{"ip":"178.16.55.132","total_events":10,"verdict":{"verdict":"probing","label":"Low-level probing","detail":null,"confidence":"low","network_type":null,"why":["10 event(s), fewer than 10 distinct ports, no exploit payloads.","Not in any known-scanner range."],"engagement":{"level":"request","label":"Request traffic","detail":"1,797 bytes sent","bytes_sent":1797,"session_seconds":1,"persistent":false}},"first_seen":"2026-09-28T06:06:18","last_seen":"2026-10-01T19:12:11","events_24h":6,"events_7d":10,"geo":{"country_code":"US","country_name":"United States","region":"New York","city":"New York","lat":40.7503,"lon":-74.0014,"asn":202412,"org":"Omegatech LTD"},"source_domain":null,"known_scanners":[],"scanner_tag":null,"cve_matches":[],"malware":[],"top_ports":[{"port":22222,"proto":"tcp","label":"","count":4},{"port":4438,"proto":"tcp","label":"","count":3},{"port":4436,"proto":"tcp","label":"","count":3}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i200900_2b729b4bf6f3_29829a46703f"],"tls_client_hello":"1603010197010001930303267e258dd21de7cf3a9f757eb56b8597f12241f9a50a2f3f45b2b567ff299d56202114139b1f960183e514d443edb64c493bf1f0bc771b1859fee20d866b6ea88d002813021301c02cc02bc030c02fc024c023c028c027c00ac009c014c013009d009c003d003c0035002f01000122002b0009080304030303020301000d001a001808040805080604010501020104030503020302020601060300230000000a00080006001d00170018003300d000ce001d0020158ae8716717c5b5f581d1f307e7d864ef628cb948025ea5a0dad44153e51f4c00170041049044b35822b39a505756cb6e3130bdad1768e60e467745f5d7b46075aa4c39bfdc5fb139b74cf6eea79ad5ebc82aa4df845f6d5faa24105925486f992394a0ad0018006104809e9f4d634fa4f7ede4d1e46a589b3c0049d3a4c4e615f5b8bd817ad5664930bd709cc1ef3e6786c447d0f379c715e61f96ca0d78451acab7a60bdb549308f92688b3e0ec0e960455a416f240cfebdbf745b0b0b2f38824aee7c42b09626e3c0031000000170000ff0100010000","tls_ja3":["4d5efa96609dc906f796e63cff009c2a"],"http_akin":["b11cun030_00040003_21fe282e","b11cun020_00040002_5ff1c0a9"]},"fingerprint_peers":{"t13i200900_2b729b4bf6f3_29829a46703f":4,"b11cun030_00040003_21fe282e":14,"b11cun020_00040002_5ff1c0a9":128},"akin_families":{"b11cun030_00040003_21fe282e":{"head":"b11cun020_00040002_5ff1c0a9","shapes":2,"ips":128},"b11cun020_00040002_5ff1c0a9":{"head":"b11cun020_00040002_5ff1c0a9","shapes":2,"ips":128}},"user_agents":[],"timeline":[{"date":"2026-09-28","count":4},{"date":"2026-10-01","count":6}],"recent_events":[{"timestamp":"2026-10-01T19:12:11","port":4436,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:4436\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/remote/login?lang=en","summary":"","payload_hex":"474554202f72656d6f74652f6c6f67696e3f6c616e673d656e20485454502f312e310d0a486f73743a20<HONEYPOT>3a343433360d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"","ja3":"4d5efa96609dc906f796e63cff009c2a","session":"9a45568b-605c-4bc9-93c1-dbcddef7c61e","seq":2,"duration_ms":383,"bytes_in":196,"bytes_out":156},{"timestamp":"2026-10-01T19:12:11","port":4436,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:4436\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/remote/login?lang=en","summary":"","payload_hex":"474554202f72656d6f74652f6c6f67696e3f6c616e673d656e20485454502f312e310d0a486f73743a20<HONEYPOT>3a343433360d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"","ja3":"4d5efa96609dc906f796e63cff009c2a","session":"9a45568b-605c-4bc9-93c1-dbcddef7c61e","seq":3,"duration_ms":655,"bytes_in":282,"bytes_out":234},{"timestamp":"2026-10-01T19:12:10","port":4436,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"Keep-Alive\",\"host\":\"<HONEYPOT>:4436\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/remote/login?lang=en","summary":"","payload_hex":"474554202f72656d6f74652f6c6f67696e3f6c616e673d656e20485454502f312e310d0a486f73743a20<HONEYPOT>3a343433360d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a204b6565702d416c6976650d0a0d0a","method":"GET","user_agent":"","ja3":"4d5efa96609dc906f796e63cff009c2a","session":"9a45568b-605c-4bc9-93c1-dbcddef7c61e","seq":1,"duration_ms":100,"bytes_in":110,"bytes_out":78},{"timestamp":"2026-10-01T16:38:04","port":4438,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:4438\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/remote/login?lang=en","summary":"","payload_hex":"