{"ip":"185.223.235.10","total_events":137,"verdict":{"verdict":"scanner","label":"Recognized scanner","detail":"infrawatch","confidence":"high","network_type":"CDN","why":["Source IP is in a known scanner range (infrawatch).","Known research and commercial scanners are labelled as such, not as threats."],"engagement":{"level":"request","label":"Request traffic","detail":"2,349 bytes sent","bytes_sent":2349,"session_seconds":0,"persistent":false}},"first_seen":"2026-04-25T03:55:41","last_seen":"2026-08-15T15:02:34","events_24h":3,"events_7d":8,"geo":{"country_code":"NL","country_name":"The Netherlands","region":"North Holland","city":"Amsterdam","lat":52.3716,"lon":4.8883,"asn":25369,"org":"Hydra Communications Ltd"},"source_domain":"185-223-235-10.infrawat.ch","known_scanners":["infrawatch","Infrawatch"],"scanner_tag":{"key":"infrawatch","label":"Infrawatch","category":"commercial","url":"https://infrawat.ch/"},"cve_matches":[],"malware":[],"top_ports":[{"port":80,"proto":"tcp","label":"HTTP","count":10},{"port":40308,"proto":"tcp","label":"","count":2},{"port":49364,"proto":"tcp","label":"","count":2},{"port":40104,"proto":"tcp","label":"","count":2},{"port":45960,"proto":"tcp","label":"","count":2},{"port":65412,"proto":"tcp","label":"","count":2},{"port":36768,"proto":"tcp","label":"","count":2},{"port":58799,"proto":"tcp","label":"","count":2},{"port":5500,"proto":"tcp","label":"","count":2},{"port":19647,"proto":"tcp","label":"","count":2},{"port":20552,"proto":"tcp","label":"","count":2},{"port":3656,"proto":"tcp","label":"","count":2},{"port":51481,"proto":"tcp","label":"","count":2},{"port":51997,"proto":"tcp","label":"","count":2},{"port":63094,"proto":"tcp","label":"","count":2}],"fingerprints":{"ssh_hassh":["8e8294623d295b5c79addcd28d64328c"],"tls_ja4":["t13i3514h1_8f004308c246_5c2c66f702b0"],"tls_ja3":[],"ja4h":["ge11nn0500_d3a2dcb1cd63","po11nn0800_5016c79b48a7","ge11nn0400_17292dadbc7b"]},"fingerprint_peers":{"t13i3514h1_8f004308c246_5c2c66f702b0":28,"po11nn0800_5016c79b48a7":324,"ge11nn0500_d3a2dcb1cd63":1281,"ge11nn0400_17292dadbc7b":2848},"user_agents":["Mozilla/5.0 (compatible; Infrawatch/1.0; +https://infrawat.ch/)"],"timeline":[{"date":"2026-07-23","count":3},{"date":"2026-08-12","count":1},{"date":"2026-08-13","count":4},{"date":"2026-08-15","count":3}],"recent_events":[{"timestamp":"2026-08-15T15:02:34","port":40986,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"application/json\",\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:40986\",\"user-agent\":\"Mozilla/5.0 (compatible; Infrawatch/1.0; +https://infrawat.ch/)\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a34303938360d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b20496e66726177617463682f312e303b202b68747470733a2f2f696e6672617761742e63682f290d0a4163636570743a206170706c69636174696f6e2f6a736f6e0d0a436f6e6e656374696f6e3a20636c6f73650d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; Infrawatch/1.0; +https://infrawat.ch/)","ja3":"","session":"05514fee-5c7b-4ef1-b4fa-eb8ce8f992e4","seq":1,"duration_ms":102,"bytes_in":190,"bytes_out":79},{"timestamp":"2026-08-15T13:12:44","port":53816,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"application/json\",\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:53816\",\"user-agent\":\"Mozilla/5.0 (compatible; Infrawatch/1.0; +https://infrawat.ch/)\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/mcp/","summary":"","payload_hex":"474554202f6d63702f20485454502f312e310d0a486f73743a20<HONEYPOT>3a35333831360d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b20496e66726177617463682f312e303b202b68747470733a2f2f696e6672617761742e63682f290d0a4163636570743a206170706c69636174696f6e2f6a736f6e0d0a436f6e6e656374696f6e3a20636c6f73650d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; Infrawatch/1.0; +https://infrawat.ch/)","ja3":"","session":"8dbd1a04-b868-4a5f-a9e3-5818a15a45d3","seq":1,"duration_ms":100,"bytes_in":194,"bytes_out":79},{"timestamp":"2026-08-15T12:59:46","port":27935,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"application/json\",\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:27935\",\"user-agent\":\"Mozilla/5.0 (compatible; Infrawatch/1.0; +https://infrawat.ch/)\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/mcp/","summary":"","payload_hex":"474554202f6d63702f20485454502f312e310d0a486f73743a20<HONEYPOT>3a32373933350d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b20496e66726177617463682f312e303b202b68747470733a2f2f696e6672617761742e63682f290d0a4163636570743a206170706c69636174696f6e2f6a736f6e0d0a436f6e6e656374696f6e3a20636c6f73650d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; Infrawatch/1.0; +https://infrawat.ch/)","ja3":"","session":"1281eb78-1612-43e2-bef3-3c448946059c","seq":1,"duration_ms":101,"bytes_in":194,"bytes_out":79},{"timestamp":"2026-08-13T14:31:16","port":32485,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:32485\",\"user-agent\":\"Mozilla/5.0 (compatible; Infrawatch/1.0; +https://infrawat.ch/)\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a33323438350d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b20496e66726177617463682f312e303b202b68747470733a2f2f696e6672617761742e63682f290d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; Infrawatch/1.0; +https://infrawat.ch/)","ja3":"","session":"2992cf9b-8f1d-4b75-8ed9-0b28de4820ef","seq":1,"duration_ms":100,"bytes_in":177,"bytes_out":79},{"timestamp":"2026-08-13T06:22:48","port":46237,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"application/json\",\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:46237\",\"user-agent\":\"Mozilla/5.0 (compatible; Infrawatch/1.0; +https://infrawat.ch/)\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/api/mcp","summary":"","payload_hex":"474554202f6170692f6d637020485454502f312e310d0a486f73743a20<HONEYPOT>3a34363233370d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b20496e66726177617463682f312e303b202b68747470733a2f2f696e6672617761742e63682f290d0a4163636570743a206170706c69636174696f6e2f6a736f6e0d0a436f6e6e656374696f6e3a20636c6f73650d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; Infrawatch/1.0; +https://infrawat.ch/)","ja3":"","session":"8f694a1f-6d13-489d-b3d6-426df51af08c","seq":1,"duration_ms":100,"bytes_in":197,"bytes_out":79},{"timestamp":"2026-08-13T06:18:35","port":47644,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:47644\",\"user-agent\":\"Mozilla/5.0 (compatible; Infrawatch/1.0; +https://infrawat.ch/)\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a34373634340d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b20496e66726177617463682f312e303b202b68747470733a2f2f696e6672617761742e63682f290d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; Infrawatch/1.0; +https://infrawat.ch/)","ja3":"","session":"2e302691-3ffd-43e0-a996-7cc8dd95b17c","seq":1,"duration_ms":100,"bytes_in":177,"bytes_out":79},{"timestamp":"2026-08-13T06:02:34","port":38734,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"text/event-stream\",\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:38734\",\"user-agent\":\"Mozilla/5.0 (compatible; Infrawatch/1.0; +https://infrawat.ch/)\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/sse","summary":"","payload_hex":"474554202f73736520485454502f312e310d0a486f73743a20<HONEYPOT>3a33383733340d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b20496e66726177617463682f312e303b202b68747470733a2f2f696e6672617761742e63682f290d0a4163636570743a20746578742f6576656e742d73747265616d0d0a436f6e6e656374696f6e3a20636c6f73650d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; Infrawatch/1.0; +https://infrawat.ch/)","ja3":"","session":"8d642363-b64d-4cb0-9240-65589dc29917","seq":1,"duration_ms":100,"bytes_in":194,"bytes_out":79},{"timestamp":"2026-08-12T20:28:47","port":14886,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"application/json\",\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:14886\",\"user-agent\":\"Mozilla/5.0 (compatible; Infrawatch/1.0; +https://infrawat.ch/)\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/mcp","summary":"","payload_hex":"474554202f6d637020485454502f312e310d0a486f73743a20<HONEYPOT>3a31343838360d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b20496e66726177617463682f312e303b202b68747470733a2f2f696e6672617761742e63682f290d0a4163636570743a206170706c69636174696f6e2f6a736f6e0d0a436f6e6e656374696f6e3a20636c6f73650d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; Infrawatch/1.0; +https://infrawat.ch/)","ja3":"","session":"cdce43f3-345e-4c63-a348-260ecb548589","seq":1,"duration_ms":102,"bytes_in":193,"bytes_out":79},{"timestamp":"2026-07-23T22:03:27","port":20755,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"application/json, text/event-stream\",\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"content-length\":\"151\",\"content-type\":\"application/json\",\"host\":\"<HONEYPOT>:20755\",\"mcp-protocol-version\":\"2025-03-26\",\"user-agent\":\"Mozilla/5.0 (compatible; Infrawatch/1.0; +https://infrawat.ch/)\"}","body":"{\"id\":1,\"jsonrpc\":\"2.0\",\"method\":\"initialize\",\"params\":{\"capabilities\":{},\"clientInfo\":{\"name\":\"client\",\"version\":\"0\"},\"protocolVersion\":\"2025-03-26\"}}","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/mcp","summary":"","payload_hex":"504f5354202f6d637020485454502f312e310d0a486f73743a20<HONEYPOT>3a32303735350d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b20496e66726177617463682f312e303b202b68747470733a2f2f696e6672617761742e63682f290d0a436f6e74656e742d4c656e6774683a203135310d0a4163636570743a206170706c69636174696f6e2f6a736f6e2c20746578742f6576656e742d73747265616d0d0a436f6e6e656374696f6e3a20636c6f73650d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a4d63702d50726f746f636f6c2d56657273696f6e3a20323032352d30332d32360d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a7b226964223a312c226a736f6e727063223a22322e30222c226d6574686f64223a22696e697469616c697a65222c22706172616d73223a7b226361706162696c6974696573223a7b7d2c22636c69656e74496e666f223a7b226e616d65223a22636c69656e74222c2276657273696f6e223a2230227d2c2270726f746f636f6c56657273696f6e223a22323032352d30332d3236227d7d","method":"POST","user_agent":"Mozilla/5.0 (compatible; Infrawatch/1.0; +https://infrawat.ch/)","ja3":"","session":"ea867dc3-66fc-4297-981f-6e10e4aaacfe","seq":1,"duration_ms":100,"bytes_in":451,"bytes_out":79},{"timestamp":"2026-07-23T20:48:17","port":10818,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:10818\",\"user-agent\":\"Mozilla/5.0 (compatible; Infrawatch/1.0; +https://infrawat.ch/)\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/favicon.ico","summary":"","payload_hex":"474554202f66617669636f6e2e69636f20485454502f312e310d0a486f73743a20<HONEYPOT>3a31303831380d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b20496e66726177617463682f312e303b202b68747470733a2f2f696e6672617761742e63682f290d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; Infrawatch/1.0; +https://infrawat.ch/)","ja3":"","session":"7d5fafd9-dd6b-47e4-aa02-d8b670fc94c7","seq":1,"duration_ms":100,"bytes_in":188,"bytes_out":79}],"http_methods":[{"method":"GET","count":68},{"method":"POST","count":1}],"distinct_ports_total":97,"top_paths":[{"path":"/","count":52,"ports":43},{"path":"/favicon.ico","count":10,"ports":10},{"path":"/mcp","count":2,"ports":2},{"path":"/sse","count":2,"ports":2},{"path":"/mcp/","count":2,"ports":2},{"path":"/api/mcp","count":1,"ports":1}],"distinct_paths_total":6,"top_snis":[],"top_hosts":[{"value":"192.0.2.1","count":3}],"top_alpns":[{"value":"http/1.1","count":18}],"banners":[{"value":"SSH-2.0-OpenSSH_9.6p1 Ubuntu-3ubuntu13.8","count":4}],"credentials":[],"header_profile":{"signature":["Accept","Accept-Encoding","Connection","Content-Length","Content-Type","Host","Mcp-Protocol-Version","User-Agent"],"representative":[{"name":"Accept","value":"application/json, text/event-stream","notable":false},{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Connection","value":"close","notable":false},{"name":"Content-Length","value":"151","notable":false},{"name":"Content-Type","value":"application/json","notable":true},{"name":"Host","value":"<HONEYPOT>:20755","notable":false},{"name":"Mcp-Protocol-Version","value":"2025-03-26","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (compatible; Infrawatch/1.0; +https://infrawat.ch/)","notable":false}],"distinct_sets":2,"events_with_headers":10},"tags":[],"data_as_of":"2026-08-15T17:42:57.108404+00:00"}