{"ip":"130.78.189.159","total_events":94,"verdict":{"verdict":"probing","label":"Low-level probing","detail":null,"confidence":"low","network_type":null,"why":["94 event(s), fewer than 10 distinct ports, no exploit payloads.","Not in any known-scanner range.","Sent 34,395 bytes despite few ports and no known exploit path: focused interaction with one service, worth a look."],"engagement":{"level":"payload","label":"Sustained payload","detail":"34,395 bytes sent","bytes_sent":34395,"session_seconds":0,"persistent":false}},"first_seen":"2026-09-16T02:46:03","last_seen":"2026-09-24T08:38:50","events_24h":16,"events_7d":88,"geo":{"country_code":"NL","country_name":"The Netherlands","region":"","city":"","lat":52.3824,"lon":4.8995,"asn":218891,"org":"Lightbyte Ltd"},"source_domain":null,"known_scanners":[],"scanner_tag":null,"cve_matches":[],"malware":[],"top_ports":[{"port":7681,"proto":"tcp","label":"","count":86},{"port":8080,"proto":"tcp","label":"HTTP-alt","count":6},{"port":81,"proto":"tcp","label":"","count":2}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i131000_f57a46bbacb6_f50d94e863eb"],"tls_client_hello":"16030105d2010005ce030389907f2e02de8559c4057cf9cff8f9ab0f85d611da34193836fd6b577fdf82c920a973b79882a503b983903cdafcfad793440c3eccd6166683b0e42da62da6a170001ac02bc02fc02cc030cca9cca8c009c013c00ac0141301130213030100056b000b00020100ff010001000017000000120000000500050100000000000a0010000e11ec11eb11ed001d001700180019000d001c001a090409050906080404030807080508060401050106010503060300320020001e090409050906080404030807080508060401050106010503060302010203002b00050403040303003304ea04e811ec04c0a5d38471fc7168fb98b8e720a21a0b1851b6e43c714e0610207ac81633791fa07a0a46507eca1b794896eec4808caa95b2681289a722cc833a9b77345a8a26c678c6275c9656643dc300a8e0e56e91e14bac01bb8370b8fa021edf1497d7b58df2987a15622ffe9bbc1be68a6363052eb433fc7133ab04c2f1824b5efcaa3710980c2b5be0729452a4bf7fd87dde92187dd1785b00980293253276299a58185d558b7ab246f38a7c4fc0c1ee9875a912308c8c5707a87cea6541b6fb366fa9895c5b71457c48eeb60cf487c8878c8dd7a7cf89228659ab9533894c24699f9f3ac6572c24aba89bebb9c5e9f395c108299e008bd91b10ea6c015c61505e25b9975b91b8088a98c6c74eb210813cb5de37affc5186d4dc4fa395cbe9c089683ac1ec7096bc065bd309c9cfa91af86b2d8adc76c7390da2f493c8e495efb1730e4c77544336b2528cec8cc812787fb7cc17e946178285248d3b1811514f5f670106053aa3b257c5273c59c77dae269523d31b87d70feac5619d32b636bb09d275221f6661ebd49d5152b9830b31c36b1a56fa5cb9676b1414a120b7723e947b1c34061fe3b888f78d46b32e3af22647196916907a9a7b9efd09972c41ae90c41c0c270c0e49bc03e03a453a87d092514b7b7b8d30bdaf618120c7283b04a723476e9a1c14d13c3311f49c6dc0169fd99ee8b9569dab0388354a9da37fe6073aba3981cd184ac721628fc3139c872bc7778f5d2243c3305df07cb788bcb231725583108f859b4d2b2307cd622f48516d8d17673d1622642a8daa3640501181b47333a87c838ca4a091093ccae09046a10e68853db19a40f9a964d0807271c8724d7794b7c38cd7995337c578106c83b7024fcb820c7440c7d8f9674cab2dacf6341f47b19ea1727c81198249606424c74dbc0f62e0ab28e406cc1b7256f4a4083881f9f57712a35b47ba1875827206a80ffc6bbc85b81990586c6857a7846360f70613e641627213ab706179fe849de28b4e54d057a1cc6445d2b81268cf10cc15cce73602845ce899506649c9427774317a226cd4177a51917c2bbf4f57229559426461c0a0b2c55cccaa602782ecdabe1ffc57762a0f19c96da589cf4d9111b33134d959a2ebd46c55fac8921802f7f20c7d4bcde42a6601ca80a4513d608235fd8c7b74b356e36172061895c87137336cb99273b433858e2da4301a32960b3847d1078d9db04a54b58b5fb498e2979da0121780e77f43550fbb19cf323645979b1079949e01936b8c924cd4727766629c6254c045a66482a158318418c212a984b1213fb47757243c6be932228cacdf0bcebbb765633208825b2c46567a53c64d936bcbff568db5638b0417116d033b93f9ac97e1936fc773e9957bb4489b99d90830167adf899ca5399a067497a0a8869e9b22f2cb845b052ba93c4ccd357a44450c12e1bbb2213ce489b66f3c238bf15e59a7b60ae265720062e6a66b985b437ea66174d0191fe1198a42c7d65592de77c341