{"ip":"159.203.160.137","total_events":15,"verdict":{"verdict":"probing","label":"Low-level probing","detail":null,"confidence":"low","network_type":"CDN","why":["15 event(s), fewer than 10 distinct ports, no exploit payloads.","Not in any known-scanner range."],"engagement":{"level":"request","label":"Request traffic","detail":"691 bytes sent","bytes_sent":691,"session_seconds":0,"persistent":false}},"first_seen":"2026-08-25T07:29:38","last_seen":"2026-08-25T07:29:51","events_24h":0,"events_7d":0,"geo":{"country_code":"US","country_name":"United States","region":"New Jersey","city":"Clifton","lat":40.8364,"lon":-74.1403,"asn":14061,"org":"DigitalOcean, LLC"},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as14061","label":"DigitalOcean","category":"cdn","url":"https://www.peeringdb.com/asn/14061"},"cve_matches":[],"malware":[],"top_ports":[{"port":22,"proto":"tcp","label":"SSH","count":15}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t12d380600_1ee1e60ab64d_e51b7354d87f","t13i131000_f57a46bbacb6_ab7e3b40a677","t12d130600_2d7513195f68_e51b7354d87f"],"tls_ja3":["275a5fb82c32cc30e7e16e2df8cb6da4","20c9baf81bfe96ff89722899e75d0190","2196848d251b217de8b2c037e356c11d"],"ja4h":["ge10nn0000_000000000000","ge11nn0000_000000000000","ge11nn0300_0db47b7d240d"]},"fingerprint_peers":{"t12d380600_1ee1e60ab64d_e51b7354d87f":2,"t13i131000_f57a46bbacb6_ab7e3b40a677":5208,"t12d130600_2d7513195f68_e51b7354d87f":23,"ge10nn0000_000000000000":2367,"ge11nn0300_0db47b7d240d":4893,"ge11nn0000_000000000000":81},"user_agents":["Go-http-client/1.1","Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.3"],"timeline":[{"date":"2026-08-25","count":15}],"recent_events":[{"timestamp":"2026-08-25T07:29:51","port":22,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:22\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/favicon.ico","summary":"","payload_hex":"474554202f66617669636f6e2e69636f20485454502f312e310d0a486f73743a20<HONEYPOT>3a32320d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"2196848d251b217de8b2c037e356c11d","session":"27b26608-0760-4e8e-b47d-a6c1628c6380","seq":1,"duration_ms":100,"bytes_in":107,"bytes_out":80},{"timestamp":"2026-08-25T07:29:51","port":22,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:22\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.3\"}","body":"","sni":"<HONEYPOT>","tls_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","tls_version":"TLSv1.2","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a32320d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f35382e302e333032392e313130205361666172692f3533372e330d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.3","ja3":"20c9baf81bfe96ff89722899e75d0190","session":"b2054a13-1b65-4911-9459-f60882675850","seq":1,"duration_ms":122,"bytes_in":192,"bytes_out":80},{"timestamp":"2026-08-25T07:29:51","port":22,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"<HONEYPOT>","tls_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","tls_version":"TLSv1.2","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000��SMBr\u0000\u0000\u0000\u0000\b\u0001@\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000@\u0006\u0000\u0000\u0001\u0000\u0000�\u0000\u0002PC NETWORK PROGRAM 1.0\u0000\u0002MICROSOFT NETWORKS 1.03\u0000\u0002MICROSOFT NETWORKS 3.0\u0000\u0002LANMAN1.0\u0000\u0002LM1.2X002\u0000\u0002Samba\u0000\u0002NT LANMAN 1.0\u0000\u0002NT LM 0.12\u0000","payload_hex":"000000a4ff534d4272000000000801400000000000000000000000000000400600000100008100025043204e4554574f524b2050524f4752414d20312e3000024d4943524f534f4654204e4554574f524b5320312e303300024d4943524f534f4654204e4554574f524b5320332e3000024c414e4d414e312e3000024c4d312e3258303032000253616d626100024e54204c414e4d414e20312e3000024e54204c4d20302e313200","method":"","user_agent":"","ja3":"275a5fb82c32cc30e7e16e2df8cb6da4","session":"4d8c3e30-e36e-4f6f-8d77-f038aeff5e10","seq":1,"duration_ms":121,"bytes_in":168,"bytes_out":15,"enriched":{"digest":"517d6cf13ba58442","strings":["SMBr","PC NETWORK PROGRAM 1.0","MICROSOFT NETWORKS 1.03","MICROSOFT NETWORKS 3.0","LANMAN1.0","LM1.2X002","Samba","NT