{"ip":"185.215.244.161","total_events":9,"verdict":{"verdict":"probing","label":"Low-level probing","detail":null,"confidence":"low","network_type":null,"why":["9 event(s), fewer than 10 distinct ports, no exploit payloads.","Not in any known-scanner range."],"engagement":{"level":"request","label":"Request traffic","detail":"4,087 bytes sent","bytes_sent":4087,"session_seconds":1,"persistent":false}},"first_seen":"2026-08-24T09:55:11","last_seen":"2026-09-12T10:21:38","events_24h":0,"events_7d":0,"geo":{"country_code":"DE","country_name":"Germany","region":"Hesse","city":"Frankfurt am Main","lat":50.1169,"lon":8.6837,"asn":212552,"org":"BitCommand LLC"},"source_domain":null,"known_scanners":[],"scanner_tag":null,"cve_matches":[],"malware":[],"top_ports":[{"port":8500,"proto":"tcp","label":"","count":4},{"port":18082,"proto":"tcp","label":"","count":2},{"port":8332,"proto":"tcp","label":"","count":1},{"port":445,"proto":"tcp","label":"SMB","count":1},{"port":8545,"proto":"tcp","label":"","count":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":["b11cun050_0004001e_00ecc3a8","b11cuq060_00050816_5ad15e38","b11cuq070_0005081e_c0f7322a"]},"fingerprint_peers":{"b11cun050_0004001e_00ecc3a8":78,"b11cuq060_00050816_5ad15e38":4,"b11cuq070_0005081e_c0f7322a":3},"akin_families":{"b11cun050_0004001e_00ecc3a8":{"head":"b11cun050_0004001e_00ecc3a8","shapes":2,"ips":78}},"user_agents":["Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:84.0) Gecko/20100101 Firefox/84.0","Mozilla/5.0 (X11; CrOS x86_64 14092.77.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.107 Safari/537.36","Mozilla/5.0 (Windows NT 6.2; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0","Mozilla/5.0 (X11; Linux x86_64; rv:1.9.7.20) Gecko/ Firefox/3.6.11","Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36","Mozilla/5.0 (Macintosh; Intel Mac OS X 14_7_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.4 Safari/605.1.15","Mozilla/5.0 (ZZ; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36","Python/3.12 aiohttp/3.14.3"],"timeline":[{"date":"2026-08-24","count":1},{"date":"2026-09-01","count":4},{"date":"2026-09-03","count":1},{"date":"2026-09-04","count":2},{"date":"2026-09-12","count":1}],"recent_events":[{"timestamp":"2026-09-12T10:21:38","port":8545,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate\",\"content-length\":\"420\",\"content-type\":\"application/json\",\"host\":\"<HONEYPOT>:8545\",\"user-agent\":\"Python/3.12 aiohttp/3.14.3\"}","body":"[{\"jsonrpc\": \"2.0\", \"method\": \"web3_clientVersion\", \"params\": [], \"id\": 1}, {\"jsonrpc\": \"2.0\", \"method\": \"net_version\", \"params\": [], \"id\": 2}, {\"jsonrpc\": \"2.0\", \"method\": \"eth_chainId\", \"params\": [], \"id\": 3}, {\"jsonrpc\": \"2.0\", \"method\": \"eth_blockNumber\", \"params\": [], \"id\": 4}, {\"jsonrpc\": \"2.0\", \"method\": \"eth_accounts\", \"params\": [], \"id\": 5}, {\"jsonrpc\": \"2.0\", \"method\": \"eth_syncing\", \"params\": [], \"id\": 6}]","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"504f5354202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a383534350d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a557365722d4167656e743a20507974686f6e2f332e31322061696f687474702f332e31342e330d0a436f6e74656e742d4c656e6774683a203432300d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a0d0a5b7b226a736f6e727063223a2022322e30222c20226d6574686f64223a2022776562335f636c69656e7456657273696f6e222c2022706172616d73223a205b5d2c20226964223a20317d2c207b226a736f6e727063223a2022322e30222c20226d6574686f64223a20226e65745f76657273696f6e222c2022706172616d73223a205b5d2c20226964223a20327d2c207b226a736f6e727063223a2022322e30222c20226d6574686f64223a20226574685f636861696e4964222c2022706172616d73223a205b5d2c20226964223a20337d2c207b226a736f6e727063223a2022322e30222c20226d6574686f64223a20226574685f626c6f636b4e756d626572222c2022706172616d73223a205b5d2c20226964223a20347d2c207b226a736f6e727063223a2022322e30222c20226d6574686f64223a20226574685f6163636f756e7473222c2022706172616d73223a205b5d2c20226964223a20357d2c207b226a736f6e727063223a2022322e30222c20226d6574686f64223a20226574685f73796e63696e67222c2022706172616d73223a205b5d2c20226964223a20367d5d","method":"POST","user_agent":"Python/3.12 aiohttp/3.14.3","ja3":"","session":"cf6ba8ea-232e-4549-9312-94e6ede5d416","seq":1,"duration_ms":100,"bytes_in":603,"bytes_out":80},{"timestamp":"2026-09-04T03:23:43","port":18082,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"accept-language\":\"en\",\"content-length\":\"54\",\"content-type\":\"application/json\",\"host\":\"<HONEYPOT>:18082\",\"user-agent\":\"Mozilla/5.0 (Windows NT 