{"ip":"45.56.118.133","total_events":130,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"17+ ports swept","confidence":"medium","network_type":"CDN","why":["No exploit payloads observed.","Swept 17 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"4,676 bytes sent","bytes_sent":4676,"session_seconds":6,"persistent":false}},"first_seen":"2026-03-13T21:20:26","last_seen":"2026-09-24T21:39:31","events_24h":0,"events_7d":32,"geo":{"country_code":"US","country_name":"United States","region":"Georgia","city":"Atlanta","lat":33.7485,"lon":-84.3871,"asn":63949,"org":"Akamai Connected Cloud"},"source_domain":"45-56-118-133.ip.linodeusercontent.com","known_scanners":[],"scanner_tag":{"key":"linode","label":"Linode (Akamai)","category":"hosting_provider","url":"https://www.linode.com/"},"cve_matches":[],"malware":[],"top_ports":[{"port":80,"proto":"tcp","label":"HTTP","count":32},{"port":27017,"proto":"tcp","label":"MongoDB","count":8},{"port":8728,"proto":"tcp","label":"","count":8},{"port":1935,"proto":"tcp","label":"","count":8},{"port":6081,"proto":"tcp","label":"","count":7},{"port":2347,"proto":"tcp","label":"","count":7},{"port":1990,"proto":"tcp","label":"","count":7},{"port":3386,"proto":"tcp","label":"","count":7},{"port":54321,"proto":"tcp","label":"","count":7},{"port":5123,"proto":"tcp","label":"","count":7},{"port":9800,"proto":"tcp","label":"","count":7},{"port":2087,"proto":"tcp","label":"","count":6},{"port":1888,"proto":"tcp","label":"","count":6},{"port":27036,"proto":"tcp","label":"","count":5},{"port":993,"proto":"tcp","label":"IMAPS","count":5}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i751000_479067518aa3_d41ae481755e"],"tls_client_hello":"1603010200010001fc03035a7a3c56368f4c8e1bf9bdabb2e2eb2793a029dfcde7e44d9d2411e20e87cd722093bcd752feebd64473a30ceb62d75ec9ca0da4e44693f2572e0272b7600859430096130213031301003300390035002fc02cc03000a3009fcca9cca8ccaac0afc0adc0a3c09fc05dc061c057c053c02bc02f00a2009ec0aec0acc0a2c09ec05cc060c056c052c024c028006b006ac073c07700c400c3c023c02700670040c072c07600be00bdc00ac014003800880087c009c013003200450044009dc0a1c09dc051009cc0a0c09cc050003d00c0003c00ba0084004100ff0100011d000b000403000102000a00160014001d0017001e0019001801000101010201030104002300000016000000170000000d002a0028040305030603080708080809080a080b080408050806040105010601030303010302040205020602002b00050403040303002d00020101003300260024001d00206f6982ed7a67aa5451f9dfb2b9e6adf5f8f11399992e231c7790dda0fe55036400150084000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000","tls_ja3":["327efd8a5e8ed9fa2b145f126b748661"],"http_akin":["b11cun030_00040011_c91eaf54","b11cuq020_00040800_724c10fb","b11cun051_10040011_985b9497_x473c","b10lun000_00000000_334359b9"]},"fingerprint_peers":{"t13i751000_479067518aa3_d41ae481755e":646,"b11cun030_00040011_c91eaf54":549,"b11cuq020_00040800_724c10fb":2,"b11cun051_10040011_985b9497_x473c":1,"b10lun000_00000000_334359b9":2219},"akin_families":{"b11cun030_00040011_c91eaf54":{"head":"b11cun030_00040011_c91eaf54","shapes":3,"ips":548},"b10lun000_00000000_334359b9":{"head":"b10lun000_00000000_334359b9","shapes":2,"ips":2218}},"user_agents":["Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html)"],"timeline":[{"date":"2026-09-08","count":7},{"date":"2026-09-24","count":32}],"recent_events":[{"timestamp":"2026-09-24T21:39:31","port":80,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"access-control-request-method\":\"PATCH\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:80\",\"origin\":\"example.com\",\"user-agent\":\"Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html)\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"4f5054494f4e53202f20485454502f312e310d0a4163636573732d436f6e74726f6c2d526571756573742d4d6574686f643a2050415443480d0a486f73743a20<HONEYPOT>3a38300d0a4f726967696e3a206578616d706c652e636f6d0d0a436f6e6e656374696f6e3a20636c6f73650d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b204e6d617020536372697074696e6720456e67696e653b2068747470733a2f2f6e6d61702e6f72672f626f6f6b2f6e73652e68746d6c290d0a0d0a","method":"OPTIONS","user_agent":"Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html)","ja3":"327efd8a5e8ed9fa2b145f126b748661","session":"f2092133-313a-4f62-9aec-8d75d439f9e5","seq":1,"duration_ms":120,"bytes_in":217,"bytes_out":78},{"timestamp":"2026-09-24T21:39:31","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"access-control-request-method\":\"PATCH\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:80\",\"origin\":\"example.com\",\"user-agent\":\"Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html)\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"4f5054494f4e53202f20485454502f312e310d0a4163636573732d436f6e74726f6c2d526571756573742d