{"ip":"194.88.98.82","total_events":856,"verdict":{"verdict":"scanner","label":"Recognized scanner","detail":"infrawatch","confidence":"high","network_type":"CDN","why":["Source IP is in a known scanner range (infrawatch).","Known research and commercial scanners are labelled as such, not as threats."],"engagement":{"level":"request","label":"Request traffic","detail":"186 bytes sent","bytes_sent":186,"session_seconds":0,"persistent":false}},"first_seen":"2026-04-03T16:37:00","last_seen":"2026-09-12T04:59:39","events_24h":0,"events_7d":0,"geo":{"country_code":"DE","country_name":"Germany","region":"Hesse","city":"Frankfurt am Main","lat":50.1169,"lon":8.6837,"asn":25369,"org":"Hydra Communications Ltd"},"source_domain":"194-88-98-82.infrawat.ch","known_scanners":["infrawatch","Infrawatch"],"scanner_tag":{"key":"infrawatch","label":"Infrawatch","category":"commercial","url":"https://infrawat.ch/"},"cve_matches":[],"malware":[],"top_ports":[{"port":21117,"proto":"tcp","label":"","count":13},{"port":465,"proto":"tcp","label":"SMTPS","count":11},{"port":80,"proto":"tcp","label":"HTTP","count":11},{"port":43615,"proto":"tcp","label":"","count":11},{"port":4840,"proto":"tcp","label":"","count":10},{"port":21116,"proto":"tcp","label":"","count":9},{"port":21118,"proto":"tcp","label":"","count":9},{"port":1505,"proto":"tcp","label":"","count":7},{"port":23,"proto":"tcp","label":"Telnet","count":7},{"port":21115,"proto":"tcp","label":"","count":7},{"port":993,"proto":"tcp","label":"IMAPS","count":6},{"port":40000,"proto":"tcp","label":"","count":6},{"port":61848,"proto":"tcp","label":"","count":6},{"port":1701,"proto":"tcp","label":"","count":6},{"port":10002,"proto":"tcp","label":"","count":5}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i3310h2_d302f37d276b_e7c285222651","t13i351400_8f004308c246_d8a2da3f94cd","t13i3515h1_8f004308c246_d8a2da3f94cd"],"tls_client_hello":"","tls_ja3":[],"http_akin":["b11cun020_00040001_78f1f19c","b11cun062_50040001_ffe60107_x9f62fdb1","b11cun040_00040016_aa48e2c8","b11cun030_00040005_4c75231d"]},"fingerprint_peers":{"t13i3310h2_d302f37d276b_e7c285222651":0,"t13i351400_8f004308c246_d8a2da3f94cd":38,"t13i3515h1_8f004308c246_d8a2da3f94cd":0,"b11cun020_00040001_78f1f19c":44,"b11cun062_50040001_ffe60107_x9f62fdb1":1,"b11cun040_00040016_aa48e2c8":6195,"b11cun030_00040005_4c75231d":5},"akin_families":{},"user_agents":["Mozilla/5.0 (compatible; Infrawatch/1.0; +https://infrawat.ch/)","Go-http-client/1.1"],"timeline":[{"date":"2026-09-12","count":1}],"recent_events":[{"timestamp":"2026-09-12T04:59:39","port":21118,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"Upgrade\",\"host\":\"<HONEYPOT>:21118\",\"origin\":\"http://localhost/\",\"sec-websocket-key\":\"UzdcNpYmnkHD4ecIqxpzWQ==\",\"sec-websocket-version\":\"13\",\"upgrade\":\"websocket\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a32313131380d0a557067726164653a20776562736f636b65740d0a436f6e6e656374696f6e3a20557067726164650d0a5365632d576562536f636b65742d4b65793a20557a64634e70596d6e6b4844346563497178707a57513d3d0d0a4f726967696e3a20687474703a2f2f6c6f63616c686f73742f0d0a5365632d576562536f636b65742d56657273696f6e3a2031330d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"4c0f39ef-3621-4aa0-a34b-415a5be489ba","seq":1,"duration_ms":100,"bytes_in":186,"bytes_out":77},{"timestamp":"2026-05-12T21:46:44","port":21116,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"Upgrade\",\"host\":\"<HONEYPOT>:21116\",\"origin\":\"http://localhost/\",\"sec-websocket-key\":\"NZI1hr9BpPNo72IVKdfPRw==\",\"sec-websocket-version\":\"13\",\"upgrade\":\"websocket\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a32313131360d0a557