{"ip":"45.156.129.92","observed":true,"total_events":300,"verdict":{"verdict":"scanner","label":"Recognized scanner","detail":"bitsight","confidence":"high","network_type":null,"why":["Source IP is in a known scanner range (bitsight).","Known research and commercial scanners are labelled as such, not as threats.","Counts include 1 interactive session(s) as well as first-packet events."],"engagement":{"level":"payload","label":"Sustained payload","detail":"32,981 bytes sent","bytes_sent":32981,"session_seconds":5,"persistent":false},"basis":"combined"},"first_seen":"2026-02-23T04:52:41","last_seen":"2026-10-15T04:18:03","events_24h":0,"events_7d":14,"interactive_sessions":1,"interactive_sessions_24h":0,"interactive_sessions_7d":1,"interactive_protocols":[],"geo":{"country_code":"PT","country_name":"Portugal","region":"","city":"","lat":38.7057,"lon":-9.1359,"asn":211680,"org":"Sistemas Informaticos, S.A."},"source_domain":"sh-chi-us-gp1-wk136c.internet-census.org","known_scanners":["bitsight","Internet Census"],"scanner_tag":{"key":"internet-census","label":"Internet Census","category":"research","url":"https://internet-census.org/"},"cve_matches":[],"malware":[],"udp":null,"interaction":{"window_days":90,"sessions":1,"first_seen":"2026-10-15T04:18:03","last_seen":"2026-10-15T04:18:03","verdicts":[{"verdict":"unknown","sessions":1}],"personas":[],"services":[{"protocol":"tcp","port":13,"sessions":1}],"logins":[],"commands":[],"downloads":[],"files":[],"attack":[]},"top_ports":[{"port":102,"proto":"tcp","label":"","count":10,"sessions":0},{"port":53,"proto":"tcp","label":"DNS","count":8,"sessions":0},{"port":8098,"proto":"tcp","label":"","count":7,"sessions":0},{"port":8001,"proto":"tcp","label":"","count":6,"sessions":0},{"port":88,"proto":"tcp","label":"","count":5,"sessions":0},{"port":1010,"proto":"tcp","label":"","count":5,"sessions":0},{"port":7777,"proto":"tcp","label":"Oracle","count":5,"sessions":0},{"port":10554,"proto":"tcp","label":"","count":5,"sessions":0},{"port":3389,"proto":"tcp","label":"RDP","count":5,"sessions":0},{"port":1777,"proto":"tcp","label":"","count":4,"sessions":0},{"port":1099,"proto":"tcp","label":"","count":4,"sessions":0},{"port":1400,"proto":"tcp","label":"","count":4,"sessions":0},{"port":9595,"proto":"tcp","label":"","count":4,"sessions":0},{"port":11300,"proto":"tcp","label":"","count":4,"sessions":0},{"port":5000,"proto":"tcp","label":"Web-alt","count":4,"sessions":0}],"fingerprints":{"ssh_hassh":["864cef7e4d8ad71d4fb1aadfcf0a3189"],"tls_ja4":["t12i330500_5172cef6ed69_021165082e1c","t13i870900_72303a6ce03a_5ac7197df9d2","t13i1909h1_9dc949149365_97f8aa674fd9"],"tls_client_hello":"16030105bf010005bb03036afc8cd08f446a94641e8cee5a65f9b67e137ac725da7990b66f395dde89d8e9203dcfc01f0ddace02a4ec5600f4d30ec304dff2ff02dbb3c6e3ca5599ff0c96e00026cca8cca9c02fc030c02bc02cc013c009c014c00a009c009d002f0035c012000a1303130113020100054c000500050100000000000a000c000a11ec001d001700180019000b00020100000d001a0018080404030807080508060401050106010503060302010203ff010001000010000b000908687474702f312e3100120000002b00050403040303003304ea04e811ec04c01f33c19ea4a51f13b59f35052dfca6d4b5b44c76a5fefab84ca8a5e7703bfce487a1723704c64d5df64cc0102879156b5565918bf9704ea08b634878c18607c51b8062482dafb123482b427b8c11c41457bd6a0a7ad21b71121e7fc685e88c40038c4a8e992aafb707c22c52e12c559d572402d455006ac6f79722ae76b8c4502ac1641be2d5aa33550b8a717c8cf25015d017bc2caa568cc64497821fb613b3131f9211877017c94be115a1cc97f5fc8191d866f1fa9a30ba7ba4eba47028730277468de74a84c644ad605f9ad5a5f5268ed62358a3099656035a405a1d33aa513a264b4e64ae88074f9b621a058c5b70c35a25d791d1ba08fadc137bb0781b34ca27896b5407a92fc67e3b694b2399632e403252e78b0d9b8df17abad514554d83a98af84d