{"ip":"45.194.67.45","total_events":141,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"47+ ports swept","confidence":"medium","network_type":"CDN","why":["No exploit payloads observed.","Swept 47 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"21,038 bytes sent","bytes_sent":21038,"session_seconds":0,"persistent":false}},"first_seen":"2026-08-25T05:39:03","last_seen":"2026-08-28T13:51:38","events_24h":26,"events_7d":141,"geo":{"country_code":"US","country_name":"United States","region":"","city":"","lat":37.751,"lon":-97.822,"asn":215925,"org":"Vpsvault.host Ltd"},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as215925","label":"VPSVAULTHOST","category":"cdn","url":"https://www.peeringdb.com/asn/215925"},"cve_matches":[],"malware":[],"top_ports":[{"port":51004,"proto":"tcp","label":"","count":27},{"port":7005,"proto":"tcp","label":"","count":10},{"port":8087,"proto":"tcp","label":"","count":8},{"port":26,"proto":"tcp","label":"","count":7},{"port":2103,"proto":"tcp","label":"","count":4},{"port":7778,"proto":"tcp","label":"","count":4},{"port":20017,"proto":"tcp","label":"","count":3},{"port":10323,"proto":"tcp","label":"","count":3},{"port":8883,"proto":"tcp","label":"","count":3},{"port":20005,"proto":"tcp","label":"","count":3},{"port":9292,"proto":"tcp","label":"","count":3},{"port":7681,"proto":"tcp","label":"","count":3},{"port":8989,"proto":"tcp","label":"","count":3},{"port":49154,"proto":"tcp","label":"","count":3},{"port":9889,"proto":"tcp","label":"","count":3}],"fingerprints":{"ssh_hassh":["f25b2be37ce355c4c168981965c843bf"],"tls_ja4":["t13i100900_61a7ad8aa9b6_cb8fff09048f","t13i100900_61a7ad8aa9b6_367aa026f35a"],"tls_ja3":["f6a637410e98cb2b9854be8efded6057","4b1cebd3cfd0ee4c0733b8def9c831a0","c6478b46e3aa6926f829267f2bce8bbf","a5c5e873d7cbed39c0a25566030bf825"],"ja4h":["ge11nn0400_17292dadbc7b"]},"fingerprint_peers":{"t13i100900_61a7ad8aa9b6_cb8fff09048f":38,"t13i100900_61a7ad8aa9b6_367aa026f35a":18,"ge11nn0400_17292dadbc7b":2511,"f25b2be37ce355c4c168981965c843bf":30},"user_agents":["Mozilla/5.0 (compatible; FlowIQ/1.0; +https://flowiq-labs.com/scanning-info)"],"timeline":[{"date":"2026-08-25","count":10},{"date":"2026-08-26","count":92},{"date":"2026-08-27","count":27},{"date":"2026-08-28","count":12}],"recent_events":[{"timestamp":"2026-08-28T13:51:38","port":445,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"close\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (compatible; FlowIQ/1.0; +https://flowiq-labs.com/scanning-info)\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b20466c6f7749512f312e303b202b68747470733a2f2f666c6f7769712d6c6162732e636f6d2f7363616e6e696e672d696e666f290d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; FlowIQ/1.0; +https://flowiq-labs.com/scanning-info)","ja3":"","session":"13b6bc45-59dd-4139-88d4-17f536e7281d","seq":1,"duration_ms":100,"bytes_in":160,"bytes_out":77},{"timestamp":"2026-08-28T11:27:58","port":25565,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"close\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (compatible; FlowIQ/1.0; +https://flowiq-labs.com/scanning-info)\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b20466c6f7749512f312e303b202b68747470733a2f2f666c6f7769712d6c6162732e636f6d2f7363616e6e696e672d696e666f290d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; FlowIQ/1.0; +https://flowiq-labs.com/scanning-info)","ja3":"","session":"e60aa4a8-8069-4790-8a18-68704efb2bb7","seq":1,"duration_ms":100,"bytes_in":160,"bytes_out":77},{"timestamp":"2026-08-28T09:58:42","port":8000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"close\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (compatible; FlowIQ/1.0; +https://flowiq-labs.com/scanning-info)\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b20466c6f7749512f312e303b202b68747470733a2f2f666c6f7769712d6c6162732e636f6d2f7363616e6e696e672d696e666f290d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; FlowIQ/1.0; +https://flowiq-labs.com/scanning-info)","ja3":"","session":"dadb8531-53f2-4364-acdf-162b234b01d0","seq":1,"duration_ms":100,"bytes_in":161,"bytes_out":77},{"timestamp":"2026-08-28T08:50:46","port":465,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"close\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (compatible; FlowIQ/1.0; +https://flowiq-labs.com/scanning-info)\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b20466c6f7749512f312e303b202b68747470733a2f2f666c6f7769712d6c6162732e636f6d2f7363616e6e696e672d696e666f290d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; FlowIQ/1.0; +https://flowiq-labs.com/scanning-info)","ja3":"","session":"a64ec6b5-e33d-473a-a56e-ed068c92b0f4","seq":1,"duration_ms":101,"bytes_in":160,"bytes_out":40},{"timestamp":"2026-08-28T08:15:23","