{"ip":"173.212.205.22","total_events":8,"verdict":{"verdict":"probing","label":"Low-level probing","detail":null,"confidence":"low","network_type":"CDN","why":["8 event(s), fewer than 10 distinct ports, no exploit payloads.","Not in any known-scanner range."],"engagement":{"level":"request","label":"Request traffic","detail":"1,588 bytes sent","bytes_sent":1588,"session_seconds":0,"persistent":false}},"first_seen":"2026-09-26T09:21:31","last_seen":"2026-09-26T09:26:15","events_24h":0,"events_7d":8,"geo":{"country_code":"FR","country_name":"France","region":"Grand Est","city":"Lauterbourg","lat":48.9742,"lon":8.1851,"asn":51167,"org":"Contabo GmbH"},"source_domain":"vmi3319144.contaboserver.net","known_scanners":[],"scanner_tag":{"key":"contabo","label":"Contabo","category":"hosting_provider","url":"https://contabo.com/"},"cve_matches":[],"malware":[],"top_ports":[{"port":5800,"proto":"tcp","label":"VNC-HTTP","count":2},{"port":5802,"proto":"tcp","label":"","count":1},{"port":6081,"proto":"tcp","label":"","count":1},{"port":6900,"proto":"tcp","label":"","count":1},{"port":6080,"proto":"tcp","label":"","count":1},{"port":8006,"proto":"tcp","label":"","count":1},{"port":5801,"proto":"tcp","label":"","count":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":["a11cun060_e000004a_ffe60107"]},"fingerprint_peers":{"a11cun060_e000004a_ffe60107":24},"akin_families":{"a11cun060_e000004a_ffe60107":{"head":"a11cun060_e000004a_ffe60107","shapes":2,"ips":25}},"user_agents":["Go-http-client/1.1"],"timeline":[{"date":"2026-09-26","count":8}],"recent_events":[{"timestamp":"2026-09-26T09:26:15","port":5802,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"Upgrade\",\"host\":\"<HONEYPOT>:5802\",\"sec-websocket-key\":\"1sci05OaOf0W2k1bNtqpBA==\",\"sec-websocket-version\":\"13\",\"upgrade\":\"websocket\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/websockify","summary":"","payload_hex":"474554202f776562736f636b69667920485454502f312e310d0a486f73743a20<HONEYPOT>3a353830320d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a436f6e6e656374696f6e3a20557067726164650d0a5365632d576562536f636b65742d4b65793a203173636930354f614f663057326b31624e74717042413d3d0d0a5365632d576562536f636b65742d56657273696f6e3a2031330d0a557067726164653a20776562736f636b65740d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"","session":"211a3069-8894-406d-bf5e-cf0a910d11e5","seq":1,"duration_ms":100,"bytes_in":198,"bytes_out":79},{"timestamp":"2026-09-26T09:25:33","port":5800,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"Upgrade\",\"host\":\"<HONEYPOT>:5800\",\"sec-websocket-key\":\"iejuA0SpSB0KMT90HCcl5A==\",\"sec-websocket-version\":\"13\",\"upgrade\":\"websocket\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/websockify","summary":"","payload_hex":"474554202f776562736f636b69667920485454502f312e310d0a486f73743a20<HONEYPOT>3a353830300d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a436f6e6e656374696f6e3a20557067726164650d0a5365632d576562536f636b65742d4b65793a2069656a75413053705342304b4d5439304843636c35413d3d0d0a5365632d576562536f636b65742d56657273696f6e3a2031330d0a557067726164653a20776562736f636b65740d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"","session":"497f585b-5289-408f-a5e3-22333e659cf5","seq":1,"duration_ms":100,"bytes_in":198,"bytes_out":79},{"timestamp":"2026-09-26T09:24:49","port":5800,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"Upgrade\",\"host\":\"<HONEYPOT>:5800\",\"sec-websocket-key\":\"lECYQCCJ5FfUDKqbgop+6A==\",\"sec-websocket-version\":\"13\",\"upgrade\":\"websocket\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/websockify","summary":"","payload_hex":"474554202f776562736f636b69667920485454502f312e310d0a486f73743a20<HONEYPOT>3a353830300d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a436f6e6e656374696f6e3a20557067726164650d0a5365632d576562536f636b65742d4b65793a206c4543595143434a35466655444b7162676f702b36413d3d0d0a5365632d576562536f636b65742d56657273696f6e3a2031330d0a557067726164653a20776562736f636b65740d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"","session":"1677d132-81ad-4d9e-befc-00c6f15fcb8e","seq":1,"duration_ms":101,"bytes_in":199,"bytes_out":79},{"timestamp":"2026-09-26T09:24:43","port":6080,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"Upgrade\",\"host\":\"<HONEYPOT>:6080\",\"sec-websocket-key\":\"q/X+dHyhWMb86ksT365e/w==\",\"sec-websocket-version\":\"13\",\"upgrade\":\"websocket\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/websockify","summary":"","payload_hex":"474554202f776562736f636b69667920485454502f312e310d0a486f73743a20<HONEYPOT>3a363038300d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