{"ip":"209.99.187.232","total_events":994,"verdict":{"verdict":"scanning","label":"Sustained targeting","detail":"994 events across 7 port(s)","confidence":"medium","network_type":"network services","why":["994 requests against only 7 service(s), which is depth rather than a sweep.","Typical of credential stuffing or a single-service campaign; the median address here sends three requests.","No exploit payload observed, so this describes volume and focus, not a confirmed compromise attempt.","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"59,033 bytes sent","bytes_sent":59033,"session_seconds":6,"persistent":false}},"first_seen":"2026-10-06T06:45:23","last_seen":"2026-10-06T06:52:28","events_24h":994,"events_7d":994,"geo":{"country_code":"CH","country_name":"Switzerland","region":"Zurich","city":"Zurich","lat":47.3643,"lon":8.5437,"asn":402253,"org":"SKN Subnet & Telecom Ltd"},"source_domain":null,"known_scanners":[],"scanner_tag":null,"cve_matches":[],"malware":[],"udp":null,"top_ports":[{"port":8080,"proto":"tcp","label":"HTTP-alt","count":166},{"port":80,"proto":"tcp","label":"HTTP","count":164},{"port":25565,"proto":"tcp","label":"Minecraft","count":150},{"port":4330,"proto":"tcp","label":"","count":148},{"port":20241,"proto":"tcp","label":"","count":148},{"port":443,"proto":"tcp","label":"HTTPS","count":144},{"port":22,"proto":"tcp","label":"SSH","count":74}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i971000_632ec8b724d6_ec21bdc2dd35"],"tls_client_hello":"16030106810100067d0303e24851bd56cae65a77ea70b7ae5fc128056d1771ca8231dc79f00c9e8c2d07572096a85a2bc2950c7be4a567fe5bc8a1e6574e4cbb43e3b54cb4d292707910058200c21302130313010002000100330039003a0035002f0034c006c010c015003bc02cc03000a3009fcca9cca8ccaac0adc09fc05dc061c057c05300a7c02bc02f00a2009ec0acc09ec05cc060c056c05200a6c0afc0aec0a3c0a2c024c028006b006ac073c07700c400c3006d00c5c023c02700670040c072c07600be00bd006c00bfc00ac014003800880087c0190089c009c0130032009a009900450044c018009b0046009dc09dc051009cc09cc050c0a1c0a0003d00c0003c00ba00840096004100ff01000572000b00020100000a0012001011ec001d0017001e0018001901000101002300000016000000170000000d003c003a09050906090404030503060308070808081a081b081c0809080a080b080408050806040105010601030302030301020103020202040205020602002b0009080304030303020301002d00020101003304ea04e811ec04c07a37b06a622dd83b9f6b82cd0528b9d8a857dde23c87303dc3a83f6c6893f1bc82205362df7144a6401854b524a6f7a635c32f95c43171b81acff161c8b0ba7b75bff8fcc6cd4b53b6167af133035aea2f25c113cc76bcb52445305a2578c5b2e607751bc38d4556155383626f9289a3ab65bb1462de748c1ad249d2c73170db79b2365de5a140dae112b71c5f3cb22adc276aaa2a3b0c9cc123147b59591a022538196c1b01682f20ac73f63a7cb4a4a039e542266920dc0bb415e011144b35ce7a9adf3b1e69bb0a9f31242943b029490a74e5730b52590064704571cc17da7eb7b292e01899bc1c689b38924e959aef388ed04642060468c7a8ae9528537740240b399781074e9ba04685cc6e1426475d796190114de6681dae7bce85cb44b10154e060b42d0186e0c80e175436fe1133a757bd7e2b6879d50312eb49f1a03f41b872f77962ea7b84b822b9f00bbdf8435b23e6ce50a4c8c2c0625631a1582a573f1247a4252f3a02af201389fc0a5bab1ac14b406931135a7b966eccec3e698791dcaccba61432ca1766291b5ebd43b386b1aff78437bb35ba1b6502eaba8ce1381a41ea8736082daff7928a5714ab0ac00284baf6f99ba335784b7445c3881c7151b1a4e5176cfb868395a84f9299a69156e519a1f1e13dfd36b00049451f0a786f23589443cffac934072c9a4a8810ece9b42df9a849a93d1243883f40c775a439ca58a738f8b7c5ac894c982ba4605561a7aab5051db796c644913bf0cb6b4b895bfd1bcccc7662b98417b8499869442a95f6c37c71c48f31742e007a6292070d31463bca384e38cdf7064b