4d6574686f643a2050415443480d0a486f73743a20<HONEYPOT>3a38300d0a4f726967696e3a206578616d706c652e636f6d0d0a436f6e6e656374696f6e3a20636c6f73650d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b204e6d617020536372697074696e6720456e67696e653b2068747470733a2f2f6e6d61702e6f72672f626f6f6b2f6e73652e68746d6c290d0a0d0a","method":"OPTIONS","user_agent":"Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html)","ja3":"","session":"4b9d28e6-1467-4f1f-9f01-479c73eccdf8","seq":1,"duration_ms":100,"bytes_in":217,"bytes_out":78},{"timestamp":"2026-09-24T21:39:30","port":80,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"access-control-request-method\":\"DELETE\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:80\",\"origin\":\"example.com\",\"user-agent\":\"Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html)\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"4f5054494f4e53202f20485454502f312e310d0a4163636573732d436f6e74726f6c2d526571756573742d4d6574686f643a2044454c4554450d0a486f73743a20<HONEYPOT>3a38300d0a4f726967696e3a206578616d706c652e636f6d0d0a436f6e6e656374696f6e3a20636c6f73650d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b204e6d617020536372697074696e6720456e67696e653b2068747470733a2f2f6e6d61702e6f72672f626f6f6b2f6e73652e68746d6c290d0a0d0a","method":"OPTIONS","user_agent":"Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html)","ja3":"327efd8a5e8ed9fa2b145f126b748661","session":"8010738a-267c-4bd3-81a4-aa5897a01449","seq":1,"duration_ms":120,"bytes_in":218,"bytes_out":78},{"timestamp":"2026-09-24T21:39:30","port":80,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"access-control-request-method\":\"TRACE\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:80\",\"origin\":\"example.com\",\"user-agent\":\"Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html)\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"4f5054494f4e53202f20485454502f312e310d0a4163636573732d436f6e74726f6c2d526571756573742d4d6574686f643a2054524143450d0a486f73743a20<HONEYPOT>3a38300d0a4f726967696e3a206578616d706c652e636f6d0d0a436f6e6e656374696f6e3a20636c6f73650d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b204e6d617020536372697074696e6720456e67696e653b2068747470733a2f2f6e6d61702e6f72672f626f6f6b2f6e73652e68746d6c290d0a0d0a","method":"OPTIONS","user_agent":"Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html)","ja3":"327efd8a5e8ed9fa2b145f126b748661","session":"db5b9b46-9490-446a-b25b-3fdaec40c292","seq":1,"duration_ms":120,"bytes_in":217,"bytes_out":78},{"timestamp":"2026-09-24T21:39:30","port":80,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"access-control-request-method\":\"OPTIONS\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:80\",\"origin\":\"example.com\",\"user-agent\":\"Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html)\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"4f5054494f4e53202f20485454502f312e310d0a4163636573732d436f6e74726f6c2d526571756573742d4d6574686f643a204f5054494f4e530d0a486f73743a20<HONEYPOT>3a38300d0a4f726967696e3a206578616d706c652e636f6d0d0a436f6e6e656374696f6e3a20636c6f73650d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b204e6d617020536372697074696e6720456e67696e653b2068747470733a2f2f6e6d61702e6f72672f626f6f6b2f6e73652e68746d6c290d0a0d0a","method":"OPTIONS","user_agent":"Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html)","ja3":"327efd8a5e8ed9fa2b145f126b748661","session":"0baec557-89ca-4fb9-a19f-21a4d9a734c0","seq":1,"duration_ms":120,"bytes_in":219,"bytes_out":78},{"timestamp":"2026-09-24T21:39:30","port":80,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"access-control-request-method\":\"CONNECT\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:80\",\"origin\":\"example.com\",\"user-agent\":\"Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html)\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"4f5054494f4e53202f20485454502f312e310d0a4163636573732d436f6e74726f6c2d526571756573742d4d6574686f643a20434f4e4e4543540d0a486f73743a20<HONEYPOT>3a38300d0a4f726967696e3a206578616d706c652e636f6d0d0a436f6e6e656374696f6e3a20636c6f73650d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b204e6d617020536372697074696e6720456e67696e653b2068747470733a2f2f6e6d61702e6f72672f626f6f6b2f6e73652e68746d6c290d0a0d0a","method":"OPTIONS","user_agent":"Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html)","ja3":"327efd8a5e8ed9fa2b145f126b748661","session":"2bb0ea43-f42b-45c9-9478-2fb632831d6b","seq":1,"duration_ms":120,"bytes_in":219,"bytes_out":78},{"timestamp":"2026-09-24T21:39:29","port":80,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"access-control-request-method\":\"HEAD\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:80\",\"origin\":\"example.com\",\"user-agent\":\"Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html)\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"4f5054494f4e53202f20485454502f312e310d0a4163636573732d436f6e74726f6c2d526571756573742d4d6574686f643a20484541440d0a486f73743a20<HONEYPOT>3a38300d0a4f726967696e3a206578616d706c652e636f6d0d0a436f6e6e656374696f6e3a20636c6f73650d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b204e6d617020536372697074696e6720456e67696e653b2068747470733a2f2f6e6d61702e6f72672f626f6f6b2f6e73652e68746d6c290d0a0d0a","method":"OPTIONS","user_agent":"Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html)","ja3":"327efd8a5e8ed9fa2b145f126b748661","session":"ba7c5127-15ca-4d8c-9c2a-d8d761236105","seq":1,"duration_ms":123,"bytes_in":216,"bytes_out":78},{"timestamp":"2026-09-24T21:39:29","port":80,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"access-control-request-method\":\"GET\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:80\",\"origin\":\"example.com\",\"user-agent\":\"Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html)\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"4f5054494f4e53202f20485454502f312e310d0a4163636573732d436f6e74726f6c2d526571756573742d4d6574686f643a204745540d0a486f73743a20<HONEYPOT>3a38300d0a4f726967696e3a206578616d706c652e636f6d0d0a436f6e6e656374696f6e3a20636c6f73650d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b204e6d617020536372697074696e6720456e67696e653b2068747470733a2f2f6e6d61702e6f72672f626f6f6b2f6e73652e68746d6c290d0a0d0a","method":"OPTIONS","user_agent":"Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html)","ja3":"327efd8a5e8ed9fa2b145f126b748661","session":"a92a9e67-920e-4a58-9741-f78ffe98b931","seq":1,"duration_ms":120,"bytes_in":215,"bytes_out":78},{"timestamp":"2026-09-24T21:39:29","port":80,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"access-control-request-method\":\"POST\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:80\",\"origin\":\"example.com\",\"user-agent\":\"Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html)\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"4f5054494f4e53202f20485454502f312e310d0a4163636573732d436f6e74726f6c2d526571756573742d4d6574686f643a20504f53540d0a486f73743a20<HONEYPOT>3a38300d0a4f726967696e3a206578616d706c652e636f6d0d0a436f6e6e656374696f6e3a20636c6f73650d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b204e6d617020536372697074696e6720456e67696e653b2068747470733a2f2f6e6d61702e6f72672f626f6f6b2f6e73652e68746d6c290d0a0d0a","method":"OPTIONS","user_agent":"Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html)","ja3":"327efd8a5e8ed9fa2b145f126b748661","session":"5c52b6de-df93-4178-9b2b-ac6c1169aa93","seq":1,"duration_ms":121,"bytes_in":216,"bytes_out":78},{"timestamp":"2026-09-24T21:39:29","port":80,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"access-control-request-method\":\"PUT\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:80\",\"origin\":\"example.com\",\"user-agent\":\"Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html)\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"4f5054494f4e53202f20485454502f312e310d0a4163636573732d436f6e74726f6c2d526571756573742d4d6574686f643a205055540d0a486f73743a20<HONEYPOT>3a38300d0a4f726967696e3a206578616d706c652e636f6d0d0a436f6e6e656374696f6e3a20636c6f73650d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b204e6d617020536372697074696e6720456e67696e653b2068747470733a2f2f6e6d61702e6f72672f626f6f6b2f6e73652e68746d6c290d0a0d0a","method":"OPTIONS","user_agent":"Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html)","ja3":"327efd8a5e8ed9fa2b145f126b748661","session":"415412ff-9646-4a02-b113-9e9e2079bdc9","seq":1,"duration_ms":120,"bytes_in":215,"bytes_out":78}],"http_methods":[{"method":"GET","count":21},{"method":"OPTIONS","count":12},{"method":"POST","count":2}],"distinct_ports_total":17,"top_paths":[{"path":"/","count":32,"ports":14},{"path":"/IPHTTPS","count":2,"ports":1},{"path":"/nice%20ports%2C/Tri%6Eity.txt%2ebak","count":1,"ports":1}],"distinct_paths_total":3,"top_snis":[],"top_hosts":[{"value":"spip","count":2}],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Access-Control-Request-Method","Connection","Host","Origin","User-Agent"],"representative":[{"name":"Access-Control-Request-Method","value":"PATCH","notable":false},{"name":"Connection","value":"close","notable":false},{"name":"Host","value":"<HONEYPOT>:80","notable":false},{"name":"Origin","value":"example.com","notable":true},{"name":"User-Agent","value":"Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html)","notable":false}],"distinct_sets":1,"events_with_headers":10},"tags":[],"data_as_of":"2026-09-30T13:32:10.803728+00:00"}