port":1344,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"close\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (compatible; FlowIQ/1.0; +https://flowiq-labs.com/scanning-info)\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b20466c6f7749512f312e303b202b68747470733a2f2f666c6f7769712d6c6162732e636f6d2f7363616e6e696e672d696e666f290d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; FlowIQ/1.0; +https://flowiq-labs.com/scanning-info)","ja3":"","session":"dca3b5b4-6669-4bee-adc8-41ce502faae0","seq":1,"duration_ms":100,"bytes_in":160,"bytes_out":77},{"timestamp":"2026-08-28T07:34:17","port":23,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"close\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (compatible; FlowIQ/1.0; +https://flowiq-labs.com/scanning-info)\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b20466c6f7749512f312e303b202b68747470733a2f2f666c6f7769712d6c6162732e636f6d2f7363616e6e696e672d696e666f290d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; FlowIQ/1.0; +https://flowiq-labs.com/scanning-info)","ja3":"","session":"e276ed48-5f54-488d-a3d2-05ca7fae3ecd","seq":1,"duration_ms":100,"bytes_in":161,"bytes_out":12},{"timestamp":"2026-08-28T07:27:10","port":1433,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"close\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (compatible; FlowIQ/1.0; +https://flowiq-labs.com/scanning-info)\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/favicon.ico","summary":"","payload_hex":"474554202f66617669636f6e2e69636f20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b20466c6f7749512f312e303b202b68747470733a2f2f666c6f7769712d6c6162732e636f6d2f7363616e6e696e672d696e666f290d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; FlowIQ/1.0; +https://flowiq-labs.com/scanning-info)","ja3":"a5c5e873d7cbed39c0a25566030bf825","session":"97734801-3736-4e67-af2c-7331e0bc0802","seq":1,"duration_ms":100,"bytes_in":172,"bytes_out":77},{"timestamp":"2026-08-28T07:27:07","port":1433,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"close\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (compatible; FlowIQ/1.0; +https://flowiq-labs.com/scanning-info)\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b20466c6f7749512f312e303b202b68747470733a2f2f666c6f7769712d6c6162732e636f6d2f7363616e6e696e672d696e666f290d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; FlowIQ/1.0; +https://flowiq-labs.com/scanning-info)","ja3":"c6478b46e3aa6926f829267f2bce8bbf","session":"91b4e8b1-093e-4e31-a44d-d7bd3cf193b2","seq":1,"duration_ms":100,"bytes_in":161,"bytes_out":77},{"timestamp":"2026-08-28T07:27:03","port":1433,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"close\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (compatible; FlowIQ/1.0; +https://flowiq-labs.com/scanning-info)\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b20466c6f7749512f312e303b202b68747470733a2f2f666c6f7769712d6c6162732e636f6d2f7363616e6e696e672d696e666f290d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; FlowIQ/1.0; +https://flowiq-labs.com/scanning-info)","ja3":"","session":"e374c778-326e-4b4b-9a34-eff1714c7909","seq":1,"duration_ms":100,"bytes_in":161,"bytes_out":77},{"timestamp":"2026-08-28T01:28:38","port":2103,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"connection\":\"close\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (compatible; FlowIQ/1.0; +https://flowiq-labs.com/scanning-info)\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/favicon.ico","summary":"","payload_hex":"474554202f66617669636f6e2e69636f20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b20466c6f7749512f312e303b202b68747470733a2f2f666c6f7769712d6c6162732e636f6d2f7363616e6e696e672d696e666f290d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; FlowIQ/1.0; +https://flowiq-labs.com/scanning-info)","ja3":"5fbff906b95c60b2ff13e38a214e3eda","session":"56526105-9617-4f8d-b47c-3c43cced63a6","seq":1,"duration_ms":100,"bytes_in":173,"bytes_out":77}],"http_methods":[{"method":"GET","count":91}],"distinct_ports_total":47,"top_paths":[{"path":"/","count":75,"ports":43},{"path":"/favicon.ico","count":16,"ports":16}],"distinct_paths_total":2,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[{"value":"SSH-2.0-FlowIQ_1.0","count":5}],"credentials":[],"header_profile":{"signature":["Accept","Connection","Host","User-Agent"],"representative":[{"name":"Accept","value":"*/*","notable":false},{"name":"Connection","value":"close","notable":false},{"name":"Host","value":"<HONEYPOT>","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (compatible; FlowIQ/1.0; +https://flowiq-labs.com/scanning-info)","notable":false}],"distinct_sets":1,"events_with_headers":10},"tags":[],"data_as_of":"2026-08-28T15:11:34.813032+00:00"}