{"ip":"193.32.126.156","total_events":11,"verdict":{"verdict":"probing","label":"Low-level probing","detail":null,"confidence":"low","network_type":"nsp","why":["11 event(s), fewer than 10 distinct ports, no exploit payloads.","Not in any known-scanner range."],"engagement":{"level":"request","label":"Request traffic","detail":"1,875 bytes sent","bytes_sent":1875,"session_seconds":0,"persistent":false}},"first_seen":"2026-08-07T18:04:21","last_seen":"2026-08-20T08:10:44","events_24h":3,"events_7d":7,"geo":{"country_code":"FR","country_name":"France","region":"Île-de-France","city":"Paris","lat":48.8558,"lon":2.3494,"asn":39351,"org":"31173 Services AB"},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as39351","label":"31173 Services","category":"isp","url":"https://www.peeringdb.com/asn/39351"},"cve_matches":[],"malware":[],"top_ports":[{"port":9200,"proto":"tcp","label":"Elastic","count":6},{"port":27017,"proto":"tcp","label":"MongoDB","count":5}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[],"ja4h":["ge11nn0300_042112399351"]},"fingerprint_peers":{"ge11nn0300_042112399351":3365},"user_agents":["curl/7.74.0"],"timeline":[{"date":"2026-08-07","count":1},{"date":"2026-08-12","count":3},{"date":"2026-08-15","count":1},{"date":"2026-08-19","count":3},{"date":"2026-08-20","count":3}],"recent_events":[{"timestamp":"2026-08-20T08:10:44","port":27017,"proto":"tcp","app_proto":"","app_protocol":"mongodb","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0006\u0001\u0000\u0000ł\u0003\n\u0000\u0000\u0000\u0000�\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000�����\u0000\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000�\u0000\u0000\u0000\u0003driver\u0000*\u0000\u0000\u0000\u0002name\u0000\b\u0000\u0000\u0000PyMongo\u0000\u0002version\u0000\u0006\u0000\u0000\u00004.6.3\u0000\u0000\u0003os\u0000[\u0000\u0000\u0000\u0002type\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002name\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002architecture\u0000\u0007\u0000\u0000\u0000x86_64\u0000\u0002version\u0000\u0010\u0000\u0000\u00004.19.0-27-amd64\u0000\u0000\u0002platform\u0000\u0016\u0000\u0000\u0000CPython 3.9.2.final.0\u0000\u0000\u0000","payload_hex":"06010000c582030a00000000d40700000000000061646d696e2e24636d640000000000ffffffffdf0000001069736d617374657200010000000868656c6c6f4f6b000103636c69656e7400ba00000003647269766572002a000000026e616d65000800000050794d6f6e676f000276657273696f6e0006000000342e362e330000036f73005b000000027479706500060000004c696e757800026e616d6500060000004c696e7578000261726368697465637475726500070000007838365f3634000276657273696f6e0010000000342e31392e302d32372d616d643634000002706c6174666f726d001600000043507974686f6e20332e392e322e66696e616c2e30000000","method":"","user_agent":"","ja3":"","session":"55750cb8-ade9-47dc-bb7d-4b559c729c34","seq":1,"duration_ms":100,"bytes_in":262,"bytes_out":14,"enriched":{"digest":"cbebf16a3d170149","strings":["admin.$cmd","ismaster","helloOk","client","driver","name","PyMongo","version","4.6.3","type"]}},{"timestamp":"2026-08-20T08:10:44","port":27017,"proto":"tcp","app_proto":"","app_protocol":"mongodb","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0006\u0001\u0000\u0000ł\u0003\n\u0000\u0000\u0000\u0000�\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000�����\u0000\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000�\u0000\u0000\u0000\u0003driver\u0000*\u0000\u0000\u0000\u0002name\u0000\b\u0000\u0000\u0000PyMongo\u0000\u0002version\u0000\u0006\u0000\u0000\u00004.6.3\u0000\u0000\u0003os\u0000[\u0000\u0000\u0000\u0002type\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002name\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002architecture\u0000\u0007\u0000\u0000\u0000x86_64\u0000\u0002version\u0000\u0010\u0000\u0000\u00004.19.0-27-amd64\u0000\u0000\u0002platform\u0000\u0016\u0000\u0000\u0000CPython 3.9.2.final.0\u0000\u0000\u0000","payload_hex":"06010000c582030a00000000d40700000000000061646d696e2e24636d640000000000ffffffffdf0000001069736d617374657200010000000868656c6c6f4f6b000103636c69656e7400ba00000003647269766572002a000000026e616d65000800000050794d6f6e676f000276657273696f6e0006000000342e362e330000036f73005b000000027479706500060000004c696e757800026e616d6500060000004c696e7578000261726368697465637475726500070000007838365f3634000276657273696f6e0010000000342e31392e302d32372d616d643634000002706c6174666f726d001600000043507974686f6e20332e392e322e66696e616c2e30000000","method":"","user_agent":"","ja3":"","session":"55750cb8-ade9-47dc-bb7d-4b559c729c34","seq":1,"duration_ms":100,"bytes_in":262,"bytes_out":14,"enriched":{"digest":"cbebf16a3d170149","strings":["admin.