{"ip":"193.24.211.28","total_events":12,"verdict":{"verdict":"probing","label":"Low-level probing","detail":null,"confidence":"low","network_type":null,"why":["12 event(s), fewer than 10 distinct ports, no exploit payloads.","Not in any known-scanner range."],"engagement":{"level":"request","label":"Request traffic","detail":"1,548 bytes sent","bytes_sent":1548,"session_seconds":9,"persistent":false}},"first_seen":"2026-08-31T17:41:33","last_seen":"2026-09-25T12:44:40","events_24h":0,"events_7d":6,"geo":{"country_code":"DE","country_name":"Germany","region":"","city":"","lat":51.2993,"lon":9.491,"asn":215929,"org":"Data Campus Limited"},"source_domain":null,"known_scanners":[],"scanner_tag":null,"cve_matches":[],"malware":[],"top_ports":[{"port":5653,"proto":"tcp","label":"","count":3},{"port":3671,"proto":"tcp","label":"","count":3},{"port":16443,"proto":"tcp","label":"","count":2},{"port":14443,"proto":"tcp","label":"","count":2},{"port":1443,"proto":"tcp","label":"","count":2}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t12i210600_76e208dd3e22_f28add8e7af0"],"tls_client_hello":"160303008e0100008a03036ab66cab29b83ec3f640d598f664d9702976ee2a6536c1dff6951c1d64d9e52900002ac02cc02bc030c02f009f009ec024c023c028c027c00ac009c014c013009d009c003d003c0035002f000a01000037000a00080006001d00170018000b00020100000d001400120401050102010403050302030202060106030023000000170000ff","tls_ja3":["c12f54a3f91dc7bafd92cb59fe009a35"],"http_akin":["a11cun020_0000000c_5ff1c0a9","a11cun030_0000000e_21fe282e"]},"fingerprint_peers":{"t12i210600_76e208dd3e22_f28add8e7af0":9,"a11cun020_0000000c_5ff1c0a9":79,"a11cun030_0000000e_21fe282e":8},"akin_families":{"a11cun020_0000000c_5ff1c0a9":{"head":"a11cun020_0000000c_5ff1c0a9","shapes":2,"ips":79},"a11cun030_0000000e_21fe282e":{"head":"a11cun020_0000000c_5ff1c0a9","shapes":2,"ips":79}},"user_agents":[],"timeline":[{"date":"2026-08-31","count":6},{"date":"2026-09-25","count":6}],"recent_events":[{"timestamp":"2026-09-25T12:44:40","port":1443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:1443\"}","body":"","sni":"","tls_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","tls_version":"TLSv1.2","alpn":[],"url_path":"/remote/login?lang=en","summary":"","payload_hex":"474554202f72656d6f74652f6c6f67696e3f6c616e673d656e20485454502f312e310d0a486f73743a20<HONEYPOT>3a313434330d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"","ja3":"c12f54a3f91dc7bafd92cb59fe009a35","session":"ec326f56-eb34-4f60-b432-9da673e32bc7","seq":2,"duration_ms":8935,"bytes_in":198,"bytes_out":156},{"timestamp":"2026-09-25T12:44:33","port":1443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"Keep-Alive\",\"host\":\"<HONEYPOT>:1443\"}","body":"","sni":"","tls_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","tls_version":"TLSv1.2","alpn":[],"url_path":"/remote/login?lang=en","summary":"","payload_hex":"474554202f72656d6f74652f6c6f67696e3f6c616e673d656e20485454502f312e310d0a486f73743a20<HONEYPOT>3a313434330d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a204b6565702d416c6976650d0a0d0a","method":"GET","user_agent":"","ja3":"c12f54a3f91dc7bafd92cb59fe009a35","session":"ec326f56-eb34-4f60-b432-9da673e32bc7","seq":1,"duration_ms":2063,"bytes_in":111,"bytes_out":78},{"timestamp":"2026-09-25T11:54:13","port":16443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:16443\"}","body":"","sni":"","tls_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","tls_version":"TLSv1.2","alpn":[],"url_path":"/remote/login?lang=en","summary":"","payload_hex":"474554202f72656d6f74652f6c6f67696e3f6c616e673d656e20485454502f312e310d0a486f73743a20<HONEYPOT>3a31363434330d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"","ja3":"c12f54a3f91dc7bafd92cb59fe009a35","session":"ce5e7dc0-1f7b-44fd-a07e-bc9862fd3a30","seq":2,"duration_ms":3638,"bytes_in":198,"bytes_out":156},{"timestamp":"2026-09-25T11:54:11","port":16443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"Keep-Alive\",\"host\":\"<HONEYPOT>:16443\"}","body":"","sni":"","tls_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","tls_version":"TLSv1.2","alpn":[],"url_path":"/remote/login?lang=en","summary":"","payload_hex":"474554202f72656d6f74652f6c6f67696e3f6c616e673d656e20485454502f312e310d0a486f73743a20<HONEYPOT>3a31363434330d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a204b6565702d416c6976650d0a0d0a","method":"GET","user_agent":"","ja3":"c12f54a3f91dc7bafd92cb59fe009a35","session":"ce5e7dc0-1f7b-44fd-a07e-bc9862fd3a30","seq":1,"duration_ms":2069,"bytes_in":111