{"ip":"45.194.92.52","total_events":98,"verdict":{"verdict":"probing","label":"Low-level probing","detail":null,"confidence":"low","network_type":"CDN","why":["98 event(s), fewer than 10 distinct ports, no exploit payloads.","Not in any known-scanner range.","Sent 5,205 bytes despite few ports and no known exploit path: focused interaction with one service, worth a look."],"engagement":{"level":"payload","label":"Sustained payload","detail":"5,205 bytes sent","bytes_sent":5205,"session_seconds":0,"persistent":false}},"first_seen":"2026-09-04T00:04:22","last_seen":"2026-10-01T17:55:22","events_24h":9,"events_7d":9,"geo":{"country_code":"US","country_name":"United States","region":"","city":"","lat":37.751,"lon":-97.822,"asn":215925,"org":"Vpsvault.host Ltd"},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as215925","label":"VPSVAULTHOST","category":"cdn","url":"https://www.peeringdb.com/asn/215925"},"cve_matches":[],"malware":[],"top_ports":[{"port":8000,"proto":"tcp","label":"HTTP-alt","count":42},{"port":9000,"proto":"tcp","label":"Web-alt","count":42},{"port":80,"proto":"tcp","label":"HTTP","count":5},{"port":8443,"proto":"tcp","label":"HTTPS-alt","count":3},{"port":444,"proto":"tcp","label":"","count":3},{"port":4433,"proto":"tcp","label":"","count":3}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i131000_f57a46bbacb6_f50d94e863eb"],"tls_client_hello":"16030105d6010005d20303dcd4075788e4145daa38ce68177c443b50f2424786a9928821f2d02bb73df35c201e7287e1a8ef3ed0324ff04f3b297d22d69c1f735a18106750f365902fed3280001acca9cca8c02bc02fc02cc030c009c013c00ac0141303130113020100056f000b00020100ff010001000017000000120000000500050100000000000a0010000e11ec11eb11ed001d001700180019000d001c001a090409050906080404030807080508060401050106010503060300320020001e090409050906080404030807080508060401050106010503060302010203002b0009080304030303020301003304ea04e811ec04c018015e560b36fef7cbe2b636165b687fd85c02e7719d8b49c3c215a0d330246263d092343d340c01e09de2fb8d28b490727814e3917c81e082bda37abd01c577d6601d933aba99b49110c16c349b8ff242441487360a85c88634a9325e51e26a8cb7889d83c096765958b411a32308e760a4e68905658bba630461cb073baea59afc7974b0297a6997ad37792913a04c6ccb3b6310b23cf31bcf0b43496535d9a54bf87a5d2f921e5390c14c7c07201566731406c6b657535c50c0c79427e8a6223148fa50b01bda680f1bce1c8ac45a6452b439ce8f06c350882b2f072d669608472c12acd9613234a7f547a73345185cd2bae2842bd7197a4145a98732b8764a5f42fc990df320ff344691862daea4b8d6c89d1396aa71b153a8293b133cc99d0b2e39557c38805f92970df9f29ab88c87b97689ae748f601ab6d0b883622c5ae46ac0add211f8cc7f63083af3a11b65fcb8baf6bb96390eec345212f92558990838f56165192458299d8f20c8e1e3721e2c2924d773ab2564a6cb72a563aed7069ac6b647c0b399dd2a59399b9b52567ff153834e8cbb101b2e369a9ca8d2a298f770443492306a1281844205c7161060b3b172cae6fca22239071562566f47658256c660f6b2073a634a94a3ac991dfa9580770ac5ea889456e085954bab0aa71ac59ba4b5bb31738b151f6456f052835aebae134711972c1b72957211c53700730820494ee7e7bb3c127572c299e4a8a3d511723c627ecbe37c0ebb2b4c6107c5469c8fc550b46c860d304116ab85e972b394109ebddac15acb35889c6298f91dfa256f1a5b0fd9962c815527e53331d31732944cbb93b38e0a174e284b24b76a6f3ff34e74c53e6249720b35bfb5e0c008531dae696789a4017b5c8279909ed957c2c6426f8129156b6cb34f381c6c621c767187f468740b7a1e7e2b5c273b2fd68ab5761a69b121a903354711d722489a0b846937ab68a63b68014411b7edb294