{"ip":"167.99.225.64","observed":true,"total_events":99,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"29+ ports swept","confidence":"medium","network_type":"CDN","why":["No exploit payloads observed.","Swept 29 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"5,894 bytes sent","bytes_sent":5894,"session_seconds":0,"persistent":false},"basis":"first_contact"},"first_seen":"2026-10-09T17:48:06","last_seen":"2026-10-09T17:48:31","events_24h":0,"events_7d":0,"interactive_sessions":0,"interactive_sessions_24h":0,"interactive_sessions_7d":0,"interactive_protocols":[],"geo":{"country_code":"US","country_name":"United States","region":"New Jersey","city":"North Bergen","lat":40.7964,"lon":-74.0203,"asn":14061,"org":"DigitalOcean, LLC"},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as14061","label":"DigitalOcean","category":"cdn","url":"https://www.peeringdb.com/asn/14061"},"cve_matches":[],"malware":[],"udp":null,"interaction":null,"top_ports":[{"port":2181,"proto":"tcp","label":"","count":6},{"port":2121,"proto":"tcp","label":"","count":6},{"port":2079,"proto":"tcp","label":"","count":5},{"port":556,"proto":"tcp","label":"","count":5},{"port":789,"proto":"tcp","label":"","count":5},{"port":2103,"proto":"tcp","label":"","count":5},{"port":2375,"proto":"tcp","label":"Docker","count":5},{"port":1414,"proto":"tcp","label":"","count":5},{"port":1925,"proto":"tcp","label":"","count":5},{"port":2480,"proto":"tcp","label":"","count":5},{"port":442,"proto":"tcp","label":"","count":5},{"port":2332,"proto":"tcp","label":"","count":5},{"port":808,"proto":"tcp","label":"","count":5},{"port":2002,"proto":"tcp","label":"","count":5},{"port":1180,"proto":"tcp","label":"","count":5}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i190800_9dc949149365_97f8aa674fd9","t13i1909h2_9dc949149365_97f8aa674fd9"],"tls_client_hello":"16030105cc010005c8030327101390978401196e14949b7f42ea39fe1398b8ea087fddf9c0802bf1157b6b202575eba1c3df02000ab8c27b6d4ed633136bf1a5896da6865d0e4ce98fcac3d90026cca8cca9c02fc030c02bc02cc013c009c014c00a009c009d002f0035c012000a13031301130201000559000500050100000000000a0012001011ec11ed11eb0202001d001700180019000b00020100000d001a0018080404030807080508060401050106010503060302010203ff010001000010000e000c02683208687474702f312e3100120000002b0009080304030303020301003304ea04e811ec04c0e4374ec708c5acc59e4e399cc4b74e7de09eea37243b6039ecb16ba1e64a7c025c8b80c2e037be89f3881c89907a5b7e86826ec0111c3a02a1beb55b8e574b9fe351509490f12c690789a923958931569a562719c6882c64620342115ee6a548ae0b4778454be8dcc2e9ca4d761846a9b6774814082b55973ba1bb85c256faf41bdcfc8e2bc42c71b31ee0d23707fa9143f15b85da4d18eb33e1e3853fb1c86cbab9eb7a9f52099d45c2bba8e73667a53f3a445190194b3c50098bb183c1b9926f8caa09766ff500cb6fd1bec5d7611ed3988dcb258c76995831b716b9836e045fab7741ed29c7c2b6b5a06abcd26aab767bbbf26b0f5080bdfe0704a0b3a6f4754b6af29c87b61a9aeb927c621fe6e77d17766549f40d3884ab8cc574468504fc070f83c76085f41d6218cbbef16e846761b664345f097982524de88c67a2e03bfe4396a53b6babf86542c8743b80b2fc3b57dd4a86dc23a2d7ab985086923a299b3a7c53132c20f3c47f80750355132b67c5c9168a975bb0461e921a1a78b238babb2426015e315411316748a182fad49391da7211e8c50639bb0be4a45b4465ea2584e07354fc1bbf36048dc93b6b8358052d14c7c3c6128aa71f07954dd52c66d7db678eda1272c7ba34098e5719a9db6672e9b674a7eb8a8a773f5a14375127cb33fb7e709724437a9345ba9d260c27fc24b705c546beab88500a533cb90661a76653d15fb582495c57bdda1c65f6ba4a929526d03651f50367a0aaa16ed453773caf619b79de64abd2e40bb3dc8ce692aa3b08248ed6cd9c0249edd93aaafbc0e9a83b365cbac967ba3571271d644c7833c66663791bdcbd7f324aa1b77448f2781de936d3aac21383c4afdc8f4aecb5ad173194d838d36a0f8ef7311ce89c4935bbb1c3962f8b6d2e945559bb7fb1a3b5f963b78ff6479d158942072f87a44366d53b5aa41888c729413baff023ce3806192b942d1c9bc1d9980846cb6bb5238dc098ce2ec858979a533852725efabfcfc9380ff3492f917c9bc0bf37a18855d98ddf52614cc12f20511e44b88b01c9c06e4946ed977f0a0b0b94bb700fc296dc49484883647e9473154079fb7968249c29d29c779f221b4e3492f0e91a4b79b9b6a912da6348dbb8abb36c30bc97830ab22b86d225153aaefbb3712c6654c641b4