{"ip":"198.74.54.62","data_as_of":"2026-10-26T11:44:13+00:00","observed":true,"total_events":204,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"23+ ports swept","confidence":"medium","network_type":"CDN","why":["No exploit payloads observed.","Swept 23 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"6,151 bytes sent","bytes_sent":6151,"session_seconds":6,"persistent":false},"basis":"first_contact"},"first_seen":"2026-02-27T14:55:50","last_seen":"2026-10-25T02:07:30","events_24h":0,"events_7d":31,"interactive_sessions":0,"interactive_sessions_24h":0,"interactive_sessions_7d":0,"interactive_protocols":[],"geo":{"country_code":"US","country_name":"United States","region":"Georgia","city":"Atlanta","lat":33.7485,"lon":-84.3871,"asn":63949,"org":"Akamai Connected Cloud"},"source_domain":"198-74-54-62.ip.linodeusercontent.com","known_scanners":[],"scanner_tag":{"key":"linode","label":"Linode (Akamai)","category":"hosting_provider","url":"https://www.linode.com/"},"cve_matches":[],"malware":[],"udp":null,"interaction":null,"top_ports":[{"port":443,"proto":"tcp","label":"HTTPS","count":31},{"port":80,"proto":"tcp","label":"HTTP","count":22},{"port":1888,"proto":"tcp","label":"","count":17},{"port":2086,"proto":"tcp","label":"","count":12},{"port":2003,"proto":"tcp","label":"","count":9},{"port":427,"proto":"tcp","label":"","count":8},{"port":8007,"proto":"tcp","label":"","count":8},{"port":1215,"proto":"tcp","label":"","count":7},{"port":9303,"proto":"tcp","label":"","count":7},{"port":1202,"proto":"tcp","label":"","count":7},{"port":49668,"proto":"tcp","label":"","count":7},{"port":49155,"proto":"tcp","label":"","count":7},{"port":55433,"proto":"tcp","label":"","count":7},{"port":4449,"proto":"tcp","label":"","count":7},{"port":12443,"proto":"tcp","label":"","count":6}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i751000_479067518aa3_d41ae481755e"],"tls_client_hello":"1603010200010001fc0303937273920b5c8f2b2b753d8de7ac11a4d402eebb991e12eb88126bbe1ea4479d20caacc949d3f7fed73d2dc5397052fb2f55de65dc396b48842f7359f894b2cf150096130213031301003300390035002fc02cc03000a3009fcca9cca8ccaac0afc0adc0a3c09fc05dc061c057c053c02bc02f00a2009ec0aec0acc0a2c09ec05cc060c056c052c024c028006b006ac073c07700c400c3c023c02700670040c072c07600be00bdc00ac014003800880087c009c013003200450044009dc0a1c09dc051009cc0a0c09cc050003d00c0003c00ba0084004100ff0100011d000b000403000102000a00160014001d0017001e0019001801000101010201030104002300000016000000170000000d002a0028040305030603080708080809080a080b080408050806040105010601030303010302040205020602002b00050403040303002d00020101003300260024001d0020ad0d7158d02a979a808eeea98a50e1d0ac26131d056b7233e1bfbdd0b4149c6000150084000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000","tls_ja3":["327efd8a5e8ed9fa2b145f126b748661"],"http_akin":["b11cun030_00040011_c91eaf54","b11cuq051_00040811_985b9497_xded3","b11cun082_04040017_735c1356_x117b3539","b10cun000_00000000_334359b9"],"interactive":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[]}},"fingerprint_peers":{"b11cun030_00040011_c91eaf54":976,"b10cun000_00000000_334359b9":2573,"t13i751000_479067518aa3_d41ae481755e":724,"b11cuq051_00040811_985b9497_xded3":2,"b11cun082_04040017_735c1356_x117b3539":2},"akin_families":{"b11cun030_00040011_c91eaf54":{"head":"b11cun030_00040011_c91eaf54","shapes":2,"ips":976},"b11cun082_04040017_735c1356_x117b3539":{"head":"b11cun082_04040017_735c1356_x117b3539","shapes":2,"ips":2}},"user_agents":["Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html)","AnyConnect Darwin_i386 3.1.05160"],"timeline":[{"date":"2026-08-11","count":7},{"date":"2026-10-04","count":7},{"date":"2026-10-25","count":31}],"recent_events":[{"timestamp":"2026-10-25T02:07:30","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"access-control-request-method\":\"POST\",\"connection\":\"close\",\"host\":\"<HONEYPOT>\",\"origin\":\"example.com\",\"user-agent\":\"Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html)\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"4f5054494f4e53202f20485454502f312e310d0a436f6e6e656374696f6e3a20636c6f73650d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b204e6d617020536372697074696e6720456e67696e653b2068747470733a2f2f6e6d61702e6f72672f626f6f6b2f6e73652e68746d6c290d0a4163636573732d436f6e74726f6c2d526571756573742d4d