{"ip":"16.5.0.240","total_events":120,"verdict":{"verdict":"scanner","label":"Recognized scanner","detail":"other","confidence":"high","network_type":"CDN","why":["Source IP is in a known scanner range (other).","Known research and commercial scanners are labelled as such, not as threats."],"engagement":{"level":"payload","label":"Sustained payload","detail":"19,655 bytes sent","bytes_sent":19655,"session_seconds":0,"persistent":false}},"first_seen":"2026-09-19T04:33:45","last_seen":"2026-09-21T17:48:11","events_24h":45,"events_7d":120,"geo":{"country_code":"BR","country_name":"Brazil","region":"São Paulo","city":"São Paulo","lat":-23.5475,"lon":-46.6361,"asn":401661,"org":"EMBNEX, LLC"},"source_domain":"embnex.com","known_scanners":["other"],"scanner_tag":{"key":"peeringdb:as401661","label":"EMBNEX, LLC","category":"cdn","url":"https://www.peeringdb.com/asn/401661"},"cve_matches":[],"malware":[],"top_ports":[{"port":6466,"proto":"tcp","label":"","count":9},{"port":1080,"proto":"tcp","label":"SOCKS","count":6},{"port":389,"proto":"tcp","label":"LDAP","count":6},{"port":25565,"proto":"tcp","label":"Minecraft","count":6},{"port":49668,"proto":"tcp","label":"","count":6},{"port":27017,"proto":"tcp","label":"MongoDB","count":6},{"port":6380,"proto":"tcp","label":"","count":4},{"port":2323,"proto":"tcp","label":"","count":4},{"port":445,"proto":"tcp","label":"SMB","count":3},{"port":9008,"proto":"tcp","label":"","count":3},{"port":443,"proto":"tcp","label":"HTTPS","count":3},{"port":49666,"proto":"tcp","label":"","count":3},{"port":26378,"proto":"tcp","label":"","count":3},{"port":6000,"proto":"tcp","label":"X11","count":3},{"port":39732,"proto":"tcp","label":"","count":3}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i100900_61a7ad8aa9b6_cb8fff09048f","t13i100900_61a7ad8aa9b6_367aa026f35a"],"tls_client_hello":"16030100db010000d703033f2407fb29708a9fc39d89ed86b1f2131a8c594fe971a267ed4f5bce5ee804d92071a87a893527fdc40ae44772991ca9934dc6aed574020a2e48a13dfee07196ea0014130213011303c02cc02bcca9c030c02fcca800ff0100007a002d00020101000a00080006001d0017001800230000003300260024001d00202a1fc76548ae99fbc85cdec9f4af0d1922444a7d0cff118ed17394472191f73b00170000000d001a0018040105010601040305030603080408050806080702010203002b00050403040303000b000201000005000501000000","tls_ja3":["60f39ed7532806acd0cb18b430327451","9d5f7e6c785dfdd81fbccc32e4618011","ccacd48676c76d12cbc65cf5ed0dd2f6","f19dfddda8475c94a4ad99c78c974943"]},"fingerprint_peers":{"t13i100900_61a7ad8aa9b6_cb8fff09048f":111,"t13i100900_61a7ad8aa9b6_367aa026f35a":65},"user_agents":["Mozilla/5.0 (compatible; FlowIQ/1.0; +https://flowiq-labs.com/scanning-info)"],"timeline":[{"date":"2026-09-19","count":9},{"date":"2026-09-21","count":111}],"recent_events":[{"timestamp":"2026-09-21T17:48:11","port":25566,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"close\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (compatible; FlowIQ/1.0; +https://flowiq-labs.com/scanning-info)\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/favicon.ico","summary":"","payload_hex":"474554202f66617669636f6e2e69636f20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b20466c6f7749512f312e303b202b68747470733a2f2f666c6f7769712d6c6162732e636f6d2f7363616e6e696e672d696e666f290d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; FlowIQ/1.0; +https://flowiq-labs.com/scanning-info)","ja3":"a2332efaf97694a98b1340a7d2beeec8","session":"27d7b803-b89d-4f9c-b3a8-1e1370e32ad7","seq":1,"duration_ms":100,"bytes_in":172,"bytes_out":75},{"timestamp":"2026-09-21T17:48:07","port":25566,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"close\