{"ip":"138.226.239.88","total_events":20,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"10+ ports swept","confidence":"medium","network_type":null,"why":["No exploit payloads observed.","Swept 10 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range."],"engagement":{"level":"request","label":"Request traffic","detail":"2,324 bytes sent","bytes_sent":2324,"session_seconds":0,"persistent":false}},"first_seen":"2026-07-21T14:02:54","last_seen":"2026-09-27T05:29:38","events_24h":0,"events_7d":11,"geo":{"country_code":"GB","country_name":"United Kingdom","region":"","city":"","lat":51.4964,"lon":-0.1224,"asn":44589,"org":"Digital Network S.r.l."},"source_domain":null,"known_scanners":[],"scanner_tag":null,"cve_matches":[],"malware":[],"top_ports":[{"port":2375,"proto":"tcp","label":"Docker","count":9},{"port":3443,"proto":"tcp","label":"","count":2},{"port":2376,"proto":"tcp","label":"Docker-TLS","count":2},{"port":8443,"proto":"tcp","label":"HTTPS-alt","count":1},{"port":9443,"proto":"tcp","label":"","count":1},{"port":443,"proto":"tcp","label":"HTTPS","count":1},{"port":444,"proto":"tcp","label":"","count":1},{"port":5443,"proto":"tcp","label":"","count":1},{"port":6443,"proto":"tcp","label":"k8s API","count":1},{"port":4433,"proto":"tcp","label":"","count":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i131000_f57a46bbacb6_a089bac06eae","t13i131000_f57a46bbacb6_e5728521abd4"],"tls_client_hello":"16030101100100010c03035cd428a23cfbd24ef4b2cf7aa965c9991a90718328d82f7a6697c916e104ac8d20345cf539d75944f192e850d1f30efa684c7e53993816c299e7533835ffb2ace7001ac02bc02fc02cc030cca9cca8c009c013c00ac014130113021303010000a9000b00020100ff010001000017000000120000000500050100000000000a000a0008001d001700180019000d0020001e09040905090608040403080708050806040105010601050306030201020300320020001e090409050906080404030807080508060401050106010503060302010203002b0009080304030303020301003300260024001d00206b2200e62c0756b9d841cf452e872d789b7024535e853165e96cea27832ce46a","tls_ja3":["ad8e2ddea9ec0a77edc063c36fc6cecc","2196848d251b217de8b2c037e356c11d"],"http_akin":["b11cun030_00040012_13ee3d34","b11cun040_00040015_a4cdfabf"]},"fingerprint_peers":{"t13i131000_f57a46bbacb6_a089bac06eae":7,"t13i131000_f57a46bbacb6_e5728521abd4":63,"b11cun030_00040012_13ee3d34":5092,"b11cun040_00040015_a4cdfabf":34},"akin_families":{"b11cun040_00040015_a4cdfabf":{"head":"b11cun040_00040015_a4cdfabf","shapes":2,"ips":34}},"user_agents":["Go-http-client/1.1","Docker-Client/24.0.0"],"timeline":[{"date":"2026-07-21","count":9},{"date":"2026-09-26","count":1},{"date":"2026-09-27","count":10}],"recent_events":[{"timestamp":"2026-09-27T05:29:38","port":2376,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"application/json\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:2376\",\"user-agent\":\"Docker-Client/24.0.0\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/version","summary":"","payload_hex":"474554202f76657273696f6e20485454502f312e310d0a486f73743a20<HONEYPOT>3a323337360d0a557365722d4167656e743a20446f636b65722d436c69656e742f32342e302e300d0a4163636570743a206170706c69636174696f6e2f6a736f6e0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Docker-Client/24.0.0","ja3":"ad8e2ddea9ec0a77edc063c36fc6cecc","session":"49f56ef3-d1ae-46db-9285-32c26d9bb3da","seq":1,"duration_ms":100,"bytes_in":129,"bytes_out":79},{"timestamp":"2026-09-27T03:34:38","port":2376,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"application/json\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:2376\",\"user-agent\":\"Docker-Client/24.0.0\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/version","summary":"","payload_hex":"474554202f76657273696f6e20485454502f312e310d0a486f73743a20<HONEYPOT>3a323337360d0a557365722d4167656e743a20446f636b65722d436c69656e742f32342e302e300d0a4163636570743a206170706c69636174696f6e2f6a736f6e0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Docker-Client/24.0.0","ja3":"ad8e2ddea9ec0a77edc063c36fc6cecc","session":"00060221-d2b7-4a7e-b419-f8583f97f47b","seq":1,"duration_ms":100,"bytes_in":130,"bytes_out":79},{"timestamp":"2026-09-27T02:05:59","port":2375,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"application/json\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:2375\",\"user-agent\":\"Docker-Client/24.0.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/version","summary":"","payload_hex":"474554202f76657273696f6e20485454502f312e310d0a486f73743a20<HONEYPOT>3a323337350d0a557365722d4167656e743a20446f636b65722d436c69656e742f32342e302e300d0a4163636570743a206170706c69636174696f6e2f6a736f6e0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Docker-Client/24.0.0","ja3":"","session":"ede4d04c-a3a0-4eb4-b670-720f9194b7aa","seq":1,"duration_ms":100,"bytes_in":129,"bytes_out":79},{"timestamp":"2026-09-27T02:02:02","port":2375,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"application/json\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:2375\",\"user-agent\":\"Docker-Client/24.0.