{"ip":"221.164.137.248","total_events":2,"verdict":{"verdict":"probing","label":"Low-level probing","detail":null,"confidence":"low","network_type":"residential ISP","why":["2 event(s), fewer than 10 distinct ports, no exploit payloads.","Not in any known-scanner range."],"engagement":{"level":"touch","label":"Touch only","detail":"0 bytes sent, no real exchange","bytes_sent":0,"session_seconds":0,"persistent":false}},"first_seen":"2026-05-11T05:09:18","last_seen":"2026-06-01T05:08:04","events_24h":0,"events_7d":0,"geo":{"country_code":"KR","country_name":"South Korea","region":"Daegu","city":"Daegu","lat":35.8699,"lon":128.6314,"asn":4766,"org":"Korea Telecom"},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as4766","label":"KT Corporation (Korea Telecom)","category":"isp","url":"https://www.peeringdb.com/asn/4766"},"cve_matches":[],"malware":[],"udp":{"source_verified":false,"window_days":90,"events":2,"protocols":[{"protocol":"udp","events":2}],"ports":[{"port":576,"events":1},{"port":57908,"events":1}],"dns_questions":[],"quic_clients":[],"first_seen":"2026-10-05T14:26:36","last_seen":"2026-10-05T19:42:21","recent":[{"timestamp":"2026-10-05T19:42:21","port":576,"src_port":34145,"proto":"udp","app_proto":"","app_protocol":"","summary":"<leP��DK\u0016�������v ����\u000e�'�\u001f�r��1��`QR����I�ھV\u000b-U\u001f�y}\u0017M��_��\nSUҢ��;V���uԉ�M\b<�.��u��e�\u0001��\u0003^��\n�9�p�g��\u0005�A\u0005�\u0014�3\u0016;�*СB\u001bN��\u0010���3n\u001e\u0005��kGΡXCXк��I:�,߷>�\tz���KS*�>����P���2��T�SH\u0003�5���\u0019\u0012��mb��T�Xoa�\u0010'�j�&\u0014w��G��=\\�lY�N\u0016��(:��\u000b�\n9��dk��+)Σ\u00132\t��]=@\"\u0012���dzq ���\u0007�\u001b`$�����\u0011��\u001b%�φ_\u001bj\u0007k,��d�\\�\u0015<�-\u0013j7zJ�}��'j�b��l\u001d\u0003P�|`���t}\"\u0014ֈ��j�ײJ/�\u0001c>f�!�ڲp�f\r�\u0011�\u0005��&t5\u001e-�밸*�|�/�Է4��k\u0005�nTK޻4\u0017\t�'����Aq����Zk~�@�\u0017A��q\\���[_No\u001e��\u0011\u0005y�;��n?_��jWK\u0006?�>\"zi8����3�;Go1\"��������o�\u0017�����M��7`܀�\nM)\t?⋋A?�uB���}���\u0011��0?�2� #\u000f<\u001e6��wX","payload_hex":"3c6c6550b2fb444b16b0929696b084c27620fbb990c50ed527cd1fd672d7f831abb9605152d4e1f2dc49bfdabe560b2d551ff2797d174d85a15f9ca50a5355d2a2f6b43b56f8afd675d489914d083ce92ef2a17584d965dc019490035e8ae70aae39ad70c667f68205db41058914c233163bbb2ad0a1421b4ec8d01081f095336e1e05c09f6b47cea1584358d0bacec4493ad02cdfb73ed9097afa9b9c4b532aed3efc8782e150abd3ec32e382548d534803e03587a89019128bb06d62eba054fd586f61c71027fd6afc261477fe8e47cbee3d5ca36c59994e16bfba283af28a0bd60a39fd99646bb9ff2b29cea313320991c65d3d402212f7a382647a7120cbceff07a21b6024a2b3f2c8d311e2ab1b2597cf865f1b6a076b2ca39364ef5cd7153cd02d136a377a4ad17df0ee276ac0629bf66c1d0350ad7c60b9b3b2747d2214d688fab36aedd7b24a2faf01633e66a421badab270be660ddc11b30587a22674351e2d85ebb0b82ab97c852f9cd4b734aabd6b05886e544bdebb3417099d27daebf7a14171f981b3ae5a6b7ec740a41741f7ba715ccef0ed5b5f4e6f1e86ec110579ec3be1d66e3f5fe2da6a574b063f8b3e227a6938fb85caeb33953b476f3122f6b9ccffbd819cb26fec17a7a2bad8fd4db2c23760dc80850a4d29093fe28b8b413f867542e2cbca7dfbcce211e1b6303fd2328120230f3c1e3682bf7758","sni":"","session":"09b036b2-cc2b-4a20-bcbf-85a5f30a6950","bytes_in":512,"source_verified":false,"enriched":{"digest":"741c171ab6356251","strings":["<leP","j7zJ","[_No",">\"zi8",";Go1\""]}},{"timestamp":"2026-10-05T14:26:36","port":57908,"src_port":23064,"proto":"udp","app_proto":"","app_protocol":"","summary":"�jJ�E;\u0006�w��b���\u0006��\u0005��)}ub$_9{�uC@�k��\u0001�!�Mx��\u0017�\u000f�k����At�ڑd�\u0014<\u0016f°��`H�� ��\b����.)xU���yN$E�1cn��\u001f�1���7)�\u001f��[�\u001e�+�wG\u000f2\u001ex�I\b�g�\\\u0013��Zu\u0011$N�!