{"ip":"108.29.178.225","data_as_of":"2026-10-27T00:40:29+00:00","observed":true,"total_events":10,"verdict":{"verdict":"probing","label":"Low-level probing","detail":null,"confidence":"low","network_type":"network service provider","why":["21 event(s), fewer than 10 distinct ports, no exploit payloads.","Not in any known-scanner range.","Sent 4,151 bytes to few ports with no known exploit path, which is focused interaction with one service.","Counts include 11 interactive session(s) as well as first-packet events."],"engagement":{"level":"payload","label":"Sustained payload","detail":"4,151 bytes sent","bytes_sent":4151,"session_seconds":0,"persistent":false},"basis":"combined"},"first_seen":"2026-10-20T06:57:30","last_seen":"2026-10-20T10:20:26","events_24h":0,"events_7d":10,"interactive_sessions":11,"interactive_sessions_24h":0,"interactive_sessions_7d":11,"interactive_protocols":[{"protocol":"http","sessions":10}],"geo":{"country_code":"US","country_name":"United States","region":"New York","city":"New York","lat":40.781,"lon":-73.9501,"asn":701,"org":"Verizon Business"},"source_domain":"pool-108-29-178-225.nycmny.fios.verizon.net","known_scanners":[],"scanner_tag":{"key":"peeringdb:as701","label":"Verizon","category":"isp","url":"https://www.peeringdb.com/asn/701"},"cve_matches":[],"malware":[],"udp":null,"interaction":{"window_days":90,"sessions":11,"first_seen":"2026-10-20T06:57:30","last_seen":"2026-10-20T10:17:55","verdicts":[{"verdict":"scan","sessions":10},{"verdict":"unknown","sessions":1}],"personas":[{"persona":"nginx@1.18.0, wordpress@6.5.2, leaks@1, miner@cgminer 4.11.1, elasticsearch@8.11.1, winrm@Windows Server 2019, fortigate@7.2.1, docker@25.0.3","sessions":10}],"services":[{"protocol":"http","port":8317,"sessions":10},{"protocol":"tcp","port":8317,"sessions":1}],"logins":[],"commands":[],"downloads":[],"files":[],"attack":[{"technique_id":"T1595","technique_name":"Active Scanning","tactic_id":"TA0043","tactic_name":"Reconnaissance","sessions":10}]},"top_ports":[{"port":8317,"proto":"tcp","label":"","count":10,"sessions":11}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":["b11cun071_80440015_c382457e_x0143","b11cun040_00040015_68049152"],"interactive":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[]}},"fingerprint_peers":{"b11cun071_80440015_c382457e_x0143":1,"b11cun040_00040015_68049152":1},"akin_families":{},"user_agents":["Mozilla/5.0"],"timeline":[{"date":"2026-10-20","count":10,"sessions":11}],"recent_events":[{"timestamp":"2026-10-20T10:20:26","port":8317,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"application/json, text/html;q=0.8, */*;q=0.5\",\"authorization\":\"Bearer 12345678\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8317\",\"user-agent\":\"Mozilla/5.0\",\"x-forwarded-for\":\"51.119.120.122\",\"x-management-key\":\"12345678\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/v0/management/api-keys","summary":"","payload_hex":"474554202f76302f6d616e6167656d656e742f6170692d6b65797320485454502f312e310d0a486f73743a20<HONEYPOT>3a383331370d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a4163636570743a206170706c69636174696f6e2f6a736f6e2c20746578742f68746d6c3b713d302e382c202a2f2a3b713d302e350d0a417574686f72697a6174696f6e3a204265617265722031323334353637380d0a582d4d616e6167656d656e742d4b65793a2031323334353637380d0a582d466f727761726465642d466f723a2035312e3131392e3132302e3132320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0","ja3":"","session":"f6d369d3-5493-4bda-9050-51fea1099408","seq":1,"duration_ms":100,"bytes_in":258,"bytes_out":79},{"timestamp":"2026-10-20T10:19:56","port":8317,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"application/json, text/html;q=0.8, */*;q=0.5\",\"authorization\":\"Bearer 123456\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8317\",\"user-agent\":\"Mozilla/5.0\",\"x-forwarded-for\":\"74.185.17.183\",\"x-management-key\":\"123456\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/v0/management/api-keys","summary":"","payload_hex":"474554202f76302f6d616e6167656d656e742f6170692d6b65797320485454502f312e310d0a486f73743a20<HONEYPOT>3a383331370d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a4163636570743a206170706c69636174696f6e2f6a736f6e2c20746578742f68746d6c3b713d302e382c202a2f2a3b713d302e350d0a417574686f72697a6174696f6e3a20426561726572203132333435360d0a582d4d616e6167656d656e742d4b65793a203132333435360d0a582d466f727761726465642d466f723a2037342e3138352e31372e3138330d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0","ja3":"","session":"ab743f5f-cd6f-4608-a0c5-9d588da1c8e5","seq":1,"duration_ms":101,"bytes_in":253,"bytes_out":79},{"timestamp":"2026-10-20T10:19:40","port":8317,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"application/json, text/html;q=0.8, */*;q=0.5\",\"authorization\":\"Bearer