{"ip":"138.226.239.91","total_events":210,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"124+ ports swept","confidence":"medium","network_type":null,"why":["No exploit payloads observed.","Swept 124 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"20,922 bytes sent","bytes_sent":20922,"session_seconds":0,"persistent":false}},"first_seen":"2026-07-21T13:55:38","last_seen":"2026-08-18T12:16:52","events_24h":0,"events_7d":0,"geo":{"country_code":"GB","country_name":"United Kingdom","region":"","city":"","lat":51.4964,"lon":-0.1224,"asn":213474,"org":"HomeLine Broadband LLC"},"source_domain":null,"known_scanners":[],"scanner_tag":null,"cve_matches":[],"malware":[],"top_ports":[{"port":44352,"proto":"tcp","label":"","count":4},{"port":44392,"proto":"tcp","label":"","count":3},{"port":44366,"proto":"tcp","label":"","count":3},{"port":24443,"proto":"tcp","label":"","count":3},{"port":44379,"proto":"tcp","label":"","count":3},{"port":44363,"proto":"tcp","label":"","count":3},{"port":44327,"proto":"tcp","label":"","count":3},{"port":44338,"proto":"tcp","label":"","count":3},{"port":44320,"proto":"tcp","label":"","count":3},{"port":44317,"proto":"tcp","label":"","count":3},{"port":44314,"proto":"tcp","label":"","count":3},{"port":44384,"proto":"tcp","label":"","count":3},{"port":44396,"proto":"tcp","label":"","count":3},{"port":44354,"proto":"tcp","label":"","count":3},{"port":44349,"proto":"tcp","label":"","count":3}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i130900_f57a46bbacb6_e7c285222651"],"tls_ja3":["6639916abfac56b9257ca216677085bc"],"ja4h":["ge11nn0300_0db47b7d240d"]},"fingerprint_peers":{"t13i130900_f57a46bbacb6_e7c285222651":4706,"ge11nn0300_0db47b7d240d":5177},"user_agents":["Go-http-client/1.1"],"timeline":[{"date":"2026-07-21","count":29},{"date":"2026-08-17","count":130},{"date":"2026-08-18","count":51}],"recent_events":[{"timestamp":"2026-08-18T12:16:52","port":80,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:80\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a38300d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"6639916abfac56b9257ca216677085bc","session":"499d837e-b024-4ead-b382-76311a5e8ca2","seq":1,"duration_ms":101,"bytes_in":96,"bytes_out":79},{"timestamp":"2026-08-18T12:12:03","port":444,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:444\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a3434340d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"6639916abfac56b9257ca216677085bc","session":"7f06cbac-a2a0-4c17-b04f-1270f8cd13a8","seq":1,"duration_ms":100,"bytes_in":98,"bytes_out":79},{"timestamp":"2026-08-18T12:08:02","port":4433,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:4433\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a343433330d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"6639916abfac56b9257ca216677085bc","session":"1a74a63b-5ad6-4f13-81bd-522dc89c079c","seq":1,"duration_ms":100,"bytes_in":100,"bytes_out":79},{"timestamp":"2026-08-18T11:56:36","port":80,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:80\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a38300d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"6639916abfac56b9257ca216677085bc","session":"b02e0a95-3a11-436f-92bc-7f1f96c23b32","seq":1,"duration_ms":101,"bytes_in":96,"bytes_out":79},{"timestamp":"2026-08-18T11:45:17","port":4433,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:4433\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a343433330d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"6639916abfac56b9257ca216677085bc","session":"0c544b18-157e-43f1-9ddf-d01169a244cb","seq":1,"duration_ms":100,"bytes_in":99,"bytes_out":79},{"timestamp":"2026-08-18T08:25:42","port":8086,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:8086\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a383038360d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"6639916abfac56b9257ca216677085bc","session":"5f8221de-4fdd-4d7a-a4db-721fbaa9aeb8","seq":1,"duration_ms":100,"bytes_in":98,"bytes_out":79},{"timestamp":"2026-08-18T08:24:09","port":17443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:17443\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a31373434330d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"6639916abfac56b9257ca216677085bc","session":"807e3806-1952-44f2-b981-b6fc35f71556","seq":1,"duration_ms":100,"bytes_in":100,"bytes_out":79},{"timestamp":"2026-08-18T08:11:23","port":8443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:8443\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a383434330d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"6639916abfac56b9257ca216677085bc","session":"4012e823-9c25-4f85-9a8c-f0e31eaf51de","seq":1,"duration_ms":100,"bytes_in":98,"bytes_out":79},{"timestamp":"2026-08-18T07:53:36","port":24443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:24443\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a32343434330d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"6639916abfac56b9257ca216677085bc","session":"171a4ef5-94cd-455f-a937-861c8ce0114e","seq":1,"duration_ms":100,"bytes_in":101,"bytes_out":79},{"timestamp":"2026-08-18T03:41:21","port":51823,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:51823\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a35313832330d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"6639916abfac56b9257ca216677085bc","session":"86b8e62b-8dc9-431e-8da9-678e45e95018","seq":1,"duration_ms":100,"bytes_in":100,"bytes_out":79}],"http_methods":[{"method":"GET","count":210}],"distinct_ports_total":124,"top_paths":[{"path":"/","count":210,"ports":124}],"distinct_paths_total":1,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept-Encoding","Host","User-Agent"],"representative":[{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Host","value":"<HONEYPOT>:80","notable":false},{"name":"User-Agent","value":"Go-http-client/1.1","notable":false}],"distinct_sets":1,"events_with_headers":10},"tags":[],"data_as_of":"2026-09-10T21:23:13.791032+00:00"}