{"ip":"195.182.16.52","total_events":275,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"67+ ports swept","confidence":"medium","network_type":"nsp","why":["No exploit payloads observed.","Swept 67 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"58,188 bytes sent","bytes_sent":58188,"session_seconds":0,"persistent":false}},"first_seen":"2026-08-09T19:53:25","last_seen":"2026-08-14T10:24:46","events_24h":12,"events_7d":275,"geo":{"country_code":"DE","country_name":"Germany","region":"Hesse","city":"Frankfurt am Main","lat":50.1169,"lon":8.6837,"asn":206264,"org":"Amarutu Technology Ltd"},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as206264","label":"Amarutu Technology Ltd.","category":"isp","url":"https://www.peeringdb.com/asn/206264"},"cve_matches":[],"malware":[],"top_ports":[{"port":4443,"proto":"tcp","label":"","count":8},{"port":443,"proto":"tcp","label":"HTTPS","count":8},{"port":80,"proto":"tcp","label":"HTTP","count":8},{"port":6443,"proto":"tcp","label":"k8s API","count":8},{"port":8443,"proto":"tcp","label":"HTTPS-alt","count":8},{"port":3443,"proto":"tcp","label":"","count":8},{"port":9443,"proto":"tcp","label":"","count":8},{"port":4200,"proto":"tcp","label":"","count":6},{"port":7443,"proto":"tcp","label":"","count":6},{"port":7547,"proto":"tcp","label":"TR-069","count":6},{"port":5000,"proto":"tcp","label":"Web-alt","count":5},{"port":3001,"proto":"tcp","label":"","count":4},{"port":4848,"proto":"tcp","label":"","count":4},{"port":5173,"proto":"tcp","label":"","count":4},{"port":5500,"proto":"tcp","label":"","count":4}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i131000_f57a46bbacb6_e5728521abd4"],"tls_ja3":["2196848d251b217de8b2c037e356c11d"],"ja4h":["ge11nn0400_17292dadbc7b"]},"fingerprint_peers":{"t13i131000_f57a46bbacb6_e5728521abd4":223,"ge11nn0400_17292dadbc7b":2847},"user_agents":["Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:146.0) Gecko/20100101 Firefox/146.0"],"timeline":[{"date":"2026-08-09","count":4},{"date":"2026-08-10","count":12},{"date":"2026-08-11","count":52},{"date":"2026-08-12","count":87},{"date":"2026-08-13","count":88},{"date":"2026-08-14","count":32}],"recent_events":[{"timestamp":"2026-08-14T10:24:46","port":7777,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:7777\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:146.0) Gecko/20100101 Firefox/146.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd","summary":"","payload_hex":"474554202f2e2e2532462e2e2532462e2e2532462e2e2532462e2e2532462e2e25324665746325324670617373776420485454502f312e310d0a486f73743a20<HONEYPOT>3a373737370d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b207836343b2072763a3134362e3029204765636b6f2f32303130303130312046697265666f782f3134362e300d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:146.0) Gecko/20100101 Firefox/146.0","ja3":"","session":"d99db984-632b-467b-b33c-fd89c77bcec3","seq":1,"duration_ms":101,"bytes_in":211,"bytes_out":78},{"timestamp":"2026-08-14T10:01:17","port":7547,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:7547\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:146.0) Gecko/20100101 Firefox/146.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd","summary":"","payload_hex":"474554202f2e2e2532462e2e2532462e2e2532462e2e2532462e2e2532462e2e25324665746325324670617373776420485454502f312e310d0a486f73743a20<HONEYPOT>3a373534370d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b207836343b2072763a3134362e3029204765636b6f2f32303130303130312046697265666f782f3134362e300d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:146.0) Gecko/20100101 Firefox/146.0","ja3":"","session":"8634613d-590b-411c-8e46-42e4ca012a6f","seq":1,"duration_ms":101,"bytes_in":211,"bytes_out":78},{"timestamp":"2026-08-14T09:53:13","port":7547,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:7547\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:146.0) Gecko/20100101 Firefox/146.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd","summary":"","payload_hex":"474554202f2e2e2532462e2e2532462e2e2532462e2e2532462e2e2532462e2e25324665746325324670617373776420485454502f312e310d0a486f73743a20<HONEYPOT>3a373534370d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b207836343b2072763a3134362e3029204765636b6f2f32303130303130312046697265666f782f3134362e300d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:146.0) Gecko/20100101 Firefox/146.0","ja3":"","session":"3035c287-ef18-44f3-b702-9acced21712c","seq":1,"duration_ms":100,"bytes_in":212,"bytes_out":78},{"timestamp":"2026-08-14T09:35:01","port":7547,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:7547\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:146.0) Gecko/20100101 Firefox/146.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd","summary":"","payload_hex":"474554202f2e2e2532462e2e2532462e2e2532462e2e2532462e2e2532462e2e25324665746325324670617373776420485454502f312e310d0a486f73743a20<HONEYPOT>3a373534370d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b207836343b2072763a3134362e3029204765636b6f2f32303130303130312046697265666f782f3134362e300d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:146.0) Gecko/20100101 Firefox/146.0","ja3":"","session":"1d0debe8-2fe2-43e6-a5de-9d04958ea439","seq":1,"duration_ms":100,"bytes_in":211,"bytes_out":78},{"timestamp":"2026-08-14T08:19:14","port":7547,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:7547\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:146.0) Gecko/20100101 Firefox/146.