$cmd","ismaster","helloOk","client","driver","name","PyMongo","version","4.6.3","type"]}},{"timestamp":"2026-08-20T08:10:44","port":27017,"proto":"tcp","app_proto":"","app_protocol":"mongodb","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0006\u0001\u0000\u0000ł\u0003\n\u0000\u0000\u0000\u0000�\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000�����\u0000\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000�\u0000\u0000\u0000\u0003driver\u0000*\u0000\u0000\u0000\u0002name\u0000\b\u0000\u0000\u0000PyMongo\u0000\u0002version\u0000\u0006\u0000\u0000\u00004.6.3\u0000\u0000\u0003os\u0000[\u0000\u0000\u0000\u0002type\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002name\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002architecture\u0000\u0007\u0000\u0000\u0000x86_64\u0000\u0002version\u0000\u0010\u0000\u0000\u00004.19.0-27-amd64\u0000\u0000\u0002platform\u0000\u0016\u0000\u0000\u0000CPython 3.9.2.final.0\u0000\u0000\u0000","payload_hex":"06010000c582030a00000000d40700000000000061646d696e2e24636d640000000000ffffffffdf0000001069736d617374657200010000000868656c6c6f4f6b000103636c69656e7400ba00000003647269766572002a000000026e616d65000800000050794d6f6e676f000276657273696f6e0006000000342e362e330000036f73005b000000027479706500060000004c696e757800026e616d6500060000004c696e7578000261726368697465637475726500070000007838365f3634000276657273696f6e0010000000342e31392e302d32372d616d643634000002706c6174666f726d001600000043507974686f6e20332e392e322e66696e616c2e30000000","method":"","user_agent":"","ja3":"","session":"55750cb8-ade9-47dc-bb7d-4b559c729c34","seq":1,"duration_ms":100,"bytes_in":262,"bytes_out":14,"enriched":{"digest":"cbebf16a3d170149","strings":["admin.$cmd","ismaster","helloOk","client","driver","name","PyMongo","version","4.6.3","type"]}},{"timestamp":"2026-08-19T06:46:30","port":27017,"proto":"tcp","app_proto":"","app_protocol":"mongodb","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0006\u0001\u0000\u0000��Up\u0000\u0000\u0000\u0000�\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000�����\u0000\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000�\u0000\u0000\u0000\u0003driver\u0000*\u0000\u0000\u0000\u0002name\u0000\b\u0000\u0000\u0000PyMongo\u0000\u0002version\u0000\u0006\u0000\u0000\u00004.6.3\u0000\u0000\u0003os\u0000[\u0000\u0000\u0000\u0002type\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002name\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002architecture\u0000\u0007\u0000\u0000\u0000x86_64\u0000\u0002version\u0000\u0010\u0000\u0000\u00004.19.0-27-amd64\u0000\u0000\u0002platform\u0000\u0016\u0000\u0000\u0000CPython 3.9.2.final.0\u0000\u0000\u0000","payload_hex":"06010000f5a5557000000000d40700000000000061646d696e2e24636d640000000000ffffffffdf0000001069736d617374657200010000000868656c6c6f4f6b000103636c69656e7400ba00000003647269766572002a000000026e616d65000800000050794d6f6e676f000276657273696f6e0006000000342e362e330000036f73005b000000027479706500060000004c696e757800026e616d6500060000004c696e7578000261726368697465637475726500070000007838365f3634000276657273696f6e0010000000342e31392e302d32372d616d643634000002706c6174666f726d001600000043507974686f6e20332e392e322e66696e616c2e30000000","method":"","user_agent":"","ja3":"","session":"b002ad86-303d-4f4a-b396-80d97611dfee","seq":1,"duration_ms":100,"bytes_in":262,"bytes_out":14,"enriched":{"digest":"023b427f1f08d329","strings":["admin.$cmd","ismaster","helloOk","client","driver","name","PyMongo","version","4.6.3","type"]}},{"timestamp":"2026-08-19T06:15:38","port":9200,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:9200\",\"user-agent\":\"curl/7.74.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/_cat/indices","summary":"","payload_hex":"474554202f5f6361742f696e646963657320485454502f312e310d0a486f73743a20<HONEYPOT>3a393230300d0a557365722d4167656e743a206375726c2f372e37342e300d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"curl/7.74.0","ja3":"","session":"28f99a37-78a6-445e-bbab-478e4d6b3019","seq":1,"duration_ms":100,"bytes_in":95,"bytes_out":79},{"timestamp":"2026-08-19T05:54:40","port":9200,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:9200\",\"user-agent\":\"curl/7.74.