{"ip":"93.123.109.228","total_events":4920,"verdict":{"verdict":"scanning","label":"Scanning for known vulnerabilities","detail":"14 exploit-path probe(s)","confidence":"medium","network_type":null,"why":["14 request(s) matched a known exploit path.","Only GET/HEAD seen, no request body: scanning for the vulnerability, not delivering a payload.","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"571,691 bytes sent","bytes_sent":571691,"session_seconds":0,"persistent":false}},"first_seen":"2026-08-15T19:26:30","last_seen":"2026-08-28T12:21:16","events_24h":0,"events_7d":0,"geo":{"country_code":"BG","country_name":"Bulgaria","region":"","city":"","lat":42.696,"lon":23.332,"asn":48090,"org":"Techoff Srv Limited"},"source_domain":null,"known_scanners":[],"scanner_tag":null,"cve_matches":[],"malware":[],"top_ports":[{"port":80,"proto":"tcp","label":"HTTP","count":2667},{"port":443,"proto":"tcp","label":"HTTPS","count":1833},{"port":8080,"proto":"tcp","label":"HTTP-alt","count":420}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i191000_9dc949149365_e5728521abd4"],"tls_ja3":["96458b3de39df5d47bc5c4a9f10f8f26"],"ja4h":["ge11nn0300_86b6b04cb9cc","ge11nn0400_9c3956fad5da","ge11nn0100_4740ae6347b0"]},"fingerprint_peers":{"t13i191000_9dc949149365_e5728521abd4":168,"ge11nn0300_86b6b04cb9cc":5250,"ge11nn0400_9c3956fad5da":1581,"ge11nn0100_4740ae6347b0":609},"user_agents":["l9tcpid/v1.1.0","l9explore/1.2.2"],"timeline":[{"date":"2026-08-15","count":108},{"date":"2026-08-16","count":360},{"date":"2026-08-18","count":331},{"date":"2026-08-19","count":431},{"date":"2026-08-20","count":505},{"date":"2026-08-21","count":707},{"date":"2026-08-22","count":264},{"date":"2026-08-23","count":378},{"date":"2026-08-24","count":518},{"date":"2026-08-25","count":356},{"date":"2026-08-26","count":351},{"date":"2026-08-27","count":421},{"date":"2026-08-28","count":190}],"recent_events":[{"timestamp":"2026-08-28T12:21:16","port":8080,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8080\",\"user-agent\":\"l9explore/1.2.2\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/.env.development","summary":"","payload_hex":"474554202f2e656e762e646576656c6f706d656e7420485454502f312e310d0a486f73743a20<HONEYPOT>3a383038300d0a557365722d4167656e743a206c396578706c6f72652f312e322e320d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"l9explore/1.2.2","ja3":"96458b3de39df5d47bc5c4a9f10f8f26","session":"4e9bf44b-a769-4ba1-8546-0c9f02f30c1e","seq":1,"duration_ms":100,"bytes_in":130,"bytes_out":79},{"timestamp":"2026-08-28T12:21:16","port":8080,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8080\",\"user-agent\":\"l9explore/1.2.2\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/.npmrc","summary":"","payload_hex":"474554202f2e6e706d726320485454502f312e310d0a486f73743a20<HONEYPOT>3a383038300d0a557365722d4167656e743a206c396578706c6f72652f312e322e320d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"l9explore/1.2.2","ja3":"96458b3de39df5d47bc5c4a9f10f8f26","session":"d96e7583-7c34-4178-b149-a45b28d1a918","seq":1,"duration_ms":101,"bytes_in":120,"bytes_out":79},{"timestamp":"2026-08-28T12:21:16","port":8080,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8080\",\"user-agent\":\"l9explore/1.2.2\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/.git/HEAD","summary":"","payload_hex":"474554202f2e6769742f4845414420485454502f312e310d0a486f73743a20<HONEYPOT>3a383038300d0a557365722d4167656e743a206c396578706c6f72652f312e322e320d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"l9explore/1.2.2","ja3":"96458b3de39df5d47bc5c4a9f10f8f26","session":"2689b7a5-74b5-4759-8aa2-7bde053189f7","seq":1,"duration_ms":100,"bytes_in":123,"bytes_out":79},{"timestamp":"2026-08-28T12:21:15","port":8080,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8080\",\"user-agent\":\"l9explore/1.2.2\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/.git/config","summary":"","payload_hex":"474554202f2e6769742f636f6e66696720485454502f312e310d0a486f73743a20<HONEYPOT>3a383038300d0a557365722d4167656e743a206c396578706c6f72652f312e322e320d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"l9explore/1.2.2","ja3":"96458b3de39df5d47bc5c4a9f10f8f26","session":"7f9e99d3-5363-47da-8915-d2657f6dcc0d","seq":1,"duration_ms":100,"bytes_in":125,"bytes_out":79},{"timestamp":"2026-08-28T12:21:15","port":8080,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8080\",\