{"ip":"195.96.138.153","total_events":54,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"26+ ports swept","confidence":"medium","network_type":null,"why":["No exploit payloads observed.","Swept 26 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"15,008 bytes sent","bytes_sent":15008,"session_seconds":0,"persistent":false}},"first_seen":"2026-09-19T20:07:59","last_seen":"2026-09-24T13:21:57","events_24h":28,"events_7d":54,"geo":{"country_code":"GB","country_name":"United Kingdom","region":"","city":"","lat":51.4964,"lon":-0.1224,"asn":210924,"org":"SSD Networks Limited"},"source_domain":null,"known_scanners":[],"scanner_tag":null,"cve_matches":[],"malware":[],"top_ports":[{"port":10447,"proto":"tcp","label":"","count":4},{"port":4436,"proto":"tcp","label":"","count":2},{"port":4435,"proto":"tcp","label":"","count":2},{"port":4444,"proto":"tcp","label":"","count":2},{"port":50443,"proto":"tcp","label":"","count":2},{"port":9200,"proto":"tcp","label":"Elastic","count":2},{"port":44444,"proto":"tcp","label":"","count":2},{"port":4455,"proto":"tcp","label":"","count":2},{"port":12443,"proto":"tcp","label":"","count":2},{"port":59443,"proto":"tcp","label":"","count":2},{"port":39443,"proto":"tcp","label":"","count":2},{"port":443,"proto":"tcp","label":"HTTPS","count":2},{"port":4437,"proto":"tcp","label":"","count":2},{"port":4430,"proto":"tcp","label":"","count":2},{"port":5555,"proto":"tcp","label":"","count":2}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i221000_231e334592e8_533b6d20482b","t13i220900_231e334592e8_29829a46703f"],"tls_client_hello":"1603010189010001850303fb155ca2b51386ffe710c509c59cb0191b1a01eaa2d1d1ebf9b3001cce38b7d020b33b2ad8a84a3403f6e5c9799387bd4af73c9c2e99c425714027b889581ba239002c13021301c02cc02bc030c02f009f009ec024c023c028c027c00ac009c014c013009d009c003d003c0035002f01000110002b0009080304030303020301000d001a001808040805080604010501020104030503020302020601060300230000000a00080006001d00170018003300260024001d0020ba18e5829fe7bbe6a41f6bc9d8eb335877199ff4618588696b0fa598b8e6f34c0031000000170000ff01000100002d0002010100290094006f0069dc01b5f6d2278d923b1dd54daf94f2b6b5f0e2b2c5ce9ee3325de000f7a8dec4493228870fdf56e97301fab1e84fa629e94b0cc280d42b151ced694ee11dbc72581bbce2f1dba44e6602086ae7f5200ca03e1b7a0023b88be36600a78ed56103043326d467cca266535c0aae27002120c4d144fad2599b9a5b112d90e0bd0d892ef41413bd4a8c63a56d13fb0a9650","tls_ja3":["622a7fd6adbafa3736c1a3468db8a8e0","85182f532cc3ec9202ca90e103c60767"],"http_akin":["a11cun060_0440006a_5fdb4e0e"]},"fingerprint_peers":{"t13i221000_231e334592e8_533b6d20482b":2,"t13i220900_231e334592e8_29829a46703f":10,"a11cun060_0440006a_5fdb4e0e":1},"akin_families":{},"user_agents":["Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:104.0) Gecko/20100101 Firefox/104.0"],"timeline":[{"date":"2026-09-19","count":4},{"date":"2026-09-20","count":8},{"date":"2026-09-21","count":6},{"date":"2026-09-22","count":2},{"date":"2026-09-23","count":18},{"date":"2026-09-24","count":16}],"recent_events":[{"timestamp":"2026-09-24T13:21:57","port":31443,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"Keep-Alive\",\"host\":\"<HONEYPOT>:31443\",\"origin\":\"http://<HONEYPOT>:31443\",\"referer\":\"http://<HONEYPOT>:31443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:104.0) Gecko/20100101 Firefox/104.