{"ip":"94.154.43.43","total_events":93,"verdict":{"verdict":"scanning","label":"Scanning for known vulnerabilities","detail":"11 exploit-path probe(s)","confidence":"medium","network_type":null,"why":["11 request(s) matched a known exploit path.","Only GET/HEAD seen, no request body: scanning for the vulnerability, not delivering a payload.","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"10,188 bytes sent","bytes_sent":10188,"session_seconds":0,"persistent":false}},"first_seen":"2026-08-05T23:49:01","last_seen":"2026-08-15T23:25:56","events_24h":4,"events_7d":89,"geo":{"country_code":"NL","country_name":"The Netherlands","region":"North Holland","city":"Amsterdam","lat":52.3716,"lon":4.8883,"asn":219502,"org":"Storm Industries LLC"},"source_domain":null,"known_scanners":[],"scanner_tag":null,"cve_matches":[],"malware":[],"top_ports":[{"port":6000,"proto":"tcp","label":"X11","count":13},{"port":4000,"proto":"tcp","label":"","count":12},{"port":8443,"proto":"tcp","label":"HTTPS-alt","count":12},{"port":3000,"proto":"tcp","label":"Web-alt","count":12},{"port":5002,"proto":"tcp","label":"","count":12},{"port":3003,"proto":"tcp","label":"","count":12},{"port":4001,"proto":"tcp","label":"","count":12},{"port":5003,"proto":"tcp","label":"","count":2},{"port":2375,"proto":"tcp","label":"Docker","count":2},{"port":2376,"proto":"tcp","label":"Docker-TLS","count":2},{"port":4002,"proto":"tcp","label":"","count":1},{"port":443,"proto":"tcp","label":"HTTPS","count":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i130900_f57a46bbacb6_e7c285222651"],"tls_ja3":["6639916abfac56b9257ca216677085bc"],"ja4h":["ge11nn0400_17292dadbc7b","ge11nn0400_9c3956fad5da"]},"fingerprint_peers":{"t13i130900_f57a46bbacb6_e7c285222651":3696,"ge11nn0400_9c3956fad5da":1488,"ge11nn0400_17292dadbc7b":2854},"user_agents":["Docker-API-Detector/1.0","Mozilla/5.0"],"timeline":[{"date":"2026-08-05","count":2},{"date":"2026-08-06","count":2},{"date":"2026-08-12","count":48},{"date":"2026-08-13","count":24},{"date":"2026-08-14","count":13},{"date":"2026-08-15","count":4}],"recent_events":[{"timestamp":"2026-08-15T23:25:56","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:443\",\"user-agent\":\"Mozilla/5.0\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/.env","summary":"","payload_hex":"474554202f2e656e7620485454502f312e310d0a486f73743a20<HONEYPOT>3a3434330d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0","ja3":"6639916abfac56b9257ca216677085bc","session":"cb0d6b5b-a3c5-4dff-8b6a-46afa4e29f5f","seq":1,"duration_ms":100,"bytes_in":104,"bytes_out":77},{"timestamp":"2026-08-15T16:31:16","port":5003,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:5003\",\"user-agent\":\"Mozilla/5.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/.env","summary":"","payload_hex":"474554202f2e656e7620485454502f312e310d0a486f73743a20<HONEYPOT>3a353030330d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0","ja3":"","session":"8f78c9a6-3556-425b-b7cd-9c2ba25ee2d5","seq":1,"duration_ms":100,"bytes_in":106,"bytes_out":77},{"timestamp":"2026-08-15T09:15:13","port":6000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:6000\",\"user-agent\":\"Mozilla/5.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/.env","summary":"","payload_hex":"474554202f2e656e7620485454502f312e310d0a486f73743a20<HONEYPOT>3a363030300d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0","ja3":"","session":"5550fa6b-0b40-4e61-8c92-4721ff31a0f4","seq":1,"duration_ms":100,"bytes_in":105,"bytes_out":77},{"timestamp":"2026-08-15T03:55:14","port":4002,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:4002\",\"user-agent\":\"Mozilla/5.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/.env","summary":"","payload_hex":"474554202f2e656e7620485454502f312e310d0a486f73743a20<HONEYPOT>3a343030320d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0","ja3":"","session":"c29608e4-a232-45b6-9370-e4bd6a38aa75","seq":1,"duration_ms":101,"bytes_in":106,"bytes_out":77},{"timestamp":"2026-08-14T22:30:19","port":5003,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:5003\",\"user-agent\":\"Mozilla/5.