{"ip":"5.252.83.46","data_as_of":"2026-10-24T17:44:47+00:00","observed":true,"total_events":21,"verdict":{"verdict":"scanner","label":"Recognized scanner","detail":"infrawatch","confidence":"high","network_type":"CDN","why":["The address is in a published scanner range (infrawatch).","Known research and commercial scanners are labelled by operator and carry no threat verdict.","Counts include 68 interactive session(s) as well as first-packet events."],"engagement":{"level":"payload","label":"Sustained payload","detail":"13,035 bytes sent","bytes_sent":13035,"session_seconds":0,"persistent":false},"basis":"combined"},"first_seen":"2026-08-30T15:44:29","last_seen":"2026-10-23T06:22:21","events_24h":0,"events_7d":1,"interactive_sessions":68,"interactive_sessions_24h":0,"interactive_sessions_7d":68,"interactive_protocols":[{"protocol":"http","sessions":68}],"geo":{"country_code":"GB","country_name":"United Kingdom","region":"England","city":"London","lat":51.5081,"lon":-0.1278,"asn":25369,"org":"Hydra Communications Ltd"},"source_domain":"5-252-83-46.infrawat.ch","known_scanners":["infrawatch","Infrawatch"],"scanner_tag":{"key":"infrawatch","label":"Infrawatch","category":"commercial","url":"https://infrawat.ch/"},"cve_matches":[],"malware":[],"udp":null,"interaction":{"window_days":90,"sessions":68,"first_seen":"2026-10-19T20:28:49","last_seen":"2026-10-23T06:22:21","verdicts":[{"verdict":"scan","sessions":68}],"personas":[{"persona":"nginx@1.24.0, wordpress@6.5.2, leaks@2, miner@bfgminer 5.5.0, elasticsearch@6.8.23, winrm@Windows Server 2016, fortigate@7.0.5, docker@25.0.3","sessions":67},{"persona":"nginx@1.24.0, wordpress@6.5.2, leaks@2, miner@bfgminer 5.5.0, elasticsearch@6.8.23, winrm@Windows Server 2016, fortigate@7.0.5, gitlab@19.4.2","sessions":1}],"services":[{"protocol":"http","port":50666,"sessions":1},{"protocol":"http","port":21968,"sessions":1},{"protocol":"http","port":37836,"sessions":1},{"protocol":"http","port":24306,"sessions":1},{"protocol":"http","port":40404,"sessions":1},{"protocol":"http","port":8200,"sessions":1},{"protocol":"http","port":47080,"sessions":1},{"protocol":"http","port":62268,"sessions":1},{"protocol":"http","port":22734,"sessions":1},{"protocol":"http","port":45403,"sessions":1},{"protocol":"http","port":41065,"sessions":1},{"protocol":"http","port":23973,"sessions":1}],"logins":[],"commands":[],"downloads":[],"files":[],"attack":[{"technique_id":"T1595","technique_name":"Active Scanning","tactic_id":"TA0043","tactic_name":"Reconnaissance","sessions":68}]},"top_ports":[{"port":1812,"proto":"tcp","label":"","count":1,"sessions":0},{"port":20847,"proto":"tcp","label":"","count":1,"sessions":0},{"port":6008,"proto":"tcp","label":"","count":1,"sessions":0},{"port":62848,"proto":"tcp","label":"","count":1,"sessions":0},{"port":40810,"proto":"tcp","label":"","count":1,"sessions":0},{"port":33052,"proto":"tcp","label":"","count":1,"sessions":0},{"port":22301,"proto":"tcp","label":"","count":1,"sessions":0},{"port":42947,"proto":"tcp","label":"","count":1,"sessions":0},{"port":37207,"proto":"tcp","label":"","count":1,"sessions":0},{"port":28587,"proto":"tcp","label":"","count":1,"sessions":0},{"port":38940,"proto":"tcp","label":"","count":1,"sessions":0},{"port":6329,"proto":"tcp","label":"","count":1,"sessions":0},{"port":29172,"proto":"tcp","label":"","count":1,"sessions":0},{"port":1813,"proto":"tcp","label":"","count":1,"sessions":0},{"port":8933,"proto":"tcp","label":"","count":1,"sessions":0}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i3514h1_8f004308c246_5c2c66f702b0"],"tls_client_hello":"","tls_ja3":["90189170f2171f397898ade1c4de4367"],"http_akin":["b11cun040_00040015_4c87b06e","b11cun050_00040017_6b90553b"],"interactive":{"ssh_hassh":[],"tls_ja4":["t13i3514h1_8f004308c246_5c2c66f702b0"],"tls_ja3":["90189170f2171f397898ade1c4de4367"]}},"fingerprint_peers":{"t13i3514h1_8f004308c246_5c2c66f702b0":0,"b11cun040_00040015_4c87b06e":357,"b11cun050_00040017_6b90553b":970},"akin_families":{"b11cun040_00040015_4c87b06e":{"head":"b11cun040_00040015_4c87b06e","shapes":4,"ips":358},"b11cun050_00040017_6b90553b":{"head":"b11cun050_00040017_6b90553b","shapes":9,"ips":969}},"user_agents":["Mozilla/5.0 (compatible; Infrawatch/1.0; +https://infrawat.ch/)"],"timeline":[{"date":"2026-08-30","count":2,"sessions":0},{"date":"2026-08-31","count":7,"sessions":0},{"date":"2026-09-01","count":6,"sessions":0},{"date":"2026-09-02","count":5,"sessions":0},{"date":"2026-10-19","count":0,"sessions":4},{"date":"2026-10-20","count":1,"sessions":27},{"date":"2026-10-21","count":0,"sessions":36},{"date":"2026-10-23","count":0,"sessions":1}],"recent_events":[{"timestamp":"2026-10-23T06:22:21","port":4443,"proto":"tcp","app_proto":"http","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"application/json, text/event-stream\",\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"content-length\":\"151\",\"content-type\":\"application/json\",\"host\":\"<HONEYPOT>:4443\",\"mcp-protocol-version\":\"2025-11-25\",\"user-agent\":\"Mozilla/5.0 (compatible; Infrawatch/1.0; +https://infrawat.ch/)\"}","body":"{\"id\":1,\"jsonrpc\":\"2.0\",\"method\":\"initialize\",\"params\":{\"capabilities\":{},\"clientInfo\":{\"name\":\"client\",\"version\":\"0\"},\"protocolVersion\":\"2025-11-25\"}}","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"1.3","alpn":[],"url_path":"/mcp","summary":"","payload_hex":"504f5354202f6d637020485454502f312e310d0a486f73743a203c484f4e4559504f543e3a343434330d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b20496e66726177617463682f312e303b202b68747470733a2f2f696e6672617761742e63682f290d0a436f6e74656e742d4c656e6774683a203135310d0a4163636570743a206170706c69636174696f6e2f6a736f6e2c20746578742f6576656e742d73747265616d0d0a436f6e6e656374696f6e3a20636c6f73650d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a4d63702d50726f746f636f6c2d56657273696f6e3a20323032352d31312d32350d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a7b226964223a312c226a736f6e727063223a22322e30222c226d6574686f64223a22696e697469616c697a65222c22706172616d73223a7b226361706162696c6974696573223a7b7d2c22636c69656e74496e666f223a7b226e616d65223a22636c69656e74222c2276657273696f6e223a2230227d2c2270726f746f636f6c56657273696f6e223a22323032352d31312d3235227d7d","method":"POST","user_agent":"Mozilla/5.0 (compatible; Infrawatch/1.0; +https://infrawat.ch/)","ja3":"90189170f2171f397898ade1c4de4367","session":"4b5330e0-d658-49ba-b581-2764cf10ea73-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-21T21:04:12","port":63940,"proto":"tcp","app_proto":"http","app_protocol":"http","host":"192.0.2.1","headers":"{\"accept\":\"*/*\",\"connection\":\"close\",\"host\":\"192.0.2.1\",\"user-agent\":\"Mozilla/5.0 (compatible; Infrawatch/1.0; +https://infrawat.ch/)\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a203139322e302e322e310d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b20496e66726177617463682f312e303b202b68747470733a2f2f696e6672617761742e63682f290d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; Infrawatch/1.0; +https://infrawat.ch/)","ja3":"","session":"3cb88075-d356-4e9b-8284-432a49311dd4-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-21T20:06:28","port":62268,"proto":"tcp","app_proto":"http","app_protocol":"http","host":"192.0.2.1","headers":"{\"accept\":\"*/*\",\"connection\":\"close\",\"host\":\"192.0.2.1\",\"user-agent\":\"Mozilla/5.0 (compatible; Infrawatch/1.0; +https://infrawat.ch/)\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a203139322e302e322e310d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b20496e66726177617463682f312e303b202b68747470733a2f2f696e6672617761742e63682f290d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; Infrawatch/1.0; +https://infrawat.ch/)","ja3":"","session":"f4d0bcaf-e924-4873-8b11-e3a17b3dc979-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-21T19:11:32","port":61121,"proto":"tcp","app_proto":"http","app_protocol":"http","host":"192.0.2.1","headers":"{\"accept\":\"*/*\",\"connection\":\"close\",\"host\":\"192.0.2.1\",\"user-agent\":\"Mozilla/5.0 (compatible; Infrawatch/1.0; +https://infrawat.ch/)\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a203139322e302e322e310d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b20496e66726177617463682f312e303b202b68747470733a2f2f696e6672617761742e63682f290d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; Infrawatch/1.0; +https://infrawat.ch/)","ja3":"","session":"3f306282-49e5-4db6-a1d5-d5c198deb97c-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-21T16:57:42","port":58452,"proto":"tcp","app_proto":"http","app_protocol":"http","host":"192.0.2.1","headers":"{\"accept\":\"*/*\",\"connection\":\"close\",\"host\":\"192.0.2.1\",\"user-agent\":\"Mozilla/5.0 (compatible; Infrawatch/1.0; +https://infrawat.ch/)\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a203139322e302e322e310d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b20496e66726177617463682f312e303b202b68747470733a2f2f696e6672617761742e63682f290d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; Infrawatch/1.0; +https://infrawat.ch/)","ja3":"","session":"b158a00e-451d-4871-9e46-95cdffedf093-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-21T16:12:23","port":57529,"proto":"tcp","app_proto":"http","app_protocol":"http","host":"192.0.2.1","headers":"{\"accept\":\"*/*\",\"connection\":\"close\",\"host\":\"192.0.2.1\",\"user-agent\":\"Mozilla/5.0 (compatible; Infrawatch/1.0; +https://infrawat.ch/)\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a203139322e302e322e310d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b20496e66726177617463682f312e303b202b68747470733a2f2f696e6672617761742e63682f290d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; Infrawatch/1.0; +https://infrawat.ch/)","ja3":"","session":"9ed75345-ad21-44f4-9060-d254131621b0-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-21T16:09:37","port":57363,"proto":"tcp","app_proto":"http","app_protocol":"http","host":"192.0.2.1","headers":"{\"accept\":\"*/*\",\"connection\":\"close\",\"host\":\"192.0.2.1\",\"user-agent\":\"Mozilla/5.0 (compatible; Infrawatch/1.0; +https://infrawat.ch/)\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a203139322e302e322e310d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b20496e66726177617463682f312e303b202b68747470733a2f2f696e6672617761742e63682f290d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; Infrawatch/1.0; +https://infrawat.ch/)","ja3":"","session":"4aba863a-a876-4027-91bc-1444e494c601-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-21T15:24:54","port":56478,"proto":"tcp","app_proto":"http","app_protocol":"http","host":"192.0.2.1","headers":"{\"accept\":\"*/*\",\"connection\":\"close\",\"host\":\"192.0.2.1\",\"user-agent\":\"Mozilla/5.0 (compatible; Infrawatch/1.0; +https://infrawat.ch/)\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a203139322e302e322e310d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b20496e66726177617463682f312e303b202b68747470733a2f2f696e6672617761742e63682f290d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; Infrawatch/1.0; +https://infrawat.ch/)","ja3":"","session":"e6bc6a49-d023-4d56-8af8-cc71533973bd-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-21T13:49:19","port":54932,"proto":"tcp","app_proto":"http","app_protocol":"http","host":"192.0.2.1","headers":"{\"accept\":\"*/*\",\"connection\":\"close\",\"host\":\"192.0.2.1\",\"user-agent\":\"Mozilla/5.0 (compatible; Infrawatch/1.0; +https://infrawat.ch/)\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a203139322e302e322e310d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b20496e66726177617463682f312e303b202b68747470733a2f2f696e6672617761742e63682f290d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; Infrawatch/1.0; +https://infrawat.ch/)","ja3":"","session":"51b24006-e5bf-4d3e-af8b-aecc3b4776d2-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-21T12:52:28","port":53805,"proto":"tcp","app_proto":"http","app_protocol":"http","host":"192.0.2.1","headers":"{\"accept\":\"*/*\",\"connection\":\"close\",\"host\":\"192.0.2.1\",\"user-agent\":\"Mozilla/5.0 (compatible; Infrawatch/1.0; +https://infrawat.ch/)\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a203139322e302e322e310d0a557365722d4167656e743a204d6f7a696c6c612f352e302028636f6d70617469626c653b20496e66726177617463682f312e303b202b68747470733a2f2f696e6672617761742e63682f290d0a4163636570743a202a2f2a0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (compatible; Infrawatch/1.0; +https://infrawat.ch/)","ja3":"","session":"57bfde09-2389-4e21-8f6a-ea548e1352bf-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true}],"http_methods":[{"method":"GET","count":87},{"method":"POST","count":1}],"distinct_ports_total":89,"top_paths":[{"path":"/","count":86,"ports":67},{"path":"/favicon.ico","count":1,"ports":1},{"path":"/mcp","count":1,"ports":1}],"distinct_paths_total":3,"top_snis":[],"top_hosts":[{"value":"192.0.2.1","count":86}],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","Accept-Encoding","Connection","Content-Length","Content-Type","Host","Mcp-Protocol-Version","User-Agent"],"representative":[{"name":"Accept","value":"application/json, text/event-stream","notable":false},{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Connection","value":"close","notable":false},{"name":"Content-Length","value":"151","notable":false},{"name":"Content-Type","value":"application/json","notable":true},{"name":"Host","value":"<HONEYPOT>:4443","notable":false},{"name":"Mcp-Protocol-Version","value":"2025-11-25","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (compatible; Infrawatch/1.0; +https://infrawat.ch/)","notable":false}],"distinct_sets":2,"events_with_headers":10},"tags":[]}