{"ip":"165.227.20.212","total_events":33,"verdict":{"verdict":"probing","label":"Low-level probing","detail":null,"confidence":"low","network_type":"CDN","why":["33 event(s), fewer than 10 distinct ports, no exploit payloads.","Not in any known-scanner range.","Sent 4,107 bytes despite few ports and no known exploit path: focused interaction with one service, worth a look."],"engagement":{"level":"payload","label":"Sustained payload","detail":"4,107 bytes sent","bytes_sent":4107,"session_seconds":0,"persistent":false}},"first_seen":"2026-04-21T05:06:59","last_seen":"2026-07-31T22:16:48","events_24h":1,"events_7d":5,"geo":{"country_code":"US","country_name":"United States","region":"California","city":"Santa Clara","lat":37.3486,"lon":-121.9732,"asn":14061,"org":"DigitalOcean, LLC"},"source_domain":"sneakyspin.com","known_scanners":[],"scanner_tag":{"key":"peeringdb:as14061","label":"DigitalOcean","category":"cdn","url":"https://www.peeringdb.com/asn/14061"},"cve_matches":[],"malware":[],"top_ports":[{"port":80,"proto":"tcp","label":"HTTP","count":18},{"port":443,"proto":"tcp","label":"HTTPS","count":15}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i131000_f57a46bbacb6_ab7e3b40a677"],"tls_ja3":["2196848d251b217de8b2c037e356c11d"],"ja4h":["ge11nn0400_17292dadbc7b"]},"fingerprint_peers":{"t13i131000_f57a46bbacb6_ab7e3b40a677":5763,"ge11nn0400_17292dadbc7b":626},"user_agents":["Mozilla/5.0 (compatible; Scanner/1.0)"],"timeline":[{"date":"2026-06-05","count":2},{"date":"2026-06-07","count":4},{"date":"2026-06-25","count":2},{"date":"2026-06-27","count":4},{"date":"2026-06-29","count":2},{"date":"2026-07-02","count":4},{"date":"2026-07-13","count":2},{"date":"2026-07-16","count":2},{"date":"2026-07-18","count":4},{"date":"2026-07-26","count":2},{"date":"2026-07-29","count":2},{"date":"2026-07-31","count":1}],"recent_events":[{"timestamp":"2026-07-31T22:16:48","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"close\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (compatible; Scanner/1.0)\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/.git/config","summary":"","payload_hex":"474554202f2e6769742f636f6e66696720485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b205363616e6e65722f312e30290d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; Scanner/1.0)","ja3":"","session":"e75204ea-67f6-411e-896e-f88cd617e8fa","seq":1,"duration_ms":100,"bytes_in":133,"bytes_out":79},{"timestamp":"2026-07-29T14:46:21","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"close\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (compatible; Scanner/1.0)\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/.git/config","summary":"","payload_hex":"474554202f2e6769742f636f6e66696720485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b205363616e6e65722f312e30290d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; Scanner/1.0)","ja3":"2196848d251b217de8b2c037e356c11d","session":"dfd11f20-7050-4f62-bd8c-00a38e2a1c33","seq":1,"duration_ms":101,"bytes_in":133,"bytes_out":79},{"timestamp":"2026-07-29T14:46:20","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"close\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (compatible; Scanner/1.0)\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/.git/config","summary":"","payload_hex":"474554202f2e6769742f636f6e66696720485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b205363616e6e65722f312e30290d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; Scanner/1.0)","ja3":"","session":"5135dec2-ea9b-4bd5-ae92-15630ab76a88","seq":1,"duration_ms":100,"bytes_in":133,"bytes_out":79},{"timestamp":"2026-07-26T11:20:14","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"close\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (compatible; Scanner/1.0)\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/.git/config","summary":"","payload_hex":"474554202f2e6769742f636f6e66696720485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b205363616e6e65722f312e30290d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; Scanner/1.0)","ja3":"2196848d251b217de8b2c037e356c11d","session":"d957486b-4bbf-47d9-ac92-b4b47d44f036","seq":1,"duration_ms":105,"bytes_in":133,"bytes_out":79},{"timestamp":"2026-07-26T11:20:13","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"close\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (compatible; Scanner/1.0)\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/.git/config","summary":"","payload_hex":"474554202f2e6769742f636f6e66696720485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b205363616e6e65722f312e30290d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; Scanner/1.0)","ja3":"","session":"a9a93aad-4310-4ef0-9149-4e5d00028465","seq":1,"duration_ms":100,"bytes_in":133,"bytes_out":79},{"timestamp":"2026-07-18T17:29:11","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"close\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (compatible; Scanner/1.0)\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/.git/config","summary":"","payload_hex":"474554202f2e6769742f636f6e66696720485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b205363616e6e65722f312e30290d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; Scanner/1.0)","ja3":"2196848d251b217de8b2c037e356c11d","session":"e9f5b06e-658d-47c4-b9f6-5192c2351c0a","seq":1,"duration_ms":109,"bytes_in":132,"bytes_out":79},{"timestamp":"2026-07-18T17:29:10","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"close\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (compatible; Scanner/1.0)\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/.git/config","summary":"","payload_hex":"474554202f2e6769742f636f6e66696720485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b205363616e6e65722f312e30290d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; Scanner/1.0)","ja3":"2196848d251b217de8b2c037e356c11d","session":"bd12efbd-cda8-4d37-bfc3-176f694d3cb0","seq":1,"duration_ms":101,"bytes_in":132,"bytes_out":79},{"timestamp":"2026-07-18T17:29:10","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"close\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (compatible; Scanner/1.0)\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/.git/config","summary":"","payload_hex":"474554202f2e6769742f636f6e66696720485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b205363616e6e65722f312e30290d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; Scanner/1.0)","ja3":"","session":"9b8d3f22-70b5-4328-8336-94ae02eab3b5","seq":1,"duration_ms":101,"bytes_in":132,"bytes_out":79},{"timestamp":"2026-07-18T17:29:10","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"close\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (compatible; Scanner/1.0)\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/.git/config","summary":"","payload_hex":"474554202f2e6769742f636f6e66696720485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b205363616e6e65722f312e30290d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; Scanner/1.0)","ja3":"","session":"ea003098-c193-4302-b941-0e0cbee83408","seq":1,"duration_ms":100,"bytes_in":132,"bytes_out":79},{"timestamp":"2026-07-16T12:56:40","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"close\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (compatible; Scanner/1.0)\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/.git/config","summary":"","payload_hex":"474554202f2e6769742f636f6e66696720485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b205363616e6e65722f312e30290d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; Scanner/1.0)","ja3":"2196848d251b217de8b2c037e356c11d","session":"cfa8a294-095f-448b-8246-062766325e48","seq":1,"duration_ms":115,"bytes_in":133,"bytes_out":79}],"http_methods":[{"method":"GET","count":31}],"distinct_ports_total":2,"top_paths":[{"path":"/.git/config","count":31,"ports":2}],"distinct_paths_total":1,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","Connection","Host","User-Agent"],"representative":[{"name":"Accept","value":"*/*","notable":false},{"name":"Connection","value":"close","notable":false},{"name":"Host","value":"<HONEYPOT>","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (compatible; Scanner/1.0)","notable":false}],"distinct_sets":1,"events_with_headers":10},"tags":[],"data_as_of":"2026-08-01T18:14:14.636924+00:00"}