cli-proxy-api-default-auto-created-sk-44Evu39noxdENiy\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8317\",\"user-agent\":\"Mozilla/5.0\",\"x-forwarded-for\":\"68.80.238.190\",\"x-management-key\":\"cli-proxy-api-default-auto-created-sk-44Evu39noxdENiy\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/v0/management/api-keys","summary":"","payload_hex":"474554202f76302f6d616e6167656d656e742f6170692d6b65797320485454502f312e310d0a486f73743a20<HONEYPOT>3a383331370d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a4163636570743a206170706c69636174696f6e2f6a736f6e2c20746578742f68746d6c3b713d302e382c202a2f2a3b713d302e350d0a417574686f72697a6174696f6e3a2042656172657220636c692d70726f78792d6170692d64656661756c742d6175746f2d637265617465642d736b2d343445767533396e6f7864454e69790d0a582d4d616e6167656d656e742d4b65793a20636c692d70726f78792d6170692d64656661756c742d6175746f2d637265617465642d736b2d343445767533396e6f7864454e69790d0a582d466f727761726465642d466f723a2036382e38302e3233382e3139300d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0","ja3":"","session":"02e2fc54-97c1-436c-a3e7-e2e3a39c7d44","seq":1,"duration_ms":101,"bytes_in":347,"bytes_out":79},{"timestamp":"2026-10-20T10:19:25","port":8317,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"application/json, text/html;q=0.8, */*;q=0.5\",\"authorization\":\"Bearer ag-canary-nuVfq0SqKQyv\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8317\",\"user-agent\":\"Mozilla/5.0\",\"x-forwarded-for\":\"193.231.87.89\",\"x-management-key\":\"ag-canary-nuVfq0SqKQyv\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/v0/management/api-keys","summary":"","payload_hex":"474554202f76302f6d616e6167656d656e742f6170692d6b65797320485454502f312e310d0a486f73743a20<HONEYPOT>3a383331370d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a4163636570743a206170706c69636174696f6e2f6a736f6e2c20746578742f68746d6c3b713d302e382c202a2f2a3b713d302e350d0a417574686f72697a6174696f6e3a204265617265722061672d63616e6172792d6e755666713053714b5179760d0a582d4d616e6167656d656e742d4b65793a2061672d63616e6172792d6e755666713053714b5179760d0a582d466f727761726465642d466f723a203139332e3233312e38372e38390d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0","ja3":"","session":"f2187f6a-c262-4de5-b5b9-c470acfeceeb","seq":1,"duration_ms":100,"bytes_in":285,"bytes_out":79},{"timestamp":"2026-10-20T10:19:10","port":8317,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"application/json, text/html;q=0.8, */*;q=0.5\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8317\",\"user-agent\":\"Mozilla/5.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/management.html","summary":"","payload_hex":"474554202f6d616e6167656d656e742e68746d6c20485454502f312e310d0a486f73743a20<HONEYPOT>3a383331370d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a4163636570743a206170706c69636174696f6e2f6a736f6e2c20746578742f68746d6c3b713d302e382c202a2f2a3b713d302e350d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0","ja3":"","session":"4eef46f8-fc50-497a-9dc9-1b97aeb8180f","seq":1,"duration_ms":100,"bytes_in":158,"bytes_out":79},{"timestamp":"2026-10-20T10:18:54","port":8317,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"application/json, text/html;q=0.8, */*;q=0.5\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8317\",\"user-agent\":\"Mozilla/5.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/v1/models","summary":"","payload_hex":"474554202f76312f6d6f64656c7320485454502f312e310d0a486f73743a20<HONEYPOT>3a383331370d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a4163636570743a206170706c69636174696f6e2f6a736f6e2c20746578742f68746d6c3b713d302e382c202a2f2a3b713d302e350d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0","ja3":"","session":"eed9e67b-19c7-46e6-b047-39c5a2db5681","seq":1,"duration_ms":101,"bytes_in":152,"bytes_out":79},{"timestamp":"2026-10-20T10:18:39","port":8317,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"application/json, text/html;q=0.8, */*;q=0.5\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8317\",\"user-agent\":\"Mozilla/5.