{"ip":"209.141.59.162","total_events":366,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"32+ ports swept","confidence":"medium","network_type":null,"why":["No exploit payloads observed.","Swept 32 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"32,029 bytes sent","bytes_sent":32029,"session_seconds":6,"persistent":false}},"first_seen":"2026-09-12T10:30:58","last_seen":"2026-09-24T14:17:00","events_24h":6,"events_7d":231,"geo":{"country_code":"US","country_name":"United States","region":"Nevada","city":"Las Vegas","lat":36.102,"lon":-115.1447,"asn":53667,"org":"FranTech Solutions"},"source_domain":"mail.ph33r.co.uk","known_scanners":[],"scanner_tag":null,"cve_matches":[],"malware":[],"top_ports":[{"port":9090,"proto":"tcp","label":"Prometheus","count":33},{"port":8080,"proto":"tcp","label":"HTTP-alt","count":32},{"port":8888,"proto":"tcp","label":"HTTP-alt","count":32},{"port":80,"proto":"tcp","label":"HTTP","count":31},{"port":443,"proto":"tcp","label":"HTTPS","count":29},{"port":9200,"proto":"tcp","label":"Elastic","count":28},{"port":8443,"proto":"tcp","label":"HTTPS-alt","count":27},{"port":135,"proto":"tcp","label":"MSRPC","count":16},{"port":11211,"proto":"tcp","label":"Memcached","count":14},{"port":22,"proto":"tcp","label":"SSH","count":12},{"port":53,"proto":"tcp","label":"DNS","count":8},{"port":1433,"proto":"tcp","label":"MSSQL","count":8},{"port":1521,"proto":"tcp","label":"Oracle","count":7},{"port":5432,"proto":"tcp","label":"Postgres","count":7},{"port":6379,"proto":"tcp","label":"Redis","count":7}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i251000_b78ed14e2fd0_ab7e3b40a677","t13i781000_ab95583b6d39_d41ae481755e","t13i311000_e8f1e7e78f70_d41ae481755e"],"tls_client_hello":"","tls_ja3":["416eca07dcaad72dec6f76d1277b3eff","004556e859f3c26c5d19746b3a957c74","75fe51990656df4f7a249d5b86aa29ae"],"http_akin":["a11cun040_0000004e_608dab68"]},"fingerprint_peers":{"t13i251000_b78ed14e2fd0_ab7e3b40a677":102,"t13i781000_ab95583b6d39_d41ae481755e":301,"t13i311000_e8f1e7e78f70_d41ae481755e":847,"a11cun040_0000004e_608dab68":523},"akin_families":{},"user_agents":["Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_5_3; nl-nl) AppleWebKit/527+ (KHTML, like Gecko) Version/3.1.1 Safari/525.20","Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.3 Safari/605.1.15","Mozilla/5.0 (SS; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36","Mozilla/5.0 (X11; Linux i686; rv:1.9.6.20) Gecko/ Firefox/11.0","Mozilla/5.0 (X11; Linux x86_64; rv:142.0) Gecko/20100101 Firefox/142.0","Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_3) AppleWebKit/534.55.3 (KHTML, like Gecko) Version/5.1.3 Safari/534.53.10","Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0"],"timeline":[{"date":"2026-09-12","count":15},{"date":"2026-09-16","count":30},{"date":"2026-09-17","count":309},{"date":"2026-09-18","count":6},{"date":"2026-09-24","count":6}],"recent_events":[{"timestamp":"2026-09-24T14:17:00","port":11211,"proto":"tcp","app_proto":"","app_protocol":"memcached","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"stats\r\n","payload_hex":"73746174730d0a","method":"","user_agent":"","ja3":"","session":"ad50d594-e664-4911-9892-1133d75786b5","seq":1,"duration_ms":100,"bytes_in":7,"bytes_out":14,"enriched":{"digest":"8ba3dc4bf81a4992","label":"Memcached","strings":["stats"]}},{"timestamp":"2026-09-24T13:22:55","port":11211,"proto":"tcp","app_proto":"","app_protocol":"memcached","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"stats\r\n","payload_hex":"73746174730d0a","method":"","user_agent":"","ja3":"","session":"1f4970cb-fcc4-413a-9849-c8223925040f","seq":1,"duration_ms":100,"bytes_in":7,"bytes_out":14,"enriched":{"digest":"8ba3dc4bf81a4992","label":"Memcached","strings":["stats"]}},{"timestamp":"2026-09-24T07:55:25","port":9090,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:9090\",\"user-agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a393039300d0a557365722d4167656e743a204d6f7a696c6c612f352e3020284d6163696e746f73683b20496e74656c204d6163204f5320582031305f31355f3729204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f39362e302e343636342e3933205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36","ja3":"","session":"023e7c52-2086-4f75-83a8-9ec95859685f","seq":1,"duration_ms":101,"bytes_in":219,"bytes_out":79},{"timestamp":"2026-09-24T07:55:18","port":443,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:443\",\"user-agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a3434330d0a557365722d4167656e743a204d6f7a