{"ip":"160.119.71.9","total_events":23,"verdict":{"verdict":"probing","label":"Low-level probing","detail":null,"confidence":"low","network_type":"residential ISP","why":["23 event(s), fewer than 10 distinct ports, no exploit payloads.","Not in any known-scanner range."]},"first_seen":"2026-06-29T02:57:31","last_seen":"2026-07-14T02:11:44","events_24h":0,"events_7d":0,"geo":{"country_code":"SC","country_name":"Seychelles","region":"","city":"","lat":-4.5833,"lon":55.6667,"asn":49870,"org":"Alsycon B.V."},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as49870","label":"Alsycon AS49870","category":"isp","url":"https://www.peeringdb.com/asn/49870"},"cve_matches":[],"malware":[],"top_ports":[{"port":3001,"proto":"tcp","label":"","count":12},{"port":80,"proto":"tcp","label":"HTTP","count":11}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[],"ja4h":["ge11nn0500_b61ccdd104e0"]},"fingerprint_peers":{"ge11nn0500_b61ccdd104e0":232},"user_agents":["Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.5 Safari/605.9.17"],"timeline":[{"date":"2026-06-29","count":7},{"date":"2026-06-30","count":4},{"date":"2026-07-03","count":4},{"date":"2026-07-06","count":2},{"date":"2026-07-07","count":2},{"date":"2026-07-13","count":3},{"date":"2026-07-14","count":1}],"recent_events":[{"timestamp":"2026-07-14T02:11:44","port":3001,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"����\u0000\u0000]\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000I\u0000\u0000\u0000<HONEYPOT>\tIP\tUSER\tLOGON\tQWRtaW4=\tQWRtaW4=\t\t65536\tUTF-8\t805306367\t1\n\n\n","payload_hex":"f1f5eaf500005d00000000000000000049000000<HONEYPOT>0949500955534552094c4f474f4e09515752746157343d09515752746157343d09093635353336095554462d380938303533303633363709310a0a0a","method":"","user_agent":"","community_id":"1:4E2TRpXBiHIFAcgHkhIWoMTOAHc=","ja3":"","session":"84823edc-f28d-41f9-ae6d-90580ba3a17a","seq":1,"duration_ms":100,"bytes_in":93,"bytes_out":12,"enriched":{"digest":"a8f79b4f656473da","strings":["<HONEYPOT>","USER","LOGON","QWRtaW4=","65536","UTF-8","805306367","]I<HONEYPOT>"]}},{"timestamp":"2026-07-13T23:10:58","port":3001,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"����\u0000\u0000\\\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000H\u0000\u0000\u0000<HONEYPOT>\tIP\tUSER\tLOGON\tQWRtaW4=\tQWRtaW4=\t\t65536\tUTF-8\t805306367\t1\n\n\n","payload_hex":"f1f5eaf500005c00000000000000000048000000<HONEYPOT>0949500955534552094c4f474f4e09515752746157343d09515752746157343d09093635353336095554462d380938303533303633363709310a0a0a","method":"","user_agent":"","community_id":"1:2O6TjZ+CnM1jCFI8eZWUI9v0Gvo=","ja3":"","session":"984c7b7d-b8f2-4e84-9057-baf236cead8d","seq":1,"duration_ms":100,"bytes_in":92,"bytes_out":12,"enriched":{"digest":"60e6e089ec86366b","strings":["<HONEYPOT>","USER","LOGON","QWRtaW4=","65536","UTF-8","805306367","\\H<HONEYPOT>"]}},{"timestamp":"2026-07-13T17:58:34","port":3001,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"����\u0000\u0000\\\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000H\u0000\u0000\u0000<HONEYPOT>\tIP\tUSER\tLOGON\tQWRtaW4=\tQWRtaW4=\t\t65536\tUTF-8\t805306367\