{"ip":"209.141.48.143","total_events":282,"verdict":{"verdict":"probing","label":"Low-level probing","detail":null,"confidence":"low","network_type":null,"why":["282 event(s), fewer than 10 distinct ports, no exploit payloads.","Not in any known-scanner range.","Sent 24,632 bytes despite few ports and no known exploit path: focused interaction with one service, worth a look."],"engagement":{"level":"payload","label":"Sustained payload","detail":"24,632 bytes sent","bytes_sent":24632,"session_seconds":1,"persistent":false}},"first_seen":"2026-08-06T22:44:05","last_seen":"2026-08-09T02:07:58","events_24h":0,"events_7d":150,"geo":{"country_code":"US","country_name":"United States","region":"Nevada","city":"Las Vegas","lat":36.102,"lon":-115.1447,"asn":53667,"org":"FranTech Solutions"},"source_domain":null,"known_scanners":[],"scanner_tag":null,"cve_matches":[],"malware":[],"top_ports":[{"port":1337,"proto":"tcp","label":"","count":282}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i1010h2_61a7ad8aa9b6_3a8073edd8ef","t13i1010h2_61a7ad8aa9b6_792d2c6655cb"],"tls_ja3":["0b36f59d3946849399766854b1dd53d4","295295d1f992b9fa32629f96e4900f88","fb6f6777b5561b5e02362abf8bad9e18","5689e070ddf9c4cf30500f80e14a4e2a","527448c647224f40bf3fbbbb6d2d7e7e"],"ja4h":["ge11nn0200_e1391afd0c9d","he11nn0200_e1391afd0c9d"]},"fingerprint_peers":{"t13i1010h2_61a7ad8aa9b6_792d2c6655cb":2,"t13i1010h2_61a7ad8aa9b6_3a8073edd8ef":4,"ge11nn0200_e1391afd0c9d":57,"he11nn0200_e1391afd0c9d":4},"user_agents":[],"timeline":[{"date":"2026-08-06","count":12},{"date":"2026-08-07","count":90},{"date":"2026-08-08","count":150},{"date":"2026-08-09","count":30}],"recent_events":[{"timestamp":"2026-08-09T02:07:58","port":1337,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:1337\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/addKey","summary":"","payload_hex":"474554202f6164644b657920485454502f312e310d0a6163636570743a202a2f2a0d0a686f73743a20<HONEYPOT>3a313333370d0a0d0a","method":"GET","user_agent":"","ja3":"e1544488ce1990c9938273bfa8a30004","session":"d5743480-2fa8-4bd9-841e-18a1c0d94923","seq":1,"duration_ms":100,"bytes_in":62,"bytes_out":79},{"timestamp":"2026-08-09T02:07:57","port":1337,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:1337\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/addKey","summary":"","payload_hex":"48454144202f6164644b657920485454502f312e310d0a6163636570743a202a2f2a0d0a686f73743a20<HONEYPOT>3a313333370d0a0d0a","method":"HEAD","user_agent":"","ja3":"b7e7ae8bd9fc679f5d1f73d771e7cd66","session":"54688afb-beb3-40a9-8863-6b0e952aeae4","seq":2,"duration_ms":553,"bytes_in":125,"bytes_out":158},{"timestamp":"2026-08-09T02:07:57","port":1337,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:1337\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/addKey","summary":"","payload_hex":"474554202f6164644b657920485454502f312e310d0a6163636570743a202a2f2a0d0a686f73743a20<HONEYPOT>3a313333370d0a0d0a","method":"GET","user_agent":"","ja3":"b7e7ae8bd9fc679f5d1f73d771e7cd66","session":"54688afb-beb3-40a9-8863-6b0e952aeae4","seq":1,"duration_ms":100,"bytes_in":62,"bytes_out":79},{"timestamp":"2026-08-09T02:07:57","port":1337,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:1337\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/addKey","summary":"","payload_hex":"48454144202f6164644b657920485454502f312e310d0a6163636570743a202a2f2a0d0a686f73743a20<HONEYPOT>3a313333370d0a0d0a","method":"HEAD","user_agent":"","ja3":"80f2b89883a7b5ccb69d2a9f05ad7b04","session":"43828d15-89d6-49e3-abc3-494