{"ip":"172.209.208.96","data_as_of":"2026-10-20T16:01:18+00:00","observed":true,"total_events":160,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"13+ ports swept","confidence":"medium","network_type":"CDN","why":["No exploit payloads observed.","Swept 13 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range.","Counts include 32 interactive session(s) as well as first-packet events."],"engagement":{"level":"payload","label":"Sustained payload","detail":"55,525 bytes sent","bytes_sent":55525,"session_seconds":5,"persistent":false},"basis":"combined"},"first_seen":"2026-09-29T01:51:30","last_seen":"2026-10-20T12:10:14","events_24h":24,"events_7d":100,"interactive_sessions":32,"interactive_sessions_24h":32,"interactive_sessions_7d":32,"interactive_protocols":[{"protocol":"http","sessions":26}],"geo":{"country_code":"ZA","country_name":"South Africa","region":"Gauteng","city":"Johannesburg","lat":-26.2309,"lon":28.0583,"asn":8075,"org":"Microsoft Corporation"},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as8075","label":"Microsoft","category":"cdn","url":"https://www.peeringdb.com/asn/8075"},"cve_matches":[],"malware":[],"udp":null,"interaction":{"window_days":90,"sessions":32,"first_seen":"2026-10-20T12:08:45","last_seen":"2026-10-20T12:10:14","verdicts":[{"verdict":"scan","sessions":24},{"verdict":"unknown","sessions":8}],"personas":[{"persona":"nginx@1.24.0, wordpress@6.5.2, leaks@2, miner@bfgminer 5.5.0, elasticsearch@6.8.23, winrm@Windows Server 2016, fortigate@7.0.5, docker@25.0.3","sessions":18},{"persona":"nginx@1.24.0, wordpress@6.5.2, leaks@2, miner@bfgminer 5.5.0, elasticsearch@6.8.23, winrm@Windows Server 2016, dlink-dir645@1.01, fortigate@7.0.5","sessions":4},{"persona":"nginx@1.24.0, wordpress@6.5.2, leaks@2, miner@bfgminer 5.5.0, elasticsearch@6.8.23, winrm@Windows Server 2016, dlink-dns@1.10, fortigate@7.0.5","sessions":4}],"services":[{"protocol":"http","port":8080,"sessions":4},{"protocol":"http","port":5000,"sessions":4},{"protocol":"http","port":8000,"sessions":3},{"protocol":"http","port":3000,"sessions":3},{"protocol":"http","port":9931,"sessions":3},{"protocol":"http","port":11434,"sessions":3},{"protocol":"http","port":30000,"sessions":3},{"protocol":"http","port":1234,"sessions":3},{"protocol":"tcp","port":9931,"sessions":1},{"protocol":"tcp","port":3000,"sessions":1},{"protocol":"tcp","port":11434,"sessions":1},{"protocol":"tcp","port":1234,"sessions":1}],"logins":[],"commands":[],"downloads":[],"files":[],"attack":[{"technique_id":"T1595","technique_name":"Active Scanning","tactic_id":"TA0043","tactic_name":"Reconnaissance","sessions":24}]},"top_ports":[{"port":8080,"proto":"tcp","label":"HTTP-alt","count":26,"sessions":4},{"port":8000,"proto":"tcp","label":"HTTP-alt","count":21,"sessions":4},{"port":5000,"proto":"tcp","label":"Web-alt","count":16,"sessions":4},{"port":8500,"proto":"tcp","label":"","count":18,"sessions":0},{"port":7860,"proto":"tcp","label":"","count":18,"sessions":0},{"port":1234,"proto":"tcp","label":"","count":12,"sessions":4},{"port":11434,"proto":"tcp","label":"","count":12,"sessions":4},{"port":8188,"proto":"tcp","label":"","count":10,"sessions":0},{"port":8081,"proto":"tcp","label":"","count":9,"sessions":0},{"port":8501,"proto":"tcp","label":"","count":9,"sessions":0},{"port":30000,"proto":"tcp","label":"","count":3,"sessions":4},{"port":9931,"proto":"tcp","label":"","count":3,"sessions":4},{"port":3000,"proto":"tcp","label":"Web-alt","count":3,"sessions":4}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":["b11cun040_00040016_1d05953d","b11cun050_00040017_1cb16073","b11cun050_00040017_97f1d74f"],"interactive":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[]}},"fingerprint_peers":{"b11cun040_00040016_1d05953d":10,"b11cun050_00040017_97f1d74f":40,"b11cun050_00040017_1cb16073":6},"akin_families":{"b11cun040_00040016_1d05953d":{"head":"b11cun040_00040016_1d05953d","shapes":2,"ips":10},"b11cun050_00040017_97f1d74f":{"head":"b11cun050_00040017_97f1d74f","shapes":2,"ips":40}},"user_agents":["Mozilla/5.0 (comfy-multimodal-scan/1.0)","Python/3.14 aiohttp/3.14.4","Python/3.12 