t1\n\n\n","payload_hex":"f1f5eaf500005c00000000000000000048000000<HONEYPOT>0949500955534552094c4f474f4e09515752746157343d09515752746157343d09093635353336095554462d380938303533303633363709310a0a0a","method":"","user_agent":"","community_id":"1:dYYytpOCLCSdGcuJ/jwlTym3y20=","ja3":"","session":"35b67303-2282-4b7b-86d1-0211124c91f7","seq":1,"duration_ms":100,"bytes_in":92,"bytes_out":12,"enriched":{"digest":"60e6e089ec86366b","strings":["<HONEYPOT>","USER","LOGON","QWRtaW4=","65536","UTF-8","805306367","\\H<HONEYPOT>"]}},{"timestamp":"2026-07-13T15:24:13","port":3001,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"����\u0000\u0000^\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000J\u0000\u0000\u0000<HONEYPOT>\tIP\tUSER\tLOGON\tQWRtaW4=\tQWRtaW4=\t\t65536\tUTF-8\t805306367\t1\n\n\n","payload_hex":"f1f5eaf500005e0000000000000000004a000000<HONEYPOT>0949500955534552094c4f474f4e09515752746157343d09515752746157343d09093635353336095554462d380938303533303633363709310a0a0a","method":"","user_agent":"","community_id":"1:dD3viPQaIxv7unXuviKRqSPu9iA=","ja3":"","session":"34776d52-3ab2-4f13-892b-c1fe02847d22","seq":1,"duration_ms":100,"bytes_in":94,"bytes_out":12,"enriched":{"digest":"fe9f90a7e03e5b8a","strings":["<HONEYPOT>","USER","LOGON","QWRtaW4=","65536","UTF-8","805306367","^J<HONEYPOT>"]}},{"timestamp":"2026-07-07T02:24:28","port":3001,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"����\u0000\u0000\\\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000H\u0000\u0000\u0000<HONEYPOT>\tIP\tUSER\tLOGON\tQWRtaW4=\tQWRtaW4=\t\t65536\tUTF-8\t805306367\t1\n\n\n","payload_hex":"f1f5eaf500005c00000000000000000048000000<HONEYPOT>0949500955534552094c4f474f4e09515752746157343d09515752746157343d09093635353336095554462d380938303533303633363709310a0a0a","method":"","user_agent":"","community_id":"1:Sg4wBgSiZf1MLu3HcVUZZxRWZl4=","ja3":"","session":"bc443231-d3c2-4f32-9385-ce7c13f74d9f","seq":1,"duration_ms":100,"bytes_in":92,"bytes_out":12,"enriched":{"digest":"60e6e089ec86366b","strings":["<HONEYPOT>","USER","LOGON","QWRtaW4=","65536","UTF-8","805306367","\\H<HONEYPOT>"]}},{"timestamp":"2026-07-07T00:57:08","port":3001,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"����\u0000\u0000^\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000J\u0000\u0000\u0000<HONEYPOT>\tIP\tUSER\tLOGON\tQWRtaW4=\tQWRtaW4=\t\t65536\tUTF-8\t805306367\t1\n\n\n","payload_hex":"f1f5eaf500005e0000000000000000004a000000<HONEYPOT>0949500955534552094c4f474f4e09515752746157343d09515752746157343d09093635353336095554462d380938303533303633363709310a0a0a","method":"","user_agent":"","community_id":"1:yvHE20W+gBsteHQTiJKVOwkFEjQ=","ja3":"","session":"78dacfc8-03a4-461e-a328-14e4ffc0dac1","seq":1,"duration_ms":100,"bytes_in":94,"bytes_out":12,"enriched":{"digest":"fe9f90a7e03e5b8a","strings":["<HONEYPOT>","USER","LOGON","QWRtaW4=","65536","UTF-8","805306367","^J<HONEYPOT>"]}},{"timestamp":"2026-07-06T19:29:52","port":3001,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"����\u0000\u0000]\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000I\u0000\u0000\u0000<HONEYPOT>\tIP\tUSER\tLOGON\tQWRtaW4=\tQWRtaW4=\t\t65536