{"ip":"220.158.232.232","observed":true,"total_events":18169,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"9276+ ports swept","confidence":"medium","network_type":"residential ISP","why":["No exploit payloads observed.","Swept 9276 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range.","Counts include 1 interactive session(s) as well as first-packet events."],"engagement":{"level":"payload","label":"Sustained payload","detail":"2,381,556 bytes sent","bytes_sent":2381556,"session_seconds":0,"persistent":false},"basis":"combined"},"first_seen":"2026-10-15T03:10:49","last_seen":"2026-10-15T04:36:42","events_24h":18169,"events_7d":18169,"interactive_sessions":1,"interactive_sessions_24h":1,"interactive_sessions_7d":1,"interactive_protocols":[{"protocol":"smtp","sessions":1}],"geo":{"country_code":"KH","country_name":"Cambodia","region":"","city":"","lat":13.0,"lon":105.0,"asn":38623,"org":"ISP/IXP IN CAMBODIA WITH THE BEST VERVICE IN THERE."},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as38623","label":"Viettel (Cambodia) Pte. Ltd.","category":"isp","url":"https://www.peeringdb.com/asn/38623"},"cve_matches":[],"malware":[],"udp":null,"interaction":{"window_days":90,"sessions":1,"first_seen":"2026-10-15T03:10:49","last_seen":"2026-10-15T03:10:49","verdicts":[{"verdict":"scan","sessions":1}],"personas":[{"persona":"smtp@3.4.13","sessions":1}],"services":[{"protocol":"smtp","port":25,"sessions":1}],"logins":[],"commands":[],"downloads":[],"files":[]},"top_ports":[{"port":4089,"proto":"tcp","label":"","count":2,"sessions":0},{"port":3525,"proto":"tcp","label":"","count":2,"sessions":0},{"port":6965,"proto":"tcp","label":"","count":2,"sessions":0},{"port":8565,"proto":"tcp","label":"","count":2,"sessions":0},{"port":4100,"proto":"tcp","label":"","count":2,"sessions":0},{"port":1780,"proto":"tcp","label":"","count":2,"sessions":0},{"port":9423,"proto":"tcp","label":"","count":2,"sessions":0},{"port":9971,"proto":"tcp","label":"","count":2,"sessions":0},{"port":3415,"proto":"tcp","label":"","count":2,"sessions":0},{"port":4664,"proto":"tcp","label":"","count":2,"sessions":0},{"port":7079,"proto":"tcp","label":"","count":2,"sessions":0},{"port":5420,"proto":"tcp","label":"","count":2,"sessions":0},{"port":10360,"proto":"tcp","label":"","count":2,"sessions":0},{"port":3947,"proto":"tcp","label":"","count":2,"sessions":0},{"port":4778,"proto":"tcp","label":"","count":2,"sessions":0}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i131000_f57a46bbacb6_ab7e3b40a677"],"tls_client_hello":"16030105c6010005c203037dfc24573d8225c6762b914d1056a6320035204d0a73e1c4894ac1e3088153a12056b2cad65873475df010735d637ea69ff666b031c115aa1a91c60aee8b042e3c001ac02bc02fc02cc030cca9cca8c009c013c00ac0141301130213030100055f000b00020100ff010001000017000000120000000500050100000000000a0010000e11ec11eb11ed001d001700180019000d0016001408040403080708050806040105010601050306030032001a0018080404030807080508060401050106010503060302010203002b00050403040303003304ea04e811ec04c00e4b3b31413a267c272138335bbb133123bd1f178909c9278ce57d791c94ba5b5edeaa2a3ba2140cd234683738ea2c16809c92b45c9191e8cd010a2c78f635b8e24f8d9460ef4998828b06e9b04c3e5086b4c843c80c060970b7d3225420b259d2177f074a5329706c13716ef5b9aa97e7afbfd0128da98ec38007fc972f934529853ba52a412285a76157d3c9b6577f20353c6602bd2bb3b56ff71356121b32b8269215959f6b51381178d59895f86982161b9523e88fc8758620f1c84cb43e5e5524179c3686629b086439ee9702228c6e9a458336191cab94110aeba37b84ba7f95bff1ac676d089d9450a6e89019a2469d9c4c46ce62b404d92740ab59dc4a5efe83c87dc2175dab60014553fd12728b56a294701612802c9de3723bc04fab484f5f15538f86565197a4bd7b07bcaac781c042d2b450cec45befc56d7082893d3388ca39cadcb5341e134a1b24aa9fe2488b47668b73b308633c4380346d208c340a07fc29b35e64509911009a7b4240ccb4be9ba950d5aff0c385fedc3abd2a5edb2a0b4ef46bbd196d62b15886c65a45968620cc589627b67284b95051c7875b1a0ed5af20a522d1679328006cc7b698c94224d813632b487a136abc505291a14967b0138049f6a73b609c56d8c35f295d6e4a6e125019cabc6440546dd1343a10d5761f501cfe80ba56ba3e4dc40d04a509f220ca91cb975557211fd1539685b2b7ac85335a103f21c8101b4a83002538db5027d806d1787d7e14b3f411cc00fc743fc541f3e537a34b9d97c51d4d26763da