{"ip":"45.194.67.42","total_events":97,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"43+ ports swept","confidence":"medium","network_type":"CDN","why":["No exploit payloads observed.","Swept 43 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"14,794 bytes sent","bytes_sent":14794,"session_seconds":0,"persistent":false}},"first_seen":"2026-08-25T05:56:39","last_seen":"2026-08-28T14:47:13","events_24h":27,"events_7d":97,"geo":{"country_code":"US","country_name":"United States","region":"","city":"","lat":37.751,"lon":-97.822,"asn":215925,"org":"Vpsvault.host Ltd"},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as215925","label":"VPSVAULTHOST","category":"cdn","url":"https://www.peeringdb.com/asn/215925"},"cve_matches":[],"malware":[],"top_ports":[{"port":8443,"proto":"tcp","label":"HTTPS-alt","count":17},{"port":5061,"proto":"tcp","label":"SIPS","count":9},{"port":5222,"proto":"tcp","label":"XMPP","count":6},{"port":49501,"proto":"tcp","label":"","count":3},{"port":1180,"proto":"tcp","label":"","count":3},{"port":139,"proto":"tcp","label":"SMB","count":3},{"port":110,"proto":"tcp","label":"POP3","count":3},{"port":5060,"proto":"tcp","label":"SIP","count":3},{"port":49154,"proto":"tcp","label":"","count":3},{"port":32400,"proto":"tcp","label":"","count":3},{"port":11211,"proto":"tcp","label":"Memcached","count":2},{"port":4443,"proto":"tcp","label":"","count":2},{"port":1723,"proto":"tcp","label":"PPTP","count":2},{"port":53,"proto":"tcp","label":"DNS","count":2},{"port":8008,"proto":"tcp","label":"HTTP-alt","count":2}],"fingerprints":{"ssh_hassh":["f25b2be37ce355c4c168981965c843bf"],"tls_ja4":["t13i100900_61a7ad8aa9b6_cb8fff09048f","t13i100900_61a7ad8aa9b6_367aa026f35a"],"tls_ja3":["9619e8b0758a7fc2db74009f6a8c7384","9b7ecff96431b30fe659635661926f22","9878a0c83a5f86019f7d3519f68a36b7","d70b8c92231a6a1f1b62302d16d26bdf"],"ja4h":["ge11nn0400_17292dadbc7b"]},"fingerprint_peers":{"t13i100900_61a7ad8aa9b6_cb8fff09048f":38,"t13i100900_61a7ad8aa9b6_367aa026f35a":18,"ge11nn0400_17292dadbc7b":2511,"f25b2be37ce355c4c168981965c843bf":30},"user_agents":["Mozilla/5.0 (compatible; FlowIQ/1.0; +https://flowiq-labs.com/scanning-info)"],"timeline":[{"date":"2026-08-25","count":18},{"date":"2026-08-26","count":43},{"date":"2026-08-27","count":10},{"date":"2026-08-28","count":26}],"recent_events":[{"timestamp":"2026-08-28T14:47:13","port":53,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"close\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (compatible; FlowIQ/1.0; +https://flowiq-labs.com/scanning-info)\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/favicon.ico","summary":"","payload_hex":"474554202f66617669636f6e2e69636f20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b20466c6f7749512f312e303b202b68747470733a2f2f666c6f7769712d6c6162732e636f6d2f7363616e6e696e672d696e666f290d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; FlowIQ/1.0; +https://flowiq-labs.com/scanning-info)","ja3":"d70b8c92231a6a1f1b62302d16d26bdf","session":"f74a6e09-652b-4616-be44-77b2c7e06807","seq":1,"duration_ms":100,"bytes_in":172,"bytes_out":77},{"timestamp":"2026-08-28T14:47:09","port":53,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"close\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (compatible; FlowIQ/1.0; +https://flowiq-labs.com/scanning-info)\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b20466c6f7749512f312e303b202b68747470733a2f2f666c6f7769