{"ip":"129.213.78.179","total_events":7,"verdict":{"verdict":"probing","label":"Low-level probing","detail":null,"confidence":"low","network_type":"CDN","why":["7 event(s), fewer than 10 distinct ports, no exploit payloads.","Not in any known-scanner range."],"engagement":{"level":"touch","label":"Touch only","detail":"0 bytes sent, no real exchange","bytes_sent":0,"session_seconds":0,"persistent":false}},"first_seen":"2026-03-10T22:53:00","last_seen":"2026-03-10T22:53:48","events_24h":0,"events_7d":0,"geo":{"country_code":"US","country_name":"United States","region":"Virginia","city":"Ashburn","lat":39.018,"lon":-77.539,"asn":31898,"org":"Oracle Corporation"},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as31898","label":"Oracle Cloud Infrastructure","category":"cdn","url":"https://www.peeringdb.com/asn/31898"},"cve_matches":[],"malware":[],"top_ports":[{"port":11434,"proto":"tcp","label":"","count":7}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i3111h1_e8f1e7e78f70_d41ae481755e"],"tls_ja3":[],"ja4h":["ge11nn0500_e161b8ad0830"]},"fingerprint_peers":{"t13i3111h1_e8f1e7e78f70_d41ae481755e":9,"ge11nn0500_e161b8ad0830":33},"user_agents":["python-httpx/0.28.1"],"timeline":[],"recent_events":[{"timestamp":"2026-03-10T22:53:48","port":11434,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:11434\",\"user-agent\":\"python-httpx/0.28.1\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"/api/tags","summary":"","payload_hex":"474554202f6170692f7461677320485454502f312e310d0a486f73743a20<HONEYPOT>3a31313433340d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a557365722d4167656e743a20707974686f6e2d68747470782f302e32382e310d0a0d0a","method":"GET","user_agent":"python-httpx/0.28.1","ja3":"","session":"fddc6b35-810b-44c9-b939-455691d1b7eb","seq":0,"duration_ms":0,"bytes_in":0,"bytes_out":0},{"timestamp":"2026-03-10T22:53:32","port":11434,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"ET /api/tags HTTP/1.1\r\nHost: <HONEYPOT>:11434\r\nAccept: */*\r\nAccept-Encoding: gzip, deflate\r\nConnection: keep-alive\r\nUser-Agent: python-httpx/0.28.1\r\n\r\n","payload_hex":"4554202f6170692f7461677320485454502f312e310d0a486f73743a20<HONEYPOT>3a31313433340d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a557365722d4167656e743a20707974686f6e2d68747470782f302e32382e310d0a0d0a","method":"","user_agent":"","ja3":"","session":"ef8d8174-882b-46a9-9ec6-7ef2c51119a9","seq":0,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"f0633cc45b62092a","strings":["ET /api/tags HTTP/1.1","Host: <HONEYPOT>:11434","Accept: */*","Accept-Encoding: gzip, deflate","Connection: keep-alive","User-Agent: python-httpx/0.28.1"],"iocs":{"paths":["/api/tags"]}}},{"timestamp":"2026-03-10T22:53:32","port":11434,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"G","payload_hex":"47","method":"","user_agent":"","ja3":"","session":"ef8d8174-882b-46a9-9ec6-7ef2c51119a9","seq":0,"duration_ms":0,"bytes_in":0,"bytes_out":0},{"timestamp":"2026-03-10T22:53:16","port":11434,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"ET /api/tags HTTP/1.1\r\nHost: <HONEYPOT>:11434\r\nAccept: */*\r\nAccept-Encoding: gzip, deflate\r\nConnection: keep-alive\r\nUser-Agent: python-httpx/0.28.1\r\n\r\n","payload_hex":"4554202f6170692f7461677320485454502f312e310d0a486f73743a20<HONEYPOT>3a31313433340d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a557365722d4167656e743a20707974686f6e2d68747470782f302e32382e310d0a0d0a","method":"","user_agent":"","ja3":"","session":"29d414cb-5f5d-4b9f-bde8-4810e97e66fe","seq":0,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"f0633cc45b62092a","strings":["ET /api/tags HTTP/1.1","Host: <HONEYPOT>:11434","Accept: */*","Accept-Encoding: gzip, deflate","Connection: keep-alive","User-Agent: python-httpx/0.28.1"],"iocs":{"paths":["/api/tags"]}}},{"timestamp":"2026-03-10T22:53:16","port":11434,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"G","payload_hex":"47","method":"","user_agent":"","ja3":"","session":"29d414cb-5f5d-4b9f-bde8-4810e97e66fe","seq":0,"duration_ms":0,"bytes_in":0,"bytes_out":0},{"timestamp":"2026-03-10T22:53:00","port":11434,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"ET /api/tags HTTP/1.1\r\nHost: <HONEYPOT>:11434\r\nAccept: */*\r\nAccept-Encoding: gzip, deflate\r\nConnection: keep-alive\r\nUser-Agent: python-httpx/0.28.1\r\n\r\n","payload_hex":"4554202f6170692f7461677320485454502f312e310d0a486f73743a20<HONEYPOT>3a31313433340d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a557365722d4167656e743a20707974686f6e2d68747470782f302e32382e310d0a0d0a","method":"","user_agent":"","ja3":"","session":"a90ec2a3-634f-4eaf-8366-3cb84ef328fc","seq":0,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"f0633cc45b62092a","strings":["ET /api/tags HTTP/1.1","Host: <HONEYPOT>:11434","Accept: */*","Accept-Encoding: gzip, deflate","Connection: keep-alive","User-Agent: python-httpx/0.28.1"],"iocs":{"paths":["/api/tags"]}}},{"timestamp":"2026-03-10T22:53:00","port":11434,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"G","payload_hex":"47","method":"","user_agent":"","ja3":"","session":"a90ec2a3-634f-4eaf-8366-3cb84ef328fc","seq":0,"duration_ms":0,"bytes_in":0,"bytes_out":0}],"http_methods":[{"method":"GET","count":1}],"distinct_ports_total":1,"top_paths":[{"path":"/api/tags","count":1,"ports":1}],"distinct_paths_total":1,"top_snis":[],"top_hosts":[],"top_alpns":[{"value":"http/1.1","count":1}],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","Accept-Encoding","Connection","Host","User-Agent"],"representative":[{"name":"Accept","value":"*/*","notable":false},{"name":"Accept-Encoding","value":"gzip, deflate","notable":false},{"name":"Connection","value":"keep-alive","notable":false},{"name":"Host","value":"<HONEYPOT>:11434","notable":false},{"name":"User-Agent","value":"python-httpx/0.28.1","notable":false}],"distinct_sets":1,"events_with_headers":1},"tags":[],"data_as_of":"2026-07-30T11:03:40.704942+00:00"}