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/Authorization","summary":"","payload_hex":"474554202f417574686f72697a6174696f6e20485454502f312e310d0a4f726967696e3a20687474703a2f2f<HONEYPOT>3a33313434330d0a557067726164652d496e7365637572652d52657175657374733a20310d0a526566657265723a20687474703a2f2f<HONEYPOT>3a33313434330d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b207836343b2072763a3130342e3029204765636b6f2f32303130303130312046697265666f782f3130342e300d0a486f73743a20<HONEYPOT>3a33313434330d0a436f6e6e656374696f6e3a204b6565702d416c6976650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:104.0) Gecko/20100101 Firefox/104.0","ja3":"","session":"20016a37-35c2-4a1e-ab22-bc0ebe9eeb82","seq":1,"duration_ms":100,"bytes_in":279,"bytes_out":79},{"timestamp":"2026-09-24T13:21:57","port":31443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"Keep-Alive\",\"host\":\"<HONEYPOT>:31443\",\"origin\":\"https://<HONEYPOT>:31443\",\"referer\":\"https://<HONEYPOT>:31443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:104.0) Gecko/20100101 Firefox/104.0\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/Authorization","summary":"","payload_hex":"474554202f417574686f72697a6174696f6e20485454502f312e310d0a4f726967696e3a2068747470733a2f2f<HONEYPOT>3a33313434330d0a557067726164652d496e7365637572652d52657175657374733a20310d0a526566657265723a2068747470733a2f2f<HONEYPOT>3a33313434330d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b207836343b2072763a3130342e3029204765636b6f2f32303130303130312046697265666f782f3130342e300d0a486f73743a20<HONEYPOT>3a33313434330d0a436f6e6e656374696f6e3a204b6565702d416c6976650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:104.0) Gecko/20100101 Firefox/104.0","ja3":"85182f532cc3ec9202ca90e103c60767","session":"3a19f67b-f844-4e47-b582-d88d093614a2","seq":1,"duration_ms":100,"bytes_in":281,"bytes_out":79},{"timestamp":"2026-09-24T13:17:15","port":35443,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"Keep-Alive\",\"host\":\"<HONEYPOT>:35443\",\"origin\":\"http://<HONEYPOT>:35443\",\"referer\":\"http://<HONEYPOT>:35443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:104.0) Gecko/20100101 Firefox/104.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/Authorization","summary":"","payload_hex":"474554202f417574686f72697a6174696f6e20485454502f312e310d0a4f726967696e3a20687474703a2f2f<HONEYPOT>3a33353434330d0a557067726164652d496e7365637572652d52657175657374733a20310d0a526566657265723a20687474703a2f2f<HONEYPOT>3a33353434330d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b207836343b2072763a3130342e3029204765636b6f2f32303130303130312046697265666f782f3130342e300d0a486f73743a20<HONEYPOT>3a33353434330d0a436f6e6e656374696f6e3a204b6565702d416c6976650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:104.0) Gecko/20100101 Firefox/104.0","ja3":"","session":"fa740caf-3c22-48c3-a945-cf1f41a132d7","seq":1,"duration_ms":100,"bytes_in":279,"bytes_out":79},{"timestamp":"2026-09-24T13:17:15","port":35443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"Keep-Alive\",\"host\":\"<HONEYPOT>:35443\",\"origin\":\"https://<HONEYPOT>:35443\",\"referer\":\"https://<HONEYPOT>:35443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:104.0) Gecko/20100101 Firefox/104.0\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/Authorization","summary":"","payload_hex":"474554202f417574686f72697a6174696f6e20485454502f312e310d0a4f726967696e3a2068747470733a2f2f<HONEYPOT>3a33353434330d0a557067726164652d496e7365637572652d52657175657374733a20310d0a526566657265723a2068747470733a2f2f<HONEYPOT>3a33353434330d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b207836343b2072763a3130342e3029204765636b6f2f32303130303130312046697265666f782f3130342e300d0a486f73743a20<HONEYPOT>3a33353434330d0a436f6e6e656374696f6e3a204b6565702d416c6976650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:104.0) Gecko/20100101 Firefox/104.0","ja3":"622a7fd6adbafa3736c1a3468db8a8e0","session":"08195b79-b393-4103-91de-d3064d218bab","seq":1,"duration_ms":100,"bytes_in":281,"bytes_out":79},{"timestamp":"2026-09-24T11:27:08","port":4434,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"Keep-Alive\",\"host\":\"<HONEYPOT>:4434\",\"origin\":\"http://<HONEYPOT>:4434\",\"referer\":\"http://<HONEYPOT>:4434\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:104.0) Gecko/20100101 Firefox/104.