6574686f643a20504f53540d0a4f726967696e3a206578616d706c652e636f6d0d0a0d0a","method":"OPTIONS","user_agent":"Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html)","ja3":"327efd8a5e8ed9fa2b145f126b748661","session":"4ce5fa13-cc7a-4b41-a9dc-0e6a0e1999cc","seq":1,"duration_ms":120,"bytes_in":213,"bytes_out":77},{"timestamp":"2026-10-25T02:07:30","port":443,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"access-control-request-method\":\"GET\",\"connection\":\"close\",\"host\":\"<HONEYPOT>\",\"origin\":\"example.com\",\"user-agent\":\"Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html)\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"4f5054494f4e53202f20485454502f312e310d0a436f6e6e656374696f6e3a20636c6f73650d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b204e6d617020536372697074696e6720456e67696e653b2068747470733a2f2f6e6d61702e6f72672f626f6f6b2f6e73652e68746d6c290d0a4163636573732d436f6e74726f6c2d526571756573742d4d6574686f643a204745540d0a4f726967696e3a206578616d706c652e636f6d0d0a0d0a","method":"OPTIONS","user_agent":"Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html)","ja3":"","session":"d6880741-3582-4c1c-b91f-8e93b1e41b71","seq":1,"duration_ms":100,"bytes_in":212,"bytes_out":77},{"timestamp":"2026-10-25T02:07:30","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"access-control-request-method\":\"GET\",\"connection\":\"close\",\"host\":\"<HONEYPOT>\",\"origin\":\"example.com\",\"user-agent\":\"Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html)\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"4f5054494f4e53202f20485454502f312e310d0a436f6e6e656374696f6e3a20636c6f73650d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b204e6d617020536372697074696e6720456e67696e653b2068747470733a2f2f6e6d61702e6f72672f626f6f6b2f6e73652e68746d6c290d0a4163636573732d436f6e74726f6c2d526571756573742d4d6574686f643a204745540d0a4f726967696e3a206578616d706c652e636f6d0d0a0d0a","method":"OPTIONS","user_agent":"Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html)","ja3":"327efd8a5e8ed9fa2b145f126b748661","session":"00d7cc2f-384e-41f3-9868-17050ea22931","seq":1,"duration_ms":120,"bytes_in":212,"bytes_out":77},{"timestamp":"2026-10-25T02:07:29","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"access-control-request-method\":\"HEAD\",\"connection\":\"close\",\"host\":\"<HONEYPOT>\",\"origin\":\"example.com\",\"user-agent\":\"Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html)\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"4f5054494f4e53202f20485454502f312e310d0a436f6e6e656374696f6e3a20636c6f73650d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b204e6d617020536372697074696e6720456e67696e653b2068747470733a2f2f6e6d61702e6f72672f626f6f6b2f6e73652e68746d6c290d0a4163636573732d436f6e74726f6c2d526571756573742d4d6574686f643a20484541440d0a4f726967696e3a206578616d706c652e636f6d0d0a0d0a","method":"OPTIONS","user_agent":"Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html)","ja3":"327efd8a5e8ed9fa2b145f126b748661","session":"fbcfaf49-95c6-409e-ba02-19e567e2b076","seq":1,"duration_ms":120,"bytes_in":213,"bytes_out":77},{"timestamp":"2026-10-25T02:06:38","port":443,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"depth\":\"0\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html)\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"PROPFIND / HTTP/1.1\r\nDepth: 0\r\nConnection: close\r\nUser-Agent: Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html)\r\nHost: <HONEYPOT>\r\n\r\n","payload_hex":"50524f5046494e44202f20485454502f312e310d0a44657074683a20300d0a436f6e6e656374696f6e3a20636c6f73650d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b204e6d617020536372697074696e6720456e67696e653b2068747470733a2f2f6e6d61702e6f72672f626f6f6b2f6e73652e68746d6c290d0a486f73743a20<HONEYPOT>0d0a0d0a","method":"PROPFIND","user_agent":"Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html)","ja3":"","session":"6d7952b1-85f6-46d0-aa0c-99cfe5d52807","seq":1,"duration_ms":100,"bytes_in":166,"bytes_out":12},{"timestamp":"2026-10-25T02:06:38","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"depth\":\"0\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html)\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"PROPFIND / HTTP/1.1\r\nDepth: 0\r\nConnection: