{"ip":"45.85.93.127","total_events":32,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"25+ ports swept","confidence":"medium","network_type":null,"why":["No exploit payloads observed.","Swept 25 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"6,856 bytes sent","bytes_sent":6856,"session_seconds":0,"persistent":false}},"first_seen":"2026-07-13T12:11:56","last_seen":"2026-09-24T10:25:16","events_24h":1,"events_7d":1,"geo":{"country_code":"CH","country_name":"Switzerland","region":"Geneva","city":"Geneva","lat":46.2052,"lon":6.142,"asn":199058,"org":"Serva One Ltd"},"source_domain":null,"known_scanners":[],"scanner_tag":null,"cve_matches":[],"malware":[],"top_ports":[{"port":2628,"proto":"tcp","label":"","count":4},{"port":8087,"proto":"tcp","label":"","count":2},{"port":8004,"proto":"tcp","label":"","count":2},{"port":2052,"proto":"tcp","label":"","count":2},{"port":8086,"proto":"tcp","label":"InfluxDB","count":2},{"port":8080,"proto":"tcp","label":"HTTP-alt","count":1},{"port":2083,"proto":"tcp","label":"","count":1},{"port":2096,"proto":"tcp","label":"","count":1},{"port":12443,"proto":"tcp","label":"","count":1},{"port":8006,"proto":"tcp","label":"","count":1},{"port":6000,"proto":"tcp","label":"X11","count":1},{"port":8009,"proto":"tcp","label":"","count":1},{"port":3003,"proto":"tcp","label":"","count":1},{"port":444,"proto":"tcp","label":"","count":1},{"port":5986,"proto":"tcp","label":"","count":1}],"fingerprints":{"ssh_hassh":["e54ef3ec27fe1fea7ab64d3fa05359fd"],"tls_ja4":["t13i1310h1_f57a46bbacb6_e7c285222651"],"tls_client_hello":"","tls_ja3":["8939412039ec4e7b3550855bbb755c01"],"http_akin":[]},"fingerprint_peers":{"t13i1310h1_f57a46bbacb6_e7c285222651":58,"e54ef3ec27fe1fea7ab64d3fa05359fd":483},"akin_families":{},"user_agents":["Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0"],"timeline":[{"date":"2026-07-13","count":1},{"date":"2026-07-14","count":1},{"date":"2026-07-20","count":1},{"date":"2026-08-01","count":4},{"date":"2026-08-02","count":4},{"date":"2026-08-08","count":1},{"date":"2026-08-09","count":1},{"date":"2026-08-10","count":1},{"date":"2026-08-16","count":1},{"date":"2026-08-21","count":1},{"date":"2026-08-30","count":1},{"date":"2026-09-01","count":4},{"date":"2026-09-02","count":2},{"date":"2026-09-07","count":4},{"date":"2026-09-10","count":1},{"date":"2026-09-15","count":3},{"date":"2026-09-24","count":1}],"recent_events":[{"timestamp":"2026-09-24T10:25:16","port":2222,"proto":"tcp","app_proto":"","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"SSH-2.0-Go\r\n\u0000\u0000\u0004�\u0006\u0014\u001f^��C���tj�>�\"x�\u0000\u0000\u0001\u0004curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group1-sha1,diffie-hellman-group14-sha256,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1\u0000\u0000\u0001�ssh-ed25519,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,rsa-sha2-256,rsa-sha2-512,ssh-rsa,ssh-dss,ssh-ed25519-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,rsa-sha2-256-cert-v01@openssh.com,rsa-sha2-512-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com\u0000\u0000\u0000�chacha20-poly1305@openssh.com,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,arcfour256,arcfour128,arcfour,3des-cbc\u0000\u0000\u0000�chacha20-poly1305@openssh.com,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,arcfour256,arcfour128,arcfour,3des-cbc\u0000\u0000\u0000Bhmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96\u0000\u0000\u0000Bhmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96\u0000\u0000\u0000\u0004none\u0000\u0000\u0000\u0004none\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000�'K�bj","payload_hex":"5353482d322e302d476f0d0a0000049c06141f5e8ae543e381d5746ab93ecc2278b600000104637572766532353531392d7368613235362c637572766532353531392d736861323536406c69627373682e6f72672c656364682d736861322d6e697374703235362