{"ip":"195.206.182.218","total_events":126,"verdict":{"verdict":"scanner","label":"Recognized scanner","detail":"infrawatch","confidence":"high","network_type":"CDN","why":["Source IP is in a known scanner range (infrawatch).","Known research and commercial scanners are labelled as such, not as threats."],"engagement":{"level":"payload","label":"Sustained payload","detail":"6,272 bytes sent","bytes_sent":6272,"session_seconds":0,"persistent":false}},"first_seen":"2026-04-25T02:48:06","last_seen":"2026-09-13T23:42:55","events_24h":9,"events_7d":18,"geo":{"country_code":"GB","country_name":"United Kingdom","region":"England","city":"City of London","lat":51.5164,"lon":-0.093,"asn":25369,"org":"Hydra Communications Ltd"},"source_domain":"195-206-182-218.infrawat.ch","known_scanners":["infrawatch","Infrawatch"],"scanner_tag":{"key":"infrawatch","label":"Infrawatch","category":"commercial","url":"https://infrawat.ch/"},"cve_matches":[],"malware":[],"top_ports":[{"port":20547,"proto":"tcp","label":"","count":3},{"port":25565,"proto":"tcp","label":"Minecraft","count":2},{"port":1764,"proto":"tcp","label":"","count":2},{"port":60813,"proto":"tcp","label":"","count":1},{"port":113,"proto":"tcp","label":"","count":1},{"port":21835,"proto":"tcp","label":"","count":1},{"port":56704,"proto":"tcp","label":"","count":1},{"port":48968,"proto":"tcp","label":"","count":1},{"port":972,"proto":"tcp","label":"","count":1},{"port":50000,"proto":"tcp","label":"SAP","count":1},{"port":43326,"proto":"tcp","label":"","count":1},{"port":7405,"proto":"tcp","label":"","count":1},{"port":28513,"proto":"tcp","label":"","count":1},{"port":52877,"proto":"tcp","label":"","count":1},{"port":47633,"proto":"tcp","label":"","count":1}],"fingerprints":{"ssh_hassh":["8e8294623d295b5c79addcd28d64328c","bc9e7273cde22b1209d6673b5fd10bd5"],"tls_ja4":["t13i3514h1_8f004308c246_5c2c66f702b0"],"tls_ja3":[],"ja4h":["ge11nn0500_d3a2dcb1cd63","ge11nn0400_17292dadbc7b"]},"fingerprint_peers":{"t13i3514h1_8f004308c246_5c2c66f702b0":38,"ge11nn0500_d3a2dcb1cd63":1243,"ge11nn0400_17292dadbc7b":1633,"8e8294623d295b5c79addcd28d64328c":0,"bc9e7273cde22b1209d6673b5fd10bd5":77},"user_agents":["Mozilla/5.0 (compatible; Infrawatch/1.0; +https://infrawat.ch/)"],"timeline":[{"date":"2026-07-14","count":1},{"date":"2026-08-13","count":2},{"date":"2026-08-14","count":3},{"date":"2026-08-16","count":1},{"date":"2026-08-17","count":9},{"date":"2026-09-11","count":2},{"date":"2026-09-12","count":7},{"date":"2026-09-13","count":9}],"recent_events":[{"timestamp":"2026-09-13T23:42:55","port":8085,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8085\",\"user-agent\":\"Mozilla/5.0 (compatible; Infrawatch/1.0; +https://infrawat.ch/)\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a383038350d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b20496e66726177617463682f312e303b202b68747470733a2f2f696e6672617761742e63682f290d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; Infrawatch/1.0; +https://infrawat.ch/)","ja3":"","session":"ce2e70c7-8ddb-4e04-94f2-3169082bf2d2","seq":1,"duration_ms":100,"bytes_in":177,"bytes_out":80},{"timestamp":"2026-09-13T22:43:15","port":59216,"proto":"tcp","app_proto":"","app_protocol":"http","host":"192.0.2.1","headers":"{\"accept\":\"*/*\",\"connection\":\"close\",\"host\":\"192.0.2.1\",\"user-agent\":\"Mozilla/5.0 (compatible; Infrawatch/1.0; +https://infrawat.ch/)\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a203139322e302e322e310d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b20496e66726177617463682f312e303b202b68747470733a2f2f696e6672617761742e63682f290d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; Infrawatch/1.0; +https://infrawat.ch/)","ja3":"","session":"6c31448a-8d66-4bdd-a725-0d93af59abc2","seq":1,"duration_ms":100,"bytes_in":144,"bytes_out":80},{"timestamp":"2026-09-13T22:33:01","port":1764,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"application/json\",\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:1764\",\"user-agent\":\"Mozilla/5.0 (compatible; Infrawatch/1.0; +https://infrawat.ch/)\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a313736340d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b20496e66726177617463682f312e303b202b68747470733a2f2f696e6672617761742e63682f290d0a4163636570743a206170706c69636174696f6e2f6a736f6e0d0a436f6e6e656374696f6e3a20636c6f73650d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; Infrawatch/1.0; +https://infrawat.ch/)","ja3":"","session":"01094645-3e1e-472b-9e1a-35e26c77f8cc","seq":1,"duration_ms":100,"bytes_in":190,"bytes_out":80},{"timestamp":"2026-09-13T22:27:24","port":60521,"proto":"tcp","app_proto":"","app_protocol":"http","host":"192.0.2.1","headers":"{\"accept\":\"*/*\",\"connection\":\"close\",\"host\":\"192.0.2.1\",\"user-agent\":\"Mozilla/5.0 (compatible; Infrawatch/1.0; +https://infrawat.ch/)\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a203139322e302e322e310d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b20496e66726177617463682f312e303b202b68747470733a2f2f696e6672617761742e63682f290d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; Infrawatch/1.0; +https://infrawat.ch/)","ja3":"","session":"f772f16d-a853-445e-8e3a-a307af9b22d4","seq":1,"duration_ms":100,"bytes_in":144,"bytes_out":80},{"timestamp":"2026-09-13T16:36:49","port":3284,"proto":"tcp","app_proto":"","app_protocol":"http","host":"192.0.2.1","headers":"{\"accept\":\"*/*\",\"connection\":\"close\",\"host\":\"192.0.2.1\",\"user-agent\":\"Mozilla/5.0 (compatible; Infrawatch/1.0; +https://infrawat.ch/)\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a203139322e302e322e310d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b20496e66726177617463682f312e303b202b68747470733a2f2f696e6672617761742e63682f290d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; Infrawatch/1.0; +https://infrawat.ch/)","ja3":"","session":"001df2b5-e7ef-4432-90d0-bad8f3ac20c5","seq":1,"duration_ms":100,"bytes_in":144,"bytes_out":80},{"timestamp":"2026-09-13T15:58:17","port":37792,"proto":"tcp","app_proto":"","app_protocol":"http","host":"192.0.2.1","headers":"{\"accept\":\"*/*\",\"connection\":\"close\",\"host\":\"192.0.2.1\",\"user-agent\":\"Mozilla/5.0 (compatible; Infrawatch/1.0; +https://infrawat.ch/)\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a203139322e302e322e310d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b20496e66726177617463682f312e303b202b68747470733a2f2f696e6672617761742e63682f290d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; Infrawatch/1.0; +https://infrawat.ch/)","ja3":"","session":"fec2ba0b-2434-4329-8621-d713f4782cb6","seq":1,"duration_ms":100,"bytes_in":144,"bytes_out":80},{"timestamp":"2026-09-13T08:37:14","port":8080,"proto":"tcp","app_proto":"","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"SSH-2.0-OpenSSH_9.6p1 