{"ip":"151.243.11.160","total_events":81,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"27+ ports swept","confidence":"medium","network_type":null,"why":["No exploit payloads observed.","Swept 27 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"13,272 bytes sent","bytes_sent":13272,"session_seconds":0,"persistent":false}},"first_seen":"2026-09-26T17:27:29","last_seen":"2026-09-28T22:52:27","events_24h":0,"events_7d":81,"geo":{"country_code":"AE","country_name":"United Arab Emirates","region":"","city":"","lat":23.75,"lon":54.5,"asn":209630,"org":"LLC Vash Kredit Bank"},"source_domain":null,"known_scanners":[],"scanner_tag":null,"cve_matches":[],"malware":[],"top_ports":[{"port":27018,"proto":"tcp","label":"MongoDB","count":3},{"port":8889,"proto":"tcp","label":"","count":3},{"port":5011,"proto":"tcp","label":"","count":3},{"port":14324,"proto":"tcp","label":"","count":3},{"port":56255,"proto":"tcp","label":"","count":3},{"port":16706,"proto":"tcp","label":"","count":3},{"port":9001,"proto":"tcp","label":"Tor","count":3},{"port":24913,"proto":"tcp","label":"","count":3},{"port":31132,"proto":"tcp","label":"","count":3},{"port":1344,"proto":"tcp","label":"","count":3},{"port":51037,"proto":"tcp","label":"","count":3},{"port":6666,"proto":"tcp","label":"","count":3},{"port":666,"proto":"tcp","label":"","count":3},{"port":5048,"proto":"tcp","label":"","count":3},{"port":3000,"proto":"tcp","label":"Web-alt","count":3}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i100900_61a7ad8aa9b6_cb8fff09048f","t13i100900_61a7ad8aa9b6_367aa026f35a"],"tls_client_hello":"16030100db010000d70303f6eedbbb5ab4886a594786ca21b3bb0b533efd9e6b5a59019b915b5fc7b7f0892045adc3281ceb37294106cc26886f38e5c57f67ef3e171bcd62e8312837e4a92f0014130213011303c02cc02bcca9c030c02fcca800ff0100007a000b00020100000a00080006001d00170018002d00020101000d001a001804010501060104030503060308040805080608070201020300050005010000000000170000003300260024001d0020e71795d3582ac36a7369344b001f41efd7252269caa93ee4437d9d6044a51160002b00050403040303002300","tls_ja3":["224fc543e7103411c2f90c0015a18d47","c5e4d334661e09a76af160b34bfb94b5","3e920ae3135eefe76191154b95dd5015","d8d88f8c514257807f601c7343e63403"],"http_akin":["a11cun040_0000004b_4c87b06e"]},"fingerprint_peers":{"t13i100900_61a7ad8aa9b6_cb8fff09048f":129,"t13i100900_61a7ad8aa9b6_367aa026f35a":67,"a11cun040_0000004b_4c87b06e":243},"akin_families":{"a11cun040_0000004b_4c87b06e":{"head":"a11cun040_0000004b_4c87b06e","shapes":2,"ips":243}},"user_agents":["Mozilla/5.0 (compatible; FlowIQ/1.0; +https://flowiq-labs.com/scanning-info)"],"timeline":[{"date":"2026-09-26","count":15},{"date":"2026-09-27","count":12},{"date":"2026-09-28","count":54}],"recent_events":[{"timestamp":"2026-09-28T22:52:27","port":2000,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"close\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (compatible; FlowIQ/1.0; +https://flowiq-labs.com/scanning-info)\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/favicon.ico","summary":"","payload_hex":"474554202f66617669636f6e2e69636f20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b20466c6f7749512f312e303b202b68747470733a2f2f666c6f7769712d6c6162732e636f6d2f7363616e6e696e672d696e666f290d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; FlowIQ/1.0; +https://flowiq-labs.com/scanning-info)","ja3":"05bee8793db81040ce63566fc8f137f1","session":"363a7ac8-4dac-4132-aacb-e36fadda0e1b","seq":1,"duration_ms":100,"bytes_in":171,"bytes_out":79},{"timestamp":"2026-09-28T22:52:24","port":2000,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"close\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (compatible; FlowIQ/1.0; +https://flowiq-labs.com/scanning-info)\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b20466c6f7749512f312e303b202b68747470733a2f2f666c6f7769712d6c6162732e636f6d2f7363616e6e696e672d696e666f290d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; FlowIQ/1.0; +https://flowiq-labs.com/scanning-info)","ja3":"591aa2d1382936660e44117b1b0e7fad","session":"4c7ee711-7756-4dff-88b3-140659079770","seq":1,"duration_ms":100,"bytes_in":160,"bytes_out":79},{"timestamp":"2026-09-28T22:52:20","port":2000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"close\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (compatible; FlowIQ/1.0; +https://flowiq-labs.com/scanning-info)\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b20466c6f7749512f312e303b202b68747470733a2f2f666c6f7769712d6c6162732e636f6d2f7363616e6e696e672d696e666f290d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; FlowIQ/1.0; +https://flowiq-labs.com/scanning-info)","ja3":"","session":"06fc6d57-ebbd-4dac-94be-07d98ab43beb","seq":1,"duration_ms":101,"bytes_in":160,"bytes_out":79},{"timestamp":"2026-09-28T22:13:35","port":8191,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"close\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (compatible; FlowIQ/1.0; +https://flowiq-labs.com/scanning-info)\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/favicon.ico","summary":"","payload_hex":"474554202f66617669636f6e2e69636f20