{"ip":"193.24.123.108","total_events":32,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"14+ ports swept","confidence":"medium","network_type":null,"why":["No exploit payloads observed.","Swept 14 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range."],"engagement":{"level":"request","label":"Request traffic","detail":"2,212 bytes sent","bytes_sent":2212,"session_seconds":0,"persistent":false}},"first_seen":"2026-09-23T22:13:35","last_seen":"2026-09-26T20:53:30","events_24h":0,"events_7d":28,"geo":{"country_code":"RU","country_name":"Russia","region":"","city":"","lat":55.7386,"lon":37.6068,"asn":200593,"org":"Prospero Ooo"},"source_domain":null,"known_scanners":[],"scanner_tag":null,"cve_matches":[],"malware":[],"top_ports":[{"port":2443,"proto":"tcp","label":"","count":4},{"port":10444,"proto":"tcp","label":"","count":4},{"port":8443,"proto":"tcp","label":"HTTPS-alt","count":2},{"port":3443,"proto":"tcp","label":"","count":2},{"port":9443,"proto":"tcp","label":"","count":2},{"port":4343,"proto":"tcp","label":"","count":2},{"port":444,"proto":"tcp","label":"","count":2},{"port":5443,"proto":"tcp","label":"","count":2},{"port":10443,"proto":"tcp","label":"","count":2},{"port":4444,"proto":"tcp","label":"","count":2},{"port":6443,"proto":"tcp","label":"k8s API","count":2},{"port":1443,"proto":"tcp","label":"","count":2},{"port":4433,"proto":"tcp","label":"","count":2},{"port":7443,"proto":"tcp","label":"","count":2}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i1010h1_61a7ad8aa9b6_c7ab7a5df584"],"tls_client_hello":"16030100ea010000e60303d69193f11896ea1f57ea3e0653f9fc79fc47fba1ab598f9f4047b91dbb1feb4d20787c9b49a7b69f87bccfb3be61ac1872663954be8e5781df9dde097d06dedeb70014130213011303c02cc02bcca9c030c02fcca800ff01000089003300260024001d0020dd01345661f470993febd81b06a7d7d03323c4084c6519bb6c821d255e9e8875002d00020101000b00020100000500050100000000002b0005040304030300170000000a00080006001d00170018002300000010000b000908687474702f312e31000d001a0018040105010601020104030503060302030804080508060807","tls_ja3":["687c32b9814db0cd5bf931950c946602","64859af606aa8e7b716d65fd0cbb4a95","0bb96a6240ab1c9ba9b34fe398398cab","96fb92a68572df90a5818a282f61f7c8","cf56a5c077abb01f8994cfabbc00b4f9"],"http_akin":["b11cun020_00040001_78f1f19c"]},"fingerprint_peers":{"t13i1010h1_61a7ad8aa9b6_c7ab7a5df584":7,"b11cun020_00040001_78f1f19c":45},"akin_families":{},"user_agents":[],"timeline":[{"date":"2026-09-23","count":4},{"date":"2026-09-24","count":4},{"date":"2026-09-25","count":18},{"date":"2026-09-26","count":6}],"recent_events":[{"timestamp":"2026-09-26T20:53:30","port":2443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"host\":\"<HONEYPOT>:2443\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"/remote/login","summary":"","payload_hex":"474554202f72656d6f74652f6c6f67696e20485454502f312e310d0a486f73743a20<HONEYPOT>3a323434330d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"","ja3":"70240febf37b0f752b22a59f01353477","session":"3f9c14e3-404c-4615-adc0-9c0ec39d1bfa","seq":1,"duration_ms":233,"bytes_in":75,"bytes_out":79},{"timestamp":"2026-09-26T20:53:29","port":2443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"host\":\"<HONEYPOT>:2443\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a323434330d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"","ja3":"27ac19f2f1d77e7066273f7e399bea47","session":"63fbe112-ba92-4dcf-a766-54ce22b2035b","seq":1,"duration_ms":230,"bytes_in":63,"bytes_out":79},{"timestamp":"2026-09-26T19:59:44","port":10444,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"host\":\"<HONEYPOT>:10444\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"/remote/login","summary":"","payload_hex":"474554202f72656d6f74652f6c6f67696e20485454502f312e310d0a486f73743a20<HONEYPOT>3a31303434340d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"","ja3":