{"ip":"109.184.65.147","total_events":11,"verdict":{"verdict":"probing","label":"Low-level probing","detail":null,"confidence":"low","network_type":"nsp","why":["11 event(s), fewer than 10 distinct ports, no exploit payloads.","Not in any known-scanner range."],"engagement":{"level":"request","label":"Request traffic","detail":"3,069 bytes sent","bytes_sent":3069,"session_seconds":0,"persistent":false}},"first_seen":"2026-09-10T08:50:16","last_seen":"2026-09-10T09:20:13","events_24h":0,"events_7d":0,"geo":{"country_code":"RU","country_name":"Russia","region":"Nizhny Novgorod Oblast","city":"Nizhniy Novgorod","lat":56.3327,"lon":44.0012,"asn":12389,"org":"Rostelecom"},"source_domain":"109-184-65-147.dynamic.mts-nn.ru","known_scanners":[],"scanner_tag":{"key":"peeringdb:as12389","label":"Rostelecom","category":"isp","url":"https://www.peeringdb.com/asn/12389"},"cve_matches":[],"malware":[],"top_ports":[{"port":5800,"proto":"tcp","label":"VNC-HTTP","count":2},{"port":6800,"proto":"tcp","label":"","count":2},{"port":6080,"proto":"tcp","label":"","count":2},{"port":7900,"proto":"tcp","label":"","count":2},{"port":5900,"proto":"tcp","label":"VNC","count":1},{"port":5901,"proto":"tcp","label":"","count":1},{"port":5801,"proto":"tcp","label":"","count":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":["b11cun073_40040011_cfe69652_x12be9f62fdb1"]},"fingerprint_peers":{"b11cun073_40040011_cfe69652_x12be9f62fdb1":2},"akin_families":{},"user_agents":["Python/3.10 websockets/16.1.1"],"timeline":[{"date":"2026-09-10","count":11}],"recent_events":[{"timestamp":"2026-09-10T09:20:13","port":6800,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"Upgrade\",\"host\":\"<HONEYPOT>:6800\",\"sec-websocket-extensions\":\"permessage-deflate; client_max_window_bits\",\"sec-websocket-key\":\"lge/EkqjbfUMBjadqmSZdA==\",\"sec-websocket-version\":\"13\",\"upgrade\":\"websocket\",\"user-agent\":\"Python/3.10 websockets/16.1.1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/websockify","summary":"","payload_hex":"474554202f776562736f636b69667920485454502f312e310d0a486f73743a20<HONEYPOT>3a363830300d0a557067726164653a20776562736f636b65740d0a436f6e6e656374696f6e3a20557067726164650d0a5365632d576562536f636b65742d4b65793a206c67652f456b716a6266554d426a6164716d535a64413d3d0d0a5365632d576562536f636b65742d56657273696f6e3a2031330d0a5365632d576562536f636b65742d457874656e73696f6e733a207065726d6573736167652d6465666c6174653b20636c69656e745f6d61785f77696e646f775f626974730d0a557365722d4167656e743a20507974686f6e2f332e313020776562736f636b6574732f31362e312e310d0a0d0a","method":"GET","user_agent":"Python/3.10 websockets/16.1.1","ja3":"","session":"936f97bb-7ee9-43c6-907a-a339476a1e17","seq":1,"duration_ms":101,"bytes_in":279,"bytes_out":79},{"timestamp":"2026-09-10T09:14:05","port":6800,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"Upgrade\",\"host\":\"<HONEYPOT>:6800\",\"sec-websocket-extensions\":\"permessage-deflate; client_max_window_bits\",\"sec-websocket-key\":\"C5RovZshDBKlxuygWhYSgw==\",\"sec-websocket-version\":\"13\",\"upgrade\":\"websocket\",\"user-agent\":\"Python/3.10 websockets/16.1.1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/websockify","summary":"","payload_hex":"474554202f776562736f636b69667920485454502f312e310d0a486f73743a20<HONEYPOT>3a363830300d0a557067726164653a20776562736f636b65740d0a436f6e6e656374696f6e3a20557067726164650d0a5365632d576562536f636b65742d4b65793a204335526f765a736844424b6c787579675768595367773d3d0d0a5365632d576562536f636b65742d56657273696f6e3a2031330d0a5365632d576562536f636b65742d457874656e73696f6e733a207065726d6573736167652d6465666c6174653b20636c69656e745f6d61785f77696e646f775f626974730d0a557365722d4167656e743a20507974686f6e2f332e313020776562736f636b6574732f31362e312e310d0a0d0a","method":"GET","user_agent":"Python/3.10 