{"ip":"14.225.19.60","total_events":29,"verdict":{"verdict":"probing","label":"Low-level probing","detail":null,"confidence":"low","network_type":null,"why":["29 event(s), fewer than 10 distinct ports, no exploit payloads.","Not in any known-scanner range.","Sent 5,406 bytes despite few ports and no known exploit path: focused interaction with one service, worth a look."],"engagement":{"level":"payload","label":"Sustained payload","detail":"5,406 bytes sent","bytes_sent":5406,"session_seconds":0,"persistent":false}},"first_seen":"2026-08-13T22:41:28","last_seen":"2026-08-14T21:13:37","events_24h":13,"events_7d":29,"geo":{"country_code":"VN","country_name":"Vietnam","region":"Can Tho","city":"Can Tho","lat":10.0361,"lon":105.7941,"asn":135905,"org":"VIETNAM POSTS AND TELECOMMUNICATIONS GROUP"},"source_domain":"static.vnpt.vn","known_scanners":[],"scanner_tag":null,"cve_matches":[],"malware":[],"top_ports":[{"port":80,"proto":"tcp","label":"HTTP","count":23},{"port":20128,"proto":"tcp","label":"","count":6}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i131000_f57a46bbacb6_ab7e3b40a677"],"tls_ja3":["725543c78edf669194c11dc7a039b56e"],"ja4h":["ge11nn0500_d3a2dcb1cd63"]},"fingerprint_peers":{"t13i131000_f57a46bbacb6_ab7e3b40a677":5328,"ge11nn0500_d3a2dcb1cd63":1279},"user_agents":["Mozilla/5.0 (compatible; filter9router/1.0)"],"timeline":[{"date":"2026-08-13","count":2},{"date":"2026-08-14","count":27}],"recent_events":[{"timestamp":"2026-08-14T21:13:37","port":80,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"text/html,application/xhtml+xml,*/*\",\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:80\",\"user-agent\":\"Mozilla/5.0 (compatible; filter9router/1.0)\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a38300d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b2066696c74657239726f757465722f312e30290d0a4163636570743a20746578742f68746d6c2c6170706c69636174696f6e2f7868746d6c2b786d6c2c2a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; filter9router/1.0)","ja3":"725543c78edf669194c11dc7a039b56e","session":"12a5d857-48eb-4d28-966b-d8dfabd8b4fc","seq":1,"duration_ms":100,"bytes_in":186,"bytes_out":77},{"timestamp":"2026-08-14T21:10:28","port":80,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"text/html,application/xhtml+xml,*/*\",\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:80\",\"user-agent\":\"Mozilla/5.0 (compatible; filter9router/1.0)\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a38300d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b2066696c74657239726f757465722f312e30290d0a4163636570743a20746578742f68746d6c2c6170706c69636174696f6e2f7868746d6c2b786d6c2c2a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; filter9router/1.0)","ja3":"725543c78edf669194c11dc7a039b56e","session":"16aeeb39-47fa-4d91-bb4d-fe0796a0ce90","seq":1,"duration_ms":100,"bytes_in":185,"bytes_out":77},{"timestamp":"2026-08-14T21:10:28","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"text/html,application/xhtml+xml,*/*\",\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:80\",\"user-agent\":\"Mozilla/5.0 (compatible; filter9router/1.0)\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a38300d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b2066696c74657239726f757465722f312e30290d0a4163636570743a20746578742f68746d6c2c6170706c69636174696f6e2f7868746d6c2b786d6c2c2a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; filter9router/1.0)","ja3":"","session":"d66c2341-57d7-4933-aebd-fc99d6a9d10b","seq":1,"duration_ms":101,"bytes_in":185,"bytes_out":77},{"timestamp":"2026-08-14T14:41:44","port":80,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"text/html,application/xhtml+xml,*/*\",\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:80\",\"user-agent\":\"Mozilla/5.0 (compatible; filter9router/1.0)\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a38300d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b2066696c74657239726f757465722f312e30290d0a4163636570743a20746578742f68746d6c2c6170706c69636174696f6e2f7868746d6c2b786d6c2c2a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; filter9router/1.0)","ja3":"725543c78edf669194c11dc7a039b56e","session":"c5a301d1-5af8-49a9-8bc3-5bc2ba1ece7a","seq":1,"duration_ms":100,"bytes_in":187,"bytes_out":77},{"timestamp":"2026-08-14T14:41:44","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"text/html,application/xhtml+xml,*/*\",\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:80\",\"user-agent\":\"Mozilla/5.0 (compatible; filter9router/1.0)\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a38300d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b2066696c74657239726f757465722f312e30290d0a4163636570743a20746578742f68746d6c2c6170706c69636174696f6e2f7868746d6c2b786d6c2c2a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; filter9router/1.0)","ja3":"","session":"21f06aa2-ca54-4dfa-9254-880eb57fe9c0","seq":1,"duration_ms":100,"bytes_in":187,"bytes_out":77},{"timestamp":"2026-08-14T13:27:47","port":20128,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"text/html,application/xhtml+xml,*/*\",\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:20128\",\"user-agent\":\"Mozilla/5.0 (compatible; filter9router/1.0)\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a32303132380d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b2066696c74657239726f757465722f312e30290d0a4163636570743a20746578742f68746d6c2c6170706c69636174696f6e2f7868746d6c2b786d6c2c2a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; filter9router/1.0)","ja3":"725543c78edf669194c11dc7a039b56e","session":"ff720c76-2030-4ae3-bc0e-d66352e582d7","seq":1,"duration_ms":100,"bytes_in":188,"bytes_out":77},{"timestamp":"2026-08-14T11:10:28","port":80,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"text/html,application/xhtml+xml,*/*\",\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:80\",\"user-agent\":\"Mozilla/5.0 (compatible; filter9router/1.0)\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a38300d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b2066696c74657239726f757465722f312e30290d0a4163636570743a20746578742f68746d6c2c6170706c69636174696f6e2f7868746d6c2b786d6c2c2a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; filter9router/1.0)","ja3":"725543c78edf669194c11dc7a039b56e","session":"e346c7cb-a2d1-4778-8ba8-8592ea2a940c","seq":1,"duration_ms":101,"bytes_in":185,"bytes_out":77},{"timestamp":"2026-08-14T11:10:28","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"text/html,application/xhtml+xml,*/*\",\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:80\",\"user-agent\":\"Mozilla/5.0 (compatible; filter9router/1.0)\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a38300d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b2066696c74657239726f757465722f312e30290d0a4163636570743a20746578742f68746d6c2c6170706c69636174696f6e2f7868746d6c2b786d6c2c2a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; filter9router/1.0)","ja3":"","session":"147ba179-a94d-4f06-af22-076da85511aa","seq":1,"duration_ms":100,"bytes_in":185,"bytes_out":77},{"timestamp":"2026-08-14T11:08:18","port":20128,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"text/html,application/xhtml+xml,*/*\",\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:20128\",\"user-agent\":\"Mozilla/5.0 (compatible; filter9router/1.0)\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a32303132380d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b2066696c74657239726f757465722f312e30290d0a4163636570743a20746578742f68746d6c2c6170706c69636174696f6e2f7868746d6c2b786d6c2c2a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; filter9router/1.0)","ja3":"","session":"c18b5f17-26db-42c6-9937-8af9beff594c","seq":1,"duration_ms":100,"bytes_in":188,"bytes_out":77},{"timestamp":"2026-08-14T09:52:35","port":20128,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"text/html,application/xhtml+xml,*/*\",\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:20128\",\"user-agent\":\"Mozilla/5.0 (compatible; filter9router/1.0)\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a32303132380d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b2066696c74657239726f757465722f312e30290d0a4163636570743a20746578742f68746d6c2c6170706c69636174696f6e2f7868746d6c2b786d6c2c2a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; filter9router/1.0)","ja3":"725543c78edf669194c11dc7a039b56e","session":"7f18ef49-1399-4713-92ab-95cf61487af4","seq":1,"duration_ms":101,"bytes_in":190,"bytes_out":77}],"http_methods":[{"method":"GET","count":29}],"distinct_ports_total":2,"top_paths":[{"path":"/","count":29,"ports":2}],"distinct_paths_total":1,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","Accept-Encoding","Connection","Host","User-Agent"],"representative":[{"name":"Accept","value":"text/html,application/xhtml+xml,*/*","notable":false},{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Connection","value":"close","notable":false},{"name":"Host","value":"<HONEYPOT>:80","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (compatible; filter9router/1.0)","notable":false}],"distinct_sets":1,"events_with_headers":10},"tags":[],"data_as_of":"2026-08-15T07:05:25.047831+00:00"}