{"ip":"185.228.82.243","total_events":36299,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"543+ ports swept","confidence":"medium","network_type":"enterprise","why":["No exploit payloads observed.","Swept 543 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range.","Held a session open for 150s, against a median of well under a second."],"engagement":{"level":"payload","label":"Sustained payload, held open","detail":"3,742,492 bytes sent, longest session 150s","bytes_sent":3742492,"session_seconds":150,"persistent":true}},"first_seen":"2026-09-05T13:06:22","last_seen":"2026-09-06T00:25:45","events_24h":36299,"events_7d":36299,"geo":{"country_code":"NL","country_name":"The Netherlands","region":"","city":"","lat":52.3824,"lon":4.8995,"asn":211750,"org":"MC-Node"},"source_domain":"hosted-by.lucadevelopment.net","known_scanners":[],"scanner_tag":{"key":"peeringdb:as211750","label":"MC-Node","category":"enterprise","url":"https://www.peeringdb.com/asn/211750"},"cve_matches":[],"malware":[],"top_ports":[{"port":2302,"proto":"tcp","label":"","count":75},{"port":2303,"proto":"tcp","label":"","count":75},{"port":25578,"proto":"tcp","label":"","count":75},{"port":30285,"proto":"tcp","label":"","count":75},{"port":25568,"proto":"tcp","label":"","count":75},{"port":7779,"proto":"tcp","label":"","count":75},{"port":2456,"proto":"tcp","label":"","count":75},{"port":30295,"proto":"tcp","label":"","count":75},{"port":30278,"proto":"tcp","label":"","count":75},{"port":30282,"proto":"tcp","label":"","count":75},{"port":7778,"proto":"tcp","label":"","count":75},{"port":30292,"proto":"tcp","label":"","count":75},{"port":9987,"proto":"tcp","label":"","count":75},{"port":25576,"proto":"tcp","label":"","count":75},{"port":30288,"proto":"tcp","label":"","count":75}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[],"ja4h":["ge11nn0300_042112399351","ge11nn0500_b4a204ff4775","ge11nn0400_8fd06a127c33"]},"fingerprint_peers":{"ge11nn0300_042112399351":3433,"ge11nn0500_b4a204ff4775":1,"ge11nn0400_8fd06a127c33":52},"user_agents":["Prometheus/2.53.5+ds1","mcnode-exporter/1.0","curl/8.18.0"],"timeline":[{"date":"2026-09-05","count":34820},{"date":"2026-09-06","count":1479}],"recent_events":[{"timestamp":"2026-09-06T00:25:45","port":30290,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"identity\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:30290\",\"user-agent\":\"mcnode-exporter/1.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/INFO","summary":"","payload_hex":"474554202f494e464f20485454502f312e310d0a4163636570742d456e636f64696e673a206964656e746974790d0a486f73743a20<HONEYPOT>3a33303239300d0a557365722d4167656e743a206d636e6f64652d6578706f727465722f312e300d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"mcnode-exporter/1.0","ja3":"","session":"a6eec047-216e-498e-9559-56e9d96d8605","seq":1,"duration_ms":111,"bytes_in":129,"bytes_out":79},{"timestamp":"2026-09-06T00:25:45","port":30256,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"identity\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:30256\",\"user-agent\":\"mcnode-exporter/1.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/INFO","summary":"","payload_hex":"474554202f494e464f20485454502f312e310d0a4163636570742d456e636f64696e673a206964656e746974790d0a486f73743a20<HONEYPOT>3a33303235360d0a557365722d4167656e743a206d636e6f64652d6578706f727465722f312e300d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"mcnode-exporter/1.0","ja3":"","session":"c31f9961-bd2f-467c-8451-8789ed448dd0","seq":1,"duration_ms":111,"bytes_in":129,"bytes_out":79},{"timestamp":"2026-09-06T00:25:45","port":30298,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"identity\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:30298\",\"user-agent\":\"mcnode-exporter/1.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/INFO","summary":"","payload_hex":"474554202f494e464f20485454502f312e310d0a4163636570742d456e636f64696e673a206964656e746974790d0a486f73743a20<HONEYPOT>3a33303239380d0a557365722d4167656e743a206d636e6f64652d6578706f727465722f312e300d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"mcnode-exporter/1.0","ja3":"","session":"a8635563-a230-4ae0-ab45-e2e12a8a6558","seq":1,"duration_ms":108,"bytes_in":129,"bytes_out":79},{"timestamp":"2026-09-06T00:25:45","port":30281,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"identity\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:30281\",\"user-agent\":\"mcnode-exporter/1.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/INFO","summary":"","payload_hex":"474554202f494e464f20485454502f312e310d0a4163636570742d456e636f64696e673a206964656e746974790d0a486f73743a20<HONEYPOT>3a33303238310d0a557365722d4167656e743a206d636e6f64652d6578706f727465722f312e300d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"mcnode-exporter/1.0","ja3":"","session":"ad641963-6891-4a88-83f9-c77f0c8dea52","seq":1,"duration_ms":107,"bytes_in":129,"bytes_out":79},{"timestamp":"2026-09-06T00:25:45","port":30299,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"identity\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:30299\",\"user-agent\":\"mcnode-exporter/1.