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b20466c6f7749512f312e303b202b68747470733a2f2f666c6f7769712d6c6162732e636f6d2f7363616e6e696e672d696e666f290d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; FlowIQ/1.0; +https://flowiq-labs.com/scanning-info)","ja3":"9e719153340d8a05e2d86d8c0f38773d","session":"67476343-27a5-47e2-b133-b32f5bb97cbf","seq":1,"duration_ms":100,"bytes_in":171,"bytes_out":79},{"timestamp":"2026-09-28T22:13:32","port":8191,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"close\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (compatible; FlowIQ/1.0; +https://flowiq-labs.com/scanning-info)\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b20466c6f7749512f312e303b202b68747470733a2f2f666c6f7769712d6c6162732e636f6d2f7363616e6e696e672d696e666f290d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; FlowIQ/1.0; +https://flowiq-labs.com/scanning-info)","ja3":"0c4e790fb6ad15b24d29e884bd5a878e","session":"c65ab872-0394-4418-be68-d5616ceae640","seq":1,"duration_ms":100,"bytes_in":160,"bytes_out":79},{"timestamp":"2026-09-28T22:13:28","port":8191,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"close\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (compatible; FlowIQ/1.0; +https://flowiq-labs.com/scanning-info)\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b20466c6f7749512f312e303b202b68747470733a2f2f666c6f7769712d6c6162732e636f6d2f7363616e6e696e672d696e666f290d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; FlowIQ/1.0; +https://flowiq-labs.com/scanning-info)","ja3":"","session":"a3a4bf6f-0465-457e-8009-cf707500da6f","seq":1,"duration_ms":101,"bytes_in":160,"bytes_out":79},{"timestamp":"2026-09-28T21:56:55","port":1344,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"close\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (compatible; FlowIQ/1.0; +https://flowiq-labs.com/scanning-info)\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/favicon.ico","summary":"","payload_hex":"474554202f66617669636f6e2e69636f20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b20466c6f7749512f312e303b202b68747470733a2f2f666c6f7769712d6c6162732e636f6d2f7363616e6e696e672d696e666f290d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; FlowIQ/1.0; +https://flowiq-labs.com/scanning-info)","ja3":"cab69183c2fbcd929e948e0da4050351","session":"24018702-84d8-425a-842d-dc273a75a32c","seq":1,"duration_ms":101,"bytes_in":171,"bytes_out":79},{"timestamp":"2026-09-28T21:56:52","port":1344,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"close\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (compatible; FlowIQ/1.0; +https://flowiq-labs.com/scanning-info)\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b20466c6f7749512f312e303b202b68747470733a2f2f666c6f7769712d6c6162732e636f6d2f7363616e6e696e672d696e666f290d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; FlowIQ/1.0; +https://flowiq-labs.com/scanning-info)","ja3":"642182273c8487c349ef319e8aa7fd51","session":"fbbf89fb-eb74-4dcb-a9d8-56ae51ecbafa","seq":1,"duration_ms":100,"bytes_in":160,"bytes_out":79},{"timestamp":"2026-09-28T21:56:48","port":1344,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"close\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (compatible; FlowIQ/1.0; +https://flowiq-labs.com/scanning-info)\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b20466c6f7749512f312e303b202b68747470733a2f2f666c6f7769712d6c6162732e636f6d2f7363616e6e696e672d696e666f290d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; FlowIQ/1.0; +https://flowiq-labs.com/scanning-info)","ja3":"","session":"d83c5408-f973-412e-8576-ab3d3c8800e5","seq":1,"duration_ms":100,"bytes_in":160,"bytes_out":79},{"timestamp":"2026-09-28T20:53:58","port":3000,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"close\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (compatible; FlowIQ/1.0; +https://flowiq-labs.com/scanning-info)\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/favicon.ico","summary":"","payload_hex":"474554202f66617669636f6e2e69636f20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b20466c6f7749512f312e303b202b68747470733a2f2f666c6f7769712d6c6162732e636f6d2f7363616e6e696e672d696e666f290d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; FlowIQ/1.0; +https://flowiq-labs.com/scanning-info)","ja3":"7f21064b058bd6a2112c8b158cbf30d2","session":"26e02d67-35d3-4ffb-a333-e79290ff6c53","seq":1,"duration_ms":100,"bytes_in":171,"bytes_out":79}],"http_methods":[{"method":"GET","count":81}],"distinct_ports_total":27,"top_paths":[{"path":"/","count":54,"ports":27},{"path":"/favicon.ico","count":27,"ports":27}],"distinct_paths_total":2,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","Connection","Host","User-Agent"],"representative":[{"name":"Accept","value":"*/*","notable":false},{"name":"Connection","value":"close","notable":false},{"name":"Host","value":"<HONEYPOT>","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (compatible; FlowIQ/1.0; +https://flowiq-labs.com/scanning-info)","notable":false}],"distinct_sets":1,"events_with_headers":10},"tags":[],"data_as_of":"2026-09-30T06:14:27.223799+00:00"}