{"ip":"216.226.78.10","total_events":58,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"23+ ports swept","confidence":"medium","network_type":null,"why":["No exploit payloads observed.","Swept 23 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"20,300 bytes sent","bytes_sent":20300,"session_seconds":0,"persistent":false}},"first_seen":"2026-09-24T15:37:08","last_seen":"2026-09-28T20:23:20","events_24h":8,"events_7d":58,"geo":{"country_code":"US","country_name":"United States","region":"","city":"","lat":37.751,"lon":-97.822,"asn":50219,"org":"Valence Technology Co."},"source_domain":null,"known_scanners":[],"scanner_tag":null,"cve_matches":[],"malware":[],"top_ports":[{"port":3389,"proto":"tcp","label":"RDP","count":10},{"port":52869,"proto":"tcp","label":"","count":4},{"port":9022,"proto":"tcp","label":"","count":3},{"port":2202,"proto":"tcp","label":"","count":3},{"port":27017,"proto":"tcp","label":"MongoDB","count":3},{"port":5656,"proto":"tcp","label":"","count":3},{"port":8899,"proto":"tcp","label":"","count":2},{"port":8080,"proto":"tcp","label":"HTTP-alt","count":2},{"port":5357,"proto":"tcp","label":"","count":2},{"port":4433,"proto":"tcp","label":"","count":2},{"port":10443,"proto":"tcp","label":"","count":2},{"port":8003,"proto":"tcp","label":"","count":2},{"port":444,"proto":"tcp","label":"","count":2},{"port":24442,"proto":"tcp","label":"","count":2},{"port":85,"proto":"tcp","label":"","count":2}],"fingerprints":{"ssh_hassh":["9052c4ab4164c78256e71143dcfc7eac"],"tls_ja4":["t13i3012h2_1d37bd780c83_8537cf56674e","t13i150900_8daaf6152771_18e8a06d9b2d"],"tls_client_hello":"160301060a0100060603036aa787b203defddc66a0af8308c6aff9407e8dca7f95a2a15ddd0fdd381ddc1b20b2c39d6d3d8111d6a62bb29257d183afba26484986b428ae5d92a095c5c5167f003c130213031301c02cc030009fcca9cca8ccaac02bc02f009ec024c028006bc023c0270067c00ac0140039c009c0130033009d009c003d003c0035002f01000581ff01000100000b000403000102000a0012001011ec001d0017001e00180019010001010010000e000c02683208687474702f312e31001600000017000000310000000d0036003409050906090404030503060308070808081a081b081c0809080a080b080408050806040105010601030303010302040205020602002b00050403040303002d00020101003304ea04e811ec04c0f9170d5d03512049865f83333a72cd1eb1162bf90ef6f36d52e137ef121759c862d8e705cc9b0e68f306dae9666a972346e08af3e43a866c9b210b3f57c3a25c1840523a4d0c71b6f5816921b80e30d55a8beb7005c99c21819a5733b59a941864851b131712d928093167b33ea07f6b0144c1489525751efda412c7e356291c180ecabe4dc99c3955051698711d93323eb78568328e6ae10a2ec43f334bbe05a26887671d5c175ba08ab35807321c4169c372a5d254231fdb1c5231bf8420a87fa69ffd9b48480814d32b3e1e3cbffbfcbb8c104efe42703a1c8ba4854fcc671d00f40b90d6277f632f177627c9a230a49929046959a24cb2c2fb9321e5cd3de3ca46792f12e64f10b9082db32a15f53e236c6e4ef995691ccb158b65950622eef632cd95723c12266d004dd694b7f9ecbf227583fa517a66cb930e55b0e517bd49e771cdc0ab4785ad9898004af30112d067a245cf7c6a7d72aa8e49ea08baf853bc50b6b677b18dda556fc7af27853bada593fbc252a97a0c60c447c8ab0967d741c446a3fd454b1bb97f3d7248058c2526a804c59ba51eac8c95a370ab5481613863c0f99047ca29d9c0b1ee79931e7433d7429e6460526e31cf1ec294d7f40dda5c63af3839fabb19c1c49f1f1cc434ea9f7b98a02186ca109301a776ce08c2b4c9251a1fa355b682cb89d057c23869fce7ad90679635f217b66176cf7703cab48bec982ef2a44179ec6b42432ebce12c58dcb54996889c706a951a595f8bb3e2924b09710f6bcbaa4e35c6817bcc5794ade6d21fac22a655986072acb18d0cce8242350c1722fdac629f8384585b8f4187018bf08970114c822962dd1c844692a7084bca794138eb065d5e773f786b52ffea5c4e12cd807c7eda2c106469082d663cb86a82bc72a9b4774c464140028bc9c290cdb14397a582c3c29285fec143b247728d2ccb75d005fae51b4d5c43a18084cafb5882f06c3fca39607a356009963ab83f5ee463c731c434354ab5e21c07470c8dc66002e415837159ec3166637835098134e172b38f58898e628b976437cac48d7d020eadf75f369767c93726babccc4d8548564b93b7a30033f3993ed354ef2c71b3e5a7c70123d6101c5bc597d9ecb9484370f2b115063864152c958300ba2c222d8af8ae734c7ada244b1