474554202f72656d6f74652f6c6f67696e3f6c616e673d656e20485454502f312e310d0a486f73743a20<HONEYPOT>3a343433380d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"","ja3":"4d5efa96609dc906f796e63cff009c2a","session":"a4528261-d230-4556-80e9-15573954127e","seq":2,"duration_ms":393,"bytes_in":196,"bytes_out":156},{"timestamp":"2026-10-01T16:38:04","port":4438,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:4438\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/remote/login?lang=en","summary":"","payload_hex":"474554202f72656d6f74652f6c6f67696e3f6c616e673d656e20485454502f312e310d0a486f73743a20<HONEYPOT>3a343433380d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"","ja3":"4d5efa96609dc906f796e63cff009c2a","session":"a4528261-d230-4556-80e9-15573954127e","seq":3,"duration_ms":713,"bytes_in":282,"bytes_out":234},{"timestamp":"2026-10-01T16:38:03","port":4438,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"Keep-Alive\",\"host\":\"<HONEYPOT>:4438\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/remote/login?lang=en","summary":"","payload_hex":"474554202f72656d6f74652f6c6f67696e3f6c616e673d656e20485454502f312e310d0a486f73743a20<HONEYPOT>3a343433380d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a204b6565702d416c6976650d0a0d0a","method":"GET","user_agent":"","ja3":"4d5efa96609dc906f796e63cff009c2a","session":"a4528261-d230-4556-80e9-15573954127e","seq":1,"duration_ms":100,"bytes_in":110,"bytes_out":78},{"timestamp":"2026-09-28T07:55:47","port":22222,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:22222\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/remote/login?lang=en","summary":"","payload_hex":"474554202f72656d6f74652f6c6f67696e3f6c616e673d656e20485454502f312e310d0a486f73743a20<HONEYPOT>3a32323232320d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"","ja3":"4d5efa96609dc906f796e63cff009c2a","session":"6ff66b1f-4a1d-4299-98e5-c65ebbebe6bb","seq":2,"duration_ms":758,"bytes_in":200,"bytes_out":156},{"timestamp":"2026-09-28T07:55:46","port":22222,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"Keep-Alive\",\"host\":\"<HONEYPOT>:22222\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/remote/login?lang=en","summary":"","payload_hex":"474554202f72656d6f74652f6c6f67696e3f6c616e673d656e20485454502f312e310d0a486f73743a20<HONEYPOT>3a32323232320d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a204b6565702d416c6976650d0a0d0a","method":"GET","user_agent":"","ja3":"4d5efa96609dc906f796e63cff009c2a","session":"6ff66b1f-4a1d-4299-98e5-c65ebbebe6bb","seq":1,"duration_ms":100,"bytes_in":112,"bytes_out":78},{"timestamp":"2026-09-28T06:06:19","port":22222,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:22222\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/remote/login?lang=en","summary":"","payload_hex":"474554202f72656d6f74652f6c6f67696e3f6c616e673d656e20485454502f312e310d0a486f73743a20<HONEYPOT>3a32323232320d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"","ja3":"4d5efa96609dc906f796e63cff009c2a","session":"6816506c-5218-4088-a52b-4e17015602f3","seq":2,"duration_ms":665,"bytes_in":198,"bytes_out":156},{"timestamp":"2026-09-28T06:06:18","port":22222,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"Keep-Alive\",\"host\":\"<HONEYPOT>:22222\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/remote/login?lang=en","summary":"","payload_hex":"474554202f72656d6f74652f6c6f67696e3f6c616e673d656e20485454502f312e310d0a486f73743a20<HONEYPOT>3a32323232320d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a204b6565702d416c6976650d0a0d0a","method":"GET","user_agent":"","ja3":"4d5efa96609dc906f796e63cff009c2a","session":"6816506c-5218-4088-a52b-4e17015602f3","seq":1,"duration_ms":100,"bytes_in":111,"bytes_out":78}],"http_methods":[{"method":"GET","count":10}],"distinct_ports_total":3,"top_paths":[{"path":"/remote/login?lang=en","count":10,"ports":3}],"distinct_paths_total":1,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept-Encoding","Connection","Host"],"representative":[{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Connection","value":"Keep-Alive","notable":false},{"name":"Host","value":"<HONEYPOT>:4436","notable":false}],"distinct_sets":2,"events_with_headers":10},"tags":[],"data_as_of":"2026-10-02T00:18:53.693663+00:00"}