websockets/16.1.1","ja3":"","session":"6e03f985-c550-4245-930c-461c77872211","seq":1,"duration_ms":100,"bytes_in":279,"bytes_out":79},{"timestamp":"2026-09-10T09:13:17","port":5800,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"Upgrade\",\"host\":\"<HONEYPOT>:5800\",\"sec-websocket-extensions\":\"permessage-deflate; client_max_window_bits\",\"sec-websocket-key\":\"DprZ0rcAL2qHJMg0E2VN/A==\",\"sec-websocket-version\":\"13\",\"upgrade\":\"websocket\",\"user-agent\":\"Python/3.10 websockets/16.1.1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/websockify","summary":"","payload_hex":"474554202f776562736f636b69667920485454502f312e310d0a486f73743a20<HONEYPOT>3a353830300d0a557067726164653a20776562736f636b65740d0a436f6e6e656374696f6e3a20557067726164650d0a5365632d576562536f636b65742d4b65793a204470725a307263414c3271484a4d67304532564e2f413d3d0d0a5365632d576562536f636b65742d56657273696f6e3a2031330d0a5365632d576562536f636b65742d457874656e73696f6e733a207065726d6573736167652d6465666c6174653b20636c69656e745f6d61785f77696e646f775f626974730d0a557365722d4167656e743a20507974686f6e2f332e313020776562736f636b6574732f31362e312e310d0a0d0a","method":"GET","user_agent":"Python/3.10 websockets/16.1.1","ja3":"","session":"510fdac8-d489-4fa5-8904-1c0ccecd4ea2","seq":1,"duration_ms":100,"bytes_in":279,"bytes_out":79},{"timestamp":"2026-09-10T09:04:44","port":5800,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"Upgrade\",\"host\":\"<HONEYPOT>:5800\",\"sec-websocket-extensions\":\"permessage-deflate; client_max_window_bits\",\"sec-websocket-key\":\"iG8r84pZWcs8YD3i/1kPCw==\",\"sec-websocket-version\":\"13\",\"upgrade\":\"websocket\",\"user-agent\":\"Python/3.10 websockets/16.1.1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/websockify","summary":"","payload_hex":"474554202f776562736f636b69667920485454502f312e310d0a486f73743a20<HONEYPOT>3a353830300d0a557067726164653a20776562736f636b65740d0a436f6e6e656374696f6e3a20557067726164650d0a5365632d576562536f636b65742d4b65793a20694738723834705a57637338594433692f316b5043773d3d0d0a5365632d576562536f636b65742d56657273696f6e3a2031330d0a5365632d576562536f636b65742d457874656e73696f6e733a207065726d6573736167652d6465666c6174653b20636c69656e745f6d61785f77696e646f775f626974730d0a557365722d4167656e743a20507974686f6e2f332e313020776562736f636b6574732f31362e312e310d0a0d0a","method":"GET","user_agent":"Python/3.10 websockets/16.1.1","ja3":"","session":"35cbb7c7-4fd0-4bda-aee8-8cf597937c58","seq":1,"duration_ms":101,"bytes_in":279,"bytes_out":79},{"timestamp":"2026-09-10T09:03:50","port":7900,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"Upgrade\",\"host\":\"<HONEYPOT>:7900\",\"sec-websocket-extensions\":\"permessage-deflate; client_max_window_bits\",\"sec-websocket-key\":\"8qVVGtUfZzQoySowRgVBtg==\",\"sec-websocket-version\":\"13\",\"upgrade\":\"websocket\",\"user-agent\":\"Python/3.10 websockets/16.1.1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/websockify","summary":"","payload_hex":"474554202f776562736f636b69667920485454502f312e310d0a486f73743a20<HONEYPOT>3a373930300d0a557067726164653a20776562736f636b65740d0a436f6e6e656374696f6e3a20557067726164650d0a5365632d576562536f636b65742d4b65793a2038715656477455665a7a516f79536f775267564274673d3d0d0a5365632d576562536f636b65742d56657273696f6e3a2031330d0a5365632d576562536f636b65742d457874656e73696f6e733a207065726d6573736167652d6465666c6174653b20636c69656e745f6d61785f77696e646f775f626974730d0a557365722d4167656e743a20507974686f6e2f332e313020776562736f636b6574732f31362e312e310d0a0d0a","method":"GET","user_agent":"Python/3.10 