{"ip":"176.120.22.43","total_events":164,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"23+ ports swept","confidence":"medium","network_type":null,"why":["No exploit payloads observed.","Swept 23 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"50,797 bytes sent","bytes_sent":50797,"session_seconds":0,"persistent":false}},"first_seen":"2026-08-26T17:09:58","last_seen":"2026-09-19T01:55:15","events_24h":0,"events_7d":0,"geo":{"country_code":"RU","country_name":"Russia","region":"","city":"","lat":55.7386,"lon":37.6068,"asn":198953,"org":"Proton66 OOO"},"source_domain":null,"known_scanners":[],"scanner_tag":null,"cve_matches":[],"malware":[],"top_ports":[{"port":443,"proto":"tcp","label":"HTTPS","count":15},{"port":9191,"proto":"tcp","label":"","count":15},{"port":9192,"proto":"tcp","label":"","count":15},{"port":2443,"proto":"tcp","label":"","count":8},{"port":4433,"proto":"tcp","label":"","count":8},{"port":10443,"proto":"tcp","label":"","count":8},{"port":4439,"proto":"tcp","label":"","count":8},{"port":1443,"proto":"tcp","label":"","count":7},{"port":9443,"proto":"tcp","label":"","count":7},{"port":6443,"proto":"tcp","label":"k8s API","count":6},{"port":4443,"proto":"tcp","label":"","count":6},{"port":4436,"proto":"tcp","label":"","count":6},{"port":7443,"proto":"tcp","label":"","count":6},{"port":3443,"proto":"tcp","label":"","count":6},{"port":4434,"proto":"tcp","label":"","count":6}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i1010h1_61a7ad8aa9b6_792d2c6655cb","t13i1010h1_61a7ad8aa9b6_c7ab7a5df584","t13i1010h1_61a7ad8aa9b6_3a8073edd8ef"],"tls_client_hello":"","tls_ja3":["88fee9528bafcb3b46b762e5ec0ee412","88f9ebb12e62aee7a42e837a70606481","d05c92110207ac560bc48b93c92716ff","7ee8ad4414d412460d01b849d76b2773"],"http_akin":["b11cuq050_00040816_3486cf44","b11cuq181_001d7bfe_1263bd1b_x7d4c","b11cun020_00040001_78f1f19c","b11cun050_0004001e_c137416a","b11cun040_00040016_dd148283"]},"fingerprint_peers":{"t13i1010h1_61a7ad8aa9b6_3a8073edd8ef":2970,"b11cun020_00040001_78f1f19c":49,"b11cun040_00040016_dd148283":0,"t13i1010h1_61a7ad8aa9b6_c7ab7a5df584":7,"t13i1010h1_61a7ad8aa9b6_792d2c6655cb":904,"b11cuq050_00040816_3486cf44":0,"b11cuq181_001d7bfe_1263bd1b_x7d4c":0,"b11cun050_0004001e_c137416a":0},"akin_families":{},"user_agents":["Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Edg/115.0.1901.203"],"timeline":[{"date":"2026-08-26","count":6},{"date":"2026-08-27","count":41},{"date":"2026-08-28","count":2},{"date":"2026-08-29","count":43},{"date":"2026-08-30","count":42},{"date":"2026-09-14","count":10},{"date":"2026-09-15","count":5},{"date":"2026-09-16","count":5},{"date":"2026-09-18","count":5},{"date":"2026-09-19","count":5}],"recent_events":[{"timestamp":"2026-09-19T01:55:15","port":9191,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"host\":\"<HONEYPOT>:9191\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/app","summary":"","payload_hex":"474554202f61707020485454502f312e310d0a486f73743a20<HONEYPOT>3a393139310d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"25b297fb-a279-4cc9-a835-eab623caabf6","seq":1,"duration_ms":100,"bytes_in":65,"bytes_out":78},{"timestamp":"2026-09-19T01:55:15","port":9191,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"host\":\"<HONEYPOT>:9191\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/app?service=page/Error","summary":"","payload_hex":"474554202f6170703f736572766963653d706167652f4572726f7220485454502f312e310d0a486f73743a20<HONEYPOT>3a393139310d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"eff5b624-38d7-4516-80d3-dffe9890d1cc","seq":1,"duration_ms":100,"bytes_in":84,"bytes_out":78},{"timestamp":"2026-09-19T01:55:14","port":9191,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"host\":\"<HONEYPOT>:9191\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/images/icons3/favicon.ico","summary":"","payload_hex":"474554202f696d616765732f69636f6e73332f66617669636f6e2e69636f20485454502f312e310d0a486f73743a20<HONEYPOT>3a393139310d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"46d7cb1d-ab04-4611-b48b-509be49f191c","seq":1,"duration_ms":102,"bytes_in":87,"bytes_out":78},{"timestamp":"2026-09-19T01:55:14","