{"ip":"209.99.190.110","observed":true,"total_events":69,"verdict":{"verdict":"probing","label":"Low-level probing","detail":null,"confidence":"low","network_type":"network services","why":["69 event(s), fewer than 10 distinct ports, no exploit payloads.","Not in any known-scanner range.","Sent 43,626 bytes despite few ports and no known exploit path: focused interaction with one service, worth a look."],"engagement":{"level":"payload","label":"Sustained payload","detail":"43,626 bytes sent","bytes_sent":43626,"session_seconds":4,"persistent":false},"basis":"first_contact"},"first_seen":"2026-10-05T14:38:58","last_seen":"2026-10-11T23:52:49","events_24h":0,"events_7d":17,"interactive_sessions":0,"interactive_sessions_24h":0,"interactive_sessions_7d":0,"interactive_protocols":[],"geo":{"country_code":"CH","country_name":"Switzerland","region":"Zurich","city":"Zurich","lat":47.3643,"lon":8.5437,"asn":402253,"org":"SKN Subnet & Telecom Ltd"},"source_domain":null,"known_scanners":[],"scanner_tag":null,"cve_matches":[],"malware":[],"udp":null,"interaction":null,"top_ports":[{"port":4222,"proto":"tcp","label":"","count":28},{"port":2222,"proto":"tcp","label":"SSH-alt","count":18},{"port":22,"proto":"tcp","label":"SSH","count":17},{"port":9443,"proto":"tcp","label":"","count":6}],"fingerprints":{"ssh_hassh":["16443846184eafde36765c9bab2f4397"],"tls_ja4":["t13i131000_f57a46bbacb6_ab7e3b40a677"],"tls_client_hello":"16030105c6010005c20303664a811a63945a89c7d65735887b8ae2c68268df8e41e837cdd4437c7e454443208f96b51cc75a7ce3871383cdf7cb055d4ec87903f012bfa45ada49a1c8f95665001ac02bc02fc02cc030cca9cca8c009c013c00ac0141301130213030100055f000b00020100ff010001000017000000120000000500050100000000000a000c000a11ec001d001700180019000d0016001408040403080708050806040105010601050306030032001a0018080404030807080508060401050106010503060302010203002b0009080304030303020301003304ea04e811ec04c0d0890562f4ac5c6aab1d67bb9ba0ca4bf19f4fd0c426204d9cc57e4707c27ddba85d36b2fc662875e5c07662850ca5aba48b92a389b3269a3384884bae08b5baf94786e8104f203c0d3c052586ae3bb983451a1c837c1d28304ca18acb3557299859588cda809bb45a08896fb2999cbfa4296341adb3a42be73532bf41307a552711d7140e367694619b8e14137fb0cf2ef95e4740b97007105457582bcaa291431ab7806bb3eaa2539a59756b778e818b59138eb5ba788a658029b6677c1706109848c6781cea0bcb1fab00242cad5f407801865a6794ce55fcbdae635a9e3291a63a0567507eefc1c6bd485cc1e21dcf33825ca53d778782b00a1e8bc0c972334ba44ab9f2c0692d9035dfd879c62b5206c938dcd1a6c53b2931089c388c21d2957575c0138d7b3c51091b03a77078cbcc591b95b27a06f28024f30258f11583d1c42563708333481b4c31bcf40977fd17409f170ad613b65ea1baeb71a71d371cc11946d79bbba311a0165b690da6b710b5c67b02901a824d0e8b5905a45b76fa33f7f8661d502ee5c7946a435549bc7778701fdb62358d1412f6b77cc4c58c7381c996969156cc42bc7abf22a58d95b6697f364e1c57a4eb75136cd63b376a62176831bb27b1aa827b9e4a1fa98cc2b211ce3722ba0c991d7bf84dd349a372b426ebd221d50b20fc8b5e53bb9c40a1331f87b78a680e2115b62eb3c7d45797b8c971983ca31012b7d877cb9d345e93b7c798d74b680039b8099e1a37473cd968a21aa297716886d8a1b63090ebb8b506c6c4fb33854f7108b7b7610574aa273c7386d3379770693aa203995cc10042569e8224625c04702a0142cb3cc995b669b3cfd7db7eff510189424fccc4c370ebc8336413513526b3cc019b184027130183e8208f61a583aa20ece9c629923949f1639a000c8fd54b44a66ff73b87b08661acb32fbcc8a7601443cb8c8483044ff6176d17277830a8a50c14285d659e77dc1a1a2657fb07a313ccc023f455a0d6a5fb1ace2a11812bd8bcaac7884c4aa100fc5dc0322af726084fbb0a4f205bb3acc237476b5f8674f78aaad5ac4664238651644e99d7acf1279bb86c4c6548cdf6a301718831466492d861b5a6c85417b880d4b6b95fc6669ed7c085a146e05b1a3ee53dab440b5e91c02188c45fec5ff249ba4cc4483237341394a4b21cc17fdc0cba25b35dbc4699f7a16c858ba598ba2b8500965548edbb7b0a515ea993ab5350ce3826890a787a75c7b22b57c57d8464fc28a93ba791182ca0bb669f570c94586030327112b4e551c2a9a69dabae41d4706a1c353951ccb663b5b0b2972e3288a094180ec0c8710b3fc360bf8c2b52ed748919732550d2ab5f1c706