>\t`��\u0016���3��q��MA�\u001dF�\u000b����\u0004t��\u001e���DŽ\u0013Q'\u0013�Y�#�-Dz��\u0016��z���`Y�g�\"�\u0002ڦ� �\u001e��M8��h!�z�����ˈ���ҳ�\u000b\u0002�y;1�CF\u0013>��X\u001b�5��,4u�\u001f[�%��r��8+�ע��\u00116X\\ש\b1T*o�����毝`3��\u0014xAP�\u0000�5l��Z���?�5\u00070�1��\u001c\u001e.(\u0004�\u0001\\\u001e\u0018V\u0002\u0016e���(v�g\u000b���`�\u0019\u0016e\u0003c&�{(}Qu󓂒�bk���\u001b�4�Zym���@�\"����GN�.L��N\u0014?��\u0019�P����NS\\�R���x2��\u0016�{02k����\u0006�[$>�N#\u0005�\u0006=ᝣ(�*\u001dΥ\u0011q���9��;POO�3��\n�3\u001b O���\u001b\t�\u0002�Z�e�\\RAe�Q��콾�\u0014��\u0012�\b�������!","payload_hex":"e36a4a84453b069577d5c562e993cf06a1fc05d1d7297d7562245f397ba8754340b46bbdab01c421c54d78e1e117a00fe16b89efe2e641ee8a8874cdda9164c2143c1666c2b081876048d8ee20fed408b295f5df2e297855a9f0cf794e2445d631636ea5eb1fcb31c3eb873729de1fc8f05bbe1e8b2be377470f327f1e78ea4908cb67a55c13b6cb5a7511244ed3213e096085a516abd2de33aec671e6b84d41ee1d46cf0b9587849e0474c0fe1ed2ece7c78413512713ab599623cb2d447ab7da16f4827a80efb06059a96794229702daa6f720ee1ed7ec4d3898c16821a07a9099fce7efcb88b383d7d2b3f00b02c8793b31cb4346133ecde0581bdd35ddc32c3475811f5bf025e48972f9ca382bd3d7a2d7fb1136585cd7a90831542a6fbbf4e6e8fde6af9d6033f4af14784150d600c2356cffb25ae18bcc3f8a350730de31fbd71c1e7f2e2804b5015c1e1856021665fba1b82876fa670b8eabe060aa191665036326b27b287d5175f3938292b9626bc1c1fe1bde34a15a796d87cbd2408422828ac1d9474efa2e4ce9a74e143fc3dd19a45091e0d4c84e535c9352afc1a07832ab8716887b30326bbdc4d4eb06c15b243eac4e23058a063de19da328b92a1dcea5117187ba9d3987b33b504f4fb533bd9a0ad6331b204ff291ad1b09a402b45ad765ab5c524165d451a5c8ecbdbe8114bfba12a4088280a8fa92d6da21","sni":"","session":"9694246f-aa82-48f1-ac2b-8711d0948ec7","bytes_in":512,"source_verified":false,"enriched":{"digest":"4c19a9680a0c0796","strings":[")}ub$_9{",".)xU","yN$E","1T*o","{(}Qu","{02k",";POO","\\RAe"]}}]},"top_ports":[{"port":8081,"proto":"tcp","label":"","count":1},{"port":80,"proto":"tcp","label":"HTTP","count":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":["b10cun020_00040004_1fdb23c0"]},"fingerprint_peers":{"b10cun020_00040004_1fdb23c0":396},"akin_families":{},"user_agents":[],"timeline":[],"recent_events":[{"timestamp":"2026-06-01T05:08:04","port":8081,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"text/plain,text/html\",\"host\":\"<HONEYPOT>\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e300d0a486f73743a20<HONEYPOT>0d0a4163636570743a20746578742f706c61696e2c746578742f68746d6c0d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"17843ccf-50b8-46be-aea2-0a946c8723bb","seq":0,"duration_ms":0,"bytes_in":0,"bytes_out":0},{"timestamp":"2026-05-11T05:09:18","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"text/plain,text/html\",\"host\":\"<HONEYPOT>\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e300d0a486f73743a20<HONEYPOT>0d0a4163636570743a20746578742f706c61696e2c746578742f68746d6c0d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"192d6716-c990-432c-9d30-a03cd0993702","seq":0,"duration_ms":0,"bytes_in":0,"bytes_out":0}],"http_methods":[{"method":"GET","count":2}],"distinct_ports_total":2,"top_paths":[{"path":"/","count":2,"ports":2}],"distinct_paths_total":1,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","Host"],"representative":[{"name":"Accept","value":"text/plain,text/html","notable":false},{"name":"Host","value":"<HONEYPOT>","notable":false}],"distinct_sets":1,"events_with_headers":2},"tags":[],"data_as_of":"2026-10-05T23:11:35.923680+00:00"}