712d6c6162732e636f6d2f7363616e6e696e672d696e666f290d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; FlowIQ/1.0; +https://flowiq-labs.com/scanning-info)","ja3":"9878a0c83a5f86019f7d3519f68a36b7","session":"87db7012-2ac9-474b-9031-74de30274ee3","seq":1,"duration_ms":100,"bytes_in":161,"bytes_out":77},{"timestamp":"2026-08-28T13:28:14","port":4443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"close\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (compatible; FlowIQ/1.0; +https://flowiq-labs.com/scanning-info)\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b20466c6f7749512f312e303b202b68747470733a2f2f666c6f7769712d6c6162732e636f6d2f7363616e6e696e672d696e666f290d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; FlowIQ/1.0; +https://flowiq-labs.com/scanning-info)","ja3":"9619e8b0758a7fc2db74009f6a8c7384","session":"9c9f8cda-dbc6-4750-933f-4e6d25284a22","seq":1,"duration_ms":101,"bytes_in":160,"bytes_out":77},{"timestamp":"2026-08-28T13:28:10","port":4443,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"close\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (compatible; FlowIQ/1.0; +https://flowiq-labs.com/scanning-info)\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b20466c6f7749512f312e303b202b68747470733a2f2f666c6f7769712d6c6162732e636f6d2f7363616e6e696e672d696e666f290d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; FlowIQ/1.0; +https://flowiq-labs.com/scanning-info)","ja3":"","session":"767ec6dc-e393-4459-8e8c-96162aaff1d7","seq":1,"duration_ms":101,"bytes_in":160,"bytes_out":77},{"timestamp":"2026-08-28T11:20:25","port":25566,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"close\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (compatible; FlowIQ/1.0; +https://flowiq-labs.com/scanning-info)\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b20466c6f7749512f312e303b202b68747470733a2f2f666c6f7769712d6c6162732e636f6d2f7363616e6e696e672d696e666f290d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; FlowIQ/1.0; +https://flowiq-labs.com/scanning-info)","ja3":"","session":"a305283e-d4c0-4beb-b432-2ea084ce4d5b","seq":1,"duration_ms":100,"bytes_in":160,"bytes_out":77},{"timestamp":"2026-08-28T08:57:51","port":8443,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"close\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (compatible; FlowIQ/1.0; +https://flowiq-labs.com/scanning-info)\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b20466c6f7749512f312e303b202b68747470733a2f2f666c6f7769712d6c6162732e636f6d2f7363616e6e696e672d696e666f290d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; FlowIQ/1.0; +https://flowiq-labs.com/scanning-info)","ja3":"","session":"eebc7d1e-eedd-41b3-aa8e-dab451d2fd02","seq":1,"duration_ms":100,"bytes_in":161,"bytes_out":77},{"timestamp":"2026-08-28T08:57:31","port":8443,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000�\u0000\u0001\u001a+<M\u0000\u0001\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000","payload_hex":"009c00011a2b3c4d000100000100000000000001000000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000","method":"","user_agent":"","ja3":"","session":"b591f5d3-3dcc-461f-81b2-372038da3266","seq":1,"duration_ms":100,"bytes_in":116,"bytes_out":12},{"timestamp":"2026-08-28T08:57:21","port":8443,"proto":"tcp","app_proto":"","app_protocol":"rtsp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"OPTIONS rtsp://<HONEYPOT>:8443 RTSP/1.0\r\nCSeq: 