,"bytes_out":79},{"timestamp":"2026-10-12T22:00:57","port":5173,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:5173\",\"user-agent\":\"CryptoHunter-Vite-2026/1.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/node_modules/home/admin/.ssh/private_key","summary":"","payload_hex":"474554202f6e6f64655f6d6f64756c65732f686f6d652f61646d696e2f2e7373682f707269766174655f6b657920485454502f312e310d0a486f73743a20<HONEYPOT>3a353137330d0a557365722d4167656e743a2043727970746f48756e7465722d566974652d323032362f312e300d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"CryptoHunter-Vite-2026/1.0","ja3":"","session":"1e4d9184-c260-4f05-be09-a5a3489c4099","seq":1,"duration_ms":101,"bytes_in":156,"bytes_out":79},{"timestamp":"2026-10-12T22:00:57","port":5173,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:5173\",\"user-agent\":\"CryptoHunter-Vite-2026/1.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/node_modules/home/admin/.env.local","summary":"","payload_hex":"474554202f6e6f64655f6d6f64756c65732f686f6d652f61646d696e2f2e656e762e6c6f63616c20485454502f312e310d0a486f73743a20<HONEYPOT>3a353137330d0a557365722d4167656e743a2043727970746f48756e7465722d566974652d323032362f312e300d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"CryptoHunter-Vite-2026/1.0","ja3":"","session":"c6228dd6-b5c4-4b1e-8cee-239dbc3c5bfb","seq":1,"duration_ms":100,"bytes_in":150,"bytes_out":79},{"timestamp":"2026-10-12T22:00:57","port":5173,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:5173\",\"user-agent\":\"CryptoHunter-Vite-2026/1.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/node_modules/home/admin/.ssh/id_ed25519","summary":"","payload_hex":"474554202f6e6f64655f6d6f64756c65732f686f6d652f61646d696e2f2e7373682f69645f6564323535313920485454502f312e310d0a486f73743a20<HONEYPOT>3a353137330d0a557365722d4167656e743a2043727970746f48756e7465722d566974652d323032362f312e300d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"CryptoHunter-Vite-2026/1.0","ja3":"","session":"a69829b7-08f9-4773-b4c0-bc5ba2e68884","seq":1,"duration_ms":100,"bytes_in":155,"bytes_out":79},{"timestamp":"2026-10-12T22:00:57","port":5173,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:5173\",\"user-agent\":\"CryptoHunter-Vite-2026/1.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/node_modules/home/deploy/.ssh/github","summary":"","payload_hex":"474554202f6e6f64655f6d6f64756c65732f686f6d652f6465706c6f792f2e7373682f67697468756220485454502f312e310d0a486f73743a20<HONEYPOT>3a353137330d0a557365722d4167656e743a2043727970746f48756e7465722d566974652d323032362f312e300d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"CryptoHunter-Vite-2026/1.0","ja3":"","session":"a6b6d13f-b263-495c-823d-41a6cee79394","seq":1,"duration_ms":100,"bytes_in":152,"bytes_out":79},{"timestamp":"2026-10-12T22:00:57","port":5173,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:5173\",\"user-agent\":\"CryptoHunter-Vite-2026/1.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/node_modules/home/deploy/.ssh/id_rsa","summary":"","payload_hex":"474554202f6e6f64655f6d6f64756c65732f686f6d652f6465706c6f792f2e7373682f69645f72736120485454502f312e310d0a486f73743a20<HONEYPOT>3a353137330d0a557365722d4167656e743a2043727970746f48756e7465722d566974652d323032362f312e300d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"CryptoHunter-Vite-2026/1.0","ja3":"","session":"632abe7e-ad66-40d7-8fb6-b17d14e204f2","seq":1,"duration_ms":100,"bytes_in":152,"bytes_out":79},{"timestamp":"2026-10-12T22:00:57","port":5173,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:5173\",\"user-agent\":\"CryptoHunter-Vite-2026/1.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/node_modules/home/admin/.pgpass","summary":"","payload_hex":"474554202f6e6f64655f6d6f64756c65732f686f6d652f61646d696e2f2e70677061737320485454502f312e310d0a486f73743a20<HONEYPOT>3a353137330d0a557365722d4167656e743a2043727970746f48756e7465722d566974652d323032362f312e300d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"CryptoHunter-Vite-2026/1.0","ja3":"","session":"583dc093-cb52-4215-bb23-490bdfca2a03","seq":1,"duration_ms":100,"bytes_in":147,"bytes_out":79},{"timestamp":"2026-10-12T22:00:57","port":5173,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:5173\",\"user-agent\":\"CryptoHunter-Vite-2026/1.