c948bd86172674b6dc86576cc9078b7a0a1fbd1531c549a6c42716791ba18faaab8420711c322e893a4cb21027a5a7fbed918c0697f586911c283884dd55651c952f3898a7a45a4a25479f34750a02ca1ae83a312b30acc30232b213e39d145ccc8746699bdbbc02d30fc5af716476915a6ba11c988502945e2a106292a739b91b5f162eff99c65c9bf2bb8c4ac854ca32a05a06c85f679876e423475848f0a250ce0c59010c26cc76aa282372a730030b5a165a3d1ab49d7b63652ab6e56abe32c085422a7ce1866a6218337e6b728140029e75151475b804c322c987d480b7027206041ec7286a34770269f6e7889ba394e2d52635c840dd1153e7ab17eeca7cc9feccba6011964f00b86e219a5c2789353a07b6831f76698233112e3b7584e55cdbea5b6ac502780f652cb6b20f6c2a9372668796762ad83507ad97b21ccedfb0d5b4fcd9722cd39ed725c4c3ed2b38bbb5d3200ddba222ff25c550926ee07ff803a9d52a0d05287d8137b1b77c767f0448e000a92c883418da7ef26001d002050571e856a86478dceed1a79c199bf5d069ef217406d38d695034b8b94a6581e001b00050400010003","tls_ja3":["02fc9e6401d2c8c1bf8f91bd21b8e17e","7587a1ac9a4f17b4e4e5fe226716f4df"],"http_akin":["a11cun030_00000049_54d07b6d","a11cun040_0000004d_aa48e2c8"]},"fingerprint_peers":{"t13i3012h2_1d37bd780c83_8537cf56674e":22,"t13i150900_8daaf6152771_18e8a06d9b2d":26,"9052c4ab4164c78256e71143dcfc7eac":83,"a11cun030_00000049_54d07b6d":2469,"a11cun040_0000004d_aa48e2c8":3281},"akin_families":{"a11cun030_00000049_54d07b6d":{"head":"a11cun030_00000049_54d07b6d","shapes":3,"ips":2473},"a11cun040_0000004d_aa48e2c8":{"head":"a11cun040_0000004d_aa48e2c8","shapes":4,"ips":3280}},"user_agents":["Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36"],"timeline":[{"date":"2026-09-24","count":22},{"date":"2026-09-25","count":16},{"date":"2026-09-26","count":5},{"date":"2026-09-27","count":7},{"date":"2026-09-28","count":8}],"recent_events":[{"timestamp":"2026-09-28T20:23:20","port":4433,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:4433\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/favicon.ico","summary":"","payload_hex":"474554202f66617669636f6e2e69636f20485454502f312e310d0a486f73743a20<HONEYPOT>3a343433330d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3135332e302e302e30205361666172692f3533372e33360d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36","ja3":"7587a1ac9a4f17b4e4e5fe226716f4df","session":"994ad101-9fff-430e-8a51-3293fed24f9f","seq":1,"duration_ms":101,"bytes_in":192,"bytes_out":78},{"timestamp":"2026-09-28T20:22:49","port":4433,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:4433\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a343433330d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3135332e302e302e30205361666172692f3533372e33360d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36","ja3":"02fc9e6401d2c8c1bf8f91bd21b8e17e","session":"af563076-38b3-4d44-951d-318ac525c47c","seq":1,"duration_ms":100,"bytes_in":204,"bytes_out":78},{"timestamp":"2026-09-28T16:31:24","port":8005,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:8005\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/favicon.ico","summary":"","payload_hex":"474554202f66617669636f6e2e69636f20485454502f312e310d0a486f73743a20<HONEYPOT>3a383030350d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3135332e302e302e30205361666172692f3533372e33360d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36","ja3":"","session":"3fa73d78-8525-45cf-bef7-f8c3707569d0","seq":1,"duration_ms":102,"bytes_in":194,"bytes_out":78},{"timestamp":"2026-09-28T16:30:56","port":8005,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:8005\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a383030350d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3135332e302e302e30205361666172692f3533372e33360d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36","ja3":"","session":"35889300-0355-45af-b20a-da092fb2b95a","seq":1,"duration_ms":100,"bytes_in":206,"bytes_out":78},{"timestamp":"2026-09-28T02:51:02","port":9998,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:9998\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/favicon.ico","summary":"","payload_hex":"474554202f66617669636f6e2e69636f20485454502f312e310d0a486f73743a20<HONEYPOT>3a393939380d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3135332e302e302e30205361666172692f3533372e33360d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36","ja3":"7587a1ac9a4f17b4e4e5fe226716f4df","session":"d1ec1bc1-232c-403d-a7e5-7297fa407713","seq":1,"duration_ms":100,"bytes_in":192,"bytes_out":78},{"timestamp":"2026-09-28T02:50:33","port":9998,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:9998\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a393939380d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3135332e302e302e30205361666172692f3533372e33360d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36","ja3":"02fc9e6401d2c8c1bf8f91bd21b8e17e","session":"092ca1a3-b2fd-4b8f-b62e-d6c2cfc32cc2","seq":1,"duration_ms":100,"bytes_in":204,"bytes_out":78},{"timestamp":"2026-09-28T01:09:27","port":9092,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:9092\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/favicon.ico","summary":"","payload_hex":"474554202f66617669636f6e2e69636f20485454502f312e310d0a486f73743a20<HONEYPOT>3a393039320d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3135332e302e302e30205361666172692f3533372e33360d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36","ja3":"7587a1ac9a4f17b4e4e5fe226716f4df","session":"cc043565-553a-4e3d-9e44-e5436b679784","seq":1,"duration_ms":100,"bytes_in":192,"bytes_out":78},{"timestamp":"2026-09-28T01:09:01","port":9092,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:9092\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a393039320d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3135332e302e302e30205361666172692f3533372e33360d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36","ja3":"02fc9e6401d2c8c1bf8f91bd21b8e17e","session":"e1ecb2f6-b396-4146-8c47-08d58e1f17bb","seq":1,"duration_ms":100,"bytes_in":204,"bytes_out":78},{"timestamp":"2026-09-27T11:43:38","port":444,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:444\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/favicon.ico","summary":"","payload_hex":"474554202f66617669636f6e2e69636f20485454502f312e310d0a486f73743a20<HONEYPOT>3a3434340d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3135332e302e302e30205361666172692f3533372e33360d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36","ja3":"7587a1ac9a4f17b4e4e5fe226716f4df","session":"e2c89256-bb26-4ecb-9307-cab8536be8ee","seq":1,"duration_ms":101,"bytes_in":192,"bytes_out":78},{"timestamp":"2026-09-27T11:43:08","port":444,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:444\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a3434340d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3135332e302e302e30205361666172692f3533372e33360d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36","ja3":"02fc9e6401d2c8c1bf8f91bd21b8e17e","session":"1305c53b-662b-4b07-a5e2-a024ce5bcbe7","seq":1,"duration_ms":100,"bytes_in":204,"bytes_out":78}],"http_methods":[{"method":"GET","count":40}],"distinct_ports_total":23,"top_paths":[{"path":"/","count":20,"ports":19},{"path":"/favicon.ico","count":20,"ports":19}],"distinct_paths_total":2,"top_snis":[],"top_hosts":[],"top_alpns":[{"value":"h2, http/1.1","count":12}],"banners":[{"value":"SSH-2.0-OpenSSH_9.2p1 Debian-2+deb12u7","count":5}],"credentials":[],"header_profile":{"signature":["Accept","Accept-Encoding","Host","User-Agent"],"representative":[{"name":"Accept","value":"*/*","notable":false},{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Host","value":"<HONEYPOT>:4433","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36","notable":false}],"distinct_sets":2,"events_with_headers":10},"tags":[],"data_as_of":"2026-09-28T20:50:20.353449+00:00"}