{"ip":"64.94.85.57","data_as_of":"2026-10-26T05:44:56+00:00","observed":true,"total_events":0,"verdict":{"verdict":"probing","label":"Low-level probing","detail":null,"confidence":"low","network_type":null,"why":["51 event(s), fewer than 10 distinct ports, no exploit payloads.","Not in any known-scanner range.","Sent 5,700 bytes to few ports with no known exploit path, which is focused interaction with one service.","Counted from 51 interactive session(s); the first-packet sensors recorded no TCP events from this address."],"engagement":{"level":"payload","label":"Sustained payload","detail":"5,700 bytes sent","bytes_sent":5700,"session_seconds":9,"persistent":false},"basis":"interactive"},"first_seen":"2026-10-22T18:06:35","last_seen":"2026-10-22T18:18:09","events_24h":0,"events_7d":0,"interactive_sessions":51,"interactive_sessions_24h":0,"interactive_sessions_7d":51,"interactive_protocols":[{"protocol":"http","sessions":36},{"protocol":"tls","sessions":9},{"protocol":"mongodb","sessions":3}],"geo":{"country_code":"US","country_name":"United States","region":"","city":"","lat":null,"lon":null,"asn":399629,"org":"BL Networks"},"source_domain":null,"known_scanners":[],"scanner_tag":null,"cve_matches":[],"malware":[],"udp":null,"interaction":{"window_days":90,"sessions":51,"first_seen":"2026-10-22T18:06:35","last_seen":"2026-10-22T18:18:09","verdicts":[{"verdict":"scan","sessions":45},{"verdict":"unknown","sessions":6}],"personas":[{"persona":"nginx@1.24.0, wordpress@6.5.2, leaks@2, miner@bfgminer 5.5.0, elasticsearch@6.8.23, winrm@Windows Server 2016, fortigate@7.0.5, gitlab@19.4.2","sessions":36},{"persona":"mongodb@6.0.15","sessions":3}],"services":[{"protocol":"http","port":1337,"sessions":12},{"protocol":"http","port":8888,"sessions":12},{"protocol":"http","port":8443,"sessions":12},{"protocol":"tls","port":1337,"sessions":3},{"protocol":"tls","port":8888,"sessions":3},{"protocol":"tls","port":8443,"sessions":3},{"protocol":"tcp","port":8888,"sessions":1},{"protocol":"tcp","port":8443,"sessions":1},{"protocol":"mongodb","port":1337,"sessions":1},{"protocol":"mongodb","port":8443,"sessions":1},{"protocol":"tcp","port":1337,"sessions":1},{"protocol":"mongodb","port":8888,"sessions":1}],"logins":[],"commands":[],"downloads":[],"files":[],"attack":[{"technique_id":"T1595","technique_name":"Active Scanning","tactic_id":"TA0043","tactic_name":"Reconnaissance","sessions":45}]},"top_ports":[{"port":1337,"proto":"tcp","label":"HTTP","count":0,"sessions":17},{"port":8443,"proto":"tcp","label":"HTTPS-alt","count":0,"sessions":17},{"port":8888,"proto":"tcp","label":"HTTP-alt","count":0,"sessions":17}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i311000_e8f1e7e78f70_d41ae481755e"],"tls_client_hello":"","tls_ja3":["c12b4ccd5320bbb380ca1a9df90f771d"],"http_akin":[],"interactive":{"ssh_hassh":[],"tls_ja4":["t13i311000_e8f1e7e78f70_d41ae481755e"],"tls_ja3":["c12b4ccd5320bbb380ca1a9df90f771d"]}},"fingerprint_peers":{"t13i311000_e8f1e7e78f70_d41ae481755e":688},"akin_families":{},"user_agents":[],"timeline":[{"date":"2026-10-22","count":0,"sessions":51}],"recent_events":[{"timestamp":"2026-10-22T18:18:09","port":1337,"proto":"tcp","app_proto":"http","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"host\":\"<HONEYPOT>\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"1.3","alpn":[],"url_path":"/abc7","summary":"","payload_hex":"474554202f6162633720485454502f312e310d0a486f73743a203c484f4e4559504f543e0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"","ja3":"c12b4ccd5320bbb380ca1a9df90f771d","session":"72d311d9-0d90-4881-a229-14d4b75a5818-