{"ip":"192.161.49.2","total_events":2683,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"935+ ports swept","confidence":"medium","network_type":null,"why":["No exploit payloads observed.","Swept 935 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range."]},"first_seen":"2026-07-15T00:53:29","last_seen":"2026-07-26T15:25:21","events_24h":357,"events_7d":2126,"geo":{"country_code":"US","country_name":"United States","region":"","city":"","lat":37.751,"lon":-97.822,"asn":23273,"org":"HostPapa"},"source_domain":"v2683292.hostpapadedi.net","known_scanners":[],"scanner_tag":null,"cve_matches":[],"malware":[],"top_ports":[{"port":9443,"proto":"tcp","label":"","count":26},{"port":18443,"proto":"tcp","label":"","count":18},{"port":10443,"proto":"tcp","label":"","count":18},{"port":6443,"proto":"tcp","label":"k8s API","count":16},{"port":7443,"proto":"tcp","label":"","count":16},{"port":8280,"proto":"tcp","label":"","count":16},{"port":5443,"proto":"tcp","label":"","count":14},{"port":3443,"proto":"tcp","label":"","count":14},{"port":8180,"proto":"tcp","label":"","count":11},{"port":20000,"proto":"tcp","label":"","count":11},{"port":5601,"proto":"tcp","label":"Kibana","count":10},{"port":28080,"proto":"tcp","label":"","count":9},{"port":9091,"proto":"tcp","label":"","count":9},{"port":18080,"proto":"tcp","label":"","count":9},{"port":9080,"proto":"tcp","label":"","count":9}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i131000_f57a46bbacb6_e5728521abd4"],"tls_ja3":["2196848d251b217de8b2c037e356c11d"],"ja4h":["ge11nn0400_17292dadbc7b"]},"fingerprint_peers":{"t13i131000_f57a46bbacb6_e5728521abd4":236,"ge11nn0400_17292dadbc7b":636},"user_agents":["Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:146.0) Gecko/20100101 Firefox/146.0"],"timeline":[{"date":"2026-07-15","count":173},{"date":"2026-07-16","count":36},{"date":"2026-07-17","count":140},{"date":"2026-07-18","count":68},{"date":"2026-07-19","count":227},{"date":"2026-07-20","count":290},{"date":"2026-07-21","count":359},{"date":"2026-07-22","count":291},{"date":"2026-07-23","count":206},{"date":"2026-07-24","count":328},{"date":"2026-07-25","count":339},{"date":"2026-07-26","count":226}],"recent_events":[{"timestamp":"2026-07-26T15:25:21","port":3619,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:3619\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:146.0) Gecko/20100101 Firefox/146.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd","summary":"","payload_hex":"474554202f2e2e2532462e2e2532462e2e2532462e2e2532462e2e2532462e2e25324665746325324670617373776420485454502f312e310d0a486f73743a20<HONEYPOT>3a333631390d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b207836343b2072763a3134362e3029204765636b6f2f32303130303130312046697265666f782f3134362e300d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:146.0) Gecko/20100101 Firefox/146.0","community_id":"1:lGwvp1l3YIWev0CY3yn+y4h3dSw=","ja3":"","session":"3e16bbc6-53bc-4cee-b53e-93b1e9436cee","seq":1,"duration_ms":100,"bytes_in":211,"bytes_out":77},{"timestamp":"2026-07-26T15:24:36","port":3619,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:3619\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:146.0) Gecko/20100101 Firefox/146.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd","summary":"","payload_hex":"474554202f2e2e2532462e2e2532462e2e2532462e2e2532462e2e2532462e2e25324665746325324670617373776420485454502f312e310d0a486f73743a20<HONEYPOT>3a333631390d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b207836343b2072763a3134362e3029204765636b6f2f32303130303130312046697265666f782f3134362e300d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:146.0) Gecko/20100101 Firefox/146.0","community_id":"1:Be9LZ5yddr/RaHoxcL8MNwAXF3A=","ja3":"","session":"2470cbed-03dc-42ef-acdd-ddbd3618a646","seq":1,"duration_ms":100,"bytes_in":211,"bytes_out":77},{"timestamp":"2026-07-26T15:18:03","port":3618,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:3618\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:146.0) Gecko/20100101 Firefox/146.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd","summary":"","payload_hex":"474554202f2e2e2532462e2e2532462e2e2532462e2e2532462e2e2532462e2e25324665746325324670617373776420485454502f312e310d0a486f73743a20<HONEYPOT>3a333631380d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b207836343b2072763a3134362e3029204765636b6f2f32303130303130312046697265666f782f3134362e300d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:146.0) Gecko/20100101 Firefox/146.0","community_id":"1:NsQYqrzTy70AJIldyviNujNe//A=","ja3":"","session":"8b94cf9c-54bb-4093-b1d6-03c33dbc1e27","seq":1,"duration_ms":101,"bytes_in":211,"bytes_out":77},{"timestamp":"2026-07-26T15:18:00","port":3618,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:3618\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:146.0) Gecko/20100101 Firefox/146.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd","summary":"","payload_hex":"474554202f2e2e2532462e2e2532462e2e2532462e2e2532462e2e2532462e2e25324665746325324670617373776420485454502f312e310d0a486f73743a20<HONEYPOT>3a333631380d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b207836343b2072763a3134362e3029204765636b6f2f32303130303130312046697265666f782f3134362e300d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:146.0) Gecko/20100101 Firefox/146.0","community_id":"1:SMikINpFA8zwYKv5Kc3jdZb/Moo=","ja3":"","session":"e976dc7c-5b5e-4327-af2d-d73dfb330c9e","seq":1,"duration_ms":100,"bytes_in":211,"bytes_out":77},{"timestamp":"2026-07-26T15:10:26","port":3617,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:3617\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:146.0) Gecko/20100101 Firefox/146.