{"ip":"69.167.107.32","total_events":270,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"20+ ports swept","confidence":"medium","network_type":"enterprise","why":["No exploit payloads observed.","Swept 20 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"27,212 bytes sent","bytes_sent":27212,"session_seconds":2,"persistent":false}},"first_seen":"2026-08-29T07:06:47","last_seen":"2026-09-09T21:48:50","events_24h":0,"events_7d":0,"geo":{"country_code":"US","country_name":"United States","region":"California","city":"San Jose","lat":37.3388,"lon":-121.8916,"asn":40934,"org":"Fortinet Inc."},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as40934","label":"Fortinet","category":"enterprise","url":"https://www.peeringdb.com/asn/40934"},"cve_matches":[],"malware":[],"top_ports":[{"port":4435,"proto":"tcp","label":"","count":36},{"port":80,"proto":"tcp","label":"HTTP","count":24},{"port":443,"proto":"tcp","label":"HTTPS","count":24},{"port":4439,"proto":"tcp","label":"","count":18},{"port":1443,"proto":"tcp","label":"","count":18},{"port":6443,"proto":"tcp","label":"k8s API","count":18},{"port":3443,"proto":"tcp","label":"","count":18},{"port":2443,"proto":"tcp","label":"","count":18},{"port":4437,"proto":"tcp","label":"","count":18},{"port":4430,"proto":"tcp","label":"","count":18},{"port":8080,"proto":"tcp","label":"HTTP-alt","count":6},{"port":4444,"proto":"tcp","label":"","count":6},{"port":4443,"proto":"tcp","label":"","count":6},{"port":81,"proto":"tcp","label":"","count":6},{"port":8888,"proto":"tcp","label":"HTTP-alt","count":6}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t12i210600_76e208dd3e22_2dae41c691ec"],"tls_client_hello":"","tls_ja3":["c12f54a3f91dc7bafd92cb59fe009a35"]},"fingerprint_peers":{"t12i210600_76e208dd3e22_2dae41c691ec":21},"user_agents":[],"timeline":[{"date":"2026-08-29","count":18},{"date":"2026-08-30","count":72},{"date":"2026-08-31","count":69},{"date":"2026-09-01","count":69},{"date":"2026-09-02","count":6},{"date":"2026-09-03","count":3},{"date":"2026-09-06","count":3},{"date":"2026-09-07","count":6},{"date":"2026-09-08","count":6},{"date":"2026-09-09","count":18}],"recent_events":[{"timestamp":"2026-09-09T21:48:50","port":443,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip,deflate,br\",\"host\":\"<HONEYPOT>:443\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/login?redir=%2F","summary":"","payload_hex":"474554202f6c6f67696e3f72656469723d25324620485454502f312e310d0a6163636570743a202a2f2a0d0a6163636570742d656e636f64696e673a20677a69702c6465666c6174652c62720d0a686f73743a20<HONEYPOT>3a3434330d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"a6a67132-d502-484d-ae1a-7680057c19bb","seq":1,"duration_ms":100,"bytes_in":104,"bytes_out":78},{"timestamp":"2026-09-09T21:48:48","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip,deflate,br\",\"host\":\"<HONEYPOT>\"}","body":"","sni":"","tls_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","tls_version":"TLSv1.2","alpn":[],"url_path":"/login?redir=%2F","summary":"","payload_hex":"474554202f6c6f67696e3f72656469723d25324620485454502f312e310d0a6163636570743a202a2f2a0d0a6163636570742d656e636f64696e673a20677a69702c6465666c6174652c62720d0a686f73743a20<HONEYPOT>0d0a0d0a","method":"GET","user_agent":"","ja3":"c12f54a3f91dc7bafd92cb59fe009a35","session":"c64f9281-2f99-4c67-8953-d0936382435f","seq":1,"duration_ms":897,"bytes_in":100,"bytes_out":78},{"timestamp":"2026-09-09T21:48:46","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip,deflate,br\",\"host\":\"<HONEYPOT>\"}","body":"","sni":"","tls_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","tls_version":"TLSv1.2","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a6163636570743a202a2f2a0d0a6163636570742d656e636f64696e673a20677a69702c6465666c6174652c62720d0a686f73743a20<HONEYPOT>0d0a0d0a","method":"GET","user_agent":"","ja3":"c12f54a3f91dc7bafd92cb59fe009a35","session":"7ca74095-a734-4639-9a29-ed8ffac34c11","seq":1,"duration_ms":876,"bytes_in":85,"bytes_out":78},{"timestamp":"2026-09-09T21:12:57","port":4403,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip,deflate,br\",\"host\":\"<HONEYPOT>:4403\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/login?redir=%2F","summary":"","payload_hex":"474554202f6c6f67696e3f72656469723d25324620485454502f312e310d0a6163636570743a202a2f2a0d0a6163636570742d656e636f64696e673a20677a69702c6465666c6174652c62720d0a686f73743a20<HONEYPOT>3a343430330d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