{"ip":"103.190.215.121","total_events":17,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"14+ ports swept","confidence":"medium","network_type":"CDN","why":["No exploit payloads observed.","Swept 14 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range."],"engagement":{"level":"request","label":"Request traffic","detail":"1,056 bytes sent","bytes_sent":1056,"session_seconds":0,"persistent":false}},"first_seen":"2026-06-21T14:57:02","last_seen":"2026-08-19T07:30:57","events_24h":0,"events_7d":3,"geo":{"country_code":"ID","country_name":"Indonesia","region":"","city":"","lat":-6.175,"lon":106.8286,"asn":38513,"org":"PT Aplikanusa Lintasarta"},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as38513","label":"Cloudeka","category":"cdn","url":"https://www.peeringdb.com/asn/38513"},"cve_matches":[],"malware":[],"top_ports":[{"port":8188,"proto":"tcp","label":"","count":3},{"port":4000,"proto":"tcp","label":"","count":2},{"port":80,"proto":"tcp","label":"HTTP","count":1},{"port":8000,"proto":"tcp","label":"HTTP-alt","count":1},{"port":8,"proto":"tcp","label":"","count":1},{"port":8189,"proto":"tcp","label":"","count":1},{"port":8002,"proto":"tcp","label":"","count":1},{"port":8005,"proto":"tcp","label":"","count":1},{"port":443,"proto":"tcp","label":"HTTPS","count":1},{"port":8004,"proto":"tcp","label":"","count":1},{"port":8003,"proto":"tcp","label":"","count":1},{"port":8001,"proto":"tcp","label":"","count":1},{"port":8082,"proto":"tcp","label":"","count":1},{"port":8080,"proto":"tcp","label":"HTTP-alt","count":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t12d800600_ee0b5a6c69b8_b8cb6a4c3c45"],"tls_ja3":["9f25da676e655f9e449963edb2fd271a"],"ja4h":["ge11nn0200_79258615d613","ge10nn0200_f24fcf356134"]},"fingerprint_peers":{"t12d800600_ee0b5a6c69b8_b8cb6a4c3c45":2,"ge11nn0200_79258615d613":5563,"ge10nn0200_f24fcf356134":781},"user_agents":[],"timeline":[{"date":"2026-06-21","count":12},{"date":"2026-07-24","count":2},{"date":"2026-08-19","count":3}],"recent_events":[{"timestamp":"2026-08-19T07:30:57","port":8188,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"host\":\"<HONEYPOT>:8188\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e300d0a486f73743a20<HONEYPOT>3a383138380d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"b43b210b-60cb-419e-8de5-f04a0c705c8e","seq":1,"duration_ms":100,"bytes_in":64,"bytes_out":80},{"timestamp":"2026-08-19T07:30:57","port":8188,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"host\":\"<HONEYPOT>:8188\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e300d0a486f73743a20<HONEYPOT>3a383138380d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"b43b210b-60cb-419e-8de5-f04a0c705c8e","seq":1,"duration_ms":100,"bytes_in":64,"bytes_out":80},{"timestamp":"2026-08-19T07:30:57","port":8188,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"host\":\"<HONEYPOT>:8188\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e300d0a486f73743a20<HONEYPOT>3a383138380d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"b43b210b-60cb-419e-8de5-f04a0c705c8e","seq":1,"duration_ms":100,"bytes_in":64,"bytes_out":80},{"timestamp":"2026-07-24T05:10:04","port":4000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"host\":\"<HONEYPOT>:4000\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e300d0a486f73743a20<HONEYPOT>3a343030300d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"650d7b4b-67b9-47ba-95e7-bde13ea59303","seq":1,"duration_ms":100,"bytes_in":62,"bytes_out":80},{"timestamp":"2026-07-24T05:10:04","port":4000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"host\":\"<HONEYPOT>:4000\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e300d0a486f73743a20<HONEYPOT>3a343030300d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"9ac6a1af-2de7-4dd3-b625-186fb707b540","seq":1,"duration_ms":101,"bytes_in":62,"bytes_out":80},{"timestamp":"2026-06-21T14:57:02","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>\"}","body":"","sni":"<HONEYPOT>","tls_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","tls_version":"TLSv1.2","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"","ja3":"9f25da676e655f9e449963edb2fd271a","session":"14c6db09-65b1-4521-8014-e19facc79b72","seq":1,"duration_ms":274,"bytes_in":52,"bytes_out":80},{"timestamp":"2026-06-21T14:57:02","port":8005,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"host\":\"<HONEYPOT>:8005\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e300d0a486f73743a20<HONEYPOT>3a383030350d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"e88f89cc-d169-4f84-84a3-abf070d4390a","seq":1,"duration_ms":100,"bytes_in":63,"bytes_out":80},{"timestamp":"2026-06-21T14:57:02","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"host\":\"<HONEYPOT>:80\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e300d0a486f73743a20<HONEYPOT>3a38300d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"9e204d25-07e0-4e08-944c-6b5fd97efb0f","seq":1,"duration_ms":102,"bytes_in":61,"bytes_out":80},{"timestamp":"2026-06-21T14:57:02","port":8082,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"host\":\"<HONEYPOT>:8082\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e300d0a486f73743a20<HONEYPOT>3a383038320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"cefadf31-3c6a-4a8f-899b-5bef5cb090ed","seq":1,"duration_ms":102,"bytes_in":63,"bytes_out":80},{"timestamp":"2026-06-21T14:57:02","port":8,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"host\":\"<HONEYPOT>:8\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e300d0a486f73743a20<HONEYPOT>3a380d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"32f915cf-b4dc-43ce-a044-c1478d581a17","seq":1,"duration_ms":100,"bytes_in":60,"bytes_out":80}],"http_methods":[{"method":"GET","count":17}],"distinct_ports_total":14,"top_paths":[{"path":"/","count":17,"ports":14}],"distinct_paths_total":1,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Connection","Host"],"representative":[{"name":"Connection","value":"close","notable":false},{"name":"Host","value":"<HONEYPOT>:8188","notable":false}],"distinct_sets":2,"events_with_headers":10},"tags":[],"data_as_of":"2026-08-20T22:12:02.591967+00:00"}