{"ip":"66.179.31.143","total_events":8,"verdict":{"verdict":"probing","label":"Low-level probing","detail":null,"confidence":"low","network_type":null,"why":["8 event(s), fewer than 10 distinct ports, no exploit payloads.","Not in any known-scanner range."],"engagement":{"level":"request","label":"Request traffic","detail":"1,066 bytes sent","bytes_sent":1066,"session_seconds":0,"persistent":false}},"first_seen":"2026-09-22T11:02:36","last_seen":"2026-09-22T11:14:49","events_24h":0,"events_7d":0,"geo":{"country_code":"SG","country_name":"Singapore","region":"","city":"","lat":1.3667,"lon":103.8,"asn":399629,"org":"BL Networks"},"source_domain":null,"known_scanners":[],"scanner_tag":null,"cve_matches":[],"malware":[],"top_ports":[{"port":80,"proto":"tcp","label":"HTTP","count":4},{"port":8080,"proto":"tcp","label":"HTTP-alt","count":4}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i311000_e8f1e7e78f70_d41ae481755e"],"tls_client_hello":"1603010200010001fc03037e66a4ef4a80858b7f5d0cfae4734f283ca1c9cd4f7ba1f5101341deffa49aa020966150ad004f388a0239066a25aca9f50ed5da35b1737056b11ea4922e881555003e130213031301c02cc030009fcca9cca8ccaac02bc02f009ec024c028006bc023c0270067c00ac0140039c009c0130033009d009c003d003c0035002f00ff01000175000b000403000102000a00160014001d0017001e0019001801000101010201030104002300000016000000170000000d002a0028040305030603080708080809080a080b080408050806040105010601030303010302040205020602002b00050403040303002d00020101003300260024001d00206ea54575478b0a5807cdcc109c41a24cdff1700eece8a0726c6c65f6324af319001500dc00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000","tls_ja3":["c12b4ccd5320bbb380ca1a9df90f771d"],"http_akin":["b11cun020_00040001_78f1f19c","b11cun063_40040001_ffe60107_x9f62a4acfdb1"]},"fingerprint_peers":{"t13i311000_e8f1e7e78f70_d41ae481755e":794,"b11cun020_00040001_78f1f19c":49,"b11cun063_40040001_ffe60107_x9f62a4acfdb1":6},"akin_families":{},"user_agents":[],"timeline":[{"date":"2026-09-22","count":8}],"recent_events":[{"timestamp":"2026-09-22T11:14:49","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"host\":\"<HONEYPOT>\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/7f13c0a9d8644f3ca0a563b6b56e49d7","summary":"","payload_hex":"474554202f376631336330613964383634346633636130613536336236623536653439643720485454502f312e310d0a486f73743a20<HONEYPOT>0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"ab3e8e7d-0d5c-4565-8c56-63b98a4726c0","seq":1,"duration_ms":100,"bytes_in":89,"bytes_out":78},{"timestamp":"2026-09-22T11:14:49","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"host\":\"<HONEYPOT>\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/api/metrics/run","summary":"","payload_hex":"474554202f6170692f6d6574726963732f72756e20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"07938872-909c-4919-91d6-833fe1cfdb4d","seq":1,"duration_ms":100,"bytes_in":72,"bytes_out":78},{"timestamp":"2026-09-22T11:14:49","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"Upgrade\",\"host\":\"<HONEYPOT>\",\"sec-websocket-key\":\"zpZbY7u729uB5FGXz9xs0A==\",\"sec-websocket-protocol\":\"chisel-v3\",\"sec-websocket-version\":\"13\",\"upgrade\":\"websocket\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557067726164653a20776562736f636b65740d0a436f6e6e656374696f6e3a20557067726164650d0a5365632d576562536f636b65742d4b65793a207a705a625937753732397542354647587a39787330413d3d0d0a5365632d576562536f636b65742d56657273696f6e3a2031330d0a5365632d576562536f636b65742d50726f746f636f6c3a2063686973656c2d76330d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"bab9cc51-b2eb-47fc-a016-e88edfeb915c","seq":1,"duration_ms":101,"bytes_in":186,"bytes_out":78},{"timestamp":"2026-09-22T11:14:49","port":80,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"Upgrade\",\"host\":\"<HONEYPOT>\",\"sec-websocket-key\":\"xJHe5aKbp7NnSDVxixO0kw==\",\"sec-websocket-protocol\":\"chisel-v3\",\"sec-websocket-version\":\"13\",\"upgrade\":\"websocket\