2a96b7c360e8bc1de01a8736161e1e6c15e8491efa3c47b13211d3215b7d75a72c5a5a9d96a9dc2b598b8a39d572a083c1709bbba64f80724978ade946a6eda1298f824302a2dc46104703ca414fc8357f651b6e919b1a9cfbd7c9ce9d282a8733f063197fbeb62b86a5d460c44ec8a133146641d79a1292951ce14ba46f1647649b1f6423d67985deee73b19f36d6cec6a3c27b93be37767875bd8b09c18dca9fc50a3e461354c04550fb01b8f5697719475b576b733c04b413315774a111ec1cdd2525be883616e5224ad2288da8a944b435b3be37bbd4326d53516752c14f72bcd58c22f1ff7cfadf67cc1d38a4abc364de66ef7b7c8151872c86a0f422a2a9507a309747575dc8c3f9c31490990ad8ca53df78a30ac7ac8b283f4e589b42b88db56c16821c4f53b31d3e8c9f9e65154eb54870700c732839d6b083ec43443a78092c61d76b6148a49cb2bf8c949c8989bebacd3187ca5b574a3aa8f4c95753fd03deeb07eb03b65fe7534d5d74ac4b0c3b61ac7641c6d2b37b38d11ab00c1cee3b862044a32e688bb2ea251081a5c22ba2868112057a489d4c5116786be0e9b52259bb0c825247bf82da3d976691718779407815cccdb81665808770cb195c82347340b3d8cd5206ff987245acfeb869f22d2087230b1898376813388aad342a4a746431328e7cc5716d25d30a28f5aacca411ab8a8910bc2188f478318c6c976e023ccb38ac7286850b954cb063099832b5132f26b9b53b1bc4a6e2dba344f984e8a5c58a5996a1e4c2114f024d9da6739c7a0ed9c37587436a17bc72aa11756f7aadbb3b133407dde9e6f1775ead7a073c8d365fb7623912022e35aa014edfb754c377f3b77fcaf15f9c75058f2bb049fbf1fac1c7b59c912539a4ba2d3283dad6d39e2d21fc262001d002015f9c75058f2bb049fbf1fac1c7b59c912539a4ba2d3283dad6d39e2","tls_ja3":["725543c78edf669194c11dc7a039b56e"],"http_akin":["b11cun040_00040013_608dab68"]},"fingerprint_peers":{"t13i131000_f57a46bbacb6_ab7e3b40a677":3143,"b11cun040_00040013_608dab68":4375},"akin_families":{},"user_agents":["mailcore/collect"],"timeline":[{"date":"2026-10-15","count":18169,"sessions":1}],"recent_events":[{"timestamp":"2026-10-15T04:36:42","port":10582,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:10582\",\"user-agent\":\"mailcore/collect\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/logs?format=xml","summary":"","payload_hex":"474554202f6c6f67733f666f726d61743d786d6c20485454502f312e310d0a486f73743a20<HONEYPOT>3a31303538320d0a557365722d4167656e743a206d61696c636f72652f636f6c6c6563740d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"mailcore/collect","ja3":"","session":"ca1eb6a0-ea72-4fee-b256-43cb9f68ef5b","seq":1,"duration_ms":100,"bytes_in":132,"bytes_out":80},{"timestamp":"2026-10-15T04:36:37","port":10739,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:10739\",\"user-agent\":\"mailcore/collect\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/logs?format=xml","summary":"","payload_hex":"474554202f6c6f67733f666f726d61743d786d6c20485454502f312e310d0a486f73743a20<HONEYPOT>3a31303733390d0a557365722d4167656e743a206d61696c636f72652f636f6c6c6563740d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"mailcore/collect","ja3":"","session":"05222154-0dac-4874-8d68-5e5d73a907b0","seq":1,"duration_ms":92,"bytes_in":132,"bytes_out":80},{"timestamp":"2026-10-15T04:36:37","port":10740,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:10740\",\"user-agent\":\"mailcore/collect\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/logs?format=xml","summary":"","payload_hex":"474554202f6c6f67733f666f726d61743d786d6c20485454502f312e310d0a486f73743a20<HONEYPOT>3a31303734300d0a557365722d4167656e743a206d61696c636f72652f636f6c6c6563740d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"mailcore/collect","ja3":"","session":"e758cb4b-785f-43a2-af66-626475133ceb","seq":1,"duration_ms":40,"bytes_in":132,"bytes_out":80},{"timestamp":"2026-10-15T04:36:37","port":10741,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:10741\",\"user-agent\":\"mailcore/collect\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/logs?format=xml","summary":"","payload_hex":"474554202f6c6f67733f666f726d61743d786d6c20485454502f312e310d0a486f73743a20<HONEYPOT>3a31303734310d0a557365722d4167656e743a206d61696c636f72652f636f6c6c6563740d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"mailcore/collect","ja3":"","session":"4136e7dc-2163-4a90-8ef4-e22b015374e3","seq":1,"duration_ms":40,"bytes_in":132,"bytes_out":80},{"timestamp":"2026-10-15T04:36:37","port":10736,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