800209b34188da0883738ac4ece52c1a055438ba95bd629209241cea6c46e7327e43f38d3a200dc6f7385ef80c3794cb7988c2aa102de48b8bd3017bdd206ec2c66bd0c3146b6017ef21130a53cff47bace9e02e200068ab53a84740343c055fc3097d5cd357c2418f57848578eaadf2583db55a23cca51a16a976231c940cf22f5601278a50077f5983541b32af01c530c133a1f40d871635663bc687d766582c47105183278a05ef05cef98810fdcbb311833966097f95e10072f13cfb713d602c63c8783abce51c86873116ca00f1ba80c64021df50899a928334c4b56a082e16946feb9182bbb133f466c2f7c29e20289736c2b7144b6c6919b042c678a5254d005066e02921a75354cd54b4b8aaaad982137b613adfb725582b8edccc84045117592c98515370605719249318d70467fd25563e673ac1905c7c8a56987baf28d13e8583850624755d9376bd3411cb56b96c6ac87ce47f0fc60c4f557e25127842407e0ea424d9b81fa5a79b83441c00b587942795b3f5167ae652bacab75448a75803be9dbb1530896e35d071f8e54b9ccc7898f3c5b48aca9158adaf6464c8e81d3ec6303036a5fae89210445289fa1cab6c1ba4f58605f600b70c57e0da0c4d3771924c23eeaa8304a6c9fd5a36f3373a7648c5848187d740b5a1591ed185a4607599d8b32cdde63e66988118875b06cc48ed95a648a4b872250020ba8ec495682de4adc5c3256a6a0713b450d54b63eb175e1c449fb7e7a90f309b579023ccb04f955729365759bbd87925b0231f99a2cd818ce4006ce10b51be5948aef075125cb93af6a078e22c8b9813753847e7f6b001e97226b771b4483f5c062a01ac7ab9b207dc34979c2611eab2b6e50b54df587ef1c1778d699e74086bec107b5c1ac49528a8ad41ca9c7425bab2ae8e6b3e17c1a167b79036cb3dc804b5edf98ea0160cce67626ddb41b7e2c147931f1811394792bcf231b6cbf285c89245b63bcaa56ac262407c96dcaff342c1155c1e219b43af47887d28c16453600016025419005184c9d9204f24c3868f898761791e4ba61956276f490c15f92ac940714891475bc388107b8b2fc8c9bb409981842c4dfd4251e2d42db6d478813b63752a7f4ba98c5b389b24d02fdc99214084c49f8904a199265142c59a2717c6a4036ad2b2d42437f17345167b590e91ce182864c6f9a5ba02cb7496c3bcec58d0ff7cba57a0b30390cfeafef75d1ab3e1dd25c82ee09c4f90b064904a35877436ceb36afe0091b3b4cfdab794f4c0702d253920f63583921a2e001d002013a4f6e5f24569aefc3cfb9544259a28120486d8bfeff33ba70d76","tls_ja3":["defbbdd6b0deddad5d637b945b6d08e2","02f32644e1b0655c19aaa3a2d6778b1e","a3710a0cb04a8c61bb7ed96e70103f1e"],"http_akin":["b11cun040_00040016_aa48e2c8"],"interactive":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[]}},"fingerprint_peers":{"t12i330500_5172cef6ed69_021165082e1c":241,"t13i1909h1_9dc949149365_97f8aa674fd9":450,"864cef7e4d8ad71d4fb1aadfcf0a3189":103,"b11cun040_00040016_aa48e2c8":5350,"t13i870900_72303a6ce03a_5ac7197df9d2":19},"akin_families":{},"user_agents":["Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.6312.86 Safari/537.36 BitSightBot/1.0","Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.6312.86 Safari/537.36","Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.117 Safari/537.36"],"timeline":[{"date":"2026-07-21","count":2,"sessions":0},{"date":"2026-07-23","count":1,"sessions":0},{"date":"2026-07-25","count":1,"sessions":0},{"date":"2026-07-26","count":2,"sessions":0},{"date":"2026-07-27","count":6,"sessions":0},{"date":"2026-07-28","count":3,"sessions":0},{"date":"2026-07-29","count":2,"sessions":0},{"date":"2026-07-30","count":1,"sessions":0},{"date":"2026-08-01","count":2,"sessions":0},{"date":"2026-08-02","count":2,"sessions":0},{"date":"2026-08-04","count":1,"sessions":0},{"date":"2026-08-05","count":1,"sessions":0},{"date":"2026-08-09","count":2,"sessions":0},{"date":"2026-08-10","count":1,"sessions":0},{"date":"2026-08-11","count":1,"sessions":0},{"date":"2026-08-12","count":3,"sessions":0},{"date":"2026-08-13","count":1,"sessions":0},{"date":"2026-08-14","count":1,"sessions":0},{"date":"2026-08-17","count":1,"sessions":0},{"date":"2026-08-18","count":1,"sessions":0},{"date":"2026-08-19","count":3,"sessions":0},{"date":"2026-08-20","count":2,"sessions":0},{"date":"2026-08-21","count":2,"sessions":0},{"date":