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd","summary":"","payload_hex":"474554202f2e2e2532462e2e2532462e2e2532462e2e2532462e2e2532462e2e25324665746325324670617373776420485454502f312e310d0a486f73743a20<HONEYPOT>3a333631370d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b207836343b2072763a3134362e3029204765636b6f2f32303130303130312046697265666f782f3134362e300d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:146.0) Gecko/20100101 Firefox/146.0","community_id":"1:Ib50HDS3Tx+At2pAHNFzF1rXPVg=","ja3":"","session":"0ea0232e-42b0-4e0e-935f-52c88018b9db","seq":1,"duration_ms":100,"bytes_in":211,"bytes_out":77},{"timestamp":"2026-07-26T15:08:26","port":3617,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:3617\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:146.0) Gecko/20100101 Firefox/146.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd","summary":"","payload_hex":"474554202f2e2e2532462e2e2532462e2e2532462e2e2532462e2e2532462e2e25324665746325324670617373776420485454502f312e310d0a486f73743a20<HONEYPOT>3a333631370d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b207836343b2072763a3134362e3029204765636b6f2f32303130303130312046697265666f782f3134362e300d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:146.0) Gecko/20100101 Firefox/146.0","community_id":"1:yWMxLouthbgxrDaV8jAY4yAKnS8=","ja3":"","session":"f448a549-2ccc-4e93-8c77-54c5c6b4e2d0","seq":1,"duration_ms":100,"bytes_in":211,"bytes_out":77},{"timestamp":"2026-07-26T15:03:30","port":3616,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:3616\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:146.0) Gecko/20100101 Firefox/146.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd","summary":"","payload_hex":"474554202f2e2e2532462e2e2532462e2e2532462e2e2532462e2e2532462e2e25324665746325324670617373776420485454502f312e310d0a486f73743a20<HONEYPOT>3a333631360d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b207836343b2072763a3134362e3029204765636b6f2f32303130303130312046697265666f782f3134362e300d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:146.0) Gecko/20100101 Firefox/146.0","community_id":"1:r3YAy3mgOADJajlyLcUmyQTlOHk=","ja3":"","session":"359cf5b6-ee67-4a14-8222-528c0183ee79","seq":1,"duration_ms":100,"bytes_in":211,"bytes_out":77},{"timestamp":"2026-07-26T15:02:09","port":3616,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:3616\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:146.0) Gecko/20100101 Firefox/146.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd","summary":"","payload_hex":"474554202f2e2e2532462e2e2532462e2e2532462e2e2532462e2e2532462e2e25324665746325324670617373776420485454502f312e310d0a486f73743a20<HONEYPOT>3a333631360d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b207836343b2072763a3134362e3029204765636b6f2f32303130303130312046697265666f782f3134362e300d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:146.0) Gecko/20100101 Firefox/146.0","community_id":"1:uSKVc3tManxaDicwrQvMNYROitw=","ja3":"","session":"5d946af9-2953-43a8-a05b-a3d94e700583","seq":1,"duration_ms":100,"bytes_in":211,"bytes_out":77},{"timestamp":"2026-07-26T14:56:04","port":3615,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:3615\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:146.0) Gecko/20100101 Firefox/146.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd","summary":"","payload_hex":"474554202f2e2e2532462e2e2532462e2e2532462e2e2532462e2e2532462e2e25324665746325324670617373776420485454502f312e310d0a486f73743a20<HONEYPOT>3a333631350d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b207836343b2072763a3134362e3029204765636b6f2f32303130303130312046697265666f782f3134362e300d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:146.0) Gecko/20100101 Firefox/146.0","community_id":"1:apzjl38UEMnAAruZPW3b6n48OhE=","ja3":"","session":"4a459582-3d8b-4f43-b0f0-d562a9604d67","seq":1,"duration_ms":102,"bytes_in":211,"bytes_out":77},{"timestamp":"2026-07-26T14:55:31","port":3615,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:3615\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:146.0) Gecko/20100101 Firefox/146.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd","summary":"","payload_hex":"474554202f2e2e2532462e2e2532462e2e2532462e2e2532462e2e2532462e2e25324665746325324670617373776420485454502f312e310d0a486f73743a20<HONEYPOT>3a333631350d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b207836343b2072763a3134362e3029204765636b6f2f32303130303130312046697265666f782f3134362e300d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:146.0) Gecko/20100101 Firefox/146.0","community_id":"1:hWMuhyA1iq9iVZJH9oZt+Qh8Vg4=","ja3":"","session":"c753b3f5-1133-430f-9ec6-3832b59e3135","seq":1,"duration_ms":100,"bytes_in":211,"bytes_out":77}],"http_methods":[{"method":"GET","count":2683}],"distinct_ports_total":935,"top_paths":[{"path":"/..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd","count":2683,"ports":935}],"distinct_paths_total":1,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","Connection","Host","User-Agent"],"representative":[{"name":"Accept","value":"*/*","notable":false},{"name":"Connection","value":"close","notable":false},{"name":"Host","value":"<HONEYPOT>:3619","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:146.0) Gecko/20100101 Firefox/146.0","notable":false}],"distinct_sets":1,"events_with_headers":10},"tags":[],"data_as_of":"2026-07-26T15:25:49.198853+00:00"}