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/Authorization","summary":"","payload_hex":"474554202f417574686f72697a6174696f6e20485454502f312e310d0a4f726967696e3a20687474703a2f2f<HONEYPOT>3a343433340d0a557067726164652d496e7365637572652d52657175657374733a20310d0a526566657265723a20687474703a2f2f<HONEYPOT>3a343433340d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b207836343b2072763a3130342e3029204765636b6f2f32303130303130312046697265666f782f3130342e300d0a486f73743a20<HONEYPOT>3a343433340d0a436f6e6e656374696f6e3a204b6565702d416c6976650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:104.0) Gecko/20100101 Firefox/104.0","ja3":"","session":"e74dd9d3-f25a-406e-8e10-995bb2941bc9","seq":1,"duration_ms":100,"bytes_in":276,"bytes_out":79},{"timestamp":"2026-09-24T11:27:08","port":4434,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"Keep-Alive\",\"host\":\"<HONEYPOT>:4434\",\"origin\":\"https://<HONEYPOT>:4434\",\"referer\":\"https://<HONEYPOT>:4434\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:104.0) Gecko/20100101 Firefox/104.0\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/Authorization","summary":"","payload_hex":"474554202f417574686f72697a6174696f6e20485454502f312e310d0a4f726967696e3a2068747470733a2f2f<HONEYPOT>3a343433340d0a557067726164652d496e7365637572652d52657175657374733a20310d0a526566657265723a2068747470733a2f2f<HONEYPOT>3a343433340d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b207836343b2072763a3130342e3029204765636b6f2f32303130303130312046697265666f782f3130342e300d0a486f73743a20<HONEYPOT>3a343433340d0a436f6e6e656374696f6e3a204b6565702d416c6976650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:104.0) Gecko/20100101 Firefox/104.0","ja3":"85182f532cc3ec9202ca90e103c60767","session":"852dd7cf-0cf5-48bd-bddf-955b0f47b24a","seq":1,"duration_ms":100,"bytes_in":278,"bytes_out":79},{"timestamp":"2026-09-24T11:05:38","port":46443,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"Keep-Alive\",\"host\":\"<HONEYPOT>:46443\",\"origin\":\"http://<HONEYPOT>:46443\",\"referer\":\"http://<HONEYPOT>:46443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:104.0) Gecko/20100101 Firefox/104.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/Authorization","summary":"","payload_hex":"474554202f417574686f72697a6174696f6e20485454502f312e310d0a4f726967696e3a20687474703a2f2f<HONEYPOT>3a34363434330d0a557067726164652d496e7365637572652d52657175657374733a20310d0a526566657265723a20687474703a2f2f<HONEYPOT>3a34363434330d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b207836343b2072763a3130342e3029204765636b6f2f32303130303130312046697265666f782f3130342e300d0a486f73743a20<HONEYPOT>3a34363434330d0a436f6e6e656374696f6e3a204b6565702d416c6976650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:104.0) Gecko/20100101 Firefox/104.0","ja3":"","session":"ea115366-1b0a-4028-ab2e-a8a21696fd9d","seq":1,"duration_ms":100,"bytes_in":279,"bytes_out":79},{"timestamp":"2026-09-24T11:05:38","port":46443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"Keep-Alive\",\"host\":\"<HONEYPOT>:46443\",\"origin\":\"https://<HONEYPOT>:46443\",\"referer\":\"https://<HONEYPOT>:46443\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:104.0) Gecko/20100101 