31a06a6b32c0b0889066e57a93763fd1d0cfc94749ab24b207f149eeb01d04422226a4589c5a01ef2284e1f12b6a21573136112b866aa4053c5fc5672c126137e039ee34bbdec87f08e81731169b22d426a24934bc8bac528224c0ec0d30927fe9a13ffd82c1de9301b3e9b4d62ccf794400963bb1ef14cd4426b504a34ba899017ee96380d90869996af1214dce72c9e035024b0689f7f367308666cc41159212afc0184737a49ed56817cb17ca9f97cac41114b1fa4338ba67f01693ad515c5c91b943d9b4d59b0954c0a12ef23e22b895d831bc2d02b3b7d2cbe5cc31d76190d70aa561049a39f6b071fa1288892eb0c785b9628b9ab16e1dd42bb758a96b96cc69e1a0b07ca103f8207bfb99e162089b074ecd336287c705e2ac018a8c38571bc675c843e3f58655253375e965c5393831bc614d5512c12797f96c87b81986f585ad4cf8ae85b25508811263748a2f5b3a57366f101431d692ac7954465bea25d9e25145a8b206808913c63f043b775cfb8e154228ecf83ddfd56f7e7921bac60037b9cfa30b987d13ca61d9230759b7fb6212c240aa9f32a4f1264ab59879d2bc070c68820bda3224932e2a277c9fd7c423c867b43a6458348531913aaab98d09f77ff0f6c70ed7bf56a24d322abc2d1caa6b1ab71f98bed928b5b2c1a4ba4616e452c9df8a3f0e228a64e052dcf9312c22255eba47e5720076db263ee87d2095486cfc7ff807070d7549993b06e6b3afaf368ca424722140cd2fb67b95453122949d93d0292b64664f849584a77e35db069523afb372f05ba8496cbf6412ae529857b729c55c4869dd4c8c09828d7741c89feca9a6396d72b7344249a46e99c9d3daa3a2d2aa48506eea01c6bf71001d00203bcd0b1fe0380a50839925d39a46ecda0d43ce8669e28aa0dc00c7ca7fb9cb4e001b000504000100","tls_ja3":["e06619a103d1efc8cabda2542b88e6a8"],"http_akin":["b11cun030_00040011_c91eaf54","b11cun021_00000010_724c10fb_xd9b8","b11cun000_00000000_334359b9","b10cun000_00000000_334359b9"]},"fingerprint_peers":{"b11cun030_00040011_c91eaf54":664,"b11cun000_00000000_334359b9":77,"b10cun000_00000000_334359b9":2216,"t13i971000_632ec8b724d6_ec21bdc2dd35":2,"b11cun021_00000010_724c10fb_xd9b8":1},"akin_families":{"b10cun000_00000000_334359b9":{"head":"b10cun000_00000000_334359b9","shapes":2,"ips":2215}},"user_agents":["Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html)","iPhoto/9.1.1  (Macintosh; N; PPC)"],"timeline":[{"date":"2026-10-06","count":994}],"recent_events":[{"timestamp":"2026-10-06T06:52:28","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>-host.colocrossing.com","headers":"{\"host\":\"<HONEYPOT>-host.colocrossing.com\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a203139322d332d3131382d3134362d686f73742e636f6c6f63726f7373696e672e636f6d0d0a0d0a","method":"GET","user_agent":"","ja3":"e06619a103d1efc8cabda2542b88e6a8","session":"f9888c46-d1b5-47a6-a754-7d3c1c7fddcf","seq":1,"duration_ms":220,"bytes_in":61,"bytes_out":79},{"timestamp":"2026-10-06T06:52:27","port":8080,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e300d0a0d0a","method":"GET","user_agent":"","ja3":"e06619a103d1efc8cabda2542b88e6a8","session":"922908cb-a433-48ec-af0c-bc984172f7fb","seq":1,"duration_ms":117,"bytes_in":18,"bytes_out":79},{"timestamp":"2026-10-06T06:52:27","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"132.183.175.5.servitro.com","headers":"{\"host\":\"132.183.175.5.servitro.com\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a203133322e3138332e3137352e352e736572766974726f2e636f6d0d0a0d0a","method":"GET","user_agent":"","ja3":"e06619a103d1efc8cabda2542b88e6a8","session":"eae4bad0-618f-4073-92c5-985793654d67","seq":1,"duration_ms":119,"bytes_in":52,"bytes_out":79},{"timestamp":"2026-10-06T06:52:27","port":80,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"132.183.175.5.servitro.com","headers":"{\"host\":\"132.183.175.5.servitro.com\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a203133322e3138332