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/version","summary":"","payload_hex":"474554202f76657273696f6e20485454502f312e310d0a486f73743a20<HONEYPOT>3a323337350d0a557365722d4167656e743a20446f636b65722d436c69656e742f32342e302e300d0a4163636570743a206170706c69636174696f6e2f6a736f6e0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Docker-Client/24.0.0","ja3":"","session":"c44d55ee-f8e5-48af-ae94-715384afa1ce","seq":1,"duration_ms":100,"bytes_in":130,"bytes_out":79},{"timestamp":"2026-09-27T00:53:17","port":2375,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"application/json\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:2375\",\"user-agent\":\"Docker-Client/24.0.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/version","summary":"","payload_hex":"474554202f76657273696f6e20485454502f312e310d0a486f73743a20<HONEYPOT>3a323337350d0a557365722d4167656e743a20446f636b65722d436c69656e742f32342e302e300d0a4163636570743a206170706c69636174696f6e2f6a736f6e0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Docker-Client/24.0.0","ja3":"","session":"d07ba83a-6e35-4a55-8d8f-d0b596eaff9e","seq":1,"duration_ms":100,"bytes_in":131,"bytes_out":79},{"timestamp":"2026-09-27T00:51:28","port":2375,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"application/json\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:2375\",\"user-agent\":\"Docker-Client/24.0.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/version","summary":"","payload_hex":"474554202f76657273696f6e20485454502f312e310d0a486f73743a20<HONEYPOT>3a323337350d0a557365722d4167656e743a20446f636b65722d436c69656e742f32342e302e300d0a4163636570743a206170706c69636174696f6e2f6a736f6e0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Docker-Client/24.0.0","ja3":"","session":"669ce31a-dc34-49bc-ab8b-9086367e5a7a","seq":1,"duration_ms":100,"bytes_in":131,"bytes_out":79},{"timestamp":"2026-09-27T00:50:33","port":2375,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"application/json\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:2375\",\"user-agent\":\"Docker-Client/24.0.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/version","summary":"","payload_hex":"474554202f76657273696f6e20485454502f312e310d0a486f73743a20<HONEYPOT>3a323337350d0a557365722d4167656e743a20446f636b65722d436c69656e742f32342e302e300d0a4163636570743a206170706c69636174696f6e2f6a736f6e0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Docker-Client/24.0.0","ja3":"","session":"e706dfd3-81af-48ac-9d21-017e61d7a32c","seq":1,"duration_ms":100,"bytes_in":131,"bytes_out":79},{"timestamp":"2026-09-27T00:50:06","port":2375,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"application/json\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:2375\",\"user-agent\":\"Docker-Client/24.0.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/version","summary":"","payload_hex":"474554202f76657273696f6e20485454502f312e310d0a486f73743a20<HONEYPOT>3a323337350d0a557365722d4167656e743a20446f636b65722d436c69656e742f32342e302e300d0a4163636570743a206170706c69636174696f6e2f6a736f6e0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Docker-Client/24.0.0","ja3":"","session":"aaf135f7-feca-477c-a6de-4e655df3b5cc","seq":1,"duration_ms":100,"bytes_in":131,"bytes_out":79},{"timestamp":"2026-09-27T00:49:52","port":2375,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"application/json\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:2375\",\"user-agent\":\"Docker-Client/24.0.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/version","summary":"","payload_hex":"474554202f76657273696f6e20485454502f312e310d0a486f73743a20<HONEYPOT>3a323337350d0a557365722d4167656e743a20446f636b65722d436c69656e742f32342e302e300d0a4163636570743a206170706c69636174696f6e2f6a736f6e0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Docker-Client/24.0.0","ja3":"","session":"575ddc27-31b9-4972-86a9-5a6c83d1a8db","seq":1,"duration_ms":100,"bytes_in":131,"bytes_out":79},{"timestamp":"2026-09-27T00:49:44","port":2375,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"application/json\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:2375\",\"user-agent\":\"Docker-Client/24.0.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/version","summary":"","payload_hex":"474554202f76657273696f6e20485454502f312e310d0a486f73743a20<HONEYPOT>3a323337350d0a557365722d4167656e743a20446f636b65722d436c69656e742f32342e302e300d0a4163636570743a206170706c69636174696f6e2f6a736f6e0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Docker-Client/24.0.0","ja3":"","session":"3cfe19c1-7646-4dfd-b80e-7eacfbd39e55","seq":1,"duration_ms":100,"bytes_in":131,"bytes_out":79}],"http_methods":[{"method":"GET","count":20}],"distinct_ports_total":10,"top_paths":[{"path":"/version","count":11,"ports":2},{"path":"/","count":9,"ports":8}],"distinct_paths_total":2,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","Connection","Host","User-Agent"],"representative":[{"name":"Accept","value":"application/json","notable":false},{"name":"Connection","value":"close","notable":false},{"name":"Host","value":"<HONEYPOT>:2376","notable":false},{"name":"User-Agent","value":"Docker-Client/24.0.0","notable":false}],"distinct_sets":1,"events_with_headers":10},"tags":[],"data_as_of":"2026-09-30T12:05:40.331493+00:00"}