{"ip":"216.25.89.116","total_events":7,"verdict":{"verdict":"scanner","label":"Recognized scanner","detail":"paloaltonetworks","confidence":"high","network_type":null,"why":["Source IP is in a known scanner range (paloaltonetworks).","Known research and commercial scanners are labelled as such, not as threats."],"engagement":{"level":"request","label":"Request traffic","detail":"1,141 bytes sent","bytes_sent":1141,"session_seconds":0,"persistent":false}},"first_seen":"2026-07-04T04:46:45","last_seen":"2026-09-28T08:29:08","events_24h":0,"events_7d":0,"geo":{"country_code":"US","country_name":"United States","region":"","city":"","lat":37.751,"lon":-97.822,"asn":396982,"org":"Google LLC"},"source_domain":null,"known_scanners":["paloaltonetworks"],"scanner_tag":null,"cve_matches":[],"malware":[],"udp":{"source_verified":false,"window_days":90,"events":1,"protocols":[{"protocol":"udp","events":1}],"ports":[{"port":161,"events":1}],"dns_questions":[],"quic_clients":[],"first_seen":"2026-10-05T15:35:04","last_seen":"2026-10-05T15:35:04","recent":[{"timestamp":"2026-10-05T15:35:04","port":161,"src_port":57340,"proto":"udp","app_proto":"","app_protocol":"snmp","summary":"0)\u0002\u0001\u0000\u0004\u0006public�\u001c\u0002\u0004VZ�]\u0002\u0001\u0000\u0002\u0001\u00000\u000e0\f\u0006\b+\u0006\u0001\u0002\u0001\u0001\u0001\u0000\u0005\u0000","payload_hex":"302902010004067075626c6963a01c0204565adc5d020100020100300e300c06082b060102010101000500","sni":"","session":"2d6d9279-029a-4f21-aafa-59d14ba7c99a","bytes_in":43,"source_verified":false,"enriched":{"digest":"e30221c9ba6bc672","strings":["public"]}}]},"top_ports":[{"port":9093,"proto":"tcp","label":"","count":4},{"port":5985,"proto":"tcp","label":"","count":2},{"port":5986,"proto":"tcp","label":"","count":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i190800_9dc949149365_97f8aa674fd9","t13i131000_f57a46bbacb6_ab7e3b40a677"],"tls_client_hello":"16030105c6010005c20303716196dab6fc8062c3d6ec2d2e582bd22732e32ad895d5a57a074a7a7113d2cd200ab9c44daa6343553f1e0a9bea6a57da434d21669ef531f8bfba1019ca284159001ac02bc02fc02cc030cca9cca8c009c013c00ac0141301130213030100055f000b00020100ff010001000017000000120000000500050100000000000a000c000a11ec001d001700180019000d0016001408040403080708050806040105010601050306030032001a0018080404030807080508060401050106010503060302010203002b0009080304030303020301003304ea04e811ec04c086aa2ddb722ac29a8a02a787c3f9b500474d6e34132edb1983556e1ae20377a7376b216cd2217b8814419d118217a642ca04a16098b9a6c3b8d85757cd12ad46ea0cc6202447c08432d151b673c9e18148eee3581d3c4931988c4a58ac29dcb7436bc532e38744c68934ea57faac7af0004fd04c92c6f8b702bc30b8f6c8703c2c84d763d50b61f7aab7fc7a1d8b8a69a9a9c21d36829e2349d5395a85541486065296ca10fc405cd6a891d50bc1a3463143518a3da27814c154dccc8378d85e1273bd71ca225407b9ae0a2fc0365eac202a5372378f80496f0b0f843b0d222574cf1a08b3b2ad2951babfdb7241093a3aa44e9bc4bd35ab5530c142e9d6040efcae61283505e92dd5565bbca581e6a09184b68757cc8457f31b93073bbe128ee5ebc7345c177b2cca0c3c57992a8ae1482802f7c1ef5680b7887550749411473d70e023bebc12cc31cd4f676fccd56bd7e5730ffc57a4d6470f2b717e154732e21b2a14b833b588f6157d101c635eb51371246fe7886cf9085ad1a014d755301b4b3b331877fab9736e33bb935338c619811835213e386c1088372201a8c0222993eac47f6436b09036c5d7716361736a0a48ce172fc9c220142a774ae01bbb07cc6af07128fb06f5cc2100b602ab589cf9f937ce0c69a71ac09541b38f814ffd45304f120ddef2b08414cdaf6cbd8ee1af4689322a13899c064dc9744f1d7684b95b7a5a46babf73bb56331a49d814efa60307795900b76dbefc440416a08a5b4d0de8b699b52854c962ce454f506919db573b35d16a41a0687b373effca3a29a36420ab0ae6835ce256b23fc5663ae30a94a209867c87017277f0d75d5aa16e690986857024e9c1a5bca843edab6157e8b7cc5c1953112735983fb82261455476fff5acefb9468d108cc84a8439328ecc9cc627128fed941cf214bbd1f50cf2d3a8f091caac00276927471e1c8a32375895d5c3b2fa04e52230a5a3a6139a922dfc5fdd267dc5e6ccedeab6db08bc40d193b39939f4504ba10bb30cc338db2b48b12c52af2b26bc299d6e2ca920b27e395b715dd45ee287ca2de9af6b60950fb49a8d1980b1e35b94315512412e0a9c6259cb3f64f03023ea4ed1ac1d876895dc6ba5dc0a141ef0b6334a3cb3336948b48736fb780959ce4be70c31dc384e2b3943d72775c90cff22a67439116c46a896ba2367d2967639bae8196fb22546f4495117706e41064c65059a00b75ad133bcffc5207c4c7b4a3c3c32b81fc3a74d2925af3e8464911c76302b1dfd7092df5080964690d6f3c1414b2fe127b3d03793033119d15788cdb71816f3bc588080ae5874b7d3710ee78878c8c98555a8fb99977293078a73a9e30c1648b27d0c95b0279b094e0182fe66881183424994483611bf602105bf7a93c789cbe2668b2fb8cdd78ac61089775ea79355e6b13e91338e6b65e6212ad5259e42f22a511544cfd068fafa5b281c7cdffabab679393f1b9109a27060e255864264e1dc832fa9a805d3086d16a87e3b4eb634aca4389af06031c6915634c121028b7fc2bb9303296d86928eff420c75eaaa22383ab2e7cd89e44b6247644876bdb61a32dec18ccf58bbba23773e198ee9057a85280291ee01812c047eaf0c8f3d16ff7cdd19d3f3c2861df5c65ac988e01abab023bd9676ffbd198cef21304c7ad3e2a34c993464092caebf48ceac298c7ffbef0f53001d00209676ffbd198cef21304c7ad3e2a34c993464092caebf48ceac298c7f","tls_ja3":["19e29534fd49dd27d09234e639c4057e","2196848d251b217de8b2c037e356c11d"],"http_akin":["b11cuq040_02050800_f46b29fb"]},"fingerprint_peers":{"t13i190800_9dc949149365_97f8aa674fd9":3128,"t13i131000_f57a46bbacb6_ab7e3b40a677":4124,"b11cuq040_02050800_f46b29fb":181},"akin_families":{},"user_agents":[],"timeline":[{"date":"2026-07-19","count":1},{"date":"2026-07-27","count":1},{"date":"2026-08-09","count":1},{"date":"2026-08-15","count":1},{"date":"2026-08-17","count":1},{"date":"2026-09-28","count":1}],"recent_events":[{"timestamp":"2026-09-28T08:29:08","port":9093,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000\u0012\u0000\u0003\u0000\u0000\u0000\u0000\u0000\t\u0000\u0004test\u0000\u0000\u0000\u0000","payload_hex":"00000012000300000000000900047465737400000000","method":"","user_agent":"","ja3":"2196848d251b217de8b2c037e356c11d","session":"55b4e898-23d2-4a4b-90ca-4638d455bc2a","seq":1,"duration_ms":101,"bytes_in":22,"bytes_out":13,"enriched":{"digest":"325c9cd715b9fcf2","strings":["test"]}},{"timestamp":"2026-08-17T00:37:18","port":5985,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"content-length\":\"198\",\"content-type\":\"application/soap+xml;charset=UTF-8\",\"host\":\"<HONEYPOT>:5985\",\"wsmanidentify\":\"unauthenticated\"}","body":"<s:Envelope