{"ip":"158.94.210.5","total_events":126,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"20+ ports swept","confidence":"medium","network_type":null,"why":["No exploit payloads observed.","Swept 20 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"14,954 bytes sent","bytes_sent":14954,"session_seconds":6,"persistent":false}},"first_seen":"2026-09-14T15:56:10","last_seen":"2026-09-22T12:17:39","events_24h":6,"events_7d":98,"geo":{"country_code":"NL","country_name":"The Netherlands","region":"North Holland","city":"Amsterdam","lat":52.3716,"lon":4.8883,"asn":202412,"org":"Omegatech LTD"},"source_domain":null,"known_scanners":[],"scanner_tag":null,"cve_matches":[],"malware":[],"top_ports":[{"port":8030,"proto":"tcp","label":"","count":12},{"port":447,"proto":"tcp","label":"","count":8},{"port":449,"proto":"tcp","label":"","count":8},{"port":442,"proto":"tcp","label":"","count":8},{"port":448,"proto":"tcp","label":"","count":8},{"port":446,"proto":"tcp","label":"","count":8},{"port":10101,"proto":"tcp","label":"","count":6},{"port":1111,"proto":"tcp","label":"","count":6},{"port":9001,"proto":"tcp","label":"Tor","count":6},{"port":44343,"proto":"tcp","label":"","count":6},{"port":8855,"proto":"tcp","label":"","count":6},{"port":3333,"proto":"tcp","label":"","count":6},{"port":4445,"proto":"tcp","label":"","count":6},{"port":8444,"proto":"tcp","label":"","count":6},{"port":634,"proto":"tcp","label":"","count":6}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i220900_231e334592e8_29829a46703f"],"tls_client_hello":"16030100f1010000ed03032507a2accd1513e7bac1b9c93e9b53c4d2403f59c253827e0c44c478f4955a35204d1b0dd6dc4dcf1e7f20675372d5f91f8b51bcde3471700f37eceeaff996c1d6002c13021301c02cc02bc030c02f009f009ec024c023c028c027c00ac009c014c013009d009c003d003c0035002f01000078002b0009080304030303020301000d001a001808040805080604010501020104030503020302020601060300230000000a00080006001d00170018003300260024001d00202d4c17445032bb11564c3a0bbb3ca0cff1229faa23b27d5b4bf0760f63d4e5530031000000170000ff01000100002d000201","tls_ja3":["622a7fd6adbafa3736c1a3468db8a8e0"]},"fingerprint_peers":{"t13i220900_231e334592e8_29829a46703f":11},"user_agents":[],"timeline":[{"date":"2026-09-14","count":14},{"date":"2026-09-15","count":24},{"date":"2026-09-16","count":14},{"date":"2026-09-17","count":12},{"date":"2026-09-18","count":14},{"date":"2026-09-19","count":18},{"date":"2026-09-20","count":14},{"date":"2026-09-21","count":14},{"date":"2026-09-22","count":2}],"recent_events":[{"timestamp":"2026-09-22T12:17:39","port":11943,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:11943\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a31313934330d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"","ja3":"622a7fd6adbafa3736c1a3468db8a8e0","session":"0109148f-e460-4900-ae35-a8fcc130e138","seq":2,"duration_ms":2686,"bytes_in":158,"bytes_out":154},{"timestamp":"2026-09-22T12:17:36","port":11943,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"Keep-Alive\",\"host\":\"<HONEYPOT>:11943\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a31313934330d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a204b6565702d416c6976650d0a0d0a","method":"GET","user_agent":"","ja3":"622a7fd6adbafa3736c1a3468db8a8e0","session":"0109148f-e460-4900-ae35-a8fcc130e138","seq":1,"duration_ms":101,"bytes_in":91,"bytes_out":77},{"timestamp":"2026-09-21T19:10:19","port":9001,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:9001\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a393030310d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"","ja3":"622a7fd6adbafa3736c1a3468db8a8e0","session":"6e89029d-f0bb-488d-918b-547fa2fa64b6","seq":2,"duration_ms":1302,"bytes_in":156,"bytes_out":154},{"timestamp":"2026-09-21T19:10:18","port":9001,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"Keep-Alive\",\"host\":\"<HONEYPOT>:9001\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a393030310d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a204b6565702d416c6976650d0a0d0a","method":"GET","user_agent":"","ja3":"622a7fd6adbafa3736c1a3468db8a8e0","session":"6e89029d-f0bb-488d-918b-547fa2fa64b6","seq":1,"duration_ms":100,"bytes_in":90,"bytes_out":77},{"timestamp":"2026-09-21T16:05:42","port":9001,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:9001\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a393030310d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"","ja3":"622a7fd6adbafa3736c1a3468db8a8e0","session":"42955d6f-21b5-4f06-9476-37ec4b1ea7b7","seq":2,"duration_ms":3207,"bytes_in":156,"bytes_out":154},{"timestamp":"2026-09-21T16:05:39","port":9001,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"Keep-Alive\",\"host\":\"<HONEYPOT>:9001\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a393030310d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a204b6565702d416c6976650d0a0d0a","method":"GET","user_agent":"","ja3":"622a7fd6adbafa3736c1a3468db8a8e0","session":"42955d6f-21b5-4f06-9476-37ec4b1ea7b7","seq":1,"duration_ms":100,"bytes_in":90,"bytes_out":77},{"timestamp":"2026-09-21T15:27:31","port":9001,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"Keep-Alive\",\"host\":\"<HONEYPOT>:9001\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a393030310d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a204b6565702d416c6976650d0a0d0a","method":"GET","user_agent":"","ja3":"622a7fd6adbafa3736c1a3468db8a8e0","session":"2072608d-5247-4e92-95e5-b188967ae75e","seq":1,"duration_ms":100,"bytes_in":91,"bytes_out":77},{"timestamp":"2026-09-21T15:27:20","port":9001,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"Keep-Alive\",\"host\":\"<HONEYPOT>:9001\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a393030310d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a204b6565702d416c6976650d0a0d0a","method":"GET","user_agent":"","ja3":"622a7fd6adbafa3736c1a3468db8a8e0","session":"e720e3d6-2400-46c2-b541-2aefbe51440b","seq":1,"duration_ms":101,"bytes_in":91,"bytes_out":77},{"timestamp":"2026-09-21T11:20:54","port":44343,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:44343\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a34343334330d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"","ja3":"622a7fd6adbafa3736c1a3468db8a8e0","session":"c1a8ea23-1645-4c6d-823b-e785cfc30dcb","seq":2,"duration_ms":913,"bytes_in":160,"bytes_out":154},{"timestamp":"2026-09-21T11:20:53","port":44343,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"Keep-Alive\",\"host\":\"<HONEYPOT>:44343\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a34343334330d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a204b6565702d416c6976650d0a0d0a","method":"GET","user_agent":"","ja3":"622a7fd6adbafa3736c1a3468db8a8e0","session":"c1a8ea23-1645-4c6d-823b-e785cfc30dcb","seq":1,"duration_ms":101,"bytes_in":92,"bytes_out":77}],"http_methods":[{"method":"GET","count":126}],"distinct_ports_total":20,"top_paths":[{"path":"/","count":126,"ports":20}],"distinct_paths_total":1,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept-Encoding","Connection","Host"],"representative":[{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Connection","value":"Keep-Alive","notable":false},{"name":"Host","value":"<HONEYPOT>:11943","notable":false}],"distinct_sets":2,"events_with_headers":10},"tags":[],"data_as_of":"2026-09-22T16:04:07.654813+00:00"}