810c0f9e170f4d292264f397b45264fe6aac6522a4076a93b1aa005589665a789645337f94b9b1d491904f54a85c567fbcc02ab1b45170606ab5767ced059bca6ac45d7278e0263d5b657bed258d828a09614009752b2043498c6d1783ef4578b5d7a17f580c1f88115cd9a3ee2bb8709a0974a5b3f9f01c52740fc42c7d6ae6643b502ca575868cd70e137ca3dd2a7ce5c93d9a5a88716590a2571976da0c87013e38a556cab9816ca08d84fbbe87fa4e94c0545f33a3b87173462185545508a0d45086418efa506b31d10ec5ea69f00b1f9974ba2e007c35ec9c26bcb07c33b072c6c0659b5fb6788c79bc47ffd697505453cb42af9067aa30739f67b72379c86f74573043b54830da24ddf842badca48ceb09dd6c0186e4500b4746343b0b17633527c0c4a2863a0b6778c3a4484d18893fc474fe9b6a269457d8ed9c5dc0e4eee3fe9fb8a443db8e32258a03a7ffcf1cb3552397feeec8f3c32a26d1082f4a0982cc6fb2f1ff6731b859ce109b92cd100734223bc458e8720c001d00202ca5790cef3072e4127bc89cfe0e92473a7ec0ffb19a3305d5d2e1f0","tls_ja3":["5af43e5eee17271a9eb37dce2ab407a8","e5c250b292fce278a62137836169e18f"],"http_akin":["b11cun040_00040016_aa48e2c8"],"interactive":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[]}},"fingerprint_peers":{"t13i190800_9dc949149365_97f8aa674fd9":3052,"t13i1909h2_9dc949149365_97f8aa674fd9":704,"b11cun040_00040016_aa48e2c8":5393},"akin_families":{},"user_agents":["Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36"],"timeline":[{"date":"2026-10-09","count":99}],"recent_events":[{"timestamp":"2026-10-09T17:48:31","port":2181,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:2181\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/security.txt","summary":"","payload_hex":"474554202f73656375726974792e74787420485454502f312e310d0a486f73743a20<HONEYPOT>3a323138310d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3134302e302e302e30205361666172692f3533372e33360d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36","ja3":"5af43e5eee17271a9eb37dce2ab407a8","session":"026374c1-eeac-4ba8-af8b-babc438374b8","seq":1,"duration_ms":100,"bytes_in":216,"bytes_out":78},{"timestamp":"2026-10-09T17:48:26","port":2121,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:2121\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/security.txt","summary":"","payload_hex":"474554202f73656375726974792e74787420485454502f312e310d0a486f73743a20<HONEYPOT>3a323132310d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3134302e302e302e30205361666172692f3533372e33360d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36","ja3":"5af43e5eee17271a9eb37dce2ab407a8","session":"aaa7c4be-d4e6-461c-98d8-c8b786593d9d","seq":1,"duration_ms":100,"bytes_in":216,"bytes_out":78},{"timestamp":"2026-10-09T17:48:26","port":2181,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:2181\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/favicon.ico","summary":"","payload_hex":"474554202f66617669636f6e2e69636f20485454502f312e310d0a486f73743a20<HONEYPOT>3a323138310d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3134302e302e302e30205361666172692f3533372e33360d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36","ja3":"5af43e5eee17271a9eb37dce2ab407a8","session":"d689cfd0-8fb2-4f70-acf3-22cf28b7a58e","seq":1,"duration_ms":108,"bytes_in":215,"bytes_out":78},{"timestamp":"2026-10-09T17:48:26","port":2181,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:2181\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/.well-known/security.txt","summary":"","payload_hex":"474554202f2e77656c6c2d6b6e6f776e2f73656375726974792e74787420485454502f312e310d0a486f73743a20<HONEYPOT>3a323138310d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3134302e302e302e30205361666172692f3533372e33360d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36","ja3":"5af43e5eee17271a9eb37dce2ab407a8","session":"33ac9973-cf7d-4bce-8d9e-f1e5eeba7a93","seq":1,"duration_ms":101,"bytes_in":228,"bytes_out":78},{"timestamp":"2026-10-09T17:48:25","port":2181,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:2181\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/robots.txt","summary":"","payload_hex":"474554202f726f626f74732e74787420485454502f312e310d0a486f73743