{"ip":"167.88.168.121","total_events":36,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"26+ ports swept","confidence":"medium","network_type":null,"why":["No exploit payloads observed.","Swept 26 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"4,720 bytes sent","bytes_sent":4720,"session_seconds":0,"persistent":false}},"first_seen":"2026-07-19T23:36:32","last_seen":"2026-09-10T15:21:13","events_24h":1,"events_7d":8,"geo":{"country_code":"US","country_name":"United States","region":"Texas","city":"Dallas","lat":32.7212,"lon":-96.6765,"asn":14956,"org":"RouterHosting LLC"},"source_domain":"121.168.88.167.static.cloudzy.com","known_scanners":[],"scanner_tag":null,"cve_matches":[],"malware":[],"top_ports":[{"port":8082,"proto":"tcp","label":"","count":2},{"port":2376,"proto":"tcp","label":"Docker-TLS","count":2},{"port":3001,"proto":"tcp","label":"","count":2},{"port":8008,"proto":"tcp","label":"HTTP-alt","count":2},{"port":8005,"proto":"tcp","label":"","count":2},{"port":2095,"proto":"tcp","label":"","count":2},{"port":14330,"proto":"tcp","label":"","count":2},{"port":902,"proto":"tcp","label":"","count":2},{"port":9092,"proto":"tcp","label":"Kafka","count":2},{"port":80,"proto":"tcp","label":"HTTP","count":2},{"port":8003,"proto":"tcp","label":"","count":1},{"port":8001,"proto":"tcp","label":"","count":1},{"port":8090,"proto":"tcp","label":"","count":1},{"port":27018,"proto":"tcp","label":"MongoDB","count":1},{"port":7000,"proto":"tcp","label":"","count":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i1310h1_f57a46bbacb6_e7c285222651"],"tls_ja3":["faa162b5a653756fba26803ea81b362f"],"ja4h":["ge11nn0400_9c3956fad5da"]},"fingerprint_peers":{"t13i1310h1_f57a46bbacb6_e7c285222651":72,"ge11nn0400_9c3956fad5da":1572},"user_agents":["Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0"],"timeline":[{"date":"2026-07-19","count":1},{"date":"2026-07-20","count":1},{"date":"2026-08-01","count":4},{"date":"2026-08-02","count":1},{"date":"2026-08-03","count":2},{"date":"2026-08-04","count":1},{"date":"2026-08-05","count":1},{"date":"2026-08-06","count":1},{"date":"2026-08-07","count":1},{"date":"2026-08-09","count":2},{"date":"2026-08-11","count":3},{"date":"2026-08-12","count":1},{"date":"2026-08-13","count":2},{"date":"2026-08-21","count":1},{"date":"2026-08-22","count":2},{"date":"2026-08-28","count":2},{"date":"2026-09-03","count":2},{"date":"2026-09-04","count":2},{"date":"2026-09-07","count":2},{"date":"2026-09-08","count":1},{"date":"2026-09-09","count":2},{"date":"2026-09-10","count":1}],"recent_events":[{"timestamp":"2026-09-10T15:21:13","port":4000,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:4000\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a343030300d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f36343b2072763a3134302e3029204765636b6f2f32303130303130312046697265666f782f3134302e300d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0","ja3":"faa162b5a653756fba26803ea81b362f","session":"46abc8bd-df7e-4114-a0c7-38b3ad332aaf","seq":1,"duration_ms":100,"bytes_in":169,"bytes_out":79},{"timestamp":"2026-09-09T23:51:10","port":902,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\n","payload_hex":"0a","method":"","user_agent":"","ja3":"","session":"a7877b12-a229-4eba-ba8d-ed521847fd17","seq":1,"duration_ms":100,"bytes_in":1,"bytes_out":14},{"timestamp":"2026-09-09T23:41:08","port":902,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\n","payload_hex":"0a","method":"","user_agent":"","ja3":"","session":"8aea6732-86bd-4407-a7df-b111e1f5a387","seq":1,"duration_ms":100,"bytes_in":1,"bytes_out":14},{"timestamp":"2026-09-08T05:21:19","port":27018,"proto":"tcp","app_proto":"","app_protocol":"mongodb","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":":\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000�\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0013\u0000\u0000\u0000\u0010isMaster\u0000\u0001\u0000\u0000\u0000\u0000","payload_hex":"3a0000000000000000000000d40700000000000061646d696e2e24636d64000000000001000000130000001069734d6173746572000100000000","method":"","user_agent":"","ja3":"","session":"efb5065d-b43c-4de5-8e6a-a14e7748f03b","seq":1,"duration_ms":101,"bytes_in":58,"bytes_out":14,"enriched":{"digest":"71265954b8b925aa","strings":["admin.$cmd","isMaster"]}},{"timestamp":"2026-09-07T12:16:30","port":9092,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\n","payload_hex":"0a","method":"","user_agent":"","ja3":"","session":"388f8ff5-1d28-4cf3-b8bb-d963743529b7","seq":1,"duration_ms":100,"bytes_in":1,"bytes_out":14},{"timestamp":"2026-09-07T12:06:06","port":9092,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\n","payload_hex":"0a","method":"","user_agent":"","ja3":"","session":"21a8525b-5783-45a3-855c-6a782cf962ee","seq":1,"duration_ms":101,"bytes_in":1,"bytes_out":14},{"timestamp":"2026-09-04T19:38:08","port":8008,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8008\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a383030380d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f36343b2072763a3134302e3029204765636b6f2f32303130303130312046697265666f782f3134302e300d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0","ja3":"","session":"c1253a1c-e27a-4026-8baa-98ff52909b27","seq":1,"duration_ms":100,"bytes_in":169,"bytes_out":79},{"timestamp":"2026-09-04T18:55:37","port":8008,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8008\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a383030380d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f36343b2072763a3134302e3029204765636b6f2f32303130303130312046697265666f782f3134302e300d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0","ja3":"","session":"a0ba0e8f-c0f9-438e-9d72-053d2a8254e4","seq":1,"duration_ms":100,"bytes_in":169,"bytes_out":79},{"timestamp":"2026-09-03T06:57:25","port":2095,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:2095\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a323039350d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f36343b2072763a3134302e3029204765636b6f2f32303130303130312046697265666f782f3134302e300d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0","ja3":"","session":"74b4b901-bc2a-4e2d-8182-092ed8770b7f","seq":1,"duration_ms":101,"bytes_in":169,"bytes_out":79},{"timestamp":"2026-09-03T06:47:31","port":2095,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:2095\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a323039350d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f36343b2072763a3134302e3029204765636b6f2f32303130303130312046697265666f782f3134302e300d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0","ja3":"","session":"d7c504a0-df38-4cd9-b95e-5355dd56f993","seq":1,"duration_ms":100,"bytes_in":169,"bytes_out":79}],"http_methods":[{"method":"GET","count":27}],"distinct_ports_total":26,"top_paths":[{"path":"/","count":27,"ports":20}],"distinct_paths_total":1,"top_snis":[],"top_hosts":[],"top_alpns":[{"value":"http/1.1","count":13}],"banners":[],"credentials":[],"header_profile":{"signature":["Accept-Encoding","Connection","Host","User-Agent"],"representative":[{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Connection","value":"close","notable":false},{"name":"Host","value":"<HONEYPOT>:4000","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0","notable":false}],"distinct_sets":1,"events_with_headers":5},"tags":[],"data_as_of":"2026-09-11T09:51:55.775246+00:00"}