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/node_modules/home/admin/.aws/credentials","summary":"","payload_hex":"474554202f6e6f64655f6d6f64756c65732f686f6d652f61646d696e2f2e6177732f63726564656e7469616c7320485454502f312e310d0a486f73743a20<HONEYPOT>3a353137330d0a557365722d4167656e743a2043727970746f48756e7465722d566974652d323032362f312e300d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"CryptoHunter-Vite-2026/1.0","ja3":"","session":"35b44692-c0f4-40df-82fd-425c7446beee","seq":1,"duration_ms":112,"bytes_in":156,"bytes_out":79},{"timestamp":"2026-10-12T22:00:57","port":5173,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:5173\",\"user-agent\":\"CryptoHunter-Vite-2026/1.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/node_modules/home/deploy/.ssh/id_ed25519","summary":"","payload_hex":"474554202f6e6f64655f6d6f64756c65732f686f6d652f6465706c6f792f2e7373682f69645f6564323535313920485454502f312e310d0a486f73743a20<HONEYPOT>3a353137330d0a557365722d4167656e743a2043727970746f48756e7465722d566974652d323032362f312e300d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"CryptoHunter-Vite-2026/1.0","ja3":"","session":"19d8bf99-647a-46fe-9ea7-1ff13eca6463","seq":1,"duration_ms":112,"bytes_in":156,"bytes_out":79}],"http_methods":[{"method":"GET","count":1012}],"distinct_ports_total":6,"top_paths":[{"path":"/","count":32,"ports":6},{"path":"/@fs/etc/passwd?import&raw","count":4,"ports":1},{"path":"/@vite/client","count":2,"ports":1},{"path":"/assets/..%2fpackage.json","count":2,"ports":1},{"path":"/assets/%2e%2e%2fpackage.json","count":2,"ports":1},{"path":"/favicon.ico/","count":2,"ports":1},{"path":"/etc/passwd","count":2,"ports":1},{"path":"/node_modules/.vite/deps/_metadata.json","count":2,"ports":1},{"path":"/vite.svg/","count":2,"ports":1},{"path":"/node_modules/root/.config/gcloud/application_default_credentials.json","count":1,"ports":1},{"path":"/node_modules/proc/1/environ","count":1,"ports":1},{"path":"/node_modules/run/secrets/db_password","count":1,"ports":1},{"path":"/node_modules/lib/systemd/system/pm2.service","count":1,"ports":1},{"path":"/node_modules/home/ubuntu/.ssh/relayer.pem","count":1,"ports":1},{"path":"/node_modules/etc/systemd/system/orchestrator.service.d/override.conf","count":1,"ports":1}],"distinct_paths_total":200,"top_snis":[],"top_hosts":[{"value":"file","count":1},{"value":"vite-posture-probe.invalid","count":1}],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","Connection","Host","User-Agent"],"representative":[{"name":"Accept","value":"*/*","notable":false},{"name":"Connection","value":"close","notable":false},{"name":"Host","value":"<HONEYPOT>:5173","notable":false},{"name":"User-Agent","value":"CryptoHunter-Vite-2026/1.0","notable":false}],"distinct_sets":1,"events_with_headers":10},"tags":[{"tag_id":"CVE-2025-31125","tag_type":"cve","title":"Vite Development Server - Path Traversal","severity":"medium","actively_exploited":true,"match_field":"url_path","matched_pattern":"/@fs/etc/passwd?import&?inline=1.wasm?init","reference_urls":["https://github.com/vitejs/vite/issues/8498","https://github.com/vitejs/vite/pull/8804","https://github.com/vitejs/vite/pull/8979","https://nvd.nist.gov/vuln/detail/CVE-2025-31125"]},{"tag_id":"CVE-2025-31486","tag_type":"cve","title":"Vite server.fs.deny Bypass - Local File Inclusion","severity":"medium","actively_exploited":false,"match_field":"url_path","matched_pattern":"/etc/passwd?.svg?.wasm?init","reference_urls":["https://github.com/advisories/GHSA-xcj6-pq6g-qj4x","https://github.com/vitejs/vite/blob/037f801075ec35bb6e52145d659f71a23813c48f/packages/vite/src/node/plugins/asset.ts#L285-L290","https://github.com/vitejs/vite/commit/62d7e81ee189d65899bb65f3263ddbd85247b647","https://github.com/vitejs/vite/security/advisories/GHSA-xcj6-pq6g-qj4x","https://nvd.nist.gov/vuln/detail/CVE-2025-31486"]}],"data_as_of":"2026-10-15T04:50:44.390619+00:00"}