696c6c612f352e3020284d6163696e746f73683b20496e74656c204d6163204f5320582031305f31355f3729204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f39362e302e343636342e3933205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36","ja3":"","session":"3e0f07a3-5189-449a-9a0a-a40942bc499b","seq":1,"duration_ms":100,"bytes_in":218,"bytes_out":79},{"timestamp":"2026-09-24T07:55:18","port":9200,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:9200\",\"user-agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a393230300d0a557365722d4167656e743a204d6f7a696c6c612f352e3020284d6163696e746f73683b20496e74656c204d6163204f5320582031305f31355f3729204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f39362e302e343636342e3933205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36","ja3":"","session":"0fc8dd0c-22af-4315-aa4c-64a55d626f46","seq":1,"duration_ms":100,"bytes_in":219,"bytes_out":79},{"timestamp":"2026-09-24T07:55:16","port":8080,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8080\",\"user-agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a383038300d0a557365722d4167656e743a204d6f7a696c6c612f352e3020284d6163696e746f73683b20496e74656c204d6163204f5320582031305f31355f3729204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f39362e302e343636342e3933205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36","ja3":"","session":"c9f503b1-5375-46b0-bd95-96991d736c60","seq":1,"duration_ms":100,"bytes_in":219,"bytes_out":79},{"timestamp":"2026-09-18T15:31:19","port":9200,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:9200\",\"user-agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a393230300d0a557365722d4167656e743a204d6f7a696c6c612f352e3020284d6163696e746f73683b20496e74656c204d6163204f5320582031305f31355f3729204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f39362e302e343636342e3933205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36","ja3":"","session":"ce1ace30-d729-4dc6-b4b4-d8fc42953cdd","seq":1,"duration_ms":100,"bytes_in":219,"bytes_out":79},{"timestamp":"2026-09-18T15:31:15","port":8888,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8888\",\"user-agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a383838380d0a557365722d4167656e743a204d6f7a696c6c612f352e3020284d6163696e746f73683b20496e74656c204d6163204f5320582031305f31355f3729204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f39362e302e343636342e3933205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36","ja3":"","session":"ae29b58c-117f-425c-87ae-5e0ac92c6e9b","seq":1,"duration_ms":100,"bytes_in":219,"bytes_out":79},{"timestamp":"2026-09-18T15:31:13","port":8443,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8443\",\"user-agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a383434330d0a557365722d4167656e743a204d6f7a696c6c612f352e3020284d6163696e746f73683b20496e74656c204d6163204f5320582031305f31355f3729204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f39362e302e343636342e3933205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36","ja3":"","session":"4a09c556-7bd6-42f2-8654-4af5d33ae026","seq":1,"duration_ms":100,"bytes_in":219,"bytes_out":79},{"timestamp":"2026-09-18T15:31:12","port":443,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:443\",\"user-agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a3434330d0a557365722d4167656e743a204d6f7a696c6c612f352e3020284d6163696e746f73683b20496e74656c204d6163204f5320582031305f31355f3729204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f39362e302e343636342e3933205361666172692f3533372e33360d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36","ja3":"","session":"0940208d-ac84-497c-ba44-09d9e8bc1a89","seq":1,"duration_ms":100,"bytes_in":218,"bytes_out":79}],"http_methods":[{"method":"GET","count":206},{"method":"OPTIONS","count":7}],"distinct_ports_total":32,"top_paths":[{"path":"/","count":103,"ports":28},{"path":"/.svn/entries","count":35,"ports":7},{"path":"/.git/config","count":35,"ports":7},{"path":"/.idea/workspace.xml","count":35,"ports":7},{"path":"/nice%20ports%2C/Tri%6Eity.txt%2ebak","count":5,"ports":5}],"distinct_paths_total":5,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept-Encoding","Connection","Host","User-Agent"],"representative":[{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Connection","value":"close","notable":false},{"name":"Host","value":"<HONEYPOT>:9090","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36","notable":false}],"distinct_sets":1,"events_with_headers":8},"tags":[],"data_as_of":"2026-09-24T14:28:39.650609+00:00"}