{"ip":"64.227.7.176","total_events":105,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"25+ ports swept","confidence":"medium","network_type":"CDN","why":["No exploit payloads observed.","Swept 25 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"12,163 bytes sent","bytes_sent":12163,"session_seconds":1,"persistent":false}},"first_seen":"2026-09-17T11:22:42","last_seen":"2026-09-17T11:23:03","events_24h":0,"events_7d":105,"geo":{"country_code":"US","country_name":"United States","region":"New Jersey","city":"North Bergen","lat":40.7964,"lon":-74.0203,"asn":14061,"org":"DigitalOcean, LLC"},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as14061","label":"DigitalOcean","category":"cdn","url":"https://www.peeringdb.com/asn/14061"},"cve_matches":[],"malware":[],"top_ports":[{"port":1883,"proto":"tcp","label":"MQTT","count":8},{"port":11211,"proto":"tcp","label":"Memcached","count":7},{"port":1900,"proto":"tcp","label":"","count":6},{"port":20000,"proto":"tcp","label":"","count":6},{"port":9600,"proto":"tcp","label":"Logstash","count":6},{"port":12159,"proto":"tcp","label":"","count":6},{"port":3535,"proto":"tcp","label":"","count":5},{"port":1337,"proto":"tcp","label":"","count":5},{"port":3000,"proto":"tcp","label":"Web-alt","count":5},{"port":7547,"proto":"tcp","label":"TR-069","count":5},{"port":8020,"proto":"tcp","label":"","count":5},{"port":4443,"proto":"tcp","label":"","count":5},{"port":5984,"proto":"tcp","label":"CouchDB","count":5},{"port":3085,"proto":"tcp","label":"","count":5},{"port":2031,"proto":"tcp","label":"","count":5}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i190800_9dc949149365_97f8aa674fd9","t13i1909h2_9dc949149365_97f8aa674fd9"],"tls_ja3":["5af43e5eee17271a9eb37dce2ab407a8","e5c250b292fce278a62137836169e18f"],"ja4h":["ge11nn0400_88d30a62b7ad"]},"fingerprint_peers":{"t13i190800_9dc949149365_97f8aa674fd9":2847,"t13i1909h2_9dc949149365_97f8aa674fd9":637,"ge11nn0400_88d30a62b7ad":6481},"user_agents":["Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36"],"timeline":[{"date":"2026-09-17","count":105}],"recent_events":[{"timestamp":"2026-09-17T11:23:03","port":1883,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:1883\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/security.txt","summary":"","payload_hex":"474554202f73656375726974792e74787420485454502f312e310d0a486f73743a20<HONEYPOT>3a313838330d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3134302e302e302e30205361666172692f3533372e33360d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36","ja3":"5af43e5eee17271a9eb37dce2ab407a8","session":"1ec3be9e-ab05-43f1-b08f-4522a818c7d7","seq":1,"duration_ms":100,"bytes_in":216,"bytes_out":77},{"timestamp":"2026-09-17T11:23:03","port":1900,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:1900\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/security.txt","summary":"","payload_hex":"474554202f73656375726974792e74787420485454502f312e310d0a486f73743a20<HONEYPOT>3a313930300d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3134302e302e302e30205361666172692f3533372e33360d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36","ja3":"5af43e5eee17271a9eb37dce2ab407a8","session":"41b4f3f8-b8c4-45d5-9062-dc7040408527","seq":1,"duration_ms":100,"bytes_in":216,"bytes_out":77},{"timestamp":"2026-09-17T11:23:02","port":12159,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:12159\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/security.txt","summary":"","payload_hex":"474554202f73656375726974792e74787420485454502f312e310d0a486f73743a20<HONEYPOT>3a31323135390d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3134302e302e302e30205361666172692f3533372e33360d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36","ja3":"5af43e5eee17271a9eb37dce2ab407a8","session":"d465bb25-5586-4158-acb3-4d579b2828c9","seq":1,"duration_ms":100,"bytes_in":217,"bytes_out":77},{"timestamp":"2026-09-17T11:23:01","port":1883,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:1883\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/robots.txt","summary":"","payload_hex":"474554202f726f626f74732e74787420485454502f312e310d0a486f73743a20<HONEYPOT>3a313838330d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3134302e302e302e30205361666172692f3533372e33360d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36","ja3":"5af43e5eee17271a9eb37dce2ab407a8","session":"b3d8e105-6e81-4a84-a624-ee360d19442f","seq":1,"duration_ms":100,"bytes_in":214,"bytes_out":77},{"timestamp":"2026-09-17T11:23:00","port":1883,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:1883\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/.well-known/security.txt","summary":"","payload_hex":"474554202f2e77656c6c2d6b6e6f776e2f73656375726974792e74787420485454502f312e310d0a486f73743a20<HONEYPOT>3a313838330d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3134302e302e302e30205361666172692f3533372e33360d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36","ja3":"5af43e5eee17271a9eb37dce2ab407a8","session":"96571118-b757-4e07-bd21-ecb2bb8271a6","seq":1,"duration_ms":100,"bytes_in":228,"bytes_out":77},{"timestamp":"2026-09-17T11:23:00","port":1883,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:1883\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/favicon.ico","summary":"","payload_hex":"474554202f66617669636f6e2e69636f