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd","summary":"","payload_hex":"474554202f2e2e2532462e2e2532462e2e2532462e2e2532462e2e2532462e2e25324665746325324670617373776420485454502f312e310d0a486f73743a20<HONEYPOT>3a373534370d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b207836343b2072763a3134362e3029204765636b6f2f32303130303130312046697265666f782f3134362e300d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:146.0) Gecko/20100101 Firefox/146.0","ja3":"","session":"906fed0b-4bc2-484a-baee-6e154d033773","seq":1,"duration_ms":100,"bytes_in":213,"bytes_out":78},{"timestamp":"2026-08-14T08:19:14","port":7547,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:7547\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:146.0) Gecko/20100101 Firefox/146.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd","summary":"","payload_hex":"474554202f2e2e2532462e2e2532462e2e2532462e2e2532462e2e2532462e2e25324665746325324670617373776420485454502f312e310d0a486f73743a20<HONEYPOT>3a373534370d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b207836343b2072763a3134362e3029204765636b6f2f32303130303130312046697265666f782f3134362e300d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:146.0) Gecko/20100101 Firefox/146.0","ja3":"","session":"906fed0b-4bc2-484a-baee-6e154d033773","seq":1,"duration_ms":100,"bytes_in":213,"bytes_out":78},{"timestamp":"2026-08-14T08:19:14","port":7547,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:7547\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:146.0) Gecko/20100101 Firefox/146.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd","summary":"","payload_hex":"474554202f2e2e2532462e2e2532462e2e2532462e2e2532462e2e2532462e2e25324665746325324670617373776420485454502f312e310d0a486f73743a20<HONEYPOT>3a373534370d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b207836343b2072763a3134362e3029204765636b6f2f32303130303130312046697265666f782f3134362e300d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:146.0) Gecko/20100101 Firefox/146.0","ja3":"","session":"906fed0b-4bc2-484a-baee-6e154d033773","seq":1,"duration_ms":100,"bytes_in":213,"bytes_out":78},{"timestamp":"2026-08-14T06:51:57","port":6060,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:6060\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:146.0) Gecko/20100101 Firefox/146.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd","summary":"","payload_hex":"474554202f2e2e2532462e2e2532462e2e2532462e2e2532462e2e2532462e2e25324665746325324670617373776420485454502f312e310d0a486f73743a20<HONEYPOT>3a363036300d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b207836343b2072763a3134362e3029204765636b6f2f32303130303130312046697265666f782f3134362e300d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:146.0) Gecko/20100101 Firefox/146.0","ja3":"","session":"59ff206e-2cad-4acc-aeec-f75e406605ef","seq":1,"duration_ms":101,"bytes_in":211,"bytes_out":78},{"timestamp":"2026-08-14T06:50:05","port":6060,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:6060\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:146.0) Gecko/20100101 Firefox/146.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd","summary":"","payload_hex":"474554202f2e2e2532462e2e2532462e2e2532462e2e2532462e2e2532462e2e25324665746325324670617373776420485454502f312e310d0a486f73743a20<HONEYPOT>3a363036300d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b207836343b2072763a3134362e3029204765636b6f2f32303130303130312046697265666f782f3134362e300d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:146.0) Gecko/20100101 Firefox/146.0","ja3":"","session":"7b843746-d950-4127-bbc0-faa596496eac","seq":1,"duration_ms":100,"bytes_in":213,"bytes_out":78},{"timestamp":"2026-08-14T06:37:27","port":6060,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:6060\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:146.0) Gecko/20100101 Firefox/146.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd","summary":"","payload_hex":"474554202f2e2e2532462e2e2532462e2e2532462e2e2532462e2e2532462e2e25324665746325324670617373776420485454502f312e310d0a486f73743a20<HONEYPOT>3a363036300d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b207836343b2072763a3134362e3029204765636b6f2f32303130303130312046697265666f782f3134362e300d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:146.0) Gecko/20100101 Firefox/146.0","ja3":"","session":"1205d99c-6929-4148-90a7-ac1c8f11105e","seq":1,"duration_ms":100,"bytes_in":211,"bytes_out":78}],"http_methods":[{"method":"GET","count":275}],"distinct_ports_total":67,"top_paths":[{"path":"/..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd","count":275,"ports":67}],"distinct_paths_total":1,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","Connection","Host","User-Agent"],"representative":[{"name":"Accept","value":"*/*","notable":false},{"name":"Connection","value":"close","notable":false},{"name":"Host","value":"<HONEYPOT>:7777","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:146.0) Gecko/20100101 Firefox/146.0","notable":false}],"distinct_sets":1,"events_with_headers":10},"tags":[],"data_as_of":"2026-08-15T05:42:26.431744+00:00"}