"2026-08-22","count":1,"sessions":0},{"date":"2026-08-24","count":1,"sessions":0},{"date":"2026-08-26","count":2,"sessions":0},{"date":"2026-08-29","count":1,"sessions":0},{"date":"2026-09-01","count":4,"sessions":0},{"date":"2026-09-02","count":5,"sessions":0},{"date":"2026-09-03","count":1,"sessions":0},{"date":"2026-09-04","count":1,"sessions":0},{"date":"2026-09-05","count":5,"sessions":0},{"date":"2026-09-06","count":3,"sessions":0},{"date":"2026-09-07","count":1,"sessions":0},{"date":"2026-09-08","count":2,"sessions":0},{"date":"2026-09-10","count":3,"sessions":0},{"date":"2026-09-11","count":1,"sessions":0},{"date":"2026-09-13","count":2,"sessions":0},{"date":"2026-09-14","count":3,"sessions":0},{"date":"2026-09-16","count":1,"sessions":0},{"date":"2026-09-17","count":2,"sessions":0},{"date":"2026-09-19","count":1,"sessions":0},{"date":"2026-09-20","count":1,"sessions":0},{"date":"2026-09-21","count":1,"sessions":0},{"date":"2026-09-22","count":3,"sessions":0},{"date":"2026-09-23","count":2,"sessions":0},{"date":"2026-09-24","count":3,"sessions":0},{"date":"2026-09-25","count":6,"sessions":0},{"date":"2026-10-02","count":2,"sessions":0},{"date":"2026-10-04","count":2,"sessions":0},{"date":"2026-10-05","count":1,"sessions":0},{"date":"2026-10-06","count":1,"sessions":0},{"date":"2026-10-07","count":1,"sessions":0},{"date":"2026-10-08","count":3,"sessions":0},{"date":"2026-10-10","count":1,"sessions":0},{"date":"2026-10-11","count":1,"sessions":0},{"date":"2026-10-12","count":2,"sessions":0},{"date":"2026-10-13","count":3,"sessions":0},{"date":"2026-10-14","count":4,"sessions":0},{"date":"2026-10-15","count":3,"sessions":1}],"recent_events":[{"timestamp":"2026-10-15T03:05:36","port":21,"proto":"tcp","app_proto":"","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"SSH-2.0-Go\r\n","payload_hex":"5353482d322e302d476f0d0a","method":"","user_agent":"","ja3":"","session":"676af7e4-d96d-4568-b4a7-77e1a6b44ec4","seq":1,"duration_ms":2101,"bytes_in":12,"bytes_out":34,"enriched":{"digest":"251052a6c1be1469","label":"SSH","strings":["SSH-2.0-Go"]}},{"timestamp":"2026-10-15T03:05:29","port":21,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:21\",\"user-agent\":\"Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.6312.86 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a32310d0a557365722d4167656e743a204d6f7a696c6c612f352e30204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132332e302e363331322e3836205361666172692f3533372e33360d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.6312.86 Safari/537.36","ja3":"a3710a0cb04a8c61bb7ed96e70103f1e","session":"0ee2b3c7-05d3-4093-bfbd-3114518f0a7d","seq":1,"duration_ms":100,"bytes_in":178,"bytes_out":34},{"timestamp":"2026-10-15T03:05:05","port":21,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:21\",\"user-agent\":\"Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.6312.86 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a32310d0a557365722d4167656e743a204d6f7a696c6c612f352e30204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132332e302e363331322e3836205361666172692f3533372e33360d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.6312.86 Safari/537.36","ja3":"","session":"46f24168-d675-4cf4-9d93-6fb1b98a9678","seq":1,"duration_ms":100,"bytes_in":178,"bytes_out":34},{"timestamp":"2026-10-14T20:46:28","port":195,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:195\",\"user-agent\":\"Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.6312.86 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/favicon.ico","summary":"","payload_hex":"474554202f66617669636f6e2e69636f20485454502f312e310d0a486f73743a20<HONEYPOT>3a3139350d0a557365722d4167656e743a204d6f7a696c6c612f352e30204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132332e302e363331322e3836205361666172692f3533372e33360d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.6312.86 