{"ip":"45.205.1.122","total_events":141,"verdict":{"verdict":"probing","label":"Low-level probing","detail":null,"confidence":"low","network_type":"CDN","why":["141 event(s), fewer than 10 distinct ports, no exploit payloads.","Not in any known-scanner range.","Sent 9,009 bytes despite few ports and no known exploit path: focused interaction with one service, worth a look."],"engagement":{"level":"payload","label":"Sustained payload","detail":"9,009 bytes sent","bytes_sent":9009,"session_seconds":0,"persistent":false}},"first_seen":"2026-07-25T05:57:25","last_seen":"2026-08-15T07:37:11","events_24h":9,"events_7d":67,"geo":{"country_code":"BR","country_name":"Brazil","region":"","city":"","lat":-22.8305,"lon":-43.2192,"asn":215925,"org":"Vpsvault.host Ltd"},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as215925","label":"VPSVAULTHOST","category":"cdn","url":"https://www.peeringdb.com/asn/215925"},"cve_matches":[],"malware":[],"top_ports":[{"port":60001,"proto":"tcp","label":"","count":89},{"port":80,"proto":"tcp","label":"HTTP","count":52}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[],"ja4h":["ge11nn0200_f24fcf356134"]},"fingerprint_peers":{"ge11nn0200_f24fcf356134":39},"user_agents":[],"timeline":[{"date":"2026-07-25","count":1},{"date":"2026-07-26","count":7},{"date":"2026-07-31","count":7},{"date":"2026-08-01","count":6},{"date":"2026-08-02","count":8},{"date":"2026-08-03","count":8},{"date":"2026-08-04","count":1},{"date":"2026-08-05","count":10},{"date":"2026-08-06","count":12},{"date":"2026-08-07","count":11},{"date":"2026-08-08","count":9},{"date":"2026-08-09","count":10},{"date":"2026-08-10","count":8},{"date":"2026-08-11","count":9},{"date":"2026-08-12","count":11},{"date":"2026-08-13","count":10},{"date":"2026-08-14","count":9},{"date":"2026-08-15","count":4}],"recent_events":[{"timestamp":"2026-08-15T07:37:11","port":60001,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"host\":\"<HONEYPOT>:60001\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a36303030310d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"24cf401b-c38c-4783-a843-ddb9df5644b8","seq":1,"duration_ms":100,"bytes_in":65,"bytes_out":77},{"timestamp":"2026-08-15T06:32:15","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"host\":\"<HONEYPOT>:80\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a38300d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"4beed5c2-a9ad-49b3-bdfc-d1cf7894b21e","seq":1,"duration_ms":100,"bytes_in":62,"bytes_out":77},{"timestamp":"2026-08-15T02:14:21","port":60001,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"host\":\"<HONEYPOT>:60001\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a36303030310d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"056c2290-50c1-4ff7-b7c2-fd1053de4cb2","seq":1,"duration_ms":100,"bytes_in":65,"bytes_out":77},{"timestamp":"2026-08-15T01:40:45","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"host\":\"<HONEYPOT>:80\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a38300d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"2a6b0b5b-cd66-46d7-85b5-b1f8a023da50","seq":1,"duration_ms":100,"bytes_in":62,"bytes_out":77},{"timestamp":"2026-08-14T21:49:45","port":60001,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"host\":\"<HONEYPOT>:60001\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a36303030310d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"3c125846-1a14-46d1-8afb-cae4fc16f35d","seq":1,"duration_ms":100,"bytes_in":65,"bytes_out":77},{"timestamp":"2026-08-14T19:03:54","port":60001,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"host\":\"<HONEYPOT>:60001\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a36303030310d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"03b15e26-a905-45e9-bb09-d6cd434c3a3f","seq":1,"duration_ms":100,"bytes_in":65,"bytes_out":77},{"timestamp":"2026-08-14T16:04:22","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"host\":\"<HONEYPOT>:80\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a38300d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"632a2390-d02e-47b8-847e-fed1e75494ec","seq":1,"duration_ms":100,"bytes_in":62,"bytes_out":77},{"timestamp":"2026-08-14T13:51:52","port":60001,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"host\":\"<HONEYPOT>:60001\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a36303030310d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"85d668f4-151d-44ed-a52c-0b80ad142fa5","seq":1,"duration_ms":100,"bytes_in":65,"bytes_out":77},{"timestamp":"2026-08-14T10:44:03","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"host\":\"<HONEYPOT>:80\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a38300d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"6df7cb80-d5d0-4dfb-9e86-181bc6ad5dc7","seq":1,"duration_ms":100,"bytes_in":62,"bytes_out":77},{"timestamp":"2026-08-14T08:16:17","port":60001,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"host\":\"<HONEYPOT>:60001\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a36303030310d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"95a2e7a5-76c7-473b-8cd7-8a544577d637","seq":1,"duration_ms":100,"bytes_in":65,"bytes_out":77}],"http_methods":[{"method":"GET","count":141}],"distinct_ports_total":2,"top_paths":[{"path":"/","count":141,"ports":2}],"distinct_paths_total":1,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Connection","Host"],"representative":[{"name":"Connection","value":"close","notable":false},{"name":"Host","value":"<HONEYPOT>:60001","notable":false}],"distinct_sets":1,"events_with_headers":10},"tags":[],"data_as_of":"2026-08-15T10:38:53.605161+00:00"}