{"ip":"220.158.234.127","observed":true,"total_events":85,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"31+ ports swept","confidence":"medium","network_type":"residential ISP","why":["No exploit payloads observed.","Swept 31 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"10,780 bytes sent","bytes_sent":10780,"session_seconds":0,"persistent":false},"basis":"first_contact"},"first_seen":"2026-10-15T00:08:50","last_seen":"2026-10-15T00:09:17","events_24h":85,"events_7d":85,"interactive_sessions":0,"interactive_sessions_24h":0,"interactive_sessions_7d":0,"interactive_protocols":[],"geo":{"country_code":"KH","country_name":"Cambodia","region":"","city":"","lat":13.0,"lon":105.0,"asn":38623,"org":"ISP/IXP IN CAMBODIA WITH THE BEST VERVICE IN THERE."},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as38623","label":"Viettel (Cambodia) Pte. Ltd.","category":"isp","url":"https://www.peeringdb.com/asn/38623"},"cve_matches":[],"malware":[],"udp":null,"interaction":null,"top_ports":[{"port":1980,"proto":"tcp","label":"","count":4},{"port":1900,"proto":"tcp","label":"","count":4},{"port":1983,"proto":"tcp","label":"","count":4},{"port":443,"proto":"tcp","label":"HTTPS","count":4},{"port":1337,"proto":"tcp","label":"","count":4},{"port":1080,"proto":"tcp","label":"SOCKS","count":4},{"port":1212,"proto":"tcp","label":"","count":4},{"port":2020,"proto":"tcp","label":"","count":4},{"port":1291,"proto":"tcp","label":"","count":4},{"port":8080,"proto":"tcp","label":"HTTP-alt","count":4},{"port":80,"proto":"tcp","label":"HTTP","count":4},{"port":2023,"proto":"tcp","label":"","count":3},{"port":2347,"proto":"tcp","label":"","count":2},{"port":2604,"proto":"tcp","label":"","count":2},{"port":6565,"proto":"tcp","label":"","count":2}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i131000_f57a46bbacb6_ab7e3b40a677"],"tls_client_hello":"16030105c6010005c20303a633f673530cb54df07a25db74564db99a75285eecf54a91a900c1fd708c5678209beaaa0661fd6af264cbceb36deac16cd033c342a793be52348bd68afc09593b001ac02bc02fc02cc030cca9cca8c009c013c00ac0141301130213030100055f000b00020100ff010001000017000000120000000500050100000000000a0010000e11ec11eb11ed001d001700180019000d0016001408040403080708050806040105010601050306030032001a0018080404030807080508060401050106010503060302010203002b00050403040303003304ea04e811ec04c00636774921c1f43197f46408e4c26e4b400b4f37aa69f55ecd98ae303bb0a4234356394e0a5076365bb26955026e5464be373c5a64a048d8c25ab012f0922bff790a9cb53a70e99e1a887fbc269d75504b628a2dcc855f973436b7e44010a994a16c554446c6b0e22cf290477e52bd3c1191a3f8280e2087dfe9810dc0c1531082a294a7c755cfdfa5365e1902df1cad617c0b47a75b39641f33ea18a4a17a6221b984d10e91e809681c7a1b9631a7f91285324e1592895df742f6d08556c04f115052f1c81b8baa32b000cc545c71f513a471257fc3a226066cada2866b7f457e34c67c73d5bf20979b17f48767a6a9b7482b1c02548298c8b477786e0a3b90133b9e0642163465228055e6920b1f48724c779013383c71f8ac9ad064faf166b9b91f9a301bca4550203586bfcb74c4903492da3f93d3cbb86599c4068e9ad48ac928b341340c66c5be47260ebfc33f3d7a6fc7e4794d34426dea345568b0a1855d411a4e5832396ed44192a709e1b95576a75c78e3b990fa64bddc783301214fa87f6003924d536a9cf702ea9ca356129e5ba2958387a982041efa0aa868a7846367027cf26d42ba3eabc42c42ea370572a296f59facd98c43d297bfe41bbc8a48087362b9237e9fd2c1cf69b0dcd2b7cd328ad3040b4d1b6d9fbc3b1c87881e45a0c8c46349716993d9b923c41c3fc0a3628b3f16838e35b94caedb1af6a6b831600a7c6676d8eaa42ab63af7c464ebe74e45a5455427084bd827ad3b498153489ef82f971348c6738f93a79809499d5eab15c9862383da6a6bfc44f5b91f4016798f211f412098