f0668d4594f4cc5fce31972d78bc7c42326bfc2c8442b2fb8658434a9a2bbaaa8747cb88b35c7487420309c2bae71e182214fe556baee59d2c0050d12020a11a0409d1577c29c23906737c4926394390415ffced3fdd5af275fd94d1408419f1069a8026efdab530eb657b7777d94e74a7c81975f633ba8dd018229ed3abd7e91ede47e052d1c7f371a20ec96c001d0020d94e74a7c81975f633ba8dd018229ed3abd7e91ede47e052d1c7f371a20ec96c","tls_ja3":["725543c78edf669194c11dc7a039b56e"],"http_akin":["a11cun101_e400114a_f5d02f95"]},"fingerprint_peers":{"a11cun101_e400114a_f5d02f95":3,"t13i131000_f57a46bbacb6_f50d94e863eb":2572},"akin_families":{},"user_agents":["Go-http-client/1.1","Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36"],"timeline":[{"date":"2026-09-16","count":6},{"date":"2026-09-19","count":8},{"date":"2026-09-20","count":24},{"date":"2026-09-21","count":22},{"date":"2026-09-22","count":14},{"date":"2026-09-23","count":4},{"date":"2026-09-24","count":16}],"recent_events":[{"timestamp":"2026-09-24T08:38:50","port":7681,"proto":"tcp","app_proto":"","app_protocol":"http","host":"192.3.118.146","headers":"{\"cache-control\":\"no-cache\",\"connection\":\"Upgrade\",\"host\":\"192.3.118.146:7681\",\"origin\":\"http://192.3.118.146:7681\",\"pragma\":\"no-cache\",\"sec-websocket-key\":\"3xgaNIWaFA9k17S8uQHc9w==\",\"sec-websocket-protocol\":\"tty\",\"sec-websocket-version\":\"13\",\"upgrade\":\"websocket\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/ws","summary":"","payload_hex":"474554202f777320485454502f312e310d0a486f73743a203139322e332e3131382e3134363a373638310d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3133352e302e302e30205361666172692f3533372e33360d0a43616368652d436f6e74726f6c3a206e6f2d63616368650d0a436f6e6e656374696f6e3a20557067726164650d0a4f726967696e3a20687474703a2f2f3139322e332e3131382e3134363a373638310d0a507261676d613a206e6f2d63616368650d0a5365632d576562536f636b65742d4b65793a20337867614e4957614641396b313753387551486339773d3d0d0a5365632d576562536f636b65742d50726f746f636f6c3a207474790d0a5365632d576562536f636b65742d56657273696f6e3a2031330d0a557067726164653a20776562736f636b65740d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36","ja3":"","session":"01ca2a54-45ca-4661-916c-019ea51055b5","seq":1,"duration_ms":100,"bytes_in":391,"bytes_out":79},{"timestamp":"2026-09-24T08:38:50","port":7681,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"192.3.118.146","headers":"{\"cache-control\":\"no-cache\",\"connection\":\"Upgrade\",\"host\":\"192.3.118.146:7681\",\"origin\":\"https://192.3.118.146:7681\",\"pragma\":\"no-cache\",\"sec-websocket-key\":\"0Yibd6Kp7fsbyMfWdX+LOQ==\",\"sec-websocket-protocol\":\"tty\",\"sec-websocket-version\":\"13\",\"upgrade\":\"websocket\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/ws","summary":"","payload_hex":"474554202f777320485454502f312e310d0a486f73743a203139322e332e3131382e3134363a373638310d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3133352e302e302e30205361666172692f3533372e33360d0a43616368652d436f6e74726f6c3a206e6f2d63616368650d0a436f6e6e656374696f6e3a20557067726164650d0a4f726967696e3a2068747470733a2f2f3139322e332e3131382e3134363a373638310d0a507261676d613a206e6f2d63616368650d0a5365632d576562536f636b65742d4b65793a203059696264364b7037667362794d665764582b4c4f513d3d0d0a5365632d576562536f636b65742d50726f746f636f6c3a207474790d0a5365632d576562536f636b65742d56657273696f6e3a2031330d0a557067726164653a20776562736f636b65740d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36","ja3":"725543c78edf669194c11dc7a039b56e","session":"d57a335d-5fd1-4281-903f-d103d1deb831","seq":1,"duration_ms":100,"bytes_in":392,"bytes_out":79},{"timestamp":"2026-09-24T08:03:57","port":7681,"proto":"tcp","app_proto":"","app_protocol":"http","host":"185.228.81.201","headers":"{\"cache-control\":\"no-cache\",\"connection\":\"Upgrade\",