{"ip":"23.234.116.123","total_events":4,"verdict":{"verdict":"probing","label":"Low-level probing","detail":null,"confidence":"low","network_type":null,"why":["4 event(s), fewer than 10 distinct ports, no exploit payloads.","Not in any known-scanner range."],"engagement":{"level":"request","label":"Request traffic","detail":"396 bytes sent","bytes_sent":396,"session_seconds":1,"persistent":false}},"first_seen":"2026-09-09T13:30:01","last_seen":"2026-09-09T13:30:02","events_24h":0,"events_7d":4,"geo":{"country_code":"US","country_name":"United States","region":"Missouri","city":"Kansas City","lat":39.1027,"lon":-94.5778,"asn":11878,"org":"tzulo, inc."},"source_domain":"static-23-234-116-123.cust.tzulo.com","known_scanners":[],"scanner_tag":null,"cve_matches":[],"malware":[],"top_ports":[{"port":465,"proto":"tcp","label":"SMTPS","count":4}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i040900_16476d049b0b_78f1d400d464"],"tls_ja3":["c1e58b5fa361cf5bfc0635a61bd8573c"],"ja4h":[]},"fingerprint_peers":{"t13i040900_16476d049b0b_78f1d400d464":5},"user_agents":[],"timeline":[{"date":"2026-09-09","count":4}],"recent_events":[{"timestamp":"2026-09-09T13:30:02","port":465,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"data\r\n","payload_hex":"646174610d0a","method":"","user_agent":"","ja3":"c1e58b5fa361cf5bfc0635a61bd8573c","session":"b7d4b43f-19ae-4f57-99c9-f7ceda9430a4","seq":4,"duration_ms":692,"bytes_in":132,"bytes_out":105,"enriched":{"digest":"b901fb770e777abb","strings":["data"]}},{"timestamp":"2026-09-09T13:30:01","port":465,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"rcpt to:<vagn@ferie-fyn.dk>\r\n","payload_hex":"7263707420746f3a3c7661676e4066657269652d66796e2e646b3e0d0a","method":"","user_agent":"","ja3":"c1e58b5fa361cf5bfc0635a61bd8573c","session":"b7d4b43f-19ae-4f57-99c9-f7ceda9430a4","seq":3,"duration_ms":572,"bytes_in":126,"bytes_out":68,"enriched":{"digest":"63adbae089cf8cc4","strings":["rcpt to:<vagn@ferie-fyn.dk>"],"iocs":{"domains":["ferie-fyn.dk"]}}},{"timestamp":"2026-09-09T13:30:01","port":465,"proto":"tcp","app_proto":"tls","app_protocol":"smtp","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"mail from:<support@<HONEYPOT>-host.colocrossing.com>\r\n","payload_hex":"6d61696c2066726f6d3a3c737570706f72744032332d39342d33362d3134312d686f73742e636f6c6f63726f7373696e672e636f6d3e0d0a","method":"","user_agent":"","ja3":"c1e58b5fa361cf5bfc0635a61bd8573c","session":"b7d4b43f-19ae-4f57-99c9-f7ceda9430a4","seq":2,"duration_ms":452,"bytes_in":97,"bytes_out":54,"enriched":{"digest":"e350c688dcb8db95","label":"SMTP","strings":["mail from:<support@<HONEYPOT>-host.colocrossing.com>"],"iocs":{"domains":["host.colocrossing.com"]}}},{"timestamp":"2026-09-09T13:30:01","port":465,"proto":"tcp","app_proto":"tls","app_protocol":"smtp","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"ehlo <HONEYPOT>-host.colocrossing.com\r\n","payload_hex":"65686c6f2032332d39342d33362d3134312d686f73742e636f6c6f63726f7373696e672e636f6d0d0a","method":"","user_agent":"","ja3":"c1e58b5fa361cf5bfc0635a61bd8573c","session":"b7d4b43f-19ae-4f57-99c9-f7ceda9430a4","seq":1,"duration_ms":223,"bytes_in":41,"bytes_out":40,"enriched":{"digest":"3bb8b762144326bb","label":"SMTP","strings":["ehlo <HONEYPOT>-host.colocrossing.com"],"iocs":{"domains":["host.colocrossing.com"]}}}],"http_methods":[],"distinct_ports_total":1,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[],"data_as_of":"2026-09-10T22:16:20.699247+00:00"}