{"ip":"103.252.221.163","total_events":120,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"11+ ports swept","confidence":"medium","network_type":"enterprise","why":["No exploit payloads observed.","Swept 11 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"17,339 bytes sent","bytes_sent":17339,"session_seconds":0,"persistent":false}},"first_seen":"2026-08-06T12:09:03","last_seen":"2026-08-14T17:32:57","events_24h":24,"events_7d":72,"geo":{"country_code":"IT","country_name":"Italy","region":"Lombardy","city":"Settimo Milanese","lat":45.4761,"lon":9.0598,"asn":60064,"org":"Hostpalace Datacenters Ltd"},"source_domain":"163.221.252.103.host-palace.com","known_scanners":[],"scanner_tag":{"key":"peeringdb:as60064","label":"HostPalace (Global)","category":"enterprise","url":"https://www.peeringdb.com/asn/60064"},"cve_matches":[],"malware":[],"top_ports":[{"port":5000,"proto":"tcp","label":"Web-alt","count":36},{"port":443,"proto":"tcp","label":"HTTPS","count":24},{"port":8080,"proto":"tcp","label":"HTTP-alt","count":13},{"port":4096,"proto":"tcp","label":"","count":12},{"port":3000,"proto":"tcp","label":"Web-alt","count":10},{"port":7860,"proto":"tcp","label":"","count":6},{"port":7861,"proto":"tcp","label":"","count":6},{"port":8443,"proto":"tcp","label":"HTTPS-alt","count":4},{"port":80,"proto":"tcp","label":"HTTP","count":4},{"port":8888,"proto":"tcp","label":"HTTP-alt","count":3},{"port":20128,"proto":"tcp","label":"","count":2}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i131000_f57a46bbacb6_ab7e3b40a677"],"tls_ja3":["725543c78edf669194c11dc7a039b56e"],"ja4h":["ge11nn0300_86b6b04cb9cc","po11nn0600_5aaf82b7b36c","po11nn0500_b4ba55311b46","ge11nn0400_9c3956fad5da","ge11nn0500_2b9dbe6d2d65"]},"fingerprint_peers":{"t13i131000_f57a46bbacb6_ab7e3b40a677":5328,"po11nn0600_5aaf82b7b36c":2,"ge11nn0500_2b9dbe6d2d65":2,"po11nn0500_b4ba55311b46":159,"ge11nn0400_9c3956fad5da":1491,"ge11nn0300_86b6b04cb9cc":5628},"user_agents":["Mozilla/5.0 (Windows NT 10.0; Win64; x64)","mlflow-clients/2.10.0","Go-http-client/1.1","Mozilla/5.0"],"timeline":[{"date":"2026-08-06","count":17},{"date":"2026-08-07","count":31},{"date":"2026-08-09","count":18},{"date":"2026-08-10","count":8},{"date":"2026-08-14","count":46}],"recent_events":[{"timestamp":"2026-08-14T17:32:57","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:443\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/api/config","summary":"","payload_hex":"474554202f6170692f636f6e66696720485454502f312e310d0a486f73743a20<HONEYPOT>3a3434330d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"725543c78edf669194c11dc7a039b56e","session":"88ddac0e-267e-4098-94aa-6655bacaa3bb","seq":1,"duration_ms":100,"bytes_in":107,"bytes_out":80},{"timestamp":"2026-08-14T17:32:54","port":3000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:3000\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/api/config","summary":"","payload_hex":"474554202f6170692f636f6e66696720485454502f312e310d0a486f73743a20<HONEYPOT>3a333030300d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"","session":"e8d9c6e6-d45b-4a88-a107-c8719f26dda6","seq":1,"duration_ms":100,"bytes_in":108,"bytes_out":80},{"timestamp":"2026-08-14T17:32:54","port":8080,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:8080\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/api/config","summary":"","payload_hex":"474554202f6170692f636f6e66696720485454502f312e310d0a486f73743a20<HONEYPOT>3a383038300d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"","session":"271834fc-ab96-4db6-b8e8-72308290904c","seq":1,"duration_ms":100,"bytes_in":108,"bytes_out":80},{"timestamp":"2026-08-14T16:18:20","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:443\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/api/config","summary":"","payload_hex":"474554202f6170692f636f6e66696720485454502f312e310d0a486f73743a20<HONEYPOT>3a3434330d