6.2; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0\"}","body":"{\"jsonrpc\":\"2.0\",\"id\":\"nuclei\",\"method\":\"get_balance\"}","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"504f5354202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a31383038320d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e5420362e323b2057696e36343b207836343b2072763a3130392e3029204765636b6f2f32303130303130312046697265666f782f3131342e300d0a436f6e74656e742d4c656e6774683a2035340d0a4163636570743a202a2f2a0d0a4163636570742d4c616e67756167653a20656e0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a7b226a736f6e727063223a22322e30222c226964223a226e75636c6569222c226d6574686f64223a226765745f62616c616e6365227d","method":"POST","user_agent":"Mozilla/5.0 (Windows NT 6.2; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0","ja3":"","session":"fbe13ad7-6059-493a-b811-1f0d386327ab","seq":1,"duration_ms":103,"bytes_in":301,"bytes_out":80},{"timestamp":"2026-09-04T03:23:43","port":18082,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"accept-language\":\"en\",\"content-length\":\"54\",\"content-type\":\"application/json\",\"host\":\"<HONEYPOT>:18082\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36\"}","body":"{\"jsonrpc\":\"2.0\",\"id\":\"nuclei\",\"method\":\"get_balance\"}","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"504f5354202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a31383038320d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3133392e302e302e30205361666172692f3533372e33360d0a436f6e74656e742d4c656e6774683a2035340d0a4163636570743a202a2f2a0d0a4163636570742d4c616e67756167653a20656e0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a7b226a736f6e727063223a22322e30222c226964223a226e75636c6569222c226d6574686f64223a226765745f62616c616e6365227d","method":"POST","user_agent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36","ja3":"","session":"c619e420-c169-43d1-b989-272cee4c883f","seq":1,"duration_ms":100,"bytes_in":323,"bytes_out":80},{"timestamp":"2026-09-03T23:47:28","port":8332,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"accept-language\":\"en\",\"content-length\":\"72\",\"content-type\":\"application/json\",\"host\":\"<HONEYPOT>:8332\",\"user-agent\":\"Mozilla/5.0 (ZZ; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36\"}","body":"{\"jsonrpc\":\"1.0\",\"id\":\"nuclei\",\"method\":\"getblockchaininfo\",\"params\":[]}","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"504f5354202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a383333320d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285a5a3b204c696e7578206936383629204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3133352e302e302e30205361666172692f3533372e33360d0a436f6e74656e742d4c656e6774683a2037320d0a4163636570743a202a2f2a0d0a4163636570742d4c616e67756167653a20656e0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a7b226a736f6e727063223a22312e30222c226964223a226e75636c6569222c226d6574686f64223a22676574626c6f636b636861696e696e666f222c22706172616d73223a5b5d7d","method":"POST","user_agent":"Mozilla/5.0 (ZZ; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36","ja3":"","session":"35623ffa-53e8-4014-b62b-2ef0218668fd","seq":1,"duration_ms":100,"bytes_in":337,"bytes_out":80},{"timestamp":"2026-09-01T16:55:49","port":8500,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"accept-language\":\"en\",\"host\":\"<HONEYPOT>:8500\",\"user-agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 14_7_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.4 Safari/605.1.15\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/v1/catalog/services","summary":"","payload_hex":"474554202f76312f636174616c6f672f736572766963657320485454502f312e310d0a486f73743a20<HONEYPOT>3a383530300d0a557365722d4167656e743a204d6f7a696c6c612f352e3020284d6163696e746f73683b20496e74656c204d6163204f5320582031345f375f3329204170706c655765624b69742f3630352e312e313520284b48544d4c2c206c696b65204765636b6f292056657273696f6e2f31382e34205361666172692f3630352e312e31350d0a4163636570743a202a2f2a0d0a4163636570742d4c616e67756167653a20656e0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 14_7_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.4 Safari/605.1.15","ja3":"","session":"ad4966ca-951a-4720-89e1-766764df3c7d","seq":3,"duration_ms":517,"bytes_in":699,"bytes_out":240},{"timestamp":"2026-09-01T16:55:49","port":8500,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"accept-language\":\"en\",\"host\":\"<HONEYPOT>:8500\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64; rv:1.9.7.20) Gecko/ Firefox/3.6.11\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/v1/kv/?recurse","summary":"","payload_hex":"474554202f76312f6b762f3f7265637572736520485454502f312e310d0a486f73743a20<HONEYPOT>3a383530300d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f36343b2072763a312e392e372e323029204765636b6f2f2046697265666f782f332e362e31310d0a4163636570743a202a2f2a0d0a4163636570742d4c616e67756167653a20656e0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64; rv:1.9.7.20) Gecko/ Firefox/3.6.11","ja3":"","session":"ad4966ca-951a-4720-89e1-766764df3c7d","seq":4,"duration_ms":725,"bytes_in":893,"bytes_out":320},{"timestamp":"2026-09-01T16:55:48","port":8500,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"accept-language\":\"en\",\"host\":\"<HONEYPOT>:8500\",\"user-agent\":\"Mozilla/5.0 (X11; CrOS x86_64 14092.77.