{"ip":"154.16.44.223","data_as_of":"2026-10-24T17:44:48+00:00","observed":true,"total_events":2,"verdict":{"verdict":"scanner","label":"Recognized scanner","detail":"infrawatch","confidence":"high","network_type":"CDN","why":["The address is in a published scanner range (infrawatch).","Known research and commercial scanners are labelled by operator and carry no threat verdict.","Counts include 68 interactive session(s) as well as first-packet events."],"engagement":{"level":"payload","label":"Sustained payload","detail":"10,165 bytes sent","bytes_sent":10165,"session_seconds":0,"persistent":false},"basis":"combined"},"first_seen":"2026-10-19T18:19:08","last_seen":"2026-10-23T06:47:53","events_24h":0,"events_7d":2,"interactive_sessions":68,"interactive_sessions_24h":0,"interactive_sessions_7d":68,"interactive_protocols":[{"protocol":"http","sessions":68}],"geo":{"country_code":"GB","country_name":"United Kingdom","region":"England","city":"London","lat":51.5081,"lon":-0.1278,"asn":25369,"org":"Hydra Communications Ltd"},"source_domain":"154-16-44-223.infrawat.ch","known_scanners":["infrawatch","Infrawatch"],"scanner_tag":{"key":"infrawatch","label":"Infrawatch","category":"commercial","url":"https://infrawat.ch/"},"cve_matches":[],"malware":[],"udp":null,"interaction":{"window_days":90,"sessions":68,"first_seen":"2026-10-19T18:19:08","last_seen":"2026-10-21T22:22:00","verdicts":[{"verdict":"scan","sessions":68}],"personas":[{"persona":"nginx@1.24.0, wordpress@6.5.2, leaks@2, miner@bfgminer 5.5.0, elasticsearch@6.8.23, winrm@Windows Server 2016, fortigate@7.0.5, docker@25.0.3","sessions":67},{"persona":"nginx@1.24.0, wordpress@6.5.2, leaks@2, miner@bfgminer 5.5.0, elasticsearch@6.8.23, winrm@Windows Server 2016, dlink-dir645@1.01, fortigate@7.0.5","sessions":1}],"services":[{"protocol":"http","port":10284,"sessions":1},{"protocol":"http","port":24010,"sessions":1},{"protocol":"http","port":9770,"sessions":1},{"protocol":"http","port":46358,"sessions":1},{"protocol":"http","port":61339,"sessions":1},{"protocol":"http","port":25730,"sessions":1},{"protocol":"http","port":47030,"sessions":1},{"protocol":"http","port":5877,"sessions":1},{"protocol":"http","port":33077,"sessions":1},{"protocol":"http","port":46045,"sessions":1},{"protocol":"http","port":40861,"sessions":1},{"protocol":"http","port":43302,"sessions":1}],"logins":[],"commands":[],"downloads":[],"files":[],"attack":[{"technique_id":"T1595","technique_name":"Active Scanning","tactic_id":"TA0043","tactic_name":"Reconnaissance","sessions":68}]},"top_ports":[{"port":14143,"proto":"tcp","label":"","count":1,"sessions":0},{"port":24000,"proto":"tcp","label":"","count":1,"sessions":0},{"port":1923,"proto":"tcp","label":"HTTP","count":0,"sessions":1},{"port":47030,"proto":"tcp","label":"HTTP","count":0,"sessions":1},{"port":2558,"proto":"tcp","label":"HTTP","count":0,"sessions":1},{"port":5877,"proto":"tcp","label":"HTTP","count":0,"sessions":1},{"port":5966,"proto":"tcp","label":"HTTP","count":0,"sessions":1},{"port":6349,"proto":"tcp","label":"HTTP","count":0,"sessions":1},{"port":7457,"proto":"tcp","label":"HTTP","count":0,"sessions":1},{"port":7771,"proto":"tcp","label":"HTTP","count":0,"sessions":1},{"port":7924,"proto":"tcp","label":"HTTP","count":0,"sessions":1},{"port":9770,"proto":"tcp","label":"HTTP","count":0,"sessions":1},{"port":10284,"proto":"tcp","label":"HTTP","count":0,"sessions":1},{"port":14874,"proto":"tcp","label":"HTTP","count":0,"sessions":1},{"port":16138,"proto":"tcp","label":"HTTP","count":0,"sessions":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":["b11cun050_00040017_6b90553b","b11cun050_00040017_e873236c"],"interactive":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[]}},"fingerprint_peers":{"b11cun050_00040017_6b90553b":970,"b11cun050_00040017_e873236c":679},"akin_families":{"b11cun050_00040017_6b90553b":{"head":"b11cun050_00040017_6b90553b","shapes":9,"ips":969},"b11cun050_00040017_e873236c":{"head":"b11cun050_00040017_e873236c","shapes":2,"ips":679}},"user_agents":["Mozilla/5.0 (compatible; Infrawatch/1.0; +https://infrawat.ch/)"],"timeline":[{"date":"2026-10-19","count":0,"sessions":9},{"date":"2026-10-20","count":0,"sessions":31},{"date":"2026-10-21","count":1,"sessions":28},{"date":"2026-10-23","count":1,"sessions":0}],"recent_events":[{"timestamp":"2026-10-23T06:47:53","port":24000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"application/json\",\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:24000\",\"user-agent\":\"Mozilla/5.0 (compatible; Infrawatch/1.0; +https://infrawat.ch/)\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/mcp/","summary":"","payload_hex":"474554202f6d63702f20485454502f312e310d0a486f73743a20<HONEYPOT>3a32343030300d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b20496e66726177617463682f312e303b202b68747470733a2f2f696e6672617761742e63682f290d0a4163636570743a206170706c69636174696f6e2f6a736f6e0d0a436f6e6e656374696f6e3a20636c6f73650d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; Infrawatch/1.0; +https://infrawat.ch/)","ja3":"","session":"f9fbfa06-ba62-4c16-b6cf-e50ef2209880","seq":1,"duration_ms":100,"bytes_in":195,"bytes_out":78},{"timestamp":"2026-10-21T22:22:00","port":65016,"proto":"tcp","app_proto":"http","app_protocol":"http","host":"192.0.2.1","headers":"{\"accept\":\"*/*\",\"connection\":\"close\",\"host\":\"192.0.2.1\",\"user-agent\":\"Mozilla/5.0 (compatible; Infrawatch/1.0; +https://infrawat.ch/)\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a203139322e302e322e310d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b20496e66726177617463682f312e303b202b68747470733a2f2f696e6672617761742e63682f290d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; Infrawatch/1.0; +https://infrawat.ch/)","ja3":"","session":"79be7880-dd5d-4f5a-a4a4-0ae8ec8f9c80-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-21T21:50:21","port":64912,"proto":"tcp","app_proto":"http","app_protocol":"http","host":"192.0.2.1","headers":"{\"accept\":\"*/*\",\"connection\":\"close\",\"host\":\"192.0.2.1\",\"user-agent\":\"Mozilla/5.0 (compatible; Infrawatch/1.0; +https://infrawat.ch/)\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a203139322e302e322e310d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b20496e66726177617463682f312e303b202b68747470733a2f2f696e6672617761742e63682f290d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; Infrawatch/1.0; +https://infrawat.ch/)","ja3":"","session":"14dbaae6-88a6-47ec-b2e3-f5d20b2ea9e7-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-21T21:35:59","port":64049,"proto":"tcp","app_proto":"http","app_protocol":"http","host":"192.0.2.1","headers":"{\"accept\":\"*/*\",\"connection\":\"close\",\"host\":\"192.0.2.1\",\"user-agent\":\"Mozilla/5.0 (compatible; Infrawatch/1.0; +https://infrawat.ch/)\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a203139322e302e322e310d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b20496e66726177617463682f312e303b202b68747470733a2f2f696e6672617761742e63682f290d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; Infrawatch/1.0; +https://infrawat.ch/)","ja3":"","session":"f9c96c44-1b20-4274-b380-0af00c9fb8f9-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-21T20:50:15","port":63103,"proto":"tcp","app_proto":"http","app_protocol":"http","host":"192.0.2.1","headers":"{\"accept\":\"*/*\",\"connection\":\"close\",\"host\":\"192.0.2.1\",\"user-agent\":\"Mozilla/5.0 (compatible; Infrawatch/1.0; +https://infrawat.ch/)\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a203139322e302e322e310d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b20496e66726177617463682f312e303b202b68747470733a2f2f696e6672617761742e63682f290d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; Infrawatch/1.0; +https://infrawat.ch/)","ja3":"","session":"0715b53d-7ab5-4feb-bdfc-7b7d455df85c-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-21T19:25:08","port":61938,"proto":"tcp","app_proto":"http","app_protocol":"http","host":"192.0.2.1","headers":"{\"accept\":\"*/*\",\"connection\":\"close\",\"host\":\"192.0.2.1\",\"user-agent\":\"Mozilla/5.0 (compatible; Infrawatch/1.0; +https://infrawat.ch/)\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a203139322e302e322e310d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b20496e66726177617463682f312e303b202b68747470733a2f2f696e6672617761742e63682f290d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; Infrawatch/1.0; +https://infrawat.ch/)","ja3":"","session":"cbdf6978-9d22-4ca9-aa35-940386a3378e-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-21T19:15:10","port":61339,"proto":"tcp","app_proto":"http","app_protocol":"http","host":"192.0.2.1","headers":"{\"accept\":\"*/*\",\"connection\":\"close\",\"host\":\"192.0.2.1\",\"user-agent\":\"Mozilla/5.0 (compatible; Infrawatch/1.0; +https://infrawat.ch/)\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a203139322e302e322e310d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b20496e66726177617463682f312e303b202b68747470733a2f2f696e6672617761742e63682f290d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; Infrawatch/1.0; +https://infrawat.ch/)","ja3":"","session":"e9dba77d-8fe3-4954-b8ff-d5c7d6f8de33-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-21T18:23:58","port":60129,"proto":"tcp","app_proto":"http","app_protocol":"http","host":"192.0.2.1","headers":"{\"accept\":\"*/*\",\"connection\":\"close\",\"host\":\"192.0.2.1\",\"user-agent\":\"Mozilla/5.0 (compatible; Infrawatch/1.0; +https://infrawat.ch/)\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a203139322e302e322e310d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b20496e66726177617463682f312e303b202b68747470733a2f2f696e6672617761742e63682f290d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; Infrawatch/1.0; +https://infrawat.ch/)","ja3":"","session":"3d97f805-2be5-44af-950b-30cde72c1fdc-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-21T16:19:50","port":57976,"proto":"tcp","app_proto":"http","app_protocol":"http","host":"192.0.2.1","headers":"{\"accept\":\"*/*\",\"connection\":\"close\",\"host\":\"192.0.2.1\",\"user-agent\":\"Mozilla/5.0 (compatible; Infrawatch/1.0; +https://infrawat.ch/)\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a203139322e302e322e310d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b20496e66726177617463682f312e303b202b68747470733a2f2f696e6672617761742e63682f290d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; Infrawatch/1.0; +https://infrawat.ch/)","ja3":"","session":"d1d46a62-d088-4fc1-b331-f8dcbf5e9e82-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-21T13:45:47","port":54720,"proto":"tcp","app_proto":"http","app_protocol":"http","host":"192.0.2.1","headers":"{\"accept\":\"*/*\",\"connection\":\"close\",\"host\":\"192.0.2.1\",\"user-agent\":\"Mozilla/5.0 (compatible; Infrawatch/1.0; +https://infrawat.ch/)\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a203139322e302e322e310d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b20496e66726177617463682f312e303b202b68747470733a2f2f696e6672617761742e63682f290d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; Infrawatch/1.0; +https://infrawat.ch/)","ja3":"","session":"bbdc8fdf-30d3-480a-87aa-f8272fd8cef1-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true}],"http_methods":[{"method":"GET","count":70}],"distinct_ports_total":70,"top_paths":[{"path":"/","count":69,"ports":68},{"path":"/mcp/","count":1,"ports":1}],"distinct_paths_total":2,"top_snis":[],"top_hosts":[{"value":"192.0.2.1","count":68}],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","Accept-Encoding","Connection","Host","User-Agent"],"representative":[{"name":"Accept","value":"application/json","notable":false},{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Connection","value":"close","notable":false},{"name":"Host","value":"<HONEYPOT>:24000","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (compatible; Infrawatch/1.0; +https://infrawat.ch/)","notable":false}],"distinct_sets":2,"events_with_headers":10},"tags":[]}