{"ip":"45.133.18.54","total_events":14,"verdict":{"verdict":"probing","label":"Low-level probing","detail":null,"confidence":"low","network_type":null,"why":["14 event(s), fewer than 10 distinct ports, no exploit payloads.","Not in any known-scanner range."],"engagement":{"level":"request","label":"Request traffic","detail":"1,437 bytes sent","bytes_sent":1437,"session_seconds":0,"persistent":false}},"first_seen":"2026-08-21T02:59:32","last_seen":"2026-09-28T05:17:59","events_24h":0,"events_7d":5,"geo":{"country_code":"CA","country_name":"Canada","region":"Ontario","city":"Toronto","lat":43.709,"lon":-79.4057,"asn":208951,"org":"Itglobal.com Nl B.v."},"source_domain":null,"known_scanners":[],"scanner_tag":null,"cve_matches":[],"malware":[],"top_ports":[{"port":9001,"proto":"tcp","label":"Tor","count":5},{"port":4100,"proto":"tcp","label":"","count":5},{"port":9000,"proto":"tcp","label":"Web-alt","count":4}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":["b10cuq020_00040800_724c10fb"]},"fingerprint_peers":{"b10cuq020_00040800_724c10fb":1},"akin_families":{},"user_agents":[],"timeline":[{"date":"2026-08-21","count":3},{"date":"2026-08-24","count":6},{"date":"2026-09-26","count":2},{"date":"2026-09-28","count":3}],"recent_events":[{"timestamp":"2026-09-28T05:17:59","port":9001,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"content-length\":\"36\",\"host\":\"<HONEYPOT>:9001\"}","body":"�\b����Naei{��N���[�\r:/\f��z�\u001az�i�\u0001r��","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/ping","summary":"","payload_hex":"504f5354202f70696e6720485454502f312e300d0a486f73743a20<HONEYPOT>3a393030310d0a436f6e74656e742d4c656e6774683a2033360d0a0d0a9b08c7d0c1834e6165697beef44e93dcf85ba20d3a2f0c82e37ab01a7abd69850172b7c6","method":"POST","user_agent":"","ja3":"","session":"17ad9641-b3ae-438a-a9ed-9f61e0bca4a1","seq":1,"duration_ms":100,"bytes_in":105,"bytes_out":77},{"timestamp":"2026-09-28T05:17:54","port":9000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"content-length\":\"40\",\"host\":\"<HONEYPOT>:9000\"}","body":"c\u001aJb5H\u0012U�U�'�a3��ь3����Κ��\u001byP�\u000e�@2py�>","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/ping","summary":"","payload_hex":"504f5354202f70696e6720485454502f312e300d0a486f73743a20<HONEYPOT>3a393030300d0a436f6e74656e742d4c656e6774683a2034300d0a0d0a631a4a62354812559b55cf27d56133989bd18c33f2bb9ed2ce9a8ec71b7950f30e8540327079f13e","method":"POST","user_agent":"","ja3":"","session":"8a866876-bd41-43c9-8866-c9feaa98f3ed","seq":1,"duration_ms":101,"bytes_in":109,"bytes_out":77},{"timestamp":"2026-09-28T05:17:48","port":4100,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"content-length\":\"42\",\"host\":\"<HONEYPOT>:4100\"}","body":"��0���\b��;$�)\u0014c�`�~2z\u001a���T��\takh}�ݼc�\u001ar��","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/ping","summary":"","payload_hex":"504f5354202f70696e6720485454502f312e300d0a486f73743a20<HONEYPOT>3a343130300d0a436f6e74656e742d4c656e6774683a2034320d0a0d0aedde30fcf58208e9df3b24e8291463c960e77e327a1ab09bd054978009616b687dc9ddbc63e41a72b4b8","method":"POST","user_agent":"","ja3":"","session":"572d4767-3f8f-43a8-a40a-9429bd871f50","seq":1,"duration_ms":100,"bytes_in":111,"bytes_out":77},{"timestamp":"2026-09-26T21:34:02","port":9001,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"content-length\":\"27\",\"host\":\"<HONEYPOT>:9001\"}","body":"�#z����\u0014Љ&A���K+�����F\u0018�h","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/ping","summary":"","payload_hex":"504f5354202f70696e6720485454502f312e300d0a486f73743a20<HONEYPOT>3a393030310d0a436f6e74656e742d4c656e6774683a2032370d0a0d0aba237a88a5a98d14d0892641a67fa9c84b2b91dddec5ee46188f68","method":"POST","user_agent":"","ja3":"","session":"9803076b-5706-453f-a3b7-537363da777a","seq":1,"duration_ms":100,"bytes_in":97,"bytes_out":77},{"timestamp":"2026-09-26T21:33:51","port":4100,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"content-length\":\"45\",\"host\":\"<HONEYPOT>:4100\"}","body":"\u0015c\u0014��h}?