{"ip":"87.120.104.29","total_events":522,"verdict":{"verdict":"scanning","label":"Scanning for known vulnerabilities","detail":"98 exploit-path probe(s)","confidence":"medium","network_type":null,"why":["98 request(s) matched a known exploit path.","Only GET/HEAD seen, no request body: scanning for the vulnerability, not delivering a payload.","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"246,048 bytes sent","bytes_sent":246048,"session_seconds":3,"persistent":false}},"first_seen":"2026-08-24T01:56:19","last_seen":"2026-08-24T01:56:25","events_24h":0,"events_7d":522,"geo":{"country_code":"NO","country_name":"Norway","region":"Vestfold","city":"Sandefjord","lat":59.1346,"lon":10.2211,"asn":211443,"org":"Sino Worldwide Trading Limited"},"source_domain":null,"known_scanners":[],"scanner_tag":null,"cve_matches":[{"cve_id":"CVE-2020-9425","title":"rConfig <3.9.4 - Sensitive Information Disclosure","severity":"high","actively_exploited":false,"match_field":"url_path","matched_pattern":"/settings.php"},{"cve_id":"CVE-2024-4836","title":"Edito CMS - Sensitive Data Leak","severity":"high","actively_exploited":false,"match_field":"url_path","matched_pattern":"/config/config.php"}],"malware":[],"top_ports":[{"port":80,"proto":"tcp","label":"HTTP","count":300},{"port":8080,"proto":"tcp","label":"HTTP-alt","count":142},{"port":443,"proto":"tcp","label":"HTTPS","count":54},{"port":8443,"proto":"tcp","label":"HTTPS-alt","count":26}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i131000_f57a46bbacb6_ab7e3b40a677"],"tls_ja3":["2196848d251b217de8b2c037e356c11d"],"ja4h":["ge11nn0400_88d30a62b7ad"]},"fingerprint_peers":{"t13i131000_f57a46bbacb6_ab7e3b40a677":5382,"ge11nn0400_88d30a62b7ad":4972},"user_agents":["Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"],"timeline":[{"date":"2026-08-24","count":522}],"recent_events":[{"timestamp":"2026-08-24T01:56:25","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/.env.temp","summary":"","payload_hex":"474554202f2e656e762e74656d7020485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b20476f6f676c65626f742f322e313b202b687474703a2f2f7777772e676f6f676c652e636f6d2f626f742e68746d6c290d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)","ja3":"","session":"11132cbc-7577-4dd9-baad-44718fc3f932","seq":7,"duration_ms":1603,"bytes_in":1204,"bytes_out":546},{"timestamp":"2026-08-24T01:56:25","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/config/config.php","summary":"","payload_hex":"474554202f636f6e6669672f636f6e6669672e70687020485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b20476f6f676c65626f742f322e313b202b687474703a2f2f7777772e676f6f676c652e636f6d2f626f742e68746d6c290d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)","ja3":"","session":"d929d3a2-e4c0-4942-a2ae-22355087293c","seq":6,"duration_ms":1599,"bytes_in":1049,"bytes_out":468},{"timestamp":"2026-08-24T01:56:25","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/config/database.yml","summary":"","payload_hex":"474554202f636f6e6669672f64617461626173652e796d6c20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b20476f6f676c65626f742f322e313b202b687474703a2f2f7777772e676f6f676c652e636f6d2f626f742e68746d6c290d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)","ja3":"","session":"d5715944-0db1-4170-ab6a-2c0039ed2b9f","seq":7,"duration_ms":1602,"bytes_in":1199,"bytes_out":546},{"timestamp":"2026-08-24T01:56:25","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/.dockerenv","summary":"","payload_hex":"474554202f2e646f636b6572656e7620485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b20476f6f676c65626f742f322e313b202b687474703a2f2f7777772e676f6f676c652e636f6d2f626f742e68746d6c290d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)","ja3":"","session":"57379bdd-c3c2-4946-bc32-b19565dc3278","seq":6,"duration_ms":1600,"bytes_in":1063,"bytes_out":468},{"timestamp":"2026-08-24T01:56:25","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/config.php","summary":"","payload_hex":"474554202f636f6e6669672e70687020485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b20476f6f676c65626f742f322e313b202b687474703a2f2f7777772e676f6f676c652e636f6d2f626f742e68746d6c290d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)","ja3":"","session":"69229d96-0396-48d1-8942-12d29b1e1051","seq":6,"duration_ms":1598,"bytes_in":1028,"bytes_out":468},{"timestamp":"2026-08-24T01:56:25","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/web/.env","summary