\"host\":\"185.228.81.201:7681\",\"origin\":\"http://185.228.81.201:7681\",\"pragma\":\"no-cache\",\"sec-websocket-key\":\"OlzgdMrO3b6YVzHNeCTVEQ==\",\"sec-websocket-protocol\":\"tty\",\"sec-websocket-version\":\"13\",\"upgrade\":\"websocket\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/ws","summary":"","payload_hex":"474554202f777320485454502f312e310d0a486f73743a203138352e3232382e38312e3230313a373638310d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3133352e302e302e30205361666172692f3533372e33360d0a43616368652d436f6e74726f6c3a206e6f2d63616368650d0a436f6e6e656374696f6e3a20557067726164650d0a4f726967696e3a20687474703a2f2f3138352e3232382e38312e3230313a373638310d0a507261676d613a206e6f2d63616368650d0a5365632d576562536f636b65742d4b65793a204f6c7a67644d724f33623659567a484e6543545645513d3d0d0a5365632d576562536f636b65742d50726f746f636f6c3a207474790d0a5365632d576562536f636b65742d56657273696f6e3a2031330d0a557067726164653a20776562736f636b65740d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36","ja3":"","session":"bb30fa73-f5e3-4a59-9c24-80202aed1b9f","seq":1,"duration_ms":100,"bytes_in":393,"bytes_out":79},{"timestamp":"2026-09-24T08:03:57","port":7681,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"185.228.81.201","headers":"{\"cache-control\":\"no-cache\",\"connection\":\"Upgrade\",\"host\":\"185.228.81.201:7681\",\"origin\":\"https://185.228.81.201:7681\",\"pragma\":\"no-cache\",\"sec-websocket-key\":\"DwtjNFELrliiWUGSBC9Tnw==\",\"sec-websocket-protocol\":\"tty\",\"sec-websocket-version\":\"13\",\"upgrade\":\"websocket\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/ws","summary":"","payload_hex":"474554202f777320485454502f312e310d0a486f73743a203138352e3232382e38312e3230313a373638310d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3133352e302e302e30205361666172692f3533372e33360d0a43616368652d436f6e74726f6c3a206e6f2d63616368650d0a436f6e6e656374696f6e3a20557067726164650d0a4f726967696e3a2068747470733a2f2f3138352e3232382e38312e3230313a373638310d0a507261676d613a206e6f2d63616368650d0a5365632d576562536f636b65742d4b65793a204477746a4e46454c726c696957554753424339546e773d3d0d0a5365632d576562536f636b65742d50726f746f636f6c3a207474790d0a5365632d576562536f636b65742d56657273696f6e3a2031330d0a557067726164653a20776562736f636b65740d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36","ja3":"725543c78edf669194c11dc7a039b56e","session":"d0326fa2-cdd0-4906-8205-ab1664401df5","seq":1,"duration_ms":101,"bytes_in":394,"bytes_out":79},{"timestamp":"2026-09-24T07:59:59","port":7681,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"cache-control\":\"no-cache\",\"connection\":\"Upgrade\",\"host\":\"<HONEYPOT>:7681\",\"origin\":\"http://<HONEYPOT>:7681\",\"pragma\":\"no-cache\",\"sec-websocket-key\":\"2+wZzhcwVXcBPv2WmqEXaw==\",\"sec-websocket-protocol\":\"tty\",\"sec-websocket-version\":\"13\",\"upgrade\":\"websocket\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/ws","summary":"","payload_hex":"474554202f777320485454502f312e310d0a486f73743a20<HONEYPOT>3a373638310d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3133352e302e302e30205361666172692f3533372e33360d0a43616368652d436f6e74726f6c3a206e6f2d63616368650d0a436f6e6e656374696f6e3a20557067726164650d0a4f726967696e3a20687474703a2f2f<HONEYPOT>3a373638310d0a507261676d613a206e6f2d63616368650d0a5365632d576562536f636b65742d4b65793a20322b775a7a68637756586342507632576d71455861773d3d0d0a5365632d576562536f636b65742d50726f746f636f6c3a207474790d0a5365632d576562536f636b65742d56657273696f6e3a2031330d0a557067726164653a20776562736f636b65740d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36","ja3":"","session":"6df02860-551a-4b6c-8c69-7f18faa5573b","seq":1,"duration_ms":101,"bytes_in":389,"bytes_out":79},{"timestamp":"2026-09-24T07:59:59","port":7681