,"bytes_out":78},{"timestamp":"2026-09-25T11:28:52","port":14443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"Keep-Alive\",\"host\":\"<HONEYPOT>:14443\"}","body":"","sni":"","tls_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","tls_version":"TLSv1.2","alpn":[],"url_path":"/remote/login?lang=en","summary":"","payload_hex":"474554202f72656d6f74652f6c6f67696e3f6c616e673d656e20485454502f312e310d0a486f73743a20<HONEYPOT>3a31343434330d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a204b6565702d416c6976650d0a0d0a","method":"GET","user_agent":"","ja3":"c12f54a3f91dc7bafd92cb59fe009a35","session":"b18549f1-5297-4ead-8baa-e57c8f6064fe","seq":1,"duration_ms":4067,"bytes_in":112,"bytes_out":78},{"timestamp":"2026-09-25T11:28:45","port":14443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"Keep-Alive\",\"host\":\"<HONEYPOT>:14443\"}","body":"","sni":"","tls_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","tls_version":"TLSv1.2","alpn":[],"url_path":"/remote/login?lang=en","summary":"","payload_hex":"474554202f72656d6f74652f6c6f67696e3f6c616e673d656e20485454502f312e310d0a486f73743a20<HONEYPOT>3a31343434330d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a204b6565702d416c6976650d0a0d0a","method":"GET","user_agent":"","ja3":"c12f54a3f91dc7bafd92cb59fe009a35","session":"6e047a47-2dd6-4615-bbb8-f4aba4ba4242","seq":1,"duration_ms":3929,"bytes_in":112,"bytes_out":78},{"timestamp":"2026-08-31T20:57:41","port":5653,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:5653\"}","body":"","sni":"","tls_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","tls_version":"TLSv1.2","alpn":[],"url_path":"/remote/login?lang=en","summary":"","payload_hex":"474554202f72656d6f74652f6c6f67696e3f6c616e673d656e20485454502f312e310d0a486f73743a20<HONEYPOT>3a353635330d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"","ja3":"c12f54a3f91dc7bafd92cb59fe009a35","session":"95dad27b-fd24-4ca5-97d7-a367d8b25437","seq":2,"duration_ms":466,"bytes_in":196,"bytes_out":156},{"timestamp":"2026-08-31T20:57:41","port":3671,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:3671\"}","body":"","sni":"","tls_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","tls_version":"TLSv1.2","alpn":[],"url_path":"/remote/login?lang=en","summary":"","payload_hex":"474554202f72656d6f74652f6c6f67696e3f6c616e673d656e20485454502f312e310d0a486f73743a20<HONEYPOT>3a333637310d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"","ja3":"c12f54a3f91dc7bafd92cb59fe009a35","session":"d9276c2b-0436-4246-8b01-e28a29ee05e3","seq":2,"duration_ms":485,"bytes_in":196,"bytes_out":156},{"timestamp":"2026-08-31T20:57:40","port":5653,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"Keep-Alive\",\"host\":\"<HONEYPOT>:5653\"}","body":"","sni":"","tls_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","tls_version":"TLSv1.2","alpn":[],"url_path":"/remote/login?lang=en","summary":"","payload_hex":"474554202f72656d6f74652f6c6f67696e3f6c616e673d656e20485454502f312e310d0a486f73743a20<HONEYPOT>3a353635330d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a204b6565702d416c6976650d0a0d0a","method":"GET","user_agent":"","ja3":"c12f54a3f91dc7bafd92cb59fe009a35","session":"95dad27b-fd24-4ca5-97d7-a367d8b25437","seq":1,"duration_ms":239,"bytes_in":110,"bytes_out":78},{"timestamp":"2026-08-31T20:57:40","port":3671,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"Keep-Alive\",\"host\":\"<HONEYPOT>:3671\"}","body":"","sni":"","tls_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","tls_version":"TLSv1.2","alpn":[],"url_path":"/remote/login?lang=en","summary":"","payload_hex":"474554202f72656d6f74652f6c6f67696e3f6c616e673d656e20485454502f312e310d0a486f73743a20<HONEYPOT>3a333637310d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a204b6565702d416c6976650d0a0d0a","method":"GET","user_agent":"","ja3":"c12f54a3f91dc7bafd92cb59fe009a35","session":"d9276c2b-0436-4246-8b01-e28a29ee05e3","seq":1,"duration_ms":250,"bytes_in":110,"bytes_out":78}],"http_methods":[{"method":"GET","count":10}],"distinct_ports_total":5,"top_paths":[{"path":"/remote/login?lang=en","count":10,"ports":5}],"distinct_paths_total":1,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept-Encoding","Connection","Host"],"representative":[{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Connection","value":"Keep-Alive","notable":false},{"name":"Host","value":"<HONEYPOT>:1443","notable":false}],"distinct_sets":2,"events_with_headers":10},"tags":[],"data_as_of":"2026-09-29T20:50:17.255233+00:00"}