c656364682d736861322d6e697374703338342c656364682d736861322d6e697374703532312c6469666669652d68656c6c6d616e2d67726f7570312d736861312c6469666669652d68656c6c6d616e2d67726f757031342d7368613235362c6469666669652d68656c6c6d616e2d67726f757031342d736861312c6469666669652d68656c6c6d616e2d67726f75702d65786368616e67652d7368613235362c6469666669652d68656c6c6d616e2d67726f75702d65786368616e67652d736861310000018b7373682d656432353531392c65636473612d736861322d6e697374703235362c65636473612d736861322d6e697374703338342c65636473612d736861322d6e697374703532312c7273612d736861322d3235362c7273612d736861322d3531322c7373682d7273612c7373682d6473732c7373682d656432353531392d636572742d763031406f70656e7373682e636f6d2c65636473612d736861322d6e697374703235362d636572742d763031406f70656e7373682e636f6d2c65636473612d736861322d6e697374703338342d636572742d763031406f70656e7373682e636f6d2c65636473612d736861322d6e697374703532312d636572742d763031406f70656e7373682e636f6d2c7273612d736861322d3235362d636572742d763031406f70656e7373682e636f6d2c7273612d736861322d3531322d636572742d763031406f70656e7373682e636f6d2c7373682d7273612d636572742d763031406f70656e7373682e636f6d2c7373682d6473732d636572742d763031406f70656e7373682e636f6d0000009e63686163686132302d706f6c7931333035406f70656e7373682e636f6d2c6165733132382d67636d406f70656e7373682e636f6d2c6165733235362d67636d406f70656e7373682e636f6d2c6165733132382d6374722c6165733139322d6374722c6165733235362d6374722c6165733132382d6362632c617263666f75723235362c617263666f75723132382c617263666f75722c336465732d6362630000009e63686163686132302d706f6c7931333035406f70656e7373682e636f6d2c6165733132382d67636d406f70656e7373682e636f6d2c6165733235362d67636d406f70656e7373682e636f6d2c6165733132382d6374722c6165733139322d6374722c6165733235362d6374722c6165733132382d6362632c617263666f75723235362c617263666f75723132382c617263666f75722c336465732d63626300000042686d61632d736861322d3235362d65746d406f70656e7373682e636f6d2c686d61632d736861322d3235362c686d61632d736861312c686d61632d736861312d393600000042686d61632d736861322d3235362d65746d406f70656e7373682e636f6d2c686d61632d736861322d3235362c686d61632d736861312c686d61632d736861312d3936000000046e6f6e65000000046e6f6e6500000000000000000000000000cf274b82626a","method":"","user_agent":"","ja3":"","session":"e45e96f7-eee5-42fc-9879-5ede68a1f3e4","seq":1,"duration_ms":122,"bytes_in":1196,"bytes_out":12,"enriched":{"digest":"9cdec1cabade6671","label":"SSH","strings":["SSH-2.0-Go","curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nist…","ssh-ed25519,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,rsa-sha2…","chacha20-poly1305@openssh.com,aes128-gcm@openssh.com,aes256-gcm@openssh.com,aes1…","Bhmac-sha2-256-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha1-96","none"],"iocs":{"domains":["libssh.org","openssh.com"]}}},{"timestamp":"2026-09-15T08:25:14","port":8080,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8080\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a383038300d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f36343b2072763a3134302e3029204765636b6f2f32303130303130312046697265666f782f3134302e300d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0","ja3":"","session":"8599cd4a-86e8-4e16-86fc-5f3d090e2e16","seq":1,"duration_ms":100,"bytes_in":170,"bytes_out":77},{"timestamp":"2026-09-15T07:22:41","port":8000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8000\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a383030300d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f36343b2072763a3134302e3029204765636b6f2f32303130303130312046697265666f782f3134302e300d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0","ja3":"","session":"b01bfe8a-baee-47c2-a11a-844f82390886","seq":1,"duration_ms":100,"bytes_in":170,"bytes_out":77},{"timestamp":"2026-09-15T01:37:43","port":8002,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8002\