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (compatible; FlowIQ/1.0; +https://flowiq-labs.com/scanning-info)\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b20466c6f7749512f312e303b202b68747470733a2f2f666c6f7769712d6c6162732e636f6d2f7363616e6e696e672d696e666f290d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; FlowIQ/1.0; +https://flowiq-labs.com/scanning-info)","ja3":"0706be8036af2e6e982c4cb51a3c11aa","session":"4ebee292-0b74-4b1f-bf2c-68ee3d99cee6","seq":1,"duration_ms":103,"bytes_in":161,"bytes_out":75},{"timestamp":"2026-09-21T17:48:04","port":25566,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"close\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (compatible; FlowIQ/1.0; +https://flowiq-labs.com/scanning-info)\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b20466c6f7749512f312e303b202b68747470733a2f2f666c6f7769712d6c6162732e636f6d2f7363616e6e696e672d696e666f290d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; FlowIQ/1.0; +https://flowiq-labs.com/scanning-info)","ja3":"","session":"a19ea107-3d9c-4f37-b490-a8c1cd4d5043","seq":1,"duration_ms":101,"bytes_in":161,"bytes_out":75},{"timestamp":"2026-09-21T17:46:19","port":389,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"185.228.81.201","headers":"{\"accept\":\"*/*\",\"connection\":\"close\",\"host\":\"185.228.81.201\",\"user-agent\":\"Mozilla/5.0 (compatible; FlowIQ/1.0; +https://flowiq-labs.com/scanning-info)\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/favicon.ico","summary":"","payload_hex":"474554202f66617669636f6e2e69636f20485454502f312e310d0a486f73743a203138352e3232382e38312e3230310d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b20466c6f7749512f312e303b202b68747470733a2f2f666c6f7769712d6c6162732e636f6d2f7363616e6e696e672d696e666f290d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; FlowIQ/1.0; +https://flowiq-labs.com/scanning-info)","ja3":"c62865ec91c9b05ea7b7fde3d3f64971","session":"c2b0d728-57c5-475d-9b71-5b89af14fa0a","seq":1,"duration_ms":100,"bytes_in":173,"bytes_out":75},{"timestamp":"2026-09-21T17:46:15","port":389,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"185.228.81.201","headers":"{\"accept\":\"*/*\",\"connection\":\"close\",\"host\":\"185.228.81.201\",\"user-agent\":\"Mozilla/5.0 (compatible; FlowIQ/1.0; +https://flowiq-labs.com/scanning-info)\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a203138352e3232382e38312e3230310d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b20466c6f7749512f312e303b202b68747470733a2f2f666c6f7769712d6c6162732e636f6d2f7363616e6e696e672d696e666f290d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; FlowIQ/1.0; +https://flowiq-labs.com/scanning-info)","ja3":"2975937768209b4b2136b2e4f22166d5","session":"6fb75136-a9c5-4221-8d38-2c3bb23a0fbe","seq":1,"duration_ms":101,"bytes_in":162,"bytes_out":75},{"timestamp":"2026-09-21T17:46:11","port":389,"proto":"tcp","app_proto":"","app_protocol":"http","host":"185.228.81.201","headers":"{\"accept\":\"*/*\",\"connection\":\"close\",\"host\":\"185.228.81.201\",\"user-agent\":\"Mozilla/5.0 (compatible; FlowIQ/1.0; +https://flowiq-labs.com/scanning-info)\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a203138352e3232382e38312e3230310d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b20466c6f7749512f312e303b202b68747470733a2f2f666c6f7769712d6c6162732e636f6d2f7363616e6e696e672d696e666f290d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; FlowIQ/1.0; +https://flowiq-labs.com/scanning-info)","ja3":"","session":"84c070f1-0769-48fb-b45c-4e60cedc16c4","seq":1,"duration_ms":100,"bytes_in":162,"bytes_out":75},{"timestamp":"2026-09-21T17:38:16","port":6380,