{"ip":"102.220.163.124","data_as_of":"2026-10-20T14:24:22+00:00","observed":true,"total_events":178,"verdict":{"verdict":"probing","label":"Low-level probing","detail":null,"confidence":"low","network_type":null,"why":["178 event(s), fewer than 10 distinct ports, no exploit payloads.","Not in any known-scanner range.","Sent 47,170 bytes to few ports with no known exploit path, which is focused interaction with one service."],"engagement":{"level":"payload","label":"Sustained payload","detail":"47,170 bytes sent","bytes_sent":47170,"session_seconds":0,"persistent":false},"basis":"first_contact"},"first_seen":"2026-09-29T06:32:06","last_seen":"2026-10-08T17:38:17","events_24h":0,"events_7d":0,"interactive_sessions":0,"interactive_sessions_24h":0,"interactive_sessions_7d":0,"interactive_protocols":[],"geo":{"country_code":"SI","country_name":"Slovenia","region":"","city":"","lat":46.0833,"lon":15.0,"asn":197769,"org":"VPS Dedicated LLC"},"source_domain":null,"known_scanners":[],"scanner_tag":null,"cve_matches":[],"malware":[],"udp":null,"interaction":null,"top_ports":[{"port":3000,"proto":"tcp","label":"Web-alt","count":178}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i131000_f57a46bbacb6_a089bac06eae"],"tls_client_hello":"160301010c0100010803034b1ced7859764d2f9449fcb54c28465935b1a71b5f966327a6c41408ab01d679204f2f7719125dc95b8d00726e463b00236615a957f722aa06875022397f5fce6b001ac02bc02fc02cc030cca9cca8c009c013c00ac014130113021303010000a5000b00020100ff010001000017000000120000000500050100000000000a000a0008001d001700180019000d0020001e09040905090608040403080708050806040105010601050306030201020300320020001e090409050906080404030807080508060401050106010503060302010203002b00050403040303003300260024001d002070d947bbdabd1cdebaaa73faac9655a5550cafb025f5361968284018","tls_ja3":["ad8e2ddea9ec0a77edc063c36fc6cecc"],"http_akin":["b11cun050_00040017_72c0bd85"],"interactive":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[]}},"fingerprint_peers":{"t13i131000_f57a46bbacb6_a089bac06eae":7,"b11cun050_00040017_72c0bd85":2},"akin_families":{"b11cun050_00040017_72c0bd85":{"head":"b11cun040_00040016_50f90888","shapes":4,"ips":69}},"user_agents":["Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"],"timeline":[{"date":"2026-09-29","count":16},{"date":"2026-09-30","count":24},{"date":"2026-10-01","count":24},{"date":"2026-10-05","count":12},{"date":"2026-10-06","count":40},{"date":"2026-10-07","count":30},{"date":"2026-10-08","count":32}],"recent_events":[{"timestamp":"2026-10-08T17:38:17","port":3000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"application/json, text/html, */*\",\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:3000\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/user/sign_up","summary":"","payload_hex":"474554202f757365722f7369676e5f757020485454502f312e310d0a486f73743a20<HONEYPOT>3a333030300d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3133312e302e302e30205361666172692f3533372e33360d0a4163636570743a206170706c69636174696f6e2f6a736f6e2c20746578742f68746d6c2c202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36","ja3":"","session":"9ced020e-0398-4a60-8faa-15a51017fc96","seq":1,"duration_ms":101,"bytes_in":265,"bytes_out":80},{"timestamp":"2026-10-08T17:38:17","port":3000,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"application/json, text/html, */*\",\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:3000\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/user/sign_up","summary":"","payload_hex":"474554202f757365722f7369676e5f757020485454502f312e310d0a486f73743a20<HONEYPOT>3a333030300d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3133312e302e302e30205361666172692f3533372e33360d0a4163636570743a206170706c69636174696f6e2f6a736f6e2c20746578742f68746d6c2c202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36","ja3":"ad8e2ddea9ec0a77edc063c36fc6cecc","session":"199c5bfe-787c-4c1c-80ea-5eff3d2f2190","seq":1,"duration_ms":100,"bytes_in":265,"bytes_out":80},{"timestamp":"2026-10-08T17:12:50","port":3000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"application/json, text/html, */*\",\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:3000\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/user/sign_up","summary":"","payload_hex":"474554202f757365722f7369676e5f757020485454502f312e310d0a486f73743a20<HONEYPOT>3a333030300d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3133312e302e302e30205361666172692f3533372e33360d0a4163636570743a206170706c69636174696f6e2f6a736f6e2c20746578742f68746d6c2c202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36","ja3":"","session":"46f395b5-1e09-4b03-81bf-a8ffbb643037","seq":1,"duration_ms":100,"bytes_in":264,"bytes_out":80},{"timestamp":"2026-10-08T17:12:50","port":3000,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"application/json, text/html, */*\",\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:3000\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/user/sign_up","summary":"","payload_hex":"474554202f757365722f7369676e5f757020485454502f312e310d0a486f73743a20<HONEYPOT>3a333030300d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3133312e302e302e30205361666172692f3533372e33360d0a4163636570743a206170706c69636174696f6e2f6a736f6e2c20746578742f68746d6c2c202