{"ip":"217.60.103.101","total_events":105,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"47+ ports swept","confidence":"medium","network_type":"network services","why":["No exploit payloads observed.","Swept 47 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"11,970 bytes sent","bytes_sent":11970,"session_seconds":0,"persistent":false}},"first_seen":"2026-09-17T16:26:22","last_seen":"2026-09-19T00:28:07","events_24h":0,"events_7d":105,"geo":{"country_code":"CH","country_name":"Switzerland","region":"","city":"","lat":47.1449,"lon":8.1551,"asn":209373,"org":"Swissnet LLC"},"source_domain":null,"known_scanners":[],"scanner_tag":null,"cve_matches":[],"malware":[],"top_ports":[{"port":8805,"proto":"tcp","label":"","count":4},{"port":8767,"proto":"tcp","label":"","count":4},{"port":8799,"proto":"tcp","label":"","count":4},{"port":8813,"proto":"tcp","label":"","count":4},{"port":8818,"proto":"tcp","label":"","count":4},{"port":8791,"proto":"tcp","label":"","count":4},{"port":8817,"proto":"tcp","label":"","count":3},{"port":8796,"proto":"tcp","label":"","count":3},{"port":8804,"proto":"tcp","label":"","count":3},{"port":8766,"proto":"tcp","label":"","count":3},{"port":8765,"proto":"tcp","label":"","count":3},{"port":8900,"proto":"tcp","label":"","count":2},{"port":8810,"proto":"tcp","label":"","count":2},{"port":8807,"proto":"tcp","label":"","count":2},{"port":8889,"proto":"tcp","label":"","count":2}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[],"ja4h":["ge11nn0400_8fd06a127c33"]},"fingerprint_peers":{"ge11nn0400_8fd06a127c33":88},"user_agents":["Mozilla/5.0"],"timeline":[{"date":"2026-09-17","count":51},{"date":"2026-09-19","count":54}],"recent_events":[{"timestamp":"2026-09-19T00:28:07","port":8818,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"identity\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8818\",\"user-agent\":\"Mozilla/5.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a4163636570742d456e636f64696e673a206964656e746974790d0a486f73743a20<HONEYPOT>3a383831380d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0","ja3":"","session":"7dc7e97d-b9f2-467e-a837-e6fba04475a8","seq":1,"duration_ms":100,"bytes_in":114,"bytes_out":79},{"timestamp":"2026-09-19T00:28:07","port":8825,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"identity\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8825\",\"user-agent\":\"Mozilla/5.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a4163636570742d456e636f64696e673a206964656e746974790d0a486f73743a20<HONEYPOT>3a383832350d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0","ja3":"","session":"08b8d3d7-4f9b-4dc4-9893-7cc08079778a","seq":1,"duration_ms":100,"bytes_in":114,"bytes_out":79},{"timestamp":"2026-09-19T00:28:07","port":8813,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"identity\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8813\",\"user-agent\":\"Mozilla/5.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a4163636570742d456e636f64696e673a206964656e746974790d0a486f73743a20<HONEYPOT>3a383831330d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0","ja3":"","session":"9942a7aa-ec3c-419b-8793-33688d0e9026","seq":1,"duration_ms":102,"bytes_in":114,"bytes_out":79},{"timestamp":"2026-09-19T00:28:07","port":8816,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"identity\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8816\",\"user-agent\":\"Mozilla/5.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a4163636570742d456e636f64696e673a206964656e746974790d0a486f73743a20<HONEYPOT>3a383831360d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0","ja3":"","session":"9c41fd26-8cf5-477f-9e6d-dc432b19cb39","seq":1,"duration_ms":102,"bytes_in":114,"bytes_out":79},{"timestamp":"2026-09-19T00:28:07","port":8812,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"identity\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8812\",\"user-agent\":\"Mozilla/5.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a4163636570742d456e636f64696e673a206964656e746974790d0a486f73743a20<HONEYPOT>3a383831320d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0","ja3":"","session":"25ccea8d-6c12-430a-98b7-79f6dbb73b27","seq":1,"duration_ms":101,"bytes_in":114,"bytes_out":79},{"timestamp":"2026-09-19T00:28:07","port":8807,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"identity\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8807\",\"user-agent\":\"Mozilla/5.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a4163636570742d456e636f64696e673a206964656e746974790d0a486f73743a20<HONEYPOT>3a383830370d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0","ja3":"","session":"54ac4b88-1cf1-417e-96dc-e3fb73e62269","seq":1,"duration_ms":105,"bytes_in":114,"bytes_out":79},{"timestamp":"2026-09-19T00:28:07","port":8847,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"identity\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8847\",\"user-agent\":\"Mozilla/5.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a4163636570742d456e636f64696e673a206964656e746974790d0a486f73743a20<HONEYPOT>3a383834370d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0","ja3":"","session":"2bc045dd-24b5-43cf-817b-12d3281a6dbb","seq":1,"duration_ms":100,"bytes_in":114,"bytes_out":79},{"timestamp":"2026-09-19T00:28:07","port":8795,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"identity\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8795\",\"user-agent\":\"Mozilla/5.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a4163636570742d456e636f64696e673a206964656e746974790d0a486f73743a20<HONEYPOT>3a383739350d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0","ja3":"","session":"371f9f57-d5d3-4cbc-afad-96c03e1da3c1","seq":1,"duration_ms":100,"bytes_in":114,"bytes_out":79},{"timestamp":"2026-09-19T00:28:07","port":8810,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"identity\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8810\",\"user-agent\":\"Mozilla/5.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a4163636570742d456e636f64696e673a206964656e746974790d0a486f73743a20<HONEYPOT>3a383831300d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0","ja3":"","session":"8a341f2d-0fca-4069-867c-afb3ea1a67bf","seq":1,"duration_ms":104,"bytes_in":114,"bytes_out":79},{"timestamp":"2026-09-19T00:28:07","port":8805,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"identity\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8805\",\"user-agent\":\"Mozilla/5.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a4163636570742d456e636f64696e673a206964656e746974790d0a486f73743a20<HONEYPOT>3a383830350d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0","ja3":"","session":"5529fa9a-6f1d-4f5c-87a9-4c804205fd3a","seq":1,"duration_ms":100,"bytes_in":114,"bytes_out":79}],"http_methods":[{"method":"GET","count":105}],"distinct_ports_total":47,"top_paths":[{"path":"/","count":105,"ports":47}],"distinct_paths_total":1,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept-Encoding","Connection","Host","User-Agent"],"representative":[{"name":"Accept-Encoding","value":"identity","notable":false},{"name":"Connection","value":"close","notable":false},{"name":"Host","value":"<HONEYPOT>:8818","notable":false},{"name":"User-Agent","value":"Mozilla/5.0","notable":false}],"distinct_sets":1,"events_with_headers":10},"tags":[],"data_as_of":"2026-09-21T10:42:31.983847+00:00"}