{"ip":"45.194.92.53","total_events":207,"verdict":{"verdict":"probing","label":"Low-level probing","detail":null,"confidence":"low","network_type":"CDN","why":["207 event(s), fewer than 10 distinct ports, no exploit payloads.","Not in any known-scanner range.","Sent 9,539 bytes despite few ports and no known exploit path: focused interaction with one service, worth a look."],"engagement":{"level":"payload","label":"Sustained payload","detail":"9,539 bytes sent","bytes_sent":9539,"session_seconds":0,"persistent":false}},"first_seen":"2026-09-04T03:28:23","last_seen":"2026-09-07T09:51:12","events_24h":0,"events_7d":0,"geo":{"country_code":"US","country_name":"United States","region":"","city":"","lat":37.751,"lon":-97.822,"asn":215925,"org":"Vpsvault.host Ltd"},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as215925","label":"VPSVAULTHOST","category":"cdn","url":"https://www.peeringdb.com/asn/215925"},"cve_matches":[],"malware":[],"top_ports":[{"port":8000,"proto":"tcp","label":"HTTP-alt","count":111},{"port":9000,"proto":"tcp","label":"Web-alt","count":42},{"port":8001,"proto":"tcp","label":"","count":42},{"port":80,"proto":"tcp","label":"HTTP","count":9},{"port":88,"proto":"tcp","label":"","count":1},{"port":9010,"proto":"tcp","label":"","count":1},{"port":81,"proto":"tcp","label":"","count":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":["b11cun040_00040411_2daa70d6","b11cun010_00040000_c4b2c4aa","b11cun070_0004003f_8a4d1a98"]},"fingerprint_peers":{"b11cun010_00040000_c4b2c4aa":647,"b11cun070_0004003f_8a4d1a98":11,"b11cun040_00040411_2daa70d6":7},"akin_families":{},"user_agents":["Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36","Mozilla/5.0"],"timeline":[{"date":"2026-09-04","count":203},{"date":"2026-09-05","count":1},{"date":"2026-09-07","count":3}],"recent_events":[{"timestamp":"2026-09-07T09:51:12","port":8000,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"Z�\u0001\u0000\u0000\u0000\u0000\u0019\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0005\u0000\u0000\u0000\u0000R6M.\u0002","payload_hex":"5aa5010000000019000000010000000100000000000000050000000052364d2e02","method":"","user_agent":"","ja3":"","session":"a375ace1-7e65-405d-9e44-36238b7bc75d","seq":1,"duration_ms":100,"bytes_in":33,"bytes_out":12,"enriched":{"digest":"fd31847a086086c8","strings":["R6M."]}},{"timestamp":"2026-09-07T09:50:24","port":8000,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"Z�\u0001\u0000\u0000\u0000\u0000\u0019\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0005\u0000\u0000\u0000\u0000R6M.\u0002","payload_hex":"5aa5010000000019000000010000000100000000000000050000000052364d2e02","method":"","user_agent":"","ja3":"","session":"39b6df6c-8fed-4232-83f4-5bec575841d1","seq":1,"duration_ms":100,"bytes_in":33,"bytes_out":12,"enriched":{"digest":"fd31847a086086c8","strings":["R6M."]}},{"timestamp":"2026-09-07T06:40:54","port":9010,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"host\":\"<HONEYPOT>:9010\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a393031300d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"14ecadc2-e335-4ca6-9cf4-86b93c73b922","seq":1,"duration_ms":100,"bytes_in":43,"bytes_out":77},{"timestamp":"2026-09-05T16:28:36","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8\",\"accept-encoding\":\"gzip, deflate\",\"accept-language\":\"en-GB,en;q=0.5\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:80\",\"upgrade-insecure-requests\":\"1\",\"user-agent\":\"Mozilla/5.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a38300d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a4163636570743a20746578742f68746d6c2c6170706c69636174696f6e2f7868746d6c2b786d6c2c6170706c69636174696f6e2f786d6c3b713d302e392c696d6167652f776562702c2a2f2a3b713d302e380d0a4163636570742d4c616e67756167653a20656e2d47422c656e3b713d302e350d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a436f6e6e656374696f6e3a20636c6f73650d0a557067726164652d496e7365637572652d52657175657374733a20310d0a0d0a","method":"GET","user_agent":"Mozilla/5.0","ja3":"","session":"42cf13c8-f96c-47cb-99ad-0f92eebf7d67","seq":1,"duration_ms":100,"bytes_in":265,"bytes_out":77},{"timestamp":"2026-09-04T18:48:16","port":8001,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"Z�\u0001\u0000\u0000\u0000\u0000\u001d\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0005\u0000\u0000\u0000\u0004R6M.