xmlns:s=\"http://www.w3.org/2003/05/soap-envelope\" xmlns:wsmid=\"http://schemas.dmtf.org/wbem/wsman/identity/1/wsmanidentity.xsd\"><s:Header/><s:Body><wsmid:Identify/></s:Body></s:Envelope>","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/wsman","summary":"","payload_hex":"504f5354202f77736d616e20485454502f312e310d0a436f6e74656e742d547970653a206170706c69636174696f6e2f736f61702b786d6c3b636861727365743d5554462d380d0a436f6e74656e742d4c656e6774683a203139380d0a486f73743a20<HONEYPOT>3a353938350d0a57534d414e4944454e544946593a20756e61757468656e746963617465640d0a0d0a3c733a456e76656c6f706520786d6c6e733a733d22687474703a2f2f7777772e77332e6f72672f323030332f30352f736f61702d656e76656c6f70652220786d6c6e733a77736d69643d22687474703a2f2f736368656d61732e646d74662e6f72672f7762656d2f77736d616e2f6964656e746974792f312f77736d616e6964656e746974792e787364223e3c733a4865616465722f3e3c733a426f64793e3c77736d69643a4964656e746966792f3e3c2f733a426f64793e3c2f733a456e76656c6f70653e","method":"POST","user_agent":"","ja3":"","session":"155b4782-1076-44c7-bc7a-38dcd461753d","seq":1,"duration_ms":100,"bytes_in":351,"bytes_out":78},{"timestamp":"2026-08-15T07:12:18","port":9093,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000\u0012\u0000\u0003\u0000\u0000\u0000\u0000\u0000\t\u0000\u0004test\u0000\u0000\u0000\u0000","payload_hex":"00000012000300000000000900047465737400000000","method":"","user_agent":"","ja3":"2196848d251b217de8b2c037e356c11d","session":"0c34e5cc-809c-4465-b98d-05768730ccea","seq":1,"duration_ms":101,"bytes_in":22,"bytes_out":13,"enriched":{"digest":"325c9cd715b9fcf2","strings":["test"]}},{"timestamp":"2026-08-09T03:01:42","port":5986,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"content-length\":\"198\",\"content-type\":\"application/soap+xml;charset=UTF-8\",\"host\":\"<HONEYPOT>:5986\",\"wsmanidentify\":\"unauthenticated\"}","body":"<s:Envelope xmlns:s=\"http://www.w3.org/2003/05/soap-envelope\" xmlns:wsmid=\"http://schemas.dmtf.org/wbem/wsman/identity/1/wsmanidentity.xsd\"><s:Header/><s:Body><wsmid:Identify/></s:Body></s:Envelope>","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/wsman","summary":"","payload_hex":"504f5354202f77736d616e20485454502f312e310d0a436f6e74656e742d547970653a206170706c69636174696f6e2f736f61702b786d6c3b636861727365743d5554462d380d0a436f6e74656e742d4c656e6774683a203139380d0a486f73743a20<HONEYPOT>3a353938360d0a57534d414e4944454e544946593a20756e61757468656e746963617465640d0a0d0a3c733a456e76656c6f706520786d6c6e733a733d22687474703a2f2f7777772e77332e6f72672f323030332f30352f736f61702d656e76656c6f70652220786d6c6e733a77736d69643d22687474703a2f2f736368656d61732e646d74662e6f72672f7762656d2f77736d616e2f6964656e746974792f312f77736d616e6964656e746974792e787364223e3c733a4865616465722f3e3c733a426f64793e3c77736d69643a4964656e746966792f3e3c2f733a426f64793e3c2f733a456e76656c6f70653e","method":"POST","user_agent":"","ja3":"19e29534fd49dd27d09234e639c4057e","session":"b1c9af02-8f10-4c4b-8f52-828dd3bfaa28","seq":1,"duration