LANMAN 1.0","NT LM 0.12"]}},{"timestamp":"2026-08-25T07:29:50","port":22,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"<HONEYPOT>","tls_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","tls_version":"TLSv1.2","alpn":[],"url_path":"","summary":"HELP\r\n","payload_hex":"48454c500d0a","method":"","user_agent":"","ja3":"275a5fb82c32cc30e7e16e2df8cb6da4","session":"60515da0-0dcd-4b67-893c-475e390951d9","seq":1,"duration_ms":121,"bytes_in":6,"bytes_out":15,"enriched":{"digest":"d6616dd899abc961","strings":["HELP"]}},{"timestamp":"2026-08-25T07:29:50","port":22,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"<HONEYPOT>","tls_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","tls_version":"TLSv1.2","alpn":[],"url_path":"","summary":"�\u0000\u0000(r�\u001d\u0013\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001��\u0000\u0001�|\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000","payload_hex":"8000002872fe1d130000000000000002000186a00001977c0000000000000000000000000000000000000000","method":"","user_agent":"","ja3":"275a5fb82c32cc30e7e16e2df8cb6da4","session":"c56218b5-0378-477d-9fa6-cf6b36c65cd3","seq":1,"duration_ms":121,"bytes_in":44,"bytes_out":15},{"timestamp":"2026-08-25T07:29:49","port":22,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"","headers":"","body":"","sni":"<HONEYPOT>","tls_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","tls_version":"TLSv1.2","alpn":[],"url_path":"","summary":"OPTIONS / RTSP/1.0\r\n\r\n","payload_hex":"4f5054494f4e53202f20525453502f312e300d0a0d0a","method":"","user_agent":"","ja3":"275a5fb82c32cc30e7e16e2df8cb6da4","session":"9c3f1725-a0af-4c4b-aa5e-d1397c43ec22","seq":1,"duration_ms":120,"bytes_in":22,"bytes_out":80,"enriched":{"digest":"b6bc3f9a3eb2980d","label":"HTTP","strings":["OPTIONS / RTSP/1.0"]}},{"timestamp":"2026-08-25T07:29:48","port":22,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"","headers":"","body":"","sni":"<HONEYPOT>","tls_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","tls_version":"TLSv1.2","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a0d0a","method":"GET","user_agent":"","ja3":"275a5fb82c32cc30e7e16e2df8cb6da4","session":"0d0eece2-fac7-41d5-9f7e-3be296eeaf8e","seq":1,"duration_ms":121,"bytes_in":18,"bytes_out":80},{"timestamp":"2026-08-25T07:29:48","port":22,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"","headers":"","body":"","sni":"<HONEYPOT>","tls_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","tls_version":"TLSv1.2","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e300d0a0d0a","method":"GET","user_agent":"","ja3":"275a5fb82c32cc30e7e16e2df8cb6da4","session":"f95217dd-4a45-4ffc-a339-e2026a411f73","seq":1,"duration_ms":121,"bytes_in":18,"bytes_out":80},{"timestamp":"2026-08-25T07:29:47","port":22,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"<HONEYPOT>","tls_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","tls_version":"TLSv1.2","alpn":[],"url_path":"","summary":"\r\n\r\n","payload_hex":"0d0a0d0a","method":"","user_agent":"","ja3":"275a5fb82c32cc30e7e16e2df8cb6da4","session":"8fed9fe3-5522-43b0-aab6-60f166e803ef","seq":1,"duration_ms":121,"bytes_in":4,"bytes_out":15},{"timestamp":"2026-08-25T07:29:40","port":22,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"HELP\r\n","payload_hex":"48454c500d0a","method":"","user_agent":"","ja3":"","session":"9fc6b689-7890-4bbe-bb06-560cda616b81","seq":1,"duration_ms":100,"bytes_in":6,"bytes_out":15,"enriched":{"digest":"d6616dd899abc961","strings":["HELP"]}}],"http_methods":[{"method":"GET","count":6}],"distinct_ports_total":1,"top_paths":[{"path":"/","count":5,"ports":1},{"path":"/favicon.ico","count":1,"ports":1}],"distinct_paths_total":2,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept-Encoding","Host","User-Agent"],"representative":[{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Host","value":"<HONEYPOT>:22","notable":false},{"name":"User-Agent","value":"Go-http-client/1.1","notable":false}],"distinct_sets":1,"events_with_headers":2},"tags":[],"data_as_of":"2026-09-20T21:30:16.399695+00:00"}