fc0b07657b5e7795db8185a06625ab7e620586a09ad78bc42c7a449e7ce410c4527651a28ac1a8551c28ed93a98685743bbcbd764985ce5602bb2705281599e710ec45c74d124a5958853f3eb505cc28a0a5a0c8663c1cca92f6f92a2a0f5845ef0a4b4e621fe6682efa635b6a5a8ff5c613f1b7f4296413110a9c7a49cbf696cd6503b5280a80ce36ccd5225a394041cb71a8064b434a29b944790cec0ccb5bb073dc35be757686ea215f26569e2e1196ae0a72889f8641a9c081a34bcc3ddcbb16ec3900e2d8b68b77ea4f6364112509eafdc5b3ef413f6cb2aff47cb68e4172d8854f4020242e98ffde92babfa887b001d00209eafdc5b3ef413f6cb2aff47cb68e4172d8854f4020242e98ffde92b","tls_ja3":["2196848d251b217de8b2c037e356c11d"],"http_akin":["b11cun040_00040015_4c87b06e"],"interactive":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[]}},"fingerprint_peers":{"t13i131000_f57a46bbacb6_ab7e3b40a677":3145,"b11cun040_00040015_4c87b06e":302,"16443846184eafde36765c9bab2f4397":41},"akin_families":{"b11cun040_00040015_4c87b06e":{"head":"b11cun040_00040015_4c87b06e","shapes":5,"ips":302}},"user_agents":["Mozilla/5.0 (X11; Linux x86_64) dpwn-banner/1"],"timeline":[{"date":"2026-10-05","count":6},{"date":"2026-10-06","count":2},{"date":"2026-10-07","count":14},{"date":"2026-10-08","count":6},{"date":"2026-10-09","count":22},{"date":"2026-10-10","count":9},{"date":"2026-10-11","count":10}],"recent_events":[{"timestamp":"2026-10-11T23:52:49","port":4222,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:4222\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64) dpwn-banner/1\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a343232320d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f363429206470776e2d62616e6e65722f310d0a436f6e6e656374696f6e3a20636c6f73650d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64) dpwn-banner/1","ja3":"2196848d251b217de8b2c037e356c11d","session":"b279098d-e641-4179-b959-7a9a9bf1661b","seq":1,"duration_ms":101,"bytes_in":135,"bytes_out":79},{"timestamp":"2026-10-11T23:52:49","port":4222,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:4222\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64) dpwn-banner/1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a343232320d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f363429206470776e2d62616e6e65722f310d0a436f6e6e656374696f6e3a20636c6f73650d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64) dpwn-banner/1","ja3":"","session":"65671d19-2f42-4b9a-bf4f-d53cb38a42cf","seq":1,"duration_ms":110,"bytes_in":135,"bytes_out":79},{"timestamp":"2026-10-11T21:49:43","port":4222,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:4222\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64) dpwn-banner/1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a343232320d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f363429206470776e2d62616e6e65722f310d0a436f6e6e656374696f6e3a20636c6f73650d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64) dpwn-banner/1","ja3":"","session":"47854e1d-c176-427f-a521-2ab507da57bc","seq":1,"duration_ms":100,"bytes_in":135,"bytes_out":79},{"timestamp":"2026-10-11T21:49:42","port":4222,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:4222\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64) dpwn-banner/1\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a343232320d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f363429206470776e2d62616e6e65722f310d0a436f6e6e656374696f6e3a20636c6f73650d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64) dpwn-banner/1","ja3":"2196848d251b217de8b2c037e356c11d","session":"b9f2d953-7167-4f15-bfbe-6852dc97caf0","seq":1,"duration_ms":100,"bytes_in":135,"bytes_out":79},{"timestamp":"2026-10-11T09:10:59","port":9443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:9443\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64) dpwn-banner/1\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a393434330d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