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"725543c78edf669194c11dc7a039b56e","session":"0cce17d8-c358-4ea9-a328-816350ac1838","seq":1,"duration_ms":114,"bytes_in":107,"bytes_out":80},{"timestamp":"2026-08-14T16:18:13","port":3000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:3000\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/api/config","summary":"","payload_hex":"474554202f6170692f636f6e66696720485454502f312e310d0a486f73743a20<HONEYPOT>3a333030300d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"","session":"33469f75-af3e-44f8-92a1-18fd61e99cc3","seq":1,"duration_ms":100,"bytes_in":108,"bytes_out":80},{"timestamp":"2026-08-14T16:18:09","port":8080,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:8080\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/api/config","summary":"","payload_hex":"474554202f6170692f636f6e66696720485454502f312e310d0a486f73743a20<HONEYPOT>3a383038300d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"","session":"92ab5b3e-c22f-450b-a6ca-329e7edd0756","seq":1,"duration_ms":100,"bytes_in":108,"bytes_out":80},{"timestamp":"2026-08-14T16:10:23","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:443\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/api/config","summary":"","payload_hex":"474554202f6170692f636f6e66696720485454502f312e310d0a486f73743a20<HONEYPOT>3a3434330d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"725543c78edf669194c11dc7a039b56e","session":"ca8ba153-61f3-4451-8953-6876fbadcceb","seq":1,"duration_ms":100,"bytes_in":109,"bytes_out":80},{"timestamp":"2026-08-14T15:16:26","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:443\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/api/config","summary":"","payload_hex":"474554202f6170692f636f6e66696720485454502f312e310d0a486f73743a20<HONEYPOT>3a3434330d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"725543c78edf669194c11dc7a039b56e","session":"4c371d49-66e4-40d3-9629-235883f7f582","seq":1,"duration_ms":100,"bytes_in":108,"bytes_out":80},{"timestamp":"2026-08-14T15:16:26","port":3000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:3000\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/api/config","summary":"","payload_hex":"474554202f6170692f636f6e66696720485454502f312e310d0a486f73743a20<HONEYPOT>3a333030300d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"","session":"007bfe4a-8b61-4964-b368-0a960976d33d","seq":1,"duration_ms":100,"bytes_in":109,"bytes_out":80},{"timestamp":"2026-08-14T15:16:26","port":8080,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:8080\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/api/config","summary":"","payload_hex":"474554202f6170692f636f6e66696720485454502f312e310d0a486f73743a20<HONEYPOT>3a383038300d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"","session":"fcbc8a99-1544-4c3e-aa23-78c36f4b3629","seq":1,"duration_ms":100,"bytes_in":109,"bytes_out":80}],"http_methods":[{"method":"GET","count":86},{"method":"POST","count":34}],"distinct_ports_total":11,"top_paths":[{"path":"/api/config","count":34,"ports":3},{"path":"/","count":29,"ports":8},{"path":"/session","count":12,"ports":1},{"path":"/config","count":9,"ports":3},{"path":"/version","count":8,"ports":1},{"path":"/api/2.0/mlflow/experiments/create","count":8,"ports":1},{"path":"/ajax-api/2.0/mlflow/experiments/create","count":8,"ports":1},{"path":"/ajax-api/2.0/mlflow/experiments/list","count":6,"ports":1},{"path":"/api/2.0/mlflow/experiments/search","count":6,"ports":1}],"distinct_paths_total":9,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept-Encoding","Host","User-Agent"],"representative":[{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Host","value":"<HONEYPOT>:443","notable":false},{"name":"User-Agent","value":"Go-http-client/1.1","notable":false}],"distinct_sets":1,"events_with_headers":10},"tags":[],"data_as_of":"2026-08-15T07:58:50.028289+00:00"}