{"ip":"194.88.98.126","total_events":37,"verdict":{"verdict":"scanner","label":"Recognized scanner","detail":"infrawatch","confidence":"high","network_type":"CDN","why":["Source IP is in a known scanner range (infrawatch).","Known research and commercial scanners are labelled as such, not as threats."],"engagement":{"level":"request","label":"Request traffic","detail":"2,174 bytes sent","bytes_sent":2174,"session_seconds":10,"persistent":false}},"first_seen":"2026-04-27T02:19:29","last_seen":"2026-08-14T13:16:12","events_24h":1,"events_7d":13,"geo":{"country_code":"DE","country_name":"Germany","region":"Hesse","city":"Frankfurt am Main","lat":50.1169,"lon":8.6837,"asn":25369,"org":"Hydra Communications Ltd"},"source_domain":"194-88-98-126.infrawat.ch","known_scanners":["infrawatch","Infrawatch"],"scanner_tag":{"key":"infrawatch","label":"Infrawatch","category":"commercial","url":"https://infrawat.ch/"},"cve_matches":[],"malware":[],"top_ports":[{"port":8088,"proto":"tcp","label":"Hadoop","count":3},{"port":5985,"proto":"tcp","label":"","count":3},{"port":1444,"proto":"tcp","label":"","count":2},{"port":37495,"proto":"tcp","label":"","count":2},{"port":21117,"proto":"tcp","label":"","count":2},{"port":57787,"proto":"tcp","label":"","count":2},{"port":5683,"proto":"tcp","label":"CoAP","count":1},{"port":2052,"proto":"tcp","label":"","count":1},{"port":16033,"proto":"tcp","label":"","count":1},{"port":6466,"proto":"tcp","label":"","count":1},{"port":12394,"proto":"tcp","label":"","count":1},{"port":7777,"proto":"tcp","label":"Oracle","count":1},{"port":30899,"proto":"tcp","label":"","count":1},{"port":27015,"proto":"tcp","label":"","count":1},{"port":65234,"proto":"tcp","label":"","count":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i1515h2_8daaf6152771_d8a2da3f94cd","t13i3514h1_8f004308c246_5c2c66f702b0"],"tls_ja3":["90189170f2171f397898ade1c4de4367"],"ja4h":["ge11nn0200_f24fcf356134","ge11nn0400_17292dadbc7b","ge11nn0500_d3a2dcb1cd63","po11nn0500_ae6043e4dae8"]},"fingerprint_peers":{"t13i3514h1_8f004308c246_5c2c66f702b0":28,"t13i1515h2_8daaf6152771_d8a2da3f94cd":146,"ge11nn0200_f24fcf356134":39,"ge11nn0500_d3a2dcb1cd63":1281,"po11nn0500_ae6043e4dae8":7,"ge11nn0400_17292dadbc7b":2848},"user_agents":["Mozilla/5.0 (compatible; Infrawatch/1.0; +https://infrawat.ch/)"],"timeline":[{"date":"2026-08-13","count":3},{"date":"2026-08-14","count":10}],"recent_events":[{"timestamp":"2026-08-14T13:16:12","port":5900,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:5900\",\"user-agent\":\"Mozilla/5.0 (compatible; Infrawatch/1.0; +https://infrawat.ch/)\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a353930300d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b20496e66726177617463682f312e303b202b68747470733a2f2f696e6672617761742e63682f290d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; Infrawatch/1.0; +https://infrawat.ch/)","ja3":"","session":"db52c1d2-27f7-4980-8eed-db156564f477","seq":1,"duration_ms":100,"bytes_in":175,"bytes_out":78},{"timestamp":"2026-08-14T10:28:51","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (compatible; Infrawatch/1.0; +https://infrawat.ch/)\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"/favicon.ico","summary":"","payload_hex":"474554202f66617669636f6e2e69636f20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b20496e66726177617463682f312e303b202b68747470733a2f2f696e6672617761742e63682f290d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; Infrawatch/1.0; +https://infrawat.ch/)","ja3":"90189170f2171f397898ade1c4de4367","session":"1494aaa2-95c3-4c3d-acbb-7392ec506f2f","seq":1,"duration_ms":100,"bytes_in":181,"bytes_out":78},{"timestamp":"2026-08-14T07:34:43","port":47808,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:47808\",\"user-agent\":\"Mozilla/5.0 (compatible; Infrawatch/1.0; +https://infrawat.ch/)\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a34373830380d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b20496e66726177617463682f312e303b202b68747470733a2f2f696e6672617761742e63682f290d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; Infrawatch/1.0; +https://infrawat.ch/)","ja3":"","session":"3942bf0b-b1a9-4415-95bc-cff32ec71611","seq":1,"duration_ms":100,"bytes_in":176,"bytes_out":78},{"timestamp":"2026-08-14T05:29:48","port":10110,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"text/event-stream\",\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:10110\",\"user-agent\":\"Mozilla/5.0 (compatible; Infrawatch/1.0; +https://infrawat.ch/)\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/sse","summary":"","payload_hex":"474554202f73736520485454502f312e310d0a486f73743a20<HONEYPOT>3a31303131300d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b20496e66726177617463682f312e303b202b68747470733a2f2f696e6672617761742e63682f290d0a4163636570743a20746578742f6576656e742d73747265616d0d0a436f6e6e656374696f6e3a20636c6f73650d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; Infrawatch/1.0; +https://infrawat.ch/)","ja3":"","session":"91787dcc-b5d4-46a3-8401-54ff6d9af49c","seq":1,"duration_ms":100,"bytes_in":193,"bytes_out":78},{"timestamp":"2026-08-14T05:19:06","port":21117,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\"t\u0000]�\u001e�L^�3\u001d���,�wz�S�R�","payload_hex":"2274005d9d1ec84c5ef7331de9caf32c84777a9253ba52cd","method":"","user_agent":"","ja3":"","session":"2db3bf8e-04ac-44f6-87ac-6d14f2d0ce77","seq":2,"duration_ms":10101,"bytes_in":72,"bytes_out":26},{"timestamp":"2026-08-14T05:18:56","port":21117,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"��\u0001,\n\u00100dfc42ecb7d31f9d\u0012\u001837af2bc80714ac9f7bb22b2b","payload_hex":"bc92012c0a10306466633432656362376433316639641218333761663262633830373134616339663762623232623262","method":"","user_agent":"","ja3":"","session":"2db3bf8e-04ac-44f6-87ac-6d14f2d0ce77","seq":1,"duration_ms":100,"bytes_in":48,"bytes_out":13,"enriched":{"digest":"cf810989ee5a26db","strings":["0dfc42ecb7d31f9d","37af2bc80714ac9f7bb22b2b"]}},{"timestamp":"2026-08-14T04:42:20","port":8088,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"text/event-stream\",\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8088\",\"user-agent\":\"Mozilla/5.0 (compatible; Infrawatch/1.0; +https://infrawat.ch/)\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/sse","summary":"","payload_hex":"474554202f73736520485454502f312e310d0a486f73743a20<HONEYPOT>3a383038380d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b20496e66726177617463682f312e303b202b68747470733a2f2f696e6672617761742e63682f290d0a4163636570743a20746578742f6576656e742d73747265616d0d0a436f6e6e656374696f6e3a20636c6f73650d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; Infrawatch/1.0; +https://infrawat.ch/)","ja3":"","session":"61303a6f-f3ec-4ff3-a2cc-b58ed2dbfbb1","seq":1,"duration_ms":100,"bytes_in":192,"bytes_out":78},{"timestamp":"2026-08-14T04:42:20","port":8088,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"text/event-stream\",\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8088\",\"user-agent\":\"Mozilla/5.0 (compatible; Infrawatch/1.0; +https://infrawat.ch/)\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/sse","summary":"","payload_hex":"474554202f73736520485454502f312e310d0a486f73743a20<HONEYPOT>3a383038380d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b20496e66726177617463682f312e303b202b68747470733a2f2f696e6672617761742e63682f290d0a4163636570743a20746578742f6576656e742d73747265616d0d0a436f6e6e656374696f6e3a20636c6f73650d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; Infrawatch/1.0; +https://infrawat.ch/)","ja3":"","session":"61303a6f-f3ec-4ff3-a2cc-b58ed2dbfbb1","seq":1,"duration_ms":100,"bytes_in":192,"bytes_out":78},{"timestamp":"2026-08-14T04:42:20","port":8088,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"text/event-stream\",\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8088\",\"user-agent\":\"Mozilla/5.0 (compatible; Infrawatch/1.0; +https://infrawat.ch/)\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/sse","summary":"","payload_hex":"474554202f73736520485454502f312e310d0a486f73743a20<HONEYPOT>3a383038380d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b20496e66726177617463682f312e303b202b68747470733a2f2f696e6672617761742e63682f290d0a4163636570743a20746578742f6576656e742d73747265616d0d0a436f6e6e656374696f6e3a20636c6f73650d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; Infrawatch/1.0; +https://infrawat.ch/)","ja3":"","session":"61303a6f-f3ec-4ff3-a2cc-b58ed2dbfbb1","seq":1,"duration_ms":100,"bytes_in":192,"bytes_out":78},{"timestamp":"2026-08-14T04:06:40","port":5683,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:5683\",\"user-agent\":\"Mozilla/5.0 (compatible; Infrawatch/1.0; +https://infrawat.ch/)\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a353638330d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b20496e66726177617463682f312e303b202b68747470733a2f2f696e6672617761742e63682f290d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; Infrawatch/1.0; +https://infrawat.ch/)","ja3":"","session":"efb75f87-c8c6-4c4a-9401-ee00091aae41","seq":1,"duration_ms":100,"bytes_in":175,"bytes_out":78}],"http_methods":[{"method":"GET","count":25},{"method":"POST","count":1}],"distinct_ports_total":29,"top_paths":[{"path":"/","count":13,"ports":13},{"path":"/sse","count":5,"ports":3},{"path":"/favicon.ico","count":5,"ports":5},{"path":"/mcp","count":1,"ports":1},{"path":"/wsman","count":1,"ports":1},{"path":"/api/mcp","count":1,"ports":1}],"distinct_paths_total":6,"top_snis":[],"top_hosts":[{"value":"a","count":1}],"top_alpns":[{"value":"http/1.1","count":4},{"value":"h2, http/1.1","count":1}],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","Accept-Encoding","Connection","Host","User-Agent"],"representative":[{"name":"Accept","value":"*/*","notable":false},{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Connection","value":"close","notable":false},{"name":"Host","value":"<HONEYPOT>:5900","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (compatible; Infrawatch/1.0; +https://infrawat.ch/)","notable":false}],"distinct_sets":1,"events_with_headers":8},"tags":[],"data_as_of":"2026-08-15T10:42:21.784525+00:00"}