{"ip":"23.94.99.34","total_events":33,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"16+ ports swept","confidence":"medium","network_type":"nsp","why":["No exploit payloads observed.","Swept 16 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range."],"engagement":{"level":"request","label":"Request traffic","detail":"1,750 bytes sent","bytes_sent":1750,"session_seconds":1,"persistent":false}},"first_seen":"2026-09-28T16:59:23","last_seen":"2026-09-28T17:02:03","events_24h":33,"events_7d":33,"geo":{"country_code":"US","country_name":"United States","region":"Illinois","city":"Chicago","lat":41.8185,"lon":-87.6931,"asn":36352,"org":"HostPapa"},"source_domain":"23-94-99-34-host.colocrossing.com","known_scanners":[],"scanner_tag":{"key":"peeringdb:as36352","label":"ColoCrossing","category":"isp","url":"https://www.peeringdb.com/asn/36352"},"cve_matches":[],"malware":[],"top_ports":[{"port":4000,"proto":"tcp","label":"","count":11},{"port":6379,"proto":"tcp","label":"Redis","count":6},{"port":4567,"proto":"tcp","label":"","count":2},{"port":7112,"proto":"tcp","label":"","count":2},{"port":9090,"proto":"tcp","label":"Prometheus","count":1},{"port":4001,"proto":"tcp","label":"","count":1},{"port":3333,"proto":"tcp","label":"","count":1},{"port":5000,"proto":"tcp","label":"Web-alt","count":1},{"port":443,"proto":"tcp","label":"HTTPS","count":1},{"port":8080,"proto":"tcp","label":"HTTP-alt","count":1},{"port":3000,"proto":"tcp","label":"Web-alt","count":1},{"port":5432,"proto":"tcp","label":"Postgres","count":1},{"port":80,"proto":"tcp","label":"HTTP","count":1},{"port":8888,"proto":"tcp","label":"HTTP-alt","count":1},{"port":8332,"proto":"tcp","label":"","count":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":["a10cun010_00000008_c4b2c4aa","a11cun030_00000049_54d07b6d"]},"fingerprint_peers":{"a10cun010_00000008_c4b2c4aa":108,"a11cun030_00000049_54d07b6d":2620},"akin_families":{"a11cun030_00000049_54d07b6d":{"head":"a11cun030_00000049_54d07b6d","shapes":2,"ips":2622}},"user_agents":["curl/8.5.0"],"timeline":[{"date":"2026-09-28","count":33}],"recent_events":[{"timestamp":"2026-09-28T17:02:03","port":6379,"proto":"tcp","app_proto":"","app_protocol":"nats","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"PING\r\nINFO\r\nKEYS *\r\nCONFIG GET dir\r\n","payload_hex":"50494e470d0a494e464f0d0a4b455953202a0d0a434f4e46494720474554206469720d0a","method":"","user_agent":"","ja3":"","session":"e35df7e7-01f7-4bc7-9d6d-9de6cc347f42","seq":1,"duration_ms":100,"bytes_in":36,"bytes_out":7,"enriched":{"digest":"758ee5fefdcaac9e","label":"Redis (RESP)","strings":["PING","INFO","KEYS *","CONFIG GET dir"]}},{"timestamp":"2026-09-28T17:01:36","port":6379,"proto":"tcp","app_proto":"","app_protocol":"redis","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"*2\r\n$6\r\nCONFIG\r\n$3\r\nGET\r\n*1\r\n$1\r\n*\r\n","payload_hex":"2a320d0a24360d0a434f4e4649470d0a24330d0a4745540d0a2a310d0a24310d0a2a0d0a","method":"","user_agent":"","ja3":"","session":"810e8ec7-a778-4b2e-ac61-ede4809e2a1f","seq":2,"duration_ms":900,"bytes_in":50,"bytes_out":10,"enriched":{"digest":"8eb11712b8627fc0","label":"Redis (RESP)","strings":["CONFIG"]}},{"timestamp":"2026-09-28T17:01:36","port":6379,"proto":"tcp","app_proto":"","app_protocol":"redis","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"*2\r\n$4\r\nKEYS\r\n$1\r\n*\r\n","payload_hex":"2a320d0a24340d0a4b4559530d0a24310d0a2a0d0a","method":"","user_agent":"","ja3":"","session":"810e8ec7-a778-4b2e-ac61-ede4809e2a1f","seq":3,"duration_ms":1401,"bytes_in":71,"bytes_out":15,"enriched":{"digest":"480c4fe5136f83f7","label":"Redis (RESP)","strings":["KEYS"]}},{"timestamp":"2026-09-28T17:01:35","port":6379,"proto":"tcp","app_proto":"","app_protocol":"redis","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"*1\r\n$4\r\nINFO\r\n","payload_hex":"2a310d0a24340d0a494e464f0d0a","method":"","user_agent":"","ja3":"","session":"810e8ec7-a778-4b2e-ac61-ede4809e2a1f","seq":1,"duration_ms":101,"bytes_in":14,"bytes_out":5,"enriched":{"digest":"2c31890b53b348f2","label":"Redis (RESP)","strings":["INFO"]}},{"timestamp":"2026-09-28T17:00:34","port":6379,"proto":"tcp","app_proto":"","app_protocol":"nats","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"PING\r\nINFO\r\n","payload_hex":"50494e470d0a494e464f0d0a","method":"","user_agent":"","ja3":"","session":"eb0a51be-9b01-457a-8378-6fe6d9084e3f","seq":1,"duration_ms":100,"bytes_in":12,"bytes_out":7,"enriched":{"digest":"6a934a192cf144b7","label":"Redis (RESP)","strings":["PING","INFO"]}},{"timestamp":"2026-09-28T17:00:04","port":4000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:4000\",\"user-agent\":\"curl/8.5.