{"ip":"158.94.208.9","data_as_of":"2026-10-24T09:53:48+00:00","observed":true,"total_events":111,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"38+ ports swept","confidence":"medium","network_type":null,"why":["No exploit payloads observed.","Swept 38 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range.","Held a session open for 61s, against a median of well under a second.","Counts include 1 interactive session(s) as well as first-packet events."],"engagement":{"level":"payload","label":"Sustained payload, held open","detail":"17,190 bytes sent, longest session 61s","bytes_sent":17190,"session_seconds":61,"persistent":true},"basis":"combined"},"first_seen":"2026-10-06T00:20:47","last_seen":"2026-10-24T09:03:16","events_24h":20,"events_7d":20,"interactive_sessions":1,"interactive_sessions_24h":1,"interactive_sessions_7d":1,"interactive_protocols":[{"protocol":"http","sessions":1}],"geo":{"country_code":"DE","country_name":"Germany","region":"Hesse","city":"Frankfurt am Main","lat":50.1517,"lon":8.7523,"asn":202412,"org":"Omegatech LTD"},"source_domain":null,"known_scanners":[],"scanner_tag":null,"cve_matches":[],"malware":[],"udp":null,"interaction":{"window_days":90,"sessions":1,"first_seen":"2026-10-24T05:22:10","last_seen":"2026-10-24T05:22:10","verdicts":[{"verdict":"scan","sessions":1}],"personas":[{"persona":"nginx@1.24.0, wordpress@6.5.2, leaks@2, miner@bfgminer 5.5.0, elasticsearch@6.8.23, winrm@Windows Server 2016, fortigate@7.0.5, gitlab@19.4.2","sessions":1}],"services":[{"protocol":"http","port":56789,"sessions":1}],"logins":[],"commands":[],"downloads":[],"files":[],"attack":[{"technique_id":"T1595","technique_name":"Active Scanning","tactic_id":"TA0043","tactic_name":"Reconnaissance","sessions":1}]},"top_ports":[{"port":9443,"proto":"tcp","label":"","count":6,"sessions":0},{"port":30000,"proto":"tcp","label":"","count":6,"sessions":0},{"port":39999,"proto":"tcp","label":"","count":4,"sessions":0},{"port":40000,"proto":"tcp","label":"","count":4,"sessions":0},{"port":6443,"proto":"tcp","label":"k8s API","count":4,"sessions":0},{"port":4444,"proto":"tcp","label":"","count":4,"sessions":0},{"port":9999,"proto":"tcp","label":"","count":4,"sessions":0},{"port":50000,"proto":"tcp","label":"SAP","count":4,"sessions":0},{"port":5443,"proto":"tcp","label":"","count":4,"sessions":0},{"port":29999,"proto":"tcp","label":"","count":4,"sessions":0},{"port":60000,"proto":"tcp","label":"","count":4,"sessions":0},{"port":11111,"proto":"tcp","label":"","count":4,"sessions":0},{"port":21443,"proto":"tcp","label":"","count":4,"sessions":0},{"port":34443,"proto":"tcp","label":"","count":4,"sessions":0},{"port":4430,"proto":"tcp","label":"","count":4,"sessions":0}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i200900_2b729b4bf6f3_29829a46703f"],"tls_client_hello":"1603010197010001930303cfb497e2c243f652e554200535e2c2311a2ba60da1a02fb4c33eb6ffa8c372e4209ecfa460618f131e5c3e316c0a9b9c3bf83c11c1a90586624c27ed538cc7cedf002813021301c02cc02bc030c02fc024c023c028c027c00ac009c014c013009d009c003d003c0035002f01000122002b0009080304030303020301000d001a001808040805080604010501020104030503020302020601060300230000000a00080006001d00170018003300d000ce001d0020b0e32c2261ab97d23aa663bcbc320f5a32a24d7d1b9a8a809fec27a3991e654b00170041049b93688cbc32c961f1b8f3d6569e1eaee6a72ded191f6fdbf5013b13a5c0800e6048597c230e482e35d1649a8b30a0281c76fe597ccf34ff2fbd8dbef861a4dc00180061041a3fb3a6c0f436234ad5624db7c315c76a35e05aa496b2a921c0d59195f91230b2bb687e5313147cb4e43b668c79533db64c010483d52d0340c87b82e12fcd52688756c77e4b9a900b1f9d5dbc03d3a8cddfa8a90840c47674e8b0ab1bf970790031000000170000ff0100010000","tls_ja3":["4d5efa96609dc906f796e63cff009c2a