"41426eb3-9d0c-4a37-8d8c-39004256d8c2","seq":1,"duration_ms":100,"bytes_in":105,"bytes_out":78},{"timestamp":"2026-09-09T21:12:56","port":4403,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip,deflate,br\",\"host\":\"<HONEYPOT>:4403\"}","body":"","sni":"","tls_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","tls_version":"TLSv1.2","alpn":[],"url_path":"/login?redir=%2F","summary":"","payload_hex":"474554202f6c6f67696e3f72656469723d25324620485454502f312e310d0a6163636570743a202a2f2a0d0a6163636570742d656e636f64696e673a20677a69702c6465666c6174652c62720d0a686f73743a20<HONEYPOT>3a343430330d0a0d0a","method":"GET","user_agent":"","ja3":"c12f54a3f91dc7bafd92cb59fe009a35","session":"bbcf56ea-c997-422b-ad53-3698e426ad98","seq":1,"duration_ms":793,"bytes_in":105,"bytes_out":78},{"timestamp":"2026-09-09T21:12:54","port":4403,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip,deflate,br\",\"host\":\"<HONEYPOT>:4403\"}","body":"","sni":"","tls_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","tls_version":"TLSv1.2","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a6163636570743a202a2f2a0d0a6163636570742d656e636f64696e673a20677a69702c6465666c6174652c62720d0a686f73743a20<HONEYPOT>3a343430330d0a0d0a","method":"GET","user_agent":"","ja3":"c12f54a3f91dc7bafd92cb59fe009a35","session":"8e3186c2-95f6-4f53-a0b6-eefd459b3cd0","seq":1,"duration_ms":755,"bytes_in":90,"bytes_out":78},{"timestamp":"2026-09-09T19:30:49","port":2222,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip,deflate,br\",\"host\":\"<HONEYPOT>:2222\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/login?redir=%2F","summary":"","payload_hex":"474554202f6c6f67696e3f72656469723d25324620485454502f312e310d0a6163636570743a202a2f2a0d0a6163636570742d656e636f64696e673a20677a69702c6465666c6174652c62720d0a686f73743a20<HONEYPOT>3a323232320d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"88495e35-8169-41ce-ae6d-d7b74f5bbb67","seq":1,"duration_ms":101,"bytes_in":105,"bytes_out":78},{"timestamp":"2026-09-09T19:30:47","port":2222,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip,deflate,br\",\"host\":\"<HONEYPOT>:2222\"}","body":"","sni":"","tls_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","tls_version":"TLSv1.2","alpn":[],"url_path":"/login?redir=%2F","summary":"","payload_hex":"474554202f6c6f67696e3f72656469723d25324620485454502f312e310d0a6163636570743a202a2f2a0d0a6163636570742d656e636f64696e673a20677a69702c6465666c6174652c62720d0a686f73743a20<HONEYPOT>3a323232320d0a0d0a","method":"GET","user_agent":"","ja3":"c12f54a3f91dc7bafd92cb59fe009a35","session":"6494c86f-0cb1-4e94-bd9d-28439e037750","seq":1,"duration_ms":888,"bytes_in":105,"bytes_out":78},{"timestamp":"2026-09-09T19:30:45","port":2222,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip,deflate,br\",\"host\":\"<HONEYPOT>:2222\"}","body":"","sni":"","tls_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","tls_version":"TLSv1.2","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a6163636570743a202a2f2a0d0a6163636570742d656e636f64696e673a20677a69702c6465666c6174652c62720d0a686f73743a20<HONEYPOT>3a323232320d0a0d0a","method":"GET","user_agent":"","ja3":"c12f54a3f91dc7bafd92cb59fe009a35","session":"e9b0b5e9-c5a8-411b-a176-9aac4d3a8fa1","seq":1,"duration_ms":807,"bytes_in":90,"bytes_out":78},{"timestamp":"2026-09-09T13:25:10","port":82,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip,deflate,br\",\"host\":\"<HONEYPOT>:82\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/login?redir=%2F","summary":"","payload_hex":"474554202f6c6f67696e3f72656469723d25324620485454502f312e310d0a6163636570743a202a2f2a0d0a6163636570742d656e636f64696e673a20677a69702c6465666c6174652c62720d0a686f73743a20<HONEYPOT>3a38320d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"036edeaf-3063-4949-a8ea-d85097e7e17f","seq":1,"duration_ms":100,"bytes_in":103,"bytes_out":78}],"http_methods":[{"method":"GET","count":270}],"distinct_ports_total":20,"top_paths":[{"path":"/login?redir=%2F","count":180,"ports":20},{"path":"/","count":90,"ports":20}],"distinct_paths_total":2,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","Accept-Encoding","Host"],"representative":[{"name":"Accept","value":"*/*","notable":false},{"name":"Accept-Encoding","value":"gzip,deflate,br","notable":false},{"name":"Host","value":"<HONEYPOT>:443","notable":false}],"distinct_sets":1,"events_with_headers":10},"tags":[],"data_as_of":"2026-09-22T11:51:33.852869+00:00"}