20485454502f312e310d0a486f73743a20<HONEYPOT>3a313838330d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3134302e302e302e30205361666172692f3533372e33360d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36","ja3":"5af43e5eee17271a9eb37dce2ab407a8","session":"33581283-e7a7-4f56-b717-2e11f9711e5d","seq":1,"duration_ms":101,"bytes_in":215,"bytes_out":77},{"timestamp":"2026-09-17T11:23:00","port":31337,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:31337\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/security.txt","summary":"","payload_hex":"474554202f73656375726974792e74787420485454502f312e310d0a486f73743a20<HONEYPOT>3a33313333370d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3134302e302e302e30205361666172692f3533372e33360d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36","ja3":"5af43e5eee17271a9eb37dce2ab407a8","session":"f0e88504-eeef-4764-8e9d-4e763d95bae7","seq":1,"duration_ms":101,"bytes_in":217,"bytes_out":77},{"timestamp":"2026-09-17T11:22:56","port":2031,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:2031\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/security.txt","summary":"","payload_hex":"474554202f73656375726974792e74787420485454502f312e310d0a486f73743a20<HONEYPOT>3a323033310d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3134302e302e302e30205361666172692f3533372e33360d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36","ja3":"5af43e5eee17271a9eb37dce2ab407a8","session":"a5dfebbb-1e4a-4ce7-ad2a-04efb6bc6d4a","seq":1,"duration_ms":139,"bytes_in":216,"bytes_out":77},{"timestamp":"2026-09-17T11:22:56","port":2031,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:2031\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/.well-known/robots.txt","summary":"","payload_hex":"474554202f2e77656c6c2d6b6e6f776e2f726f626f74732e74787420485454502f312e310d0a486f73743a20<HONEYPOT>3a323033310d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3134302e302e302e30205361666172692f3533372e33360d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36","ja3":"5af43e5eee17271a9eb37dce2ab407a8","session":"517a8d89-7406-4c11-90e1-4be412c6b94b","seq":1,"duration_ms":135,"bytes_in":226,"bytes_out":77},{"timestamp":"2026-09-17T11:22:56","port":23,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"","summary":"fox a 1 -1 fox hello\n{\nfox.version=s:1.0\nid=i:1\nhostName=s:xpvm-0omdc01xmy\nhostAddress=s:192.168.1.125\napp.name=s:Workbench\napp.version=s:3.7.44\nvm.name=s:Java HotSpot(TM) Server VM\nvm.version=s:20.4-b02\nos.name=s:Windows XP\nos.version=s:5.1\nlang=s:en\ntimeZone=s:America/Los_Angeles;-28800000;3600000;02:00:00.000,wall,march,8,on or after,sunday,undefined;02:00:00.000,wall,november,1,on or after,sunday,undefined\nhostId=s:Win-99CB-D49D-5442-07BB\nvmUuid=s:8b530bc8-76c5-4139-a2ea-0fabd394d305\nbrandId=s:vykon\n};;\n","payload_hex":"666f7820612031202d3120666f782068656c6c6f0a7b0a666f782e76657273696f6e3d733a312e300a69643d693a310a686f73744e616d653d733a7870766d2d306f6d64633031786d790a686f7374416464726573733d733a3139322e3136382e312e3132350a6170702e6e616d653d733a576f726b62656e63680a6170702e76657273696f6e3d733a332e372e34340a766d2e6e616d653d733a4a61766120486f7453706f7428544d292053657276657220564d0a766d2e76657273696f6e3d733a32302e342d6230320a6f732e6e616d653d733a57696e646f77732058500a6f732e76657273696f6e3d733a352e310a6c616e673d733a656e0a74696d655a6f6e653d733a416d65726963612f4c6f735f416e67656c65733b2d32383830303030303b333630303030303b30323a30303a30302e3030302c77616c6c2c6d617263682c382c6f6e206f722061667465722c73756e6461792c756e646566696e65643b30323a30303a30302e3030302c77616c6c2c6e6f76656d6265722c312c6f6e206f722061667465722c73756e6461792c756e646566696e65640a686f737449643d733a57696e2d393943422d443439442d353434322d303742420a766d557569643d733a38623533306263382d373663352d343133392d613265612d3066616264333934643330350a6272616e6449643d733a76796b6f6e0a7d3b3b0a","method":"","user_agent":"","ja3":"e5c250b292fce278a62137836169e18f","session":"c8a6afc9-0a99-4547-8008-028936cb250a","seq":1,"duration_ms":11,"bytes_in":513,"bytes_out":12,"enriched":{"digest":"fe39c976bf6d2d07","strings":["fox a 1 -1 fox hello","fox.version=s:1.0","id=i:1","hostName=s:xpvm-0omdc01xmy","hostAddress=s:192.168.1.125","app.name=s:Workbench","app.version=s:3.7.44","vm.name=s:Java HotSpot(TM) Server VM","vm.version=s:20.4-b02","os.name=s:Windows XP"],"iocs":{"ips":["192.168.1.125"],"domains":["fox.version","app.name","app.version","vm.name","vm.version","os.name"]}}}],"http_methods":[{"method":"GET","count":36}],"distinct_ports_total":25,"top_paths":[{"path":"/","count":8,"ports":8},{"path":"/security.txt","count":8,"ports":8},{"path":"/favicon.ico","count":7,"ports":7},{"path":"/robots.txt","count":6,"ports":6},{"path":"/.well-known/security.txt","count":6,"ports":6},{"path":"/.well-known/robots.txt","count":1,"ports":1}],"distinct_paths_total":6,"top_snis":[],"top_hosts":[],"top_alpns":[{"value":"h2, http/1.1","count":21}],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","Accept-Encoding","Host","User-Agent"],"representative":[{"name":"Accept","value":"*/*","notable":false},{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Host","value":"<HONEYPOT>:1883","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36","notable":false}],"distinct_sets":1,"events_with_headers":9},"tags":[],"data_as_of":"2026-09-21T10:41:38.471570+00:00"}