"],"http_akin":["b11cun030_00040003_21fe282e","b11cun020_00040002_5ff1c0a9"],"interactive":{"ssh_hassh":[],"tls_ja4":["t13i200900_2b729b4bf6f3_29829a46703f"],"tls_ja3":["4d5efa96609dc906f796e63cff009c2a"]}},"fingerprint_peers":{"t13i200900_2b729b4bf6f3_29829a46703f":9,"b11cun020_00040002_5ff1c0a9":105,"b11cun030_00040003_21fe282e":14},"akin_families":{"b11cun030_00040003_21fe282e":{"head":"b11cun020_00040002_5ff1c0a9","shapes":2,"ips":105},"b11cun020_00040002_5ff1c0a9":{"head":"b11cun020_00040002_5ff1c0a9","shapes":2,"ips":105}},"user_agents":[],"timeline":[{"date":"2026-10-06","count":6,"sessions":0},{"date":"2026-10-08","count":7,"sessions":0},{"date":"2026-10-09","count":12,"sessions":0},{"date":"2026-10-10","count":6,"sessions":0},{"date":"2026-10-13","count":8,"sessions":0},{"date":"2026-10-14","count":18,"sessions":0},{"date":"2026-10-15","count":18,"sessions":0},{"date":"2026-10-16","count":16,"sessions":0},{"date":"2026-10-23","count":6,"sessions":0},{"date":"2026-10-24","count":14,"sessions":1}],"recent_events":[{"timestamp":"2026-10-24T09:03:16","port":49999,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:49999\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/remote/login?lang=en","summary":"","payload_hex":"474554202f72656d6f74652f6c6f67696e3f6c616e673d656e20485454502f312e310d0a486f73743a20<HONEYPOT>3a34393939390d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"","ja3":"4d5efa96609dc906f796e63cff009c2a","session":"1d372b1f-aca6-44ce-b567-68f11e9d2727","seq":2,"duration_ms":267,"bytes_in":200,"bytes_out":154},{"timestamp":"2026-10-24T09:03:15","port":49999,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"Keep-Alive\",\"host\":\"<HONEYPOT>:49999\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/remote/login?lang=en","summary":"","payload_hex":"474554202f72656d6f74652f6c6f67696e3f6c616e673d656e20485454502f312e310d0a486f73743a20<HONEYPOT>3a34393939390d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a204b6565702d416c6976650d0a0d0a","method":"GET","user_agent":"","ja3":"4d5efa96609dc906f796e63cff009c2a","session":"1d372b1f-aca6-44ce-b567-68f11e9d2727","seq":1,"duration_ms":103,"bytes_in":112,"bytes_out":77},{"timestamp":"2026-10-24T05:44:39","port":29999,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:29999\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/remote/login?lang=en","summary":"","payload_hex":"474554202f72656d6f74652f6c6f67696e3f6c616e673d656e20485454502f312e310d0a486f73743a20<HONEYPOT>3a32393939390d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"","ja3":"4d5efa96609dc906f796e63cff009c2a","session":"920cf836-fc3c-4daa-88d2-5b9c291ca154","seq":2,"duration_ms":505,"bytes_in":198,"bytes_out":154},{"timestamp":"2026-10-24T05:44:39","port":29999,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"Keep-Alive\",\"host\":\"<HONEYPOT>:29999\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/remote/login?lang=en","summary":"","payload_hex":"474554202f72656d6f74652f6c6f67696e3f6c616e673d656e20485454502f312e310d0a486f73743a20<HONEYPOT>3a32393939390d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a204b6565702d416c6976650d0a0d0a","method":"GET","user_agent":"","ja3":"4d5efa96609dc906f796e63cff009c2a","session":"920cf836-fc3c-4daa-88d2-5b9c291ca154","seq":1,"duration_ms":100,"bytes_in":111,"bytes_out":77},{"timestamp":"2026-10-24T05:21:10","port":56789,"proto":"tcp","app_proto":"http","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:56789\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"1.3","alpn":[],"url_path":"/remote/login","summary":"","payload_hex":"474554202f72656d6f74652f6c6f67696e3f6c616e673d656e20485454502f312e310d0a486f73743a203c484f4e4559504