{"ip":"176.65.139.229","total_events":20,"verdict":{"verdict":"probing","label":"Low-level probing","detail":null,"confidence":"low","network_type":null,"why":["20 event(s), fewer than 10 distinct ports, no exploit payloads.","Not in any known-scanner range.","Sent 4,537 bytes despite few ports and no known exploit path: focused interaction with one service, worth a look."],"engagement":{"level":"payload","label":"Sustained payload","detail":"4,537 bytes sent","bytes_sent":4537,"session_seconds":0,"persistent":false}},"first_seen":"2026-09-22T08:53:31","last_seen":"2026-09-26T00:27:38","events_24h":0,"events_7d":13,"geo":{"country_code":"DE","country_name":"Germany","region":"","city":"","lat":51.2993,"lon":9.491,"asn":219502,"org":"Storm Industries LLC"},"source_domain":null,"known_scanners":[],"scanner_tag":null,"cve_matches":[],"malware":[],"top_ports":[{"port":80,"proto":"tcp","label":"HTTP","count":10},{"port":7681,"proto":"tcp","label":"","count":5},{"port":443,"proto":"tcp","label":"HTTPS","count":5}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i131000_f57a46bbacb6_f50d94e863eb","t13i191000_9dc949149365_e5728521abd4"],"tls_client_hello":"16030105d2010005ce030366a9055ac16ba63e09158f98935d6030fac59a21266a8897b98691bffe874d5d20a3ffb8b2460e4ae6bd211be19441ce9cb181912b96e8386cb7b69b39d14fbfe7001ac02bc02fc02cc030cca9cca8c009c013c00ac0141301130213030100056b000b00020100ff010001000017000000120000000500050100000000000a0010000e11ec11eb11ed001d001700180019000d001c001a090409050906080404030807080508060401050106010503060300320020001e090409050906080404030807080508060401050106010503060302010203002b00050403040303003304ea04e811ec04c0d8375d8b41524d61a6cbb5cb550a08eec98a59d70a7dc06a6d3474923c2e37077899605f4eb0bfa8b50889c46a3e71036cc3c6b30477741bc335c11c5878277335ae0a7041f1e1cbc70693dd4b315c1aa26da73874953ac49a536c05c099a836e7f7c02881271e76b0e6d2acd6484a8c5a7cf629cb10705552f157e080788418561d498574782b011205513004112335e5e19640773d424609176a9e2c3b5e72597c51074a9a1c04c985436050126b130dc22857c7ec4635bc9872d94c3562a7617668dfd4c6c0810b64c3bcf2c61a8a1a4e4735afce0449ff74817fa23c5b37497b0b1c7734c5c558a5f532c046427a0102642912c73198cad136b6d33c6ecbe56023106f97f4cd1690af2ae37aba80b218783492d862f9542ceb84acc4134ca4450ab7083f96ca2a0fa6b3ffe96b22071ed7aa5822733a4301bd589ca652983785682b87071cb4684719b6323a3abc908c827be9b2a3fb08848960c9e39a7554ad1cabc2f0ea320a6a4bf113a02b154775fc45a3122b9946bbe8221d0b5b93fb3bc607bb58b2fc59dc9c256e24635fd7943b906a1b808939e261e44193f8219e3d51681366334f41a9c1e30a33847cb160babe7b3f6d0038ee49ae61850f2bd94c6b51307b3211c7a5b6d1d8899cd67807ac4333a13bc9a5cd10e79843127900242774ec10e97548189466170940ba2072c583bd8b9617269905cf3c3f2eeb6aed39b920aa4d241bc70c8519690bd081c7b0eda40d61eb9c4d7ca1eb3564c0cc14e8672881b8a0819051aea0c2641753e172a7aba27a3d1a815cac35a24b4cb8b471827ba6ac602c148aa19c769cdfa346cc29026a7a6beb5062f2c54f37e6989a9009db9543a8bcc61707772b8c407dc08e391982ed4c57ef512befa12a5eeab686c24bcb9c3bbf627413ea5274f8439f058a85187ff6234faa9a79df3530508795151a61a7844e20b35466e8ace259aa2f304b6df2683ac29bab26818d37acc8505cac72335170933fab6818566ce0822f24db461f341fa27cb99a37aa77ea8ae7b0c552310796747f03a402a1c562bd26bbd1e58d15a37989672061837648a4bd66965520339397d96c2fa96627b738f125703af9395cacc00d75147a6bc54fc0c803e36d19abbfabc88142263e45250fa1f624372539406993a056572a49999fa27145747a63914741e7b40bccbaabf48e7b720c00274dd4386a1df03313203ce4c6c8637302aaa48796b8bdc38a9b45a4958c61822ba952ca6ab00029a8cf529d5e580f6b0479b011362148659b0c6dd3d4864e75cea5246e79578f97e58c1d7018ac60502d17376e85a1d6836dafb98dc6d84ecda31d63a3ce40b25bf020afba8b0bf1a89364366130ac0ae5a0a707539d2c5918d4a366f8a19a195660087961e0d6516c433a5f57688fdc33da93bdca477814d78c35944e4e62180c2b17b634cb16d6890090415b454f9cc7ad1a79999dabb6bcc9557589abaad7913902c61deb8d8921af55fb823416a599867f0d653135815f64e814c2509fbdf17ce0a77cc05054a7b870eaf4b6f08a725656bacf49a56443809693c50d07c9f515415fcc690783409bf43ac7d13228264ffbe1962ac989b5a846c3a308d2c0316609936db8259202e39477ca49a679bdbde47dc67df030a0c54d190c4f098250f7ff8d155af86d56319418ec5c31372c8f270eee7389612889e966951f69bc4f001d0020f7ff8d155af86d56319418ec5c31372c8f270eee7389612889e966951f69bc4f","tls_ja3":["96458b3de39df5d47bc5c4a9f10f8f26","725543c78edf669194c11dc7a039b56e"],"http_akin":["b11cun030_00040012_13ee3d34","b11cun103_50340011_f5d02f95_x9f62a4acfdb1","b11cun040_00040013_608dab68","b11cun092_50340011_b9bb172f_x9f62fdb1"]},"fingerprint_peers":{"t13i131000_f57a46bbacb6_f50d94e863eb":2741,"t13i191000_9dc949149365_e5728521abd4":222,"b11cun030_00040012_13ee3d34":5063,"b11cun103_50340011_f5d02f95_x9f62a4acfdb1":22,"b11cun040_00040013_608dab68":4310,"b11cun092_50340011_b9bb172f_x9f62fdb1":2},"akin_families":{"b11cun103_50340011_f5d02f95_x9f62a4acfdb1":{"head":"b11cun103_50340011_f5d02f95_x9f62a4acfdb1","shapes":2,"ips":22},"b11cun092_50340011_b9bb172f_x9f62fdb1":{"head":"b11cun103_50340011_f5d02f95_x9f62a4acfdb1","shapes":2,"ips":22}},"user_agents":["Go-http-client/1.1","Mozilla/5.0 