{"ip":"185.93.89.61","total_events":55,"verdict":{"verdict":"probing","label":"Low-level probing","detail":null,"confidence":"low","network_type":null,"why":["55 event(s), fewer than 10 distinct ports, no exploit payloads.","Not in any known-scanner range."],"engagement":{"level":"request","label":"Request traffic","detail":"3,213 bytes sent","bytes_sent":3213,"session_seconds":0,"persistent":false}},"first_seen":"2026-08-08T02:26:36","last_seen":"2026-09-27T15:16:25","events_24h":0,"events_7d":8,"geo":{"country_code":"IR","country_name":"Iran","region":"","city":"","lat":35.698,"lon":51.4115,"asn":213790,"org":"Limited Network LTD"},"source_domain":null,"known_scanners":[],"scanner_tag":null,"cve_matches":[],"malware":[],"top_ports":[{"port":9401,"proto":"tcp","label":"","count":55}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":[]},"fingerprint_peers":{},"akin_families":{},"user_agents":[],"timeline":[{"date":"2026-08-08","count":6},{"date":"2026-08-17","count":3},{"date":"2026-08-18","count":4},{"date":"2026-09-04","count":1},{"date":"2026-09-05","count":5},{"date":"2026-09-06","count":3},{"date":"2026-09-07","count":3},{"date":"2026-09-08","count":3},{"date":"2026-09-12","count":1},{"date":"2026-09-13","count":5},{"date":"2026-09-14","count":6},{"date":"2026-09-15","count":2},{"date":"2026-09-20","count":2},{"date":"2026-09-21","count":3},{"date":"2026-09-25","count":1},{"date":"2026-09-26","count":3},{"date":"2026-09-27","count":4}],"recent_events":[{"timestamp":"2026-09-27T15:16:25","port":9401,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0001\u0000\u0001\u0002\u0002\u001dnet.tcp://<HONEYPOT>:9401/\u0003\b\t\u0013application/ssl-tls","payload_hex":"0001000102021d6e65742e7463703a2f2f<HONEYPOT>3a393430312f030809136170706c69636174696f6e2f73736c2d746c73","method":"","user_agent":"","ja3":"","session":"97cb5e62-95a5-4026-a375-c620d839207f","seq":1,"duration_ms":100,"bytes_in":59,"bytes_out":12,"enriched":{"digest":"2dac967ea8ce73f5","strings":["net.tcp://<HONEYPOT>:9401/","application/ssl-tls"],"iocs":{"domains":["net.tcp"]}}},{"timestamp":"2026-09-27T15:16:24","port":9401,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0001\u0000\u0001\u0002\u0002\u001dnet.tcp://<HONEYPOT>:9401/\u0003\b\t\u0013application/ssl-tls","payload_hex":"0001000102021d6e65742e7463703a2f2f<HONEYPOT>3a393430312f030809136170706c69636174696f6e2f73736c2d746c73","method":"","user_agent":"","ja3":"","session":"c5c2eaa9-66ba-41e2-a994-a3da8f486077","seq":1,"duration_ms":100,"bytes_in":59,"bytes_out":12,"enriched":{"digest":"2dac967ea8ce73f5","strings":["net.tcp://<HONEYPOT>:9401/","application/ssl-tls"],"iocs":{"domains":["net.tcp"]}}},{"timestamp":"2026-09-27T07:43:49","port":9401,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0001\u0000\u0001\u0002\u0002\u001cnet.tcp://<HONEYPOT>:9401/\u0003\b\t\u0013application/ssl-tls","payload_hex":"0001000102021c6e65742e7463703a2f2f<HONEYPOT>3a393430312f030809136170706c69636174696f6e2f73736c2d746c73","method":"","user_agent":"","ja3":"","session":"38fd22b6-67b2-4b70-9154-aa0a4b208851","seq":1,"duration_ms":100,"bytes_in":58,"bytes_out":12,"enriched":{"digest":"fe6d3e1b45fcc061","strings":["net.tcp://<HONEYPOT>:9401/","application/ssl-tls"],"iocs":{"domains":["net.tcp"]}}},{"timestamp":"2026-09-27T06:55:24","port":9401,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0001\u0000\u0001\u0002\u0002\u001dnet.tcp://<HONEYPOT>:9401/\u0003\b\t\u0013application/ssl-tls","payload_hex":"0001000102021d6e65742e7463703a2f2f<HONEYPOT>3a393430312f030809136170706c69636174696f6e2f73736c2d746c73","method":"","user_agent":"","ja3":"","session":"a246efdc-4dfb-4d0b-8001-0e0bc04618cc","seq":1,"duration_ms":100,"bytes_in":59,"bytes_out":12,"enriched":{"digest":"2dac967ea8ce73f5","strings":