{"ip":"178.16.52.10","total_events":80,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"16+ ports swept","confidence":"medium","network_type":null,"why":["No exploit payloads observed.","Swept 16 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"7,383 bytes sent","bytes_sent":7383,"session_seconds":4,"persistent":false}},"first_seen":"2026-09-15T15:27:40","last_seen":"2026-09-24T11:11:49","events_24h":8,"events_7d":50,"geo":{"country_code":"DE","country_name":"Germany","region":"Hesse","city":"Frankfurt am Main","lat":50.1517,"lon":8.7523,"asn":202412,"org":"Omegatech LTD"},"source_domain":null,"known_scanners":[],"scanner_tag":null,"cve_matches":[],"malware":[],"top_ports":[{"port":8443,"proto":"tcp","label":"HTTPS-alt","count":12},{"port":10000,"proto":"tcp","label":"Webmin","count":10},{"port":4433,"proto":"tcp","label":"","count":6},{"port":40000,"proto":"tcp","label":"","count":6},{"port":4443,"proto":"tcp","label":"","count":6},{"port":11111,"proto":"tcp","label":"","count":6},{"port":12443,"proto":"tcp","label":"","count":6},{"port":57443,"proto":"tcp","label":"","count":4},{"port":999,"proto":"tcp","label":"","count":4},{"port":4880,"proto":"tcp","label":"","count":4},{"port":441,"proto":"tcp","label":"","count":4},{"port":4434,"proto":"tcp","label":"","count":4},{"port":59443,"proto":"tcp","label":"","count":2},{"port":54443,"proto":"tcp","label":"","count":2},{"port":56443,"proto":"tcp","label":"","count":2}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i220900_231e334592e8_29829a46703f"],"tls_client_hello":"16030100f1010000ed03039a94ddccac2c9f06ce6c13b7acc994b1a38ce4774b53c9f75d9c6db6acfcb918200a610288fefcab395e98f185c98ee34d9b97135436cf9abd2f29c75dabd56cae002c13021301c02cc02bc030c02f009f009ec024c023c028c027c00ac009c014c013009d009c003d003c0035002f01000078002b0009080304030303020301000d001a001808040805080604010501020104030503020302020601060300230000000a00080006001d00170018003300260024001d0020b0f901d11a5c378b96f79bafa3a7bf1afa321e329e09bfadda2e53e1d50a6f120031000000170000ff01000100002d000201","tls_ja3":["622a7fd6adbafa3736c1a3468db8a8e0"],"http_akin":["a11cun020_0000000a_4e1a3733","a11cun010_00000008_c4b2c4aa"]},"fingerprint_peers":{"t13i220900_231e334592e8_29829a46703f":10,"a11cun020_0000000a_4e1a3733":1,"a11cun010_00000008_c4b2c4aa":401},"akin_families":{},"user_agents":[],"timeline":[{"date":"2026-09-15","count":4},{"date":"2026-09-16","count":12},{"date":"2026-09-17","count":20},{"date":"2026-09-18","count":2},{"date":"2026-09-19","count":2},{"date":"2026-09-20","count":4},{"date":"2026-09-21","count":14},{"date":"2026-09-22","count":2},{"date":"2026-09-23","count":14},{"date":"2026-09-24","count":6}],"recent_events":[{"timestamp":"2026-09-24T11:11:49","port":59443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"Keep-Alive\",\"host\":\"<HONEYPOT>:59443\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a35393434330d0a436f6e6e656374696f6e3a204b6565702d416c6976650d0a0d0a","method":"GET","user_agent":"","ja3":"622a7fd6adbafa3736c1a3468db8a8e0","session":"81b22912-d561-409c-9440-f6dec2390a14","seq":1,"duration_ms":100,"bytes_in":69,"bytes_out":77},{"timestamp":"2026-09-24T11:11:34","port":59443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"Keep-Alive\",\"host\":\"<HONEYPOT>:59443\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a35393434330d0a436f6e6e656374696f6e3a204b6565702d416c6976650d0a0d0a","method":"GET","user_agent":"","ja3":"622a7fd6adbafa3736c1a3468db8a8e0","session":"3654b215-7dec-4431-8228-9ee9d02c5897","seq":1,"duration_ms":100,"bytes_in":69,"bytes_out":77},{"timestamp":"2026-09-24T01:48:07","port":999,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"Keep-Alive\",\"host\":\"<HONEYPOT>:999\