e5844496328c552bcfd610ce9a975772e5c49606781683aad6f7c9ce24c781e0235b6400e5e890a530598d5a75b396743bf350bafb0dc4b83a11b0ab08e226ebf3069279c941663a351bb4dad44e095bce9e643750b84a30e87eaa0273b54ac0310b4f4bb61583da2fbb6260a89872656360082290779327e19104da410dd98a2d9b5cb8abc97a559b227c00bf1d8a286196214027793ec24f5841a9eb22c89d3c455105b2e2d75f37a58560090aa0d74f5833a87b5954cd97448204b1674588ae651a716243a2cc4edd310f89a056ab690dc8431534981970aca4a75359151b905d63c70d9c4a197c5d365588f758199610591af183c6c9c9eebc5fc38b5018790c8b1b035403b43ae657cb261878672754724fbe0898b7667e2a40772a73483b375345899bef4a1e6afc4e2e08b0ff711ced1a4798a79c8dbb2851d141af03aa2b684c94299885d683a9f035e2db4631b9b0abf1728a4880ebdabc046820570c95ad054794a1581eb22c10969565cb5260f11779c22543a0939e354af4a82c2ae97dbfd1bf27fcc63c47c2ad546ff1298f01b63c7873bc9ac373eba6a0deb772d537ae8dfb5a24e1a129d70f10413104322e3d31c34a353f35db084521df7ba872c1f8429cd28501f7f8878d30660282f9a54ba762cd38d802beee1762a572b1e3263b01cd9933bb3b720f7ea3836e24d62104d857ab2e01ceea4b001d00201762a572b1e3263b01cd9933bb3b720f7ea3836e24d62104d857ab2e","tls_ja3":["56b0f6febc953849f7ace70c5a2ae34d"],"http_akin":["b11cun040_00040411_2daa70d6"]},"fingerprint_peers":{"t13i131000_f57a46bbacb6_f50d94e863eb":2754,"b11cun040_00040411_2daa70d6":6},"akin_families":{},"user_agents":["Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36"],"timeline":[{"date":"2026-09-04","count":89},{"date":"2026-10-01","count":9}],"recent_events":[{"timestamp":"2026-10-01T17:55:22","port":4433,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"PROPFIND / HTTP/1.1\r\nHost: <HONEYPOT>:4433\r\nUser-Agent: -\r\nConnection: close\r\nReferer: http://<HONEYPOT>:4433/\r\n\r\n","payload_hex":"50524f5046494e44202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a343433330d0a557365722d4167656e743a202d0d0a436f6e6e656374696f6e3a20636c6f73650d0a526566657265723a20687474703a2f2f<HONEYPOT>3a343433332f0d0a0d0a","method":"","user_agent":"","ja3":"56b0f6febc953849f7ace70c5a2ae34d","session":"572b4535-3171-497c-9b6d-db2f6d46dece","seq":1,"duration_ms":100,"bytes_in":118,"bytes_out":12,"enriched":{"digest":"1fec411ab955c573","strings":["PROPFIND / HTTP/1.1","Host: <HONEYPOT>:4433","User-Agent: -","Connection: close","Referer: http://<HONEYPOT>:4433/"]}},{"timestamp":"2026-10-01T17:49:36","port":4433,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"PROPFIND / HTTP/1.1\r\nHost: <HONEYPOT>:4433\r\nUser-Agent: -\r\nConnection: close\r\nReferer: http://<HONEYPOT>:4433/\r\n\r\n","payload_hex":"50524f5046494e44202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a343433330d0a557365722d4167656e743a202d0d0a436f6e6e656374696f6e3a20636c6f73650d0a526566657265723a20687474703a2f2f<HONEYPOT>3a343433332f0d0a0d0a","method":"","user_agent":"","ja3":"56b0f6febc953849f7ace70c5a2ae34d","session":"915734ae-e47e-43ef-9d55-dd1dd0232b8c","seq":1,"duration_ms":100,"bytes_in":120,"bytes_out":12,"enriched":{"digest":"1fec411ab955c573","strings":["PROPFIND / HTTP/1.1","Host: <HONEYPOT>:4433","User-Agent: -","Connection: close","Referer: http://<HONEYPOT>:4433/"]}},{"timestamp":"2026-10-01T14:29:15","port":4433,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"PROPFIND / HTTP/1.1\r\nHost: <HONEYPOT>:4433\r\nUser-Agent: -\r\nConnection: close\r\nReferer: http://<HONEYPOT>:4433/\r\n\r\n","payload_hex":"50524f5046494e44202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a343433330d0a557365722d4167656e743a202d0d0a436f6e6e656374696f6e3a20636c6f73650d0a526566657265723a20687474703a2f2f<HONEYPOT>3a343433332f0d0a0d0a","method":"","user_agent":"","ja3":"56b0f6febc953849f7ace70c5a2ae34d","session":"de26bc20-11d5-4430-8401-bbf041d41646","seq":1,"duration_ms":100,"bytes_in":120,"bytes_out":12,"enriched":{"digest":"1fec411ab955c573","strings":["PROPFIND / HTTP/1.1","Host: <HONEYPOT>:4433","User-Agent: -","Connection: close","Referer: http://<HONEYPOT>:4433/"]}},{"timestamp":"2026-10-01T14:11:25","port":8443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"PROPFIND / HTTP/1.1\r\nHost: <HONEYPOT>:8443\r\nUser-Agent: -\r\nConnection: close\r\nReferer: http://<HONEYPOT>:8443/\r\n\r\n","payload_hex":"50524f5046494e44202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a383434330d0a557365722d4167656e743a202d0d0a436f6e6e656374696f6e3a20636c6f73650d0a526566657265723a20687474703a2f2f<HONEYPOT>3a383434332f0d0a0d0a","method":"","user_agent":"","ja3":"56b0f6febc953849f7ace70c5a2ae34d","session":"3c8b8166-0e2d-4a46-a26e-946f9ae62326","seq":1,"duration_ms":122,"bytes_in":120,"bytes_out":12,"enriched":{"digest":"a5de83a5d63bcef6","strings":["PROPFIND / HTTP/1.1","Host: <HONEYPOT>:8443","User-Agent: -","Connection: close","Referer: http://<HONEYPOT>:8443/"]}},{"timestamp":"2026-10-01T13:00:13","port":8443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"PROPFIND / HTTP/1.1\r\nHost: <HONEYPOT>:8443\r\nUser-Agent: -\r\nConnection: close\r\nReferer: http://<HONEYPOT>:8443/\r\n\r\n","payload_hex":"50524f5046494e44202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a383434330d0a557365722d4167656e743a202d0d0a436f6e6e656374696f6e3a20636c6f73650d0a526566657265723a20687474703a2f2f<HONEYPOT>3a383434332f0d0a0d0a","method":"","user_agent":"","ja3":"56b0f6febc953849f7ace70c5a2ae34d","session":"c7d9a0fe-296c-46ab-b69e-bf8b612d9767","seq":1,"duration_ms":100,"bytes_in":122,"bytes_out":12,"enriched":{"digest":"a5de83a5d63bcef6","strings":["PROPFIND / HTTP/1.1","Host: <HONEYPOT>:8443","User-Agent: -","Connection: close","Referer: http://<HONEYPOT>:8443/"]}},{"timestamp":"2026-10-01T11:42:30","port":8443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"PROPFIND / HTTP/1.1\r\nHost: <HONEYPOT>:8443\r\nUser-Agent: -\r\nConnection: close\r\nReferer: http://<HONEYPOT>:8443/\r\n\r\n","payload_hex":"50524f5046494e44202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a383434330d0a557365722d4167656e743a202d0d0a436f6e6e656374696f6e3a20636c6f73650d0a526566657265723a20687474703a2f2f<HONEYPOT>3a383434332f0d0a0d0a","method":"","user_agent":"","ja3":"56b0f6febc953849f7ace70c5a2ae34d","session":"1de0677e-b2ff-4c80-b9fa-f20fbbbbcb6b","seq":1,"duration_ms":101,"bytes_in":118,"bytes_out":12,"enriched":{"digest":"a5de83a5d63bcef6","strings":["PROPFIND / HTTP/1.1","Host: <HONEYPOT>:8443","User-Agent: -","Connection: close","Referer: http://<HONEYPOT>:8443/"]}},{"timestamp":"2026-10-01T03:57:33","port":444,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"PROPFIND / HTTP/1.1\r\nHost: <HONEYPOT>:444\r\nUser-Agent: -\r\nConnection: close\r\nReferer: http://<HONEYPOT>:444/\r\n\r\n","payload_hex":"50524f5046494e44202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a3434340d0a557365722d4167656e743a202d0d0a436f6e6e656374696f6e3a20636c6f73650d0a526566657265723a20687474703a2f2f<HONEYPOT>3a3434342f0d0a0d0a","method":"","user_agent":"","ja3":"56b0f6febc953849f7ace70c5a2ae34d","session":"ef160b81-be57-4fde-837a-b9ec3b54ca80","seq":1,"duration_ms":100,"bytes_in":118,"bytes_out":12,"enriched":{"digest":"d119575c0923fc9e","strings":["PROPFIND / HTTP/1.1","Host: <HONEYPOT>:444","User-Agent: -","Connection: close","Referer: http://<HONEYPOT>:444/"]}},{"timestamp":"2026-10-01T03:02:19","port":444,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"PROPFIND / HTTP/1.1\r\nHost: <HONEYPOT>:444\r\nUser-Agent: -\r\nConnection: close\r\nReferer: http://<HONEYPOT>:444/\r\n\r\n","payload_hex":"50524f5046494e44202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a3434340d0a557365722d4167656e743a202d0d0a436f6e6e656374696f6e3a20636c6f73650d0a526566657265723a20687474703a2f2f<HONEYPOT>3a3434342f0d0a0d0a","method":"","user_agent":"","ja3":"56b0f6febc953849f7ace70c5a2ae34d","session":"ce088e75-7047-43e3-a9d0-a3b2991b8f88","seq":1,"duration_ms":124,"bytes_in":118,"bytes_out":12,"enriched":{"digest":"d119575c0923fc9e","strings":["PROPFIND / HTTP/1.1","Host: <HONEYPOT>:444","User-Agent: -","Connection: close","Referer: http://<HONEYPOT>:444/"]}},{"timestamp":"2026-10-01T02:00:36","port":444,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"PROPFIND / HTTP/1.1\r\nHost: <HONEYPOT>:444\r\nUser-Agent: -\r\nConnection: close\r\nReferer: http://<HONEYPOT>:444/\r\n\r\n","payload_hex":"50524f5046494e44202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a3434340d0a557365722d4167656e743a202d0d0a436f6e6e656374696f6e3a20636c6f73650d0a526566657265723a20687474703a2f2f<HONEYPOT>3a3434342f0d0a0d0a","method":"","user_agent":"","ja3":"56b0f6febc953849f7ace70c5a2ae34d","session":"8acbabc1-f17a-4e7a-9790-5148574bf01b","seq":1,"duration_ms":101,"bytes_in":116,"bytes_out":12,"enriched":{"digest":"d119575c0923fc9e","strings":["PROPFIND / HTTP/1.1","Host: <HONEYPOT>:444","User-Agent: -","Connection: close","Referer: http://<HONEYPOT>:444/"]}},{"timestamp":"2026-09-04T02:47:05","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"host\":\"<HONEYPOT>:80\",\"referer\":\"http://<HONEYPOT>:80/\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a38300d0a436f6e6e656374696f6e3a20636c6f73650d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3132362e302e302e30205361666172692f3533372e33360d0a526566657265723a20687474703a2f2f<HONEYPOT>3a38302f0d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36","ja3":"","session":"b633d0e1-6cb0-448d-a0da-85632c6c73d8","seq":1,"duration_ms":100,"bytes_in":211,"bytes_out":77}],"http_methods":[{"method":"GET","count":5}],"distinct_ports_total":6,"top_paths":[{"path":"/","count":5,"ports":1}],"distinct_paths_total":1,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Connection","Host","Referer","User-Agent"],"representative":[{"name":"Connection","value":"close","notable":false},{"name":"Host","value":"<HONEYPOT>:80","notable":false},{"name":"Referer","value":"http://<HONEYPOT>:80/","notable":true},{"name":"User-Agent","value":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36","notable":false}],"distinct_sets":1,"events_with_headers":1},"tags":[],"data_as_of":"2026-10-01T18:08:43.770214+00:00"}