{"ip":"201.148.65.18","total_events":8,"verdict":{"verdict":"probing","label":"Low-level probing","detail":null,"confidence":"low","network_type":"residential ISP","why":["8 event(s), fewer than 10 distinct ports, no exploit payloads.","Not in any known-scanner range."],"engagement":{"level":"request","label":"Request traffic","detail":"1,692 bytes sent","bytes_sent":1692,"session_seconds":0,"persistent":false}},"first_seen":"2026-07-22T08:24:21","last_seen":"2026-09-23T23:57:42","events_24h":0,"events_7d":3,"geo":{"country_code":"MX","country_name":"Mexico","region":"Durango","city":"Durango","lat":24.0705,"lon":-104.6435,"asn":18734,"org":"Operbes, S.A. de C.V."},"source_domain":"18.201-148-65.bestelclientes.com.mx","known_scanners":[],"scanner_tag":{"key":"peeringdb:as18734","label":"Bestel","category":"isp","url":"https://www.peeringdb.com/asn/18734"},"cve_matches":[],"malware":[],"top_ports":[{"port":5985,"proto":"tcp","label":"","count":4},{"port":5678,"proto":"tcp","label":"","count":1},{"port":1194,"proto":"tcp","label":"OpenVPN","count":1},{"port":5050,"proto":"tcp","label":"","count":1},{"port":1099,"proto":"tcp","label":"","count":1}],"fingerprints":{"ssh_hassh":["eb0e0554de9aeb368191c86016a40080"],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":["b11cuq040_00440810_a31e7c35"]},"fingerprint_peers":{"eb0e0554de9aeb368191c86016a40080":0,"b11cuq040_00440810_a31e7c35":399},"akin_families":{},"user_agents":["Microsoft WinRM Client"],"timeline":[{"date":"2026-07-22","count":1},{"date":"2026-07-23","count":2},{"date":"2026-07-26","count":1},{"date":"2026-09-19","count":1},{"date":"2026-09-23","count":3}],"recent_events":[{"timestamp":"2026-09-23T23:57:42","port":5985,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"authorization\":\"Negotiate TlRMTVNTUAABAAAAN4II4gAAAAAAAAAAAAAAAAAAAAAGAbAdAAAADw==\",\"content-length\":\"0\",\"host\":\"<HONEYPOT>:5985\",\"user-agent\":\"Microsoft WinRM Client\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/wsman?PSVersion=5.1.19041.1","summary":"","payload_hex":"504f5354202f77736d616e3f505356657273696f6e3d352e312e31393034312e3120485454502f312e310d0a417574686f72697a6174696f6e3a204e65676f746961746520546c524d54564e5455414142414141414e344949346741414141414141414141414141414141414141414147416241644141414144773d3d0d0a557365722d4167656e743a204d6963726f736f66742057696e524d20436c69656e740d0a486f73743a20<HONEYPOT>3a353938350d0a436f6e74656e742d4c656e6774683a20300d0a0d0a","method":"POST","user_agent":"Microsoft WinRM Client","ja3":"","session":"39120320-c913-44a0-9a71-ab0fc5ca18b5","seq":1,"duration_ms":100,"bytes_in":209,"bytes_out":78},{"timestamp":"2026-09-23T23:21:35","port":5985,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"authorization\":\"Negotiate TlRMTVNTUAABAAAAN4II4gAAAAAAAAAAAAAAAAAAAAAGAbAdAAAADw==\",\"content-length\":\"0\",\"host\":\"<HONEYPOT>:5985\",\"user-agent\":\"Microsoft WinRM Client\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/wsman?PSVersion=5.1.19041.1","summary":"","payload_hex":"504f5354202f77736d616e3f505356657273696f6e3d352e312e31393034312e3120485454502f312e310d0a417574686f72697a6174696f6e3a204e65676f746961746520546c524d54564e5455414142414141414e344949346741414141414141414141414141414141414141414147416241644141414144773d3d0d0a557365722d4167656e743a204d6963726f736f66742057696e524d20436c69656e740d0a486f73743a20<HONEYPOT>3a353938350d0a436f6e74656e742d4c656e6774683a20300d0a0d0a","method":"POST","user_agent":"Microsoft WinRM Client","ja3":"","session":"a1044023-4f8d-45e0-b9f3-382a2dbea9a9","seq":1,"duration_ms":100,"bytes_in":209,"bytes_out":78},{"timestamp":"2026-09-23T17:49:45","port":5985,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"authorization\":\"Negotiate