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/healthz","summary":"","payload_hex":"474554202f6865616c74687a20485454502f312e310d0a486f73743a20<HONEYPOT>3a383331370d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a4163636570743a206170706c69636174696f6e2f6a736f6e2c20746578742f68746d6c3b713d302e382c202a2f2a3b713d302e350d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0","ja3":"","session":"0f62de63-a9e3-4377-9c40-9f2d5f8dfeb2","seq":1,"duration_ms":100,"bytes_in":150,"bytes_out":79},{"timestamp":"2026-10-20T10:18:24","port":8317,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"application/json, text/html;q=0.8, */*;q=0.5\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8317\",\"user-agent\":\"Mozilla/5.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/v0/management/config","summary":"","payload_hex":"474554202f76302f6d616e6167656d656e742f636f6e66696720485454502f312e310d0a486f73743a20<HONEYPOT>3a383331370d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a4163636570743a206170706c69636174696f6e2f6a736f6e2c20746578742f68746d6c3b713d302e382c202a2f2a3b713d302e350d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0","ja3":"","session":"6a8c240c-d832-483f-bc3c-04abb8fa4ee6","seq":1,"duration_ms":100,"bytes_in":163,"bytes_out":79},{"timestamp":"2026-10-20T10:18:08","port":8317,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"application/json, text/html;q=0.8, */*;q=0.5\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8317\",\"user-agent\":\"Mozilla/5.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/v0/management/api-keys","summary":"","payload_hex":"474554202f76302f6d616e6167656d656e742f6170692d6b65797320485454502f312e310d0a486f73743a20<HONEYPOT>3a383331370d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a4163636570743a206170706c69636174696f6e2f6a736f6e2c20746578742f68746d6c3b713d302e382c202a2f2a3b713d302e350d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0","ja3":"","session":"0fff9a41-0940-45f5-aa3c-ae2f3636d91b","seq":1,"duration_ms":101,"bytes_in":165,"bytes_out":79},{"timestamp":"2026-10-20T10:17:55","port":8317,"proto":"tcp","app_proto":"http","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"application/json, text/html;q=0.8, */*;q=0.5\",\"authorization\":\"Bearer 12345678\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8317\",\"user-agent\":\"Mozilla/5.0\",\"x-forwarded-for\":\"85.123.193.193\",\"x-management-key\":\"12345678\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/v0/management/api-keys","summary":"","payload_hex":"474554202f76302f6d616e6167656d656e742f6170692d6b65797320485454502f312e310d0a486f73743a203c484f4e4559504f543e3a383331370d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a4163636570743a206170706c69636174696f6e2f6a736f6e2c20746578742f68746d6c3b713d302e382c202a2f2a3b713d302e350d0a417574686f72697a6174696f6e3a204265617265722031323334353637380d0a582d4d616e6167656d656e742d4b65793a2031323334353637380d0a582d466f727761726465642d466f723a2038352e3132332e3139332e3139330d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0","ja3":"","session":"38c03874-2163-4439-abdb-fd26fa89fe05-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true}],"http_methods":[{"method":"GET","count":20}],"distinct_ports_total":1,"top_paths":[{"path":"/v0/management/api-keys","count":10,"ports":1},{"path":"/","count":2,"ports":1},{"path":"/healthz","count":2,"ports":1},{"path":"/v1/models","count":2,"ports":1},{"path":"/management.html","count":2,"ports":1},{"path":"/v0/management/config","count":2,"ports":1}],"distinct_paths_total":6,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","Authorization","Connection","Host","User-Agent","X-Forwarded-For","X-Management-Key"],"representative":[{"name":"Accept","value":"application/json, text/html;q=0.8, */*;q=0.5","notable":false},{"name":"Authorization","value":"Bearer 12345678","notable":true},{"name":"Connection","value":"close","notable":false},{"name":"Host","value":"<HONEYPOT>:8317","notable":false},{"name":"User-Agent","value":"Mozilla/5.0","notable":false},{"name":"X-Forwarded-For","value":"51.119.120.122","notable":true},{"name":"X-Management-Key","value":"12345678","notable":true}],"distinct_sets":2,"events_with_headers":10},"tags":[]}