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"close\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (compatible; FlowIQ/1.0; +https://flowiq-labs.com/scanning-info)\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b20466c6f7749512f312e303b202b68747470733a2f2f666c6f7769712d6c6162732e636f6d2f7363616e6e696e672d696e666f290d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; FlowIQ/1.0; +https://flowiq-labs.com/scanning-info)","ja3":"c28c809537ed4505f0a170e033bdee15","session":"325c3e67-8490-4285-a544-fd78d532b398","seq":1,"duration_ms":100,"bytes_in":161,"bytes_out":5},{"timestamp":"2026-09-21T17:38:13","port":6380,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"close\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (compatible; FlowIQ/1.0; +https://flowiq-labs.com/scanning-info)\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b20466c6f7749512f312e303b202b68747470733a2f2f666c6f7769712d6c6162732e636f6d2f7363616e6e696e672d696e666f290d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; FlowIQ/1.0; +https://flowiq-labs.com/scanning-info)","ja3":"","session":"5ab260c3-1655-4946-83e6-34c5ce23205d","seq":1,"duration_ms":100,"bytes_in":161,"bytes_out":5},{"timestamp":"2026-09-21T17:37:28","port":1080,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"185.228.81.201","headers":"{\"accept\":\"*/*\",\"connection\":\"close\",\"host\":\"185.228.81.201\",\"user-agent\":\"Mozilla/5.0 (compatible; FlowIQ/1.0; +https://flowiq-labs.com/scanning-info)\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/favicon.ico","summary":"","payload_hex":"474554202f66617669636f6e2e69636f20485454502f312e310d0a486f73743a203138352e3232382e38312e3230310d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b20466c6f7749512f312e303b202b68747470733a2f2f666c6f7769712d6c6162732e636f6d2f7363616e6e696e672d696e666f290d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; FlowIQ/1.0; +https://flowiq-labs.com/scanning-info)","ja3":"18ac956b17f1afc15dd6a70d9dad3bce","session":"3f940cf7-3f94-467d-9a4a-0534829fdfee","seq":1,"duration_ms":100,"bytes_in":173,"bytes_out":75},{"timestamp":"2026-09-21T17:37:24","port":1080,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"185.228.81.201","headers":"{\"accept\":\"*/*\",\"connection\":\"close\",\"host\":\"185.228.81.201\",\"user-agent\":\"Mozilla/5.0 (compatible; FlowIQ/1.0; +https://flowiq-labs.com/scanning-info)\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a203138352e3232382e38312e3230310d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b20466c6f7749512f312e303b202b68747470733a2f2f666c6f7769712d6c6162732e636f6d2f7363616e6e696e672d696e666f290d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; FlowIQ/1.0; +https://flowiq-labs.com/scanning-info)","ja3":"340fbb794767318960a51356b3081cc8","session":"5c478366-ff7b-4d1a-88ac-739e58d8fa08","seq":1,"duration_ms":100,"bytes_in":162,"bytes_out":75}],"http_methods":[{"method":"GET","count":120}],"distinct_ports_total":34,"top_paths":[{"path":"/","count":85,"ports":34},{"path":"/favicon.ico","count":35,"ports":28}],"distinct_paths_total":2,"top_snis":[],"top_hosts":[{"value":"185.228.81.201","count":15}],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","Connection","Host","User-Agent"],"representative":[{"name":"Accept","value":"*/*","notable":false},{"name":"Connection","value":"close","notable":false},{"name":"Host","value":"<HONEYPOT>","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (compatible; FlowIQ/1.0; +https://flowiq-labs.com/scanning-info)","notable":false}],"distinct_sets":1,"events_with_headers":10},"tags":[],"data_as_of":"2026-09-22T15:33:00.688632+00:00"}