":"","payload_hex":"474554202f7765622f2e656e7620485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b20476f6f676c65626f742f322e313b202b687474703a2f2f7777772e676f6f676c652e636f6d2f626f742e68746d6c290d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)","ja3":"","session":"155cef56-1c34-46ec-8d31-2609b67b36cd","seq":7,"duration_ms":1599,"bytes_in":1212,"bytes_out":546},{"timestamp":"2026-08-24T01:56:25","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/.env.json","summary":"","payload_hex":"474554202f2e656e762e6a736f6e20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b20476f6f676c65626f742f322e313b202b687474703a2f2f7777772e676f6f676c652e636f6d2f626f742e68746d6c290d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)","ja3":"","session":"2ab81c90-34f8-4960-b81d-a25c40362ee3","seq":6,"duration_ms":1596,"bytes_in":1055,"bytes_out":468},{"timestamp":"2026-08-24T01:56:25","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/html/.env","summary":"","payload_hex":"474554202f68746d6c2f2e656e7620485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b20476f6f676c65626f742f322e313b202b687474703a2f2f7777772e676f6f676c652e636f6d2f626f742e68746d6c290d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)","ja3":"","session":"bf026033-bd72-4767-a0eb-852a691c9511","seq":6,"duration_ms":1595,"bytes_in":1036,"bytes_out":468},{"timestamp":"2026-08-24T01:56:25","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/database.yml","summary":"","payload_hex":"474554202f64617461626173652e796d6c20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b20476f6f676c65626f742f322e313b202b687474703a2f2f7777772e676f6f676c652e636f6d2f626f742e68746d6c290d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)","ja3":"","session":"8f94356b-7522-40a0-9879-4b0739ef5dc5","seq":6,"duration_ms":1595,"bytes_in":1031,"bytes_out":468},{"timestamp":"2026-08-24T01:56:25","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/.env.save~","summary":"","payload_hex":"474554202f2e656e762e736176657e20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b20476f6f676c65626f742f322e313b202b687474703a2f2f7777772e676f6f676c652e636f6d2f626f742e68746d6c290d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)","ja3":"","session":"2cc761ef-8dd5-4278-8c62-32a82d6aeed1","seq":6,"duration_ms":1592,"bytes_in":1035,"bytes_out":468}],"http_methods":[{"method":"GET","count":522}],"distinct_ports_total":4,"top_paths":[{"path":"/.env.backup","count":5,"ports":4},{"path":"/docker-compose.yml","count":5,"ports":4},{"path":"/.env.local","count":5,"ports":4},{"path":"/.npmrc","count":5,"ports":4},{"path":"/.htaccess","count":5,"ports":4},{"path":"/config.php","count":5,"ports":4},{"path":"/.git/config","count":5,"ports":4},{"path":"/.yarnrc","count":5,"ports":4},{"path":"/wp-config.php","count":5,"ports":4},{"path":"/wp-config.php.bak","count":5,"ports":4},{"path":"/.circleci/config.yml","count":5,"ports":4},{"path":"/wp-config.php~","count":5,"ports":4},{"path":"/.aws/credentials","count":5,"ports":4},{"path":"/.git/HEAD","count":5,"ports":4},{"path":"/composer.json","count":5,"ports":4}],"distinct_paths_total":150,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","Accept-Encoding","Host","User-Agent"],"representative":[{"name":"Accept","value":"*/*","notable":false},{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Host","value":"<HONEYPOT>","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)","notable":false}],"distinct_sets":1,"events_with_headers":10},"tags":[{"tag_id":"CVE-2020-9425","tag_type":"cve","title":"rConfig <3.9.4 - Sensitive Information Disclosure","severity":"high","actively_exploited":false,"match_field":"url_path","matched_pattern":"/settings.php","reference_urls":["https://blog.hivint.com/rconfig-3-9-3-unauthenticated-sensitive-information-disclosure-ead4ed88f153","https://github.com/rconfig/rconfig/commit/20f4e3d87e84663d922b937842fddd9af1b68dd9","https://nvd.nist.gov/vuln/detail/CVE-2020-9425","https://github.com/ARPSyndicate/cvemon","https://github.com/ARPSyndicate/kenzer-templates"]},{"tag_id":"CVE-2024-4836","tag_type":"cve","title":"Edito CMS - Sensitive Data Leak","severity":"high","actively_exploited":false,"match_field":"url_path","matched_pattern":"/config/config.php","reference_urls":["https://cert.pl/en/posts/2024/07/CVE-2024-4836/","https://github.com/sleep46/CVE-2024-4836_Check","https://nvd.nist.gov/vuln/detail/CVE-2024-4836"]}],"data_as_of":"2026-08-25T06:43:39.740369+00:00"}