{"ip":"160.119.66.52","total_events":35,"verdict":{"verdict":"probing","label":"Low-level probing","detail":null,"confidence":"low","network_type":"residential ISP","why":["35 event(s), fewer than 10 distinct ports, no exploit payloads.","Not in any known-scanner range."],"engagement":{"level":"request","label":"Request traffic","detail":"3,290 bytes sent","bytes_sent":3290,"session_seconds":0,"persistent":false}},"first_seen":"2026-08-10T16:30:24","last_seen":"2026-08-15T08:07:08","events_24h":8,"events_7d":35,"geo":{"country_code":"SC","country_name":"Seychelles","region":"","city":"","lat":-4.5833,"lon":55.6667,"asn":49870,"org":"Alsycon B.V."},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as49870","label":"Alsycon AS49870","category":"isp","url":"https://www.peeringdb.com/asn/49870"},"cve_matches":[],"malware":[],"top_ports":[{"port":3001,"proto":"tcp","label":"","count":35}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[],"ja4h":[]},"fingerprint_peers":{},"user_agents":[],"timeline":[{"date":"2026-08-10","count":3},{"date":"2026-08-11","count":6},{"date":"2026-08-12","count":8},{"date":"2026-08-13","count":7},{"date":"2026-08-14","count":7},{"date":"2026-08-15","count":4}],"recent_events":[{"timestamp":"2026-08-15T08:07:08","port":3001,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"����\u0000\u0000^\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000J\u0000\u0000\u0000<HONEYPOT>\tIP\tUSER\tLOGON\tQWRtaW4=\tQWRtaW4=\t\t65536\tUTF-8\t805306367\t1\n\n\n","payload_hex":"f1f5eaf500005e0000000000000000004a000000<HONEYPOT>0949500955534552094c4f474f4e09515752746157343d09515752746157343d09093635353336095554462d380938303533303633363709310a0a0a","method":"","user_agent":"","ja3":"","session":"18065bbc-d6f4-4cc8-8292-50dd084b8146","seq":1,"duration_ms":100,"bytes_in":94,"bytes_out":13,"enriched":{"digest":"fe9f90a7e03e5b8a","strings":["<HONEYPOT>","USER","LOGON","QWRtaW4=","65536","UTF-8","805306367","^J<HONEYPOT>"]}},{"timestamp":"2026-08-15T05:39:03","port":3001,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"����\u0000\u0000^\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000J\u0000\u0000\u0000<HONEYPOT>\tIP\tUSER\tLOGON\tQWRtaW4=\tQWRtaW4=\t\t65536\tUTF-8\t805306367\t1\n\n\n","payload_hex":"f1f5eaf500005e0000000000000000004a000000<HONEYPOT>0949500955534552094c4f474f4e09515752746157343d09515752746157343d09093635353336095554462d380938303533303633363709310a0a0a","method":"","user_agent":"","ja3":"","session":"c3af660c-2352-4663-b908-69ab4cb7a921","seq":1,"duration_ms":101,"bytes_in":94,"bytes_out":13,"enriched":{"digest":"fe9f90a7e03e5b8a","strings":["<HONEYPOT>","USER","LOGON","QWRtaW4=","65536","UTF-8","805306367","^J<HONEYPOT>"]}},{"timestamp":"2026-08-15T04:12:02","port":3001,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"����\u0000\u0000^\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000J\u0000\u0000\u0000<HONEYPOT>\tIP\tUSER\tLOGON\tQWRtaW4=\tQWRtaW4=\t\t65536\tUTF-8\t805306367\t1\n\n\n","payload_hex":"f1f5eaf500005e0000000000000000004a000000<HONEYPOT>0949500955534552094c4f474f4e09515752746157343d09515752746157343d09093635353336095554462d380938303533303633363709310a0a0a","method":"","user_agent":"","ja3":"","session":"8de36b77-6a6c-42e0-956d-e8b372a4a156","seq":1,"duration_ms":101,"bytes_in":94,"bytes_out":13,"enriched":{"digest":"fe9f90a7e03e5b8a","strings":["<HONEYPOT>","USER","LOGON","QWRtaW4=","65536","UTF-8","805306367","^J<HONEYPOT>"]}},{"timestamp":"2026-08-15T02:20:18","port":3001,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"����\u0000\u0000^\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000J\u0000\u0000\u0000<HONEYPOT>\tIP\tUSER\tLOGON\tQWRtaW4=\tQWRtaW4=\t\t65536\tUTF-8\t805306367\t1\n\n\n","payload_hex":"f1f5eaf500005e0000000000000000004a000000<HONEYPOT>0949500955534552094c4f474f4e09515752746157343d09515752746157343d09093635353336095554462d380938303533303633363709310a0a0a","method":"","user_agent":"","ja3":"","session":"ba4894b2-d372-462a-ac1f-a8818761b550","seq":1,"duration_ms":100,"bytes_in":94,"bytes_out":13,"enriched":{"digest":"fe9f90a7e03e5b8a","strings":["<HONEYPOT>","USER","LOGON","QWRtaW4=","65536","UTF-8","805306367","^J<HONEYPOT>"]}},{"timestamp":"2026-08-14T22:15:27","port":3001,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"����\u0000\u0000^\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000J\u0000\u0000\u0000