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36","ja3":"ad8e2ddea9ec0a77edc063c36fc6cecc","session":"40cdb6fa-a130-40eb-a18f-a9b5c40c1a77","seq":1,"duration_ms":100,"bytes_in":264,"bytes_out":80},{"timestamp":"2026-10-08T16:10:45","port":3000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"application/json, text/html, */*\",\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:3000\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/user/sign_up","summary":"","payload_hex":"474554202f757365722f7369676e5f757020485454502f312e310d0a486f73743a20<HONEYPOT>3a333030300d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3133312e302e302e30205361666172692f3533372e33360d0a4163636570743a206170706c69636174696f6e2f6a736f6e2c20746578742f68746d6c2c202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36","ja3":"","session":"e584969a-8e2a-47c6-9658-ddc2d494539f","seq":1,"duration_ms":100,"bytes_in":265,"bytes_out":80},{"timestamp":"2026-10-08T16:10:45","port":3000,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"application/json, text/html, */*\",\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:3000\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/user/sign_up","summary":"","payload_hex":"474554202f757365722f7369676e5f757020485454502f312e310d0a486f73743a20<HONEYPOT>3a333030300d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3133312e302e302e30205361666172692f3533372e33360d0a4163636570743a206170706c69636174696f6e2f6a736f6e2c20746578742f68746d6c2c202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36","ja3":"ad8e2ddea9ec0a77edc063c36fc6cecc","session":"f142452e-6797-4b7a-b115-370c461aaaa7","seq":1,"duration_ms":100,"bytes_in":265,"bytes_out":80},{"timestamp":"2026-10-08T15:31:33","port":3000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"application/json, text/html, */*\",\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:3000\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/user/sign_up","summary":"","payload_hex":"474554202f757365722f7369676e5f757020485454502f312e310d0a486f73743a20<HONEYPOT>3a333030300d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3133312e302e302e30205361666172692f3533372e33360d0a4163636570743a206170706c69636174696f6e2f6a736f6e2c20746578742f68746d6c2c202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36","ja3":"","session":"1b1c78d0-36fa-404f-94e2-a16f30b5ac7b","seq":1,"duration_ms":100,"bytes_in":266,"bytes_out":80},{"timestamp":"2026-10-08T15:31:33","port":3000,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"application/json, text/html, */*\",\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:3000\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/user/sign_up","summary":"","payload_hex":"474554202f757365722f7369676e5f757020485454502f312e310d0a486f73743a20<HONEYPOT>3a333030300d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3133312e302e302e30205361666172692f3533372e33360d0a4163636570743a206170706c69636174696f6e2f6a736f6e2c20746578742f68746d6c2c202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36","ja3":"ad8e2ddea9ec0a77edc063c36fc6cecc","session":"806cdb0e-2e25-4974-bcfd-059dc45ea490","seq":1,"duration_ms":100,"bytes_in":266,"bytes_out":80},{"timestamp":"2026-10-08T12:50:11","port":3000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"application/json, text/html, */*\",\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:3000\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/user/sign_up","summary":"","payload_hex":"474554202f757365722f7369676e5f757020485454502f312e310d0a486f73743a20<HONEYPOT>3a333030300d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3133312e302e302e30205361666172692f3533372e33360d0a4163636570743a206170706c69636174696f6e2f6a736f6e2c20746578742f68746d6c2c202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36","ja3":"","session":"06ad7603-6994-4b56-9706-cc4009e055d0","seq":1,"duration_ms":100,"bytes_in":265,"bytes_out":80},{"timestamp":"2026-10-08T12:50:11","port":3000,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"application/json, text/html, */*\",\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:3000\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/user/sign_up","summary":"","payload_hex":"474554202f757365722f7369676e5f757020485454502f312e310d0a486f73743a20<HONEYPOT>3a333030300d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3133312e302e302e30205361666172692f3533372e33360d0a4163636570743a206170706c69636174696f6e2f6a736f6e2c20746578742f68746d6c2c202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36","ja3":"ad8e2ddea9ec0a77edc063c36fc6cecc","session":"fa6b9038-a25c-4d20-a19d-685553c85495","seq":1,"duration_ms":101,"bytes_in":265,"bytes_out":80}],"http_methods":[{"method":"GET","count":178}],"distinct_ports_total":1,"top_paths":[{"path":"/user/sign_up","count":178,"ports":1}],"distinct_paths_total":1,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","Accept-Encoding","Connection","Host","User-Agent"],"representative":[{"name":"Accept","value":"application/json, text/html, */*","notable":false},{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Connection","value":"close","notable":false},{"name":"Host","value":"<HONEYPOT>:3000","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36","notable":false}],"distinct_sets":1,"events_with_headers":10},"tags":[]}