port":9191,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"host\":\"<HONEYPOT>:9191\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/favicon.ico","summary":"","payload_hex":"474554202f66617669636f6e2e69636f20485454502f312e310d0a486f73743a20<HONEYPOT>3a393139310d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"39692b79-5243-4e4d-ac4b-23467cac9fbc","seq":1,"duration_ms":101,"bytes_in":73,"bytes_out":78},{"timestamp":"2026-09-19T01:55:13","port":9191,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"host\":\"<HONEYPOT>:9191\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a393139310d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"9ae16ce6-99a7-4568-a143-64c737f5f1ac","seq":1,"duration_ms":100,"bytes_in":62,"bytes_out":78},{"timestamp":"2026-09-18T00:31:12","port":9192,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"host\":\"<HONEYPOT>:9192\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"/app?service=page/Error","summary":"","payload_hex":"474554202f6170703f736572766963653d706167652f4572726f7220485454502f312e310d0a486f73743a20<HONEYPOT>3a393139320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"","ja3":"957f5a4e4c5d0b16fce64e9e9c8410a9","session":"e6fe2311-3b88-47cc-9be8-fe9bd6f66788","seq":1,"duration_ms":232,"bytes_in":84,"bytes_out":78},{"timestamp":"2026-09-18T00:31:11","port":9192,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"host\":\"<HONEYPOT>:9192\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"/app","summary":"","payload_hex":"474554202f61707020485454502f312e310d0a486f73743a20<HONEYPOT>3a393139320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"","ja3":"c64e3f12ea818f9546a87932d5b3bb7c","session":"4ba0a961-6c09-4638-bc7d-4c8a1898a36d","seq":1,"duration_ms":232,"bytes_in":65,"bytes_out":78},{"timestamp":"2026-09-18T00:31:10","port":9192,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"host\":\"<HONEYPOT>:9192\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"/images/icons3/favicon.ico","summary":"","payload_hex":"474554202f696d616765732f69636f6e73332f66617669636f6e2e69636f20485454502f312e310d0a486f73743a20<HONEYPOT>3a393139320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"","ja3":"386bffdbcb4d8edbf1f2aa1b741db49b","session":"78d1fb73-6500-4f73-a147-6e1e0673f684","seq":1,"duration_ms":232,"bytes_in":87,"bytes_out":78},{"timestamp":"2026-09-18T00:31:10","port":9192,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"host\":\"<HONEYPOT>:9192\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"/favicon.ico","summary":"","payload_hex":"474554202f66617669636f6e2e69636f20485454502f312e310d0a486f73743a20<HONEYPOT>3a393139320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"","ja3":"4c6baae15a5d47750754fb8459e3c997","session":"c07de36a-caf4-4581-95c1-2fe1bae70583","seq":1,"duration_ms":232,"bytes_in":73,"bytes_out":78},{"timestamp":"2026-09-18T00:31:09","port":9192,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"host\":\"<HONEYPOT>:9192\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a393139320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"","ja3":"5761122791c8e54fc933876a35b961b6","session":"b5ed58f7-a050-42b3-9934-b3bf3b61abf8","seq":1,"duration_ms":234,"bytes_in":62,"bytes_out":78}],"http_methods":[{"method":"GET","count":99},{"method":"POST","count":65}],"distinct_ports_total":23,"top_paths":[{"path":"/","count":94,"ports":23},{"path":"/global-protect/login.esp","count":44,"ports":16},{"path":"/app","count":6,"ports":2},{"path":"/favicon.ico","count":6,"ports":2},{"path":"/app?service=page/Error","count":6,"ports":2},{"path":"/images/icons3/favicon.ico","count":6,"ports":2},{"path":"/+CSCOE+/logon.html","count":2,"ports":1}],"distinct_paths_total":7,"top_snis":[],"top_hosts":[],"top_alpns":[{"value":"http/1.1","count":149}],"banners":[],"credentials":[{"username":"BJohn","password":"Password123%21","count":20}],"header_profile":{"signature":["Connection","Host"],"representative":[{"name":"Connection","value":"close","notable":false},{"name":"Host","value":"<HONEYPOT>:9191","notable":false}],"distinct_sets":1,"events_with_headers":10},"tags":[],"data_as_of":"2026-09-30T19:12:34.770342+00:00"}