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/health","summary":"","payload_hex":"474554202f6865616c746820485454502f312e310d0a486f73743a20<HONEYPOT>3a343030300d0a557365722d4167656e743a206375726c2f382e352e300d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"curl/8.5.0","ja3":"","session":"5f59f39c-f015-4e99-a50a-26f6d7159c06","seq":1,"duration_ms":101,"bytes_in":86,"bytes_out":76},{"timestamp":"2026-09-28T17:00:03","port":4000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:4000\",\"user-agent\":\"curl/8.5.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/metrics","summary":"","payload_hex":"474554202f6d65747269637320485454502f312e310d0a486f73743a20<HONEYPOT>3a343030300d0a557365722d4167656e743a206375726c2f382e352e300d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"curl/8.5.0","ja3":"","session":"4c5a649f-ce89-4d26-ab38-802e331bd06e","seq":1,"duration_ms":100,"bytes_in":87,"bytes_out":76},{"timestamp":"2026-09-28T17:00:00","port":4000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:4000\",\"user-agent\":\"curl/8.5.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/api/pools/btc/miners","summary":"","payload_hex":"474554202f6170692f706f6f6c732f6274632f6d696e65727320485454502f312e310d0a486f73743a20<HONEYPOT>3a343030300d0a557365722d4167656e743a206375726c2f382e352e300d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"curl/8.5.0","ja3":"","session":"4fd1cbb8-981c-4923-9b0e-0ab01fb68e2c","seq":1,"duration_ms":100,"bytes_in":100,"bytes_out":76},{"timestamp":"2026-09-28T16:59:59","port":4000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:4000\",\"user-agent\":\"curl/8.5.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/api/pools/btc/blocks","summary":"","payload_hex":"474554202f6170692f706f6f6c732f6274632f626c6f636b7320485454502f312e310d0a486f73743a20<HONEYPOT>3a343030300d0a557365722d4167656e743a206375726c2f382e352e300d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"curl/8.5.0","ja3":"","session":"68541559-6718-4620-836e-e56560b771e3","seq":1,"duration_ms":100,"bytes_in":100,"bytes_out":76},{"timestamp":"2026-09-28T16:59:58","port":4000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"host\":\"<HONEYPOT>:4000\",\"user-agent\":\"curl/8.5.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/api/pools/btc","summary":"","payload_hex":"474554202f6170692f706f6f6c732f62746320485454502f312e310d0a486f73743a20<HONEYPOT>3a343030300d0a557365722d4167656e743a206375726c2f382e352e300d0a4163636570743a202a2f2a0d0a0d0a","method":"GET","user_agent":"curl/8.5.0","ja3":"","session":"01296838-80a5-456d-a944-c99bc93fc0cc","seq":1,"duration_ms":100,"bytes_in":93,"bytes_out":76}],"http_methods":[{"method":"GET","count":26}],"distinct_ports_total":16,"top_paths":[{"path":"/","count":17,"ports":16},{"path":"/api/pools","count":4,"ports":1},{"path":"/health","count":1,"ports":1},{"path":"/metrics","count":1,"ports":1},{"path":"/api/pools/btc","count":1,"ports":1},{"path":"/api/pools/btc/miners","count":1,"ports":1},{"path":"/api/pools/btc/blocks","count":1,"ports":1}],"distinct_paths_total":7,"top_snis":[],"top_hosts":[{"value":"millpools.cc","count":18}],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","Host","User-Agent"],"representative":[{"name":"Accept","value":"*/*","notable":false},{"name":"Host","value":"<HONEYPOT>:4000","notable":false},{"name":"User-Agent","value":"curl/8.5.0","notable":false}],"distinct_sets":1,"events_with_headers":5},"tags":[],"data_as_of":"2026-09-29T14:52:16.822305+00:00"}