{"ip":"149.224.11.243","total_events":12,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"11+ ports swept","confidence":"medium","network_type":"residential ISP","why":["No exploit payloads observed.","Swept 11 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range."],"engagement":{"level":"request","label":"Request traffic","detail":"319 bytes sent","bytes_sent":319,"session_seconds":0,"persistent":false}},"first_seen":"2026-09-29T04:10:48","last_seen":"2026-09-29T23:06:12","events_24h":4,"events_7d":12,"geo":{"country_code":"DE","country_name":"Germany","region":"Free and Hanseatic City of Hamburg","city":"Hamburg","lat":53.5992,"lon":10.0436,"asn":15943,"org":"wilhelm.tel GmbH"},"source_domain":"149.224.11.243.dynamic-pppoe.dt.ipv4.wtnet.de","known_scanners":[],"scanner_tag":{"key":"peeringdb:as15943","label":"wilhelm.tel","category":"isp","url":"https://www.peeringdb.com/asn/15943"},"cve_matches":[],"malware":[],"top_ports":[{"port":25567,"proto":"tcp","label":"","count":2},{"port":56449,"proto":"tcp","label":"","count":1},{"port":25575,"proto":"tcp","label":"","count":1},{"port":25568,"proto":"tcp","label":"","count":1},{"port":25566,"proto":"tcp","label":"","count":1},{"port":25579,"proto":"tcp","label":"","count":1},{"port":25571,"proto":"tcp","label":"","count":1},{"port":34853,"proto":"tcp","label":"","count":1},{"port":25560,"proto":"tcp","label":"","count":1},{"port":2651,"proto":"tcp","label":"","count":1},{"port":25545,"proto":"tcp","label":"","count":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":[]},"fingerprint_peers":{},"akin_families":{},"user_agents":[],"timeline":[{"date":"2026-09-29","count":12}],"recent_events":[{"timestamp":"2026-09-29T23:06:12","port":56449,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0017\u0000����\u000f\r<HONEYPOT>܁\u0001\u0001\u0000","payload_hex":"1700ffffffff0f0d<HONEYPOT>dc81010100","method":"","user_agent":"","ja3":"","session":"f00d306a-03a9-491c-bd50-2cefc69c4222","seq":1,"duration_ms":100,"bytes_in":26,"bytes_out":14,"enriched":{"digest":"13bb3d140dc6b07d","strings":["<HONEYPOT>"]}},{"timestamp":"2026-09-29T22:27:35","port":25545,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0017\u0000����\u000f\r<HONEYPOT>c�\u0001\u0001\u0000","payload_hex":"1700ffffffff0f0d<HONEYPOT>63c9010100","method":"","user_agent":"","ja3":"","session":"83884585-aa58-46c1-9770-1bce204b110c","seq":1,"duration_ms":100,"bytes_in":26,"bytes_out":14,"enriched":{"digest":"50ffa3da3f52e270","strings":["<HONEYPOT>c"]}},{"timestamp":"2026-09-29T21:49:15","port":25567,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0018\u0000����\u000f\u000e<HONEYPOT>c�\u0001\u0001\u0000","payload_hex":"1800ffffffff0f0e<HONEYPOT>63df010100","method":"","user_agent":"","ja3":"","session":"549ce6fe-1fb5-46c2-a092-7e4022cd5a01","seq":1,"duration_ms":100,"bytes_in":27,"bytes_out":14,"enriched":{"digest":"4af91430a715afdc","strings":["<HONEYPOT>c"]}},{"timestamp":"2026-09-29T21:23:30","port":25566,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0017\u0000����\u000f\r<HONEYPOT>c�\u0001\u0001\u0000","payload_hex":"1700ffffffff0f0d<HONEYPOT>63de010100","method":"","user_agent":"","ja3":"","session":"cf4d78f7-d976-4b87-b190-f9d9a9f536c5","seq":1,"duration_ms":100,"bytes_in":26,"bytes_out":14,"enriched":{"digest":"50ffa3da3f52e270","strings":["<HONEYPOT>c"]}},{"timestamp":"2026-09-29T07:07:36","port":25568,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0018\u0000����\u000f\u000e<HONEYPOT>c�\u0001\u0001\u0000","payload_hex":"1800ffffffff0f0e<HONEYPOT>63e0010100","method":"","user_agent":"","ja3":"","session":"970630f6-a5fc-40d8-8b8c-dcbca7b27e32","seq":1,"duration_ms":101,"bytes_in":27,"bytes_out":14,"enriched":{"digest":"4af91430a715afdc","strings":["<HONEYPOT>c"]}},{"timestamp":"2026-09-29T07:07:35","port":25579,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0018\u0000����\u000f\u000e<HONEYPOT>c�\u0001\u0001\u0000","payload_hex":"1800ffffffff0f0e<HONEYPOT>63eb010100","method":"","user_agent":"","ja3":"","session":"fedc2f67-ff4a-44d6-a0bf-cb036bc430ee","seq":1,"duration_ms":100,"bytes_in":27,"bytes_out":14,"enriched":{"digest":"4af91430a715afdc","strings":["<HONEYPOT>c"]}},{"timestamp":"2026-09-29T07:07:26","port":2651,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0018\u0000����\u000f\u000e<HONEYPOT>\n[\u0001\u0001\u0000","payload_hex":"1800ffffffff0f0e<HONEYPOT>0a5b010100","method":"","user_agent":"","ja3":"","session":"b65cacdb-b71c-4985-97b0-ec94a30f2d1d","seq":1,"duration_ms":100,"bytes_in":27,"bytes_out":14,"enriched":{"digest":"2328fef83139f864","strings":["<HONEYPOT>"]}},{"timestamp":"2026-09-29T07:07:25","port":25560,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0018\u0000����\u000f\u000e<HONEYPOT>c�\u0001\u0001\u0000","payload_hex":"1800ffffffff0f0e<HONEYPOT>63d8010100","method":"","user_agent":"","ja3":"","session":"37e7b986-2d54-4414-b4cc-0467bb941a9b","seq":1,"duration_ms":100,"bytes_in":27,"bytes_out":14,"enriched":{"digest":"4af91430a715afdc","strings":["<HONEYPOT>c"]}},{"timestamp":"2026-09-29T07:06:59","port":25575,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0018\u0000����\u000f\u000e<HONEYPOT>c�\u0001\u0001\u0000","payload_hex":"1800ffffffff0f0e<HONEYPOT>63e7010100","method":"","user_agent":"","ja3":"","session":"8e1dc03e-c201-45cf-9888-6d25d1f692f9","seq":1,"duration_ms":100,"bytes_in":27,"bytes_out":14,"enriched":{"digest":"4af91430a715afdc","strings":["<HONEYPOT>c"]}},{"timestamp":"2026-09-29T05:07:59","port":34853,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0017\u0000����\u000f\r<HONEYPOT>�%\u0001\u0001\u0000","payload_hex":"1700ffffffff0f0d<HONEYPOT>8825010100","method":"","user_agent":"","ja3":"","session":"8b946f6a-4e90-433a-a4e0-4d881a8d70ab","seq":1,"duration_ms":100,"bytes_in":26,"bytes_out":14,"enriched":{"digest":"6ac4b2fc768c6695","strings":["<HONEYPOT>"]}}],"http_methods":[],"distinct_ports_total":11,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-09-30T16:18:21.068383+00:00"}