{"ip":"93.123.109.234","total_events":395,"verdict":{"verdict":"scanning","label":"Scanning for known vulnerabilities","detail":"14 exploit-path probe(s)","confidence":"medium","network_type":null,"why":["14 request(s) matched a known exploit path.","Only GET/HEAD seen, no request body: scanning for the vulnerability, not delivering a payload.","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"45,846 bytes sent","bytes_sent":45846,"session_seconds":0,"persistent":false}},"first_seen":"2026-08-09T12:20:13","last_seen":"2026-09-03T02:00:21","events_24h":0,"events_7d":0,"geo":{"country_code":"BG","country_name":"Bulgaria","region":"","city":"","lat":42.696,"lon":23.332,"asn":48090,"org":"Techoff Srv Limited"},"source_domain":null,"known_scanners":[],"scanner_tag":null,"cve_matches":[],"malware":[],"top_ports":[{"port":8443,"proto":"tcp","label":"HTTPS-alt","count":211},{"port":80,"proto":"tcp","label":"HTTP","count":67},{"port":8888,"proto":"tcp","label":"HTTP-alt","count":46},{"port":8000,"proto":"tcp","label":"HTTP-alt","count":43},{"port":443,"proto":"tcp","label":"HTTPS","count":21},{"port":8080,"proto":"tcp","label":"HTTP-alt","count":7}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i191000_9dc949149365_e5728521abd4"],"tls_client_hello":"","tls_ja3":["96458b3de39df5d47bc5c4a9f10f8f26"],"http_akin":[]},"fingerprint_peers":{"t13i191000_9dc949149365_e5728521abd4":187},"user_agents":["l9tcpid/v1.1.0","l9explore/1.2.2"],"timeline":[{"date":"2026-08-09","count":7},{"date":"2026-08-10","count":18},{"date":"2026-08-12","count":18},{"date":"2026-08-13","count":14},{"date":"2026-08-14","count":7},{"date":"2026-08-15","count":7},{"date":"2026-08-17","count":32},{"date":"2026-08-18","count":25},{"date":"2026-08-19","count":17},{"date":"2026-08-21","count":7},{"date":"2026-08-23","count":18},{"date":"2026-08-24","count":7},{"date":"2026-08-25","count":7},{"date":"2026-08-26","count":7},{"date":"2026-08-29","count":14},{"date":"2026-08-31","count":102},{"date":"2026-09-02","count":81},{"date":"2026-09-03","count":7}],"recent_events":[{"timestamp":"2026-09-03T02:00:21","port":8443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8443\",\"user-agent\":\"l9explore/1.2.2\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/.npmrc","summary":"","payload_hex":"474554202f2e6e706d726320485454502f312e310d0a486f73743a20<HONEYPOT>3a383434330d0a557365722d4167656e743a206c396578706c6f72652f312e322e320d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"l9explore/1.2.2","ja3":"96458b3de39df5d47bc5c4a9f10f8f26","session":"7d6f5a51-a611-4e55-87d1-10076b7d298a","seq":1,"duration_ms":100,"bytes_in":120,"bytes_out":79},{"timestamp":"2026-09-03T02:00:21","port":8443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8443\",\"user-agent\":\"l9explore/1.2.2\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/.env.local","summary":"","payload_hex":"474554202f2e656e762e6c6f63616c20485454502f312e310d0a486f73743a20<HONEYPOT>3a383434330d0a557365722d4167656e743a206c396578706c6f72652f312e322e320d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"l9explore/1.2.2","ja3":"96458b3de39df5d47bc5c4a9f10f8f26","session":"1149c8d4-1f0d-40cd-9016-c1d30bbd34f8","seq":1,"duration_ms":100,"bytes_in":124,"bytes_out":79},{"timestamp":"2026-09-03T02:00:20","port":8443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8443\",\"user-agent\":\"l9explore/1.2.2\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/.git-credentials","summary":"","payload_hex":"474554202f2e6769742d63726564656e7469616c7320485454502f312e310d0a486f73743a20<HONEYPOT>3a383434330d0a557365722d4167656e743a206c396578706c6f72652f312e322e320d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"l9explore/1.2.2","ja3":"96458b3de39df5d47bc5c4a9f10f8f26","session":"5d906ee0-3a98-4097-bc42-f56f35af28e3","seq":1,"duration_ms":100,"bytes_in":130,"bytes_out":79},{"timestamp":"2026-09-03T02:00:20","port":8443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8443\",\"user-agent\":\"l9explore/1.2.2\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/.git/HEAD","summary":"","payload_hex":"474554202f2e6769742f4845414420485454502f312e310d0a486f73743a20<HONEYPOT>3a383434330d0a557365722d4167656e743a206c396578706c6f72652f312e322e320d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"l9explore/1.2.2","ja3":"96458b3de39df5d47bc5c4a9f10f8f26","session":"c0383cf5-dab7-4759-81e6-a8a2e0e5c275