websockets/16.1.1","ja3":"","session":"450f723d-6e3a-42d5-aff9-d25101e87061","seq":1,"duration_ms":100,"bytes_in":279,"bytes_out":79},{"timestamp":"2026-09-10T09:02:44","port":6080,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"Upgrade\",\"host\":\"<HONEYPOT>:6080\",\"sec-websocket-extensions\":\"permessage-deflate; client_max_window_bits\",\"sec-websocket-key\":\"QMndrI1tTLFaLN70x2Fy5g==\",\"sec-websocket-version\":\"13\",\"upgrade\":\"websocket\",\"user-agent\":\"Python/3.10 websockets/16.1.1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/websockify","summary":"","payload_hex":"474554202f776562736f636b69667920485454502f312e310d0a486f73743a20<HONEYPOT>3a363038300d0a557067726164653a20776562736f636b65740d0a436f6e6e656374696f6e3a20557067726164650d0a5365632d576562536f636b65742d4b65793a20514d6e6472493174544c46614c4e37307832467935673d3d0d0a5365632d576562536f636b65742d56657273696f6e3a2031330d0a5365632d576562536f636b65742d457874656e73696f6e733a207065726d6573736167652d6465666c6174653b20636c69656e745f6d61785f77696e646f775f626974730d0a557365722d4167656e743a20507974686f6e2f332e313020776562736f636b6574732f31362e312e310d0a0d0a","method":"GET","user_agent":"Python/3.10 websockets/16.1.1","ja3":"","session":"87e07c66-29db-4415-86cd-ae154e6b12dc","seq":1,"duration_ms":100,"bytes_in":279,"bytes_out":79},{"timestamp":"2026-09-10T09:00:56","port":5900,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"Upgrade\",\"host\":\"<HONEYPOT>:5900\",\"sec-websocket-extensions\":\"permessage-deflate; client_max_window_bits\",\"sec-websocket-key\":\"JxDmFr4BF8kd6SJtTanFVA==\",\"sec-websocket-version\":\"13\",\"upgrade\":\"websocket\",\"user-agent\":\"Python/3.10 websockets/16.1.1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/websockify","summary":"","payload_hex":"474554202f776562736f636b69667920485454502f312e310d0a486f73743a20<HONEYPOT>3a353930300d0a557067726164653a20776562736f636b65740d0a436f6e6e656374696f6e3a20557067726164650d0a5365632d576562536f636b65742d4b65793a204a78446d4672344246386b6436534a7454616e4656413d3d0d0a5365632d576562536f636b65742d56657273696f6e3a2031330d0a5365632d576562536f636b65742d457874656e73696f6e733a207065726d6573736167652d6465666c6174653b20636c69656e745f6d61785f77696e646f775f626974730d0a557365722d4167656e743a20507974686f6e2f332e313020776562736f636b6574732f31362e312e310d0a0d0a","method":"GET","user_agent":"Python/3.10 websockets/16.1.1","ja3":"","session":"6c40dc1a-a34b-46d5-a3d9-2e99033c0126","seq":1,"duration_ms":100,"bytes_in":279,"bytes_out":79},{"timestamp":"2026-09-10T08:58:16","port":5901,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"Upgrade\",\"host\":\"<HONEYPOT>:5901\",\"sec-websocket-extensions\":\"permessage-deflate; client_max_window_bits\",\"sec-websocket-key\":\"xkM0Nn1MRc6FkyRYNg8vcQ==\",\"sec-websocket-version\":\"13\",\"upgrade\":\"websocket\",\"user-agent\":\"Python/3.10 websockets/16.1.1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/websockify","summary":"","payload_hex":"474554202f776562736f636b69667920485454502f312e310d0a486f73743a20<HONEYPOT>3a353930310d0a557067726164653a20776562736f636b65740d0a436f6e6e656374696f6e3a20557067726164650d0a5365632d576562536f636b65742d4b65793a20786b4d304e6e314d526336466b7952594e67387663513d3d0d0a5365632d576562536f636b65742d56657273696f6e3a2031330d0a5365632d576562536f636b65742d457874656e73696f6e733a207065726d6573736167652d6465666c6174653b20636c69656e745f6d61785f77696e646f775f626974730d0a557365722d4167656e743a20507974686f6e2f332e313020776562736f636b6574732f31362e312e310d0a0d0a","method":"GET","user_agent":"Python/3.10 