{"ip":"172.239.120.244","total_events":4,"verdict":{"verdict":"probing","label":"Low-level probing","detail":null,"confidence":"low","network_type":"CDN","why":["4 event(s), fewer than 10 distinct ports, no exploit payloads.","Not in any known-scanner range."],"engagement":{"level":"request","label":"Request traffic","detail":"1,927 bytes sent","bytes_sent":1927,"session_seconds":0,"persistent":false}},"first_seen":"2026-09-24T07:18:40","last_seen":"2026-09-24T07:33:26","events_24h":4,"events_7d":4,"geo":{"country_code":"GB","country_name":"United Kingdom","region":"England","city":"London","lat":51.5081,"lon":-0.1278,"asn":63949,"org":"Akamai Connected Cloud"},"source_domain":"172-239-120-244.ip.linodeusercontent.com","known_scanners":[],"scanner_tag":{"key":"linode","label":"Linode (Akamai)","category":"hosting_provider","url":"https://www.linode.com/"},"cve_matches":[],"malware":[],"top_ports":[{"port":80,"proto":"tcp","label":"HTTP","count":2},{"port":443,"proto":"tcp","label":"HTTPS","count":2}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i3111h1_e8f1e7e78f70_8d633dac7124"],"tls_client_hello":"1603010200010001fc03038efc8bccbb924e101c91e7abcf142587bd00a087821acb8cd0ecb0325c251f922039aa67b0de4a527945a7dc2e88c5143a17d7b061a3c9f060b6b4cc9b5fbf4a39003e130213031301c02cc030009fcca9cca8ccaac02bc02f009ec024c028006bc023c0270067c00ac0140039c009c0130033009d009c003d003c0035002f00ff01000175000b000403000102000a000c000a001d0017001e001900180010000b000908687474702f312e31001600000017000000310000000d0030002e040305030603080708080809080a080b080408050806040105010601030302030301020103020202040205020602002b0009080304030303020301002d00020101003300260024001d0020fac971e0d455a1b5b90869da08e5e18f247592fe333dbe192db931f3541f0431001500cd00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000","tls_ja3":["9b55a9609c756df436b6aa0a2adee99e"],"http_akin":["a11cun040_00000059_cdac4f66","a11cun050_0000005d_b6f3ec63"]},"fingerprint_peers":{"t13i3111h1_e8f1e7e78f70_8d633dac7124":22,"a11cun040_00000059_cdac4f66":4,"a11cun050_0000005d_b6f3ec63":4},"akin_families":{"a11cun040_00000059_cdac4f66":{"head":"a11cun040_00000059_cdac4f66","shapes":2,"ips":4},"a11cun050_0000005d_b6f3ec63":{"head":"a11cun040_00000059_cdac4f66","shapes":2,"ips":4}},"user_agents":["Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36"],"timeline":[{"date":"2026-09-24","count":4}],"recent_events":[{"timestamp":"2026-09-24T07:33:26","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"en-US,en;q=0.9\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132302e302e302e30205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174652c2062720d0a4163636570743a20746578742f68746d6c2c6170706c69636174696f6e2f7868746d6c2b786d6c2c6170706c69636174696f6e2f786d6c3b713d302e392c696d6167652f617669662c696d6167652f776562702c2a2f2a3b713d302e380d0a4163636570742d4c616e67756167653a20656e2d55532c656e3b713d302e390d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36","ja3":"9b55a9609c756df436b6aa0a2adee99e","session":"aff4d6fd-2651-4b58-841d-57f1db8c77f3","seq":1,"duration_ms":100,"bytes_in":328,"bytes_out":80},{"timestamp":"2026-09-24T07:33:26","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\",\"accept-language\":\"en-US,en;q=0.9\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"/favicon.ico","summary":"","payload_hex":"474554202f66617669636f6e2e69636f20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132302e302e302e30205361666172692f3533372e33360d0a4163636570743a20746578742f68746d6c2c6170706c69636174696f6e2f7868746d6c2b786d6c2c6170706c69636174696f6e2f786d6c3b713d302e392c696d6167652f617669662c696d6167652f776562702c2a2f2a3b713d302e380d0a4163636570742d4c616e67756167653a20656e2d55532c656e3b713d302e390d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36","ja3":"9b55a9609c756df436b6aa0a2adee99e","session":"aff4d6fd-2651-4b58-841d-57f1db8c77f3","seq":2,"duration_ms":215,"bytes_in":631,"bytes_out":160},{"timestamp":"2026-09-24T07:18:40","port":80,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\",\"accept-encoding\":\"gzip, deflate, br\",\"accept-language\":\"en-US,en;q=0.9\",\"host\":\"<HONEYPOT>:80\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a38300d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132302e302e302e30205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174652c2062720d0a4163636570743a20746578742f68746d6c2c6170706c69636174696f6e2f7868746d6c2b786d6c2c6170706c69636174696f6e2f786d6c3b713d302e392c696d6167652f617669662c696d6167652f776562702c2a2f2a3b713d302e380d0a4163636570742d4c616e67756167653a20656e2d55532c656e3b713d302e390d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36","ja3":"9b55a9609c756df436b6aa0a2adee99e","session":"5d6e2626-2333-4ff7-b320-18842024f163","seq":1,"duration_ms":100,"bytes_in":331,"bytes_out":80},{"timestamp":"2026-09-24T07:18:40","port":80,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\",\"accept-language\":\"en-US,en;q=0.9\",\"host\":\"<HONEYPOT>:80\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"/favicon.ico","summary":"","payload_hex":"474554202f66617669636f6e2e69636f20485454502f312e310d0a486f73743a20<HONEYPOT>3a38300d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132302e302e302e30205361666172692f3533372e33360d0a4163636570743a20746578742f68746d6c2c6170706c69636174696f6e2f7868746d6c2b786d6c2c6170706c69636174696f6e2f786d6c3b713d302e392c696d6167652f617669662c696d6167652f776562702c2a2f2a3b713d302e380d0a4163636570742d4c616e67756167653a20656e2d55532c656e3b713d302e390d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36","ja3":"9b55a9609c756df436b6aa0a2adee99e","session":"5d6e2626-2333-4ff7-b320-18842024f163","seq":2,"duration_ms":221,"bytes_in":637,"bytes_out":160}],"http_methods":[{"method":"GET","count":4}],"distinct_ports_total":2,"top_paths":[{"path":"/","count":2,"ports":2},{"path":"/favicon.ico","count":2,"ports":2}],"distinct_paths_total":2,"top_snis":[],"top_hosts":[],"top_alpns":[{"value":"http/1.1","count":4}],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","Accept-Encoding","Accept-Language","Host","User-Agent"],"representative":[{"name":"Accept","value":"text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8","notable":false},{"name":"Accept-Encoding","value":"gzip, deflate, br","notable":false},{"name":"Accept-Language","value":"en-US,en;q=0.9","notable":false},{"name":"Host","value":"<HONEYPOT>","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36","notable":false}],"distinct_sets":2,"events_with_headers":4},"tags":[],"data_as_of":"2026-09-24T13:39:14.381190+00:00"}