067726164653a20776562736f636b65740d0a436f6e6e656374696f6e3a20557067726164650d0a5365632d576562536f636b65742d4b65793a204e5a49316872394270504e6f373249564b64665052773d3d0d0a4f726967696e3a20687474703a2f2f6c6f63616c686f73742f0d0a5365632d576562536f636b65742d56657273696f6e3a2031330d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"de5bea1f-34d0-4039-8a44-8b6fff8c0580","seq":0,"duration_ms":0,"bytes_in":0,"bytes_out":0},{"timestamp":"2026-05-12T20:09:17","port":21118,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"Upgrade\",\"host\":\"<HONEYPOT>:21118\",\"origin\":\"http://localhost/\",\"sec-websocket-key\":\"peB8tKH4t0GGjIWixuA+Og==\",\"sec-websocket-version\":\"13\",\"upgrade\":\"websocket\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a32313131380d0a557067726164653a20776562736f636b65740d0a436f6e6e656374696f6e3a20557067726164650d0a5365632d576562536f636b65742d4b65793a2070654238744b4834743047476a4957697875412b4f673d3d0d0a4f726967696e3a20687474703a2f2f6c6f63616c686f73742f0d0a5365632d576562536f636b65742d56657273696f6e3a2031330d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"987c5f53-934b-4dd6-b1a2-2f340be2b58c","seq":0,"duration_ms":0,"bytes_in":0,"bytes_out":0},{"timestamp":"2026-05-12T19:08:01","port":21116,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"Upgrade\",\"host\":\"<HONEYPOT>:21116\",\"origin\":\"http://localhost/\",\"sec-websocket-key\":\"X6MNDb4Jf2VOQbeQ48/bYw==\",\"sec-websocket-version\":\"13\",\"upgrade\":\"websocket\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a32313131360d0a557067726164653a20776562736f636b65740d0a436f6e6e656374696f6e3a20557067726164650d0a5365632d576562536f636b65742d4b65793a2058364d4e4462344a6632564f5162655134382f6259773d3d0d0a4f726967696e3a20687474703a2f2f6c6f63616c686f73742f0d0a5365632d576562536f636b65742d56657273696f6e3a2031330d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"a77340d4-3733-424b-ad9f-59e6dd36894b","seq":0,"duration_ms":0,"bytes_in":0,"bytes_out":0},{"timestamp":"2026-05-12T14:01:50","port":21117,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"Upgrade\",\"host\":\"<HONEYPOT>:21117\",\"origin\":\"http://localhost/\",\"sec-websocket-key\":\"I4/zyWAiyYXDthWJPqQBrQ==\",\"sec-websocket-version\":\"13\",\"upgrade\":\"websocket\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a32313131370d0a557067726164653a20776562736f636b65740d0a436f6e6e656374696f6e3a20557067726164650d0a5365632d576562536f636b65742d4b65793a2049342f7a79574169795958447468574a5071514272513d3d0d0a4f726967696e3a20687474703a2f2f6c6f63616c686f73742f0d0a5365632d576562536f636b65742d56657273696f6e3a2031330d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"829fdcf9-0169-4447-ba42-c44b43193416","seq":0,"duration_ms":0,"bytes_in":0,"bytes_out":0},{"timestamp":"2026-05-12T11:34:35","port":21119,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"Upgrade\",\"host\":\"<HONEYPOT>:21119\",\"origin\":\"http://localhost/\",\"sec-websocket-key\":\"P5mZ5AaDAJUWgLygdbFM0Q==\",\"sec-websocket-version\":\"13\",\"upgrade\":\"websocket\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a32313131390d0a557067726164653a20776562736f636b65740d0a436f6e6e656374696f6e3a20557067726164650d0a5365632d576562536f636b65742d4b65793a2050356d5a35416144414a5557674c79676462464d30513d3d0d0a4f726967696e3a20687474703a2f2f6c6f63616c686f73742f0d0a5365632d576562536f636b65742d56657273696f6e3a2031330d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"7ebe9e38-10cd-4fd4-ab9a-f9ae53cf078f","seq":0,"duration_ms":0,"bytes_in":0,"bytes_out":0},{"timestamp":"2026-05-12T10:08:00","port":4840,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"HELF;\u0000\u0000\u0000\u0000\u0000\u0000\u0000��\u0000\u0000��\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u001b\u0000\u0000\u0000opc.tcp://<HONEYPOT>:4840","payload_hex":"48454c463b00000000000000ffff0000ffff000000000100000000001b0000006f70632e7463703a2f2f<HONEYPOT>3a34383430","method":"","user_agent":"","ja3":"","session":"2010e6c2-ea56-4737-a050-7e192de94864","seq":0,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"0a238f088ce036fb","strings":["HELF;","opc.tcp://<HONEYPOT>:4840"],"iocs":{"domains":["opc.tcp"]}}},{"timestamp":"2026-05-12T02:53:27","port":4840,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"HELF=\u0000\u0000\u0000\u0000\u0000\u0000\u0000��\u0000\u0000��\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u001d\u0000\u0000\u0000opc.tcp://<HONEYPOT>:4840","payload_hex":"48454c463d00000000000000ffff0000ffff000000000100000000001d0000006f70632e7463703a2f2f<HONEYPOT>3a34383430","method":"","user_agent":"","ja3":"","session":"e7f03903-4038-4172-9bca-686aad43155a","seq":0,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"729f705db632b0ea","strings":["HELF=","opc.tcp://<HONEYPOT>:4840"],"iocs":{"domains":["opc.tcp"]}}},{"timestamp":"2026-05-11T19:07:44","port":21116,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"Upgrade\",\"host\":\"<HONEYPOT>:21116\",\"origin\":\"http://localhost/\",\"sec-websocket-key\":\"VYhNOpJQMUdMOnHjpLf7gQ==\",\"sec-websocket-version\":\"13\",\"upgrade\":\"websocket\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a32313131360d0a557067726164653a20776562736f636b65740d0a436f6e6e656374696f6e3a20557067726164650d0a5365632d576562536f636b65742d4b65793a205659684e4f704a514d55644d4f6e486a704c663767513d3d0d0a4f726967696e3a20687474703a2f2f6c6f63616c686f73742f0d0a5365632d576562536f636b65742d56657273696f6e3a2031330d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"a350acc5-ddc1-4003-9d8b-b1ef6c689818","seq":0,"duration_ms":0,"bytes_in":0,"bytes_out":0},{"timestamp":"2026-05-11T14:50:24","port":21119,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"Upgrade\",\"host\":\"<HONEYPOT>:21119\",\"origin\":\"http://localhost/\",\"sec-websocket-key\":\"XKWsIkM+yl/xgLWOInN8Zg==\",\"sec-websocket-version\":\"13\",\"upgrade\":\"websocket\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a32313131390d0a557067726164653a20776562736f636b65740d0a436f6e6e656374696f6e3a20557067726164650d0a5365632d576562536f636b65742d4b65793a20584b5773496b4d2b796c2f78674c574f496e4e385a673d3d0d0a4f726967696e3a20687474703a2f2f6c6f63616c686f73742f0d0a5365632d576562536f636b65742d56657273696f6e3a2031330d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"e9fd6cad-b0e0-410c-9d1c-cfde3e3bc8cc","seq":0,"duration_ms":0,"bytes_in":0,"bytes_out":0}],"http_methods":[{"method":"GET","count":64},{"method":"POST","count":1}],"distinct_ports_total":481,"top_paths":[{"path":"/","count":51,"ports":19},{"path":"/favicon.ico","count":14,"ports":11}],"distinct_paths_total":2,"top_snis":[],"top_hosts":[{"value":"a","count":16}],"top_alpns":[{"value":"http/1.1","count":29},{"value":"h2, http/1.1","count":16}],"banners":[],"credentials":[],"header_profile":{"signature":["Connection","Host","Origin","Sec-Websocket-Key","Sec-Websocket-Version","Upgrade"],"representative":[{"name":"Connection","value":"Upgrade","notable":false},{"name":"Host","value":"<HONEYPOT>:21118","notable":false},{"name":"Origin","value":"http://localhost/","notable":true},{"name":"Sec-Websocket-Key","value":"UzdcNpYmnkHD4ecIqxpzWQ==","notable":false},{"name":"Sec-Websocket-Version","value":"13","notable":false},{"name":"Upgrade","value":"websocket","notable":false}],"distinct_sets":1,"events_with_headers":8},"tags":[],"data_as_of":"2026-10-01T19:40:48.803902+00:00"}