e3137352e352e736572766974726f2e636f6d0d0a0d0a","method":"GET","user_agent":"","ja3":"e06619a103d1efc8cabda2542b88e6a8","session":"2362befb-c9dc-4dcc-aa39-e3e3ce10ef46","seq":1,"duration_ms":117,"bytes_in":52,"bytes_out":79},{"timestamp":"2026-10-06T06:52:27","port":8080,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"132.183.175.5.servitro.com","headers":"{\"host\":\"132.183.175.5.servitro.com\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a203133322e3138332e3137352e352e736572766974726f2e636f6d0d0a0d0a","method":"GET","user_agent":"","ja3":"e06619a103d1efc8cabda2542b88e6a8","session":"4b154a64-d160-428b-b3cc-8402f4b06313","seq":1,"duration_ms":117,"bytes_in":52,"bytes_out":79},{"timestamp":"2026-10-06T06:52:27","port":8080,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e300d0a0d0a","method":"GET","user_agent":"","ja3":"e06619a103d1efc8cabda2542b88e6a8","session":"eb879749-0d90-47fa-a77d-0f24d898937e","seq":1,"duration_ms":214,"bytes_in":18,"bytes_out":79},{"timestamp":"2026-10-06T06:52:27","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e300d0a0d0a","method":"GET","user_agent":"","ja3":"e06619a103d1efc8cabda2542b88e6a8","session":"4893254f-761f-46d1-add3-3e4e7e0ab0e1","seq":1,"duration_ms":217,"bytes_in":18,"bytes_out":79},{"timestamp":"2026-10-06T06:52:27","port":80,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e300d0a0d0a","method":"GET","user_agent":"","ja3":"e06619a103d1efc8cabda2542b88e6a8","session":"442fc08a-c789-48fe-a33d-60b75b583bea","seq":1,"duration_ms":218,"bytes_in":18,"bytes_out":79},{"timestamp":"2026-10-06T06:52:27","port":8080,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>-host.colocrossing.com","headers":"{\"host\":\"<HONEYPOT>-host.colocrossing.com\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a203139322d332d3131382d3134362d686f73742e636f6c6f63726f7373696e672e636f6d0d0a0d0a","method":"GET","user_agent":"","ja3":"e06619a103d1efc8cabda2542b88e6a8","session":"f0587952-30f2-4664-8946-e95468632f36","seq":1,"duration_ms":211,"bytes_in":61,"bytes_out":79},{"timestamp":"2026-10-06T06:52:27","port":80,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>-host.colocrossing.com","headers":"{\"host\":\"<HONEYPOT>-host.colocrossing.com\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a203139322d332d3131382d3134362d686f73742e636f6c6f63726f7373696e672e636f6d0d0a0d0a","method":"GET","user_agent":"","ja3":"e06619a103d1efc8cabda2542b88e6a8","session":"851b8931-5efc-46a5-b822-b5a521b97887","seq":1,"duration_ms":213,"bytes_in":61,"bytes_out":79}],"http_methods":[{"method":"GET","count":97},{"method":"OPTIONS","count":24},{"method":"POST","count":6}],"distinct_ports_total":7,"top_paths":[{"path":"/","count":60,"ports":7},{"path":"/nice%20ports%2C/Tri%6Eity.txt%2ebak","count":17,"ports":7},{"path":"/?CAVIT","count":13,"ports":7},{"path":"/server-info","count":13,"ports":7},{"path":"/sdk","count":6,"ports":3},{"path":"/NmapUpperCheck1791269545","count":6,"ports":3},{"path":"/nmaplowercheck1791269545","count":6,"ports":3},{"path":"/Nmap/folder/check1791269545","count":6,"ports":3}],"distinct_paths_total":8,"top_snis":[],"top_hosts":[{"value":"132.183.175.5.servitro.com","count":15},{"value":"<HONEYPOT>-host.colocrossing.com","count":15}],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Host"],"representative":[{"name":"Host","value":"<HONEYPOT>-host.colocrossing.com","notable":false}],"distinct_sets":1,"events_with_headers":6},"tags":[],"data_as_of":"2026-10-06T20:36:42.204596+00:00"}