{"ip":"31.59.160.32","total_events":163,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"41+ ports swept","confidence":"medium","network_type":"CDN","why":["No exploit payloads observed.","Swept 41 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range."]},"first_seen":"2026-07-08T21:59:13","last_seen":"2026-07-24T10:38:09","events_24h":0,"events_7d":8,"geo":{"country_code":"AE","country_name":"United Arab Emirates","region":"","city":"","lat":23.75,"lon":54.5,"asn":203861,"org":"Miteflux Technologies Ltd"},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as203861","label":"ServerExpress","category":"cdn","url":"https://www.peeringdb.com/asn/203861"},"cve_matches":[],"malware":[],"top_ports":[{"port":8080,"proto":"tcp","label":"HTTP-alt","count":28},{"port":5555,"proto":"tcp","label":"","count":8},{"port":5557,"proto":"tcp","label":"","count":6},{"port":5559,"proto":"tcp","label":"","count":6},{"port":28080,"proto":"tcp","label":"","count":6},{"port":3168,"proto":"tcp","label":"","count":6},{"port":5556,"proto":"tcp","label":"","count":6},{"port":9821,"proto":"tcp","label":"","count":3},{"port":6262,"proto":"tcp","label":"","count":3},{"port":1981,"proto":"tcp","label":"","count":3},{"port":50000,"proto":"tcp","label":"SAP","count":3},{"port":47821,"proto":"tcp","label":"","count":3},{"port":1010,"proto":"tcp","label":"","count":3},{"port":14158,"proto":"tcp","label":"","count":3},{"port":4433,"proto":"tcp","label":"","count":3}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[],"ja4h":["ge11nn08en_cc87d786e67d","po11nn0500_b4ba55311b46","ge11nn0400_9c3956fad5da"]},"fingerprint_peers":{"ge11nn08en_cc87d786e67d":5,"po11nn0500_b4ba55311b46":123,"ge11nn0400_9c3956fad5da":1466},"user_agents":["Go-http-client/1.1","Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.85 Safari/537.36 Edg/90.0.818.46"],"timeline":[{"date":"2026-07-08","count":3},{"date":"2026-07-09","count":18},{"date":"2026-07-10","count":27},{"date":"2026-07-11","count":36},{"date":"2026-07-12","count":30},{"date":"2026-07-13","count":39},{"date":"2026-07-16","count":2},{"date":"2026-07-21","count":7},{"date":"2026-07-24","count":1}],"recent_events":[{"timestamp":"2026-07-24T10:38:09","port":8088,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"content-length\":\"0\",\"content-type\":\"application/json\",\"host\":\"<HONEYPOT>:8088\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/ws/v1/cluster/apps/new-application","summary":"","payload_hex":"504f5354202f77732f76312f636c75737465722f617070732f6e65772d6170706c69636174696f6e20485454502f312e310d0a486f73743a20<HONEYPOT>3a383038380d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a436f6e74656e742d4c656e6774683a20300d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"POST","user_agent":"Go-http-client/1.1","community_id":"1:oCciy+9BEjERUmTOFBEiWa2oG5o=","ja3":"","session":"46a88136-7a20-401a-b97f-ea6c0fc63bdd","seq":1,"duration_ms":100,"bytes_in":184,"bytes_out":77},{"timestamp":"2026-07-21T23:28:14","port":5555,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CNXN\u0000\u0000\u0000\u0001\u0000\u0010\u0000\u0000\u0007\u0000\u0000\u00002\u0002\u0000\u0000����host::\u0000","payload_hex":"434e584e00000001001000000700000032020000bcb1a7b1686f73743a3a00","method":"","user_agent":"","community_id":"1://mjWdqTk9zOeX5s6Udv41nQBuM=","ja3":"","session":"ead5247e-302b-4d94-86da-d70899feed5d","seq":1,"duration_ms":100,"bytes_in":31,"bytes_out":12,"enriched":{"digest":"6c0944affd4f5212","strings":["CNXN","host::"]}},{"timestamp":"2026-07-21T23:27:54","port":5555,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CNXN\u0000\u0000\u0000\u0001\u0000\u0010\u0000\u0000\u0007\u0000\u0000\u00002\u0002\u0000\u0000����host::\u0000","payload_hex":"434e584e00000001001000000700000032020000bcb1a7b1686f73743a3a00","method":"","user_agent":"","community_id":"1:b2Ar9AC5mw+e7Tw1J0EFT/icBeo=","ja3":"","session":"ff9cf9ee-fd3c-44b8-b9d1-e50e62144cd7","seq":1,"duration_ms":100,"bytes_in":31,"bytes_out":12,"enriched":{"digest":"6c0944affd4f5212","strings":["CNXN","host::"]}},{"timestamp":"2026-07-21T23:27:34","port":5555,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CNXN\u0000\u0000\u0000\u0001\u0000\u0010\u0000\u0000\u0007\u0000\u0000\u00002\u0002\u0000\u0000����host::\u0000","payload_hex":"434e584e00000001001000000700000032020000bcb1a7b1686f73743a3a00","method":"","user_agent":"","community_id":"1:lNPIw8/alIUVawB3WTKufZ8LgPA=","ja3":"","session":"5dd5feb8-b071-4aa9-9854-0b821a493047","seq":1,"duration_ms":100,"bytes_in":31,"bytes_out":12,"enriched":{"digest":"6c0944affd4f5212","strings":["CNXN","host::"]}},{"timestamp":"2026-07-21T23:25:36","port":5555,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CNXN\u0000\u0000\u0000\u0001\u0000\u0010\u0000\u0000\u0007\u