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/.env","summary":"","payload_hex":"474554202f2e656e7620485454502f312e310d0a486f73743a20<HONEYPOT>3a353030330d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0","ja3":"","session":"1c231d6f-d64d-4bc1-b697-a32176eba7e9","seq":1,"duration_ms":100,"bytes_in":104,"bytes_out":77},{"timestamp":"2026-08-14T11:44:32","port":6000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:6000\",\"user-agent\":\"Mozilla/5.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/.htaccess","summary":"","payload_hex":"474554202f2e687461636365737320485454502f312e310d0a486f73743a20<HONEYPOT>3a363030300d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0","ja3":"","session":"6f37a780-d7cf-4d2b-8fb6-26fc7c24c9e9","seq":1,"duration_ms":101,"bytes_in":109,"bytes_out":77},{"timestamp":"2026-08-14T11:44:32","port":6000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:6000\",\"user-agent\":\"Mozilla/5.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/.env.backup","summary":"","payload_hex":"474554202f2e656e762e6261636b757020485454502f312e310d0a486f73743a20<HONEYPOT>3a363030300d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0","ja3":"","session":"48dfb6dd-c343-455d-80f4-eb13f330b6e8","seq":1,"duration_ms":100,"bytes_in":111,"bytes_out":77},{"timestamp":"2026-08-14T11:44:32","port":6000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:6000\",\"user-agent\":\"Mozilla/5.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/.env.aws","summary":"","payload_hex":"474554202f2e656e762e61777320485454502f312e310d0a486f73743a20<HONEYPOT>3a363030300d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0","ja3":"","session":"b26a22c8-8e01-4ec6-a29e-85823734d1b8","seq":1,"duration_ms":100,"bytes_in":108,"bytes_out":77},{"timestamp":"2026-08-14T11:44:31","port":6000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:6000\",\"user-agent\":\"Mozilla/5.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/.env_old","summary":"","payload_hex":"474554202f2e656e765f6f6c6420485454502f312e310d0a486f73743a20<HONEYPOT>3a363030300d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0","ja3":"","session":"4bbafb1f-5d2e-4f9e-9b73-c52474cdf0ed","seq":1,"duration_ms":100,"bytes_in":108,"bytes_out":77},{"timestamp":"2026-08-14T11:44:31","port":6000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:6000\",\"user-agent\":\"Mozilla/5.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/.env.dev","summary":"","payload_hex":"474554202f2e656e762e64657620485454502f312e310d0a486f73743a20<HONEYPOT>3a363030300d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0","ja3":"","session":"7e1f3009-d1a0-4852-8644-37cc51f74e86","seq":1,"duration_ms":100,"bytes_in":108,"bytes_out":77}],"http_methods":[{"method":"GET","count":93}],"distinct_ports_total":12,"top_paths":[{"path":"/.env","count":12,"ports":10},{"path":"/.env~","count":7,"ports":7},{"path":"/.env.aws","count":7,"ports":7},{"path":"/.htaccess","count":7,"ports":7},{"path":"/.env.prod","count":7,"ports":7},{"path":"/.env.dev","count":7,"ports":7},{"path":"/.env_old","count":7,"ports":7},{"path":"/.env.swp","count":7,"ports":7},{"path":"/.env.backup","count":7,"ports":7},{"path":"/.env.old.1","count":7,"ports":7},{"path":"/.env.old","count":7,"ports":7},{"path":"/wp-config.php","count":7,"ports":7},{"path":"/_ping","count":4,"ports":2}],"distinct_paths_total":13,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","Connection","Host","User-Agent"],"representative":[{"name":"Accept","value":"*/*","notable":false},{"name":"Connection","value":"close","notable":false},{"name":"Host","value":"<HONEYPOT>:443","notable":false},{"name":"User-Agent","value":"Mozilla/5.0","notable":false}],"distinct_sets":1,"events_with_headers":10},"tags":[],"data_as_of":"2026-08-15T23:43:20.000262+00:00"}