f363429206470776e2d62616e6e65722f310d0a436f6e6e656374696f6e3a20636c6f73650d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64) dpwn-banner/1","ja3":"2196848d251b217de8b2c037e356c11d","session":"4777f910-f2b7-43f3-a3f4-2d9423424bc8","seq":1,"duration_ms":100,"bytes_in":135,"bytes_out":79},{"timestamp":"2026-10-11T09:10:59","port":9443,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:9443\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64) dpwn-banner/1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a393434330d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f363429206470776e2d62616e6e65722f310d0a436f6e6e656374696f6e3a20636c6f73650d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64) dpwn-banner/1","ja3":"","session":"7be9bffe-d3f3-4a37-848e-66acef66647a","seq":1,"duration_ms":101,"bytes_in":135,"bytes_out":79},{"timestamp":"2026-10-11T09:04:22","port":9443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:9443\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64) dpwn-banner/1\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a393434330d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f363429206470776e2d62616e6e65722f310d0a436f6e6e656374696f6e3a20636c6f73650d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64) dpwn-banner/1","ja3":"2196848d251b217de8b2c037e356c11d","session":"9ea32945-9b3d-40f5-9d2b-6f6f62d62b92","seq":1,"duration_ms":100,"bytes_in":134,"bytes_out":79},{"timestamp":"2026-10-11T09:04:22","port":9443,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:9443\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64) dpwn-banner/1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a393434330d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f363429206470776e2d62616e6e65722f310d0a436f6e6e656374696f6e3a20636c6f73650d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64) dpwn-banner/1","ja3":"","session":"f836f8a8-46ec-4a23-bc7f-7285b2b32631","seq":1,"duration_ms":100,"bytes_in":134,"bytes_out":79},{"timestamp":"2026-10-11T03:40:29","port":9443,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:9443\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64) dpwn-banner/1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a393434330d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f363429206470776e2d62616e6e65722f310d0a436f6e6e656374696f6e3a20636c6f73650d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64) dpwn-banner/1","ja3":"","session":"2c5594f6-7525-4890-9d71-7bb58dc87bb7","seq":1,"duration_ms":100,"bytes_in":136,"bytes_out":79},{"timestamp":"2026-10-11T03:40:28","port":9443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:9443\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64) dpwn-banner/1\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a393434330d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f363429206470776e2d62616e6e65722f310d0a436f6e6e656374696f6e3a20636c6f73650d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64) dpwn-banner/1","ja3":"2196848d251b217de8b2c037e356c11d","session":"439a9bff-322a-473f-898f-c253183b89a6","seq":1,"duration_ms":100,"bytes_in":136,"bytes_out":79}],"http_methods":[{"method":"GET","count":34}],"distinct_ports_total":4,"top_paths":[{"path":"/","count":34,"ports":2}],"distinct_paths_total":1,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[{"value":"SSH-2.0-Go","count":34}],"credentials":[],"header_profile":{"signature":["Accept","Connection","Host","User-Agent"],"representative":[{"name":"Accept","value":"*/*","notable":false},{"name":"Connection","value":"close","notable":false},{"name":"Host","value":"<HONEYPOT>:4222","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (X11; Linux x86_64) dpwn-banner/1","notable":false}],"distinct_sets":1,"events_with_headers":10},"tags":[],"data_as_of":"2026-10-17T04:32:55.266302+00:00"}