f543e3a35363738390d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"","ja3":"4d5efa96609dc906f796e63cff009c2a","session":"9a27741b-dd9c-4b4b-b97d-9ec03ff5827b-3","seq":3,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-24T05:21:10","port":56789,"proto":"tcp","app_proto":"http","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"Keep-Alive\",\"host\":\"<HONEYPOT>:56789\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"1.3","alpn":[],"url_path":"/remote/login","summary":"","payload_hex":"474554202f72656d6f74652f6c6f67696e3f6c616e673d656e20485454502f312e310d0a486f73743a203c484f4e4559504f543e3a35363738390d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a204b6565702d416c6976650d0a0d0a","method":"GET","user_agent":"","ja3":"4d5efa96609dc906f796e63cff009c2a","session":"9a27741b-dd9c-4b4b-b97d-9ec03ff5827b-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-24T04:32:12","port":30000,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:30000\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/remote/login?lang=en","summary":"","payload_hex":"474554202f72656d6f74652f6c6f67696e3f6c616e673d656e20485454502f312e310d0a486f73743a20<HONEYPOT>3a33303030300d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"","ja3":"4d5efa96609dc906f796e63cff009c2a","session":"0f64e174-f5fd-47a3-8a1c-8c1da9a24c96","seq":2,"duration_ms":359,"bytes_in":198,"bytes_out":154},{"timestamp":"2026-10-24T04:32:12","port":30000,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"Keep-Alive\",\"host\":\"<HONEYPOT>:30000\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/remote/login?lang=en","summary":"","payload_hex":"474554202f72656d6f74652f6c6f67696e3f6c616e673d656e20485454502f312e310d0a486f73743a20<HONEYPOT>3a33303030300d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a204b6565702d416c6976650d0a0d0a","method":"GET","user_agent":"","ja3":"4d5efa96609dc906f796e63cff009c2a","session":"0f64e174-f5fd-47a3-8a1c-8c1da9a24c96","seq":1,"duration_ms":101,"bytes_in":111,"bytes_out":77},{"timestamp":"2026-10-24T03:59:59","port":39999,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:39999\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/remote/login?lang=en","summary":"","payload_hex":"474554202f72656d6f74652f6c6f67696e3f6c616e673d656e20485454502f312e310d0a486f73743a20<HONEYPOT>3a33393939390d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"","ja3":"4d5efa96609dc906f796e63cff009c2a","session":"3fc83493-e19e-4d2e-bb6e-12b8de3eec02","seq":1,"duration_ms":103,"bytes_in":88,"bytes_out":77},{"timestamp":"2026-10-24T03:59:55","port":39999,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"Keep-Alive\",\"host\":\"<HONEYPOT>:39999\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/remote/login?lang=en","summary":"","payload_hex":"474554202f72656d6f74652f6c6f67696e3f6c616e673d656e20485454502f312e310d0a486f73743a20<HONEYPOT>3a33393939390d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a204b6565702d416c6976650d0a0d0a","method":"GET","user_agent":"","ja3":"4d5efa96609dc906f796e63cff009c2a","session":"f4e740a3-6fc7-4bcf-bd44-79a951c7ca39","seq":1,"duration_ms":102,"bytes_in":112,"bytes_out":77}],"http_methods":[{"method":"GET","count":113}],"distinct_ports_total":38,"top_paths":[{"path":"/remote/login?lang=en","count":111,"ports":38},{"path":"/remote/login","count":2,"ports":1}],"distinct_paths_total":2,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept-Encoding","Connection","Host"],"representative":[{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Connection","value":"Keep-Alive","notable":false},{"name":"Host","value":"<HONEYPOT>:49999","notable":false}],"distinct_sets":2,"events_with_headers":10},"tags":[]}