a436f6e6e656374696f6e3a20557067726164650d0a5365632d576562536f636b65742d4b65793a20712f582b64487968574d6238366b7354333635652f773d3d0d0a5365632d576562536f636b65742d56657273696f6e3a2031330d0a557067726164653a20776562736f636b65740d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"","session":"3fc2169b-1e0c-4410-af87-699c06a27fe7","seq":1,"duration_ms":100,"bytes_in":199,"bytes_out":79},{"timestamp":"2026-09-26T09:24:04","port":6900,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"Upgrade\",\"host\":\"<HONEYPOT>:6900\",\"sec-websocket-key\":\"x9tfMyncyg6ZONFJrzAMYg==\",\"sec-websocket-version\":\"13\",\"upgrade\":\"websocket\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/websockify","summary":"","payload_hex":"474554202f776562736f636b69667920485454502f312e310d0a486f73743a20<HONEYPOT>3a363930300d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a436f6e6e656374696f6e3a20557067726164650d0a5365632d576562536f636b65742d4b65793a20783974664d796e637967365a4f4e464a727a414d59673d3d0d0a5365632d576562536f636b65742d56657273696f6e3a2031330d0a557067726164653a20776562736f636b65740d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"","session":"047c6753-07cb-40d0-b7d0-9b086c7036de","seq":1,"duration_ms":100,"bytes_in":198,"bytes_out":79},{"timestamp":"2026-09-26T09:23:15","port":5801,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"Upgrade\",\"host\":\"<HONEYPOT>:5801\",\"sec-websocket-key\":\"k9TJ6h13fNh1kEmfNdV+1Q==\",\"sec-websocket-version\":\"13\",\"upgrade\":\"websocket\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/websockify","summary":"","payload_hex":"474554202f776562736f636b69667920485454502f312e310d0a486f73743a20<HONEYPOT>3a353830310d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a436f6e6e656374696f6e3a20557067726164650d0a5365632d576562536f636b65742d4b65793a206b39544a36683133664e68316b456d664e64562b31513d3d0d0a5365632d576562536f636b65742d56657273696f6e3a2031330d0a557067726164653a20776562736f636b65740d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"","session":"816225ee-a016-4e95-8f00-faf7aeb04492","seq":1,"duration_ms":100,"bytes_in":198,"bytes_out":79},{"timestamp":"2026-09-26T09:22:32","port":8006,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"Upgrade\",\"host\":\"<HONEYPOT>:8006\",\"sec-websocket-key\":\"AvXx/YWjplnauZeDq6b3Fg==\",\"sec-websocket-version\":\"13\",\"upgrade\":\"websocket\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/websockify","summary":"","payload_hex":"474554202f776562736f636b69667920485454502f312e310d0a486f73743a20<HONEYPOT>3a383030360d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a436f6e6e656374696f6e3a20557067726164650d0a5365632d576562536f636b65742d4b65793a20417658782f59576a706c6e61755a65447136623346673d3d0d0a5365632d576562536f636b65742d56657273696f6e3a2031330d0a557067726164653a20776562736f636b65740d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"","session":"ca5fc14c-d934-4e12-8dde-93106a3f3e79","seq":1,"duration_ms":100,"bytes_in":199,"bytes_out":79},{"timestamp":"2026-09-26T09:21:31","port":6081,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"Upgrade\",\"host\":\"<HONEYPOT>:6081\",\"sec-websocket-key\":\"3/r5k95QZ7uP8wTk6aS8cA==\",\"sec-websocket-version\":\"13\",\"upgrade\":\"websocket\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/websockify","summary":"","payload_hex":"474554202f776562736f636b69667920485454502f312e310d0a486f73743a20<HONEYPOT>3a363038310d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a436f6e6e656374696f6e3a20557067726164650d0a5365632d576562536f636b65742d4b65793a20332f72356b3935515a3775503877546b3661533863413d3d0d0a5365632d576562536f636b65742d56657273696f6e3a2031330d0a557067726164653a20776562736f636b65740d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"","session":"e3f5bb82-5092-4acf-85d0-3c4d1e4c84d6","seq":1,"duration_ms":100,"bytes_in":199,"bytes_out":79}],"http_methods":[{"method":"GET","count":8}],"distinct_ports_total":7,"top_paths":[{"path":"/websockify","count":8,"ports":7}],"distinct_paths_total":1,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Connection","Host","Sec-Websocket-Key","Sec-Websocket-Version","Upgrade","User-Agent"],"representative":[{"name":"Connection","value":"Upgrade","notable":false},{"name":"Host","value":"<HONEYPOT>:5802","notable":false},{"name":"Sec-Websocket-Key","value":"1sci05OaOf0W2k1bNtqpBA==","notable":false},{"name":"Sec-Websocket-Version","value":"13","notable":false},{"name":"Upgrade","value":"websocket","notable":false},{"name":"User-Agent","value":"Go-http-client/1.1","notable":false}],"distinct_sets":1,"events_with_headers":8},"tags":[],"data_as_of":"2026-09-28T20:50:36.425529+00:00"}