c5600d4d5","seq":2,"duration_ms":478,"bytes_in":125,"bytes_out":158},{"timestamp":"2026-08-09T02:07:56","port":1337,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:1337\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/addKey","summary":"","payload_hex":"474554202f6164644b657920485454502f312e310d0a6163636570743a202a2f2a0d0a686f73743a20<HONEYPOT>3a313333370d0a0d0a","method":"GET","user_agent":"","ja3":"80f2b89883a7b5ccb69d2a9f05ad7b04","session":"43828d15-89d6-49e3-abc3-494c5600d4d5","seq":1,"duration_ms":101,"bytes_in":62,"bytes_out":79},{"timestamp":"2026-08-09T02:07:56","port":1337,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:1337\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/addKey","summary":"","payload_hex":"48454144202f6164644b657920485454502f312e310d0a6163636570743a202a2f2a0d0a686f73743a20<HONEYPOT>3a313333370d0a0d0a","method":"HEAD","user_agent":"","ja3":"39e8124973d34c9cf33284ef2df8fc14","session":"316749da-0942-4b22-8ccf-c7f2d17110ba","seq":2,"duration_ms":403,"bytes_in":125,"bytes_out":158},{"timestamp":"2026-08-09T02:07:56","port":1337,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:1337\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/addKey","summary":"","payload_hex":"474554202f6164644b657920485454502f312e310d0a6163636570743a202a2f2a0d0a686f73743a20<HONEYPOT>3a313333370d0a0d0a","method":"GET","user_agent":"","ja3":"39e8124973d34c9cf33284ef2df8fc14","session":"316749da-0942-4b22-8ccf-c7f2d17110ba","seq":1,"duration_ms":100,"bytes_in":62,"bytes_out":79},{"timestamp":"2026-08-09T02:07:55","port":1337,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:1337\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/addKey","summary":"","payload_hex":"48454144202f6164644b657920485454502f312e310d0a6163636570743a202a2f2a0d0a686f73743a20<HONEYPOT>3a313333370d0a0d0a","method":"HEAD","user_agent":"","ja3":"b0ad36a0b7a981049efe3e1eeaad2cb2","session":"07ae53d9-24a3-41ca-a5f1-c994fc8e971a","seq":2,"duration_ms":327,"bytes_in":125,"bytes_out":158},{"timestamp":"2026-08-09T02:07:55","port":1337,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:1337\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/addKey","summary":"","payload_hex":"474554202f6164644b657920485454502f312e310d0a6163636570743a202a2f2a0d0a686f73743a20<HONEYPOT>3a313333370d0a0d0a","method":"GET","user_agent":"","ja3":"b0ad36a0b7a981049efe3e1eeaad2cb2","session":"07ae53d9-24a3-41ca-a5f1-c994fc8e971a","seq":1,"duration_ms":101,"bytes_in":62,"bytes_out":79},{"timestamp":"2026-08-09T02:07:55","port":1337,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:1337\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/addKey","summary":"","payload_hex":"48454144202f6164644b657920485454502f312e310d0a6163636570743a202a2f2a0d0a686f73743a20<HONEYPOT>3a313333370d0a0d0a","method":"HEAD","user_agent":"","ja3":"5ef8c50560793d7bebf7b1f1342fd0ae","session":"fc13d366-ae82-4111-a1c3-b0d70d19269f","seq":1,"duration_ms":101,"bytes_in":63,"bytes_out":79}],"http_methods":[{"method":"GET","count":141},{"method":"HEAD","count":141}],"distinct_ports_total":1,"top_paths":[{"path":"/addKey","count":282,"ports":1}],"distinct_paths_total":1,"top_snis":[],"top_hosts":[],"top_alpns":[{"value":"h2, http/1.1","count":282}],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","Host"],"representative":[{"name":"Accept","value":"*/*","notable":false},{"name":"Host","value":"<HONEYPOT>:1337","notable":false}],"distinct_sets":1,"events_with_headers":10},"tags":[],"data_as_of":"2026-08-15T04:45:24.585503+00:00"}