{"ip":"209.99.184.239","total_events":4,"verdict":{"verdict":"probing","label":"Low-level probing","detail":null,"confidence":"low","network_type":"network services","why":["4 event(s), fewer than 10 distinct ports, no exploit payloads.","Not in any known-scanner range."],"engagement":{"level":"request","label":"Request traffic","detail":"542 bytes sent","bytes_sent":542,"session_seconds":0,"persistent":false}},"first_seen":"2026-09-23T12:17:15","last_seen":"2026-09-23T13:35:04","events_24h":4,"events_7d":4,"geo":{"country_code":"CH","country_name":"Switzerland","region":"Zurich","city":"Zurich","lat":47.3643,"lon":8.5437,"asn":402253,"org":"SKN Subnet & Telecom Ltd"},"source_domain":null,"known_scanners":[],"scanner_tag":null,"cve_matches":[],"malware":[],"top_ports":[{"port":4222,"proto":"tcp","label":"","count":4}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i131000_f57a46bbacb6_ab7e3b40a677"],"tls_client_hello":"16030105c6010005c20303929952474d4dc6b8c40f56ad1ee301a05d13dffe1634a1bd290beea54ada35f520bfd38ff8714076d1aa61ae6c0da08f762f2c195aad1ee1f438c9ea07bc483450001ac02bc02fc02cc030cca9cca8c009c013c00ac0141301130213030100055f000b00020100ff010001000017000000120000000500050100000000000a000c000a11ec001d001700180019000d0016001408040403080708050806040105010601050306030032001a0018080404030807080508060401050106010503060302010203002b0009080304030303020301003304ea04e811ec04c06457922087367afc76aba7416e7919b35b4ee6c1b9b61a7d27e27e53d63794a7a95a668e5eabc9d1a26a105cbacab74e27b0a6a77a53aa683e0d45c2a1921993a92933b8a1a39c438b6c1e4c13027b5433d8d556ade4412bb51fd978aa664b6f7d52279e28c53bf352ddf54c7f304390c013054c1e1ca12a61c6552974a3d09954e1c86f8a3bc7aa414d2ce34b48873bf2f5051ef4cb07e7035a568c10059f6d80442dcb0ccea2cc6f614f4942a71708d0006bc781b582e7c54ad84091dcb3a3266ac3c5dc6682053908202bf8f9a5691ac0b9dcae637cb336191ae304736b1a2b41bb502a07a47288809a61b05ff64b05f60cfcf43ce453cb179ba8f7d6511249849ad3c5ca5577267a1a741aae6cc3baed4373368038d5349042e79602b05cfddbbdc49b13aeba72237b4263f688e1aa323c29c12e2603d0da631b119d9a5c1039987307a3bb5557182c2bb55056875d5793b130b825f11ff9da1967b773f43a56bf234d5b093111a389ff7033ca10398b17be6fe0b3b650304c7560463372b5018aaca60a59e0aa959803851338ea8070ab6b5ad972b1df7cbe53084456b30590c2c2f2a367039bc39009aabb216af7056b5cd660ce24659ef7b2971357c9106ee8938926451c05936849e60d9f6aafc9b93f836980a1d05eeb93583978752071ba7fcba0422580c9665cf7529b434a8db591c30bd8303c0aac0cb8633df30d5e15c7a690649ba02897b3595714b1fc3417b6558e52d89ef916c88fd0a0d2d7025a928c78673d598a4a4a753e737425487781cc91aa27f4716223bbbda6401c81022a3c0eda0178f8116b109b78db11bd447abcfba5cd7b7cb9128c13968c04c6f666f8c314f8c1750e307f386abceb7a9d4d75ce70a08f37b55389420da1e25763770f5c668075706cd06067941a604573009a33af8a232ddce790148168d147ab9ff55acb22bf11683b5a736d9116b6a4c22550dcceb891142270a2aa480ca51642411b766137303573086a3c348059cde8dba545c17cfabccdff1180e2009a85eaaf279343b5838e37fb32ae815965fb20ebba23937a20496263153bcb6c74b5bfe102219c1bfeb8bd9b29375cb738c3a3a8715873da65ca9f948b7d91940445555dd866d16cc3885877328bb337bb3058b37d15fa680d932263bcbfd423ab0bf36e600cb1a00042ae195dcac219c77b57b3f39f9a538fcfa11b8473470534c6dd827f61c90706a7cc6eeb2fcd31910b449751e66924ac588ca42efcb79a479951a72932b7a25f30424d85b5c9a39322db357d46d132d1daa76a1a0526810c79bb20cf07280a474d1c4a79f57b2aee66730200a819806d7ea7155d36b22c99554f8a0fdbec3a1dc733fab7c9218738a9a0c1658072c7f69db680b0a1ba5377f78491470748e5a8fb7351cd3a0e6f24126be304bda6b6a6189fc112a8406357d3744d9b03b1101a60a55cb394b59408401d5f71c7c77a383f09cc90a33349230bc00b9935b6879906263859c956125c989a6808cb9f1f190d6a2348dc659b4dfab80681bed5e9244e738b1ffaa9dd93cc3a59aa4bbaa22b1261351aa577a073e2d30436830da423000bb59f7b89c9ccf9925f5875fe3490808085b0b517e6845a430491f8c14ab8a60bbae995318bdecd5c4abef5b37fbf1b121222a146c5662e8209684c64494b4ade3c5bbdaae15b547ede3afb559fc39b79bf247355001d0020c5662e8209684c64494b4ade3c5bbdaae15b547ede3afb559fc39b79","tls_ja3":["2196848d251b217de8b2c037e356c11d"],"http_akin":["a11cun040_0000004b_469eb43f"]},"fingerprint_peers":{"t13i131000_f57a46bbacb6_ab7e3b40a677":5121,"a11cun040_0000004b_469eb43f":2},"akin_families":{},"user_agents":["Mozilla/5.0 (X11; Linux x86_64) dpwn-banner/1"],"timeline":[{"date":"2026-09-23","count":4}],"recent_events":[{"timestamp":"2026-09-23T13:35:04","port":4222,"proto":"tcp","app_proto":"","app_protocol":"http","host":"185.228.81.201","headers":"{\"accept\":\"*/*\",\"connection\":\"close\",\"host\":\"185.228.81.201:4222\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64) dpwn-banner/1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a203138352e3232382e38312e3230313a343232320d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f363429206470776e2d62616e6e65722f310d0a436f6e6e656374696f6e3a20636c6f73650d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64) dpwn-banner/1","ja3":"","session":"79dedb5b-46a4-439c-b990-6901c0363bdb","seq":1,"duration_ms":100,"bytes_in":136,"bytes_out":79},{"timestamp":"2026-09-23T13:35:03","port":4222,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"185.228.81.201","headers":"{\"accept\":\"*/*\",\"connection\":\"close\",\"host\":\"185.228.81.201:4222\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64) dpwn-banner/1\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a203138352e3232382e38312e3230313a343232320d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f363429206470776e2d62616e6e65722f310d0a436f6e6e656374696f6e3a20636c6f73650d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64) dpwn-banner/1","ja3":"2196848d251b217de8b2c037e356c11d","session":"f4e8d0a5-f86b-4131-8a81-9a204f9d013f","seq":1,"duration_ms":100,"bytes_in":136,"bytes_out":79},{"timestamp":"2026-09-23T12:17:15","port":4222,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:4222\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64) dpwn-banner/1\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a343232320d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f363429206470776e2d62616e6e65722f310d0a436f6e6e656374696f6e3a20636c6f73650d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64) dpwn-banner/1","ja3":"2196848d251b217de8b2c037e356c11d","session":"bee200e3-10fd-44df-93c2-96589a20f03c","seq":1,"duration_ms":100,"bytes_in":135,"bytes_out":79},{"timestamp":"2026-09-23T12:17:15","port":4222,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:4222\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64) dpwn-banner/1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a343232320d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f363429206470776e2d62616e6e65722f310d0a436f6e6e656374696f6e3a20636c6f73650d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64) dpwn-banner/1","ja3":"","session":"03c72af8-ef8a-4ecd-aae0-e57bc1bf4de8","seq":1,"duration_ms":100,"bytes_in":135,"bytes_out":79}],"http_methods":[{"method":"GET","count":4}],"distinct_ports_total":1,"top_paths":[{"path":"/","count":4,"ports":1}],"distinct_paths_total":1,"top_snis":[],"top_hosts":[{"value":"185.228.81.201","count":2}],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","Connection","Host","User-Agent"],"representative":[{"name":"Accept","value":"*/*","notable":false},{"name":"Connection","value":"close","notable":false},{"name":"Host","value":"185.228.81.201:4222","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (X11; Linux x86_64) dpwn-banner/1","notable":false}],"distinct_sets":1,"events_with_headers":4},"tags":[],"data_as_of":"2026-09-23T15:10:31.823050+00:00"}