{"ip":"188.186.183.82","total_events":5,"verdict":{"verdict":"probing","label":"Low-level probing","detail":null,"confidence":"low","network_type":null,"why":["5 event(s), fewer than 10 distinct ports, no exploit payloads.","Not in any known-scanner range."],"engagement":{"level":"request","label":"Request traffic","detail":"385 bytes sent","bytes_sent":385,"session_seconds":0,"persistent":false}},"first_seen":"2026-09-14T17:57:29","last_seen":"2026-09-14T18:00:10","events_24h":0,"events_7d":0,"geo":{"country_code":"RU","country_name":"Russia","region":"Tyumen Oblast","city":"Tyumen","lat":57.1533,"lon":65.5418,"asn":41682,"org":"JSC ER-Telecom Holding"},"source_domain":"188x186x183x82.dynamic.tmn.ertelecom.ru","known_scanners":[],"scanner_tag":null,"cve_matches":[],"malware":[],"top_ports":[{"port":85,"proto":"tcp","label":"","count":1},{"port":65011,"proto":"tcp","label":"","count":1},{"port":65012,"proto":"tcp","label":"","count":1},{"port":443,"proto":"tcp","label":"HTTPS","count":1},{"port":65010,"proto":"tcp","label":"","count":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i191000_9dc949149365_e5728521abd4"],"tls_client_hello":"","tls_ja3":["96458b3de39df5d47bc5c4a9f10f8f26"],"http_akin":["b11cun020_00040001_78f1f19c"]},"fingerprint_peers":{"t13i191000_9dc949149365_e5728521abd4":222,"b11cun020_00040001_78f1f19c":49},"akin_families":{},"user_agents":[],"timeline":[{"date":"2026-09-14","count":5}],"recent_events":[{"timestamp":"2026-09-14T18:00:10","port":65012,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"host\":\"<HONEYPOT>:65012\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/dvr/brief.xml","summary":"","payload_hex":"474554202f6476722f62726965662e786d6c20485454502f312e310d0a486f73743a20<HONEYPOT>3a36353031320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"","ja3":"96458b3de39df5d47bc5c4a9f10f8f26","session":"3febc559-860e-4dfe-9737-c6fae0f53a53","seq":1,"duration_ms":100,"bytes_in":78,"bytes_out":79},{"timestamp":"2026-09-14T17:59:54","port":65011,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"host\":\"<HONEYPOT>:65011\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/dvr/brief.xml","summary":"","payload_hex":"474554202f6476722f62726965662e786d6c20485454502f312e310d0a486f73743a20<HONEYPOT>3a36353031310d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"","ja3":"96458b3de39df5d47bc5c4a9f10f8f26","session":"77e3e85a-6586-40fb-91af-c1eca91dd53a","seq":1,"duration_ms":100,"bytes_in":78,"bytes_out":79},{"timestamp":"2026-09-14T17:59:39","port":65010,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"host\":\"<HONEYPOT>:65010\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/dvr/brief.xml","summary":"","payload_hex":"474554202f6476722f62726965662e786d6c20485454502f312e310d0a486f73743a20<HONEYPOT>3a36353031300d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"","ja3":"96458b3de39df5d47bc5c4a9f10f8f26","session":"5b72df0b-a2bf-40dd-8b47-6f7adb854224","seq":1,"duration_ms":100,"bytes_in":78,"bytes_out":79},{"timestamp":"2026-09-14T17:58:34","port":85,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"host\":\"<HONEYPOT>:85\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/dvr/brief.xml","summary":"","payload_hex":"474554202f6476722f62726965662e786d6c20485454502f312e310d0a486f73743a20<HONEYPOT>3a38350d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"","ja3":"96458b3de39df5d47bc5c4a9f10f8f26","session":"58bab106-c65e-48b8-9eb5-06f495b4bdfd","seq":1,"duration_ms":100,"bytes_in":75,"bytes_out":79},{"timestamp":"2026-09-14T17:57:29","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"host\":\"<HONEYPOT>:443\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/dvr/brief.xml","summary":"","payload_hex":"474554202f6476722f62726965662e786d6c20485454502f312e310d0a486f73743a20<HONEYPOT>3a3434330d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"","ja3":"96458b3de39df5d47bc5c4a9f10f8f26","session":"7c0a36d8-371e-4155-a5bc-91daa4d383ca","seq":1,"duration_ms":100,"bytes_in":76,"bytes_out":79}],"http_methods":[{"method":"GET","count":5}],"distinct_ports_total":5,"top_paths":[{"path":"/dvr/brief.xml","count":5,"ports":5}],"distinct_paths_total":1,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Connection","Host"],"representative":[{"name":"Connection","value":"close","notable":false},{"name":"Host","value":"<HONEYPOT>:65012","notable":false}],"distinct_sets":1,"events_with_headers":5},"tags":[],"data_as_of":"2026-09-30T19:47:33.614571+00:00"}