{"ip":"16.5.0.254","total_events":572,"verdict":{"verdict":"scanner","label":"Recognized scanner","detail":"other","confidence":"high","network_type":"CDN","why":["Source IP is in a known scanner range (other).","Known research and commercial scanners are labelled as such, not as threats."],"engagement":{"level":"payload","label":"Sustained payload","detail":"101,230 bytes sent","bytes_sent":101230,"session_seconds":40,"persistent":false}},"first_seen":"2026-09-01T23:34:59","last_seen":"2026-09-09T13:55:02","events_24h":0,"events_7d":95,"geo":{"country_code":"US","country_name":"United States","region":"","city":"","lat":37.751,"lon":-97.822,"asn":401661,"org":"EMBNEX, LLC"},"source_domain":"embnex.com","known_scanners":["other"],"scanner_tag":{"key":"peeringdb:as401661","label":"EMBNEX, LLC","category":"cdn","url":"https://www.peeringdb.com/asn/401661"},"cve_matches":[],"malware":[],"top_ports":[{"port":23456,"proto":"tcp","label":"","count":20},{"port":45678,"proto":"tcp","label":"","count":20},{"port":8001,"proto":"tcp","label":"","count":15},{"port":65535,"proto":"tcp","label":"","count":15},{"port":12345,"proto":"tcp","label":"","count":10},{"port":34567,"proto":"tcp","label":"","count":10},{"port":49664,"proto":"tcp","label":"","count":6},{"port":554,"proto":"tcp","label":"","count":6},{"port":27017,"proto":"tcp","label":"MongoDB","count":6},{"port":40003,"proto":"tcp","label":"","count":6},{"port":111,"proto":"tcp","label":"RPC","count":6},{"port":56789,"proto":"tcp","label":"","count":5},{"port":54321,"proto":"tcp","label":"","count":5},{"port":6380,"proto":"tcp","label":"","count":4},{"port":465,"proto":"tcp","label":"SMTPS","count":4}],"fingerprints":{"ssh_hassh":["f25b2be37ce355c4c168981965c843bf"],"tls_ja4":["t13i100900_61a7ad8aa9b6_cb8fff09048f"],"tls_ja3":["7997bb502ef83ef1447a856e2d3895dd","ea2fbfcbc0b3510d2c81478d66b62f9b","70d42339aaf711d271988323bcee1dfa","5dd26ee3cfb4aed4f51cc3fa79728fce"],"ja4h":["ge11nn0400_17292dadbc7b"]},"fingerprint_peers":{"t13i100900_61a7ad8aa9b6_cb8fff09048f":93,"ge11nn0400_17292dadbc7b":1463,"f25b2be37ce355c4c168981965c843bf":52},"user_agents":["Mozilla/5.0 (compatible; FlowIQ/1.0; +https://flowiq-labs.com/scanning-info)"],"timeline":[{"date":"2026-09-01","count":75},{"date":"2026-09-02","count":264},{"date":"2026-09-03","count":138},{"date":"2026-09-08","count":82},{"date":"2026-09-09","count":13}],"recent_events":[{"timestamp":"2026-09-09T13:55:02","port":8082,"proto":"tcp","app_proto":"","app_protocol":"socks5","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0005\u0001\u0000","payload_hex":"050100","method":"","user_agent":"","ja3":"","session":"9c839b80-7989-4a89-bbd2-bcb2804def78","seq":1,"duration_ms":103,"bytes_in":3,"bytes_out":10,"enriched":{"digest":"11c52e4743758a8a","label":"SOCKS5"}},{"timestamp":"2026-09-09T13:55:02","port":8082,"proto":"tcp","app_proto":"","app_protocol":"http","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"OPTIONS sip:<HONEYPOT>:8082 SIP/2.0\r\nVia: SIP/2.0/TCP <HONEYPOT>:8082;branch=z9hG4bK22945f1d\r\nMax-Forwards: 70\r\nFrom: <sip:scanner@<HONEYPOT>>;tag=22945f1d\r\nTo: <sip:<HONEYPOT>:8082>\r\nCall-ID: 22945f1d@<HONEYPOT>\r\nCSeq: 1 OPTIONS\r\nContact: <sip:scanner@<HONEYPOT>:8082>\r\nAccept: application/sdp\r\nContent-Length: 0\r\n\r\n","payload_hex":"4f5054494f4e53207369703a<HONEYPOT>3a38303832205349502f322e300d0a5669613a205349502f322e302f54435020<HONEYPOT>3a383038323b6272616e63683d7a39684734624b32323934356631640d0a4d61782d466f7277617264733a2037300d0a46726f6d3a203c7369703a7363616e6e657240<HONEYPOT>3e3b7461673d32323934356631640d0a546f3a203c7369703a<HONEYPOT>3a383038323e0d0a43616c6c2d49443a20323239343566316440<HONEYPOT>0d0a435365713a2031204f5054494f4e530d0a436f6e746163743a203c7369703a7363616e6e657240<HONEYPOT>3a383038323e0d0a4163636570743a206170706c69636174696f6e2f7364700d0a436f6e74656e742d4c656e6774683a20300d0a0d0a","method":"","user_agent":"","ja3":"","session":"a04d350b-24d8-4ca4-8c0c-6ac89295e232","seq":1,"duration_ms":102,"bytes_in":329,"bytes_out":75,"enriched":{"digest":"58068faadb1a709f","label":"HTTP","strings":["OPTIONS sip:<HONEYPOT>:8082 SIP/2.0","Via: SIP/2.0/TCP <HONEYPOT>:8082;branch=z9hG4bK22945f1d","Max-Forwards: 70","From: <sip:scanner@<HONEYPOT>>;tag=22945f1d","To: <sip:<HONEYPOT>:8082>","Call-ID: 22945f1d@<HONEYPOT>","CSeq: 1 OPTIONS","Contact: <sip:scanner@<HONEYPOT>:8082>","Accept: application/sdp","Content-Length: 0"],"iocs":{"paths":["/2.0/TCP"]}}},{"timestamp":"2026-09-09T13:55:02","port":8082,"proto":"tcp","app_proto":"","app_protocol":"cassandra","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0004\u0001\u0000P\u0001\u0001\u0001\u0001\u0000","payload_hex":"040100500101010100","method":"","user_agent":"","ja3":"","session":"0dc456ec-8aec-410e-82ee-a73967d2a7ae","seq":1,"duration_ms":101,"bytes_in":9,"bytes_out":10},{"timestamp":"2026-09-09T12:14:25","port":42069,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000�\u0003%\u0000\u0000\u0000{ \"Ret\" : 100, \"SessionID\" : \"0x0\" }\n�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000�\u0003.\u0000\u0000\u0000{ \"Name\" : \"KeepAlive\", \"SessionID\" : \"0x0\" }\n","payload_hex":"ff00000000000000000000000000f103250000007b202252657422203a203130302c202253657373696f6e494422203a202230783022207d0aff00000000000000000000000000ee032e0000007b20224e616d6522203a20224b656570416c697665222c202253657373696f6e494422203a202230783022207d0a","method":"","user_agent":"","ja3":"","session":"95c4419f-bca6-4e79-9716-4f9e67750eda","seq":1,"duration_ms":100,"bytes_in":123,"bytes_out":10,"enriched":{"digest":"0f9a492031a91047","strings":["{ \"Ret\" : 100, \"SessionID\" : \"0x0\" }","{ \"Name\" : \"KeepAlive\", \"SessionID\" : \"0x0\" }","%{ \"Ret\" : 100, \"SessionID\" : \"0x0\" }",".{ \"Name\" : \"KeepAlive\", \"SessionID\" : \"0x0\" }"]}},{"timestamp":"2026-09-09T11:30:07","port":3389,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"l\u0000\u000b\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000","payload_hex":"6c000b000000000000000000","method":"","user_agent":"","ja3":"","session":"51885445-bbd7-4dae-950f-d3a89c127040","seq":1,"duration_ms":101,"bytes_in":12,"bytes_out":10},{"timestamp":"2026-09-09T11:30:07","port":3389,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000��SMBr\u0000\u0000\u0000\u0000\u0018\u0001(\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000/K\u0000\u0000\u0000\u0000\u0000b\u0000\u0002PC