{"ip":"172.245.209.151","total_events":7,"verdict":{"verdict":"probing","label":"Low-level probing","detail":null,"confidence":"low","network_type":"nsp","why":["7 event(s), fewer than 10 distinct ports, no exploit payloads.","Not in any known-scanner range."],"engagement":{"level":"request","label":"Request traffic","detail":"660 bytes sent","bytes_sent":660,"session_seconds":0,"persistent":false}},"first_seen":"2026-09-26T11:20:18","last_seen":"2026-09-27T09:10:57","events_24h":0,"events_7d":7,"geo":{"country_code":"US","country_name":"United States","region":"New York","city":"Buffalo","lat":42.8864,"lon":-78.8784,"asn":36352,"org":"HostPapa"},"source_domain":"172-245-209-151-host.colocrossing.com","known_scanners":[],"scanner_tag":{"key":"peeringdb:as36352","label":"ColoCrossing","category":"isp","url":"https://www.peeringdb.com/asn/36352"},"cve_matches":[],"malware":[],"top_ports":[{"port":8017,"proto":"tcp","label":"","count":2},{"port":60001,"proto":"tcp","label":"","count":2},{"port":85,"proto":"tcp","label":"","count":1},{"port":8117,"proto":"tcp","label":"","count":1},{"port":8097,"proto":"tcp","label":"","count":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":["b11cun030_00040011_213543bf","b11cun020_00040001_4e1a3733"]},"fingerprint_peers":{"b11cun030_00040011_213543bf":9,"b11cun020_00040001_4e1a3733":11},"akin_families":{},"user_agents":["Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:55.0) Gecko/20100101 Firefox/55.0"],"timeline":[{"date":"2026-09-26","count":4},{"date":"2026-09-27","count":3}],"recent_events":[{"timestamp":"2026-09-27T09:10:57","port":85,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"Keep-Alive\",\"host\":\"<HONEYPOT>:85\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a38350d0a436f6e6e656374696f6e3a204b6565702d416c6976650d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"89459041-e067-4827-a9a7-5dc27f38aa31","seq":1,"duration_ms":100,"bytes_in":66,"bytes_out":80},{"timestamp":"2026-09-27T09:05:37","port":8097,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"Keep-Alive\",\"host\":\"<HONEYPOT>:8097\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a383039370d0a436f6e6e656374696f6e3a204b6565702d416c6976650d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"c384dc55-3faf-41c9-a67f-653129ea25e5","seq":1,"duration_ms":100,"bytes_in":68,"bytes_out":80},{"timestamp":"2026-09-27T09:04:48","port":8117,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"Keep-Alive\",\"host\":\"<HONEYPOT>:8117\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a383131370d0a436f6e6e656374696f6e3a204b6565702d416c6976650d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"bc9938fd-4d3a-4304-8bc4-f756b6ccb99b","seq":1,"duration_ms":100,"bytes_in":68,"bytes_out":80},{"timestamp":"2026-09-26T23:29:50","port":60001,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"Keep-Alive\",\"host\":\"<HONEYPOT>:60001\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:55.0) Gecko/20100101 Firefox/55.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b207836343b2072763a35352e3029204765636b6f2f32303130303130312046697265666f782f35352e300d0a486f73743a20<HONEYPOT>3a36303030310d0a436f6e6e656374696f6e3a204b6565702d416c6976650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:55.0) Gecko/20100101 Firefox/55.0","ja3":"","session":"6432b408-3730-439b-a52e-833a6e217ab8","seq":1,"duration_ms":100,"bytes_in":161,"bytes_out":80},{"timestamp":"2026-09-26T23:29:48","port":8017,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"Keep-Alive\",\"host\":\"<HONEYPOT>:8017\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:55.0) Gecko/20100101 Firefox/55.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b207836343b2072763a35352e3029204765636b6f2f32303130303130312046697265666f782f35352e300d0a486f73743a20<HONEYPOT>3a383031370d0a436f6e6e656374696f6e3a204b6565702d416c6976650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:55.0) Gecko/20100101 Firefox/55.0","ja3":"","session":"82262352-c56b-48fc-a530-d144656e1b3e","seq":1,"duration_ms":100,"bytes_in":160,"bytes_out":80},{"timestamp":"2026-09-26T11:21:30","port":60001,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"Keep-Alive\",\"host\":\"<HONEYPOT>:60001\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a36303030310d0a436f6e6e656374696f6e3a204b6565702d416c6976650d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"56db59e2-01ae-48eb-b079-ff75231db8c6","seq":1,"duration_ms":100,"bytes_in":69,"bytes_out":80},{"timestamp":"2026-09-26T11:20:18","port":8017,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"Keep-Alive\",\"host\":\"<HONEYPOT>:8017\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a383031370d0a436f6e6e656374696f6e3a204b6565702d416c6976650d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"05a735dd-546d-41ae-a586-dea7458e3376","seq":1,"duration_ms":100,"bytes_in":68,"bytes_out":80}],"http_methods":[{"method":"GET","count":7}],"distinct_ports_total":5,"top_paths":[{"path":"/","count":7,"ports":5}],"distinct_paths_total":1,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Connection","Host","User-Agent"],"representative":[{"name":"Connection","value":"Keep-Alive","notable":false},{"name":"Host","value":"<HONEYPOT>:60001","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:55.0) Gecko/20100101 Firefox/55.0","notable":false}],"distinct_sets":2,"events_with_headers":7},"tags":[],"data_as_of":"2026-09-30T15:20:58.622113+00:00"}