["net.tcp://<HONEYPOT>:9401/","application/ssl-tls"],"iocs":{"domains":["net.tcp"]}}},{"timestamp":"2026-09-26T17:39:40","port":9401,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0001\u0000\u0001\u0002\u0002\u001dnet.tcp://<HONEYPOT>:9401/\u0003\b\t\u0013application/ssl-tls","payload_hex":"0001000102021d6e65742e7463703a2f2f<HONEYPOT>3a393430312f030809136170706c69636174696f6e2f73736c2d746c73","method":"","user_agent":"","ja3":"","session":"91d65f09-4851-458c-b1b5-95c769b05569","seq":1,"duration_ms":100,"bytes_in":59,"bytes_out":12,"enriched":{"digest":"2dac967ea8ce73f5","strings":["net.tcp://<HONEYPOT>:9401/","application/ssl-tls"],"iocs":{"domains":["net.tcp"]}}},{"timestamp":"2026-09-26T13:05:34","port":9401,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0001\u0000\u0001\u0002\u0002\u001dnet.tcp://<HONEYPOT>:9401/\u0003\b\t\u0013application/ssl-tls","payload_hex":"0001000102021d6e65742e7463703a2f2f<HONEYPOT>3a393430312f030809136170706c69636174696f6e2f73736c2d746c73","method":"","user_agent":"","ja3":"","session":"bf8aa5d3-675f-4982-ba53-1869698b6424","seq":1,"duration_ms":100,"bytes_in":59,"bytes_out":12,"enriched":{"digest":"2dac967ea8ce73f5","strings":["net.tcp://<HONEYPOT>:9401/","application/ssl-tls"],"iocs":{"domains":["net.tcp"]}}},{"timestamp":"2026-09-26T12:35:48","port":9401,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0001\u0000\u0001\u0002\u0002\u001cnet.tcp://<HONEYPOT>:9401/\u0003\b\t\u0013application/ssl-tls","payload_hex":"0001000102021c6e65742e7463703a2f2f<HONEYPOT>3a393430312f030809136170706c69636174696f6e2f73736c2d746c73","method":"","user_agent":"","ja3":"","session":"d91aec1b-eaf9-4734-8a13-755ee1b40bb1","seq":1,"duration_ms":100,"bytes_in":58,"bytes_out":12,"enriched":{"digest":"fe6d3e1b45fcc061","strings":["net.tcp://<HONEYPOT>:9401/","application/ssl-tls"],"iocs":{"domains":["net.tcp"]}}},{"timestamp":"2026-09-25T19:04:09","port":9401,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0001\u0000\u0001\u0002\u0002\u001dnet.tcp://<HONEYPOT>:9401/\u0003\b\t\u0013application/ssl-tls","payload_hex":"0001000102021d6e65742e7463703a2f2f<HONEYPOT>3a393430312f030809136170706c69636174696f6e2f73736c2d746c73","method":"","user_agent":"","ja3":"","session":"1cc8c23b-234e-4f58-9c4e-c82c90592737","seq":1,"duration_ms":100,"bytes_in":59,"bytes_out":12,"enriched":{"digest":"2dac967ea8ce73f5","strings":["net.tcp://<HONEYPOT>:9401/","application/ssl-tls"],"iocs":{"domains":["net.tcp"]}}},{"timestamp":"2026-09-21T11:30:39","port":9401,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0001\u0000\u0001\u0002\u0002\u001cnet.tcp://<HONEYPOT>:9401/\u0003\b\t\u0013application/ssl-tls","payload_hex":"0001000102021c6e65742e7463703a2f2f<HONEYPOT>3a393430312f030809136170706c69636174696f6e2f73736c2d746c73","method":"","user_agent":"","ja3":"","session":"e47f89cc-ced7-4e75-8e12-444075d3eac0","seq":1,"duration_ms":100,"bytes_in":58,"bytes_out":12,"enriched":{"digest":"fe6d3e1b45fcc061","strings":["net.tcp://<HONEYPOT>:9401/","application/ssl-tls"],"iocs":{"domains":["net.tcp"]}}},{"timestamp":"2026-09-21T05:35:13","port":9401,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0001\u0000\u0001\u0002\u0002\u001dnet.tcp://<HONEYPOT>:9401/\u0003\b\t\u0013application/ssl-tls","payload_hex":"0001000102021d6e65742e7463703a2f2f<HONEYPOT>3a393430312f030809136170706c69636174696f6e2f73736c2d746c73","method":"","user_agent":"","ja3":"","session":"961572a8-3fb9-4dcd-911a-dbca64bf9618","seq":1,"duration_ms":100,"bytes_in":59,"bytes_out":12,"enriched":{"digest":"2dac967ea8ce73f5","strings":["net.tcp://<HONEYPOT>:9401/","application/ssl-tls"],"iocs":{"domains":["net.tcp"]}}}],"http_methods":[],"distinct_ports_total":1,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-09-29T09:15:38.219306+00:00"}