aiohttp/3.14.3"],"timeline":[{"date":"2026-09-29","count":1,"sessions":0},{"date":"2026-10-08","count":2,"sessions":0},{"date":"2026-10-09","count":16,"sessions":0},{"date":"2026-10-10","count":5,"sessions":0},{"date":"2026-10-11","count":36,"sessions":0},{"date":"2026-10-13","count":18,"sessions":0},{"date":"2026-10-14","count":31,"sessions":0},{"date":"2026-10-15","count":27,"sessions":0},{"date":"2026-10-20","count":24,"sessions":32}],"recent_events":[{"timestamp":"2026-10-20T04:39:33","port":3000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate, zstd\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:3000\",\"user-agent\":\"Python/3.14 aiohttp/3.14.4\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/props","summary":"","payload_hex":"474554202f70726f707320485454502f312e310d0a486f73743a20<HONEYPOT>3a333030300d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174652c207a7374640d0a557365722d4167656e743a20507974686f6e2f332e31342061696f687474702f332e31342e340d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Python/3.14 aiohttp/3.14.4","ja3":"","session":"e28de950-ee52-42b4-a338-1365a8c8f29a","seq":1,"duration_ms":101,"bytes_in":159,"bytes_out":79},{"timestamp":"2026-10-20T04:39:33","port":5000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate, zstd\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:5000\",\"user-agent\":\"Python/3.14 aiohttp/3.14.4\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/props","summary":"","payload_hex":"474554202f70726f707320485454502f312e310d0a486f73743a20<HONEYPOT>3a353030300d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174652c207a7374640d0a557365722d4167656e743a20507974686f6e2f332e31342061696f687474702f332e31342e340d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Python/3.14 aiohttp/3.14.4","ja3":"","session":"f5a8357a-8925-4973-bce6-f60e7fbbe4a9","seq":1,"duration_ms":101,"bytes_in":159,"bytes_out":79},{"timestamp":"2026-10-20T04:39:33","port":30000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate, zstd\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:30000\",\"user-agent\":\"Python/3.14 aiohttp/3.14.4\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/props","summary":"","payload_hex":"474554202f70726f707320485454502f312e310d0a486f73743a20<HONEYPOT>3a33303030300d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174652c207a7374640d0a557365722d4167656e743a20507974686f6e2f332e31342061696f687474702f332e31342e340d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Python/3.14 aiohttp/3.14.4","ja3":"","session":"7b3306df-dd21-4e51-a4dc-01350c628836","seq":1,"duration_ms":101,"bytes_in":160,"bytes_out":79},{"timestamp":"2026-10-20T04:39:33","port":9931,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate, zstd\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:9931\",\"user-agent\":\"Python/3.14 aiohttp/3.14.4\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/props","summary":"","payload_hex":"474554202f70726f707320485454502f312e310d0a486f73743a20<HONEYPOT>3a393933310d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174652c207a7374640d0a557365722d4167656e743a20507974686f6e2f332e31342061696f687474702f332e31342e340d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Python/3.14 aiohttp/3.14.4","ja3":"","session":"6818b6fc-455b-4d07-9971-d0a14c2f14f9","seq":1,"duration_ms":101,"bytes_in":159,"bytes_out":79},{"timestamp":"2026-10-20T04:39:33","port":8080,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate, zstd\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8080\",\"user-agent\":\"Python/3.14 aiohttp/3.14.4\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/props","summary":"","payload_hex":"474554202f70726f707320485454502f312e310d0a486f73743a20<HONEYPOT>3a383038300d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174652c207a7374640d0a557365722d4167656e743a20507974686f6e2f332e31342061696f687474702f332e31342e340d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Python/3.14 aiohttp/3.14.4","ja3":"","session":"ba1754d9-3309-45fb-b30a-03f55c8370a0","seq":1,"duration_ms":100,"bytes_in":159,"bytes_out":79},{"timestamp":"2026-10-20T04:39:33","port":1234,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate, zstd\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:1234\",\"user-agent\":\"Python/3.14 aiohttp/3.14.4\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/props","summary":"","payload_hex":"474554202f70726f707320485454502f312e310d0a486f73743a20<HONEYPOT>3a313233340d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174652c207a7374640d0a557365722d4167656e743a20507974686f6e2f332e31342061696f687474702f332e31342e340d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Python/3.14 