{"ip":"13.62.142.172","data_as_of":"2026-10-25T01:49:41+00:00","observed":true,"total_events":2,"verdict":{"verdict":"probing","label":"Low-level probing","detail":null,"confidence":"low","network_type":"enterprise","why":["5 event(s), fewer than 10 distinct ports, no exploit payloads.","Not in any known-scanner range.","Counts include 3 interactive session(s) as well as first-packet events."],"engagement":{"level":"request","label":"Request traffic","detail":"2,038 bytes sent","bytes_sent":2038,"session_seconds":0,"persistent":false},"basis":"combined"},"first_seen":"2026-10-21T00:59:14","last_seen":"2026-10-24T18:44:31","events_24h":0,"events_7d":2,"interactive_sessions":3,"interactive_sessions_24h":2,"interactive_sessions_7d":3,"interactive_protocols":[{"protocol":"http","sessions":2},{"protocol":"xmpp","sessions":1}],"geo":{"country_code":"SE","country_name":"Sweden","region":"Stockholm County","city":"Stockholm","lat":59.3287,"lon":18.0717,"asn":16509,"org":"Amazon.com, Inc."},"source_domain":"scan.apcosys.cc","known_scanners":[],"scanner_tag":{"key":"peeringdb:as16509","label":"Amazon.com","category":"enterprise","url":"https://www.peeringdb.com/asn/16509"},"cve_matches":[],"malware":[],"udp":null,"interaction":{"window_days":90,"sessions":3,"first_seen":"2026-10-21T00:59:14","last_seen":"2026-10-24T18:44:31","verdicts":[{"verdict":"unknown","sessions":2},{"verdict":"scan","sessions":1}],"personas":[{"persona":"nginx@1.18.0, wordpress@6.5.2, leaks@1, miner@cgminer 4.11.1, elasticsearch@8.11.1, winrm@Windows Server 2019, fortigate@7.2.1","sessions":1},{"persona":"xmpp@ejabberd 21.12","sessions":1},{"persona":"nginx@1.18.0, wordpress@6.5.2, leaks@1, miner@cgminer 4.11.1, elasticsearch@8.11.1, winrm@Windows Server 2019, dlink-dir645@1.03, fortigate@7.2.1, gitlab@19.4.2","sessions":1}],"services":[{"protocol":"http","port":9200,"sessions":1},{"protocol":"http","port":80,"sessions":1},{"protocol":"xmpp","port":5269,"sessions":1}],"logins":[],"commands":[],"downloads":[],"files":[],"attack":[{"technique_id":"T1595","technique_name":"Active Scanning","tactic_id":"TA0043","tactic_name":"Reconnaissance","sessions":1}]},"top_ports":[{"port":27017,"proto":"tcp","label":"MongoDB","count":2,"sessions":0},{"port":80,"proto":"tcp","label":"HTTP","count":0,"sessions":1},{"port":5269,"proto":"tcp","label":"XMPP-S2S","count":0,"sessions":1},{"port":9200,"proto":"tcp","label":"Elastic","count":0,"sessions":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i251000_b78ed14e2fd0_f50d94e863eb"],"tls_client_hello":"","tls_ja3":["416eca07dcaad72dec6f76d1277b3eff"],"http_akin":["b11cun050_0004001e_6f27235c"],"interactive":{"ssh_hassh":[],"tls_ja4":["t13i251000_b78ed14e2fd0_f50d94e863eb"],"tls_ja3":["416eca07dcaad72dec6f76d1277b3eff"]}},"fingerprint_peers":{"t13i251000_b78ed14e2fd0_f50d94e863eb":48,"b11cun050_0004001e_6f27235c":9},"akin_families":{},"user_agents":["ApcosysBot/1.0 (+https://apcosys.net)"],"timeline":[{"date":"2026-10-21","count":0,"sessions":1},{"date":"2026-10-22","count":2,"sessions":0},{"date":"2026-10-24","count":0,"sessions":2}],"recent_events":[{"timestamp":"2026-10-24T03:59:55","port":5269,"proto":"tcp","app_proto":"xmpp","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0016\u0003\u0001\u0005�\u0001\u0000\u0005�\u0003\u0003\u001a����#F������'�9<(O\u0016f��,gFC\u0003��\t ���;Q.�}q�\u000b�\u0003�\u000e�ͤ,�\"Y0ÿ��$\u0016b>�\u00002�+�/�,�0̨̩�\t�\u0013�\n�\u0014\u0000�\u0000�\u0000/\u00005�\u0012\u0000\n�#�'\u0000<�\u0007�\u0011\u0000\u0005\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005o\u0000\u000b\u0000\u0002\u0001\u0000�\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\u0010\u0000\u000e\u0011�\u0011�\u0011�\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u001c\u0000\u001a\t\u0004\t\u0005\t\u0006\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u00002\u0000 \u0000\u001e\t\u0004\t\u0005\t\u0006\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0004�\u0004�\u0011�\u0004�\t:�\"t�\u0001�\u0005d�������LhE�����Ś��9��-�V!h��\rǴ�8<��\u001c�kW�ٯ�̥�\"�&\bF�p\u000f�\\\u0016\t\u0019��\u001c������\u000b����\u0018�����\t�\u0007<\nJ�'ɤ�E\u001a�4[��\\T퓵\u000f�D\f�\u0003�&�l\u0015!�\u0016jE*\u0015f�BѐE�����\u001f��\u0017�h(�YIh�\u000b��\u0011�|\u0000\nK��\u001b\u0015v\u0006�tL�RH�TŻ���\u0015�_\u0012��҆�B\u0010@��D^��TT\u0001*D*lU��t'��S�*rhFC\u0019���W\u0000�\f\b�%fœw1\u00055l�{�P�X\u0018�y�QnW\u0019�hf�a�G�n�G�PZeC\u0006r:��\u0018��Q�\u00037�:r\u0016~�6\\�\u0013���Q�{i\u0017T�n31�#���j�2_��l\t\u001a\u0016���%\n:�&�%��\n{G\u001be|˜\u0001�vh\b��Kp��^E<]wŴ��=�KVbBN���H�+L��ꬬ\u0015\u0019�FWl��\u0015ߚ$���|2\u0017<��Ky{���F�V��\u001dbK��:cɨ{\u001a���\u0007���y\u0013���,D\u0013�\u001e�\u0015Z>\u000b=\u0005�'5)j4�y}����:��a��-\t:7�5]���Z����4�%�橆����\u0001��L催81��Yh1qU�Hi��}�ˢ\\yh�\u001b-h��s��@�\u0006z\u0005�\u0000�0[��\u0006\u0015���>�\u0014,�9YS��\u001a*F�8c\u001b3D�R(�P�\u0003\t\u0005�����\u001f�\u0007�L6\u0002\f��a��7v\u0000�\u0002�ӂ��\fc�61��C8B�:I�,i�����Ba�AD����\u0005��T\b��Ua�\u000e��]�a\u0018��\u000b�I���e�0\f�\u0014\u0018��5�pc\u0016I���dWP��eJ\u0005;����s���\u0005�Ti\u0019�C\u001e����S�j�\u0000��8��7mӜI�6��F�w*��l��z\u0016��\\\u0000Es\u001c�4H�\u000b\u0016�Ciotr��\u001c1�Fʼ�'���N�kAԒ��K7�\u0004\u0010�;+w���zZx2�\u0017'@v\u0007\u0011bU�\f�h�c��6\u0001�\u001a�\u0018L���Ћ\u0018�gXT��-��!|���2���TP���0{�q\u000e1|ރ��\u0003|���\u0003\"��c\"\u0011���\u0017\u000fN\fg��\u001a\u0012Y���\u001bm]��!