{"ip":"45.74.57.251","total_events":53,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"32+ ports swept","confidence":"medium","network_type":"nsp","why":["No exploit payloads observed.","Swept 32 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"12,053 bytes sent","bytes_sent":12053,"session_seconds":0,"persistent":false}},"first_seen":"2026-09-03T19:46:46","last_seen":"2026-09-06T19:18:01","events_24h":0,"events_7d":0,"geo":{"country_code":"US","country_name":"United States","region":"","city":"","lat":37.751,"lon":-97.822,"asn":9009,"org":"M247 Europe SRL"},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as9009","label":"M247 Global","category":"isp","url":"https://www.peeringdb.com/asn/9009"},"cve_matches":[],"malware":[],"top_ports":[{"port":4433,"proto":"tcp","label":"","count":6},{"port":8443,"proto":"tcp","label":"HTTPS-alt","count":5},{"port":443,"proto":"tcp","label":"HTTPS","count":4},{"port":444,"proto":"tcp","label":"","count":4},{"port":43443,"proto":"tcp","label":"","count":2},{"port":57443,"proto":"tcp","label":"","count":2},{"port":4431,"proto":"tcp","label":"","count":2},{"port":5443,"proto":"tcp","label":"","count":2},{"port":10443,"proto":"tcp","label":"","count":2},{"port":37443,"proto":"tcp","label":"","count":2},{"port":36443,"proto":"tcp","label":"","count":1},{"port":26443,"proto":"tcp","label":"","count":1},{"port":22443,"proto":"tcp","label":"","count":1},{"port":6443,"proto":"tcp","label":"k8s API","count":1},{"port":4438,"proto":"tcp","label":"","count":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i251000_b78ed14e2fd0_f50d94e863eb"],"tls_client_hello":"","tls_ja3":["416eca07dcaad72dec6f76d1277b3eff"],"http_akin":[]},"fingerprint_peers":{"t13i251000_b78ed14e2fd0_f50d94e863eb":38},"akin_families":{},"user_agents":["Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/112.0","Mozilla/5.0 (X11; Linux i686; rv:1.9.6.20) Gecko/ Firefox/3.6.16","Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:68.0) Gecko/20100101 Firefox/68.0","Mozilla/5.0 (X11; Linux x86_64; rv:1.9.5.20) Gecko/ Firefox/3.8","Mozilla/5.0 (Macintosh, Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.1.1 Safari/605.1.15","Mozilla/5.0 (Kubuntu; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36","Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36","Mozilla/5.0 (Windows NT 10.0; rv:139.0) Gecko/20100101 Firefox/139.0"],"timeline":[{"date":"2026-09-03","count":11},{"date":"2026-09-04","count":12},{"date":"2026-09-05","count":28},{"date":"2026-09-06","count":2}],"recent_events":[{"timestamp":"2026-09-06T19:18:01","port":4433,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"accept-language\":\"en\",\"host\":\"<HONEYPOT>:4433\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a343433330d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f37342e302e333732392e313639205361666172692f3533372e33360d0a4163636570743a202a2f2a0d0a4163636570742d4c616e67756167653a20656e0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36","ja3":"416eca07dcaad72dec6f76d1277b3eff","session":"27c1dfb5-a4c2-4189-8140-57d8054d3a61","seq":1,"duration_ms":100,"bytes_in":229,"bytes_out":77},{"timestamp":"2026-09-06T19:17:10","port":4433,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"accept-language\":\"en\",\"host\":\"<HONEYPOT>:4433\",\"user-agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.2 Safari/605.1.15\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a343433330d0a557365722d4167656e743a204d6f7a696c6c612f352e3020284d6163696e746f73683b20496e74656c204d6163204f5320582031345f3329204170706c655765624b69742f3630352e312e313520284b48544d4c2c206c696b65204765636b6f292056657273696f6e2f31372e32205361666172692f3630352e312e31350d0a4163636570743a202a2f2a0d0a4163636570742d4c616e67756167653a20656e0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.2 Safari/605.1.15","ja3":"416eca07dcaad72dec6f76d1277b3eff","session":"6c8a288e-5688-468a-8498-53156d3c11f8","seq":1,"duration_ms":100,"bytes_in":228,"bytes_out":77},{"timestamp":"2026-09-05T00:50:41","port":4431,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"accept-language\":\"en\",\"host\":\"<HONEYPOT>:4431\",\"user-agent\":\"Mozilla/5.0 (Windows NT 6.1; WOW64; rv:8.0) Gecko/20100101 Firefox/8.0\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/remote/login?lang=en","summary":"","payload_hex":"474554202f72656d6f74652f6c6f67696e3f6c616e673d656e20485454502f312e310d0a486f73743a20<HONEYPOT>3a343433310d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e5420362e313b20574f5736343b2072763a382e3029204765636b6f2f32303130303130312046697265666f782f382e300d0a4163636570743a202a2f2a0d0a4163636570742d4c616e67756167653a20656e0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 6.1; WOW64; rv:8.0) Gecko/20100101 Firefox/8.0","ja3":"416eca07dcaad72dec6f76d1277b3eff","session":"5940da06-6c8e-4d25-af71-dc84e7e3e7d6","seq":1,"duration_ms":119,"bytes_in":204,"bytes_out":77},{"timestamp":"2026-09-05T00:50:41","port":64443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"accept-language\":\"en\",\"host\":\"<HONEYPOT>:64443\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:141.0) Gecko/20100101 Firefox/141.0\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/remote/login?lang=en","summary":"","payload_hex":"474554202f72656d6f74652f6c6f67696e3f6c616e673d656e20485454502f312e310d0a486f73743a20<HONEYPOT>3a36343434330d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b207836343b2072763a3134312e3029204765636b6f2f32303130303130312046697265666f782f3134312e300d0a4163636570743a202a2f2a0d0a4163636570742d4c616e67756167653a20656e0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:141.0) Gecko/20100101 Firefox/141.0","ja3":"416eca07dcaad72dec6f76d1277b3eff","session":"ef272a36-8eff-4460-8e69-9516c355020e","seq":1,"duration_ms":125,"bytes_in":215,"bytes_out":77},{"timestamp":"2026-09-05T00:50:41","port":36443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"accept-language\":\"en\",\"host\":\"<HONEYPOT>:36443\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:100.0) Gecko/20100101 Firefox/100.0\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/remote/login?lang=en","summary":"","payload_hex":"474554202f72656d6f74652f6c6f67696e3f6c616e673d656e20485454502f312e310d0a486f73743a20<HONEYPOT>3a33363434330d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b207836343b2072763a3130302e3029204765636b6f2f32303130303130312046697265666f782f3130302e300d0a4163636570743a202a2f2a0d0a4163636570742d4c616e67756167653a20656e0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:100.0) Gecko/20100101 Firefox/100.0","ja3":"416eca07dcaad72dec6f76d1277b3eff","session":"f70d2ecd-75ad-43e2-9c7d-1a971c12dea8","seq":1,"duration_ms":117,"bytes_in":215,"bytes_out":77},{"timestamp":"2026-09-05T00:50:41","port":4438,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"accept-language\":\"en\",\"host\":\"<HONEYPOT>:4438\",\"user-agent\":\"Mozilla/5.0 (X11; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/remote/login?lang=en","summary":"","payload_hex":"474554202f72656d6f74652f6c6f67696e3f6c616e673d656e20485454502f312e310d0a486f73743a20<HONEYPOT>3a343433380d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578206936383629204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3133372e302e302e30205361666172692f3533372e33360d0a4163636570743a202a2f2a0d0a4163636570742d4c616e67756167653a20656e0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36","ja3":"416eca07dcaad72dec6f76d1277b3eff","session":"e3e74ad5-4d3e-4c61-b1cb-26ae789035e8","seq":1,"duration_ms":123,"bytes_in":233,"bytes_out":77},{"timestamp":"2026-09-05T00:39:38","port":59443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"accept-language\":\"en\",\"host\":\"<HONEYPOT>:59443\",\"user-agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/remote/login?lang=en","summary":"","payload_hex":"474554202f72656d6f74652f6c6f67696e3f6c616e673d656e20485454502f312e310d0a486f73743a20<HONEYPOT>3a35393434330d0a557365722d4167656e743a204d6f7a696c6c612f352e3020284d6163696e746f73683b20496e74656c204d6163204f5320582031305f31355f3729204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3130392e302e302e30205361666172692f3533372e33360d0a4163636570743a202a2f2a0d0a4163636570742d4c616e67756167653a20656e0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36","ja3":"416eca07dcaad72dec6f76d1277b3eff","session":"71069e69-5615-45ac-9d28-5fced2f6fddd","seq":1,"duration_ms":245,"bytes_in":252,"bytes_out":77},{"timestamp":"2026-09-05T00:39:38","port":30443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"accept-language\":\"en\",\"host\":\"<HONEYPOT>:30443\",\"user-agent\":\"Mozilla/5.0 (X11; Ubuntu; Linux aarch64; rv:90.0) Gecko/20100101 Firefox/90.0\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/remote/login?lang=en","summary":"","payload_hex":"474554202f72656d6f74652f6c6f67696e3f6c616e673d656e20485454502f312e310d0a486f73743a20<HONEYPOT>3a33303434330d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b205562756e74753b204c696e757820616172636836343b2072763a39302e3029204765636b6f2f32303130303130312046697265666f782f39302e300d0a4163636570743a202a2f2a0d0a4163636570742d4c616e67756167653a20656e0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Ubuntu; Linux aarch64; rv:90.0) Gecko/20100101 Firefox/90.0","ja3":"416eca07dcaad72dec6f76d1277b3eff","session":"f497af12-84ab-4ed5-8923-7cc8411fbadf","seq":1,"duration_ms":237,"bytes_in":212,"bytes_out":77},{"timestamp":"2026-09-05T00:39:38","port":62443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"accept-language\":\"en\",\"host\":\"<HONEYPOT>:62443\",\"user-agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 15_0_0) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/19.0 Safari/605.1.15\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/remote/login?lang=en","summary":"","payload_hex":"474554202f72656d6f74652f6c6f67696e3f6c616e673d656e20485454502f312e310d0a486f73743a20<HONEYPOT>3a36323434330d0a557365722d4167656e743a204d6f7a696c6c612f352e3020284d6163696e746f73683b20496e74656c204d6163204f5320582031355f305f3029204170706c655765624b69742f3630352e312e313520284b48544d4c2c206c696b65204765636b6f292056657273696f6e2f31392e30205361666172692f3630352e312e31350d0a4163636570743a202a2f2a0d0a4163636570742d4c616e67756167653a20656e0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 15_0_0) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/19.0 Safari/605.1.15","ja3":"416eca07dcaad72dec6f76d1277b3eff","session":"a36bb6c7-d369-434a-bbcb-f9a56a881071","seq":1,"duration_ms":244,"bytes_in":251,"bytes_out":77},{"timestamp":"2026-09-05T00:39:38","port":442,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"accept-language\":\"en\",\"host\":\"<HONEYPOT>:442\",\"user-agent\":\"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.0 Safari/605.4.21\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/remote/login?lang=en","summary":"","payload_hex":"474554202f72656d6f74652f6c6f67696e3f6c616e673d656e20485454502f312e310d0a486f73743a20<HONEYPOT>3a3434320d0a557365722d4167656e743a204d6f7a696c6c612f352e3020284d6163696e746f73683b20496e74656c204d6163204f5320582031305f31355f3729204170706c655765624b69742f3630352e312e313520284b48544d4c2c206c696b65204765636b6f292056657273696f6e2f31372e30205361666172692f3630352e342e32310d0a4163636570743a202a2f2a0d0a4163636570742d4c616e67756167653a20656e0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.0 Safari/605.4.21","ja3":"416eca07dcaad72dec6f76d1277b3eff","session":"e5e176a8-9c40-435d-a2a0-44b948e5255f","seq":1,"duration_ms":244,"bytes_in":250,"bytes_out":77}],"http_methods":[{"method":"GET","count":53}],"distinct_ports_total":32,"top_paths":[{"path":"/remote/login?lang=en","count":37,"ports":31},{"path":"/","count":12,"ports":4},{"path":"/global-protect/login.esp","count":4,"ports":4}],"distinct_paths_total":3,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","Accept-Encoding","Accept-Language","Host","User-Agent"],"representative":[{"name":"Accept","value":"*/*","notable":false},{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Accept-Language","value":"en","notable":false},{"name":"Host","value":"<HONEYPOT>:4433","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36","notable":false}],"distinct_sets":1,"events_with_headers":10},"tags":[],"data_as_of":"2026-09-28T20:50:14.303720+00:00"}