{"ip":"46.151.178.11","total_events":1377,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"90+ ports swept","confidence":"medium","network_type":null,"why":["No exploit payloads observed.","Swept 90 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"39,243 bytes sent","bytes_sent":39243,"session_seconds":0,"persistent":false}},"first_seen":"2026-02-24T16:12:30","last_seen":"2026-08-25T03:22:08","events_24h":528,"events_7d":762,"geo":{"country_code":"NL","country_name":"The Netherlands","region":"","city":"","lat":52.3824,"lon":4.8995,"asn":211443,"org":"Sino Worldwide Trading Limited"},"source_domain":null,"known_scanners":[],"scanner_tag":null,"cve_matches":[],"malware":[],"top_ports":[{"port":6179,"proto":"tcp","label":"","count":48},{"port":1080,"proto":"tcp","label":"SOCKS","count":48},{"port":5588,"proto":"tcp","label":"","count":42},{"port":10808,"proto":"tcp","label":"","count":42},{"port":6143,"proto":"tcp","label":"","count":42},{"port":5955,"proto":"tcp","label":"","count":42},{"port":4443,"proto":"tcp","label":"","count":38},{"port":5234,"proto":"tcp","label":"","count":36},{"port":6750,"proto":"tcp","label":"","count":36},{"port":5123,"proto":"tcp","label":"","count":36},{"port":40000,"proto":"tcp","label":"","count":36},{"port":6493,"proto":"tcp","label":"","count":36},{"port":5831,"proto":"tcp","label":"","count":36},{"port":5706,"proto":"tcp","label":"","count":36},{"port":9299,"proto":"tcp","label":"","count":36}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t12i280800_0df5e5c63df4_686390af6b8e"],"tls_ja3":[],"ja4h":["ge10nn0200_3ed38b250d3d","ge10nn0100_4740ae6347b0","ge10nr0400_0c3ee47b4d83","ge11nn0300_47c2bbddfa85"]},"fingerprint_peers":{"t12i280800_0df5e5c63df4_686390af6b8e":2,"ge10nr0400_0c3ee47b4d83":15,"ge10nn0200_3ed38b250d3d":3,"ge10nn0100_4740ae6347b0":373,"ge11nn0300_47c2bbddfa85":2},"user_agents":["Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36","Mozilla/5.0","Mozilla/5.0 (compatible; Rota/1.0)"],"timeline":[{"date":"2026-08-22","count":234},{"date":"2026-08-25","count":528}],"recent_events":[{"timestamp":"2026-08-25T03:22:08","port":1080,"proto":"tcp","app_proto":"","app_protocol":"http_proxy","host":"icanhazip.com","headers":"{\"accept\":\"*/*\",\"host\":\"icanhazip.com\",\"user-agent\":\"Mozilla/5.0 (compatible; Rota/1.0)\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"http://icanhazip.com/","summary":"","payload_hex":"47455420687474703a2f2f6963616e68617a69702e636f6d2f20485454502f312e310d0a757365722d6167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b20526f74612f312e30290d0a6163636570743a202a2f2a0d0a686f73743a206963616e68617a69702e636f6d0d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; Rota/1.0)","ja3":"","session":"8ab9e73c-c771-4e53-bc51-63c63e1d4c06","seq":1,"duration_ms":100,"bytes_in":120,"bytes_out":78},{"timestamp":"2026-08-25T03:22:08","port":1080,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e300d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a0d0a","method":"GET","user_agent":"Mozilla/5.0","ja3":"","session":"135cc47a-086f-479a-837e-2dc3bb5e0157","seq":1,"duration_ms":100,"bytes_in":63,"bytes_out":78},{"timestamp":"2026-08-25T03:22:07","port":1080,"proto":"tcp","app_proto":"","app_protocol":"http_proxy","host":"example.com","headers":"{\"host\":\"example.com\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"http://example.com/","summary":"","payload_hex":"47455420687474703a2f2f6578616d706c652e636f6d2f20485454502f312e300d0a486f73743a206578616d706c652e636f6d0d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"e1c65102-c91d-47e0-a5b4-96328571cc43","seq":1,"duration_ms":100,"bytes_in":55,"bytes_out":78},{"timestamp":"2026-08-25T03:22:07","port":1080,"proto":"tcp","app_proto":"","app_protocol":"http_connect","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CONNECT example.com:443 HTTP/1.1\r\nHost: example.com:443\r\n\r\n","payload_hex":"434f4e4e454354206578616d706c652e636f6d3a34343320485454502f312e310d0a486f73743a206578616d706c652e636f6d3a3434330d0a0d0a","method":"","user_agent":"","ja3":"","session":"4ce0f2f5-9e61-4f5d-9d74-e6c7e318d837","seq":1,"duration_ms":101,"bytes_in":59,"bytes_out":13,"enriched":{"digest":"606f03e749c33412","label":"HTTP","strings":["CONNECT