{"ip":"45.63.4.69","total_events":358,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"10+ ports swept","confidence":"medium","network_type":"nsp","why":["No exploit payloads observed.","Swept 10 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"75,004 bytes sent","bytes_sent":75004,"session_seconds":2,"persistent":false}},"first_seen":"2026-06-06T02:47:40","last_seen":"2026-08-14T02:45:35","events_24h":7,"events_7d":55,"geo":{"country_code":"US","country_name":"United States","region":"New Jersey","city":"Piscataway","lat":40.4993,"lon":-74.399,"asn":20473,"org":"The Constant Company, LLC"},"source_domain":"45.63.4.69.vultrusercontent.com","known_scanners":[],"scanner_tag":{"key":"vultr","label":"Vultr","category":"hosting_provider","url":"https://www.vultr.com/"},"cve_matches":[],"malware":[],"top_ports":[{"port":4153,"proto":"tcp","label":"","count":54},{"port":443,"proto":"tcp","label":"HTTPS","count":51},{"port":22,"proto":"tcp","label":"SSH","count":41},{"port":8080,"proto":"tcp","label":"HTTP-alt","count":41},{"port":80,"proto":"tcp","label":"HTTP","count":39},{"port":3389,"proto":"tcp","label":"RDP","count":37},{"port":1080,"proto":"tcp","label":"SOCKS","count":33},{"port":1337,"proto":"tcp","label":"","count":28},{"port":3000,"proto":"tcp","label":"Web-alt","count":19},{"port":2000,"proto":"tcp","label":"","count":15}],"fingerprints":{"ssh_hassh":["e54ef3ec27fe1fea7ab64d3fa05359fd"],"tls_ja4":["t13i1909h2_9dc949149365_97f8aa674fd9"],"tls_ja3":["7c1e207beb00684bbbe144f1b0abe1d5"],"ja4h":["ge11nn0400_88d30a62b7ad"]},"fingerprint_peers":{"t13i1909h2_9dc949149365_97f8aa674fd9":562,"ge11nn0400_88d30a62b7ad":4815,"e54ef3ec27fe1fea7ab64d3fa05359fd":194},"user_agents":["Mozilla/5.0 (compatible; CyberConvoyScout/1.0; +https://scout.cyberconvoy.co)"],"timeline":[{"date":"2026-06-06","count":10},{"date":"2026-06-07","count":2},{"date":"2026-06-08","count":7},{"date":"2026-06-10","count":4},{"date":"2026-06-12","count":12},{"date":"2026-06-13","count":2},{"date":"2026-06-17","count":2},{"date":"2026-06-18","count":3},{"date":"2026-06-19","count":6},{"date":"2026-06-20","count":5},{"date":"2026-06-23","count":3},{"date":"2026-06-25","count":5},{"date":"2026-06-26","count":4},{"date":"2026-06-27","count":4},{"date":"2026-06-28","count":1},{"date":"2026-06-30","count":7},{"date":"2026-07-01","count":10},{"date":"2026-07-02","count":6},{"date":"2026-07-04","count":3},{"date":"2026-07-08","count":11},{"date":"2026-07-09","count":2},{"date":"2026-07-10","count":4},{"date":"2026-07-11","count":2},{"date":"2026-07-12","count":7},{"date":"2026-07-13","count":8},{"date":"2026-07-14","count":7},{"date":"2026-07-15","count":3},{"date":"2026-07-16","count":4},{"date":"2026-07-17","count":7},{"date":"2026-07-18","count":7},{"date":"2026-07-19","count":5},{"date":"2026-07-20","count":12},{"date":"2026-07-21","count":3},{"date":"2026-07-22","count":11},{"date":"2026-07-23","count":11},{"date":"2026-07-24","count":7},{"date":"2026-07-25","count":7},{"date":"2026-07-26","count":10},{"date":"2026-07-27","count":8},{"date":"2026-07-28","count":9},{"date":"2026-07-29","count":7},{"date":"2026-07-30","count":2},{"date":"2026-07-31","count":7},{"date":"2026-08-01","count":8},{"date":"2026-08-02","count":9},{"date":"2026-08-04","count":1},{"date":"2026-08-05","count":10},{"date":"2026-08-06","count":11},{"date":"2026-08-07","count":7},{"date":"2026-08-08","count":9},{"date":"2026-08-09","count":11},{"date":"2026-08-10","count":9},{"date":"2026-08-11","count":9},{"date":"2026-08-12","count":9},{"date":"2026-08-13","count":4},{"date":"2026-08-14","count":4}],"recent_events":[{"timestamp":"2026-08-14T02:45:35","port":3000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:3000\",\"user-agent\":\"Mozilla/5.0 (compatible; CyberConvoyScout/1.0; +https://scout.cyberconvoy.co)\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a333030300d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b204379626572436f6e766f7953636f75742f312e303b202b68747470733a2f2f73636f75742e6379626572636f6e766f792e636f290d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; CyberConvoyScout/1.0; +https://scout.cyberconvoy.co)","ja3":"","session":"12b8092a-d22b-4482-bd37-abb7c8df9d70","seq":1,"duration_ms":100,"bytes_in":170,"bytes_out":75},{"timestamp":"2026-08-14T01:53:34","port":8080,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:8080\",\"user-agent\":\"Mozilla/5.0 (compatible; CyberConvoyScout/1.0; +https://scout.cyberconvoy.co)\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a383038300d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b204379626572436f6e766f7953636f75742f312e303b202b68747470733a2f2f73636f75742e6379626572636f6e766f792e636f290d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; CyberConvoyScout/1.0; +https://scout.cyberconvoy.co)","ja3":"","session":"7cafec4e-6e69-476d-a7de-d5ff810bc31e","seq":1,"duration_ms":100,"bytes_in":170,"bytes_out":75},{"timestamp":"2026-08-14T01:28:26","port":1337,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\n","payload_hex":"0a","method":"","user_agent":"","ja3":"","session":"9f7cd4fc-4aad-4605-b804-3b9a6e6d4fd0","seq":1,"duration_ms":11,"bytes_in":1,"bytes_out":10},{"timestamp":"2026-08-14T00:48:29","port":1080,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\n","payload_hex":"0a","method":"","user_agent":"","ja3":"","session":"bbe2a152-85bf-4f3e-a190-f83199ced6c9","seq":1,"duration_ms":10,"bytes_in":1,"bytes_out":10},{"timestamp":"2026-08-13T23:22:47","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (compatible; CyberConvoyScout/1.0; +https://scout.cyberconvoy.co)\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b204379626572436f6e766f7953636f75742f312e303b202b68747470733a2f2f73636f75742e6379626572636f6e766f792e636f290d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; CyberConvoyScout/1.0; +https://scout.cyberconvoy.co)","ja3":"7c1e207beb00684bbbe144f1b0abe1d5","session":"e1a42ee6-1fb1-436a-b082-540a5f21eec9","seq":1,"duration_ms":143,"bytes_in":165,"bytes_out":75},{"timestamp":"2026-08-13T21:46:26","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 (compatible; CyberConvoyScout/1.0; +https://scout.cyberconvoy.co)\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b204379626572436f6e766f7953636f75742f312e303b202b68747470733a2f2f73636f75742e6379626572636f6e766f792e636f290d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; CyberConvoyScout/1.0; +https://scout.cyberconvoy.co)","ja3":"","session":"fb1ed8e4-45af-4089-abe3-2be00343295e","seq":1,"duration_ms":100,"bytes_in":165,"bytes_out":75},{"timestamp":"2026-08-13T20:43:59","port":22,"proto":"tcp","app_proto":"","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"SSH-2.0-Go\r\n\u0000\u0000\u0004�\u0006\u0014,0\u0019:�����\u0018���H3�\u0000\u0000\u0001\u0004curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group1-sha1,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1\u0000\u0000\u0001�ssh-ed25519,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss,ssh-ed25519-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,rsa-sha2-256-cert-v01@openssh.com,rsa-sha2-512-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com\u0000\u0000\u0000�chacha20-poly1305@openssh.com,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,arcfour256,arcfour128,arcfour,3des-cbc\u0000\u0000\u0000�chacha20-poly1305@openssh.com,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,arcfour256,arcfour128,arcfour,3des-cbc\u0000\u0000\u0000Bhmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96\u0000\u0000\u0000Bhmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96\u0000\u0000\u0000\u0004none\u0000\u0000\u0000\u0004none\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000L�'2\t�","payload_hex":"5353482d322e302d476f0d0a0000049c06142c30193a9ebdb39ca218998edc48339a00000104637572766532353531392d7368613235362c637572766532353531392d736861323536406c69627373682e6f72672c656364682d736861322d6e697374703235362c656364682d736861322d6e697374703338342c656364682d736861322d6e697374703532312c6469666669652d68656c6c6d616e2d67726f7570312d736861312c6469666669652d68656c6c6d616e2d67726f757031342d7368613235362c6469666669652d68656c6c6d616e2d67726f757031342d736861312c6469666669652d68656c6c6d616e2d67726f75702d65786368616e67652d7368613235362c6469666669652d68656c6c6d616e2d67726f75702d65786368616e67652d736861310000018b7373682d656432353531392c65636473612d736861322d6e697374703235362c65636473612d736861322d6e697374703338342c65636473612d736861322d6e697374703532312c7273612d736861322d3235362c7273612d736861322d3531322c7373682d7273612c7373682d6473732c7373682d656432353531392d636572742d763031406f70656e7373682e636f6d2c65636473612d736861322d6e697374703235362d636572742d763031