TlRMTVNTUAABAAAAN4II4gAAAAAAAAAAAAAAAAAAAAAGAbAdAAAADw==\",\"content-length\":\"0\",\"host\":\"<HONEYPOT>:5985\",\"user-agent\":\"Microsoft WinRM Client\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/wsman?PSVersion=5.1.19041.1","summary":"","payload_hex":"504f5354202f77736d616e3f505356657273696f6e3d352e312e31393034312e3120485454502f312e310d0a417574686f72697a6174696f6e3a204e65676f746961746520546c524d54564e5455414142414141414e344949346741414141414141414141414141414141414141414147416241644141414144773d3d0d0a557365722d4167656e743a204d6963726f736f66742057696e524d20436c69656e740d0a486f73743a20<HONEYPOT>3a353938350d0a436f6e74656e742d4c656e6774683a20300d0a0d0a","method":"POST","user_agent":"Microsoft WinRM Client","ja3":"","session":"3aa34d0d-03b5-4210-aa65-bfb16a444fc3","seq":1,"duration_ms":100,"bytes_in":210,"bytes_out":78},{"timestamp":"2026-09-19T15:11:45","port":5985,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"authorization\":\"Negotiate TlRMTVNTUAABAAAAN4II4gAAAAAAAAAAAAAAAAAAAAAGAbAdAAAADw==\",\"content-length\":\"0\",\"host\":\"<HONEYPOT>:5985\",\"user-agent\":\"Microsoft WinRM Client\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/wsman?PSVersion=5.1.19041.1","summary":"","payload_hex":"504f5354202f77736d616e3f505356657273696f6e3d352e312e31393034312e3120485454502f312e310d0a417574686f72697a6174696f6e3a204e65676f746961746520546c524d54564e5455414142414141414e344949346741414141414141414141414141414141414141414147416241644141414144773d3d0d0a557365722d4167656e743a204d6963726f736f66742057696e524d20436c69656e740d0a486f73743a20<HONEYPOT>3a353938350d0a436f6e74656e742d4c656e6774683a20300d0a0d0a","method":"POST","user_agent":"Microsoft WinRM Client","ja3":"","session":"02f316d7-a655-4af1-8d5f-fd233aca61dd","seq":1,"duration_ms":100,"bytes_in":210,"bytes_out":78},{"timestamp":"2026-07-26T20:53:37","port":1194,"proto":"tcp","app_proto":"","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"SSH-2.0-RawPasswordConnectOnly_1.0\r\n\u0000\u0000\u0001�\n\u0014�\u001a&��\n��m��n��\u000f\u0000\u0000\u0000recdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1\u0000\u0000\u0000]ecdsa-sha2-nistp256,rsa-sha2-256,rsa-sha2-512,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa\u0000\u0000\u0000Aaes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,aes192-cbc,aes256-cbc\u0000\u0000\u0000Aaes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,aes192-cbc,aes256-cbc\u0000\u0000\u0000%hmac-sha2-256,hmac-sha1,hmac-sha2-512\u0000\u0000\u0000%hmac-sha2-256,hmac-sha1,hmac-sha2-512\u0000\u0000\u0000\u0004none\u0000\u0000\u0000\u0004none\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000��IM���3��","payload_hex":"5353482d322e302d52617750617373776f7264436f6e6e6563744f6e6c795f312e300d0a000001ec0a149c1a26b4a80ac3c36d7fefbd6ebee50f00000072656364682d736861322d6e697374703235362c656364682d736861322d6e697374703338342c656364682d736861322d6e697374703532312c6469666669652d68656c6c6d616e2d67726f757031342d7368613235362c6469666669652d68656c6c6d616e2d67726f757031342d736861310000005d65636473612d736861322d6e697374703235362c7273612d736861322d3235362c7273612d736861322d3531322c65636473612d736861322d6e697374703338342c65636473612d736861322d6e697374703532312c7373682d727361000000416165733132382d6374722c6165733139322d6374722c6165733235362d6374722c6165733132382d6362632c6165733139322d6362632c6165733235362d636263000000416165733132382d6374722c6165733139322d6374722c6165733235362d6374722c6165733132382d6362632c6165733139322d6362632c6165733235362d63626300000025686d61632d736861322d3235362c686d61632d736861312c686d61632d736861322d35313200000025686d61632d736861322d3235362c686d61632d736861312c686d61632d736861322d353132000000046e6f6e65000000046e6f6e6500000000000000000000000000bfd3494deb82d533caf5","method":