{"ip":"154.16.44.162","data_as_of":"2026-10-24T16:53:56+00:00","observed":true,"total_events":4,"verdict":{"verdict":"scanner","label":"Recognized scanner","detail":"infrawatch","confidence":"high","network_type":"CDN","why":["The address is in a published scanner range (infrawatch).","Known research and commercial scanners are labelled by operator and carry no threat verdict.","Counts include 61 interactive session(s) as well as first-packet events."],"engagement":{"level":"payload","label":"Sustained payload","detail":"9,370 bytes sent","bytes_sent":9370,"session_seconds":1,"persistent":false},"basis":"combined"},"first_seen":"2026-08-30T09:09:48","last_seen":"2026-10-24T06:22:23","events_24h":0,"events_7d":0,"interactive_sessions":61,"interactive_sessions_24h":1,"interactive_sessions_7d":60,"interactive_protocols":[{"protocol":"http","sessions":59},{"protocol":"s7comm","sessions":1}],"geo":{"country_code":"GB","country_name":"United Kingdom","region":"England","city":"London","lat":51.5081,"lon":-0.1278,"asn":25369,"org":"Hydra Communications Ltd"},"source_domain":"154-16-44-162.infrawat.ch","known_scanners":["infrawatch","Infrawatch"],"scanner_tag":{"key":"infrawatch","label":"Infrawatch","category":"commercial","url":"https://infrawat.ch/"},"cve_matches":[],"malware":[],"udp":null,"interaction":{"window_days":90,"sessions":61,"first_seen":"2026-10-16T06:56:15","last_seen":"2026-10-24T06:22:23","verdicts":[{"verdict":"scan","sessions":60},{"verdict":"unknown","sessions":1}],"personas":[{"persona":"nginx@1.24.0, wordpress@6.5.2, leaks@2, miner@bfgminer 5.5.0, elasticsearch@6.8.23, winrm@Windows Server 2016, fortigate@7.0.5, docker@25.0.3","sessions":57},{"persona":"ics@Schneider Modicon M340","sessions":1},{"persona":"nginx@1.18.0, wordpress@6.5.2, leaks@1, miner@cgminer 4.11.1, elasticsearch@8.11.1, winrm@Windows Server 2019, fortigate@7.2.1","sessions":1},{"persona":"nginx@1.24.0, wordpress@6.5.2, leaks@2, miner@bfgminer 5.5.0, elasticsearch@6.8.23, winrm@Windows Server 2016, fortigate@7.0.5, gitlab@19.4.2","sessions":1}],"services":[{"protocol":"http","port":33054,"sessions":1},{"protocol":"http","port":12333,"sessions":1},{"protocol":"http","port":26592,"sessions":1},{"protocol":"http","port":4027,"sessions":1},{"protocol":"http","port":5692,"sessions":1},{"protocol":"http","port":44226,"sessions":1},{"protocol":"http","port":55968,"sessions":1},{"protocol":"http","port":36422,"sessions":1},{"protocol":"http","port":27787,"sessions":1},{"protocol":"http","port":18232,"sessions":1},{"protocol":"http","port":31154,"sessions":1},{"protocol":"http","port":443,"sessions":1}],"logins":[],"commands":[],"downloads":[],"files":[],"attack":[{"technique_id":"T1595","technique_name":"Active Scanning","tactic_id":"TA0043","tactic_name":"Reconnaissance","sessions":60}]},"top_ports":[{"port":47000,"proto":"tcp","label":"","count":2,"sessions":0},{"port":59340,"proto":"tcp","label":"","count":1,"sessions":0},{"port":42853,"proto":"tcp","label":"","count":1,"sessions":0},{"port":102,"proto":"tcp","label":"S7COMM","count":0,"sessions":1},{"port":53190,"proto":"tcp","label":"HTTP","count":0,"sessions":1},{"port":1000,"proto":"tcp","label":"","count":0,"sessions":1},{"port":2206,"proto":"tcp","label":"HTTP","count":0,"sessions":1},{"port":4027,"proto":"tcp","label":"HTTP","count":0,"sessions":1},{"port":5692,"proto":"tcp","label":"HTTP","count":0,"sessions":1},{"port":7257,"proto":"tcp","label":"HTTP","count":0,"sessions":1},{"port":9961,"proto":"tcp","label":"HTTP","count":0,"sessions":1},{"port":11497,"proto":"tcp","label":"HTTP","count":0,"sessions":1},{"port":11892,"proto":"tcp","label":"HTTP","count":0,"sessions":1},{"port":12333,"proto":"tcp","label":"HTTP","count":0,"sessions":1},{"port":16521,"proto":"tcp","label":"HTTP","count":0,"sessions":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i3514h1_8f004308c246_5c2c66f702b0"],"tls_client_hello":"","tls_ja3":["90189170f2171f397898ade1c4de4367"],"http_akin":["b11cun040_00040015_4c87b06e","b11cun050_00040017_6b90553b","b11cun050_00040017_e873236c"],"interactive":{"ssh_hassh":[],"tls_ja4":["t13i3514h1_8f004308c246_5c2c66f702b0"],"tls_ja3":["90189170f2171f397898ade1c4de4367"]}},"fingerprint_peers":{"t13i3514h1_8f004308c246_5c2c66f702b0":0,"b11cun040_00040015_4c87b06e":356,"b11cun050_00040017_6b90553b":972,"b11cun050_00040017_e873236c":679},"akin_families":{"b11cun040_00040015_4c87b06e":{"head":"b11cun040_00040015_4c87b06e","shapes":5,"ips":357},"b11cun050_00040017_6b90553b":{"head":"b11cun050_00040017_6b90553b","shapes":10,"ips":972},"b11cun050_00040017_e873236c":{"head":"b11cun050_00040017_e873236c","shapes":2,"ips":679}},"user_agents":["Mozilla/5.0 (compatible; Infrawatch/1.0; +https://infrawat.ch/)"],"timeline":[{"date":"2026-08-30","count":2,"sessions":0},{"date":"2026-10-11","count":1,"sessions":0},{"date":"2026-10-12","count":1,"sessions":0},{"date":"2026-10-16","count":0,"sessions":1},{"date":"2026-10-18","count":0,"sessions":1},{"date":"2026-10-19","count":0,"sessions":4},{"date":"2026-10-20","count":0,"sessions":20},{"date":"2026-10-21","count":0,"sessions":33},{"date":"2026-10-22","count":0,"sessions":1},{"date":"2026-10-24","count":0,"sessions":1}],"recent_events":[{"timestamp":"2026-10-24T06:22:23","port":102,"proto":"tcp","app_proto":"s7comm","app_protocol":"s7comm","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000!\u0002��2\u0007\u0000\u0000\u0000\u0003\u0000\b\u0000\b\u0000\u0001\u0012\u0004\u0011D\u0001\u0000�\t\u0000\u0004\u0000\u001c\u0000\u0001","payload_hex":"0300002102f080320700000003000800080001120411440100ff090004001c0001","method":"","user_agent":"","ja3":"","session":"1ba547b4-47d2-44d1-95d9-92372f8af194-7","seq":7,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"c6e5f206781e4e16","label":"S7comm / COTP (ISO-TSAP)"},"interactive":true},{"timestamp":"2026-10-24T06:22:22","port":102,"proto":"tcp","app_proto":"s7comm","app_protocol":"s7comm","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000!\u0002��2\u0007\u0000\u0000\u0000\u0002\u0000\b\u0000\b\u0000\u0001\u0012\u0004\u0011D\u0001\u0000�\t\u0000\u0004\u0000\u0011\u0000\u0001","payload_hex":"0300002102f080320700000002000800080001120411440100ff09000400110001","method":"","user_agent":"","ja3":"","session":"1ba547b4-47d2-44d1-95d9-92372f8af194-5","seq":5,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"3e62be58cf7ee27b","label":"S7comm / COTP (ISO-TSAP)"},"interactive":true},{"timestamp":"2026-10-24T06:22:22","port":102,"proto":"tcp","app_proto":"s7comm","app_protocol":"s7comm","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000\u0019\u0002��2\u0001\u0000\u0000\u0000\u0001\u0000\b\u0000\u0000�\u0000\u0000\u0001\u0000\u0001\u0001�","payload_hex":"0300001902f08032010000000100080000f0000001000101e0","method":"","user_agent":"","ja3":"","session":"1ba547b4-47d2-44d1-95d9-92372f8af194-3","seq":3,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"d5ec30dd03fefa97","label":"S7comm / COTP (ISO-TSAP)"},"interactive":true},{"timestamp":"2026-10-24T06:22:22","port":102,"proto":"tcp","app_proto":"s7comm","app_protocol":"s7comm","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000\u0016\u0011�\u0000\u0000\u0000\u0004\u0000�\u0002\u0001\u0000�\u0002\u0001\u0002�\u0001\n","payload_hex":"0300001611e00000000400c1020100c2020102c0010a","method":"","user_agent":"","ja3":"","session":"1ba547b4-47d2-44d1-95d9-92372f8af194-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"1a42acaf9034e519","label":"S7comm / COTP (ISO-TSAP)"},"interactive":true},{"timestamp":"2026-10-22T06:23:26","port":443,"proto":"tcp","app_proto":"http","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"application/json\",\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (compatible; Infrawatch/1.0; +https://infrawat.ch/)\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a203c484f4e4559504f543e0d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b20496e66726177617463682f312e303b202b68747470733a2f2f696e6672617761742e63682f290d0a4163636570743a206170706c69636174696f6e2f6a736f6e0d0a436f6e6e656374696f6e3a20636c6f73650d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; Infrawatch/1.0; +https://infrawat.ch/)","ja3":"90189170f2171f397898ade1c4de4367","session":"f198aed5-d92d-4fa4-a4c7-d41755a5575e-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-21T22:28:43","port":65419,"proto":"tcp","app_proto":"http","app_protocol":"http","host":"192.0.2.1","headers":"{\"accept\":\"*/*\",\"connection\":\"close\",\"host\":\"192.0.2.1\",\"user-agent\":\"Mozilla/5.0 (compatible; Infrawatch/1.0; +https://infrawat.ch/)\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a203139322e302e322e310d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b20496e66726177617463682f312e303b202b68747470733a2f2f696e6672617761742e63682f290d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; Infrawatch/1.0; +https://infrawat.ch/)","ja3":"","session":"5ca29aa9-24cc-46bc-b4bd-862cffe36c36-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-21T21:44:29","port":64559,"proto":"tcp","app_proto":"http","app_protocol":"http","host":"192.0.2.1","headers":"{\"accept\":\"*/*\",\"connection\":\"close\",\"host\":\"192.0.2.1\",\"user-agent\":\"Mozilla/5.0 (compatible; Infrawatch/1.0; +https://infrawat.ch/)\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a203139322e302e322e310d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b20496e66726177617463682f312e303b202b68747470733a2f2f696e6672617761742e63682f290d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; Infrawatch/1.0; +https://infrawat.ch/)","ja3":"","session":"a1b45169-7197-42d6-852f-3590e3b53f4c-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-21T21:03:35","port":63903,"proto":"tcp","app_proto":"http","app_protocol":"http","host":"192.0.2.1","headers":"{\"accept\":\"*/*\",\"connection\":\"close\",\"host\":\"192.0.2.1\",\"user-agent\":\"Mozilla/5.0 (compatible; Infrawatch/1.0; +https://infrawat.ch/)\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a203139322e302e322e310d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b20496e66726177617463682f312e303b202b68747470733a2f2f696e6672617761742e63682f290d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; Infrawatch/1.0; +https://infrawat.ch/)","ja3":"","session":"c238ab91-c232-4d7e-9839-0f8583db716c-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-21T20:54:48","port":63376,"proto":"tcp","app_proto":"http","app_protocol":"http","host":"192.0.2.1","headers":"{\"accept\":\"*/*\",\"connection\":\"close\",\"host\":\"192.0.2.1\",\"user-agent\":\"Mozilla/5.0 (compatible; Infrawatch/1.0; +https://infrawat.ch/)\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a203139322e302e322e310d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b20496e66726177617463682f312e303b202b68747470733a2f2f696e6672617761742e63682f290d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; Infrawatch/1.0; +https://infrawat.ch/)","ja3":"","session":"87b95230-0189-4e6f-9bf1-cdc50e06ce72-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-21T19:21:38","port":61728,"proto":"tcp","app_proto":"http","app_protocol":"http","host":"192.0.2.1","headers":"{\"accept\":\"*/*\",\"connection\":\"close\",\"host\":\"192.0.2.1\",\"user-agent\":\"Mozilla/5.0 (compatible; Infrawatch/1.0; +https://infrawat.ch/)\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a203139322e302e322e310d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b20496e66726177617463682f312e303b202b68747470733a2f2f696e6672617761742e63682f290d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; Infrawatch/1.0; +https://infrawat.ch/)","ja3":"","session":"2edeb2e1-e96b-454b-ad02-ab572f900100-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true}],"http_methods":[{"method":"GET","count":63}],"distinct_ports_total":64,"top_paths":[{"path":"/","count":60,"ports":58},{"path":"/mcp","count":2,"ports":1},{"path":"/favicon.ico","count":1,"ports":1}],"distinct_paths_total":3,"top_snis":[],"top_hosts":[{"value":"192.0.2.1","count":59}],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","Accept-Encoding","Connection","Host","User-Agent"],"representative":[{"name":"Accept","value":"application/json","notable":false},{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Connection","value":"close","notable":false},{"name":"Host","value":"<HONEYPOT>","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (compatible; Infrawatch/1.0; +https://infrawat.ch/)","notable":false}],"distinct_sets":2,"events_with_headers":6},"tags":[]}