","seq":1,"duration_ms":100,"bytes_in":123,"bytes_out":79},{"timestamp":"2026-09-03T02:00:19","port":8443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8443\",\"user-agent\":\"l9explore/1.2.2\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/.git/config","summary":"","payload_hex":"474554202f2e6769742f636f6e66696720485454502f312e310d0a486f73743a20<HONEYPOT>3a383434330d0a557365722d4167656e743a206c396578706c6f72652f312e322e320d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"l9explore/1.2.2","ja3":"96458b3de39df5d47bc5c4a9f10f8f26","session":"01967bd1-81b6-448f-abe3-5b1c41f2dd18","seq":1,"duration_ms":100,"bytes_in":125,"bytes_out":79},{"timestamp":"2026-09-03T02:00:16","port":8443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"l9tcpid/v1.1.0\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a206c3974637069642f76312e312e300d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"l9tcpid/v1.1.0","ja3":"96458b3de39df5d47bc5c4a9f10f8f26","session":"80747e02-4568-4078-8b55-b6464cf16ffd","seq":1,"duration_ms":100,"bytes_in":85,"bytes_out":79},{"timestamp":"2026-09-03T02:00:09","port":8443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"","headers":"{\"host\":\"\"}","body":"HELP\r\nEHLO leakix.net\r\n?\r\n\r\n","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a200d0a0d0a48454c500d0a45484c4f206c65616b69782e6e65740d0a3f0d0a0d0a","method":"GET","user_agent":"","ja3":"96458b3de39df5d47bc5c4a9f10f8f26","session":"243e0fdf-8299-45c8-b4b7-070694c7506c","seq":1,"duration_ms":100,"bytes_in":54,"bytes_out":79},{"timestamp":"2026-09-02T18:55:45","port":8443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8443\",\"user-agent\":\"l9explore/1.2.2\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/.env.production","summary":"","payload_hex":"474554202f2e656e762e70726f64756374696f6e20485454502f312e310d0a486f73743a20<HONEYPOT>3a383434330d0a557365722d4167656e743a206c396578706c6f72652f312e322e320d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"l9explore/1.2.2","ja3":"96458b3de39df5d47bc5c4a9f10f8f26","session":"d18a72ec-9f9f-4b16-b96e-436b791079c9","seq":1,"duration_ms":100,"bytes_in":131,"bytes_out":79},{"timestamp":"2026-09-02T18:55:42","port":8443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"l9tcpid/v1.1.0\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a206c3974637069642f76312e312e300d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"l9tcpid/v1.1.0","ja3":"96458b3de39df5d47bc5c4a9f10f8f26","session":"3bdba89a-c69e-4d19-9eeb-c2f6bf5981de","seq":1,"duration_ms":100,"bytes_in":87,"bytes_out":79},{"timestamp":"2026-09-02T18:55:37","port":8443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8443\",\"user-agent\":\"l9explore/1.2.2\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/.env.backup","summary":"","payload_hex":"474554202f2e656e762e6261636b757020485454502f312e310d0a486f73743a20<HONEYPOT>3a383434330d0a557365722d4167656e743a206c396578706c6f72652f312e322e320d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"l9explore/1.2.2","ja3":"96458b3de39df5d47bc5c4a9f10f8f26","session":"f18ebfa0-f547-4a22-a816-9d08e5efb2fb","seq":1,"duration_ms":100,"bytes_in":127,"bytes_out":79}],"http_methods":[{"method":"GET","count":395}],"distinct_ports_total":6,"top_paths":[{"path":"/","count":68,"ports":6},{"path":"/.env.backup","count":19,"ports":4},{"path":"/.git/config","count":19,"ports":5},{"path":"/.env","count":18,"ports":6},{"path":"/.env.old","count":18,"ports":5},{"path":"/.env.local","count":17,"ports":5},{"path":"/.env.production","count":17,"ports":4},{"path":"/.env.development","count":16,"ports":5},{"path":"/.npmrc","count":15,"ports":5},{"path":"/info.php","count":15,"ports":4},{"path":"/terraform.tfstate","count":15,"ports":4},{"path":"/appsettings.json","count":15,"ports":5},{"path":"/.env.staging","count":14,"ports":4},{"path":"/.env.prod","count":14,"ports":4},{"path":"/.git/HEAD","count":14,"ports":5}],"distinct_paths_total":23,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept-Encoding","Connection","Host","User-Agent"],"representative":[{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Connection","value":"close","notable":false},{"name":"Host","value":"<HONEYPOT>:8443","notable":false},{"name":"User-Agent","value":"l9explore/1.2.2","notable":false}],"distinct_sets":3,"events_with_headers":10},"tags":[],"data_as_of":"2026-09-23T02:41:12.399774+00:00"}