{"ip":"169.150.203.17","total_events":8,"verdict":{"verdict":"probing","label":"Low-level probing","detail":null,"confidence":"low","network_type":null,"why":["8 event(s), fewer than 10 distinct ports, no exploit payloads.","Not in any known-scanner range."],"engagement":{"level":"request","label":"Request traffic","detail":"804 bytes sent","bytes_sent":804,"session_seconds":1,"persistent":false}},"first_seen":"2026-08-13T02:32:10","last_seen":"2026-08-13T02:32:11","events_24h":0,"events_7d":8,"geo":{"country_code":"US","country_name":"United States","region":"California","city":"Los Angeles","lat":34.0544,"lon":-118.244,"asn":212238,"org":"Datacamp Limited"},"source_domain":"unn-169-150-203-17.datapacket.com","known_scanners":[],"scanner_tag":null,"cve_matches":[],"malware":[],"top_ports":[{"port":465,"proto":"tcp","label":"SMTPS","count":8}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i030900_55b375c5d22e_3217d83565aa"],"tls_ja3":["2ff342cadae61a6b95f4aaf7317ba5bd"],"ja4h":[]},"fingerprint_peers":{"t13i030900_55b375c5d22e_3217d83565aa":33},"user_agents":[],"timeline":[{"date":"2026-08-13","count":8}],"recent_events":[{"timestamp":"2026-08-13T02:32:11","port":465,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"data\r\n","payload_hex":"646174610d0a","method":"","user_agent":"","ja3":"2ff342cadae61a6b95f4aaf7317ba5bd","session":"1163ee44-2e20-48b7-b1f7-0f9bb31bb943","seq":4,"duration_ms":1273,"bytes_in":135,"bytes_out":105,"enriched":{"digest":"b901fb770e777abb","strings":["data"]}},{"timestamp":"2026-08-13T02:32:11","port":465,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"data\r\n","payload_hex":"646174610d0a","method":"","user_agent":"","ja3":"2ff342cadae61a6b95f4aaf7317ba5bd","session":"0476ca84-4d1f-43cd-8e0b-b19eb3e2a499","seq":4,"duration_ms":1270,"bytes_in":135,"bytes_out":105,"enriched":{"digest":"b901fb770e777abb","strings":["data"]}},{"timestamp":"2026-08-13T02:32:11","port":465,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"rcpt to:<ersemney@hotmail.com>\r\n","payload_hex":"7263707420746f3a3c657273656d6e657940686f746d61696c2e636f6d3e0d0a","method":"","user_agent":"","ja3":"2ff342cadae61a6b95f4aaf7317ba5bd","session":"1163ee44-2e20-48b7-b1f7-0f9bb31bb943","seq":3,"duration_ms":1005,"bytes_in":129,"bytes_out":68,"enriched":{"digest":"08c683e9a90ebe69","strings":["rcpt to:<ersemney@hotmail.com>"],"iocs":{"domains":["hotmail.com"]}}},{"timestamp":"2026-08-13T02:32:11","port":465,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"rcpt to:<ersemney@hotmail.com>\r\n","payload_hex":"7263707420746f3a3c657273656d6e657940686f746d61696c2e636f6d3e0d0a","method":"","user_agent":"","ja3":"2ff342cadae61a6b95f4aaf7317ba5bd","session":"0476ca84-4d1f-43cd-8e0b-b19eb3e2a499","seq":3,"duration_ms":1005,"bytes_in":129,"bytes_out":68,"enriched":{"digest":"08c683e9a90ebe69","strings":["rcpt to:<ersemney@hotmail.com>"],"iocs":{"domains":["hotmail.com"]}}},{"timestamp":"2026-08-13T02:32:10","port":465,"proto":"tcp","app_proto":"tls","app_protocol":"smtp","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"mail from:<support@<HONEYPOT>-host.colocrossing.com>\r\n","payload_hex":"6d61696c2066726f6d3a3c737570706f72744032332d39342d33362d3134312d686f73742e636f6c6f63726f7373696e672e636f6d3e0d0a","method":"","user_agent":"","ja3":"2ff342cadae61a6b95f4aaf7317ba5bd","session":"1163ee44-2e20-48b7-b1f7-0f9bb31bb943","seq":2,"duration_ms":737,"bytes_in":97,"bytes_out":54,"enriched":{"digest":"e350c688dcb8db95","label":"SMTP","strings":["mail from:<support@<HONEYPOT>-host.colocrossing.com>"],"iocs":{"domains":["host.colocrossing.com"]}}},{"timestamp":"2026-08-13T02:32:10","port":465,"proto":"tcp","app_proto":"tls","app_protocol":"smtp","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"mail from:<support@<HONEYPOT>-host.colocrossing.com>\r\n","payload_hex":"6d61696c2066726f6d3a3c737570706f72744032332d39342d33362d3134312d686f73742e636f6c6f63726f7373696e672e636f6d3e0d0a","method":"","user_agent":"","ja3":"2ff342cadae61a6b95f4aaf7317ba5bd","session":"0476ca84-4d1f-43cd-8e0b-b19eb3e2a499","seq":2,"duration_ms":738,"bytes_in":97,"bytes_out":54,"enriched":{"digest":"e350c688dcb8db95","label":"SMTP","strings":["mail from:<support@<HONEYPOT>-host.colocrossing.com>"],"iocs":{"domains":["host.colocrossing.com"]}}},{"timestamp":"2026-08-13T02:32:10","port":465,"proto":"tcp","app_proto":"tls","app_protocol":"smtp","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"ehlo <HONEYPOT>-host.colocrossing.com\r\n","payload_hex":"65686c6f2032332d39342d33362d3134312d686f73742e636f6c6f63726f7373696e672e636f6d0d0a","method":"","user_agent":"","ja3":"2ff342cadae61a6b95f4aaf7317ba5bd","session":"1163ee44-2e20-48b7-b1f7-0f9bb31bb943","seq":1,"duration_ms":369,"bytes_in":41,"bytes_out":40,"enriched":{"digest":"3bb8b762144326bb","label":"SMTP","strings":["ehlo <HONEYPOT>-host.colocrossing.com"],"iocs":{"domains":["host.colocrossing.com"]}}},{"timestamp":"2026-08-13T02:32:10","port":465,"proto":"tcp","app_proto":"tls","app_protocol":"smtp","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"ehlo <HONEYPOT>-host.colocrossing.com\r\n","payload_hex":"65686c6f2032332d39342d33362d3134312d686f73742e636f6c6f63726f7373696e672e636f6d0d0a","method":"","user_agent":"","ja3":"2ff342cadae61a6b95f4aaf7317ba5bd","session":"0476ca84-4d1f-43cd-8e0b-b19eb3e2a499","seq":1,"duration_ms":369,"bytes_in":41,"bytes_out":40,"enriched":{"digest":"3bb8b762144326bb","label":"SMTP","strings":["ehlo <HONEYPOT>-host.colocrossing.com"],"iocs":{"domains":["host.colocrossing.com"]}}}],"http_methods":[],"distinct_ports_total":1,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-08-15T12:23:41.478265+00:00"}