,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"cache-control\":\"no-cache\",\"connection\":\"Upgrade\",\"host\":\"<HONEYPOT>:7681\",\"origin\":\"https://<HONEYPOT>:7681\",\"pragma\":\"no-cache\",\"sec-websocket-key\":\"KrANmnPfGibeiEC7Sue46g==\",\"sec-websocket-protocol\":\"tty\",\"sec-websocket-version\":\"13\",\"upgrade\":\"websocket\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/ws","summary":"","payload_hex":"474554202f777320485454502f312e310d0a486f73743a20<HONEYPOT>3a373638310d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3133352e302e302e30205361666172692f3533372e33360d0a43616368652d436f6e74726f6c3a206e6f2d63616368650d0a436f6e6e656374696f6e3a20557067726164650d0a4f726967696e3a2068747470733a2f2f<HONEYPOT>3a373638310d0a507261676d613a206e6f2d63616368650d0a5365632d576562536f636b65742d4b65793a204b72414e6d6e506647696265694543375375653436673d3d0d0a5365632d576562536f636b65742d50726f746f636f6c3a207474790d0a5365632d576562536f636b65742d56657273696f6e3a2031330d0a557067726164653a20776562736f636b65740d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36","ja3":"725543c78edf669194c11dc7a039b56e","session":"8a1a5f1b-d5dd-4e4e-b4e9-bb179f0c09da","seq":1,"duration_ms":100,"bytes_in":390,"bytes_out":79},{"timestamp":"2026-09-24T07:57:15","port":7681,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"cache-control\":\"no-cache\",\"connection\":\"Upgrade\",\"host\":\"<HONEYPOT>:7681\",\"origin\":\"http://<HONEYPOT>:7681\",\"pragma\":\"no-cache\",\"sec-websocket-key\":\"/fL+9LLatvT59T4yMjusuQ==\",\"sec-websocket-protocol\":\"tty\",\"sec-websocket-version\":\"13\",\"upgrade\":\"websocket\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/ws","summary":"","payload_hex":"474554202f777320485454502f312e310d0a486f73743a20<HONEYPOT>3a373638310d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3133352e302e302e30205361666172692f3533372e33360d0a43616368652d436f6e74726f6c3a206e6f2d63616368650d0a436f6e6e656374696f6e3a20557067726164650d0a4f726967696e3a20687474703a2f2f<HONEYPOT>3a373638310d0a507261676d613a206e6f2d63616368650d0a5365632d576562536f636b65742d4b65793a202f664c2b394c4c6174765435395434794d6a757375513d3d0d0a5365632d576562536f636b65742d50726f746f636f6c3a207474790d0a5365632d576562536f636b65742d56657273696f6e3a2031330d0a557067726164653a20776562736f636b65740d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36","ja3":"","session":"14ba5b53-8d48-4943-8e48-520fcdc4403e","seq":1,"duration_ms":100,"bytes_in":391,"bytes_out":79},{"timestamp":"2026-09-24T07:57:15","port":7681,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"cache-control\":\"no-cache\",\"connection\":\"Upgrade\",\"host\":\"<HONEYPOT>:7681\",\"origin\":\"https://<HONEYPOT>:7681\",\"pragma\":\"no-cache\",\"sec-websocket-key\":\"uXgUh+tOXaf/qjwVeOAyCw==\",\"sec-websocket-protocol\":\"tty\",\"sec-websocket-version\":\"13\",\"upgrade\":\"websocket\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/ws","summary":"","payload_hex":"474554202f777320485454502f312e310d0a486f73743a20<HONEYPOT>3a373638310d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3133352e302e302e30205361666172692f3533372e33360d0a43616368652d436f6e74726f6c3a206e6f2d63616368650d0a436f6e6e656374696f6e3a20557067726164650d0a4f726967696e3a2068747470733a2f2f<HONEYPOT>3a373638310d0a507261676d613a206e6f2d63616368650d0a5365632d576562536f636b65742d4b65793a2075586755682b744f5861662f716a7756654f417943773d3d0d0a5365632d576562536f636b65742d50726f746f636f6c3a207474790d0a5365632d576562536f636b65742d56657273696f6e3a2031330d0a557067726164653a20776562736f636b65740d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36","ja3":"725543c78edf669194c11dc7a039b56e","session":"5348e660-def4-4d7b-96ce-e4d121da9b2b","seq":1,"duration_ms":100,"bytes_in":392,"bytes_out":79},{"timestamp":"2