Safari/537.36","ja3":"","session":"b0e8ff6c-3ce7-451b-b5dc-83cd9dc124e6","seq":1,"duration_ms":100,"bytes_in":189,"bytes_out":78},{"timestamp":"2026-10-14T11:51:30","port":5009,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:5009\",\"user-agent\":\"Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.6312.86 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/favicon.ico","summary":"","payload_hex":"474554202f66617669636f6e2e69636f20485454502f312e310d0a486f73743a20<HONEYPOT>3a353030390d0a557365722d4167656e743a204d6f7a696c6c612f352e30204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132332e302e363331322e3836205361666172692f3533372e33360d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.6312.86 Safari/537.36","ja3":"","session":"61d13502-e5b3-427d-b2eb-07f499b45753","seq":1,"duration_ms":100,"bytes_in":190,"bytes_out":78},{"timestamp":"2026-10-14T07:47:44","port":18245,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:18245\",\"user-agent\":\"Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.6312.86 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/favicon.ico","summary":"","payload_hex":"474554202f66617669636f6e2e69636f20485454502f312e310d0a486f73743a20<HONEYPOT>3a31383234350d0a557365722d4167656e743a204d6f7a696c6c612f352e30204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132332e302e363331322e3836205361666172692f3533372e33360d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.6312.86 Safari/537.36","ja3":"","session":"bf606322-47b7-4fec-92e8-68fa7c623dd8","seq":1,"duration_ms":100,"bytes_in":191,"bytes_out":78},{"timestamp":"2026-10-14T02:16:18","port":1080,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:1080\",\"user-agent\":\"Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.6312.86 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a313038300d0a557365722d4167656e743a204d6f7a696c6c612f352e30204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132332e302e363331322e3836205361666172692f3533372e33360d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.6312.86 Safari/537.36","ja3":"","session":"3e47b6b8-accc-49a5-bd05-a2a88a7f3f22","seq":1,"duration_ms":100,"bytes_in":179,"bytes_out":78},{"timestamp":"2026-10-13T21:53:20","port":7777,"proto":"tcp","app_proto":"","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"SSH-2.0-Go\r\n\u0000\u0000\u0003,\u0012\u0014\t\u0011�'�\u0006�{q���QI8i\u0000\u0000\u0000�curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1\u0000\u0000\u0001-ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa,ssh-dss,ssh-ed25519\u0000\u0000\u0000iaes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,arcfour256,arcfour128,arcfour,aes128-cbc,3des-cbc\u0000\u0000\u0000iaes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,arcfour256,arcfour128,arcfour,aes128-cbc,3des-cbc\u0000\u0000\u0000$hmac-sha2-256,hmac-sha1,hmac-sha1-96\u0000\u0000\u0000$hmac-sha2-256,hmac-sha1,hmac-sha1-96\u0000\u0000\u0000\u0004none\u0000\u0000\u0000\u0004none\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000Z!