{"ip":"139.28.240.53","total_events":25,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"23+ ports swept","confidence":"medium","network_type":"CDN","why":["No exploit payloads observed.","Swept 23 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range."],"engagement":{"level":"request","label":"Request traffic","detail":"3,962 bytes sent","bytes_sent":3962,"session_seconds":0,"persistent":false}},"first_seen":"2026-08-16T10:55:26","last_seen":"2026-09-10T21:11:46","events_24h":2,"events_7d":6,"geo":{"country_code":"TR","country_name":"Türkiye","region":"","city":"","lat":41.0214,"lon":28.9948,"asn":215540,"org":"Global Connectivity Solutions Llp"},"source_domain":"289588.ip-ptr.tech","known_scanners":[],"scanner_tag":{"key":"peeringdb:as215540","label":"GLOBAL CONNECTIVITY SOLUTIONS LLP","category":"cdn","url":"https://www.peeringdb.com/asn/215540"},"cve_matches":[],"malware":[],"top_ports":[{"port":80,"proto":"tcp","label":"HTTP","count":3},{"port":8082,"proto":"tcp","label":"","count":1},{"port":8085,"proto":"tcp","label":"","count":1},{"port":27018,"proto":"tcp","label":"MongoDB","count":1},{"port":1443,"proto":"tcp","label":"","count":1},{"port":7001,"proto":"tcp","label":"WebLogic","count":1},{"port":8003,"proto":"tcp","label":"","count":1},{"port":8009,"proto":"tcp","label":"","count":1},{"port":444,"proto":"tcp","label":"","count":1},{"port":60443,"proto":"tcp","label":"","count":1},{"port":8014,"proto":"tcp","label":"","count":1},{"port":3002,"proto":"tcp","label":"","count":1},{"port":443,"proto":"tcp","label":"HTTPS","count":1},{"port":60000,"proto":"tcp","label":"","count":1},{"port":8089,"proto":"tcp","label":"Splunk","count":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i1310h1_f57a46bbacb6_e7c285222651"],"tls_ja3":["faa162b5a653756fba26803ea81b362f"],"ja4h":["ge11nn0400_9c3956fad5da"]},"fingerprint_peers":{"t13i1310h1_f57a46bbacb6_e7c285222651":72,"ge11nn0400_9c3956fad5da":1572},"user_agents":["Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0"],"timeline":[{"date":"2026-08-16","count":3},{"date":"2026-08-21","count":1},{"date":"2026-08-25","count":2},{"date":"2026-08-27","count":1},{"date":"2026-08-28","count":2},{"date":"2026-08-29","count":1},{"date":"2026-08-30","count":1},{"date":"2026-09-01","count":3},{"date":"2026-09-02","count":4},{"date":"2026-09-04","count":2},{"date":"2026-09-07","count":2},{"date":"2026-09-08","count":1},{"date":"2026-09-10","count":2}],"recent_events":[{"timestamp":"2026-09-10T21:11:46","port":9100,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:9100\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a393130300d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f36343b2072763a3134302e3029204765636b6f2f32303130303130312046697265666f782f3134302e300d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0","ja3":"faa162b5a653756fba26803ea81b362f","session":"45320108-f1bc-4359-8bda-0fb8467afced","seq":1,"duration_ms":100,"bytes_in":170,"bytes_out":78},{"timestamp":"2026-09-10T16:03:55","port":3000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:3000\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a333030300d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f36343b2072763a3134302e3029204765636b6f2f32303130303130312046697265666f782f3134302e300d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0","ja3":"","session":"3f50a123-b4cf-45e9-9ef1-d2c0cfd332c6","seq":1,"duration_ms":100,"bytes_in":170,"bytes_out":78},{"timestamp":"2026-09-08T03:32:08","port":7001,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:7001\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a373030310d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f36343b2072763a3134302e3029204765636b6f2f32303130303130312046697265666f782f3134302e300d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0","ja3":"faa162b5a653756fba26803ea81b362f","session":"35ed30ec-a5b3-4f33-a401-d6a3d2b4dc93","seq":1,"duration_ms":101,"bytes_in":170,"bytes_out":78},{"timestamp":"2026-09-07T20:14:11","port":10050,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\n","payload_hex":"0a","method":"","user_agent":"","ja3":"","session":"a47ae182-f75d-4834-b6d0-b690e2c2b3c3","seq":1,"duration_ms":100,"bytes_in":1,"bytes_out":13},{"timestamp":"2026-09-07T17:57:32","port":27018,"proto":"tcp","app_proto":"","app_protocol":"mongodb","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":":\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000�\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0013\u0000\u0000\u0000\u0010isMaster\u0000\u0001\u0000\u0000\u0000\u0000","payload_hex":"3a0000000000000000000000d40700000000000061646d696e2e24636d64000000000001000000130000001069734d6173746572000100000000","method":"","user_agent":"","ja3":"","session":"17ee77c9-f360-409b-9fce-d22cb751a5f7","seq":1,"duration_ms":100,"bytes_in":58,"bytes_out":13,"enriched":{"digest":"71265954b8b925aa","strings":["admin.$cmd","isMaster"]}},{"timestamp":"2026-09-04T13:47:15","port":3002,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:3002\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a333030320d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f36343b2072763a3134302e3029204765636b6f2f32303130303130312046697265666f782f3134302e300d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0","ja3":"","session":"4292457d-7775-4fcc-aca9-10bc35e0df00","seq":1,"duration_ms":100,"bytes_in":170,"bytes_out":78},{"timestamp":"2026-09-04T09:21:03","port":8003,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8003\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a383030330d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f36343b2072763a3134302e3029204765636b6f2f32303130303130312046697265666f782f3134302e300d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0","ja3":"","session":"e9efb838-0948-4c16-92f3-857e2710a088","seq":1,"duration_ms":100,"bytes_in":171,"bytes_out":78},{"timestamp":"2026-09-02T22:05:33","port":8009,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8009\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a383030390d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f36343b2072763a3134302e3029204765636b6f2f32303130303130312046697265666f782f3134302e300d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0","ja3":"","session":"0a0281ad-b7ba-4e01-8ebe-8aaf27eb48d0","seq":1,"duration_ms":100,"bytes_in":171,"bytes_out":78},{"timestamp":"2026-09-02T20:22:21","port":8082,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8082\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a383038320d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f36343b2072763a3134302e3029204765636b6f2f32303130303130312046697265666f782f3134302e300d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0","ja3":"","session":"c48dd6bc-6e78-4c3e-9012-0a353bcff3cb","seq":1,"duration_ms":100,"bytes_in":170,"bytes_out":78},{"timestamp":"2026-09-02T18:10:38","port":8085,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8085\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a383038350d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f36343b2072763a3134302e3029204765636b6f2f32303130303130312046697265666f782f3134302e300d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0","ja3":"","session":"95fe488e-4c1f-4a30-a83b-cc5ca3bb283e","seq":1,"duration_ms":100,"bytes_in":171,"bytes_out":78}],"http_methods":[{"method":"GET","count":23}],"distinct_ports_total":23,"top_paths":[{"path":"/","count":23,"ports":21}],"distinct_paths_total":1,"top_snis":[],"top_hosts":[],"top_alpns":[{"value":"http/1.1","count":11}],"banners":[],"credentials":[],"header_profile":{"signature":["Accept-Encoding","Connection","Host","User-Agent"],"representative":[{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Connection","value":"close","notable":false},{"name":"Host","value":"<HONEYPOT>:9100","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0","notable":false}],"distinct_sets":1,"events_with_headers":8},"tags":[],"data_as_of":"2026-09-11T09:52:36.816712+00:00"}