{"ip":"64.49.11.184","total_events":16,"verdict":{"verdict":"probing","label":"Low-level probing","detail":null,"confidence":"low","network_type":null,"why":["16 event(s), fewer than 10 distinct ports, no exploit payloads.","Not in any known-scanner range."],"engagement":{"level":"request","label":"Request traffic","detail":"1,238 bytes sent","bytes_sent":1238,"session_seconds":0,"persistent":false}},"first_seen":"2026-09-05T11:38:41","last_seen":"2026-09-13T12:18:16","events_24h":2,"events_7d":10,"geo":{"country_code":"GB","country_name":"United Kingdom","region":"England","city":"Coventry","lat":52.382,"lon":-1.5874,"asn":201002,"org":"PebbleHost Ltd"},"source_domain":"vm.184.11.49.64.sparked.cloud","known_scanners":[],"scanner_tag":null,"cve_matches":[],"malware":[],"top_ports":[{"port":11211,"proto":"tcp","label":"Memcached","count":4},{"port":53490,"proto":"tcp","label":"","count":2},{"port":27017,"proto":"tcp","label":"MongoDB","count":2},{"port":3033,"proto":"tcp","label":"","count":2},{"port":5555,"proto":"tcp","label":"","count":2},{"port":65535,"proto":"tcp","label":"","count":2},{"port":5349,"proto":"tcp","label":"","count":2}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i1310h1_f57a46bbacb6_e7c285222651"],"tls_ja3":["faa162b5a653756fba26803ea81b362f"],"ja4h":["ge11nn0400_9c3956fad5da"]},"fingerprint_peers":{"t13i1310h1_f57a46bbacb6_e7c285222651":70,"ge11nn0400_9c3956fad5da":1517},"user_agents":["Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0"],"timeline":[{"date":"2026-09-05","count":2},{"date":"2026-09-06","count":4},{"date":"2026-09-08","count":2},{"date":"2026-09-10","count":4},{"date":"2026-09-11","count":2},{"date":"2026-09-13","count":2}],"recent_events":[{"timestamp":"2026-09-13T12:18:16","port":5555,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:5555\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a353535350d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f36343b2072763a3134302e3029204765636b6f2f32303130303130312046697265666f782f3134302e300d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0","ja3":"faa162b5a653756fba26803ea81b362f","session":"74261cbc-d493-4cff-8422-af7cecf0cc2c","seq":1,"duration_ms":100,"bytes_in":169,"bytes_out":77},{"timestamp":"2026-09-13T12:05:16","port":5555,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:5555\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a353535350d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f36343b2072763a3134302e3029204765636b6f2f32303130303130312046697265666f782f3134302e300d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0","ja3":"faa162b5a653756fba26803ea81b362f","session":"6db67d8b-e838-4883-aeb3-4e12e0f2aa68","seq":1,"duration_ms":100,"bytes_in":169,"bytes_out":77},{"timestamp":"2026-09-11T01:14:25","port":65535,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:65535\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a36353533350d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f36343b2072763a3134302e3029204765636b6f2f32303130303130312046697265666f782f3134302e300d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0","ja3":"faa162b5a653756fba26803ea81b362f","session":"beb2102e-0b3d-44b5-9649-6f643c5396c0","seq":1,"duration_ms":101,"bytes_in":170,"bytes_out":77},{"timestamp":"2026-09-11T01:00:05","port":65535,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:65535\",\"user-agent\":\"Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":["http/1.1"],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a36353533350d0a557365722d4167656e743a204d6f7a696c6c612f352e3020285831313b204c696e7578207838365f36343b2072763a3134302e3029204765636b6f2f32303130303130312046697265666f782f3134302e300d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0","ja3":"faa162b5a653756fba26803ea81b362f","session":"2cad69e6-351a-4c2b-9ea6-86894c7bb4b9","seq":1,"duration_ms":101,"bytes_in":170,"bytes_out":77},{"timestamp":"2026-09-10T07:19:45","port":5349,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\n","payload_hex":"0a","method":"","user_agent":"","ja3":"","session":"1766df84-8e3f-4abe-951e-87661e4fe040","seq":1,"duration_ms":100,"bytes_in":1,"bytes_out":12},{"timestamp":"2026-09-10T07:05:20","port":5349,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\n","payload_hex":"0a","method":"","user_agent":"","ja3":"","session":"c3346dd7-c5ed-4b28-83b0-8bea759fc53d","seq":1,"duration_ms":100,"bytes_in":1,"bytes_out":12},{"timestamp":"2026-09-10T04:33:42","port":53490,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\n","payload_hex":"0a","method":"","user_agent":"","ja3":"","session":"4db11246-219e-4c33-80c2-cc80e63df1e4","seq":1,"duration_ms":100,"bytes_in":1,"bytes_out":12},{"timestamp":"2026-09-10T04:19:19","port":53490,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\n","payload_hex":"0a","method":"","user_agent":"","ja3":"","session":"238f6569-88f9-49bf-8112-441955bf2765","seq":1,"duration_ms":100,"bytes_in":1,"bytes_out":12},{"timestamp":"2026-09-08T08:03:37","port":27017,"proto":"tcp","app_proto":"","app_protocol":"mongodb","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":":\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000�\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0013\u0000\u0000\u0000\u0010isMaster\u0000\u0001\u0000\u0000\u0000\u0000","payload_hex":"3a0000000000000000000000d40700000000000061646d696e2e24636d64000000000001000000130000001069734d6173746572000100000000","method":"","user_agent":"","ja3":"","session":"45025b84-5bc8-4f66-8bc0-9b5d9fb193d6","seq":1,"duration_ms":100,"bytes_in":58,"bytes_out":12,"enriched":{"digest":"71265954b8b925aa","strings":["admin.$cmd","isMaster"]}},{"timestamp":"2026-09-08T07:49:09","port":27017,"proto":"tcp","app_proto":"","app_protocol":"mongodb","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":":\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000�\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0013\u0000\u0000\u0000\u0010isMaster\u0000\u0001\u0000\u0000\u0000\u0000","payload_hex":"3a0000000000000000000000d40700000000000061646d696e2e24636d64000000000001000000130000001069734d6173746572000100000000","method":"","user_agent":"","ja3":"","session":"3b7f93de-33b8-42ca-bb7c-12ac72f6398c","seq":1,"duration_ms":100,"bytes_in":58,"bytes_out":12,"enriched":{"digest":"71265954b8b925aa","strings":["admin.$cmd","isMaster"]}}],"http_methods":[{"method":"GET","count":6}],"distinct_ports_total":7,"top_paths":[{"path":"/","count":6,"ports":3}],"distinct_paths_total":1,"top_snis":[],"top_hosts":[],"top_alpns":[{"value":"http/1.1","count":4}],"banners":[],"credentials":[],"header_profile":{"signature":["Accept-Encoding","Connection","Host","User-Agent"],"representative":[{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Connection","value":"close","notable":false},{"name":"Host","value":"<HONEYPOT>:5555","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0","notable":false}],"distinct_sets":1,"events_with_headers":4},"tags":[],"data_as_of":"2026-09-13T23:13:08.001337+00:00"}