{"ip":"158.94.211.70","total_events":104,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"25+ ports swept","confidence":"medium","network_type":null,"why":["No exploit payloads observed.","Swept 25 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"22,244 bytes sent","bytes_sent":22244,"session_seconds":0,"persistent":false}},"first_seen":"2026-09-07T17:07:20","last_seen":"2026-09-18T15:06:14","events_24h":0,"events_7d":0,"geo":{"country_code":"NL","country_name":"The Netherlands","region":"South Holland","city":"Rotterdam","lat":51.9179,"lon":4.4901,"asn":202412,"org":"Omegatech LTD"},"source_domain":null,"known_scanners":[],"scanner_tag":null,"cve_matches":[],"malware":[],"top_ports":[{"port":12443,"proto":"tcp","label":"","count":8},{"port":10443,"proto":"tcp","label":"","count":5},{"port":5443,"proto":"tcp","label":"","count":5},{"port":8443,"proto":"tcp","label":"HTTPS-alt","count":5},{"port":18443,"proto":"tcp","label":"","count":5},{"port":9443,"proto":"tcp","label":"","count":4},{"port":7443,"proto":"tcp","label":"","count":4},{"port":1443,"proto":"tcp","label":"","count":4},{"port":6443,"proto":"tcp","label":"k8s API","count":4},{"port":20443,"proto":"tcp","label":"","count":4},{"port":4443,"proto":"tcp","label":"","count":4},{"port":13443,"proto":"tcp","label":"","count":4},{"port":443,"proto":"tcp","label":"HTTPS","count":4},{"port":65443,"proto":"tcp","label":"","count":4},{"port":3443,"proto":"tcp","label":"","count":4}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i1410h1_cbb2034c60b8_e7c285222651","t13i1810h1_e8a523a41297_e7c285222651"],"tls_client_hello":"","tls_ja3":["b625eeea88c81fdb728f44fd7c10e710","4b5262fbeaaa013d0f561ff2b8fccfa6"],"http_akin":[]},"fingerprint_peers":{"t13i1410h1_cbb2034c60b8_e7c285222651":2,"t13i1810h1_e8a523a41297_e7c285222651":1},"akin_families":{},"user_agents":["Mozilla/5.0 (compatible; simplehelp-scan/1.0)","Mozilla/5.0 (compatible; ncentral-scan/1.0)","Mozilla/5.0"],"timeline":[{"date":"2026-09-07","count":8},{"date":"2026-09-16","count":4},{"date":"2026-09-17","count":49},{"date":"2026-09-18","count":43}],"recent_events":[{"timestamp":"2026-09-18T15:06:14","port":7443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"text/html,application/xhtml+xml;q=0.9,*/*;q=0.8\",\"accept-language\":\"en-US,en;q=0.5\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:7443\",\"user-agent\":\"Mozilla/5.0 (compatible; simplehelp-scan/1.0)\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"/welcome","summary":"","payload_hex":"474554202f77656c636f6d6520485454502f312e310d0a486f73743a20<HONEYPOT>3a373434330d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b2073696d706c6568656c702d7363616e2f312e30290d0a4163636570743a20746578742f68746d6c2c6170706c69636174696f6e2f7868746d6c2b786d6c3b713d302e392c2a2f2a3b713d302e380d0a4163636570742d4c616e67756167653a20656e2d55532c656e3b713d302e350d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; simplehelp-scan/1.0)","ja3":"4b5262fbeaaa013d0f561ff2b8fccfa6","session":"22271fa5-4f68-4ca4-a2cd-b696c3c60f85","seq":1,"duration_ms":100,"bytes_in":218,"bytes_out":78},{"timestamp":"2026-09-18T15:05:02","port":4443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"text/html,application/xhtml+xml;q=0.9,*/*;q=0.8\",\"accept-language\":\"en-US,en;q=0.5\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:4443\",\"user-agent\":\"Mozilla/5.0 (compatible; simplehelp-scan/1.0)\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"/welcome","summary":"","payload_hex":"474554202f77656c636f6d6520485454502f312e310d0a486f73743a20<HONEYPOT>3a343434330d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b2073696d706c6568656c702d7363616e2f312e30290d0a4163636570743a20746578742f68746d6c2c6170706c69636174696f6e2f7868746d6c2b786d6c3b713d302e392c2a2f2a3b713d302e380d0a4163636570742d4c616e67756167653a20656e2d55532c656e3b713d302e350d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; simplehelp-scan/1.0)","ja3":"4b5262fbeaaa013d0f561ff2b8fccfa6","session":"80915244-ddea-414d-a911-d924dc22989b","seq":1,"duration_ms":100,"bytes_in":218,"bytes_out":78},{"timestamp":"2026-09-18T14:54:38","port":7443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"text/html,application/xhtml+xml;q=0.9,*/*;q=0.8\",\"accept-language\":\"en-US,en;q=0.5\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:7443\",\"user-agent\":\"Mozilla/5.0 (compatible; simplehelp-scan/1.0)\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"/welcome","summary":"","payload_hex":"474554202f77656c636f6d6520485454502f312e310d0a486f73743a20<HONEYPOT>3a373434330d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b2073696d706c6568656c702d7363616e2f312e30290d0a4163636570743a20746578742f68746d6c2c6170706c69636174696f6e2f7868746d6c2b786d6c3b713d302e392c2a2f2a3b713d302e380d0a4163636570742d4c616e67756167653a20656e2d55532c656e3b713d302e350d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; simplehelp-scan/1.0)","ja3":"4b5262fbeaaa013d0f561ff2b8fccfa6","session":"682079dc-4646-4e22-810e-0a4955720e55","seq":1,"duration_ms":100,"bytes_in":218,"bytes_out":78},{"timestamp":"2026-09-18T14:51:49","port":6443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"text/html,application/xhtml+xml;q=0.9,*/*;q=0.8\",\"accept-language\":\"en-US,en;q=0.5\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:6443\",\"user-agent\":\"Mozilla/5.0 (compatible; simplehelp-scan/1.0)\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"/welcome","summary":"","payload_hex":"474554202f77656c636f6d6520485454502f312e310d0a486f73743a20<HONEYPOT>3a363434330d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b2073696d706c6568656c702d7363616e2f312e30290d0a4163636570743a20746578742f68746d6c2c6170706c69636174696f6e2f7868746d6c2b786d6c3b713d302e392c2a2f2a3b713d302e380d0a4163636570742d4c616e67756167653a20656e2d55532c656e3b713d302e350d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; simplehelp-scan/1.0)","ja3":"4b5262fbeaaa013d0f561ff2b8fccfa6","session":"729edd57-3288-4fed-99c5-f51acd978096","seq":1,"duration_ms":100,"bytes_in":218,"bytes_out":78},{"timestamp":"2026-09-18T14:50:27","port":19443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"text/html,application/xhtml+xml;q=0.9,*/*;q=0.8\",\"accept-language\":\"en-US,en;q=0.5\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:19443\",\"user-agent\":\"Mozilla/5.0 (compatible; simplehelp-scan/1.0)\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"/welcome","summary":"","payload_hex":"474554202f77656c636f6d6520485454502f312e310d0a486f73743a20<HONEYPOT>3a31393434330d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b2073696d706c6568656c702d7363616e2f312e30290d0a4163636570743a20746578742f68746d6c2c6170706c69636174696f6e2f7868746d6c2b786d6c3b713d302e392c2a2f2a3b713d302e380d0a4163636570742d4c616e67756167653a20656e2d55532c656e3b713d302e350d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; simplehelp-scan/1.0)","ja3":"4b5262fbeaaa013d0f561ff2b8fccfa6","session":"71b199aa-fd9f-4370-9aac-ef4be3710b6b","seq":1,"duration_ms":100,"bytes_in":219,"bytes_out":78},{"timestamp":"2026-09-18T14:44:16","port":18443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"text/html,application/xhtml+xml;q=0.9,*/*;q=0.8\",\"accept-language\":\"en-US,en;q=0.5\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:18443\",\"user-agent\":\"Mozilla/5.0 (compatible; simplehelp-scan/1.0)\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"/welcome","summary":"","payload_hex":"474554202f77656c636f6d6520485454502f312e310d0a486f73743a20<HONEYPOT>3a31383434330d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b2073696d706c6568656c702d7363616e2f312e30290d0a4163636570743a20746578742f68746d6c2c6170706c69636174696f6e2f7868746d6c2b786d6c3b713d302e392c2a2f2a3b713d302e380d0a4163636570742d4c616e67756167653a20656e2d55532c656e3b713d302e350d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; simplehelp-scan/1.0)","ja3":"4b5262fbeaaa013d0f561ff2b8fccfa6","session":"f9e2f772-739d-4f91-8140-5ce46c50672e","seq":1,"duration_ms":100,"bytes_in":219,"bytes_out":78},{"timestamp":"2026-09-18T14:37:47","port":3443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"text/html,application/xhtml+xml;q=0.9,*/*;q=0.8\",\"accept-language\":\"en-US,en;q=0.5\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:3443\",\"user-agent\":\"Mozilla/5.0 (compatible; simplehelp-scan/1.0)\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"/welcome","summary":"","payload_hex":"474554202f77656c636f6d6520485454502f312e310d0a486f73743a20<HONEYPOT>3a333434330d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b2073696d706c6568656c702d7363616e2f312e30290d0a4163636570743a20746578742f68746d6c2c6170706c69636174696f6e2f7868746d6c2b786d6c3b713d302e392c2a2f2a3b713d302e380d0a4163636570742d4c616e67756167653a20656e2d55532c656e3b713d302e350d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; simplehelp-scan/1.0)","ja3":"4b5262fbeaaa013d0f561ff2b8fccfa6","session":"fcd8086a-90be-4900-8c14-84a2eb5d67b7","seq":1,"duration_ms":100,"bytes_in":218,"bytes_out":78},{"timestamp":"2026-09-18T14:24:26","port":16443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"text/html,application/xhtml+xml;q=0.9,*/*;q=0.8\",\"accept-language\":\"en-US,en;q=0.5\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:16443\",\"user-agent\":\"Mozilla/5.0 (compatible; simplehelp-scan/1.0)\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"/welcome","summary":"","payload_hex":"474554202f77656c636f6d6520485454502f312e310d0a486f73743a20<HONEYPOT>3a31363434330d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b2073696d706c6568656c702d7363616e2f312e30290d0a4163636570743a20746578742f68746d6c2c6170706c69636174696f6e2f7868746d6c2b786d6c3b713d302e392c2a2f2a3b713d302e380d0a4163636570742d4c616e67756167653a20656e2d55532c656e3b713d302e350d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; simplehelp-scan/1.0)","ja3":"4b5262fbeaaa013d0f561ff2b8fccfa6","session":"b39336b8-58ad-4dc3-8711-d23e091b5cee","seq":1,"duration_ms":100,"bytes_in":219,"bytes_out":78},{"timestamp":"2026-09-18T14:23:54","port":6443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"text/html,application/xhtml+xml;q=0.9,*/*;q=0.8\",\"accept-language\":\"en-US,en;q=0.5\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:6443\",\"user-agent\":\"Mozilla/5.0 (compatible; simplehelp-scan/1.0)\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"/welcome","summary":"","payload_hex":"474554202f77656c636f6d6520485454502f312e310d0a486f73743a20<HONEYPOT>3a363434330d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b2073696d706c6568656c702d7363616e2f312e30290d0a4163636570743a20746578742f68746d6c2c6170706c69636174696f6e2f7868746d6c2b786d6c3b713d302e392c2a2f2a3b713d302e380d0a4163636570742d4c616e67756167653a20656e2d55532c656e3b713d302e350d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; simplehelp-scan/1.0)","ja3":"4b5262fbeaaa013d0f561ff2b8fccfa6","session":"81982788-41b2-4440-9f84-bd4471c0254b","seq":1,"duration_ms":100,"bytes_in":218,"bytes_out":78},{"timestamp":"2026-09-18T14:02:22","port":16443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"text/html,application/xhtml+xml;q=0.9,*/*;q=0.8\",\"accept-language\":\"en-US,en;q=0.5\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:16443\",\"user-agent\":\"Mozilla/5.0 (compatible; simplehelp-scan/1.0)\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"/welcome","summary":"","payload_hex":"474554202f77656c636f6d6520485454502f312e310d0a486f73743a20<HONEYPOT>3a31363434330d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b2073696d706c6568656c702d7363616e2f312e30290d0a4163636570743a20746578742f68746d6c2c6170706c69636174696f6e2f7868746d6c2b786d6c3b713d302e392c2a2f2a3b713d302e380d0a4163636570742d4c616e67756167653a20656e2d55532c656e3b713d302e350d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; simplehelp-scan/1.0)","ja3":"4b5262fbeaaa013d0f561ff2b8fccfa6","session":"f7362abe-02c3-4f9e-8506-af31b433781f","seq":1,"duration_ms":101,"bytes_in":219,"bytes_out":78}],"http_methods":[{"method":"GET","count":100},{"method":"POST","count":4}],"distinct_ports_total":25,"top_paths":[{"path":"/login","count":51,"ports":23},{"path":"/welcome","count":45,"ports":23},{"path":"/user","count":4,"ports":2},{"path":"/app?service=direct/1/Home/UserList/$QuickFind.$Form","count":4,"ports":2}],"distinct_paths_total":4,"top_snis":[],"top_hosts":[],"top_alpns":[{"value":"http/1.1","count":96}],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","Accept-Language","Connection","Host","User-Agent"],"representative":[{"name":"Accept","value":"text/html,application/xhtml+xml;q=0.9,*/*;q=0.8","notable":false},{"name":"Accept-Language","value":"en-US,en;q=0.5","notable":false},{"name":"Connection","value":"close","notable":false},{"name":"Host","value":"<HONEYPOT>:7443","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (compatible; simplehelp-scan/1.0)","notable":false}],"distinct_sets":1,"events_with_headers":10},"tags":[],"data_as_of":"2026-09-25T15:58:14.727143+00:00"}