��QyHPt\u0000\u0014悬euVRxm\u001cޅG��\u0013�&\u000e��y����`��\f\u0017�\u0006u��g\u0007;T觿R\u0016�\u000b\u0000\u001d\u0000 \u0013�&\u000e��y����`��\f\u0017�\u0006u��g\u0007;T觿R\u0016�\u000b","payload_hex":"16030105ee010005ea03031a929196e42346d6fbd1dac0c6278b393c284f1666ccc42c677f464303818009209b89fc3b512efb7d71f30b8403ff0ecfcda42cd8225930c3bfb5da2416623ecd0032c02bc02fc02cc030cca9cca8c009c013c00ac014009c009d002f0035c012000ac023c027003cc007c01100051301130213030100056f000b00020100ff010001000017000000120000000500050100000000000a0010000e11ec11eb11ed001d001700180019000d001c001a090409050906080404030807080508060401050106010503060300320020001e090409050906080404030807080508060401050106010503060302010203002b0009080304030303020301003304ea04e811ec04c0093ac622749801b40564b99c8ff4a7a7864c684597e196c19ec59aa0a53990d42db656216895940dc7b4b0383c97c41cdf6b57dad9afcccca5d022be260846b3700f995c16091992881c9dfab799c7d50bd0e0a7df18a6a7e8c5ff09c4073c0a4ad827c9a4cc451a91345bbedf5c54ed93b50f91440cf40388269a6c152184166a452a1566e542d19045f4f1bbdce71ff9c317f56828d35949689a0be4ba11cd7c000a4ba1e41b15760695744cbc5248a854c5bb87e2c515f45f12f0a8d2869f421040eba4445eb3cf5454012a442a6c55b2937427ffe753952a72684643198991e15700a10c08b72566c593773105356cc97ba750be5818897993516e5719ee6866be618147c96ec047a9505a654306723ae4ac18a2ac51850337b03a72167e8f365ce1138ec7c551807b691754bf6e33319623ab9d866acc325fd4d46c091a7f16ba9f87250a3aac269f25a0a90a7b471b657ccb9c01b67668088fa74b70a3a55e453c5d77c5b4eb823de54b5662424eb7b9ca48db2b4ccbc0eaacac15199346576c89d315df9a249be0c37c32173ca8cf4b797bbbfb8546b356b3a61d624ba4b43a63c9a87b1ab09aeb0781ddfb791381883c7062b4dc489272bd534650fcb918fe6b51e2514bab648a1e300b2dec710746577f8401ea294e5bd02798a0628ed1a2e60a9211295323fb228881ca92d55eaccaabad029941e32073e9be41b967f2ccb60fb9445ce7b4672baccc1700d90804de78164008c1523b8eb7f16cc54a76f2c8a96f3226523a7101a46cf833ab54145ad110538a3ac480e888604bcb9600650ae988cd3892fa8734c5a9199fe46cf480a8e6e2648b968739942e0d316b5658b0f6a9353672a266d508483a02738c60130724b97458c849272dbccb7ab273154c3ee92c4413b91eb8155a3e0b3d05f72735296a34a2797d85ced8c43a8dd261b9f72d093a37d9355da1dac55afa9191b134dd25a57fe6a986aac2dbd201ad8a4c3c64a68d47a55cb69f3adc56ef6a5a4354bc9827c7cda8c646d4729e5a2942516b97e016b16c0edce98adf225f3faa494fa35c0c9943fd003ee582ac38318e9c5968317155f74869e3807dc0cba25c7968e11b2d68fac673e79e4085067a05b700ea305b92bb061593bb8c3ee1142cb1395953f1c11a2a469738631b3344bd52289d50c5030905dfc0b4f7eb1f9607b84c36020cb99c61a4a5377600a102aad38282900c63ac3631b8c0433842c93a49a3ee91b32c69b0f3eaa9c04261f54144fa979ee005c3cf540898f35561fb0eaeac5d936118aba50bca49a385b365ee300cc31418f6f335e37063164982e3e5645750ced5654a053b81b3e39c73b6b4f70598546919d1431e93e8a5dd538b6adc00af9938c1d9376dd39c49aa36f1b646f3772ac7e16c8dd27a16b19b5c0045731cce3448c20b168943696f7472c7e01c31d246cabca227c9e8c94ef16b41d492eed44b37ca0410843b2b77baf8a77a5a7832d41727407607116255b70c8668c763f0933601c21aea184c8dfcaad08b188367585486b42dd4ce217c809efa32bfb6875450b7e7d6307bb7710e317cde83c2dc037cd2fcba032292e3632211a48bdb170f4e0c67f1b61a1259a2cbd21b6d5ddccb21c1a151794850740014e682ac65755652786d1cde854787d71399260ec5ea79e1f6aeb260edb80c17e90675c7f567073b54e8a7bf5216fc0b001d00201399260ec5ea79e1f6aeb260edb80c17e90675c7f567073b54e8a7bf5216fc0b","method":"","user_agent":"","ja3":"416eca07dcaad72dec6f76d1277b3eff","session":"65df19ab-e3c8-49d2-a77d-f5a3321397d8-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"4e40b990cabbc473","label":"TLS/SSL","strings":["9<(O","*D*lU","*rhFC","PZeC","^E<]w","KVbBN","o2&R:q","1kVX","'5)j4","jZCT"]},"interactive":true},{"timestamp":"2026-10-22T01:45:45","port":27017,"proto":"tcp","app_proto":"","app_protocol":"http","host":"","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"identity\",\"accept-language\":\"en-US;q=0.8,en;q=0.7\",\"host\":\"\",\"user-agent\":\"ApcosysBot/1.0 (+https://apcosys.net)\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/favicon.ico","summary":"","payload_hex":"474554202f66617669636f6e2e69636f20485454502f312e310d0a486f73743a200d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a206964656e746974790d0a4163636570742d4c616e67756167653a20656e2d55533b713d302e382c656e3b713d302e370d0a557365722d4167656e743a204170636f737973426f742f312e3020282b68747470733a2f2f6170636f7379732e6e6574290d0a0d0a","method":"GET","user_agent":"ApcosysBot/1.0 (+https://apcosys.net)","ja3":"","session":"0e7b980f-0d9f-45a2-8927-48f65d6cd93b","seq":2,"duration_ms":352,"bytes_in":347,"bytes_out":156},{"timestamp":"2026-10-22T01:45:45","port":27017,"proto":"tcp","app_proto":"","app_protocol":"http","host":"","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"identity\",\"accept-language\":\"en-US;q=0.8,en;q=0.7\",\"host\":\"\",\"user-agent\":\"ApcosysBot/1.0 (+https://apcosys.net)\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a200d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a206964656e746974790d0a4163636570742d4c616e67756167653a20656e2d55533b713d302e382c656e3b713d302e370d0a557365722d4167656e743a204170636f737973426f742f312e3020282b68747470733a2f2f6170636f7379732e6e6574290d0a0d0a","method":"GET","user_agent":"ApcosysBot/1.0 (+https://apcosys.net)","ja3":"","session":"0e7b980f-0d9f-45a2-8927-48f65d6cd93b","seq":1,"duration_ms":100,"bytes_in":168,"bytes_out":78}],"http_methods":[{"method":"GET","count":2}],"distinct_ports_total":4,"top_paths":[{"path":"/","count":1,"ports":1},{"path":"/favicon.ico","count":1,"ports":1}],"distinct_paths_total":2,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","Accept-Encoding","Accept-Language","Host","User-Agent"],"representative":[{"name":"Accept","value":"*/*","notable":false},{"name":"Accept-Encoding","value":"identity","notable":false},{"name":"Accept-Language","value":"en-US;q=0.8,en;q=0.7","notable":false},{"name":"Host","value":"","notable":false},{"name":"User-Agent","value":"ApcosysBot/1.0 (+https://apcosys.net)","notable":false}],"distinct_sets":1,"events_with_headers":2},"tags":[]}