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-22T18:18:09","port":1337,"proto":"tcp","app_proto":"http","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"host\":\"<HONEYPOT>\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"1.3","alpn":[],"url_path":"/abc6","summary":"","payload_hex":"474554202f6162633620485454502f312e310d0a486f73743a203c484f4e4559504f543e0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"","ja3":"c12b4ccd5320bbb380ca1a9df90f771d","session":"0215ddc5-3e14-48a9-b29a-9fddbc164d0c-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-22T18:18:09","port":1337,"proto":"tcp","app_proto":"http","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"host\":\"<HONEYPOT>\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"1.3","alpn":[],"url_path":"/abc8","summary":"","payload_hex":"474554202f6162633820485454502f312e310d0a486f73743a203c484f4e4559504f543e0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"","ja3":"c12b4ccd5320bbb380ca1a9df90f771d","session":"282ee2a6-8b34-41b2-a0ad-a6e8dc0640bd-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-22T18:18:09","port":1337,"proto":"tcp","app_proto":"http","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"host\":\"<HONEYPOT>\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/abc7","summary":"","payload_hex":"474554202f6162633720485454502f312e310d0a486f73743a203c484f4e4559504f543e0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"5a2620ec-e291-4df9-8fa7-efaec4cc050e-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-22T18:18:09","port":1337,"proto":"tcp","app_proto":"http","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"host\":\"<HONEYPOT>\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/abc8","summary":"","payload_hex":"474554202f6162633820485454502f312e310d0a486f73743a203c484f4e4559504f543e0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"feebfed8-4a94-4820-9d30-19150ae8b674-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-22T18:18:09","port":1337,"proto":"tcp","app_proto":"http","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"host\":\"<HONEYPOT>\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/abc6","summary":"","payload_hex":"474554202f6162633620485454502f312e310d0a486f73743a203c484f4e4559504f543e0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"2977f4d7-8d5d-4c62-8725-ce990cc04069-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-22T18:18:01","port":1337,"proto":"tcp","app_proto":"tls","app_protocol":"tls","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"1.3","alpn":[],"url_path":"","summary":"\u0000\u0001\u0000\u0001\u0000\u0000\u0000\u0001\u0000\\\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000�o\u0000\u0000\u0000\u0000\u0000\u0000\u0000�{\"version\":\"0.69.1\",\"hostname\":\"scanner-probe-host-0001\",\"os\":\"darwin\",\"arch\":\"arm64\",\"privilege_key\":\"5abe744e9d3dfe7609a39d5ba456f723\",\"timestamp\":1782367876,\"client_spec\":{},\"pool_count\":1}","payload_hex":"0001000100000001005c00000000000000000001000000c96f00000000000000c07b2276657273696f6e223a22302e36392e31222c22686f73746e616d65223a227363616e6e65722d70726f62652d686f73742d30303031222c226f73223a2264617277696e222c2261726368223a2261726d3634222c2270726976696c6567655f6b6579223a223561626537343465396433646665373630396133396435626134353666373233222c2274696d657374616d70223a313738323336373837362c22636c69656e745f73706563223a7b7d2c22706f6f6c5f636f756e74223a317d","method":"","user_agent":"","ja3":"c12b4ccd5320bbb380ca1a9df90f771d","session":"be9593f3-301b-4330-89b5-4e9caa0fc954-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"018b26cdfe517432","