{"ip":"192.42.116.112","total_events":33,"verdict":{"verdict":"scanner","label":"Recognized scanner","detail":"Church of Cyberology","confidence":"high","network_type":"educational/research","why":["Source IP is in a known scanner range (Church of Cyberology).","Known research and commercial scanners are labelled as such, not as threats."],"engagement":{"level":"payload","label":"Sustained payload","detail":"5,113 bytes sent","bytes_sent":5113,"session_seconds":3,"persistent":false}},"first_seen":"2026-07-14T21:20:12","last_seen":"2026-09-20T06:01:40","events_24h":0,"events_7d":5,"geo":{"country_code":"NL","country_name":"The Netherlands","region":"","city":"","lat":52.3824,"lon":4.8995,"asn":215125,"org":"Church of Cyberology"},"source_domain":null,"known_scanners":["Church of Cyberology"],"scanner_tag":{"key":"cyberology","label":"Church of Cyberology","category":"research","url":""},"cve_matches":[],"malware":[],"top_ports":[{"port":80,"proto":"tcp","label":"HTTP","count":13},{"port":6666,"proto":"tcp","label":"","count":9},{"port":6379,"proto":"tcp","label":"Redis","count":5},{"port":23,"proto":"tcp","label":"Telnet","count":3},{"port":1935,"proto":"tcp","label":"","count":2},{"port":11434,"proto":"tcp","label":"","count":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":[]},"fingerprint_peers":{},"akin_families":{},"user_agents":["python-requests/2.28.1","curl/8.18.0"],"timeline":[{"date":"2026-07-14","count":1},{"date":"2026-07-28","count":24},{"date":"2026-07-29","count":3},{"date":"2026-09-20","count":5}],"recent_events":[{"timestamp":"2026-09-20T06:01:40","port":6379,"proto":"tcp","app_proto":"","app_protocol":"redis","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"*2\r\n$4\r\nINFO\r\n$8\r\nkeyspace\r\n","payload_hex":"2a320d0a24340d0a494e464f0d0a24380d0a6b657973706163650d0a","method":"","user_agent":"","ja3":"","session":"7d95dbe2-f428-408c-8858-9d9ae96ba54f","seq":5,"duration_ms":2810,"bytes_in":175,"bytes_out":27,"enriched":{"digest":"e55d01bcab337cf3","label":"Redis (RESP)","strings":["INFO","keyspace"]}},{"timestamp":"2026-09-20T06:01:39","port":6379,"proto":"tcp","app_proto":"","app_protocol":"redis","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"*2\r\n$4\r\nINFO\r\n$3\r\nall\r\n","payload_hex":"2a320d0a24340d0a494e464f0d0a24330d0a616c6c0d0a","method":"","user_agent":"","ja3":"","session":"7d95dbe2-f428-408c-8858-9d9ae96ba54f","seq":4,"duration_ms":2141,"bytes_in":147,"bytes_out":22,"enriched":{"digest":"54e0f1fcaba18997","label":"Redis (RESP)","strings":["INFO"]}},{"timestamp":"2026-09-20T06:01:38","port":6379,"proto":"tcp","app_proto":"","app_protocol":"redis","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"*4\r\n$6\r\nCLIENT\r\n$7\r\nSETINFO\r\n$7\r\nLIB-VER\r\n$5\r\n8.1.0\r\n","payload_hex":"2a340d0a24360d0a434c49454e540d0a24370d0a534554494e464f0d0a24370d0a4c49422d5645520d0a24350d0a382e312e300d0a","method":"","user_agent":"","ja3":"","session":"7d95dbe2-f428-408c-8858-9d9ae96ba54f","seq":2,"duration_ms":865,"bytes_in":110,"bytes_out":10,"enriched":{"digest":"2fe18f36d05095a9","label":"Redis (RESP)","strings":["CLIENT","SETINFO","LIB-VER","8.1.0"]}},{"timestamp":"2026-09-20T06:01:38","port":6379,"proto":"tcp","app_proto":"","app_protocol":"redis","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"*1\r\n$4\r\nPING\r\n","payload_hex":"2a310d0a24340d0a50494e470d0a","method":"","user_agent":"","ja3":"","session":"7d95dbe2-f428-408c-8858-9d9ae96ba54f","seq":3,"duration_ms":1483,"bytes_in":124,"bytes_out":17,"enriched":{"digest":"3311f70e8081417b","label":"Redis (RESP)","strings":["PING"]}},{"timestamp":"2026-09-20T06:01:37","port":6379,"proto":"tcp","app_proto":"","app_protocol":"redis","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"*4\r\n$6\r\nCLIENT\r\n$7\r\nSETINFO\r\n$8\r\nLIB-NAME\r\n$8\r\nredis-py\r\n","payload_hex":"2a340d0a24360d0a434c49454e540d0a24370d0a534554494e464f0d0a24380d0a4c49422d4e414d450d0a24380d0a72656469732d70790d0a","method":"","user_agent":"","ja3":"","session":"7d95dbe2-f428-408c-8858-9d9ae96ba54f","seq":1,"duration_ms":100,"bytes_in":57,"bytes_out":5,"enriched":{"digest":"a8b68666804f9599","label":"Redis (RESP)","strings":["CLIENT","SETINFO","LIB-NAME","redis-py"]}},{"timestamp":"2026-07-29T19:03:39","port":23,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"��\u00031234567890\n","payload_hex":"fffe03313233343536373839300a","method":"","user_agent":"","ja3":"","session":"cd47d775-99c2-4bdd-bb25-c2c430559a61","seq":3,"duration_ms":611,"bytes_in":22,"bytes_out":41,"enriched":{"digest":"b699a4120ef4db4d","strings":["1234567890"]}},{"timestamp":"2026-07-29T19:03:39","port":23,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"��\u0001","payload_hex":"fffe01","method":"","user_agent":"","ja3":"","session":"cd47d775-99c2-4bdd-bb25-c2c430559a61","seq":2,"duration_ms":465,"bytes_in":8,"bytes_out":22},{"timestamp":"2026-07-29T19:03:39","port":23,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"root\n","payload_hex":"726f6f740a","method":"","user_agent":"","ja3":"","session":"cd47d775-99c2-4bdd-bb25-c2c430559a61","seq":1,"duration_ms":100,"bytes_in":5,"bytes_out":12,"enriched":{"digest":"552c0ba71b1046a0","strings":["root"]}},{"timestamp":"2026-07-28T20:20:40","port":6666,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:6666\",\"user-agent\":\"python-requests/2.28.1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/tmpfs/auto.jpg?usr=admin123&pwd=admin","summary":"","payload_hex":"474554202f746d7066732f6175746f2e6a70673f7573723d61646d696e313233267077643d61646d696e20485454502f312e310d0a486f73743a20<HONEYPOT>3a363636360d0a557365722d4167656e743a20707974686f6e2d72657175657374732f322e32382e310d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"python-requests/2.28.1","ja3":"","session":"6f5aa55b-7308-43c2-987a-884e8b59685a","seq":1,"duration_ms":100,"bytes_in":185,"bytes_out":79},{"timestamp":"2026-07-28T20:20:39","port":6666,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate\",\"connection\":\"keep-alive\",\"host\":\"<HONEYPOT>:6666\",\"user-agent\":\"python-requests/2.28.1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/tmpfs/auto.jpg?usr=admin122&pwd=admin","summary":"","payload_hex":"474554202f746d7066732f6175746f2e6a70673f7573723d61646d696e313232267077643d61646d696e20485454502f312e310d0a486f73743a20<HONEYPOT>3a363636360d0a557365722d4167656e743a20707974686f6e2d72657175657374732f322e32382e310d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a0d0a","method":"GET","user_agent":"python-requests/2.28.1","ja3":"","session":"35b913e9-437b-46bd-9b7f-efbed69ba248","seq":1,"duration_ms":100,"bytes_in":185,"bytes_out":79}],"http_methods":[{"method":"GET","count":25}],"distinct_ports_total":6,"top_paths":[{"path":"/tmpfs/auto.jpg?usr=admin115&pwd=admin","count":2,"ports":2},{"path":"/tmpfs/auto.jpg?usr=admin116&pwd=admin","count":2,"ports":2},{"path":"/api/ps","count":1,"ports":1},{"path":"/tmpfs/auto.jpg?usr=admin114&pwd=admin","count":1,"ports":1},{"path":"/tmpfs/auto.jpg?usr=guest&pwd=moggy","count":1,"ports":1},{"path":"/tmpfs/auto.jpg?usr=guest&pwd=admin","count":1,"ports":1},{"path":"/tmpfs/auto.jpg?usr=admin119&pwd=admin","count":1,"ports":1},{"path":"/tmpfs/auto.jpg?usr=guest&pwd=user","count":1,"ports":1},{"path":"/tmpfs/auto.jpg?usr=admin113&pwd=admin","count":1,"ports":1},{"path":"/tmpfs/auto.jpg?usr=admin121&pwd=admin","count":1,"ports":1},{"path":"/tmpfs/auto.jpg?usr=admin118&pwd=admin","count":1,"ports":1},{"path":"/tmpfs/auto.jpg?usr=admin112&pwd=admin","count":1,"ports":1},{"path":"/tmpfs/auto.jpg?usr=admin120&pwd=admin","count":1,"ports":1},{"path":"/tmpfs/auto.jpg?usr=guest&pwd=","count":1,"ports":1},{"path":"/tmpfs/auto.jpg?usr=admin122&pwd=admin","count":1,"ports":1}],"distinct_paths_total":23,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","Accept-Encoding","Connection","Host","User-Agent"],"representative":[{"name":"Accept","value":"*/*","notable":false},{"name":"Accept-Encoding","value":"gzip, deflate","notable":false},{"name":"Connection","value":"keep-alive","notable":false},{"name":"Host","value":"<HONEYPOT>:6666","notable":false},{"name":"User-Agent","value":"python-requests/2.28.1","notable":false}],"distinct_sets":1,"events_with_headers":2},"tags":[],"data_as_of":"2026-09-23T17:01:11.220212+00:00"}