"","user_agent":"","ja3":"","session":"6d3d7687-de51-4c24-876f-89b618ad87c0","seq":1,"duration_ms":100,"bytes_in":532,"bytes_out":13,"enriched":{"digest":"b7796ebddac750da","label":"SSH","strings":["SSH-2.0-RawPasswordConnectOnly_1.0","recdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14…","]ecdsa-sha2-nistp256,rsa-sha2-256,rsa-sha2-512,ecdsa-sha2-nistp384,ecdsa-sha2-ni…","Aaes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,aes192-cbc,aes256-cbc","%hmac-sha2-256,hmac-sha1,hmac-sha2-512","none"]}},{"timestamp":"2026-07-23T09:12:24","port":5678,"proto":"tcp","app_proto":"","app_protocol":"google","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CONNECT www.google.com:443 HTTP/1.1\r\nHost: www.google.com:443\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:145.0) Gecko/20100101 Firefox/145.0\r\n\r\n","payload_hex":"434f4e4e454354207777772e676f6f676c652e636f6d3a34343320485454502f312e310d0a486f73743a207777772e676f6f676c652e636f6d3a3434330d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b207836343b2072763a3134352e3029204765636b6f2f32303130303130312046697265666f782f3134352e300d0a0d0a","method":"","user_agent":"","ja3":"","session":"c8d2d531-76c1-4d62-8e84-cdd9b1972523","seq":1,"duration_ms":101,"bytes_in":159,"bytes_out":13,"enriched":{"digest":"3971a1fdfcb966ed","label":"HTTP","strings":["CONNECT www.google.com:443 HTTP/1.1","Host: www.google.com:443","User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:145.0) Gecko/20100101 F…"],"iocs":{"domains":["www.google.com"]}}},{"timestamp":"2026-07-23T07:37:24","port":1099,"proto":"tcp","app_proto":"","app_protocol":"google","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CONNECT www.google.com:443 HTTP/1.1\r\nHost: www.google.com:443\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:145.0) Gecko/20100101 Firefox/145.0\r\n\r\n","payload_hex":"434f4e4e454354207777772e676f6f676c652e636f6d3a34343320485454502f312e310d0a486f73743a207777772e676f6f676c652e636f6d3a3434330d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b207836343b2072763a3134352e3029204765636b6f2f32303130303130312046697265666f782f3134352e300d0a0d0a","method":"","user_agent":"","ja3":"","session":"d5e34266-a916-4393-a9f6-d51cd6f97637","seq":1,"duration_ms":101,"bytes_in":159,"bytes_out":13,"enriched":{"digest":"3971a1fdfcb966ed","label":"HTTP","strings":["CONNECT www.google.com:443 HTTP/1.1","Host: www.google.com:443","User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:145.0) Gecko/20100101 F…"],"iocs":{"domains":["www.google.com"]}}},{"timestamp":"2026-07-22T08:24:21","port":5050,"proto":"tcp","app_proto":"","app_protocol":"socks5","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0005\u0002\u0000\u0002","payload_hex":"05020002","method":"","user_agent":"","ja3":"","session":"bbe05325-3e71-473d-8e1f-39c7eb588fa4","seq":1,"duration_ms":100,"bytes_in":4,"bytes_out":13,"enriched":{"digest":"bb32f1da18a34784","label":"SOCKS5"}}],"http_methods":[{"method":"POST","count":4}],"distinct_ports_total":5,"top_paths":[{"path":"/wsman?PSVersion=5.1.19041.1","count":4,"ports":1}],"distinct_paths_total":1,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[{"value":"SSH-2.0-RawPasswordConnectOnly_1.0","count":1}],"credentials":[],"header_profile":{"signature":["Authorization","Content-Length","Host","User-Agent"],"representative":[{"name":"Authorization","value":"Negotiate TlRMTVNTUAABAAAAN4II4gAAAAAAAAAAAAAAAAAAAAAGAbAdAAAADw==","notable":true},{"name":"Content-Length","value":"0","notable":false},{"name":"Host","value":"<HONEYPOT>:5985","notable":false},{"name":"User-Agent","value":"Microsoft WinRM Client","notable":false}],"distinct_sets":1,"events_with_headers":4},"tags":[],"data_as_of":"2026-09-30T16:08:57.682795+00:00"}