aiohttp/3.14.4","ja3":"","session":"07f6ef05-7e48-4fb5-9bee-7cdd7255d07d","seq":1,"duration_ms":100,"bytes_in":159,"bytes_out":79},{"timestamp":"2026-10-20T04:39:33","port":8000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate, zstd\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8000\",\"user-agent\":\"Python/3.14 aiohttp/3.14.4\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/props","summary":"","payload_hex":"474554202f70726f707320485454502f312e310d0a486f73743a20<HONEYPOT>3a383030300d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174652c207a7374640d0a557365722d4167656e743a20507974686f6e2f332e31342061696f687474702f332e31342e340d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Python/3.14 aiohttp/3.14.4","ja3":"","session":"e13e4678-10cb-4692-9c8d-5e67839b2a9a","seq":1,"duration_ms":100,"bytes_in":159,"bytes_out":79},{"timestamp":"2026-10-20T04:39:33","port":11434,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate, zstd\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:11434\",\"user-agent\":\"Python/3.14 aiohttp/3.14.4\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/props","summary":"","payload_hex":"474554202f70726f707320485454502f312e310d0a486f73743a20<HONEYPOT>3a31313433340d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174652c207a7374640d0a557365722d4167656e743a20507974686f6e2f332e31342061696f687474702f332e31342e340d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Python/3.14 aiohttp/3.14.4","ja3":"","session":"99993a73-f859-48a6-ab2a-1c36150a2bd8","seq":1,"duration_ms":100,"bytes_in":160,"bytes_out":79},{"timestamp":"2026-10-20T04:39:33","port":3000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate, zstd\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:3000\",\"user-agent\":\"Python/3.14 aiohttp/3.14.4\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/api/tags","summary":"","payload_hex":"474554202f6170692f7461677320485454502f312e310d0a486f73743a20<HONEYPOT>3a333030300d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174652c207a7374640d0a557365722d4167656e743a20507974686f6e2f332e31342061696f687474702f332e31342e340d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Python/3.14 aiohttp/3.14.4","ja3":"","session":"5e3946b2-1b30-4776-a049-fa199d8825c3","seq":1,"duration_ms":101,"bytes_in":162,"bytes_out":79},{"timestamp":"2026-10-20T04:39:33","port":5000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate, zstd\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:5000\",\"user-agent\":\"Python/3.14 aiohttp/3.14.4\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/api/tags","summary":"","payload_hex":"474554202f6170692f7461677320485454502f312e310d0a486f73743a20<HONEYPOT>3a353030300d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174652c207a7374640d0a557365722d4167656e743a20507974686f6e2f332e31342061696f687474702f332e31342e340d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Python/3.14 aiohttp/3.14.4","ja3":"","session":"c39fa1a9-fbdd-4232-833e-e2bc86a1998e","seq":1,"duration_ms":100,"bytes_in":162,"bytes_out":79}],"http_methods":[{"method":"GET","count":160}],"distinct_ports_total":13,"top_paths":[{"path":"/props","count":20,"ports":12},{"path":"/v1/models","count":20,"ports":12},{"path":"/","count":19,"ports":9},{"path":"/api/tags","count":17,"ports":8},{"path":"/info","count":13,"ports":8},{"path":"/api/config","count":13,"ports":8},{"path":"/v1/internal/model/info","count":13,"ports":8},{"path":"/api/v1/model","count":12,"ports":8},{"path":"/api/v0/models","count":12,"ports":8},{"path":"/get_model_info","count":12,"ports":8},{"path":"/healthz","count":3,"ports":2},{"path":"/config","count":3,"ports":2},{"path":"/system_stats","count":3,"ports":2}],"distinct_paths_total":13,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","Accept-Encoding","Connection","Host","User-Agent"],"representative":[{"name":"Accept","value":"*/*","notable":false},{"name":"Accept-Encoding","value":"gzip, deflate, zstd","notable":false},{"name":"Connection","value":"close","notable":false},{"name":"Host","value":"<HONEYPOT>:3000","notable":false},{"name":"User-Agent","value":"Python/3.14 aiohttp/3.14.4","notable":false}],"distinct_sets":1,"events_with_headers":10},"tags":[]}