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a383030320d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f36343b2072763a3134302e3029204765636b6f2f32303130303130312046697265666f782f3134302e300d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0","ja3":"","session":"a9b5ccb5-83d8-4246-b69a-42d125c21ff9","seq":1,"duration_ms":100,"bytes_in":171,"bytes_out":77},{"timestamp":"2026-09-10T16:54:34","port":5601,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:5601\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a353630310d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f36343b2072763a3134302e3029204765636b6f2f32303130303130312046697265666f782f3134302e300d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0","ja3":"8939412039ec4e7b3550855bbb755c01","session":"735fdada-93f6-4d2d-8de6-34b42fa9f848","seq":1,"duration_ms":100,"bytes_in":170,"bytes_out":77},{"timestamp":"2026-09-07T13:46:52","port":2628,"proto":"tcp","app_proto":"","app_protocol":"redis","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"*1\r\n$4\r\nPING\r\n","payload_hex":"2a310d0a24340d0a50494e470d0a","method":"","user_agent":"","ja3":"","session":"fae927d6-7860-4287-9746-937fc55c0b0b","seq":1,"duration_ms":100,"bytes_in":14,"bytes_out":7,"enriched":{"digest":"3311f70e8081417b","label":"Redis (RESP)","strings":["PING"]}},{"timestamp":"2026-09-07T13:46:52","port":2628,"proto":"tcp","app_proto":"","app_protocol":"redis","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"*1\r\n$4\r\nINFO\r\n","payload_hex":"2a310d0a24340d0a494e464f0d0a","method":"","user_agent":"","ja3":"","session":"fae927d6-7860-4287-9746-937fc55c0b0b","seq":2,"duration_ms":212,"bytes_in":28,"bytes_out":12,"enriched":{"digest":"2c31890b53b348f2","label":"Redis (RESP)","strings":["INFO"]}},{"timestamp":"2026-09-07T13:46:52","port":2628,"proto":"tcp","app_proto":"","app_protocol":"redis","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"*1\r\n$11\r\nNONEXISTENT\r\n","payload_hex":"2a310d0a2431310d0a4e4f4e4558495354454e540d0a","method":"","user_agent":"","ja3":"","session":"fae927d6-7860-4287-9746-937fc55c0b0b","seq":3,"duration_ms":324,"bytes_in":50,"bytes_out":17,"enriched":{"digest":"6a74b11849fd84cf","label":"Redis (RESP)","strings":["NONEXISTENT"]}},{"timestamp":"2026-09-07T13:46:52","port":2628,"proto":"tcp","app_proto":"","app_protocol":"redis","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"*1\r\n$4\r\nQUIT\r\n","payload_hex":"2a310d0a24340d0a515549540d0a","method":"","user_agent":"","ja3":"","session":"fae927d6-7860-4287-9746-937fc55c0b0b","seq":4,"duration_ms":436,"bytes_in":64,"bytes_out":22,"enriched":{"digest":"c8eec36f8388dba0","label":"Redis (RESP)","strings":["QUIT"]}},{"timestamp":"2026-09-02T17:16:34","port":8086,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:8086\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a383038360d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f36343b2072763a3134302e3029204765636b6f2f32303130303130312046697265666f782f3134302e300d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0","ja3":"","session":"766add41-e588-4e98-8323-48061a7b84f4","seq":1,"duration_ms":100,"bytes_in":170,"bytes_out":77}],"http_methods":[{"method":"GET","count":25}],"distinct_ports_total":25,"top_paths":[{"path":"/","count":25,"ports":21}],"distinct_paths_total":1,"top_snis":[],"top_hosts":[],"top_alpns":[{"value":"http/1.1","count":8}],"banners":[{"value":"SSH-2.0-Go","count":2}],"credentials":[],"header_profile":{"signature":["Accept-Encoding","Connection","Host","User-Agent"],"representative":[{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Connection","value":"close","notable":false},{"name":"Host","value":"<HONEYPOT>:8080","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0","notable":false}],"distinct_sets":1,"events_with_headers":5},"tags":[],"data_as_of":"2026-09-24T12:55:08.903907+00:00"}