a20<HONEYPOT>3a323138310d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3134302e302e302e30205361666172692f3533372e33360d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36","ja3":"5af43e5eee17271a9eb37dce2ab407a8","session":"b586857f-7394-4a46-a090-e8e2e170cf41","seq":1,"duration_ms":100,"bytes_in":214,"bytes_out":78},{"timestamp":"2026-10-09T17:48:21","port":2103,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:2103\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/security.txt","summary":"","payload_hex":"474554202f73656375726974792e74787420485454502f312e310d0a486f73743a20<HONEYPOT>3a323130330d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3134302e302e302e30205361666172692f3533372e33360d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36","ja3":"5af43e5eee17271a9eb37dce2ab407a8","session":"d999f571-4594-499a-be4c-a40a775751b5","seq":1,"duration_ms":100,"bytes_in":216,"bytes_out":78},{"timestamp":"2026-10-09T17:48:21","port":2002,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:2002\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/.well-known/robots.txt","summary":"","payload_hex":"474554202f2e77656c6c2d6b6e6f776e2f726f626f74732e74787420485454502f312e310d0a486f73743a20<HONEYPOT>3a323030320d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3134302e302e302e30205361666172692f3533372e33360d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36","ja3":"5af43e5eee17271a9eb37dce2ab407a8","session":"0bbda6f5-f033-4e0e-bbbd-e6c3fc9f0312","seq":1,"duration_ms":100,"bytes_in":226,"bytes_out":78},{"timestamp":"2026-10-09T17:48:21","port":2002,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:2002\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/security.txt","summary":"","payload_hex":"474554202f73656375726974792e74787420485454502f312e310d0a486f73743a20<HONEYPOT>3a323030320d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3134302e302e302e30205361666172692f3533372e33360d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36","ja3":"5af43e5eee17271a9eb37dce2ab407a8","session":"c6f40f97-57b5-4a73-85e6-87c6e4777756","seq":1,"duration_ms":101,"bytes_in":216,"bytes_out":78},{"timestamp":"2026-10-09T17:48:20","port":2079,"proto":"tcp","app_proto":"tls","app_protocol":"redis","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"*1\r\n$4\r\nINFO\r\n","payload_hex":"2a310d0a24340d0a494e464f0d0a","method":"","user_agent":"","ja3":"e5c250b292fce278a62137836169e18f","session":"b779b5f9-f7cc-4641-a1c2-4d60f17ff5d7","seq":2,"duration_ms":225,"bytes_in":28,"bytes_out":12,"enriched":{"digest":"2c31890b53b348f2","label":"Redis (RESP)","strings":["INFO"]}},{"timestamp":"2026-10-09T17:48:20","port":2079,"proto":"tcp","app_proto":"tls","app_protocol":"redis","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"*1\r\n$4\r\nQUIT\r\n","payload_hex":"2a310d0a24340d0a515549540d0a","method":"","user_agent":"","ja3":"e5c250b292fce278a62137836169e18f","session":"b779b5f9-f7cc-4641-a1c2-4d60f17ff5d7","seq":4,"duration_ms":468,"bytes_in":64,"bytes_out":22,"enriched":{"digest":"c8eec36f8388dba0","label":"Redis (RESP)","strings":["QUIT"]}}],"http_methods":[{"method":"GET","count":18}],"distinct_ports_total":29,"top_paths":[{"path":"/","count":4,"ports":4},{"path":"/favicon.ico","count":4,"ports":4},{"path":"/security.txt","count":4,"ports":4},{"path":"/robots.txt","count":3,"ports":3},{"path":"/.well-known/security.txt","count":2,"ports":2},{"path":"/.well-known/robots.txt","count":1,"ports":1}],"distinct_paths_total":6,"top_snis":[],"top_hosts":[],"top_alpns":[{"value":"h2, http/1.1","count":18}],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","Accept-Encoding","Host","User-Agent"],"representative":[{"name":"Accept","value":"*/*","notable":false},{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Host","value":"<HONEYPOT>:2181","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36","notable":false}],"distinct_sets":1,"events_with_headers":8},"tags":[],"data_as_of":"2026-10-17T21:06:02.084331+00:00"}