{"ip":"147.90.171.26","total_events":6,"verdict":{"verdict":"probing","label":"Low-level probing","detail":null,"confidence":"low","network_type":"nsp","why":["6 event(s), fewer than 10 distinct ports, no exploit payloads.","Not in any known-scanner range."],"engagement":{"level":"request","label":"Request traffic","detail":"312 bytes sent","bytes_sent":312,"session_seconds":0,"persistent":false}},"first_seen":"2026-09-22T19:06:06","last_seen":"2026-09-23T02:58:21","events_24h":0,"events_7d":6,"geo":{"country_code":"MO","country_name":"Macao","region":"","city":"Macao","lat":22.201,"lon":113.5559,"asn":137409,"org":"GSL Networks Pty LTD"},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as137409","label":"Global Secure Layer","category":"isp","url":"https://www.peeringdb.com/asn/137409"},"cve_matches":[],"malware":[],"top_ports":[{"port":3000,"proto":"tcp","label":"Web-alt","count":4},{"port":3443,"proto":"tcp","label":"","count":2}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":["a11cun030_0000004a_c91eaf54"]},"fingerprint_peers":{"a11cun030_0000004a_c91eaf54":119},"akin_families":{"a11cun030_0000004a_c91eaf54":{"head":"a11cun030_0000004a_c91eaf54","shapes":2,"ips":118}},"user_agents":["WanScannerBot/1.0"],"timeline":[{"date":"2026-09-22","count":5},{"date":"2026-09-23","count":1}],"recent_events":[{"timestamp":"2026-09-23T02:58:21","port":3000,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0001\u0000\u0000\u0000\r\nAT+CLAC\r\n","payload_hex":"010000000d0a41542b434c41430d0a","method":"","user_agent":"","ja3":"","session":"47cbe8f0-1bdb-4fd2-93b2-a1c8d499be83","seq":1,"duration_ms":100,"bytes_in":15,"bytes_out":13,"enriched":{"digest":"027aa4ac1d00e707","strings":["AT+CLAC"]}},{"timestamp":"2026-09-22T20:40:12","port":3000,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0001\u0000\u0000\u0000\r\nAT+CLAC\r\n","payload_hex":"010000000d0a41542b434c41430d0a","method":"","user_agent":"","ja3":"","session":"de1b2c15-ec3c-49a5-8944-0fd170d2bf3d","seq":1,"duration_ms":100,"bytes_in":15,"bytes_out":13,"enriched":{"digest":"027aa4ac1d00e707","strings":["AT+CLAC"]}},{"timestamp":"2026-09-22T20:40:10","port":3000,"proto":"tcp","app_proto":"","app_protocol":"mssql-tds","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0012\u0001\u0000/\u0000\u0000\u0000\u0000\u0000\u0000\u001a\u0000\u0006\u0001\u0000 \u0000\u0001\u0002\u0000!\u0000\u0001\u0003\u0000\"\u0000\u0004\u0004\u0000&\u0000\u0001�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000","payload_hex":"1201002f0000000000001a00060100200001020021000103002200040400260001ff00000000000000000000000000","method":"","user_agent":"","ja3":"","session":"3fe44a8d-d154-476e-8a48-83b23b130360","seq":1,"duration_ms":100,"bytes_in":47,"bytes_out":13},{"timestamp":"2026-09-22T20:40:09","port":3000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"host\":\"<HONEYPOT>:3000\",\"user-agent\":\"WanScannerBot/1.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a333030300d0a557365722d4167656e743a2057616e5363616e6e6572426f742f312e300d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"WanScannerBot/1.0","ja3":"","session":"ca6172d1-bb04-4fbf-99d7-1ad1135b4f9e","seq":1,"duration_ms":100,"bytes_in":93,"bytes_out":78},{"timestamp":"2026-09-22T19:06:06","port":3443,"proto":"tcp","app_proto":"","app_protocol":"http","host":"185.228.81.201","headers":"{\"connection\":\"close\",\"host\":\"185.228.81.201:3443\",\"user-agent\":\"WanScannerBot/1.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a203138352e3232382e38312e3230313a333434330d0a557365722d4167656e743a2057616e5363616e6e6572426f742f312e300d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"WanScannerBot/1.0","ja3":"","session":"af1f76ea-abcc-4b59-93a7-bf3973c11589","seq":1,"duration_ms":100,"bytes_in":95,"bytes_out":78},{"timestamp":"2026-09-22T19:06:06","port":3443,"proto":"tcp","app_proto":"","app_protocol":"mssql-tds","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0012\u0001\u0000/\u0000\u0000\u0000\u0000\u0000\u0000\u001a\u0000\u0006\u0001\u0000 \u0000\u0001\u0002\u0000!\u0000\u0001\u0003\u0000\"\u0000\u0004\u0004\u0000&\u0000\u0001�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000","payload_hex":"1201002f0000000000001a00060100200001020021000103002200040400260001ff00000000000000000000000000","method":"","user_agent":"","ja3":"","session":"dfb7a345-82dd-4feb-ac5a-7d00ff7e06ec","seq":1,"duration_ms":101,"bytes_in":47,"bytes_out":13}],"http_methods":[{"method":"GET","count":2}],"distinct_ports_total":2,"top_paths":[{"path":"/","count":2,"ports":2}],"distinct_paths_total":1,"top_snis":[],"top_hosts":[{"value":"185.228.81.201","count":1}],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Connection","Host","User-Agent"],"representative":[{"name":"Connection","value":"close","notable":false},{"name":"Host","value":"<HONEYPOT>:3000","notable":false},{"name":"User-Agent","value":"WanScannerBot/1.0","notable":false}],"distinct_sets":1,"events_with_headers":2},"tags":[],"data_as_of":"2026-09-24T15:53:46.978835+00:00"}