{"ip":"185.180.222.6","total_events":6,"verdict":{"verdict":"probing","label":"Low-level probing","detail":null,"confidence":"low","network_type":"network services","why":["6 event(s), fewer than 10 distinct ports, no exploit payloads.","Not in any known-scanner range."],"engagement":{"level":"request","label":"Request traffic","detail":"1,104 bytes sent","bytes_sent":1104,"session_seconds":0,"persistent":false}},"first_seen":"2026-09-05T22:37:55","last_seen":"2026-09-06T00:43:58","events_24h":0,"events_7d":0,"geo":{"country_code":"NL","country_name":"The Netherlands","region":"South Holland","city":"Naaldwijk","lat":51.9968,"lon":4.2057,"asn":49981,"org":"WorldStream B.V."},"source_domain":null,"known_scanners":[],"scanner_tag":null,"cve_matches":[],"malware":[],"top_ports":[{"port":9191,"proto":"tcp","label":"","count":4},{"port":9192,"proto":"tcp","label":"","count":2}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":["b11cun030_00040012_13ee3d34","b11cuq060_10050812_0421ce22"]},"fingerprint_peers":{"b11cun030_00040012_13ee3d34":5041,"b11cuq060_10050812_0421ce22":4},"akin_families":{},"user_agents":["Mozilla/5.0"],"timeline":[{"date":"2026-09-05","count":4},{"date":"2026-09-06","count":2}],"recent_events":[{"timestamp":"2026-09-06T00:43:58","port":9192,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:9192\",\"user-agent\":\"Mozilla/5.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/user","summary":"","payload_hex":"474554202f7573657220485454502f312e310d0a486f73743a20<HONEYPOT>3a393139320d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0","ja3":"","session":"e50df039-c16f-4d2d-9be6-77d234c5b09b","seq":1,"duration_ms":100,"bytes_in":95,"bytes_out":78},{"timestamp":"2026-09-06T00:43:58","port":9192,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"content-length\":\"27\",\"content-type\":\"application/x-www-form-urlencoded\",\"host\":\"<HONEYPOT>:9192\",\"origin\":\"http://<HONEYPOT>:9192\",\"user-agent\":\"Mozilla/5.0\"}","body":"quickFindForm=quickFindForm","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/app?service=direct/1/Home/UserList/$QuickFind.$Form","summary":"","payload_hex":"504f5354202f6170703f736572766963653d6469726563742f312f486f6d652f557365724c6973742f24517569636b46696e642e24466f726d20485454502f312e310d0a486f73743a20<HONEYPOT>3a393139320d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a436f6e74656e742d4c656e6774683a2032370d0a436f6e74656e742d547970653a206170706c69636174696f6e2f782d7777772d666f726d2d75726c656e636f6465640d0a4f726967696e3a20687474703a2f2f<HONEYPOT>3a393139320d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a717569636b46696e64466f726d3d717569636b46696e64466f726d","method":"POST","user_agent":"Mozilla/5.0","ja3":"","session":"1637f488-f8f5-4f68-b7b9-461d1b9bb057","seq":1,"duration_ms":100,"bytes_in":273,"bytes_out":78},{"timestamp":"2026-09-05T23:21:50","port":9191,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"content-length\":\"27\",\"content-type\":\"application/x-www-form-urlencoded\",\"host\":\"<HONEYPOT>:9191\",\"origin\":\"http://<HONEYPOT>:9191\",\"user-agent\":\"Mozilla/5.0\"}","body":"quickFindForm=quickFindForm","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/app?service=direct/1/Home/UserList/$QuickFind.$Form","summary":"","payload_hex":"504f5354202f6170703f736572766963653d6469726563742f312f486f6d652f557365724c6973742f24517569636b46696e642e24466f726d20485454502f312e310d0a486f73743a20<HONEYPOT>3a393139310d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a436f6e74656e742d4c656e6774683a2032370d0a436f6e74656e742d547970653a206170706c69636174696f6e2f782d7777772d666f726d2d75726c656e636f6465640d0a4f726967696e3a20687474703a2f2f<HONEYPOT>3a393139310d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a717569636b46696e64466f726d3d717569636b46696e64466f726d","method":"POST","user_agent":"Mozilla/5.0","ja3":"","session":"7b7e7557-d91e-4c5e-9ca9-000a45424329","seq":1,"duration_ms":101,"bytes_in":273,"bytes_out":78},{"timestamp":"2026-09-05T23:21:49","port":9191,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:9191\",\"user-agent\":\"Mozilla/5.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/user","summary":"","payload_hex":"474554202f7573657220485454502f312e310d0a486f73743a20<HONEYPOT>3a393139310d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0","ja3":"","session":"3ba31f2f-2936-4b47-82ad-2e8a5d70d707","seq":1,"duration_ms":100,"bytes_in":95,"bytes_out":78},{"timestamp":"2026-09-05T22:37:56","port":9191,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"content-length\":\"27\",\"content-type\":\"application/x-www-form-urlencoded\",\"host\":\"<HONEYPOT>:9191\",\"origin\":\"http://<HONEYPOT>:9191\",\"user-agent\":\"Mozilla/5.0\"}","body":"quickFindForm=quickFindForm","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/app?service=direct/1/Home/UserList/$QuickFind.$Form","summary":"","payload_hex":"504f5354202f6170703f736572766963653d6469726563742f312f486f6d652f557365724c6973742f24517569636b46696e642e24466f726d20485454502f312e310d0a486f73743a20<HONEYPOT>3a393139310d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a436f6e74656e742d4c656e6774683a2032370d0a436f6e74656e742d547970653a206170706c69636174696f6e2f782d7777772d666f726d2d75726c656e636f6465640d0a4f726967696e3a20687474703a2f2f<HONEYPOT>3a393139310d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a717569636b46696e64466f726d3d717569636b46696e64466f726d","method":"POST","user_agent":"Mozilla/5.0","ja3":"","session":"9ea0ff46-662c-4c84-898e-fac94678e81d","seq":1,"duration_ms":100,"bytes_in":273,"bytes_out":78},{"timestamp":"2026-09-05T22:37:55","port":9191,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:9191\",\"user-agent\":\"Mozilla/5.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/user","summary":"","payload_hex":"474554202f7573657220485454502f312e310d0a486f73743a20<HONEYPOT>3a393139310d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0","ja3":"","session":"8e0925ec-ce37-4d98-a6e4-2cf71849fd29","seq":1,"duration_ms":101,"bytes_in":95,"bytes_out":78}],"http_methods":[{"method":"GET","count":3},{"method":"POST","count":3}],"distinct_ports_total":2,"top_paths":[{"path":"/user","count":3,"ports":2},{"path":"/app?service=direct/1/Home/UserList/$QuickFind.$Form","count":3,"ports":2}],"distinct_paths_total":2,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept-Encoding","Content-Length","Content-Type","Host","Origin","User-Agent"],"representative":[{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Content-Length","value":"27","notable":false},{"name":"Content-Type","value":"application/x-www-form-urlencoded","notable":true},{"name":"Host","value":"<HONEYPOT>:9192","notable":false},{"name":"Origin","value":"http://<HONEYPOT>:9192","notable":true},{"name":"User-Agent","value":"Mozilla/5.0","notable":false}],"distinct_sets":2,"events_with_headers":6},"tags":[],"data_as_of":"2026-09-30T20:01:12.691508+00:00"}