close\r\nUser-Agent: Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html)\r\nHost: <HONEYPOT>\r\n\r\n","payload_hex":"50524f5046494e44202f20485454502f312e310d0a44657074683a20300d0a436f6e6e656374696f6e3a20636c6f73650d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b204e6d617020536372697074696e6720456e67696e653b2068747470733a2f2f6e6d61702e6f72672f626f6f6b2f6e73652e68746d6c290d0a486f73743a20<HONEYPOT>0d0a0d0a","method":"PROPFIND","user_agent":"Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html)","ja3":"327efd8a5e8ed9fa2b145f126b748661","session":"5f947801-c58e-455c-961f-dafb94c47e5e","seq":1,"duration_ms":121,"bytes_in":166,"bytes_out":12},{"timestamp":"2026-10-25T02:06:32","port":443,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�4\u0001\u0000\u0002\u0000\u001b\u0000\u0000\u0000\u0010\u0006\u0000@\u0004\u0000�\u0003\u0000�\u0002\u0000�\u0001\u0000�\u0000\u0000\u0000\b\u0000�\u0007\u0000�\u0005\u0000���U�53�a�����\u0015cJ","payload_hex":"8034010002001b000000100600400400800300800200800100800000000800800700c0050080e69255ce35338b618e87bf94c315634a","method":"","user_agent":"","ja3":"","session":"23149c38-9fc3-4c02-98e9-6f69f934c0c0","seq":1,"duration_ms":100,"bytes_in":54,"bytes_out":12},{"timestamp":"2026-10-25T02:06:17","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html)\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"4f5054494f4e53202f20485454502f312e310d0a436f6e6e656374696f6e3a20636c6f73650d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b204e6d617020536372697074696e6720456e67696e653b2068747470733a2f2f6e6d61702e6f72672f626f6f6b2f6e73652e68746d6c290d0a486f73743a20<HONEYPOT>0d0a0d0a","method":"OPTIONS","user_agent":"Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html)","ja3":"327efd8a5e8ed9fa2b145f126b748661","session":"fe7ff4c9-aa79-4acf-9b53-879886af3b8c","seq":1,"duration_ms":120,"bytes_in":155,"bytes_out":77},{"timestamp":"2026-10-25T02:06:17","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"content-length\":\"0\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html)\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"504f5354202f20485454502f312e310d0a436f6e74656e742d4c656e6774683a20300d0a436f6e6e656374696f6e3a20636c6f73650d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b204e6d617020536372697074696e6720456e67696e653b2068747470733a2f2f6e6d61702e6f72672f626f6f6b2f6e73652e68746d6c290d0a486f73743a20<HONEYPOT>0d0a0d0a","method":"POST","user_agent":"Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html)","ja3":"327efd8a5e8ed9fa2b145f126b748661","session":"8a768de1-22b8-4d3a-9643-9ef0d75707e6","seq":1,"duration_ms":120,"bytes_in":171,"bytes_out":77},{"timestamp":"2026-10-25T02:06:17","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html)\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"48454144202f20485454502f312e310d0a436f6e6e656374696f6e3a20636c6f73650d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b204e6d617020536372697074696e6720456e67696e653b2068747470733a2f2f6e6d61702e6f72672f626f6f6b2f6e73652e68746d6c290d0a486f73743a20<HONEYPOT>0d0a0d0a","method":"HEAD","user_agent":"Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html)","ja3":"327efd8a5e8ed9fa2b145f126b748661","session":"49d6132e-0b44-4049-9b66-14d89d9cef6c","seq":1,"duration_ms":120,"bytes_in":152,"bytes_out":77}],"http_methods":[{"method":"GET","count":36},{"method":"OPTIONS","count":9},{"method":"HEAD","count":4},{"method":"PROPFIND","count":4},{"method":"POST","count":2},{"method":"ITJI","count":1}],"distinct_ports_total":23,"top_paths":[{"path":"/","count":52,"ports":21},{"path":"/robots.txt","count":1,"ports":1},{"path":"/favicon.ico","count":1,"ports":1},{"path":"/.git/HEAD","count":1,"ports":1},{"path":"/nice%20ports%2C/Tri%6Eity.txt%2ebak","count":1,"ports":1}],"distinct_paths_total":5,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Access-Control-Request-Method","Connection","Host","Origin","User-Agent"],"representative":[{"name":"Access-Control-Request-Method","value":"POST","notable":false},{"name":"Connection","value":"close","notable":false},{"name":"Host","value":"<HONEYPOT>","notable":false},{"name":"Origin","value":"example.com","notable":true},{"name":"User-Agent","value":"Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html)","notable":false}],"distinct_sets":4,"events_with_headers":9},"tags":[]}