NETWORK PROGRAM 1.0\u0000\u0002LANMAN1.0\u0000\u0002Windows for Workgroups 3.1a\u0000\u0002LM1.2X002\u0000\u0002LANMAN2.1\u0000\u0002NT LM 0.12\u0000","payload_hex":"00000085ff534d42720000000018012800000000000000000000000000002f4b00000000006200025043204e4554574f524b2050524f4752414d20312e3000024c414e4d414e312e30000257696e646f777320666f7220576f726b67726f75707320332e316100024c4d312e325830303200024c414e4d414e322e3100024e54204c4d20302e313200","method":"","user_agent":"","ja3":"","session":"13129433-6d29-4a71-94eb-4190d0e88203","seq":1,"duration_ms":100,"bytes_in":137,"bytes_out":10,"enriched":{"digest":"7ce9be1faa0de74b","strings":["SMBr","PC NETWORK PROGRAM 1.0","LANMAN1.0","Windows for Workgroups 3.1a","LM1.2X002","LANMAN2.1","NT LM 0.12","(/Kb"]}},{"timestamp":"2026-09-09T11:30:07","port":3389,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"head\u0003","payload_hex":"6865616403","method":"","user_agent":"","ja3":"","session":"3ec91405-8355-402e-bd3a-ba4f982608d6","seq":1,"duration_ms":100,"bytes_in":5,"bytes_out":10,"enriched":{"digest":"904b67d3a763810c","strings":["head"]}},{"timestamp":"2026-09-09T07:51:43","port":40003,"proto":"tcp","app_proto":"","app_protocol":"memcached","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"version\r\n","payload_hex":"76657273696f6e0d0a","method":"","user_agent":"","ja3":"","session":"e41208f1-43ae-4357-bebf-65ba6d6596bf","seq":1,"duration_ms":103,"bytes_in":9,"bytes_out":10,"enriched":{"digest":"d1a9b5f9ca3064cf","label":"Memcached","strings":["version"]}},{"timestamp":"2026-09-09T07:51:43","port":40003,"proto":"tcp","app_proto":"","app_protocol":"cassandra","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0003\u0000\u0000\u0013\u000e�\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u0003\u0000\u0000\u0000","payload_hex":"030000130ee0000000000100080003000000","method":"","user_agent":"","ja3":"","session":"4f86abea-4026-496c-aca9-322937808afa","seq":1,"duration_ms":101,"bytes_in":18,"bytes_out":10,"enriched":{"digest":"b2854be388f0581c","label":"TPKT / COTP (ISO-TSAP)"}},{"timestamp":"2026-09-09T07:51:43","port":40003,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u001c\u00124\u0001\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0006google\u0003com\u0000\u0000\u0001\u0000\u0001","payload_hex":"001c12340100000100000000000006676f6f676c6503636f6d0000010001","method":"","user_agent":"","ja3":"","session":"0df1ada0-d396-4e00-bb7f-5d820f4d5d9f","seq":1,"duration_ms":101,"bytes_in":30,"bytes_out":10,"enriched":{"digest":"a0c4f99c42e00627","strings":["google"]}}],"http_methods":[{"method":"GET","count":456}],"distinct_ports_total":166,"top_paths":[{"path":"/","count":313,"ports":151},{"path":"/favicon.ico","count":143,"ports":139}],"distinct_paths_total":2,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[{"value":"SSH-2.0-FlowIQ_1.0","count":3}],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-09-10T23:03:46.780231+00:00"}