{"ip":"138.226.239.90","total_events":200,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"112+ ports swept","confidence":"medium","network_type":null,"why":["No exploit payloads observed.","Swept 112 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"19,950 bytes sent","bytes_sent":19950,"session_seconds":0,"persistent":false}},"first_seen":"2026-07-21T13:59:43","last_seen":"2026-08-18T12:19:06","events_24h":0,"events_7d":0,"geo":{"country_code":"GB","country_name":"United Kingdom","region":"","city":"","lat":51.4964,"lon":-0.1224,"asn":213474,"org":"HomeLine Broadband LLC"},"source_domain":null,"known_scanners":[],"scanner_tag":null,"cve_matches":[],"malware":[],"top_ports":[{"port":44347,"proto":"tcp","label":"","count":6},{"port":44326,"proto":"tcp","label":"","count":4},{"port":44353,"proto":"tcp","label":"","count":4},{"port":44398,"proto":"tcp","label":"","count":4},{"port":44388,"proto":"tcp","label":"","count":3},{"port":44331,"proto":"tcp","label":"","count":3},{"port":44369,"proto":"tcp","label":"","count":3},{"port":44356,"proto":"tcp","label":"","count":3},{"port":44397,"proto":"tcp","label":"","count":3},{"port":44345,"proto":"tcp","label":"","count":3},{"port":44313,"proto":"tcp","label":"","count":3},{"port":44339,"proto":"tcp","label":"","count":3},{"port":10443,"proto":"tcp","label":"","count":3},{"port":44377,"proto":"tcp","label":"","count":3},{"port":44306,"proto":"tcp","label":"","count":3}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i130900_f57a46bbacb6_e7c285222651"],"tls_ja3":["6639916abfac56b9257ca216677085bc"],"ja4h":["ge11nn0300_0db47b7d240d"]},"fingerprint_peers":{"t13i130900_f57a46bbacb6_e7c285222651":4706,"ge11nn0300_0db47b7d240d":5177},"user_agents":["Go-http-client/1.1"],"timeline":[{"date":"2026-07-21","count":19},{"date":"2026-08-17","count":125},{"date":"2026-08-18","count":56}],"recent_events":[{"timestamp":"2026-08-18T12:19:06","port":80,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:80\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a38300d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"6639916abfac56b9257ca216677085bc","session":"ae6f871a-2a13-4cb7-958d-a9f3ecbd7260","seq":1,"duration_ms":101,"bytes_in":98,"bytes_out":79},{"timestamp":"2026-08-18T12:09:45","port":80,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:80\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a38300d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"6639916abfac56b9257ca216677085bc","session":"cbbf7301-39b4-4e6c-846e-9d58026ec79b","seq":1,"duration_ms":100,"bytes_in":97,"bytes_out":79},{"timestamp":"2026-08-18T08:41:09","port":2443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:2443\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a323434330d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"6639916abfac56b9257ca216677085bc","session":"143bc3a0-cc92-483d-ba2a-9cc3cfa5bac9","seq":1,"duration_ms":100,"bytes_in":100,"bytes_out":79},{"timestamp":"2026-08-18T08:36:17","port":20443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:20443\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a32303434330d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"6639916abfac56b9257ca216677085bc","session":"91d0c328-d92d-4a1b-bc1c-7aa9afd84093","seq":1,"duration_ms":100,"bytes_in":99,"bytes_out":79},{"timestamp":"2026-08-18T08:35:35","port":10443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:10443\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a31303434330d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"6639916abfac56b9257ca216677085bc","session":"698f46b2-67a1-4fc7-8ace-682f19dfe429","seq":1,"duration_ms":100,"bytes_in":99,"bytes_out":79},{"timestamp":"2026-08-18T08:27:03","port":34443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:34443\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a33343434330d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"6639916abfac56b9257ca216677085bc","session":"be687fc9-14b0-4383-8de4-cffcbd921720","seq":1,"duration_ms":100,"bytes_in":101,"bytes_out":79},{"timestamp":"2026-08-18T08:24:16","port":32443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:32443\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a33323434330d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"6639916abfac56b9257ca216677085bc","session":"1c3d5658-0283-4aff-8f11-966f4856c317","seq":1,"duration_ms":100,"bytes_in":99,"bytes_out":79},{"timestamp":"2026-08-18T08:06:17","port":15443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:15443\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a31353434330d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"6639916abfac56b9257ca216677085bc","session":"067d54d3-1286-4d94-83e5-7db6d7848c39","seq":1,"duration_ms":100,"bytes_in":100,"bytes_out":79},{"timestamp":"2026-08-18T08:02:18","port":6443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:6443\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a363434330d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"6639916abfac56b9257ca216677085bc","session":"9d3a8dda-e568-4c9b-805b-5a8402d1ce35","seq":1,"duration_ms":100,"bytes_in":99,"bytes_out":79},{"timestamp":"2026-08-18T08:00:15","port":9090,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:9090\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a393039300d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"6639916abfac56b9257ca216677085bc","session":"149d771f-a76d-40cb-91ae-1275b6580bd5","seq":1,"duration_ms":100,"bytes_in":99,"bytes_out":79}],"http_methods":[{"method":"GET","count":200}],"distinct_ports_total":112,"top_paths":[{"path":"/","count":200,"ports":112}],"distinct_paths_total":1,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept-Encoding","Host","User-Agent"],"representative":[{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Host","value":"<HONEYPOT>:80","notable":false},{"name":"User-Agent","value":"Go-http-client/1.1","notable":false}],"distinct_sets":1,"events_with_headers":10},"tags":[],"data_as_of":"2026-09-10T21:23:13.790171+00:00"}