{"ip":"43.228.157.185","total_events":410,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"106+ ports swept","confidence":"medium","network_type":null,"why":["No exploit payloads observed.","Swept 106 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"211,905 bytes sent","bytes_sent":211905,"session_seconds":2,"persistent":false}},"first_seen":"2026-09-01T07:42:58","last_seen":"2026-09-16T03:24:02","events_24h":0,"events_7d":0,"geo":{"country_code":"PK","country_name":"Pakistan","region":"","city":"","lat":30.0,"lon":70.0,"asn":207184,"org":"AS207184"},"source_domain":null,"known_scanners":[],"scanner_tag":null,"cve_matches":[{"cve_id":"CVE-2026-54236","title":"vLLM <= 0.23.0 - Anthropic Router Heap Address Information Leak","severity":"medium","actively_exploited":false,"match_field":"url_path","matched_pattern":"/v1/messages"}],"malware":[],"top_ports":[{"port":8799,"proto":"tcp","label":"","count":7},{"port":8922,"proto":"tcp","label":"","count":6},{"port":8916,"proto":"tcp","label":"","count":6},{"port":8927,"proto":"tcp","label":"","count":6},{"port":9056,"proto":"tcp","label":"","count":6},{"port":9058,"proto":"tcp","label":"","count":6},{"port":8925,"proto":"tcp","label":"","count":6},{"port":8930,"proto":"tcp","label":"","count":6},{"port":8924,"proto":"tcp","label":"","count":6},{"port":8920,"proto":"tcp","label":"","count":6},{"port":9059,"proto":"tcp","label":"","count":6},{"port":9057,"proto":"tcp","label":"","count":6},{"port":9060,"proto":"tcp","label":"","count":6},{"port":8938,"proto":"tcp","label":"","count":6},{"port":8923,"proto":"tcp","label":"","count":6}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":[]},"fingerprint_peers":{},"akin_families":{},"user_agents":["claude-code/1.x","Mozilla/5.0"],"timeline":[{"date":"2026-09-01","count":363},{"date":"2026-09-16","count":47}],"recent_events":[{"timestamp":"2026-09-16T03:24:02","port":8807,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"identity\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8807\",\"user-agent\":\"Mozilla/5.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a4163636570742d456e636f64696e673a206964656e746974790d0a486f73743a20<HONEYPOT>3a383830370d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0","ja3":"","session":"38921c77-e7ae-4fa6-a13b-d41305133c7e","seq":1,"duration_ms":101,"bytes_in":114,"bytes_out":79},{"timestamp":"2026-09-16T03:24:02","port":8805,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"identity\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8805\",\"user-agent\":\"Mozilla/5.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a4163636570742d456e636f64696e673a206964656e746974790d0a486f73743a20<HONEYPOT>3a383830350d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0","ja3":"","session":"43ef0479-cfe9-45da-a950-2572ddea8dca","seq":1,"duration_ms":100,"bytes_in":114,"bytes_out":79},{"timestamp":"2026-09-16T03:24:02","port":8808,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"identity\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8808\",\"user-agent\":\"Mozilla/5.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a4163636570742d456e636f64696e673a206964656e746974790d0a486f73743a20<HONEYPOT>3a383830380d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0","ja3":"","session":"e6520308-924a-478d-abb4-82f3bbd1f361","seq":1,"duration_ms":102,"bytes_in":114,"bytes_out":79},{"timestamp":"2026-09-16T03:24:02","port":8809,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"identity\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8809\",\"user-agent\":\"Mozilla/5.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a4163636570742d456e636f64696e673a206964656e746974790d0a486f73743a20<HONEYPOT>3a383830390d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0","ja3":"","session":"a5e77291-ecff-44d2-bc3f-3e3f3d580af4","seq":1,"duration_ms":100,"bytes_in":114,"bytes_out":79},{"timestamp":"2026-09-16T03:24:01","port":8816,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"identity\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8816\",\"user-agent\":\"Mozilla/5.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a4163636570742d456e636f64696e673a206964656e746974790d0a486f73743a20<HONEYPOT>3a383831360d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0","ja3":"","session":"12897c0c-589f-4ee4-b34a-6d029bbd2513","seq":1,"duration_ms":102,"bytes_in":114,"bytes_out":79},{"timestamp":"2026-09-16T03:24:01","port":8804,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"identity\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8804\",\"user-agent\":\"Mozilla/5.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a4163636570742d456e636f64696e673a206964656e746974790d0a486f73743a20<HONEYPOT>3a383830340d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0","ja3":"","session":"d123d382-796a-4ec2-b33a-cfaeab0d79c3","seq":1,"duration_ms":100,"bytes_in":114,"bytes_out":79},{"timestamp":"2026-09-16T03:24:01","port":8797,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"identity\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8797\",\"user-agent\":\"Mozilla/5.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a4163636570742d456e636f64696e673a206964656e746974790d0a486f73743a20<HONEYPOT>3a383739370d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0","ja3":"","session":"edb56045-48c1-46b0-b856-5319c4a4fd05","seq":1,"duration_ms":100,"bytes_in":114,"bytes_out":79},{"timestamp":"2026-09-16T03:24:01","port":8810,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"identity\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8810\",\"user-agent\":\"Mozilla/5.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a4163636570742d456e636f64696e673a206964656e746974790d0a486f73743a20<HONEYPOT>3a383831300d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0","ja3":"","session":"9ec44bb5-fb45-4e7b-ae1c-5f689336f33e","seq":1,"duration_ms":100,"bytes_in":114,"bytes_out":79},{"timestamp":"2026-09-16T03:24:01","port":8794,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"identity\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8794\",\"user-agent\":\"Mozilla/5.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a4163636570742d456e636f64696e673a206964656e746974790d0a486f73743a20<HONEYPOT>3a383739340d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0","ja3":"","session":"f94ed429-1a0d-4d59-ba8f-d11abb70a0ed","seq":1,"duration_ms":100,"bytes_in":114,"bytes_out":79},{"timestamp":"2026-09-16T03:24:01","port":8787,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"identity\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8787\",\"user-agent\":\"Mozilla/5.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a4163636570742d456e636f64696e673a206964656e746974790d0a486f73743a20<HONEYPOT>3a383738370d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0","ja3":"","session":"d34ff3de-f891-4a18-8213-33156268c8f3","seq":1,"duration_ms":100,"bytes_in":114,"bytes_out":79}],"http_methods":[{"method":"POST","count":363},{"method":"GET","count":47}],"distinct_ports_total":106,"top_paths":[{"path":"/v1/messages","count":242,"ports":72},{"path":"/","count":168,"ports":106}],"distinct_paths_total":2,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept-Encoding","Connection","Host","User-Agent"],"representative":[{"name":"Accept-Encoding","value":"identity","notable":false},{"name":"Connection","value":"close","notable":false},{"name":"Host","value":"<HONEYPOT>:8807","notable":false},{"name":"User-Agent","value":"Mozilla/5.0","notable":false}],"distinct_sets":1,"events_with_headers":10},"tags":[{"tag_id":"CVE-2026-54236","tag_type":"cve","title":"vLLM <= 0.23.0 - Anthropic Router Heap Address Information Leak","severity":"medium","actively_exploited":false,"match_field":"url_path","matched_pattern":"/v1/messages","reference_urls":["https://github.com/advisories/GHSA-hgg8-fqqc-vfmw","https://github.com/vllm-project/vllm/pull/45119"]}],"data_as_of":"2026-09-23T09:25:53.443990+00:00"}