{"ip":"45.133.173.173","data_as_of":"2026-10-24T16:54:37+00:00","observed":true,"total_events":4,"verdict":{"verdict":"scanner","label":"Recognized scanner","detail":"infrawatch","confidence":"high","network_type":"CDN","why":["The address is in a published scanner range (infrawatch).","Known research and commercial scanners are labelled by operator and carry no threat verdict.","Counts include 73 interactive session(s) as well as first-packet events."],"engagement":{"level":"payload","label":"Sustained payload","detail":"11,183 bytes sent","bytes_sent":11183,"session_seconds":0,"persistent":false},"basis":"combined"},"first_seen":"2026-08-30T08:56:51","last_seen":"2026-10-21T22:30:14","events_24h":0,"events_7d":0,"interactive_sessions":73,"interactive_sessions_24h":0,"interactive_sessions_7d":73,"interactive_protocols":[{"protocol":"http","sessions":73}],"geo":{"country_code":"GB","country_name":"United Kingdom","region":"England","city":"London","lat":51.5081,"lon":-0.1278,"asn":25369,"org":"Hydra Communications Ltd"},"source_domain":"45-133-173-173.infrawat.ch","known_scanners":["infrawatch","Infrawatch"],"scanner_tag":{"key":"infrawatch","label":"Infrawatch","category":"commercial","url":"https://infrawat.ch/"},"cve_matches":[],"malware":[],"udp":null,"interaction":{"window_days":90,"sessions":73,"first_seen":"2026-10-19T18:17:43","last_seen":"2026-10-21T22:30:14","verdicts":[{"verdict":"scan","sessions":73}],"personas":[{"persona":"nginx@1.24.0, wordpress@6.5.2, leaks@2, miner@bfgminer 5.5.0, elasticsearch@6.8.23, winrm@Windows Server 2016, fortigate@7.0.5, docker@25.0.3","sessions":73}],"services":[{"protocol":"http","port":28929,"sessions":1},{"protocol":"http","port":7904,"sessions":1},{"protocol":"http","port":22375,"sessions":1},{"protocol":"http","port":59882,"sessions":1},{"protocol":"http","port":36791,"sessions":1},{"protocol":"http","port":49962,"sessions":1},{"protocol":"http","port":59975,"sessions":1},{"protocol":"http","port":54916,"sessions":1},{"protocol":"http","port":37183,"sessions":1},{"protocol":"http","port":7812,"sessions":1},{"protocol":"http","port":28525,"sessions":1},{"protocol":"http","port":32720,"sessions":1}],"logins":[],"commands":[],"downloads":[],"files":[],"attack":[{"technique_id":"T1595","technique_name":"Active Scanning","tactic_id":"TA0043","tactic_name":"Reconnaissance","sessions":73}]},"top_ports":[{"port":30238,"proto":"tcp","label":"","count":1,"sessions":0},{"port":47051,"proto":"tcp","label":"","count":1,"sessions":0},{"port":40000,"proto":"tcp","label":"","count":1,"sessions":0},{"port":18000,"proto":"tcp","label":"","count":1,"sessions":0},{"port":1834,"proto":"tcp","label":"HTTP","count":0,"sessions":1},{"port":49962,"proto":"tcp","label":"HTTP","count":0,"sessions":1},{"port":2280,"proto":"tcp","label":"HTTP","count":0,"sessions":1},{"port":3160,"proto":"tcp","label":"HTTP","count":0,"sessions":1},{"port":5016,"proto":"tcp","label":"HTTP","count":0,"sessions":1},{"port":7377,"proto":"tcp","label":"HTTP","count":0,"sessions":1},{"port":7812,"proto":"tcp","label":"HTTP","count":0,"sessions":1},{"port":7904,"proto":"tcp","label":"HTTP","count":0,"sessions":1},{"port":10510,"proto":"tcp","label":"HTTP","count":0,"sessions":1},{"port":11096,"proto":"tcp","label":"HTTP","count":0,"sessions":1},{"port":13401,"proto":"tcp","label":"HTTP","count":0,"sessions":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":["b11cun040_00040015_4c87b06e","b11cun050_00040017_6b90553b","b11cun050_00040017_e873236c"],"interactive":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[]}},"fingerprint_peers":{"b11cun040_00040015_4c87b06e":356,"b11cun050_00040017_6b90553b":972,"b11cun050_00040017_e873236c":679},"akin_families":{"b11cun040_00040015_4c87b06e":{"head":"b11cun040_00040015_4c87b06e","shapes":5,"ips":357},"b11cun050_00040017_6b90553b":{"head":"b11cun050_00040017_6b90553b","shapes":10,"ips":972},"b11cun050_00040017_e873236c":{"head":"b11cun050_00040017_e873236c","shapes":2,"ips":679}},"user_agents":["Mozilla/5.0 (compatible; Infrawatch/1.0; +https://infrawat.ch/)"],"timeline":[{"date":"2026-08-30","count":2,"sessions":0},{"date":"2026-10-11","count":1,"sessions":0},{"date":"2026-10-12","count":1,"sessions":0},{"date":"2026-10-19","count":0,"sessions":8},{"date":"2026-10-20","count":0,"sessions":39},{"date":"2026-10-21","count":0,"sessions":26}],"recent_events":[{"timestamp":"2026-10-21T22:30:14","port":65510,"proto":"tcp","app_proto":"http","app_protocol":"http","host":"192.0.2.1","headers":"{\"accept\":\"*/*\",\"connection\":\"close\",\"host\":\"192.0.2.1\",\"user-agent\":\"Mozilla/5.0 (compatible; Infrawatch/1.0; +https://infrawat.ch/)\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a203139322e302e322e310d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b20496e66726177617463682f312e303b202b68747470733a2f2f696e6672617761742e63682f290d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; Infrawatch/1.0; +https://infrawat.ch/)","ja3":"","session":"7e7d6281-88c8-4204-808a-11910e77072d-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-21T22:23:24","port":65100,"proto":"tcp","app_proto":"http","app_protocol":"http","host":"192.0.2.1","headers":"{\"accept\":\"*/*\",\"connection\":\"close\",\"host\":\"192.0.2.1\",\"user-agent\":\"Mozilla/5.0 (compatible; Infrawatch/1.0; +https://infrawat.ch/)\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a203139322e302e322e310d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b20496e66726177617463682f312e303b202b68747470733a2f2f696e6672617761742e63682f290d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; Infrawatch/1.0; +https://infrawat.ch/)","ja3":"","session":"4e3ebe0a-1070-4aa7-a8a7-060eb161c731-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-21T21:46:48","port":64698,"proto":"tcp","app_proto":"http","app_protocol":"http","host":"192.0.2.1","headers":"{\"accept\":\"*/*\",\"connection\":\"close\",\"host\":\"192.0.2.1\",\"user-agent\":\"Mozilla/5.0 (compatible; Infrawatch/1.0; +https://infrawat.ch/)\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a203139322e302e322e310d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b20496e66726177617463682f312e303b202b68747470733a2f2f696e6672617761742e63682f290d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; Infrawatch/1.0; +https://infrawat.ch/)","ja3":"","session":"d3fee020-8838-41a2-ae20-3e3b8bb66ebf-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-21T21:02:45","port":63853,"proto":"tcp","app_proto":"http","app_protocol":"http","host":"192.0.2.1","headers":"{\"accept\":\"*/*\",\"connection\":\"close\",\"host\":\"192.0.2.1\",\"user-agent\":\"Mozilla/5.0 (compatible; Infrawatch/1.0; +https://infrawat.ch/)\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a203139322e302e322e310d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b20496e66726177617463682f312e303b202b68747470733a2f2f696e6672617761742e63682f290d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; Infrawatch/1.0; +https://infrawat.ch/)","ja3":"","session":"cea7a146-5dcb-46e0-863e-ac58b1adb1fc-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-21T20:16:11","port":62851,"proto":"tcp","app_proto":"http","app_protocol":"http","host":"192.0.2.1","headers":"{\"accept\":\"*/*\",\"connection\":\"close\",\"host\":\"192.0.2.1\",\"user-agent\":\"Mozilla/5.0 (compatible; Infrawatch/1.0; +https://infrawat.ch/)\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a203139322e302e322e310d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b20496e66726177617463682f312e303b202b68747470733a2f2f696e6672617761742e63682f290d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; Infrawatch/1.0; +https://infrawat.ch/)","ja3":"","session":"d66747a2-e71b-443f-ae76-954cfb38ca81-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-21T20:12:10","port":62610,"proto":"tcp","app_proto":"http","app_protocol":"http","host":"192.0.2.1","headers":"{\"accept\":\"*/*\",\"connection\":\"close\",\"host\":\"192.0.2.1\",\"user-agent\":\"Mozilla/5.0 (compatible; Infrawatch/1.0; +https://infrawat.ch/)\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a203139322e302e322e310d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b20496e66726177617463682f312e303b202b68747470733a2f2f696e6672617761742e63682f290d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; Infrawatch/1.0; +https://infrawat.ch/)","ja3":"","session":"25649cd9-ddfc-421c-95b1-3dfc15abbd1b-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-21T18:31:11","port":60562,"proto":"tcp","app_proto":"http","app_protocol":"http","host":"192.0.2.1","headers":"{\"accept\":\"*/*\",\"connection\":\"close\",\"host\":\"192.0.2.1\",\"user-agent\":\"Mozilla/5.0 (compatible; Infrawatch/1.0; +https://infrawat.ch/)\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a203139322e302e322e310d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b20496e66726177617463682f312e303b202b68747470733a2f2f696e6672617761742e63682f290d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; Infrawatch/1.0; +https://infrawat.ch/)","ja3":"","session":"7c2174b0-9d21-474c-9a1e-84958c79dab0-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-21T17:53:37","port":59982,"proto":"tcp","app_proto":"http","app_protocol":"http","host":"192.0.2.1","headers":"{\"accept\":\"*/*\",\"connection\":\"close\",\"host\":\"192.0.2.1\",\"user-agent\":\"Mozilla/5.0 (compatible; Infrawatch/1.0; +https://infrawat.ch/)\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a203139322e302e322e310d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b20496e66726177617463682f312e303b202b68747470733a2f2f696e6672617761742e63682f290d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; Infrawatch/1.0; +https://infrawat.ch/)","ja3":"","session":"d07409cf-9646-44ea-85ff-1f08e9725bce-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-21T17:53:30","port":59975,"proto":"tcp","app_proto":"http","app_protocol":"http","host":"192.0.2.1","headers":"{\"accept\":\"*/*\",\"connection\":\"close\",\"host\":\"192.0.2.1\",\"user-agent\":\"Mozilla/5.0 (compatible; Infrawatch/1.0; +https://infrawat.ch/)\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a203139322e302e322e310d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b20496e66726177617463682f312e303b202b68747470733a2f2f696e6672617761742e63682f290d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; Infrawatch/1.0; +https://infrawat.ch/)","ja3":"","session":"ffdce9da-3857-4f39-a159-1cf42ad3937f-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-21T17:53:08","port":59953,"proto":"tcp","app_proto":"http","app_protocol":"http","host":"192.0.2.1","headers":"{\"accept\":\"*/*\",\"connection\":\"close\",\"host\":\"192.0.2.1\",\"user-agent\":\"Mozilla/5.0 (compatible; Infrawatch/1.0; +https://infrawat.ch/)\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a203139322e302e322e310d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b20496e66726177617463682f312e303b202b68747470733a2f2f696e6672617761742e63682f290d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; Infrawatch/1.0; +https://infrawat.ch/)","ja3":"","session":"975793dc-8c16-4de3-a0cf-82e9bf1565aa-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true}],"http_methods":[{"method":"GET","count":77}],"distinct_ports_total":77,"top_paths":[{"path":"/","count":75,"ports":73},{"path":"/mcp","count":1,"ports":1},{"path":"/favicon.ico","count":1,"ports":1}],"distinct_paths_total":3,"top_snis":[],"top_hosts":[{"value":"192.0.2.1","count":75}],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","Connection","Host","User-Agent"],"representative":[{"name":"Accept","value":"*/*","notable":false},{"name":"Connection","value":"close","notable":false},{"name":"Host","value":"192.0.2.1","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (compatible; Infrawatch/1.0; +https://infrawat.ch/)","notable":false}],"distinct_sets":1,"events_with_headers":10},"tags":[]}