1\r\nUser-Agent: FlowIQ\r\n\r\n","payload_hex":"4f5054494f4e5320727473703a2f2f<HONEYPOT>3a3834343320525453502f312e300d0a435365713a20310d0a557365722d4167656e743a20466c6f7749510d0a0d0a","method":"","user_agent":"","ja3":"","session":"0596ecd2-9aa3-4d8b-a28a-dcdf1be0eeea","seq":1,"duration_ms":100,"bytes_in":75,"bytes_out":77,"enriched":{"digest":"c897135d1f341bdf","label":"HTTP","strings":["OPTIONS rtsp://<HONEYPOT>:8443 RTSP/1.0","CSeq: 1","User-Agent: FlowIQ"]}},{"timestamp":"2026-08-28T08:57:18","port":8443,"proto":"tcp","app_proto":"","app_protocol":"nfs","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"�\u0000\u0000(\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0002\u0000\u0001��\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000","payload_hex":"80000028000000010000000000000002000186a0000000020000000000000000000000000000000000000000","method":"","user_agent":"","ja3":"","session":"3fecdfe7-b542-4232-a659-85f43e34fb5e","seq":1,"duration_ms":100,"bytes_in":44,"bytes_out":12},{"timestamp":"2026-08-28T08:57:17","port":8443,"proto":"tcp","app_proto":"","app_protocol":"http","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"OPTIONS sip:<HONEYPOT>:8443 SIP/2.0\r\nVia: SIP/2.0/TCP <HONEYPOT>:8443;branch=z9hG4bK0f3bf60f\r\nMax-Forwards: 70\r\nFrom: <sip:scanner@<HONEYPOT>>;tag=0f3bf60f\r\nTo: <sip:<HONEYPOT>:8443>\r\nCall-ID: 0f3bf60f@<HONEYPOT>\r\nCSeq: 1 OPTIONS\r\nContact: <sip:scanner@<HONEYPOT>:8443>\r\nAccept: application/sdp\r\nContent-Length: 0\r\n\r\n","payload_hex":"4f5054494f4e53207369703a<HONEYPOT>3a38343433205349502f322e300d0a5669613a205349502f322e302f54435020<HONEYPOT>3a383434333b6272616e63683d7a39684734624b30663362663630660d0a4d61782d466f7277617264733a2037300d0a46726f6d3a203c7369703a7363616e6e657240<HONEYPOT>3e3b7461673d30663362663630660d0a546f3a203c7369703a<HONEYPOT>3a383434333e0d0a43616c6c2d49443a20306633626636306640<HONEYPOT>0d0a435365713a2031204f5054494f4e530d0a436f6e746163743a203c7369703a7363616e6e657240<HONEYPOT>3a383434333e0d0a4163636570743a206170706c69636174696f6e2f7364700d0a436f6e74656e742d4c656e6774683a20300d0a0d0a","method":"","user_agent":"","ja3":"","session":"c9cbe3e3-a15e-4755-b5c1-04caa1ac6fd1","seq":1,"duration_ms":100,"bytes_in":335,"bytes_out":77,"enriched":{"digest":"f6acfd94a06cbb75","label":"HTTP","strings":["OPTIONS sip:<HONEYPOT>:8443 SIP/2.0","Via: SIP/2.0/TCP <HONEYPOT>:8443;branch=z9hG4bK0f3bf60f","Max-Forwards: 70","From: <sip:scanner@<HONEYPOT>>;tag=0f3bf60f","To: <sip:<HONEYPOT>:8443>","Call-ID: 0f3bf60f@<HONEYPOT>","CSeq: 1 OPTIONS","Contact: <sip:scanner@<HONEYPOT>:8443>","Accept: application/sdp","Content-Length: 0"],"iocs":{"paths":["/2.0/TCP"]}}}],"http_methods":[{"method":"GET","count":67}],"distinct_ports_total":43,"top_paths":[{"path":"/","count":57,"ports":41},{"path":"/favicon.ico","count":10,"ports":10}],"distinct_paths_total":2,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[{"value":"SSH-2.0-FlowIQ_1.0","count":3}],"credentials":[],"header_profile":{"signature":["Accept","Connection","Host","User-Agent"],"representative":[{"name":"Accept","value":"*/*","notable":false},{"name":"Connection","value":"close","notable":false},{"name":"Host","value":"<HONEYPOT>","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (compatible; FlowIQ/1.0; +https://flowiq-labs.com/scanning-info)","notable":false}],"distinct_sets":1,"events_with_headers":6},"tags":[],"data_as_of":"2026-08-28T15:21:50.248203+00:00"}