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/_cat/indices","summary":"","payload_hex":"474554202f5f6361742f696e646963657320485454502f312e310d0a486f73743a20<HONEYPOT>3a393230300d0a557365722d4167656e743a206375726c2f372e37342e300d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"curl/7.74.0","ja3":"","session":"3daedbd2-eafa-46bc-a03a-5f2282904fd5","seq":1,"duration_ms":100,"bytes_in":93,"bytes_out":79},{"timestamp":"2026-08-15T16:36:45","port":9200,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:9200\",\"user-agent\":\"curl/7.74.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/_cat/indices","summary":"","payload_hex":"474554202f5f6361742f696e646963657320485454502f312e310d0a486f73743a20<HONEYPOT>3a393230300d0a557365722d4167656e743a206375726c2f372e37342e300d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"curl/7.74.0","ja3":"","session":"45d01662-fb0d-4e09-81a3-90abcacf2d3e","seq":1,"duration_ms":100,"bytes_in":93,"bytes_out":79},{"timestamp":"2026-08-12T23:30:57","port":9200,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:9200\",\"user-agent\":\"curl/7.74.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/_cat/indices","summary":"","payload_hex":"474554202f5f6361742f696e646963657320485454502f312e310d0a486f73743a20<HONEYPOT>3a393230300d0a557365722d4167656e743a206375726c2f372e37342e300d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"curl/7.74.0","ja3":"","session":"0e5d491a-b413-4cd3-8313-1bc1ce6168cb","seq":1,"duration_ms":100,"bytes_in":95,"bytes_out":79},{"timestamp":"2026-08-12T15:40:47","port":27017,"proto":"tcp","app_proto":"","app_protocol":"mongodb","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0006\u0001\u0000\u0000�\u0007hk\u0000\u0000\u0000\u0000�\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000�����\u0000\u0000\u0000\u0010ismaster\u0000\u0001\u0000\u0000\u0000\bhelloOk\u0000\u0001\u0003client\u0000�\u0000\u0000\u0000\u0003driver\u0000*\u0000\u0000\u0000\u0002name\u0000\b\u0000\u0000\u0000PyMongo\u0000\u0002version\u0000\u0006\u0000\u0000\u00004.6.3\u0000\u0000\u0003os\u0000[\u0000\u0000\u0000\u0002type\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002name\u0000\u0006\u0000\u0000\u0000Linux\u0000\u0002architecture\u0000\u0007\u0000\u0000\u0000x86_64\u0000\u0002version\u0000\u0010\u0000\u0000\u00004.19.0-27-amd64\u0000\u0000\u0002platform\u0000\u0016\u0000\u0000\u0000CPython 3.9.2.final.0\u0000\u0000\u0000","payload_hex":"060100009a07686b00000000d40700000000000061646d696e2e24636d640000000000ffffffffdf0000001069736d617374657200010000000868656c6c6f4f6b000103636c69656e7400ba00000003647269766572002a000000026e616d65000800000050794d6f6e676f000276657273696f6e0006000000342e362e330000036f73005b000000027479706500060000004c696e757800026e616d6500060000004c696e7578000261726368697465637475726500070000007838365f3634000276657273696f6e0010000000342e31392e302d32372d616d643634000002706c6174666f726d001600000043507974686f6e20332e392e322e66696e616c2e30000000","method":"","user_agent":"","ja3":"","session":"6738c2c0-16c3-47c7-a8ea-fbe3f062cff6","seq":1,"duration_ms":100,"bytes_in":262,"bytes_out":14,"enriched":{"digest":"a694ac43da041e1b","strings":["admin.$cmd","ismaster","helloOk","client","driver","name","PyMongo","version","4.6.3","type"]}},{"timestamp":"2026-08-12T06:41:19","port":9200,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:9200\",\"user-agent\":\"curl/7.74.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/_cat/indices","summary":"","payload_hex":"474554202f5f6361742f696e646963657320485454502f312e310d0a486f73743a20<HONEYPOT>3a393230300d0a557365722d4167656e743a206375726c2f372e37342e300d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"curl/7.74.0","ja3":"","session":"29fe409c-8431-411c-aac4-fb64b47fa432","seq":1,"duration_ms":100,"bytes_in":94,"bytes_out":79}],"http_methods":[{"method":"GET","count":6}],"distinct_ports_total":2,"top_paths":[{"path":"/_cat/indices","count":6,"ports":1}],"distinct_paths_total":1,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","Host","User-Agent"],"representative":[{"name":"Accept","value":"*/*","notable":false},{"name":"Host","value":"<HONEYPOT>:9200","notable":false},{"name":"User-Agent","value":"curl/7.74.0","notable":false}],"distinct_sets":1,"events_with_headers":5},"tags":[],"data_as_of":"2026-08-21T01:29:53.071824+00:00"}