_ms":100,"bytes_in":352,"bytes_out":78},{"timestamp":"2026-07-27T22:37:43","port":9093,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000\u0012\u0000\u0003\u0000\u0000\u0000\u0000\u0000\t\u0000\u0004test\u0000\u0000\u0000\u0000","payload_hex":"00000012000300000000000900047465737400000000","method":"","user_agent":"","ja3":"2196848d251b217de8b2c037e356c11d","session":"9e4fcce0-0baa-4466-b59c-366de9c1d09e","seq":1,"duration_ms":100,"bytes_in":22,"bytes_out":13,"enriched":{"digest":"325c9cd715b9fcf2","strings":["test"]}},{"timestamp":"2026-07-19T04:03:11","port":5985,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"content-length\":\"198\",\"content-type\":\"application/soap+xml;charset=UTF-8\",\"host\":\"<HONEYPOT>:5985\",\"wsmanidentify\":\"unauthenticated\"}","body":"<s:Envelope xmlns:s=\"http://www.w3.org/2003/05/soap-envelope\" xmlns:wsmid=\"http://schemas.dmtf.org/wbem/wsman/identity/1/wsmanidentity.xsd\"><s:Header/><s:Body><wsmid:Identify/></s:Body></s:Envelope>","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/wsman","summary":"","payload_hex":"504f5354202f77736d616e20485454502f312e310d0a436f6e74656e742d547970653a206170706c69636174696f6e2f736f61702b786d6c3b636861727365743d5554462d380d0a436f6e74656e742d4c656e6774683a203139380d0a486f73743a20<HONEYPOT>3a353938350d0a57534d414e4944454e544946593a20756e61757468656e746963617465640d0a0d0a3c733a456e76656c6f706520786d6c6e733a733d22687474703a2f2f7777772e77332e6f72672f323030332f30352f736f61702d656e76656c6f70652220786d6c6e733a77736d69643d22687474703a2f2f736368656d61732e646d74662e6f72672f7762656d2f77736d616e2f6964656e746974792f312f77736d616e6964656e746974792e787364223e3c733a4865616465722f3e3c733a426f64793e3c77736d69643a4964656e746966792f3e3c2f733a426f64793e3c2f733a456e76656c6f70653e","method":"POST","user_agent":"","ja3":"","session":"f71d8e0c-4ae0-4384-a147-dcb0e9f25ec5","seq":1,"duration_ms":100,"bytes_in":350,"bytes_out":78},{"timestamp":"2026-07-04T04:46:45","port":9093,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000\u0012\u0000\u0003\u0000\u0000\u0000\u0000\u0000\t\u0000\u0004test\u0000\u0000\u0000\u0000","payload_hex":"00000012000300000000000900047465737400000000","method":"","user_agent":"","ja3":"2196848d251b217de8b2c037e356c11d","session":"bbfa6a91-95f8-4a79-bf76-3ec7fd985e74","seq":1,"duration_ms":100,"bytes_in":22,"bytes_out":13,"enriched":{"digest":"325c9cd715b9fcf2","strings":["test"]}}],"http_methods":[{"method":"POST","count":3}],"distinct_ports_total":3,"top_paths":[{"path":"/wsman","count":3,"ports":2}],"distinct_paths_total":1,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Content-Length","Content-Type","Host","Wsmanidentify"],"representative":[{"name":"Content-Length","value":"198","notable":false},{"name":"Content-Type","value":"application/soap+xml;charset=UTF-8","notable":true},{"name":"Host","value":"<HONEYPOT>:5985","notable":false},{"name":"Wsmanidentify","value":"unauthenticated","notable":false}],"distinct_sets":1,"events_with_headers":3},"tags":[],"data_as_of":"2026-10-05T19:36:52.809497+00:00"}