0000\u0000\u00002\u0002\u0000\u0000����host::\u0000","payload_hex":"434e584e00000001001000000700000032020000bcb1a7b1686f73743a3a00","method":"","user_agent":"","community_id":"1:XRNeEAyK8FKUL3QNm4TgkwN90N4=","ja3":"","session":"dc813e84-c3e5-4e1c-8f2b-712ac8983316","seq":1,"duration_ms":100,"bytes_in":31,"bytes_out":12,"enriched":{"digest":"6c0944affd4f5212","strings":["CNXN","host::"]}},{"timestamp":"2026-07-21T23:25:16","port":5555,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CNXN\u0000\u0000\u0000\u0001\u0000\u0010\u0000\u0000\u0007\u0000\u0000\u00002\u0002\u0000\u0000����host::\u0000","payload_hex":"434e584e00000001001000000700000032020000bcb1a7b1686f73743a3a00","method":"","user_agent":"","community_id":"1:C473pGxRJ8eg0aWmk90j5MxfdPM=","ja3":"","session":"2b60dc34-af71-45a1-8dae-dc235c8643c4","seq":1,"duration_ms":100,"bytes_in":31,"bytes_out":12,"enriched":{"digest":"6c0944affd4f5212","strings":["CNXN","host::"]}},{"timestamp":"2026-07-21T23:24:56","port":5555,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CNXN\u0000\u0000\u0000\u0001\u0000\u0010\u0000\u0000\u0007\u0000\u0000\u00002\u0002\u0000\u0000����host::\u0000","payload_hex":"434e584e00000001001000000700000032020000bcb1a7b1686f73743a3a00","method":"","user_agent":"","community_id":"1:MIHRVzif1zbLoSbpTw0MYyjz+C4=","ja3":"","session":"0f2f8205-bfb3-4c97-ae3e-30ab8d465d33","seq":1,"duration_ms":100,"bytes_in":31,"bytes_out":12,"enriched":{"digest":"6c0944affd4f5212","strings":["CNXN","host::"]}},{"timestamp":"2026-07-21T17:38:16","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip, deflate\",\"accept-language\":\"en US,en;q=0.9,sv;q=0.8\",\"connection\":\"keep-alive\",\"content-type\":\"application/x-www-form-urlencoded; charset=UTF-8\",\"host\":\"<HONEYPOT>:80\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.85 Safari/537.36 Edg/90.0.818.46\",\"x-requested-with\":\"XMLHttpRequest\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f39302e302e343433302e3835205361666172692f3533372e3336204564672f39302e302e3831382e34360d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a206b6565702d616c6976650d0a582d5265717565737465642d576974683a20584d4c48747470526571756573740d0a436f6e74656e742d547970653a206170706c69636174696f6e2f782d7777772d666f726d2d75726c656e636f6465643b20636861727365743d5554462d380d0a4163636570742d4c616e67756167653a20656e2055532c656e3b713d302e392c73763b713d302e380d0a486f73743a20<HONEYPOT>3a38300d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.85 Safari/537.36 Edg/90.0.818.46","community_id":"1:auEemVGrHzev5hAuTMOc/VPxBks=","ja3":"","session":"c1c59fa3-23b6-48e6-8635-82512d6465f0","seq":1,"duration_ms":100,"bytes_in":394,"bytes_out":77},{"timestamp":"2026-07-16T15:58:02","port":8080,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8080\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/login","summary":"","payload_hex":"474554202f6c6f67696e20485454502f312e310d0a486f73743a20<HONEYPOT>3a383038300d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","community_id":"1:Mz6uNeelDbfOlG8eIcb/Y+zkspI=","ja3":"","session":"29aae4ab-2a9b-4642-886e-53accdb5ca02","seq":1,"duration_ms":100,"bytes_in":124,"bytes_out":77},{"timestamp":"2026-07-16T15:38:22","port":8080,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8080\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/login","summary":"","payload_hex":"474554202f6c6f67696e20485454502f312e310d0a486f73743a20<HONEYPOT>3a383038300d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","community_id":"1:ZmtGJ8WWfobCz539kyTILF7PiM0=","ja3":"","session":"8741358e-97ab-4c3c-bea6-83460578694e","seq":1,"duration_ms":101,"bytes_in":122,"bytes_out":77}],"http_methods":[{"method":"GET","count":26},{"method":"POST","count":1}],"distinct_ports_total":41,"top_paths":[{"path":"/login","count":25,"ports":1},{"path":"/","count":1,"ports":1},{"path":"/ws/v1/cluster/apps/new-application","count":1,"ports":1}],"distinct_paths_total":3,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","Accept-Encoding","Accept-Language","Connection","Content-Type","Host","User-Agent","X-Requested-With"],"representative":[{"name":"Accept","value":"*/*","notable":false},{"name":"Accept-Encoding","value":"gzip, deflate","notable":false},{"name":"Accept-Language","value":"en US,en;q=0.9,sv;q=0.8","notable":false},{"name":"Connection","value":"keep-alive","notable":false},{"name":"Content-Type","value":"application/x-www-form-urlencoded; charset=UTF-8","notable":true},{"name":"Host","value":"<HONEYPOT>:80","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.85 Safari/537.36 Edg/90.0.818.46","notable":false},{"name":"X-Requested-With","value":"XMLHttpRequest","notable":true}],"distinct_sets":3,"events_with_headers":4},"tags":[],"data_as_of":"2026-07-26T18:46:21.552576+00:00"}