<HONEYPOT>\tIP\tUSER\tLOGON\tQWRtaW4=\tQWRtaW4=\t\t65536\tUTF-8\t805306367\t1\n\n\n","payload_hex":"f1f5eaf500005e0000000000000000004a000000<HONEYPOT>0949500955534552094c4f474f4e09515752746157343d09515752746157343d09093635353336095554462d380938303533303633363709310a0a0a","method":"","user_agent":"","ja3":"","session":"3f7b359f-131d-4957-9305-50301a4a5e97","seq":1,"duration_ms":100,"bytes_in":94,"bytes_out":13,"enriched":{"digest":"fe9f90a7e03e5b8a","strings":["<HONEYPOT>","USER","LOGON","QWRtaW4=","65536","UTF-8","805306367","^J<HONEYPOT>"]}},{"timestamp":"2026-08-14T19:57:23","port":3001,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"����\u0000\u0000^\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000J\u0000\u0000\u0000<HONEYPOT>\tIP\tUSER\tLOGON\tQWRtaW4=\tQWRtaW4=\t\t65536\tUTF-8\t805306367\t1\n\n\n","payload_hex":"f1f5eaf500005e0000000000000000004a000000<HONEYPOT>0949500955534552094c4f474f4e09515752746157343d09515752746157343d09093635353336095554462d380938303533303633363709310a0a0a","method":"","user_agent":"","ja3":"","session":"a3998f3f-08a5-4d7a-ba1f-5ff82ef86c05","seq":1,"duration_ms":100,"bytes_in":94,"bytes_out":13,"enriched":{"digest":"fe9f90a7e03e5b8a","strings":["<HONEYPOT>","USER","LOGON","QWRtaW4=","65536","UTF-8","805306367","^J<HONEYPOT>"]}},{"timestamp":"2026-08-14T13:41:05","port":3001,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"����\u0000\u0000^\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000J\u0000\u0000\u0000<HONEYPOT>\tIP\tUSER\tLOGON\tQWRtaW4=\tQWRtaW4=\t\t65536\tUTF-8\t805306367\t1\n\n\n","payload_hex":"f1f5eaf500005e0000000000000000004a000000<HONEYPOT>0949500955534552094c4f474f4e09515752746157343d09515752746157343d09093635353336095554462d380938303533303633363709310a0a0a","method":"","user_agent":"","ja3":"","session":"78dc4825-1dac-439c-860b-445b92abceea","seq":1,"duration_ms":100,"bytes_in":94,"bytes_out":13,"enriched":{"digest":"fe9f90a7e03e5b8a","strings":["<HONEYPOT>","USER","LOGON","QWRtaW4=","65536","UTF-8","805306367","^J<HONEYPOT>"]}},{"timestamp":"2026-08-14T13:12:51","port":3001,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"����\u0000\u0000^\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000J\u0000\u0000\u0000<HONEYPOT>\tIP\tUSER\tLOGON\tQWRtaW4=\tQWRtaW4=\t\t65536\tUTF-8\t805306367\t1\n\n\n","payload_hex":"f1f5eaf500005e0000000000000000004a000000<HONEYPOT>0949500955534552094c4f474f4e09515752746157343d09515752746157343d09093635353336095554462d380938303533303633363709310a0a0a","method":"","user_agent":"","ja3":"","session":"a5fc22a8-2fa4-4d69-9c9f-22f4b47151fb","seq":1,"duration_ms":100,"bytes_in":94,"bytes_out":13,"enriched":{"digest":"fe9f90a7e03e5b8a","strings":["<HONEYPOT>","USER","LOGON","QWRtaW4=","65536","UTF-8","805306367","^J<HONEYPOT>"]}},{"timestamp":"2026-08-14T06:53:40","port":3001,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"����\u0000\u0000^\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000J\u0000\u0000\u0000<HONEYPOT>\tIP\tUSER\tLOGON\tQWRtaW4=\tQWRtaW4=\t\t65536\tUTF-8\t805306367\t1\n\n\n","payload_hex":"f1f5eaf500005e0000000000000000004a000000<HONEYPOT>0949500955534552094c4f474f4e09515752746157343d09515752746157343d09093635353336095554462d380938303533303633363709310a0a0a","method":"","user_agent":"","ja3":"","session":"f7741fc5-bbb8-4000-9315-2539a28a6f52","seq":1,"duration_ms":100,"bytes_in":94,"bytes_out":13,"enriched":{"digest":"fe9f90a7e03e5b8a","strings":["<HONEYPOT>","USER","LOGON","QWRtaW4=","65536","UTF-8","805306367","^J<HONEYPOT>"]}},{"timestamp":"2026-08-14T03:34:34","port":3001,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"����\u0000\u0000^\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000J\u0000\u0000\u0000<HONEYPOT>\tIP\tUSER\tLOGON\tQWRtaW4=\tQWRtaW4=\t\t65536\tUTF-8\t805306367\t1\n\n\n","payload_hex":"f1f5eaf500005e0000000000000000004a000000<HONEYPOT>0949500955534552094c4f474f4e09515752746157343d09515752746157343d09093635353336095554462d380938303533303633363709310a0a0a","method":"","user_agent":"","ja3":"","session":"a16e559a-63e0-45d9-a47c-85714a8f4d93","seq":1,"duration_ms":100,"bytes_in":94,"bytes_out":13,"enriched":{"digest":"fe9f90a7e03e5b8a","strings":["<HONEYPOT>","USER","LOGON","QWRtaW4=","65536","UTF-8","805306367","^J<HONEYPOT>"]}}],"http_methods":[],"distinct_ports_total":1,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-08-15T08:45:47.323726+00:00"}