websockets/16.1.1","ja3":"","session":"d8d023cf-b92f-4cfe-bd17-d8ea6f53f713","seq":1,"duration_ms":100,"bytes_in":279,"bytes_out":79},{"timestamp":"2026-09-10T08:56:48","port":6080,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"Upgrade\",\"host\":\"<HONEYPOT>:6080\",\"sec-websocket-extensions\":\"permessage-deflate; client_max_window_bits\",\"sec-websocket-key\":\"7Ej4ge5OUE1TxePnZnnG+Q==\",\"sec-websocket-version\":\"13\",\"upgrade\":\"websocket\",\"user-agent\":\"Python/3.10 websockets/16.1.1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/websockify","summary":"","payload_hex":"474554202f776562736f636b69667920485454502f312e310d0a486f73743a20<HONEYPOT>3a363038300d0a557067726164653a20776562736f636b65740d0a436f6e6e656374696f6e3a20557067726164650d0a5365632d576562536f636b65742d4b65793a2037456a346765354f554531547865506e5a6e6e472b513d3d0d0a5365632d576562536f636b65742d56657273696f6e3a2031330d0a5365632d576562536f636b65742d457874656e73696f6e733a207065726d6573736167652d6465666c6174653b20636c69656e745f6d61785f77696e646f775f626974730d0a557365722d4167656e743a20507974686f6e2f332e313020776562736f636b6574732f31362e312e310d0a0d0a","method":"GET","user_agent":"Python/3.10 websockets/16.1.1","ja3":"","session":"224a2d06-bf0f-4830-9c75-f0c0a4ac795d","seq":1,"duration_ms":103,"bytes_in":279,"bytes_out":79},{"timestamp":"2026-09-10T08:54:03","port":7900,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"Upgrade\",\"host\":\"<HONEYPOT>:7900\",\"sec-websocket-extensions\":\"permessage-deflate; client_max_window_bits\",\"sec-websocket-key\":\"xS/q/DuSMNEY49Y/UBwCeQ==\",\"sec-websocket-version\":\"13\",\"upgrade\":\"websocket\",\"user-agent\":\"Python/3.10 websockets/16.1.1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/websockify","summary":"","payload_hex":"474554202f776562736f636b69667920485454502f312e310d0a486f73743a20<HONEYPOT>3a373930300d0a557067726164653a20776562736f636b65740d0a436f6e6e656374696f6e3a20557067726164650d0a5365632d576562536f636b65742d4b65793a2078532f712f4475534d4e45593439592f5542774365513d3d0d0a5365632d576562536f636b65742d56657273696f6e3a2031330d0a5365632d576562536f636b65742d457874656e73696f6e733a207065726d6573736167652d6465666c6174653b20636c69656e745f6d61785f77696e646f775f626974730d0a557365722d4167656e743a20507974686f6e2f332e313020776562736f636b6574732f31362e312e310d0a0d0a","method":"GET","user_agent":"Python/3.10 websockets/16.1.1","ja3":"","session":"1422dcce-44b9-45ac-bc27-9f3bd3aa447d","seq":1,"duration_ms":100,"bytes_in":279,"bytes_out":79}],"http_methods":[{"method":"GET","count":11}],"distinct_ports_total":7,"top_paths":[{"path":"/websockify","count":11,"ports":7}],"distinct_paths_total":1,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Connection","Host","Sec-Websocket-Extensions","Sec-Websocket-Key","Sec-Websocket-Version","Upgrade","User-Agent"],"representative":[{"name":"Connection","value":"Upgrade","notable":false},{"name":"Host","value":"<HONEYPOT>:6800","notable":false},{"name":"Sec-Websocket-Extensions","value":"permessage-deflate; client_max_window_bits","notable":false},{"name":"Sec-Websocket-Key","value":"lge/EkqjbfUMBjadqmSZdA==","notable":false},{"name":"Sec-Websocket-Version","value":"13","notable":false},{"name":"Upgrade","value":"websocket","notable":false},{"name":"User-Agent","value":"Python/3.10 websockets/16.1.1","notable":false}],"distinct_sets":1,"events_with_headers":10},"tags":[],"data_as_of":"2026-09-30T17:59:05.122915+00:00"}