example.com:443 HTTP/1.1","Host: example.com:443"],"iocs":{"domains":["example.com"]}}},{"timestamp":"2026-08-25T03:22:06","port":1080,"proto":"tcp","app_proto":"","app_protocol":"cassandra","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0004\u0001\u0000P\u0001\u0001\u0001\u0001\u0000","payload_hex":"040100500101010100","method":"","user_agent":"","ja3":"","session":"369535e5-9f01-45d4-b8cc-447bfd3d54a5","seq":1,"duration_ms":100,"bytes_in":9,"bytes_out":13},{"timestamp":"2026-08-25T03:22:06","port":1080,"proto":"tcp","app_proto":"","app_protocol":"socks5","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0005\u0001\u0000","payload_hex":"050100","method":"","user_agent":"","ja3":"","session":"9146c73a-03f4-4bf8-89cc-225d1575eddc","seq":1,"duration_ms":100,"bytes_in":3,"bytes_out":13,"enriched":{"digest":"11c52e4743758a8a","label":"SOCKS5"}},{"timestamp":"2026-08-25T03:22:05","port":6860,"proto":"tcp","app_proto":"","app_protocol":"http_proxy","host":"icanhazip.com","headers":"{\"accept\":\"*/*\",\"host\":\"icanhazip.com\",\"user-agent\":\"Mozilla/5.0 (compatible; Rota/1.0)\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"http://icanhazip.com/","summary":"","payload_hex":"47455420687474703a2f2f6963616e68617a69702e636f6d2f20485454502f312e310d0a757365722d6167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b20526f74612f312e30290d0a6163636570743a202a2f2a0d0a686f73743a206963616e68617a69702e636f6d0d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; Rota/1.0)","ja3":"","session":"03a4c822-768a-4385-ad81-729b5576fc5d","seq":1,"duration_ms":100,"bytes_in":120,"bytes_out":78},{"timestamp":"2026-08-25T03:22:04","port":6860,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e300d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a0d0a","method":"GET","user_agent":"Mozilla/5.0","ja3":"","session":"7aebfc89-9a7d-472c-80a9-c2e3aa5fb70c","seq":1,"duration_ms":100,"bytes_in":63,"bytes_out":78},{"timestamp":"2026-08-25T03:22:03","port":6860,"proto":"tcp","app_proto":"","app_protocol":"http_proxy","host":"example.com","headers":"{\"host\":\"example.com\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"http://example.com/","summary":"","payload_hex":"47455420687474703a2f2f6578616d706c652e636f6d2f20485454502f312e300d0a486f73743a206578616d706c652e636f6d0d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"a3caf9fe-5636-4922-a834-e1e51313b5f3","seq":1,"duration_ms":101,"bytes_in":55,"bytes_out":78},{"timestamp":"2026-08-25T03:22:03","port":6860,"proto":"tcp","app_proto":"","app_protocol":"http_connect","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CONNECT example.com:443 HTTP/1.1\r\nHost: example.com:443\r\n\r\n","payload_hex":"434f4e4e454354206578616d706c652e636f6d3a34343320485454502f312e310d0a486f73743a206578616d706c652e636f6d3a3434330d0a0d0a","method":"","user_agent":"","ja3":"","session":"f83aba01-67e1-446a-ae9e-cdcb9f4cbac9","seq":1,"duration_ms":100,"bytes_in":59,"bytes_out":13,"enriched":{"digest":"606f03e749c33412","label":"HTTP","strings":["CONNECT example.com:443 HTTP/1.1","Host: example.com:443"],"iocs":{"domains":["example.com"]}}}],"http_methods":[{"method":"GET","count":594}],"distinct_ports_total":90,"top_paths":[{"path":"/","count":139,"ports":28},{"path":"http://example.com/","count":127,"ports":20},{"path":"http://icanhazip.com/","count":127,"ports":20},{"path":"/remote/login","count":87,"ports":67},{"path":"/login?redir=","count":86,"ports":66},{"path":"/api/sonicos/is-sslvpn-enabled","count":12,"ports":8},{"path":"/+CSCOE+/logon.html","count":10,"ports":7},{"path":"/sslvpn_logon.shtml","count":6,"ports":6}],"distinct_paths_total":8,"top_snis":[],"top_hosts":[{"value":"example.com","count":127},{"value":"icanhazip.com","count":127}],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","Host","User-Agent"],"representative":[{"name":"Accept","value":"*/*","notable":false},{"name":"Host","value":"icanhazip.com","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (compatible; Rota/1.0)","notable":false}],"distinct_sets":3,"events_with_headers":6},"tags":[],"data_as_of":"2026-08-25T08:01:50.503327+00:00"}