\tUTF-8\t805306367\t1\n\n\n","payload_hex":"f1f5eaf500005d00000000000000000049000000<HONEYPOT>0949500955534552094c4f474f4e09515752746157343d09515752746157343d09093635353336095554462d380938303533303633363709310a0a0a","method":"","user_agent":"","community_id":"1:GUWM1UN93nDHIPpZ22wIV8VEDDM=","ja3":"","session":"993f67af-c292-4bff-9d4d-f041475a71bb","seq":1,"duration_ms":100,"bytes_in":93,"bytes_out":12,"enriched":{"digest":"a8f79b4f656473da","strings":["<HONEYPOT>","USER","LOGON","QWRtaW4=","65536","UTF-8","805306367","]I<HONEYPOT>"]}},{"timestamp":"2026-07-06T16:40:33","port":3001,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"����\u0000\u0000\\\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000H\u0000\u0000\u0000<HONEYPOT>\tIP\tUSER\tLOGON\tQWRtaW4=\tQWRtaW4=\t\t65536\tUTF-8\t805306367\t1\n\n\n","payload_hex":"f1f5eaf500005c00000000000000000048000000<HONEYPOT>0949500955534552094c4f474f4e09515752746157343d09515752746157343d09093635353336095554462d380938303533303633363709310a0a0a","method":"","user_agent":"","community_id":"1:GyF+EMulXB6xE4M3vMJ4KnwYcH4=","ja3":"","session":"92e296b9-3858-41d0-95d3-b39c88573dc1","seq":1,"duration_ms":100,"bytes_in":92,"bytes_out":12,"enriched":{"digest":"60e6e089ec86366b","strings":["<HONEYPOT>","USER","LOGON","QWRtaW4=","65536","UTF-8","805306367","\\H<HONEYPOT>"]}},{"timestamp":"2026-07-03T16:43:53","port":3001,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"����\u0000\u0000^\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000J\u0000\u0000\u0000<HONEYPOT>\tIP\tUSER\tLOGON\tQWRtaW4=\tQWRtaW4=\t\t65536\tUTF-8\t805306367\t1\n\n\n","payload_hex":"f1f5eaf500005e0000000000000000004a000000<HONEYPOT>0949500955534552094c4f474f4e09515752746157343d09515752746157343d09093635353336095554462d380938303533303633363709310a0a0a","method":"","user_agent":"","community_id":"1:KM9TnSq9XNva3d79pnXV4dGOz1o=","ja3":"","session":"fd82c268-9841-4fe8-9423-2a0a11fb7a38","seq":1,"duration_ms":100,"bytes_in":94,"bytes_out":12,"enriched":{"digest":"fe9f90a7e03e5b8a","strings":["<HONEYPOT>","USER","LOGON","QWRtaW4=","65536","UTF-8","805306367","^J<HONEYPOT>"]}},{"timestamp":"2026-07-03T14:28:51","port":3001,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"����\u0000\u0000\\\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000H\u0000\u0000\u0000<HONEYPOT>\tIP\tUSER\tLOGON\tQWRtaW4=\tQWRtaW4=\t\t65536\tUTF-8\t805306367\t1\n\n\n","payload_hex":"f1f5eaf500005c00000000000000000048000000<HONEYPOT>0949500955534552094c4f474f4e09515752746157343d09515752746157343d09093635353336095554462d380938303533303633363709310a0a0a","method":"","user_agent":"","community_id":"1:bmYoFp35z73fxaumJyKjeY/XN0A=","ja3":"","session":"076e09a0-cd86-46c3-9cca-c3e22c3c96f7","seq":1,"duration_ms":100,"bytes_in":92,"bytes_out":12,"enriched":{"digest":"60e6e089ec86366b","strings":["<HONEYPOT>","USER","LOGON","QWRtaW4=","65536","UTF-8","805306367","\\H<HONEYPOT>"]}}],"http_methods":[{"method":"GET","count":11}],"distinct_ports_total":2,"top_paths":[{"path":"/","count":11,"ports":1}],"distinct_paths_total":1,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-07-26T00:24:34.178774+00:00"}