Chrome/124.0","Mozilla/5.0 (Linux; Android 15; SM-G998B) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Mobile Safari/537.36","Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Edg/132.0.0.0","Mozilla/5.0 (Macintosh; Intel Mac OS X 15_1) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.2 Safari/605.1.15","Mozilla/5.0 (iPhone; CPU iPhone OS 18_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/131.0.0.0 Mobile/15E148 Safari/604.1","Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36","Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36 OPR/117.0.0.0"],"timeline":[{"date":"2026-09-22","count":7},{"date":"2026-09-25","count":8},{"date":"2026-09-26","count":5}],"recent_events":[{"timestamp":"2026-09-26T00:27:38","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (Windows NT 11.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/api/json","summary":"","payload_hex":"474554202f6170692f6a736f6e20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031312e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3133322e302e302e30205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 11.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36","ja3":"725543c78edf669194c11dc7a039b56e","session":"dfe962bf-1a5c-46ec-93ff-d8596bbd0ad2","seq":1,"duration_ms":101,"bytes_in":194,"bytes_out":79},{"timestamp":"2026-09-26T00:27:37","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (iPad; CPU OS 18_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.1 Mobile/15E148 Safari/604.1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/api/json","summary":"","payload_hex":"474554202f6170692f6a736f6e20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e302028695061643b20435055204f532031385f31206c696b65204d6163204f53205829204170706c655765624b69742f3630352e312e313520284b48544d4c2c206c696b65204765636b6f292056657273696f6e2f31382e31204d6f62696c652f313545313438205361666172692f3630342e310d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (iPad; CPU OS 18_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.1 Mobile/15E148 Safari/604.1","ja3":"","session":"cd403ef4-eec7-48f6-bf4e-45d3e6825987","seq":1,"duration_ms":100,"bytes_in":209,"bytes_out":79},{"timestamp":"2026-09-26T00:12:46","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:80\",\"user-agent\":\"Mozilla/5.0 Chrome/124.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/geoserver/web/","summary":"","payload_hex":"474554202f67656f7365727665722f7765622f20485454502f312e310d0a486f73743a20<HONEYPOT>3a38300d0a557365722d4167656e743a204d6f7a696c6c612f352e30204368726f6d652f3132342e300d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 Chrome/124.0","ja3":"","session":"180ff9a9-c207-42ab-b9a6-e09ddc8780f8","seq":1,"duration_ms":100,"bytes_in":136,"bytes_out":79},{"timestamp":"2026-09-26T00:12:45","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:80\",\"user-agent\":\"Mozilla/5.0 Chrome/124.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/geoserver/wfs?request=GetCapabilities&service=wfs","summary":"","payload_hex":"474554202f67656f7365727665722f7766733f726571756573743d4765744361706162696c697469657326736572766963653d77667320485454502f312e310d0a486f73743a20<HONEYPOT>3a38300d0a557365722d4167656e743a204d6f7a696c6c612f352e30204368726f6d652f3132342e300d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 Chrome/124.0","ja3":"","session":"31713c41-cd8e-4fbf-accd-57056c1b0947","seq":1,"duration_ms":100,"bytes_in":171,"bytes_out":79},{"timestamp":"2026-09-26T00:12:45","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:80\",\"user-agent\":\"Mozilla/5.0 Chrome/124.