026-09-24T03:32:47","port":7681,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"cache-control\":\"no-cache\",\"connection\":\"Upgrade\",\"host\":\"<HONEYPOT>:7681\",\"origin\":\"http://<HONEYPOT>:7681\",\"pragma\":\"no-cache\",\"sec-websocket-key\":\"yaVx03BAQ7kpOZfMjwX7sw==\",\"sec-websocket-protocol\":\"tty\",\"sec-websocket-version\":\"13\",\"upgrade\":\"websocket\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/ws","summary":"","payload_hex":"474554202f777320485454502f312e310d0a486f73743a20<HONEYPOT>3a373638310d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3133352e302e302e30205361666172692f3533372e33360d0a43616368652d436f6e74726f6c3a206e6f2d63616368650d0a436f6e6e656374696f6e3a20557067726164650d0a4f726967696e3a20687474703a2f2f<HONEYPOT>3a373638310d0a507261676d613a206e6f2d63616368650d0a5365632d576562536f636b65742d4b65793a20796156783033424151376b704f5a664d6a77583773773d3d0d0a5365632d576562536f636b65742d50726f746f636f6c3a207474790d0a5365632d576562536f636b65742d56657273696f6e3a2031330d0a557067726164653a20776562736f636b65740d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36","ja3":"","session":"7853c14a-24ef-4756-9fd7-38b1870e7fe9","seq":1,"duration_ms":101,"bytes_in":389,"bytes_out":79},{"timestamp":"2026-09-24T03:32:47","port":7681,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"cache-control\":\"no-cache\",\"connection\":\"Upgrade\",\"host\":\"<HONEYPOT>:7681\",\"origin\":\"https://<HONEYPOT>:7681\",\"pragma\":\"no-cache\",\"sec-websocket-key\":\"jNyoGXvgk84hp5G99Lvtlw==\",\"sec-websocket-protocol\":\"tty\",\"sec-websocket-version\":\"13\",\"upgrade\":\"websocket\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/ws","summary":"","payload_hex":"474554202f777320485454502f312e310d0a486f73743a20<HONEYPOT>3a373638310d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3133352e302e302e30205361666172692f3533372e33360d0a43616368652d436f6e74726f6c3a206e6f2d63616368650d0a436f6e6e656374696f6e3a20557067726164650d0a4f726967696e3a2068747470733a2f2f<HONEYPOT>3a373638310d0a507261676d613a206e6f2d63616368650d0a5365632d576562536f636b65742d4b65793a206a4e796f475876676b38346870354739394c76746c773d3d0d0a5365632d576562536f636b65742d50726f746f636f6c3a207474790d0a5365632d576562536f636b65742d56657273696f6e3a2031330d0a557067726164653a20776562736f636b65740d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36","ja3":"725543c78edf669194c11dc7a039b56e","session":"ed98f819-4b4e-40a5-b875-43e66afd37ad","seq":1,"duration_ms":100,"bytes_in":390,"bytes_out":79}],"http_methods":[{"method":"GET","count":94}],"distinct_ports_total":3,"top_paths":[{"path":"/ws","count":86,"ports":1},{"path":"/login","count":6,"ports":1},{"path":"login.cgi","count":2,"ports":1}],"distinct_paths_total":3,"top_snis":[],"top_hosts":[{"value":"185.228.81.201","count":12},{"value":"192.3.118.146","count":6}],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Cache-Control","Connection","Host","Origin","Pragma","Sec-Websocket-Key","Sec-Websocket-Protocol","Sec-Websocket-Version","Upgrade","User-Agent"],"representative":[{"name":"Cache-Control","value":"no-cache","notable":false},{"name":"Connection","value":"Upgrade","notable":false},{"name":"Host","value":"192.3.118.146:7681","notable":false},{"name":"Origin","value":"http://192.3.118.146:7681","notable":true},{"name":"Pragma","value":"no-cache","notable":false},{"name":"Sec-Websocket-Key","value":"3xgaNIWaFA9k17S8uQHc9w==","notable":false},{"name":"Sec-Websocket-Protocol","value":"tty","notable":false},{"name":"Sec-Websocket-Version","value":"13","notable":false},{"name":"Upgrade","value":"websocket","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36","notable":false}],"distinct_sets":1,"events_with_headers":10},"tags":[],"data_as_of":"2026-09-24T13:49:27.404034+00:00"}