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/INFO","summary":"","payload_hex":"474554202f494e464f20485454502f312e310d0a4163636570742d456e636f64696e673a206964656e746974790d0a486f73743a20<HONEYPOT>3a33303239390d0a557365722d4167656e743a206d636e6f64652d6578706f727465722f312e300d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"mcnode-exporter/1.0","ja3":"","session":"6e1b9297-41b4-4c9b-8ac3-193d0c9d63bd","seq":1,"duration_ms":107,"bytes_in":129,"bytes_out":79},{"timestamp":"2026-09-06T00:25:45","port":30262,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"identity\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:30262\",\"user-agent\":\"mcnode-exporter/1.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/INFO","summary":"","payload_hex":"474554202f494e464f20485454502f312e310d0a4163636570742d456e636f64696e673a206964656e746974790d0a486f73743a20<HONEYPOT>3a33303236320d0a557365722d4167656e743a206d636e6f64652d6578706f727465722f312e300d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"mcnode-exporter/1.0","ja3":"","session":"b03a8d16-7594-4d6b-ba88-f4fe11a5f3be","seq":1,"duration_ms":105,"bytes_in":129,"bytes_out":79},{"timestamp":"2026-09-06T00:25:45","port":30284,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"identity\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:30284\",\"user-agent\":\"mcnode-exporter/1.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/INFO","summary":"","payload_hex":"474554202f494e464f20485454502f312e310d0a4163636570742d456e636f64696e673a206964656e746974790d0a486f73743a20<HONEYPOT>3a33303238340d0a557365722d4167656e743a206d636e6f64652d6578706f727465722f312e300d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"mcnode-exporter/1.0","ja3":"","session":"447673b9-f2f7-4656-8e50-3715976c07be","seq":1,"duration_ms":108,"bytes_in":129,"bytes_out":79},{"timestamp":"2026-09-06T00:25:45","port":30255,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"identity\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:30255\",\"user-agent\":\"mcnode-exporter/1.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/INFO","summary":"","payload_hex":"474554202f494e464f20485454502f312e310d0a4163636570742d456e636f64696e673a206964656e746974790d0a486f73743a20<HONEYPOT>3a33303235350d0a557365722d4167656e743a206d636e6f64652d6578706f727465722f312e300d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"mcnode-exporter/1.0","ja3":"","session":"3ee9bc43-a8af-49f3-ba9c-e28d7ce2f68f","seq":1,"duration_ms":108,"bytes_in":129,"bytes_out":79},{"timestamp":"2026-09-06T00:25:45","port":30296,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"identity\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:30296\",\"user-agent\":\"mcnode-exporter/1.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/INFO","summary":"","payload_hex":"474554202f494e464f20485454502f312e310d0a4163636570742d456e636f64696e673a206964656e746974790d0a486f73743a20<HONEYPOT>3a33303239360d0a557365722d4167656e743a206d636e6f64652d6578706f727465722f312e300d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"mcnode-exporter/1.0","ja3":"","session":"8ea761c5-2743-425c-999b-8be65287ef90","seq":1,"duration_ms":108,"bytes_in":129,"bytes_out":79},{"timestamp":"2026-09-06T00:25:45","port":30287,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"identity\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:30287\",\"user-agent\":\"mcnode-exporter/1.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/INFO","summary":"","payload_hex":"474554202f494e464f20485454502f312e310d0a4163636570742d456e636f64696e673a206964656e746974790d0a486f73743a20<HONEYPOT>3a33303238370d0a557365722d4167656e743a206d636e6f64652d6578706f727465722f312e300d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"mcnode-exporter/1.0","ja3":"","session":"c78c6899-5c8b-4d30-a5e4-fa1e26471ece","seq":1,"duration_ms":104,"bytes_in":129,"bytes_out":79}],"http_methods":[{"method":"GET","count":26188}],"distinct_ports_total":543,"top_paths":[{"path":"/INFO","count":13147,"ports":542},{"path":"/dynamic.json","count":13005,"ports":542},{"path":"/metrics","count":36,"ports":1}],"distinct_paths_total":3,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept-Encoding","Connection","Host","User-Agent"],"representative":[{"name":"Accept-Encoding","value":"identity","notable":false},{"name":"Connection","value":"close","notable":false},{"name":"Host","value":"<HONEYPOT>:30290","notable":false},{"name":"User-Agent","value":"mcnode-exporter/1.0","notable":false}],"distinct_sets":1,"events_with_headers":10},"tags":[],"data_as_of":"2026-09-06T00:49:07.697738+00:00"}