:10736\",\"user-agent\":\"mailcore/collect\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/logs?format=xml","summary":"","payload_hex":"474554202f6c6f67733f666f726d61743d786d6c20485454502f312e310d0a486f73743a20<HONEYPOT>3a31303733360d0a557365722d4167656e743a206d61696c636f72652f636f6c6c6563740d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"mailcore/collect","ja3":"725543c78edf669194c11dc7a039b56e","session":"b0727316-ef45-4379-853d-af1b5a952bc7","seq":1,"duration_ms":22,"bytes_in":132,"bytes_out":80},{"timestamp":"2026-10-15T04:36:37","port":10735,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:10735\",\"user-agent\":\"mailcore/collect\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/logs?format=xml","summary":"","payload_hex":"474554202f6c6f67733f666f726d61743d786d6c20485454502f312e310d0a486f73743a20<HONEYPOT>3a31303733350d0a557365722d4167656e743a206d61696c636f72652f636f6c6c6563740d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"mailcore/collect","ja3":"725543c78edf669194c11dc7a039b56e","session":"336434e5-ca1c-4c0f-8c51-5723ae47fdde","seq":1,"duration_ms":0,"bytes_in":132,"bytes_out":80},{"timestamp":"2026-10-15T04:36:37","port":10743,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:10743\",\"user-agent\":\"mailcore/collect\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/logs?format=xml","summary":"","payload_hex":"474554202f6c6f67733f666f726d61743d786d6c20485454502f312e310d0a486f73743a20<HONEYPOT>3a31303734330d0a557365722d4167656e743a206d61696c636f72652f636f6c6c6563740d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"mailcore/collect","ja3":"","session":"6bcde655-f94d-4a88-a86a-0b3803eed676","seq":1,"duration_ms":19,"bytes_in":132,"bytes_out":80},{"timestamp":"2026-10-15T04:36:37","port":10742,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:10742\",\"user-agent\":\"mailcore/collect\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/logs?format=xml","summary":"","payload_hex":"474554202f6c6f67733f666f726d61743d786d6c20485454502f312e310d0a486f73743a20<HONEYPOT>3a31303734320d0a557365722d4167656e743a206d61696c636f72652f636f6c6c6563740d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"mailcore/collect","ja3":"","session":"63f625aa-03e9-4692-91db-5bf1643801be","seq":1,"duration_ms":0,"bytes_in":132,"bytes_out":80},{"timestamp":"2026-10-15T04:36:37","port":10734,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:10734\",\"user-agent\":\"mailcore/collect\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/logs?format=xml","summary":"","payload_hex":"474554202f6c6f67733f666f726d61743d786d6c20485454502f312e310d0a486f73743a20<HONEYPOT>3a31303733340d0a557365722d4167656e743a206d61696c636f72652f636f6c6c6563740d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"mailcore/collect","ja3":"725543c78edf669194c11dc7a039b56e","session":"5e2088c7-e857-4cc0-88af-255990eb8e87","seq":1,"duration_ms":56,"bytes_in":132,"bytes_out":80},{"timestamp":"2026-10-15T04:36:37","port":10744,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:10744\",\"user-agent\":\"mailcore/collect\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/logs?format=xml","summary":"","payload_hex":"474554202f6c6f67733f666f726d61743d786d6c20485454502f312e310d0a486f73743a20<HONEYPOT>3a31303734340d0a557365722d4167656e743a206d61696c636f72652f636f6c6c6563740d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"mailcore/collect","ja3":"","session":"1331c38e-b6c0-4614-a3dd-34e70b713692","seq":1,"duration_ms":6,"bytes_in":132,"bytes_out":80}],"http_methods":[{"method":"GET","count":18169}],"distinct_ports_total":9276,"top_paths":[{"path":"/logs?format=xml","count":18169,"ports":9275}],"distinct_paths_total":1,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept-Encoding","Connection","Host","User-Agent"],"representative":[{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Connection","value":"close","notable":false},{"name":"Host","value":"<HONEYPOT>:10582","notable":false},{"name":"User-Agent","value":"mailcore/collect","notable":false}],"distinct_sets":1,"events_with_headers":10},"tags":[],"data_as_of":"2026-10-15T06:46:58.429845+00:00"}