{"ip":"144.202.92.17","total_events":411,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"10+ ports swept","confidence":"medium","network_type":"nsp","why":["No exploit payloads observed.","Swept 10 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"80,068 bytes sent","bytes_sent":80068,"session_seconds":1,"persistent":false}},"first_seen":"2026-06-06T02:58:18","last_seen":"2026-08-14T04:49:37","events_24h":9,"events_7d":69,"geo":{"country_code":"US","country_name":"United States","region":"Washington","city":"Kent","lat":47.3798,"lon":-122.2893,"asn":20473,"org":"The Constant Company, LLC"},"source_domain":"144.202.92.17.vultrusercontent.com","known_scanners":[],"scanner_tag":{"key":"vultr","label":"Vultr","category":"hosting_provider","url":"https://www.vultr.com/"},"cve_matches":[],"malware":[],"top_ports":[{"port":443,"proto":"tcp","label":"HTTPS","count":59},{"port":4153,"proto":"tcp","label":"","count":58},{"port":80,"proto":"tcp","label":"HTTP","count":56},{"port":8080,"proto":"tcp","label":"HTTP-alt","count":49},{"port":22,"proto":"tcp","label":"SSH","count":41},{"port":1080,"proto":"tcp","label":"SOCKS","count":40},{"port":3389,"proto":"tcp","label":"RDP","count":39},{"port":1337,"proto":"tcp","label":"","count":29},{"port":3000,"proto":"tcp","label":"Web-alt","count":23},{"port":2000,"proto":"tcp","label":"","count":17}],"fingerprints":{"ssh_hassh":["e54ef3ec27fe1fea7ab64d3fa05359fd"],"tls_ja4":["t13i1909h2_9dc949149365_97f8aa674fd9"],"tls_ja3":["7c1e207beb00684bbbe144f1b0abe1d5"],"ja4h":["ge11nn0400_88d30a62b7ad"]},"fingerprint_peers":{"t13i1909h2_9dc949149365_97f8aa674fd9":562,"ge11nn0400_88d30a62b7ad":4815,"e54ef3ec27fe1fea7ab64d3fa05359fd":194},"user_agents":["Mozilla/5.0 (compatible; CyberConvoyScout/1.0; +https://scout.cyberconvoy.co)"],"timeline":[{"date":"2026-06-06","count":10},{"date":"2026-06-09","count":2},{"date":"2026-06-10","count":9},{"date":"2026-06-11","count":3},{"date":"2026-06-17","count":1},{"date":"2026-06-18","count":7},{"date":"2026-06-19","count":4},{"date":"2026-06-20","count":4},{"date":"2026-06-23","count":1},{"date":"2026-06-24","count":6},{"date":"2026-06-25","count":10},{"date":"2026-06-26","count":5},{"date":"2026-06-27","count":4},{"date":"2026-06-28","count":2},{"date":"2026-06-29","count":6},{"date":"2026-06-30","count":4},{"date":"2026-07-01","count":3},{"date":"2026-07-03","count":5},{"date":"2026-07-04","count":8},{"date":"2026-07-08","count":5},{"date":"2026-07-10","count":6},{"date":"2026-07-11","count":13},{"date":"2026-07-12","count":7},{"date":"2026-07-13","count":1},{"date":"2026-07-14","count":9},{"date":"2026-07-15","count":7},{"date":"2026-07-16","count":4},{"date":"2026-07-17","count":11},{"date":"2026-07-18","count":12},{"date":"2026-07-19","count":8},{"date":"2026-07-20","count":11},{"date":"2026-07-21","count":6},{"date":"2026-07-22","count":8},{"date":"2026-07-23","count":11},{"date":"2026-07-24","count":7},{"date":"2026-07-25","count":15},{"date":"2026-07-26","count":8},{"date":"2026-07-27","count":10},{"date":"2026-07-28","count":15},{"date":"2026-07-29","count":8},{"date":"2026-07-31","count":9},{"date":"2026-08-01","count":12},{"date":"2026-08-02","count":7},{"date":"2026-08-03","count":7},{"date":"2026-08-04","count":9},{"date":"2026-08-05","count":11},{"date":"2026-08-06","count":7},{"date":"2026-08-07","count":4},{"date":"2026-08-08","count":12},{"date":"2026-08-09","count":10},{"date":"2026-08-10","count":8},{"date":"2026-08-11","count":8},{"date":"2026-08-12","count":11},{"date":"2026-08-13","count":12},{"date":"2026-08-14","count":8}],"recent_events":[{"timestamp":"2026-08-14T04:49:37","port":3000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:3000\",\"user-agent\":\"Mozilla/5.0 (compatible; CyberConvoyScout/1.0; +https://scout.cyberconvoy.co)\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a333030300d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b204379626572436f6e766f7953636f75742f312e303b202b68747470733a2f2f73636f75742e6379626572636f6e766f792e636f290d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; CyberConvoyScout/1.0; +https://scout.cyberconvoy.co)","ja3":"","session":"6d809c88-8436-4414-a703-0b8a31ca9bec","seq":1,"duration_ms":101,"bytes_in":170,"bytes_out":78},{"timestamp":"2026-08-14T04:29:15","port":2000,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\n","payload_hex":"0a","method":"","user_agent":"","ja3":"","session":"9c6d2d2d-5b9b-4964-ab37-f25ffc3a1a1e","seq":1,"duration_ms":9,"bytes_in":1,"bytes_out":13},{"timestamp":"2026-08-14T04:06:49","port":8080,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:8080\",\"user-agent\":\"Mozilla/5.0 (compatible; CyberConvoyScout/1.0; +https://scout.cyberconvoy.co)\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a383038300d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b204379626572436f6e766f7953636f75742f312e303b202b68747470733a2f2f73636f75742e6379626572636f6e766f792e636f290d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; CyberConvoyScout/1.0; +https://scout.cyberconvoy.co)","ja3":"","session":"fd776bb8-6e6f-4bef-9bb3-10bc99e196c4","seq":1,"duration_ms":100,"bytes_in":170,"bytes_out":78},{"timestamp":"2026-08-14T03:45:09","port":1337,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\n","payload_hex":"0a","method":"","user_agent":"","ja3":"","session":"54ab9e6a-d7ea-4067-b0ef-56f0dddaa67b","seq":1,"duration_ms":9,"bytes_in":1,"bytes_out":13},{"timestamp":"2026-08-14T03:27:20","port":4153,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\n","payload_hex":"0a","method":"","user_agent":"","ja3":"","session":"3b39f914-ddb8-4048-806b-2205ffc34153","seq":1,"duration_ms":9,"bytes_in":1,"bytes_out":13},{"timestamp":"2026-08-14T03:09:14","port":1080,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\n","payload_hex":"0a","method":"","user_agent":"","ja3":"","session":"e73c1fcb-5878-48a1-b00a-88678639e1fd","seq":1,"duration_ms":9,"bytes_in":1,"bytes_out":13},{"timestamp":"2026-08-14T01:47:34","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (compatible; CyberConvoyScout/1.0; +https://scout.cyberconvoy.co)\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b204379626572436f6e766f7953636f75742f312e303b202b68747470733a2f2f73636f75742e6379626572636f6e766f792e636f290d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; CyberConvoyScout/1.0; +https://scout.cyberconvoy.co)","ja3":"7c1e207beb00684bbbe144f1b0abe1d5","session":"0e76fdd7-e703-43a0-9000-0a101b071da5","seq":1,"duration_ms":149,"bytes_in":165,"bytes_out":78},{"timestamp":"2026-08-14T00:17:00","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (compatible; CyberConvoyScout/1.0; +https://scout.cyberconvoy.co)\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b204379626572436f6e766f7953636f75742f312e303b202b68747470733a2f2f73636f75742e6379626572636f6e766f792e636f290d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; CyberConvoyScout/1.0; +https://scout.cyberconvoy.co)","ja3":"","session":"1ae13652-6733-46fa-bbae-eacb62da6e64","seq":1,"duration_ms":100,"bytes_in":165,"bytes_out":78},{"timestamp":"2026-08-13T23:28:37","port":22,"proto":"tcp","app_proto":"","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"SSH-2.0-Go\r\n\u0000\u0000\u0004�\u0006\u0014N�\u0016�����( �3�[Uv\u0000\u0000\u0001\u0004curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group1-sha1,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1\u0000\u0000\u0001�ssh-ed25519,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss,ssh-ed25519-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,rsa-sha2-256-cert-v01@openssh.com,rsa-sha2-512-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com\u0000\u0000\u0000�chacha20-poly1305@openssh.com,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,arcfour256,arcfour128,arcfour,3des-cbc\u0000\u0000\u0000�chacha20-poly1305@openssh.com,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,arcfour256,arcfour128,arcfour,3des-cbc\u0000\u0000\u0000Bhmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96\u0000\u0000\u0000Bhmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96\u0000\u0000\u0000\u0004none\u0000\u0000\u0000\u0004none\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000��\u0016y��","payload_hex":"5353482d322e302d476f0d0a0000049c06144ebd16b8dad6c0d828208a33955b557600000104637572766532353531392d7368613235362c637572766532353531392d736861323536406c69627373682e6f72672c656