{"ip":"104.139.99.229","total_events":3,"verdict":{"verdict":"probing","label":"Low-level probing","detail":null,"confidence":"low","network_type":null,"why":["3 event(s), fewer than 10 distinct ports, no exploit payloads.","Not in any known-scanner range."],"engagement":{"level":"request","label":"Request traffic","detail":"678 bytes sent","bytes_sent":678,"session_seconds":1,"persistent":false}},"first_seen":"2026-08-11T04:44:26","last_seen":"2026-08-11T04:45:12","events_24h":0,"events_7d":3,"geo":{"country_code":"US","country_name":"United States","region":"North Carolina","city":"Charlotte","lat":35.0892,"lon":-80.8194,"asn":11426,"org":"Charter Communications Inc"},"source_domain":"syn-104-139-099-229.res.spectrum.com","known_scanners":[],"scanner_tag":null,"cve_matches":[],"malware":[],"top_ports":[{"port":8000,"proto":"tcp","label":"HTTP-alt","count":2},{"port":2638,"proto":"tcp","label":"","count":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t12i880500_b202fa15e46a_a1e935682795"],"tls_ja3":["34af3a0c6bb3c6c6c675f9ec5fccbc16"],"ja4h":["ge11nn04en_bc19de6b1339"]},"fingerprint_peers":{"t12i880500_b202fa15e46a_a1e935682795":347,"ge11nn04en_bc19de6b1339":346},"user_agents":["Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.107 Safari/537.36"],"timeline":[{"date":"2026-08-11","count":3}],"recent_events":[{"timestamp":"2026-08-11T04:45:12","port":2638,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-language\":\"en-US,en;q=0.9\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:2638\",\"user-agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.107 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","tls_version":"TLSv1.2","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a557365722d4167656e743a204d6f7a696c6c612f352e3020284d6163696e746f73683b20496e74656c204d6163204f5320582031305f31355f3329204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f39322e302e343531352e313037205361666172692f3533372e33360d0a4163636570742d4c616e67756167653a20656e2d55532c656e3b713d302e390d0a436f6e6e656374696f6e3a20636c6f73650d0a486f73743a20<HONEYPOT>3a323633380d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.107 Safari/537.36","ja3":"34af3a0c6bb3c6c6c675f9ec5fccbc16","session":"ed00b7e4-8f96-4c29-9a74-8b05baea966a","seq":1,"duration_ms":539,"bytes_in":230,"bytes_out":79},{"timestamp":"2026-08-11T04:44:26","port":8000,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000�Z\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0005\u0001=K\u0000\u0000\u0001\u0001�Ψ�\u0000\f)�PYo\u0000root\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u00000��\u0002��\u0000�\u0015���>J\u000e��r�dS�%/V֡����m�(\u001a��\f<XHPh9�\\|\u0007��\n���\u0004��\u001e(2����Ѥ��\r�Ub�C\"��\u001e�2��S'��[�;{��\u0001Κ;hON�FZ\u0013|k�|\u001090��?��6�Z�\u0011�\u0012�7\u0003UU\u0005)���\u0016�\u0002\u0003\u0001\u0000\u0001","payload_hex":"000000e05a000000000000000001000005013d4b0000010191cea8c0000c29fc50596f00726f6f74000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030818902818100f915f391f13e4a0e8cba72ac64538b252f56d6a1f4ee9fd06df5281a93d60c3c5848506839a55c7c07a2d10ac77fd5c00481c61e283287beb3d9d1a4bafe0da85562e34322f0ef1ef232ddfe5327a6995baa3b7bf3b701ce9a3b684f4eec465a137c6bd97c103930b2d63ffae536935aa511a912b9370355550529fe949416810203010001","method":"","user_agent":"","ja3":"","session":"78e53e11-9a17-4e87-bf55-bd6bdf7afbc1","seq":1,"duration_ms":101,"bytes_in":224,"bytes_out":14,"enriched":{"digest":"47b9a163a04d01a8","strings":["root","<XHPh9",";hON","PYoroot0"]}},{"timestamp":"2026-08-11T04:44:26","port":8000,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000�Z\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0005\u0001=K\u0000\u0000\u0001\u0001�Ψ�\u0000\f)�PYo\u0000root\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u00000��\u0002��\u0000�\u0015���>J\u000e��r�dS�%/V֡����m�(\u001a��\f<XHPh9�\\|\u0007��\n���\u0004��\u001e(2����Ѥ��\r�Ub�C\"��\u001e�2��S'��[�;{��\u0001Κ;hON�FZ\u0013|k�|\u001090��?��6�Z�\u0011�\u0012�7\u0003UU\u0005)���\u0016�\u0002\u0003\u0001\u0000\u0001","payload_hex":"000000e05a000000000000000001000005013d4b0000010191cea8c0000c29fc50596f00726f6f74000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030818902818100f915f391f13e4a0e8cba72ac64538b252f56d6a1f4ee9fd06df5281a93d60c3c5848506839a55c7c07a2d10ac77fd5c00481c61e283287beb3d9d1a4bafe0da85562e34322f0ef1ef232ddfe5327a6995baa3b7bf3b701ce9a3b684f4eec465a137c6bd97c103930b2d63ffae536935aa511a912b9370355550529fe949416810203010001","method":"","user_agent":"","ja3":"","session":"78e53e11-9a17-4e87-bf55-bd6bdf7afbc1","seq":1,"duration_ms":101,"bytes_in":224,"bytes_out":14,"enriched":{"digest":"47b9a163a04d01a8","strings":["root","<XHPh9",";hON","PYoroot0"]}}],"http_methods":[{"method":"GET","count":1}],"distinct_ports_total":2,"top_paths":[{"path":"/","count":1,"ports":1}],"distinct_paths_total":1,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept-Language","Connection","Host","User-Agent"],"representative":[{"name":"Accept-Language","value":"en-US,en;q=0.9","notable":false},{"name":"Connection","value":"close","notable":false},{"name":"Host","value":"<HONEYPOT>:2638","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.107 Safari/537.36","notable":false}],"distinct_sets":1,"events_with_headers":1},"tags":[],"data_as_of":"2026-08-15T08:46:03.447143+00:00"}