Ubuntu-3ubuntu13.8\r\n\u0000\u0000\u0004\\\b\u0014>�S�#Q�n�I�0\u0005���\u0000\u0000\u0000�curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,diffie-hellman-group-exchange-sha1,diffie-hellman-group-exchange-sha256\u0000\u0000\u0001�rsa-sha2-256-cert-v01@openssh.com,rsa-sha2-512-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss,ssh-ed25519\u0000\u0000\u0000iaes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,arcfour256,arcfour128,arcfour,aes128-cbc,3des-cbc\u0000\u0000\u0000iaes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,arcfour256,arcfour128,arcfour,aes128-cbc,3des-cbc\u0000\u0000\u0000nhmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96\u0000\u0000\u0000nhmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1,hmac-sha1-96\u0000\u0000\u0000\u0004none\u0000\u0000\u0000\u0004none\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000��\u0018�Ҵ��","payload_hex":"5353482d322e302d4f70656e5353485f392e367031205562756e74752d337562756e747531332e380d0a0000045c08143efc53ff2351e56eef49ec3005a4f6d2000000d4637572766532353531392d736861323536406c69627373682e6f72672c656364682d736861322d6e697374703235362c656364682d736861322d6e697374703338342c656364682d736861322d6e697374703532312c6469666669652d68656c6c6d616e2d67726f757031342d736861312c6469666669652d68656c6c6d616e2d67726f7570312d736861312c6469666669652d68656c6c6d616e2d67726f75702d65786368616e67652d736861312c6469666669652d68656c6c6d616e2d67726f75702d65786368616e67652d7368613235360000018b7273612d736861322d3235362d636572742d763031406f70656e7373682e636f6d2c7273612d736861322d3531322d636572742d763031406f70656e7373682e636f6d2c7373682d7273612d636572742d763031406f70656e7373682e636f6d2c7373682d6473732d636572742d763031406f70656e7373682e636f6d2c65636473612d736861322d6e697374703235362d636572742d763031406f70656e7373682e636f6d2c65636473612d736861322d6e697374703338342d636572742d763031406f70656e7373682e636f6d2c65636473612d736861322d6e697374703532312d636572742d763031406f70656e7373682e636f6d2c7373682d656432353531392d636572742d763031406f70656e7373682e636f6d2c65636473612d736861322d6e697374703235362c65636473612d736861322d6e697374703338342c65636473612d736861322d6e697374703532312c7273612d736861322d3235362c7273612d736861322d3531322c7373682d7273612c7373682d6473732c7373682d65643235353139000000696165733132382d6374722c6165733139322d6374722c6165733235362d6374722c6165733132382d67636d406f70656e7373682e636f6d2c617263666f75723235362c617263666f75723132382c617263666f75722c6165733132382d6362632c336465732d636263000000696165733132382d6374722c6165733139322d6374722c6165733235362d6374722c6165733132382d67636d406f70656e7373682e636f6d2c617263666f75723235362c617263666f75723132382c617263666f75722c6165733132382d6362632c336465732d6362630000006e686d61632d736861322d3235362d65746d406f70656e7373682e636f6d2c686d61632d736861322d3531322d65746d406f70656e7373682e636f6d2c686d61632d736861322d3235362c686d61632d736861322d3531322c686d61632d736861312c686d61632d736861312d39360000006e686d61632d736861322d3235362d65746d406f70656e7373682e636f6d2c686d61632d736861322d3531322d65746d406f70656e7373682e636f6d2c686d61632d736861322d3235362c686d61632d736861322d3531322c686d61632d736861312c686d61632d736861312d3936000000046e6f6e65000000046e6f6e6500000000000000000000000000f28718f4d2b4c0ee","method":"","user_agent":"","ja3":"","session":"0df6dbe3-0ace-4f26-a257-edbf869c1d05","seq":1,"duration_ms":116,"bytes_in":1162,"bytes_out":15,"enriched":{"digest":"51f0492b4f0beb2d","label":"SSH","strings":["SSH-2.0-OpenSSH_9.6p1 