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a3939390d0a436f6e6e656374696f6e3a204b6565702d416c6976650d0a0d0a","method":"GET","user_agent":"","ja3":"622a7fd6adbafa3736c1a3468db8a8e0","session":"d4dd7914-a6bc-4677-b98d-f5f0bd836e78","seq":1,"duration_ms":100,"bytes_in":66,"bytes_out":77},{"timestamp":"2026-09-24T01:48:07","port":999,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"Keep-Alive\",\"host\":\"<HONEYPOT>:999\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a3939390d0a436f6e6e656374696f6e3a204b6565702d416c6976650d0a0d0a","method":"GET","user_agent":"","ja3":"622a7fd6adbafa3736c1a3468db8a8e0","session":"d0ef57d3-98e7-4d62-a8b2-503b06fd408d","seq":1,"duration_ms":100,"bytes_in":66,"bytes_out":77},{"timestamp":"2026-09-24T01:13:25","port":999,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"Keep-Alive\",\"host\":\"<HONEYPOT>:999\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a3939390d0a436f6e6e656374696f6e3a204b6565702d416c6976650d0a0d0a","method":"GET","user_agent":"","ja3":"622a7fd6adbafa3736c1a3468db8a8e0","session":"df1f6478-1600-4dcc-82fd-8d10b0b3ab2c","seq":1,"duration_ms":100,"bytes_in":67,"bytes_out":77},{"timestamp":"2026-09-24T01:13:24","port":999,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"Keep-Alive\",\"host\":\"<HONEYPOT>:999\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a3939390d0a436f6e6e656374696f6e3a204b6565702d416c6976650d0a0d0a","method":"GET","user_agent":"","ja3":"622a7fd6adbafa3736c1a3468db8a8e0","session":"9ad6e0af-127e-4c7e-8a1b-82fe7915c55f","seq":1,"duration_ms":100,"bytes_in":67,"bytes_out":77},{"timestamp":"2026-09-23T20:25:10","port":441,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"host\":\"<HONEYPOT>:441\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a3434310d0a0d0a","method":"GET","user_agent":"","ja3":"622a7fd6adbafa3736c1a3468db8a8e0","session":"7f250f91-b8ef-4e1f-b771-13a73329bdc1","seq":2,"duration_ms":2509,"bytes_in":110,"bytes_out":154},{"timestamp":"2026-09-23T20:25:07","port":441,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"Keep-Alive\",\"host\":\"<HONEYPOT>:441\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a3434310d0a436f6e6e656374696f6e3a204b6565702d416c6976650d0a0d0a","method":"GET","user_agent":"","ja3":"622a7fd6adbafa3736c1a3468db8a8e0","session":"7f250f91-b8ef-4e1f-b771-13a73329bdc1","seq":1,"duration_ms":100,"bytes_in":67,"bytes_out":77},{"timestamp":"2026-09-23T14:32:23","port":441,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"Keep-Alive\",\"host\":\"<HONEYPOT>:441\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a3434310d0a436f6e6e656374696f6e3a204b6565702d416c6976650d0a0d0a","method":"GET","user_agent":"","ja3":"622a7fd6adbafa3736c1a3468db8a8e0","session":"2bddbab7-45b3-40c0-ae42-85dda8041e2f","seq":1,"duration_ms":101,"bytes_in":66,"bytes_out":77},{"timestamp":"2026-09-23T14:32:14","port":441,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"Keep-Alive\",\"host\":\"<HONEYPOT>:441\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a3434310d0a436f6e6e656374696f6e3a204b6565702d416c6976650d0a0d0a","method":"GET","user_agent":"","ja3":"622a7fd6adbafa3736c1a3468db8a8e0","session":"6c79edbc-347d-4921-8769-454ac19cbc78","seq":1,"duration_ms":100,"bytes_in":66,"bytes_out":77}],"http_methods":[{"method":"GET","count":80}],"distinct_ports_total":16,"top_paths":[{"path":"/","count":80,"ports":16}],"distinct_paths_total":1,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Connection","Host"],"representative":[{"name":"Connection","value":"Keep-Alive","notable":false},{"name":"Host","value":"<HONEYPOT>:59443","notable":false}],"distinct_sets":2,"events_with_headers":10},"tags":[],"data_as_of":"2026-09-24T18:44:03.791903+00:00"}