�8���+\u001d\f���j�\u0015%R","payload_hex":"5353482d322e302d476f0d0a0000032c121409118227de06957b718bcad0514938690000008c637572766532353531392d736861323536406c69627373682e6f72672c656364682d736861322d6e697374703235362c656364682d736861322d6e697374703338342c656364682d736861322d6e697374703532312c6469666669652d68656c6c6d616e2d67726f757031342d736861312c6469666669652d68656c6c6d616e2d67726f7570312d736861310000012d7373682d7273612d636572742d763031406f70656e7373682e636f6d2c7373682d6473732d636572742d763031406f70656e7373682e636f6d2c65636473612d736861322d6e697374703235362d636572742d763031406f70656e7373682e636f6d2c65636473612d736861322d6e697374703338342d636572742d763031406f70656e7373682e636f6d2c65636473612d736861322d6e697374703532312d636572742d763031406f70656e7373682e636f6d2c7373682d656432353531392d636572742d763031406f70656e7373682e636f6d2c65636473612d736861322d6e697374703235362c65636473612d736861322d6e697374703338342c65636473612d736861322d6e697374703532312c7373682d7273612c7373682d6473732c7373682d65643235353139000000696165733132382d6374722c6165733139322d6374722c6165733235362d6374722c6165733132382d67636d406f70656e7373682e636f6d2c617263666f75723235362c617263666f75723132382c617263666f75722c6165733132382d6362632c336465732d636263000000696165733132382d6374722c6165733139322d6374722c6165733235362d6374722c6165733132382d67636d406f70656e7373682e636f6d2c617263666f75723235362c617263666f75723132382c617263666f75722c6165733132382d6362632c336465732d63626300000024686d61632d736861322d3235362c686d61632d736861312c686d61632d736861312d393600000024686d61632d736861322d3235362c686d61632d736861312c686d61632d736861312d3936000000046e6f6e65000000046e6f6e65000000000000000000000000005a21bd389ac9d42b1d0cf580996ad6152552","method":"","user_agent":"","ja3":"","session":"655a23fc-f19c-44cc-8138-1c957b4154b8","seq":1,"duration_ms":205,"bytes_in":828,"bytes_out":13,"enriched":{"digest":"8f8a6cb43d703c0c","label":"SSH","strings":["SSH-2.0-Go","QI8i","curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nis…","-ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ecdsa-sha2-nistp256-c…","iaes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,arcfour256,arcfour128,a…","$hmac-sha2-256,hmac-sha1,hmac-sha1-96","none","noneZ!"],"iocs":{"domains":["libssh.org","openssh.com"]}}},{"timestamp":"2026-10-13T12:07:41","port":53,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:53\",\"user-agent\":\"Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.6312.86 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/favicon.ico","summary":"","payload_hex":"474554202f66617669636f6e2e69636f20485454502f312e310d0a486f73743a20<HONEYPOT>3a35330d0a557365722d4167656e743a204d6f7a696c6c612f352e30204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132332e302e363331322e3836205361666172692f3533372e33360d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.6312.86 Safari/537.36","ja3":"","session":"750cb159-c1d6-4ed4-8cd8-24b8eb4a3d47","seq":1,"duration_ms":101,"bytes_in":188,"bytes_out":78},{"timestamp":"2026-10-13T11:02:43","port":2455,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"��\u0001\u0000\u0000\u0000\u0001","payload_hex":"bbbb0100000001","method":"","user_agent":"","ja3":"","session":"38033e81-bd89-41b8-9d0c-32a20a22eb62","seq":1,"duration_ms":100,"bytes_in":7,"bytes_out":13}],"http_methods":[{"method":"GET","count":206}],"distinct_ports_total":150,"top_paths":[{"path":"/favicon.ico","count":117,"ports":87},{"path":"/","count":86,"ports":67},{"path":"/ms/1.0/","count":1,"ports":1},{"path":"/version","count":1,"ports":1},{"path":"/jmx?Hadoop:service=NameNode","count":1,"ports":1}],"distinct_paths_total":5,"top_snis":[],"top_hosts":[],"top_alpns":[{"value":"http/1.1","count":2}],"banners":[{"value":"SSH-2.0-Go","count":11}],"credentials":[],"header_profile":{"signature":["Accept","Accept-Encoding","Host","User-Agent"],"representative":[{"name":"Accept","value":"*/*","notable":false},{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Host","value":"<HONEYPOT>:21","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.6312.86 Safari/537.36","notable":false}],"distinct_sets":1,"events_with_headers":7},"tags":[],"data_as_of":"2026-10-16T07:03:45.111002+00:00"}