364682d736861322d6e697374703235362c656364682d736861322d6e697374703338342c656364682d736861322d6e697374703532312c6469666669652d68656c6c6d616e2d67726f7570312d736861312c6469666669652d68656c6c6d616e2d67726f757031342d7368613235362c6469666669652d68656c6c6d616e2d67726f757031342d736861312c6469666669652d68656c6c6d616e2d67726f75702d65786368616e67652d7368613235362c6469666669652d68656c6c6d616e2d67726f75702d65786368616e67652d736861310000018b7373682d656432353531392c65636473612d736861322d6e697374703235362c65636473612d736861322d6e697374703338342c65636473612d736861322d6e697374703532312c7273612d736861322d3235362c7273612d736861322d3531322c7373682d7273612c7373682d6473732c7373682d656432353531392d636572742d763031406f70656e7373682e636f6d2c65636473612d736861322d6e697374703235362d636572742d763031406f70656e7373682e636f6d2c65636473612d736861322d6e697374703338342d636572742d763031406f70656e7373682e636f6d2c65636473612d736861322d6e697374703532312d636572742d763031406f70656e7373682e636f6d2c7273612d736861322d3235362d636572742d763031406f70656e7373682e636f6d2c7273612d736861322d3531322d636572742d763031406f70656e7373682e636f6d2c7373682d7273612d636572742d763031406f70656e7373682e636f6d2c7373682d6473732d636572742d763031406f70656e7373682e636f6d0000009e63686163686132302d706f6c7931333035406f70656e7373682e636f6d2c6165733132382d67636d406f70656e7373682e636f6d2c6165733235362d67636d406f70656e7373682e636f6d2c6165733132382d6374722c6165733139322d6374722c6165733235362d6374722c6165733132382d6362632c617263666f75723235362c617263666f75723132382c617263666f75722c336465732d6362630000009e63686163686132302d706f6c7931333035406f70656e7373682e636f6d2c6165733132382d67636d406f70656e7373682e636f6d2c6165733235362d67636d406f70656e7373682e636f6d2c6165733132382d6374722c6165733139322d6374722c6165733235362d6374722c6165733132382d6362632c617263666f75723235362c617263666f75723132382c617263666f75722c336465732d63626300000042686d61632d736861322d3235362d65746d406f70656e7373682e636f6d2c686d61632d736861322d3235362c686d61632d736861312c686d61632d736861312d393600000042686d61632d736861322d3235362d65746d406f70656e7373682e636f6d2c686d61632d736861322d3235362c686d61632d736861312c686d61632d736861312d3936000000046e6f6e65000000046e6f6e6500000000000000000000000000a69416798ed8","method":"","user_agent":"","ja3":"","session":"c66d073b-412a-44d5-be7a-ee2fef7905cd","seq":1,"duration_ms":143,"bytes_in":1196,"bytes_out":13,"enriched":{"digest":"13fbbfdd27dcbfe9","label":"SSH","strings":["SSH-2.0-Go","curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nist…","ssh-ed25519,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,rsa-sha2…","chacha20-poly1305@openssh.com,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes1…","Bhmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96","none"],"iocs":{"domains":["libssh.org","openssh.com"]}}},{"timestamp":"2026-08-13T05:58:15","port":3000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:3000\",\"user-agent\":\"Mozilla/5.0 (compatible; CyberConvoyScout/1.0; +https://scout.cyberconvoy.co)\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a333030300d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b204379626572436f6e766f7953636f75742f312e303b202b68747470733a2f2f73636f75742e6379626572636f6e766f792e636f290d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; CyberConvoyScout/1.0; +https://scout.cyberconvoy.co)","ja3":"","session":"938348ef-acb6-44c3-a9b8-64b64e9e2a84","seq":1,"duration_ms":100,"bytes_in":171,"bytes_out":78}],"http_methods":[{"method":"GET","count":187}],"distinct_ports_total":10,"top_paths":[{"path":"/","count":187,"ports":4}],"distinct_paths_total":1,"top_snis":[],"top_hosts":[],"top_alpns":[{"value":"h2, http/1.1","count":59}],"banners":[{"value":"SSH-2.0-Go","count":41}],"credentials":[],"header_profile":{"signature":["Accept","Accept-Encoding","Host","User-Agent"],"representative":[{"name":"Accept","value":"*/*","notable":false},{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Host","value":"<HONEYPOT>:3000","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (compatible; CyberConvoyScout/1.0; +https://scout.cyberconvoy.co)","notable":false}],"distinct_sets":1,"events_with_headers":5},"tags":[],"data_as_of":"2026-08-14T16:13:46.168421+00:00"}