"user-agent\":\"l9explore/1.2.2\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/.env.bak","summary":"","payload_hex":"474554202f2e656e762e62616b20485454502f312e310d0a486f73743a20<HONEYPOT>3a383038300d0a557365722d4167656e743a206c396578706c6f72652f312e322e320d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"l9explore/1.2.2","ja3":"96458b3de39df5d47bc5c4a9f10f8f26","session":"911ae06f-a805-4d11-9c10-9249b667d7d2","seq":1,"duration_ms":100,"bytes_in":122,"bytes_out":79},{"timestamp":"2026-08-28T12:21:12","port":8080,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"l9tcpid/v1.1.0\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a206c3974637069642f76312e312e300d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"l9tcpid/v1.1.0","ja3":"96458b3de39df5d47bc5c4a9f10f8f26","session":"b2f6b83a-9c30-4f12-86c3-7765a9581333","seq":1,"duration_ms":101,"bytes_in":85,"bytes_out":79},{"timestamp":"2026-08-28T12:21:05","port":8080,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"","headers":"{\"host\":\"\"}","body":"HELP\r\nEHLO leakix.net\r\n?\r\n\r\n","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a200d0a0d0a48454c500d0a45484c4f206c65616b69782e6e65740d0a3f0d0a0d0a","method":"GET","user_agent":"","ja3":"96458b3de39df5d47bc5c4a9f10f8f26","session":"0f1bf715-d5e7-466d-a76f-1fab163e2c2b","seq":1,"duration_ms":100,"bytes_in":54,"bytes_out":79},{"timestamp":"2026-08-28T12:05:56","port":8080,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8080\",\"user-agent\":\"l9explore/1.2.2\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/.npmrc","summary":"","payload_hex":"474554202f2e6e706d726320485454502f312e310d0a486f73743a20<HONEYPOT>3a383038300d0a557365722d4167656e743a206c396578706c6f72652f312e322e320d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"l9explore/1.2.2","ja3":"96458b3de39df5d47bc5c4a9f10f8f26","session":"73e14fad-f6f3-4d3d-8aed-2115e4007513","seq":1,"duration_ms":100,"bytes_in":120,"bytes_out":79},{"timestamp":"2026-08-28T12:05:55","port":8080,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8080\",\"user-agent\":\"l9explore/1.2.2\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/.git-credentials","summary":"","payload_hex":"474554202f2e6769742d63726564656e7469616c7320485454502f312e310d0a486f73743a20<HONEYPOT>3a383038300d0a557365722d4167656e743a206c396578706c6f72652f312e322e320d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"l9explore/1.2.2","ja3":"96458b3de39df5d47bc5c4a9f10f8f26","session":"51afec7f-7163-4895-b637-90b3240bf727","seq":1,"duration_ms":100,"bytes_in":130,"bytes_out":79},{"timestamp":"2026-08-28T12:05:55","port":8080,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8080\",\"user-agent\":\"l9explore/1.2.2\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/.env.prod","summary":"","payload_hex":"474554202f2e656e762e70726f6420485454502f312e310d0a486f73743a20<HONEYPOT>3a383038300d0a557365722d4167656e743a206c396578706c6f72652f312e322e320d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"l9explore/1.2.2","ja3":"96458b3de39df5d47bc5c4a9f10f8f26","session":"c99f05fd-2576-42f4-8add-b9686069d39d","seq":1,"duration_ms":101,"bytes_in":123,"bytes_out":79}],"http_methods":[{"method":"GET","count":4920}],"distinct_ports_total":3,"top_paths":[{"path":"/","count":684,"ports":3},{"path":"/.env.bak","count":218,"ports":3},{"path":"/.env","count":215,"ports":3},{"path":"/.env.old","count":212,"ports":3},{"path":"/.env.prod","count":211,"ports":3},{"path":"/.env.staging","count":205,"ports":3},{"path":"/.env.production","count":202,"ports":3},{"path":"/.env.local","count":201,"ports":3},{"path":"/app/.env","count":199,"ports":3},{"path":"/.env.development","count":193,"ports":3},{"path":"/.aws/credentials","count":193,"ports":3},{"path":"/.npmrc","count":192,"ports":3},{"path":"/.git/HEAD","count":192,"ports":3},{"path":"/.git-credentials","count":191,"ports":3},{"path":"/.git/config","count":189,"ports":3}],"distinct_paths_total":23,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept-Encoding","Connection","Host","User-Agent"],"representative":[{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Connection","value":"close","notable":false},{"name":"Host","value":"<HONEYPOT>:8080","notable":false},{"name":"User-Agent","value":"l9explore/1.2.2","notable":false}],"distinct_sets":3,"events_with_headers":10},"tags":[],"data_as_of":"2026-09-04T21:06:56.115033+00:00"}