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557067726164653a20776562736f636b65740d0a436f6e6e656374696f6e3a20557067726164650d0a5365632d576562536f636b65742d4b65793a20784a486535614b6270374e6e5344567869784f306b773d3d0d0a5365632d576562536f636b65742d56657273696f6e3a2031330d0a5365632d576562536f636b65742d50726f746f636f6c3a2063686973656c2d76330d0a0d0a","method":"GET","user_agent":"","ja3":"c12b4ccd5320bbb380ca1a9df90f771d","session":"0382fe80-93fd-44a1-bb5f-c8530e923b40","seq":1,"duration_ms":100,"bytes_in":186,"bytes_out":78},{"timestamp":"2026-09-22T11:02:38","port":8080,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"host\":\"<HONEYPOT>\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/7f13c0a9d8644f3ca0a563b6b56e49d7","summary":"","payload_hex":"474554202f376631336330613964383634346633636130613536336236623536653439643720485454502f312e310d0a486f73743a20<HONEYPOT>0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"375bcf61-8adf-420f-9759-8d4146161cbd","seq":1,"duration_ms":100,"bytes_in":89,"bytes_out":78},{"timestamp":"2026-09-22T11:02:37","port":8080,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"Upgrade\",\"host\":\"<HONEYPOT>\",\"sec-websocket-key\":\"ZcNLPucrW/4enfB0BGIl8A==\",\"sec-websocket-protocol\":\"chisel-v3\",\"sec-websocket-version\":\"13\",\"upgrade\":\"websocket\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557067726164653a20776562736f636b65740d0a436f6e6e656374696f6e3a20557067726164650d0a5365632d576562536f636b65742d4b65793a205a634e4c50756372572f34656e6642304247496c38413d3d0d0a5365632d576562536f636b65742d56657273696f6e3a2031330d0a5365632d576562536f636b65742d50726f746f636f6c3a2063686973656c2d76330d0a0d0a","method":"GET","user_agent":"","ja3":"c12b4ccd5320bbb380ca1a9df90f771d","session":"10813567-d8aa-419f-bf9e-3cfc9d70b106","seq":1,"duration_ms":100,"bytes_in":186,"bytes_out":78},{"timestamp":"2026-09-22T11:02:36","port":8080,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"host\":\"<HONEYPOT>\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/api/metrics/run","summary":"","payload_hex":"474554202f6170692f6d6574726963732f72756e20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"e2fa3436-687a-4199-9603-bd6a760a5c49","seq":1,"duration_ms":100,"bytes_in":72,"bytes_out":78},{"timestamp":"2026-09-22T11:02:36","port":8080,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"Upgrade\",\"host\":\"<HONEYPOT>\",\"sec-websocket-key\":\"Htz5QYkkc71UefDO/FD0Tw==\",\"sec-websocket-protocol\":\"chisel-v3\",\"sec-websocket-version\":\"13\",\"upgrade\":\"websocket\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557067726164653a20776562736f636b65740d0a436f6e6e656374696f6e3a20557067726164650d0a5365632d576562536f636b65742d4b65793a2048747a3551596b6b633731556566444f2f46443054773d3d0d0a5365632d576562536f636b65742d56657273696f6e3a2031330d0a5365632d576562536f636b65742d50726f746f636f6c3a2063686973656c2d76330d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"7d4b7d58-9bd3-492b-94f3-b543ef8eda5f","seq":1,"duration_ms":102,"bytes_in":186,"bytes_out":78}],"http_methods":[{"method":"GET","count":8}],"distinct_ports_total":2,"top_paths":[{"path":"/","count":4,"ports":2},{"path":"/api/metrics/run","count":2,"ports":2},{"path":"/7f13c0a9d8644f3ca0a563b6b56e49d7","count":2,"ports":2}],"distinct_paths_total":3,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Connection","Host","Sec-Websocket-Key","Sec-Websocket-Protocol","Sec-Websocket-Version","Upgrade"],"representative":[{"name":"Connection","value":"Upgrade","notable":false},{"name":"Host","value":"<HONEYPOT>","notable":false},{"name":"Sec-Websocket-Key","value":"zpZbY7u729uB5FGXz9xs0A==","notable":false},{"name":"Sec-Websocket-Protocol","value":"chisel-v3","notable":false},{"name":"Sec-Websocket-Version","value":"13","notable":false},{"name":"Upgrade","value":"websocket","notable":false}],"distinct_sets":2,"events_with_headers":8},"tags":[],"data_as_of":"2026-09-30T16:53:11.702327+00:00"}