\u0016ԶP\u00103�ހ�7�'��6�'��>4�T�t\\c��SA�#\u001a�","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/ping","summary":"","payload_hex":"504f5354202f70696e6720485454502f312e300d0a486f73743a20<HONEYPOT>3a343130300d0a436f6e74656e742d4c656e6774683a2034350d0a0d0a156314fec2687d3f16d4b650103384de80fd378e2797827f36d32790fe3e34f654a4745c63a08c5341bc231acd","method":"POST","user_agent":"","ja3":"","session":"c938a83d-8085-4438-a612-016c40d77cd3","seq":1,"duration_ms":100,"bytes_in":115,"bytes_out":77},{"timestamp":"2026-08-24T22:21:54","port":9001,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"content-length\":\"23\",\"host\":\"<HONEYPOT>:9001\"}","body":"CM�b�\r\b�Fæ������e�=�O�","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/ping","summary":"","payload_hex":"504f5354202f70696e6720485454502f312e300d0a486f73743a20<HONEYPOT>3a393030310d0a436f6e74656e742d4c656e6774683a2032330d0a0d0a434d89628d0d089346c3a6898ce5caf3b765d63df64fc4","method":"POST","user_agent":"","ja3":"","session":"2fecbb35-65ab-44dd-9c4c-649527d68a59","seq":1,"duration_ms":100,"bytes_in":91,"bytes_out":77},{"timestamp":"2026-08-24T22:21:54","port":9001,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"content-length\":\"37\",\"host\":\"<HONEYPOT>:9001\"}","body":"�V\u001b����$ᯣ�\u0011�I��ŋ�D��,\u001d�L\u0017b�;\u0017�`є","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/ping","summary":"","payload_hex":"504f5354202f70696e6720485454502f312e300d0a486f73743a20<HONEYPOT>3a393030310d0a436f6e74656e742d4c656e6774683a2033370d0a0d0aab561baa87e0e824e1afa3a7118d49e485c58b9644ae7f952c1d9f4c1762d73b17fe60d194","method":"POST","user_agent":"","ja3":"","session":"30a2b166-3451-41c4-a798-355e3d804593","seq":1,"duration_ms":118,"bytes_in":105,"bytes_out":77},{"timestamp":"2026-08-24T22:21:49","port":9000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"content-length\":\"15\",\"host\":\"<HONEYPOT>:9000\"}","body":"�?\u001d?0\u0003\u0014��2Gl��\u0011","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/ping","summary":"","payload_hex":"504f5354202f70696e6720485454502f312e300d0a486f73743a20<HONEYPOT>3a393030300d0a436f6e74656e742d4c656e6774683a2031350d0a0d0acc3f1d3f300314e59b32476cc6d911","method":"POST","user_agent":"","ja3":"","session":"19afb6e5-a087-4713-a714-6954cf4f9e0c","seq":1,"duration_ms":100,"bytes_in":83,"bytes_out":77},{"timestamp":"2026-08-24T22:21:49","port":9000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"content-length\":\"45\",\"host\":\"<HONEYPOT>:9000\"}","body":"D�\u0016��td�t��u���\\�\u0011l�V�?�ܫ-V7��{\t1\u0019��\u001cj�e�ղ","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/ping","summary":"","payload_hex":"504f5354202f70696e6720485454502f312e300d0a486f73743a20<HONEYPOT>3a393030300d0a436f6e74656e742d4c656e6774683a2034350d0a0d0a44e816a5c3746499748fbc759bbaa35ca2116cd8569e3f8bdcab2d5637bccb7b09317f198eb11c6ab665d6d5b2","method":"POST","user_agent":"","ja3":"","session":"3f997e17-1796-4072-a095-40354ccfa0b2","seq":1,"duration_ms":100,"bytes_in":113,"bytes_out":77},{"timestamp":"2026-08-24T22:21:44","port":4100,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"content-length\":\"30\",\"host\":\"<HONEYPOT>:4100\"}","body":"KE`h;]�tqa|\u0011�(ّϜ��]+8G��q0�c","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/ping","summary":"","payload_hex":"504f5354202f70696e6720485454502f312e300d0a486f73743a20<HONEYPOT>3a343130300d0a436f6e74656e742d4c656e6774683a2033300d0a0d0a4b4560683b5d917471617c119228d991cf9cd8e85d2b384790ea7130ef63","method":"POST","user_agent":"","ja3":"","session":"cf6a3560-f9b1-41d7-9910-90a2ff86ba75","seq":1,"duration_ms":101,"bytes_in":98,"bytes_out":77}],"http_methods":[{"method":"POST","count":14}],"distinct_ports_total":3,"top_paths":[{"path":"/ping","count":14,"ports":3}],"distinct_paths_total":1,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Content-Length","Host"],"representative":[{"name":"Content-Length","value":"36","notable":false},{"name":"Host","value":"<HONEYPOT>:9001","notable":false}],"distinct_sets":1,"events_with_headers":10},"tags":[],"data_as_of":"2026-09-30T13:32:06.157654+00:00"}