"d2af4ea0011723cd67f9b10105f3deeb","session":"bd02efe5-2c64-496e-8f9a-dbda01cea4d5","seq":1,"duration_ms":227,"bytes_in":76,"bytes_out":79},{"timestamp":"2026-09-26T19:59:43","port":10444,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"host\":\"<HONEYPOT>:10444\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a31303434340d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"","ja3":"f17b8c6ff273ca3c1b0ec2ea7335e058","session":"596d4b04-7b58-40a2-b08e-8534434f1aa0","seq":1,"duration_ms":233,"bytes_in":64,"bytes_out":79},{"timestamp":"2026-09-26T00:53:47","port":4433,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"host\":\"<HONEYPOT>:4433\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a343433330d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"","ja3":"207a6d1002001332d3cc30acfc95ebca","session":"fb9ba782-11ee-4f1b-9edb-6d05a2c249c0","seq":1,"duration_ms":229,"bytes_in":63,"bytes_out":79},{"timestamp":"2026-09-26T00:53:47","port":4433,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"host\":\"<HONEYPOT>:4433\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"/remote/login","summary":"","payload_hex":"474554202f72656d6f74652f6c6f67696e20485454502f312e310d0a486f73743a20<HONEYPOT>3a343433330d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"","ja3":"bc955ad317286fc7dd4c127748682d4c","session":"8daba03e-07c4-4dfa-a052-d767ecf5df52","seq":1,"duration_ms":229,"bytes_in":75,"bytes_out":79},{"timestamp":"2026-09-25T22:04:32","port":3443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"host\":\"<HONEYPOT>:3443\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"/remote/login","summary":"","payload_hex":"474554202f72656d6f74652f6c6f67696e20485454502f312e310d0a486f73743a20<HONEYPOT>3a333434330d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"","ja3":"0a4f01e00ee652ffe8b0a47936a814ea","session":"8a483a8d-7653-4b1e-a462-1e90ad0e539e","seq":1,"duration_ms":229,"bytes_in":75,"bytes_out":79},{"timestamp":"2026-09-25T22:04:31","port":3443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"host\":\"<HONEYPOT>:3443\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a333434330d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"","ja3":"38f7a7d65e7ed93d59a7f5daa465a474","session":"230c1aca-3e5b-41be-b53f-8d21842cf9e2","seq":1,"duration_ms":231,"bytes_in":63,"bytes_out":79},{"timestamp":"2026-09-25T20:14:32","port":10443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"host\":\"<HONEYPOT>:10443\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"/remote/login","summary":"","payload_hex":"474554202f72656d6f74652f6c6f67696e20485454502f312e310d0a486f73743a20<HONEYPOT>3a31303434330d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"","ja3":"473b0859875754f88234905450d05dfd","session":"3300e1f4-7596-4d9c-a78d-ef26554d814d","seq":1,"duration_ms":232,"bytes_in":76,"bytes_out":79},{"timestamp":"2026-09-25T20:14:31","port":10443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"host\":\"<HONEYPOT>:10443\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a31303434330d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"","ja3":"b6c643ce444d5e36ceedafee47768a08","session":"7b8ceee0-745f-4632-a44a-0ea295850541","seq":1,"duration_ms":231,"bytes_in":64,"bytes_out":79}],"http_methods":[{"method":"GET","count":32}],"distinct_ports_total":14,"top_paths":[{"path":"/","count":16,"ports":14},{"path":"/remote/login","count":16,"ports":14}],"distinct_paths_total":2,"top_snis":[],"top_hosts":[],"top_alpns":[{"value":"http/1.1","count":32}],"banners":[],"credentials":[],"header_profile":{"signature":["Connection","Host"],"representative":[{"name":"Connection","value":"close","notable":false},{"name":"Host","value":"<HONEYPOT>:2443","notable":false}],"distinct_sets":1,"events_with_headers":10},"tags":[],"data_as_of":"2026-10-01T14:04:55.411724+00:00"}