{"ip":"155.103.157.133","total_events":13,"verdict":{"verdict":"probing","label":"Low-level probing","detail":null,"confidence":"low","network_type":null,"why":["13 event(s), fewer than 10 distinct ports, no exploit payloads.","Not in any known-scanner range."],"engagement":{"level":"request","label":"Request traffic","detail":"545 bytes sent","bytes_sent":545,"session_seconds":0,"persistent":false}},"first_seen":"2026-09-30T06:59:28","last_seen":"2026-09-30T07:01:45","events_24h":0,"events_7d":13,"geo":{"country_code":"US","country_name":"United States","region":"","city":"","lat":37.751,"lon":-97.822,"asn":42960,"org":"VH Global Limited"},"source_domain":null,"known_scanners":[],"scanner_tag":null,"cve_matches":[],"malware":[],"top_ports":[{"port":27017,"proto":"tcp","label":"MongoDB","count":3},{"port":15672,"proto":"tcp","label":"RabbitMQ","count":2},{"port":2379,"proto":"tcp","label":"","count":2},{"port":2375,"proto":"tcp","label":"Docker","count":2},{"port":11211,"proto":"tcp","label":"Memcached","count":2},{"port":9200,"proto":"tcp","label":"Elastic","count":2}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":["b10cun020_00440000_724c10fb","b10cun010_00040000_c4b2c4aa"]},"fingerprint_peers":{"b10cun010_00040000_c4b2c4aa":359,"b10cun020_00440000_724c10fb":1},"akin_families":{},"user_agents":[],"timeline":[{"date":"2026-09-30","count":13}],"recent_events":[{"timestamp":"2026-09-30T07:01:45","port":11211,"proto":"tcp","app_proto":"","app_protocol":"memcached","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"stats settings\r\n","payload_hex":"73746174732073657474696e67730d0a","method":"","user_agent":"","ja3":"","session":"7583b536-e8ed-4fa5-9609-2516a10da04c","seq":1,"duration_ms":100,"bytes_in":16,"bytes_out":15,"enriched":{"digest":"851657fb6672008d","label":"Memcached","strings":["stats settings"]}},{"timestamp":"2026-09-30T07:01:39","port":2375,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"host\":\"<HONEYPOT>\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/version","summary":"","payload_hex":"474554202f76657273696f6e20485454502f312e300d0a486f73743a20<HONEYPOT>0d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"d738e975-229a-4b2a-bea2-478cceb452da","seq":1,"duration_ms":100,"bytes_in":46,"bytes_out":80},{"timestamp":"2026-09-30T07:01:33","port":15672,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"authorization\":\"Basic Z3Vlc3Q6Z3Vlc3Q=\",\"host\":\"<HONEYPOT>\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/api/overview","summary":"","payload_hex":"474554202f6170692f6f7665727669657720485454502f312e300d0a486f73743a20<HONEYPOT>0d0a417574686f72697a6174696f6e3a204261736963205a33566c633351365a33566c6333513d0d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"c6e16473-04b2-4d26-b00e-d33713261128","seq":1,"duration_ms":100,"bytes_in":90,"bytes_out":80},{"timestamp":"2026-09-30T07:01:26","port":2379,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"host\":\"<HONEYPOT>\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/v2/keys/?recursive=true","summary":"","payload_hex":"474554202f76322f6b6579732f3f7265637572736976653d7472756520485454502f312e300d0a486f73743a20<HONEYPOT>0d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"4af31f07-5ec6-4a40-821a-e7ab38b3ad8f","seq":1,"duration_ms":100,"bytes_in":62,"bytes_out":80},{"timestamp":"2026-09-30T07:01:20","port":9200,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"host\":\"<HONEYPOT>\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e300d0a486f73743a20<HONEYPOT>0d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"d2e2ee4f-0046-48ea-ac3d-fe0472b1b707","seq":1,"duration_ms":100,"bytes_in":39,"bytes_out":80},{"timestamp":"2026-09-30T07:01:19","port":27017,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000\u0000","payload_hex":"00000000","method":"","user_agent":"","ja3":"","session":"c93eff01-8fe2-4a6c-a82d-beb3c4d1e6d2","seq":1,"duration_ms":100,"bytes_in":4,"bytes_out":15},{"timestamp":"2026-09-30T07:00:01","port":11211,"proto":"tcp","app_proto":"","app_protocol":"memcached","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"version\r\n","payload_hex":"76657273696f6e0d0a","method":"","user_agent":"","ja3":"","session":"9ce708b5-b526-471c-ab3f-b73ed6ece769","seq":1,"duration_ms":101,"bytes_in":9,"bytes_out":15,"enriched":{"digest":"d1a9b5f9ca3064cf","label":"Memcached","strings":["version"]}},{"timestamp":"2026-09-30T06:59:54","port":2375,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"host\":\"<HONEYPOT>\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/version","summary":"","payload_hex":"474554202f76657273696f6e20485454502f312e300d0a486f73743a20<HONEYPOT>0d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"929b0789-b9d1-4869-8f6d-88cf14dc7015","seq":1,"duration_ms":100,"bytes_in":46,"bytes_out":80},{"timestamp":"2026-09-30T06:59:48","port":15672,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"host\":\"<HONEYPOT>\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/api/overview","summary":"","payload_hex":"474554202f6170692f6f7665727669657720485454502f312e300d0a486f73743a20<HONEYPOT>0d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"80433ee2-5fb5-483d-bddf-3a61acd35e8a","seq":1,"duration_ms":101,"bytes_in":51,"bytes_out":80},{"timestamp":"2026-09-30T06:59:42","port":2379,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"host\":\"<HONEYPOT>\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/version","summary":"","payload_hex":"474554202f76657273696f6e20485454502f312e300d0a486f73743a20<HONEYPOT>0d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"0991ae85-92a9-4025-85d8-22d84201272b","seq":1,"duration_ms":100,"bytes_in":46,"bytes_out":80}],"http_methods":[{"method":"GET","count":9}],"distinct_ports_total":6,"top_paths":[{"path":"/","count":3,"ports":2},{"path":"/version","count":3,"ports":2},{"path":"/api/overview","count":2,"ports":1},{"path":"/v2/keys/?recursive=true","count":1,"ports":1}],"distinct_paths_total":4,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Authorization","Host"],"representative":[{"name":"Authorization","value":"Basic Z3Vlc3Q6Z3Vlc3Q=","notable":true},{"name":"Host","value":"<HONEYPOT>","notable":false}],"distinct_sets":2,"events_with_headers":7},"tags":[],"data_as_of":"2026-10-01T21:36:06.524780+00:00"}