Ubuntu-3ubuntu13.8","curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nis…","rsa-sha2-256-cert-v01@openssh.com,rsa-sha2-512-cert-v01@openssh.com,ssh-rsa-cert…","iaes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,arcfour256,arcfour128,a…","nhmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-…","none"],"iocs":{"domains":["libssh.org","openssh.com"]}}},{"timestamp":"2026-09-13T07:46:49","port":520,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"text/event-stream\",\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:520\",\"user-agent\":\"Mozilla/5.0 (compatible; Infrawatch/1.0; +https://infrawat.ch/)\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/sse","summary":"","payload_hex":"474554202f73736520485454502f312e310d0a486f73743a20<HONEYPOT>3a3532300d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b20496e66726177617463682f312e303b202b68747470733a2f2f696e6672617761742e63682f290d0a4163636570743a20746578742f6576656e742d73747265616d0d0a436f6e6e656374696f6e3a20636c6f73650d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; Infrawatch/1.0; +https://infrawat.ch/)","ja3":"","session":"8107ec81-7700-40d1-be72-9a4e89960580","seq":1,"duration_ms":100,"bytes_in":193,"bytes_out":80},{"timestamp":"2026-09-13T05:14:52","port":17977,"proto":"tcp","app_proto":"","app_protocol":"http","host":"192.0.2.1","headers":"{\"accept\":\"*/*\",\"connection\":\"close\",\"host\":\"192.0.2.1\",\"user-agent\":\"Mozilla/5.0 (compatible; Infrawatch/1.0; +https://infrawat.ch/)\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a203139322e302e322e310d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b20496e66726177617463682f312e303b202b68747470733a2f2f696e6672617761742e63682f290d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; Infrawatch/1.0; +https://infrawat.ch/)","ja3":"","session":"fb699460-749a-45d8-bb9c-0099ce2d8774","seq":1,"duration_ms":101,"bytes_in":144,"bytes_out":80},{"timestamp":"2026-09-12T22:16:31","port":38562,"proto":"tcp","app_proto":"","app_protocol":"http","host":"192.0.2.1","headers":"{\"accept\":\"*/*\",\"connection\":\"close\",\"host\":\"192.0.2.1\",\"user-agent\":\"Mozilla/5.0 (compatible; Infrawatch/1.0; +https://infrawat.ch/)\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a203139322e302e322e310d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b20496e66726177617463682f312e303b202b68747470733a2f2f696e6672617761742e63682f290d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; Infrawatch/1.0; +https://infrawat.ch/)","ja3":"","session":"66959b69-d717-4482-b050-1fcd15e56cb6","seq":1,"duration_ms":100,"bytes_in":144,"bytes_out":80}],"http_methods":[{"method":"GET","count":83}],"distinct_ports_total":122,"top_paths":[{"path":"/","count":67,"ports":65},{"path":"/favicon.ico","count":8,"ports":8},{"path":"/mcp","count":3,"ports":3},{"path":"/mcp/","count":3,"ports":3},{"path":"/sse","count":1,"ports":1},{"path":"/api/mcp","count":1,"ports":1}],"distinct_paths_total":6,"top_snis":[],"top_hosts":[{"value":"192.0.2.1","count":19}],"top_alpns":[{"value":"http/1.1","count":13}],"banners":[{"value":"SSH-2.0-OpenSSH_9.6p1 Ubuntu-3ubuntu13.8","count":7}],"credentials":[],"header_profile":{"signature":["Accept","Accept-Encoding","Connection","Host","User-Agent"],"representative":[{"name":"Accept","value":"*/*","notable":false},{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Connection","value":"close","notable":false},{"name":"Host","value":"<HONEYPOT>:8085","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (compatible; Infrawatch/1.0; +https://infrawat.ch/)","notable":false}],"distinct_sets":2,"events_with_headers":9},"tags":[],"data_as_of":"2026-09-14T00:00:56.497205+00:00"}