406f70656e7373682e636f6d2c65636473612d736861322d6e697374703338342d636572742d763031406f70656e7373682e636f6d2c65636473612d736861322d6e697374703532312d636572742d763031406f70656e7373682e636f6d2c7273612d736861322d3235362d636572742d763031406f70656e7373682e636f6d2c7273612d736861322d3531322d636572742d763031406f70656e7373682e636f6d2c7373682d7273612d636572742d763031406f70656e7373682e636f6d2c7373682d6473732d636572742d763031406f70656e7373682e636f6d0000009e63686163686132302d706f6c7931333035406f70656e7373682e636f6d2c6165733132382d67636d406f70656e7373682e636f6d2c6165733235362d67636d406f70656e7373682e636f6d2c6165733132382d6374722c6165733139322d6374722c6165733235362d6374722c6165733132382d6362632c617263666f75723235362c617263666f75723132382c617263666f75722c336465732d6362630000009e63686163686132302d706f6c7931333035406f70656e7373682e636f6d2c6165733132382d67636d406f70656e7373682e636f6d2c6165733235362d67636d406f70656e7373682e636f6d2c6165733132382d6374722c6165733139322d6374722c6165733235362d6374722c6165733132382d6362632c617263666f75723235362c617263666f75723132382c617263666f75722c336465732d63626300000042686d61632d736861322d3235362d65746d406f70656e7373682e636f6d2c686d61632d736861322d3235362c686d61632d736861312c686d61632d736861312d393600000042686d61632d736861322d3235362d65746d406f70656e7373682e636f6d2c686d61632d736861322d3235362c686d61632d736861312c686d61632d736861312d3936000000046e6f6e65000000046e6f6e65000000000000000000000000004c9e273209fc","method":"","user_agent":"","ja3":"","session":"d431af28-4e2a-4d30-b8d2-8d95e5fbd8c7","seq":1,"duration_ms":342,"bytes_in":1196,"bytes_out":10,"enriched":{"digest":"3c1f26aa8e12f72b","label":"SSH","strings":["SSH-2.0-Go","curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nist…","ssh-ed25519,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,rsa-sha2…","chacha20-poly1305@openssh.com,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes1…","Bhmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96","none","noneL"],"iocs":{"domains":["libssh.org","openssh.com"]}}},{"timestamp":"2026-08-13T00:13:24","port":3000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:3000\",\"user-agent\":\"Mozilla/5.0 (compatible; CyberConvoyScout/1.0; +https://scout.cyberconvoy.co)\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a333030300d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b204379626572436f6e766f7953636f75742f312e303b202b68747470733a2f2f73636f75742e6379626572636f6e766f792e636f290d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; CyberConvoyScout/1.0; +https://scout.cyberconvoy.co)","ja3":"","session":"37a943c3-f6a3-48a1-854b-85201926e344","seq":1,"duration_ms":101,"bytes_in":170,"bytes_out":75},{"timestamp":"2026-08-12T23:48:33","port":2000,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\n","payload_hex":"0a","method":"","user_agent":"","ja3":"","session":"c9c8a9ff-76ca-4171-9ba3-898d42bc8da5","seq":1,"duration_ms":9,"bytes_in":1,"bytes_out":10},{"timestamp":"2026-08-12T23:20:43","port":8080,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:8080\",\"user-agent\":\"Mozilla/5.0 (compatible; CyberConvoyScout/1.0; +https://scout.cyberconvoy.co)\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a383038300d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b204379626572436f6e766f7953636f75742f312e303b202b68747470733a2f2f73636f75742e6379626572636f6e766f792e636f290d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; CyberConvoyScout/1.0; +https://scout.cyberconvoy.co)","ja3":"","session":"92f5c1f7-90a8-43ab-812e-0edcdfba84f8","seq":1,"duration_ms":101,"bytes_in":170,"bytes_out":75}],"http_methods":[{"method":"GET","count":150}],"distinct_ports_total":10,"top_paths":[{"path":"/","count":150,"ports":4}],"distinct_paths_total":1,"top_snis":[],"top_hosts":[],"top_alpns":[{"value":"h2, http/1.1","count":51}],"banners":[{"value":"SSH-2.0-Go","count":41}],"credentials":[],"header_profile":{"signature":["Accept","Accept-Encoding","Host","User-Agent"],"representative":[{"name":"Accept","value":"*/*","notable":false},{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Host","value":"<HONEYPOT>:3000","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (compatible; CyberConvoyScout/1.0; +https://scout.cyberconvoy.co)","notable":false}],"distinct_sets":1,"events_with_headers":6},"tags":[],"data_as_of":"2026-08-14T16:12:58.981498+00:00"}