dea30359f6a8f0d2792c918386564f84fa3b4d236549466e7ec6a2188bb760d8585715665efb6a6542555488a483a2336b2641d4738d21ca1409b665c1e3b032c1cddd783a298c7a4914b0f3323236072cd23c0da5a2c054036ab13715f75614b6b37dae28ad48878104bab37f045ca9f64fba0ca0d8326aa977307f0b9a34b50896d1a688187aa4cba045c8ba777385f64186f389800a69a01c309eed26b7e0993348735423bc8d39d79dfee021581180ea2536286b90c9f0abd251bc2ec60b28e6a309215e9885779fc30a93827737f2a39684770ed006d2e2c1ca25ca27c0ba1e551b004cab8d170f10f391d3f67e5789bd5aa70dfa9901a0d06302b57156a36308dac50dc578ab81bf531276ba1b2820122c2e632988191bceb25c3001a67971a729a48672079a1e61c61998314790b322e148f99cbffdb2bc02f8af4e070a22c8ceab1a3a31a14b90a01a74a8bd6dd461e50157e003933e2ab643e0a5b42349e20263ab8ba2f7f67b13facc48dbcda0fc07ac064214c96427368945b932b27394fd262e439897a8932b1f7818ddb22116092d5f5b56e5d398dc5175bbb8ba1033b094f8cb03fa8a3e200e8e919944a860fbd969826b84648492bf44337a4cac00791c4ac09047f9c551054057962899069a67b1918aa26951e82b0fb54315253e0b3cb3f168ba504aa025b094b9c704cf70b7c097623f0c28e631afea662ffa95a7e8504aa3e138b0092e708406e505509feb03cd884bfdf630f71132ab0a3afdf9519dab926bf0c6ce93c15f566ca6ec2ba9f1ba22b535e13ee6751526d3765db78891a31a89f1ada3168096f7c4fc021ca257285ee0f97ae0ed24fc7db9f1759e194842d60fec7a5aae976f2bcd2174ebb47072001d00205ee0f97ae0ed24fc7db9f1759e194842d60fec7a5aae976f2bcd2174","tls_ja3":["725543c78edf669194c11dc7a039b56e"],"http_akin":["b11cun040_00040013_608dab68"]},"fingerprint_peers":{"t13i131000_f57a46bbacb6_ab7e3b40a677":3143,"b11cun040_00040013_608dab68":4374},"akin_families":{},"user_agents":["mailcore/collect"],"timeline":[{"date":"2026-10-15","count":85}],"recent_events":[{"timestamp":"2026-10-15T00:09:17","port":2023,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:2023\",\"user-agent\":\"mailcore/collect\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a323032330d0a557365722d4167656e743a206d61696c636f72652f636f6c6c6563740d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"mailcore/collect","ja3":"725543c78edf669194c11dc7a039b56e","session":"de68de38-e092-4961-8ed6-4d7190ef53b8","seq":1,"duration_ms":100,"bytes_in":116,"bytes_out":80},{"timestamp":"2026-10-15T00:09:17","port":2020,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:2020\",\"user-agent\":\"mailcore/collect\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a323032300d0a557365722d4167656e743a206d61696c636f72652f636f6c6c6563740d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"mailcore/collect","ja3":"725543c78edf669194c11dc7a039b56e","session":"47590a1a-3daa-4f7c-a45b-2708bc09008a","seq":1,"duration_ms":101,"bytes_in":116,"bytes_out":80},{"timestamp":"2026-10-15T00:09:17","port":2020,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:2020\",\"user-agent\":\"mailcore/collect\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a323032300d0a557365722d4167656e743a206d61696c636f72652f636f6c6c6563740d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"mailcore/collect","ja3":"","session":"a59b5f31-3695-4f94-9367-f1c6fb5f1fa6","seq":1,"duration_ms":100,"bytes_in":116,"bytes_out":80},{"timestamp":"2026-10-15T00:09:16","port":1983,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:1983\",\"user-agent\":\"mailcore/collect\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a313938330d0a557365722d4167656e743a206d61696c636f72652f636f6c6c6563740d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"mailcore/collect","ja3":"725543c78edf669194c11dc7a039b56e","session":"93ca0717-625d-400e-a851-b8aa51bd4d1f","seq":1,"duration_ms":105,"bytes_in":116,"bytes_out":80},{"timestamp":"2026-10-15T00:09:16","port":1983,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:1983\",\"user-agent\":\"mailcore/collect\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a313938330d0a557365722d4167656e743a206d61696c636f72652f636f6c6c6563740d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"mailcore/collect","ja3":"","session":"2473c0dd-da2c-4cda-882b-1a740e00fefe","seq":1,"duration_ms":100,"bytes_in":116,"bytes_out":80},{"timestamp":"2026-10-15T00:09:16","port":1980,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:1980\",\"user-agent\":\"mailcore/collect\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a313938300d0a557365722d4167656e743a206d61696c636f72652f636f6c6c6563740d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"mailcore/collect","ja3":"725543c78edf669194c11dc7a039b56e","session":"08c0f940-4e22-4c18-b3b5-13d7de35b7a9","seq":1,"duration_ms":100,"bytes_in":116,"bytes_out":80},{"timestamp":"2026-10-15T00:09:16","port":1980,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:1980\",\"user-agent\":\"mailcore/collect\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a313938300d0a557365722d4167656e743a206d61696c636f72652f636f6c6c6563740d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"mailcore/collect","ja3":"","session":"b4d5d392-dd92-4e4d-b800-6bbe64062ee4","seq":1,"duration_ms":100,"bytes_in":116,"bytes_out":80},{"timestamp":"2026-10-15T00:09:15","port":1900,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:1900\",\"user-agent\":\"mailcore/collect\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a313930300d0a557365722d4167656e743a206d61696c636f72652f636f6c6c6563740d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"mailcore/collect","ja3":"725543c78edf669194c11dc7a039b56e","session":"1766bfd7-c332-41b5-997c-c1f070c51858","seq":1,"duration_ms":101,"bytes_in":116,"bytes_out":80},{"timestamp":"2026-10-15T00:09:15","port":1900,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:1900\",\"user-agent\":\"mailcore/collect\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a313930300d0a557365722d4167656e743a206d61696c636f72652f636f6c6c6563740d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"mailcore/collect","ja3":"","session":"ea52f5c6-6aea-4b9f-8f3e-818a2f5042f9","seq":1,"duration_ms":100,"bytes_in":116,"bytes_out":80},{"timestamp":"2026-10-15T00:09:15","port":1337,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:1337\",\"user-agent\":\"mailcore/collect\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a313333370d0a557365722d4167656e743a206d61696c636f72652f636f6c6c6563740d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"mailcore/collect","ja3":"725543c78edf669194c11dc7a039b56e","session":"6ca0c26b-55e0-4387-9a8b-12897435b790","seq":1,"duration_ms":100,"bytes_in":116,"bytes_out":80}],"http_methods":[{"method":"GET","count":85}],"distinct_ports_total":31,"top_paths":[{"path":"/logs?format=xml","count":62,"ports":31},{"path":"/","count":23,"ports":12}],"distinct_paths_total":2,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept-Encoding","Connection","Host","User-Agent"],"representative":[{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Connection","value":"close","notable":false},{"name":"Host","value":"<HONEYPOT>:2023","notable":false},{"name":"User-Agent","value":"mailcore/collect","notable":false}],"distinct_sets":1,"events_with_headers":10},"tags":[],"data_as_of":"2026-10-15T07:36:48.090118+00:00"}