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/wfs?request=GetCapabilities&service=wfs","summary":"","payload_hex":"474554202f7766733f726571756573743d4765744361706162696c697469657326736572766963653d77667320485454502f312e310d0a486f73743a20<HONEYPOT>3a38300d0a557365722d4167656e743a204d6f7a696c6c612f352e30204368726f6d652f3132342e300d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 Chrome/124.0","ja3":"","session":"08a1abd8-3dee-4797-a4fe-67f6289938ea","seq":1,"duration_ms":100,"bytes_in":161,"bytes_out":79},{"timestamp":"2026-09-25T21:44:27","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36 OPR/117.0.0.0\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/api/json","summary":"","payload_hex":"474554202f6170692f6a736f6e20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3133322e302e302e30205361666172692f3533372e3336204f50522f3131372e302e302e300d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36 OPR/117.0.0.0","ja3":"725543c78edf669194c11dc7a039b56e","session":"5199719d-d861-44b2-a95b-a0d77c18dd26","seq":1,"duration_ms":100,"bytes_in":209,"bytes_out":79},{"timestamp":"2026-09-25T21:44:25","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (iPhone; CPU iPhone OS 18_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/131.0.0.0 Mobile/15E148 Safari/604.1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/api/json","summary":"","payload_hex":"474554202f6170692f6a736f6e20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e3020286950686f6e653b20435055206950686f6e65204f532031385f30206c696b65204d6163204f53205829204170706c655765624b69742f3630352e312e313520284b48544d4c2c206c696b65204765636b6f29204372694f532f3133312e302e302e30204d6f62696c652f313545313438205361666172692f3630342e310d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (iPhone; CPU iPhone OS 18_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/131.0.0.0 Mobile/15E148 Safari/604.1","ja3":"","session":"6582dad5-5c1a-4fdc-8e34-81c62f0a084b","seq":1,"duration_ms":100,"bytes_in":222,"bytes_out":79},{"timestamp":"2026-09-25T18:13:20","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (Linux; Android 15; SM-G998B) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Mobile Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/api/json","summary":"","payload_hex":"474554202f6170692f6a736f6e20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e3020284c696e75783b20416e64726f69642031353b20534d2d473939384229204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3133322e302e302e30204d6f62696c65205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Linux; Android 15; SM-G998B) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Mobile Safari/537.36","ja3":"725543c78edf669194c11dc7a039b56e","session":"e92fa689-a1ce-47df-a24d-484d89499135","seq":1,"duration_ms":100,"bytes_in":203,"bytes_out":79},{"timestamp":"2026-09-25T18:13:17","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Edg/132.0.0.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/api/json","summary":"","payload_hex":"474554202f6170692f6a736f6e20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3133322e302e302e30204564672f3133322e302e302e300d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Edg/132.0.0.0","ja3":"","session":"067ac4f8-b8da-4932-a345-d00bb1a12fa6","seq":1,"duration_ms":100,"bytes_in":196,"bytes_out":79},{"timestamp":"2026-09-25T15:13:48","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 15_1) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.2 Safari/605.1.15\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/api/json","summary":"","payload_hex":"474554202f6170692f6a736f6e20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e3020284d6163696e746f73683b20496e74656c204d6163204f5320582031355f3129204170706c655765624b69742f3630352e312e313520284b48544d4c2c206c696b65204765636b6f292056657273696f6e2f31382e32205361666172692f3630352e312e31350d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 15_1) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.2 Safari/605.1.15","ja3":"725543c78edf669194c11dc7a039b56e","session":"dccdf45c-d90a-4040-af55-e824e7a14140","seq":1,"duration_ms":112,"bytes_in":198,"bytes_out":79}],"http_methods":[{"method":"GET","count":20}],"distinct_ports_total":3,"top_paths":[{"path":"/api/json","count":8,"ports":2},{"path":"/ws","count":5,"ports":1},{"path":"/login","count":2,"ports":2},{"path":"/geoserver/wfs?request=ListStoredQueries&service=wfs&version=2.0.0","count":2,"ports":1},{"path":"/geoserver/web/","count":1,"ports":1},{"path":"/wfs?request=GetCapabilities&service=wfs","count":1,"ports":1},{"path":"/geoserver/wfs?request=GetCapabilities&service=wfs","count":1,"ports":1}],"distinct_paths_total":7,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept-Encoding","Connection","Host","User-Agent"],"representative":[{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Connection","value":"close","notable":false},{"name":"Host","value":"<HONEYPOT>:80","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 Chrome/124.0","notable":false}],"distinct_sets":2,"events_with_headers":10},"tags":[],"data_as_of":"2026-09-30T17:18:31.477227+00:00"}