{"ip":"213.209.159.41","data_as_of":"2026-10-24T15:41:56+00:00","observed":true,"total_events":7,"verdict":{"verdict":"probing","label":"Low-level probing","detail":null,"confidence":"low","network_type":null,"why":["7 event(s), fewer than 10 distinct ports, no exploit payloads.","Not in any known-scanner range."],"engagement":{"level":"request","label":"Request traffic","detail":"451 bytes sent","bytes_sent":451,"session_seconds":0,"persistent":false},"basis":"first_contact"},"first_seen":"2026-10-13T04:34:08","last_seen":"2026-10-15T20:25:30","events_24h":0,"events_7d":0,"interactive_sessions":0,"interactive_sessions_24h":0,"interactive_sessions_7d":0,"interactive_protocols":[],"geo":{"country_code":"DE","country_name":"Germany","region":"North Rhine-Westphalia","city":"Aachen","lat":50.7745,"lon":6.0861,"asn":208137,"org":"Feo Prest SRL"},"source_domain":null,"known_scanners":[],"scanner_tag":null,"cve_matches":[],"malware":[],"udp":null,"interaction":null,"top_ports":[{"port":8443,"proto":"tcp","label":"HTTPS-alt","count":2},{"port":902,"proto":"tcp","label":"","count":2},{"port":5000,"proto":"tcp","label":"Web-alt","count":2},{"port":11434,"proto":"tcp","label":"","count":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i311000_e8f1e7e78f70_d41ae481755e"],"tls_client_hello":"1603010200010001fc0303284b6cdf0cd11705711eff4c87f011427a15743e4a7204c0f48e140b8a909bb22060b86f0871a4d4a3497ba6bf75b2149f58ce5243713fadac22dd1da8ae7f95ea003e130213031301c02cc030009fcca9cca8ccaac02bc02f009ec024c028006bc023c0270067c00ac0140039c009c0130033009d009c003d003c0035002f00ff01000175000b000403000102000a00160014001d0017001e0019001801000101010201030104002300000016000000170000000d002a0028040305030603080708080809080a080b080408050806040105010601030303010302040205020602002b00050403040303002d00020101003300260024001d0020df4e592c262eeadfd33bc8db7938cd6f2568569b284b6460da3b6fc91394404c001500dc00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000","tls_ja3":["c12b4ccd5320bbb380ca1a9df90f771d"],"http_akin":["b10cun020_00040010_724c10fb"],"interactive":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[]}},"fingerprint_peers":{"t13i311000_e8f1e7e78f70_d41ae481755e":722,"b10cun020_00040010_724c10fb":41},"akin_families":{},"user_agents":["Mozilla/5.0"],"timeline":[{"date":"2026-10-13","count":1},{"date":"2026-10-15","count":6}],"recent_events":[{"timestamp":"2026-10-15T20:25:30","port":902,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e300d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a0d0a","method":"GET","user_agent":"Mozilla/5.0","ja3":"c12b4ccd5320bbb380ca1a9df90f771d","session":"f2d3d80d-af03-44a6-a118-f0ccd35a159d","seq":1,"duration_ms":197,"bytes_in":64,"bytes_out":79},{"timestamp":"2026-10-15T20:25:25","port":902,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e300d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a0d0a","method":"GET","user_agent":"Mozilla/5.0","ja3":"","session":"5e74132f-bd93-4dec-9619-f1c778d639a6","seq":1,"duration_ms":101,"bytes_in":64,"bytes_out":79},{"timestamp":"2026-10-15T19:37:45","port":8443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e300d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a0d0a","method":"GET","user_agent":"Mozilla/5.0","ja3":"c12b4ccd5320bbb380ca1a9df90f771d","session":"628192e9-327e-4d64-8148-be035c8846b4","seq":1,"duration_ms":196,"bytes_in":63,"bytes_out":79},{"timestamp":"2026-10-15T19:37:38","port":8443,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e300d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a0d0a","method":"GET","user_agent":"Mozilla/5.0","ja3":"","session":"9b139c7f-6654-40b2-a1f9-037ea1d975fa","seq":1,"duration_ms":100,"bytes_in":63,"bytes_out":79},{"timestamp":"2026-10-15T16:02:35","port":5000,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/v2/","summary":"","payload_hex":"474554202f76322f20485454502f312e300d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a0d0a","method":"GET","user_agent":"Mozilla/5.0","ja3":"c12b4ccd5320bbb380ca1a9df90f771d","session":"14b95bcd-4460-4c07-a536-0f6d8bd80fce","seq":1,"duration_ms":112,"bytes_in":67,"bytes_out":79},{"timestamp":"2026-10-15T16:02:29","port":5000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/v2/","summary":"","payload_hex":"474554202f76322f20485454502f312e300d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a0d0a","method":"GET","user_agent":"Mozilla/5.0","ja3":"","session":"a82e1f80-167d-4598-888c-c7e0c163834e","seq":1,"duration_ms":100,"bytes_in":67,"bytes_out":79},{"timestamp":"2026-10-13T04:34:08","port":11434,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e300d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a0d0a","method":"GET","user_agent":"Mozilla/5.0","ja3":"","session":"8ffaf803-749e-4a62-a79c-0cf9cd6960d0","seq":1,"duration_ms":101,"bytes_in":63,"bytes_out":79}],"http_methods":[{"method":"GET","count":7}],"distinct_ports_total":4,"top_paths":[{"path":"/","count":5,"ports":3},{"path":"/v2/","count":2,"ports":1}],"distinct_paths_total":2,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Host","User-Agent"],"representative":[{"name":"Host","value":"<HONEYPOT>","notable":false},{"name":"User-Agent","value":"Mozilla/5.0","notable":false}],"distinct_sets":1,"events_with_headers":7},"tags":[]}