{"ip":"216.245.184.242","total_events":4,"verdict":{"verdict":"probing","label":"Low-level probing","detail":null,"confidence":"low","network_type":null,"why":["4 event(s), fewer than 10 distinct ports, no exploit payloads.","Not in any known-scanner range."],"engagement":{"level":"request","label":"Request traffic","detail":"744 bytes sent","bytes_sent":744,"session_seconds":0,"persistent":false}},"first_seen":"2026-09-17T11:58:14","last_seen":"2026-09-17T13:13:31","events_24h":0,"events_7d":0,"geo":{"country_code":"US","country_name":"United States","region":"Illinois","city":"Chicago","lat":41.8483,"lon":-87.6517,"asn":399629,"org":"BL Networks"},"source_domain":null,"known_scanners":[],"scanner_tag":null,"cve_matches":[],"malware":[],"top_ports":[{"port":443,"proto":"tcp","label":"HTTPS","count":2},{"port":1337,"proto":"tcp","label":"","count":2}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i311000_e8f1e7e78f70_d41ae481755e"],"tls_client_hello":"","tls_ja3":["c12b4ccd5320bbb380ca1a9df90f771d"],"http_akin":["b11cun063_40040001_ffe60107_x9f62a4acfdb1"]},"fingerprint_peers":{"t13i311000_e8f1e7e78f70_d41ae481755e":793,"b11cun063_40040001_ffe60107_x9f62a4acfdb1":6},"akin_families":{},"user_agents":[],"timeline":[{"date":"2026-09-17","count":4}],"recent_events":[{"timestamp":"2026-09-17T13:13:31","port":1337,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"Upgrade\",\"host\":\"<HONEYPOT>\",\"sec-websocket-key\":\"a7EkJlur829g/yNpYWfNXw==\",\"sec-websocket-protocol\":\"chisel-v3\",\"sec-websocket-version\":\"13\",\"upgrade\":\"websocket\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557067726164653a20776562736f636b65740d0a436f6e6e656374696f6e3a20557067726164650d0a5365632d576562536f636b65742d4b65793a206137456b4a6c7572383239672f794e705957664e58773d3d0d0a5365632d576562536f636b65742d56657273696f6e3a2031330d0a5365632d576562536f636b65742d50726f746f636f6c3a2063686973656c2d76330d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"a1c822fa-5745-48b0-9268-e2b224ec4188","seq":1,"duration_ms":100,"bytes_in":186,"bytes_out":80},{"timestamp":"2026-09-17T13:13:31","port":1337,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"Upgrade\",\"host\":\"<HONEYPOT>\",\"sec-websocket-key\":\"/oFCAJ63VyP2jtLSnxQ5qQ==\",\"sec-websocket-protocol\":\"chisel-v3\",\"sec-websocket-version\":\"13\",\"upgrade\":\"websocket\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557067726164653a20776562736f636b65740d0a436f6e6e656374696f6e3a20557067726164650d0a5365632d576562536f636b65742d4b65793a202f6f4643414a3633567950326a744c536e78513571513d3d0d0a5365632d576562536f636b65742d56657273696f6e3a2031330d0a5365632d576562536f636b65742d50726f746f636f6c3a2063686973656c2d76330d0a0d0a","method":"GET","user_agent":"","ja3":"c12b4ccd5320bbb380ca1a9df90f771d","session":"1599bb93-c294-4f90-9146-7ff46ed45588","seq":1,"duration_ms":100,"bytes_in":186,"bytes_out":80},{"timestamp":"2026-09-17T11:58:14","port":443,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"Upgrade\",\"host\":\"<HONEYPOT>\",\"sec-websocket-key\":\"AK18BvWYSE0qSM9K2Rn2Jw==\",\"sec-websocket-protocol\":\"chisel-v3\",\"sec-websocket-version\":\"13\",\"upgrade\":\"websocket\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557067726164653a20776562736f636b65740d0a436f6e6e656374696f6e3a20557067726164650d0a5365632d576562536f636b65742d4b65793a20414b31384276575953453071534d394b32526e324a773d3d0d0a5365632d576562536f636b65742d56657273696f6e3a2031330d0a5365632d576562536f636b65742d50726f746f636f6c3a2063686973656c2d76330d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"915cca75-ea9b-41f0-8469-f44db1a885e7","seq":1,"duration_ms":100,"bytes_in":186,"bytes_out":80},{"timestamp":"2026-09-17T11:58:14","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"Upgrade\",\"host\":\"<HONEYPOT>\",\"sec-websocket-key\":\"hPH7W8YVQ3g1TuAq76/rcg==\",\"sec-websocket-protocol\":\"chisel-v3\",\"sec-websocket-version\":\"13\",\"upgrade\":\"websocket\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557067726164653a20776562736f636b65740d0a436f6e6e656374696f6e3a20557067726164650d0a5365632d576562536f636b65742d4b65793a206850483757385956513367315475417137362f7263673d3d0d0a5365632d576562536f636b65742d56657273696f6e3a2031330d0a5365632d576562536f636b65742d50726f746f636f6c3a2063686973656c2d76330d0a0d0a","method":"GET","user_agent":"","ja3":"c12b4ccd5320bbb380ca1a9df90f771d","session":"1283446e-b4a2-4007-b33d-4f5e58278a14","seq":1,"duration_ms":100,"bytes_in":186,"bytes_out":80}],"http_methods":[{"method":"GET","count":4}],"distinct_ports_total":2,"top_paths":[{"path":"/","count":4,"ports":2}],"distinct_paths_total":1,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Connection","Host","Sec-Websocket-Key","Sec-Websocket-Protocol","Sec-Websocket-Version","Upgrade"],"representative":[{"name":"Connection","value":"Upgrade","notable":false},{"name":"Host","value":"<HONEYPOT>","notable":false},{"name":"Sec-Websocket-Key","value":"a7EkJlur829g/yNpYWfNXw==","notable":false},{"name":"Sec-Websocket-Protocol","value":"chisel-v3","notable":false},{"name":"Sec-Websocket-Version","value":"13","notable":false},{"name":"Upgrade","value":"websocket","notable":false}],"distinct_sets":1,"events_with_headers":4},"tags":[],"data_as_of":"2026-09-30T17:03:41.090731+00:00"}