strings":["{\"version\":\"0.69.1\",\"hostname\":\"scanner-probe-host-0001\",\"os\":\"darwin\",\"arch\":\"a…"]},"interactive":true},{"timestamp":"2026-10-22T18:18:01","port":1337,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0001\u0000\u0001\u0000\u0000\u0000\u0001\u0000\\\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000�o\u0000\u0000\u0000\u0000\u0000\u0000\u0000�{\"version\":\"0.69.1\",\"hostname\":\"scanner-probe-host-0001\",\"os\":\"darwin\",\"arch\":\"arm64\",\"privilege_key\":\"5abe744e9d3dfe7609a39d5ba456f723\",\"timestamp\":1782367876,\"client_spec\":{},\"pool_count\":1}","payload_hex":"0001000100000001005c00000000000000000001000000c96f00000000000000c07b2276657273696f6e223a22302e36392e31222c22686f73746e616d65223a227363616e6e65722d70726f62652d686f73742d30303031222c226f73223a2264617277696e222c2261726368223a2261726d3634222c2270726976696c6567655f6b6579223a223561626537343465396433646665373630396133396435626134353666373233222c2274696d657374616d70223a313738323336373837362c22636c69656e745f73706563223a7b7d2c22706f6f6c5f636f756e74223a317d","method":"","user_agent":"","ja3":"","session":"0bf88062-7c39-401f-84fe-e4e573c3391d-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"018b26cdfe517432","strings":["{\"version\":\"0.69.1\",\"hostname\":\"scanner-probe-host-0001\",\"os\":\"darwin\",\"arch\":\"a…"]},"interactive":true},{"timestamp":"2026-10-22T18:18:01","port":1337,"proto":"tcp","app_proto":"http","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"host\":\"<HONEYPOT>\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a203c484f4e4559504f543e0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"","ja3":"c12b4ccd5320bbb380ca1a9df90f771d","session":"e7f10377-e65e-4143-a0f1-d18afefa9a2e-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-22T18:18:01","port":1337,"proto":"tcp","app_proto":"http","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"Upgrade\",\"host\":\"<HONEYPOT>\",\"sec-websocket-key\":\"ZXmswD0NSDA7ohzrrc7NvA==\",\"sec-websocket-protocol\":\"chisel-v3\",\"sec-websocket-version\":\"13\",\"upgrade\":\"websocket\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a203c484f4e4559504f543e0d0a557067726164653a20776562736f636b65740d0a436f6e6e656374696f6e3a20557067726164650d0a5365632d576562536f636b65742d4b65793a205a586d737744304e534441376f687a727263374e76413d3d0d0a5365632d576562536f636b65742d56657273696f6e3a2031330d0a5365632d576562536f636b65742d50726f746f636f6c3a2063686973656c2d76330d0a0d0a","method":"GET","user_agent":"","ja3":"c12b4ccd5320bbb380ca1a9df90f771d","session":"4936d906-06bb-4e52-a80e-94e904f6e7e6-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true}],"http_methods":[{"method":"GET","count":36}],"distinct_ports_total":3,"top_paths":[{"path":"/","count":12,"ports":3},{"path":"/abc6","count":6,"ports":3},{"path":"/abc8","count":6,"ports":3},{"path":"/abc7","count":6,"ports":3},{"path":"/api/metrics/run","count":3,"ports":3},{"path":"/7f13c0a9d8644f3ca0a563b6b56e49d7","count":3,"ports":3}],"distinct_paths_total":6,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Connection","Host","Sec-Websocket-Key","Sec-Websocket-Protocol","Sec-Websocket-Version","Upgrade"],"representative":[{"name":"Connection","value":"Upgrade","notable":false},{"name":"Host","value":"<HONEYPOT>","notable":false},{"name":"Sec-Websocket-Key","value":"ZXmswD0NSDA7ohzrrc7NvA==","notable":false},{"name":"Sec-Websocket-Protocol","value":"chisel-v3","notable":false},{"name":"Sec-Websocket-Version","value":"13","notable":false},{"name":"Upgrade","value":"websocket","notable":false}],"distinct_sets":2,"events_with_headers":8},"tags":[]}