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.107 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/v1/status/leader","summary":"","payload_hex":"474554202f76312f7374617475732f6c656164657220485454502f312e310d0a486f73743a20<HONEYPOT>3a383530300d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b2043724f53207838365f36342031343039322e37372e3029204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f39332e302e343537372e313037205361666172692f3533372e33360d0a4163636570743a202a2f2a0d0a4163636570742d4c616e67756167653a20656e0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; CrOS x86_64 14092.77.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.107 Safari/537.36","ja3":"","session":"ad4966ca-951a-4720-89e1-766764df3c7d","seq":1,"duration_ms":101,"bytes_in":245,"bytes_out":80},{"timestamp":"2026-09-01T16:55:48","port":8500,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"accept-language\":\"en\",\"host\":\"<HONEYPOT>:8500\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:84.0) Gecko/20100101 Firefox/84.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/v1/agent/self","summary":"","payload_hex":"474554202f76312f6167656e742f73656c6620485454502f312e310d0a486f73743a20<HONEYPOT>3a383530300d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b207836343b2072763a38342e3029204765636b6f2f32303130303130312046697265666f782f38342e300d0a4163636570743a202a2f2a0d0a4163636570742d4c616e67756167653a20656e0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:84.0) Gecko/20100101 Firefox/84.0","ja3":"","session":"ad4966ca-951a-4720-89e1-766764df3c7d","seq":2,"duration_ms":309,"bytes_in":450,"bytes_out":160},{"timestamp":"2026-08-24T09:55:11","port":445,"proto":"tcp","app_proto":"","app_protocol":"smbv23","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000��SMB@\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u001f\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000$\u0000\u0005\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000�ܫT��gM��\t��Qޏp\u0000\u0000\u0000\u0004\u0000\u0000\u0000\u0002\u0002\u0010\u0002\u0000\u0003\u0002\u0003\u0011\u0003\u0000\u0000\u0001\u0000&\u0000\u0000\u0000\u0000\u0000\u0001\u0000 \u0000\u0001\u0000��\tӾ\u0000�\u0018\u0015�=\u000eofl1�\u0019�%�Q��e�����r�\u0000\u0000\u0002\u0000\n\u0000\u0000\u0000\u0000\u0000\u0004\u0000\u0002\u0000\u0001\u0000\u0004\u0000\u0003\u0000\u0000\u0000\u0000\u0000\u0000\u0000\b\u0000\b\u0000\u0000\u0000\u0000\u0000\u0003\u0000\u0002\u0000\u0001\u0000\u0000\u0000\u0005\u0000\u0018\u0000\u0000\u0000\u0000\u00002\u00003\u0000.\u00009\u00004\u0000.\u00003\u00006\u0000.\u00001\u00004\u00001\u0000","payload_hex":"000000e8fe534d42400000000000000000001f0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000024000500010000007f0000008fdcab54e183674da5d2099b8251de8f70000000040000000202100200030203110300000100260000000000010020000100f0fe09d3be00b61815b93d0e6f666c31ed19ea25ca51bcc9658588928ab172ce000002000a000000000004000200010004000300000000000000080008000000000003000200010000000500180000000000320033002e00390034002e00330036002e00310034003100","method":"","user_agent":"","ja3":"","session":"e756a0a6-1528-45a5-b7fc-823da4b1f6cc","seq":1,"duration_ms":100,"bytes_in":236,"bytes_out":15,"enriched":{"digest":"35478dabfaad69e6","strings":["SMB@","ofl1","23.94.36.141"],"iocs":{"ips":["23.94.36.141"]}}}],"http_methods":[{"method":"GET","count":4},{"method":"POST","count":4}],"distinct_ports_total":5,"top_paths":[{"path":"/","count":4,"ports":3},{"path":"/v1/kv/?recurse","count":1,"ports":1},{"path":"/v1/agent/self","count":1,"ports":1},{"path":"/v1/catalog/services","count":1,"ports":1},{"path":"/v1/status/leader","count":1,"ports":1}],"distinct_paths_total":5,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","Accept-Encoding","Accept-Language","Content-Length","Content-Type","Host","User-Agent"],"representative":[{"name":"Accept","value":"*/*","notable":false},{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Accept-Language","value":"en","notable":false},{"name":"Content-Length","value":"54","notable":false},{"name":"Content-Type","value":"application/json","notable":true},{"name":"Host","value":"<HONEYPOT>:18082","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (Windows NT 6.2; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0","notable":false}],"distinct_sets":3,"events_with_headers":8},"tags":[],"data_as_of":"2026-10-02T21:29:27.777358+00:00"}