Firefox/104.0\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/Authorization","summary":"","payload_hex":"474554202f417574686f72697a6174696f6e20485454502f312e310d0a4f726967696e3a2068747470733a2f2f<HONEYPOT>3a34363434330d0a557067726164652d496e7365637572652d52657175657374733a20310d0a526566657265723a2068747470733a2f2f<HONEYPOT>3a34363434330d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b207836343b2072763a3130342e3029204765636b6f2f32303130303130312046697265666f782f3130342e300d0a486f73743a20<HONEYPOT>3a34363434330d0a436f6e6e656374696f6e3a204b6565702d416c6976650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:104.0) Gecko/20100101 Firefox/104.0","ja3":"622a7fd6adbafa3736c1a3468db8a8e0","session":"1a89cfee-df91-462a-851c-0a49a37e25b9","seq":1,"duration_ms":101,"bytes_in":281,"bytes_out":79},{"timestamp":"2026-09-24T03:08:26","port":9200,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"Keep-Alive\",\"host\":\"<HONEYPOT>:9200\",\"origin\":\"http://<HONEYPOT>:9200\",\"referer\":\"http://<HONEYPOT>:9200\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:104.0) Gecko/20100101 Firefox/104.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/Authorization","summary":"","payload_hex":"474554202f417574686f72697a6174696f6e20485454502f312e310d0a4f726967696e3a20687474703a2f2f<HONEYPOT>3a393230300d0a557067726164652d496e7365637572652d52657175657374733a20310d0a526566657265723a20687474703a2f2f<HONEYPOT>3a393230300d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b207836343b2072763a3130342e3029204765636b6f2f32303130303130312046697265666f782f3130342e300d0a486f73743a20<HONEYPOT>3a393230300d0a436f6e6e656374696f6e3a204b6565702d416c6976650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:104.0) Gecko/20100101 Firefox/104.0","ja3":"","session":"1e318b2f-22d7-48c0-80b0-ae12b08edc67","seq":1,"duration_ms":100,"bytes_in":276,"bytes_out":79},{"timestamp":"2026-09-24T03:08:26","port":9200,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"Keep-Alive\",\"host\":\"<HONEYPOT>:9200\",\"origin\":\"https://<HONEYPOT>:9200\",\"referer\":\"https://<HONEYPOT>:9200\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:104.0) Gecko/20100101 Firefox/104.0\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/Authorization","summary":"","payload_hex":"474554202f417574686f72697a6174696f6e20485454502f312e310d0a4f726967696e3a2068747470733a2f2f<HONEYPOT>3a393230300d0a557067726164652d496e7365637572652d52657175657374733a20310d0a526566657265723a2068747470733a2f2f<HONEYPOT>3a393230300d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b207836343b2072763a3130342e3029204765636b6f2f32303130303130312046697265666f782f3130342e300d0a486f73743a20<HONEYPOT>3a393230300d0a436f6e6e656374696f6e3a204b6565702d416c6976650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:104.0) Gecko/20100101 Firefox/104.0","ja3":"85182f532cc3ec9202ca90e103c60767","session":"3db5fc0f-3e4e-40e3-9141-18436e7b0172","seq":1,"duration_ms":100,"bytes_in":278,"bytes_out":79}],"http_methods":[{"method":"GET","count":54}],"distinct_ports_total":26,"top_paths":[{"path":"/Authorization","count":54,"ports":26}],"distinct_paths_total":1,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Connection","Host","Origin","Referer","Upgrade-Insecure-Requests","User-Agent"],"representative":[{"name":"Connection","value":"Keep-Alive","notable":false},{"name":"Host","value":"<HONEYPOT>:31443","notable":false},{"name":"Origin","value":"http://<HONEYPOT>:31443","notable":true},{"name":"Referer","value":"http://<HONEYPOT>:31443","notable":true},{"name":"Upgrade-Insecure-Requests","value":"1","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:104.0) Gecko/20100101 Firefox/104.0","notable":false}],"distinct_sets":1,"events_with_headers":10},"tags":[],"data_as_of":"2026-09-24T14:47:40.304319+00:00"}