\u0002\u0005j\u0016s","payload_hex":"5aa501000000001d000000010000000100000000000000050000000452364d2e02056a1673","method":"","user_agent":"","ja3":"","session":"6fa7b9ac-7641-42c6-9851-f0eafada7802","seq":1,"duration_ms":100,"bytes_in":37,"bytes_out":12,"enriched":{"digest":"a2c7f3e1c593c7fe","strings":["R6M."]}},{"timestamp":"2026-09-04T18:48:16","port":8001,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"Z�\u0001\u0000\u0000\u0000\u0000\u001d\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0005\u0000\u0000\u0000\u0004R6M.\u0002\u0004c\u0012w","payload_hex":"5aa501000000001d000000010000000100000000000000050000000452364d2e0204631277","method":"","user_agent":"","ja3":"","session":"d8ef4967-02a2-43ce-89c9-3ba1b13c89f1","seq":1,"duration_ms":100,"bytes_in":37,"bytes_out":12,"enriched":{"digest":"76a285565799c7cf","strings":["R6M."]}},{"timestamp":"2026-09-04T18:48:16","port":8001,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"Z�\u0001\u0000\u0000\u0000\u0000\u001d\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0005\u0000\u0000\u0000\u0004R6M.\u0002\u0004j\u0012s","payload_hex":"5aa501000000001d000000010000000100000000000000050000000452364d2e02046a1273","method":"","user_agent":"","ja3":"","session":"0e1fca49-b8a6-4c9b-9615-4841bb47af9e","seq":1,"duration_ms":100,"bytes_in":37,"bytes_out":12,"enriched":{"digest":"f6fe8ce48a96e5fe","strings":["R6M."]}},{"timestamp":"2026-09-04T18:48:16","port":8001,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"Z�\u0001\u0000\u0000\u0000\u0000\u001d\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0005\u0000\u0000\u0000\u0004R6M.\u0002\u000bb\u0010s","payload_hex":"5aa501000000001d000000010000000100000000000000050000000452364d2e020b621073","method":"","user_agent":"","ja3":"","session":"2443f2ac-e566-4367-af55-3131dc903800","seq":1,"duration_ms":100,"bytes_in":37,"bytes_out":12,"enriched":{"digest":"633c6e26a02af82b","strings":["R6M."]}},{"timestamp":"2026-09-04T18:48:16","port":8001,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"Z�\u0001\u0000\u0000\u0000\u0000\u001d\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0005\u0000\u0000\u0000\u0004R6M.\u0002\u000bd\u0014u","payload_hex":"5aa501000000001d000000010000000100000000000000050000000452364d2e020b641475","method":"","user_agent":"","ja3":"","session":"73992b2c-fad1-4a88-824e-15ac71f1af26","seq":1,"duration_ms":100,"bytes_in":37,"bytes_out":12,"enriched":{"digest":"e355739cb82f7a55","strings":["R6M."]}},{"timestamp":"2026-09-04T18:48:16","port":8001,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"Z�\u0001\u0000\u0000\u0000\u0000\u001d\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0005\u0000\u0000\u0000\u0004R6M.\u0002\u000be\u0014","payload_hex":"5aa501000000001d000000010000000100000000000000050000000452364d2e020b65147f","method":"","user_agent":"","ja3":"","session":"339eea0d-24b7-491e-b911-7ba217bf96f9","seq":1,"duration_ms":100,"bytes_in":37,"bytes_out":12,"enriched":{"digest":"7d34a833cd1f4ed6","strings":["R6M."]}}],"http_methods":[{"method":"GET","count":12}],"distinct_ports_total":7,"top_paths":[{"path":"/","count":12,"ports":4}],"distinct_paths_total":1,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","Accept-Encoding","Accept-Language","Connection","Host","Upgrade-Insecure-Requests","User-Agent"],"representative":[{"name":"Accept","value":"text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8","notable":false},{"name":"Accept-Encoding","value":"gzip, deflate","notable":false},{"name":"Accept-Language","value":"en-GB,en;q=0.5","notable":false},{"name":"Connection","value":"close","notable":false},{"name":"Host","value":"<HONEYPOT>:80","notable":false},{"name":"Upgrade-Insecure-Requests","value":"1","notable":false},{"name":"User-Agent","value":"Mozilla/5.0","notable":false}],"distinct_sets":2,"events_with_headers":2},"tags":[],"data_as_of":"2026-09-30T16:52:43.418450+00:00"}