{"ip":"69.48.229.164","total_events":8,"verdict":{"verdict":"probing","label":"Low-level probing","detail":null,"confidence":"low","network_type":null,"why":["8 event(s), fewer than 10 distinct ports, no exploit payloads.","Not in any known-scanner range."],"engagement":{"level":"request","label":"Request traffic","detail":"1,066 bytes sent","bytes_sent":1066,"session_seconds":0,"persistent":false}},"first_seen":"2026-09-22T07:22:03","last_seen":"2026-09-22T07:33:55","events_24h":0,"events_7d":0,"geo":{"country_code":"SG","country_name":"Singapore","region":"","city":"","lat":1.3667,"lon":103.8,"asn":399629,"org":"BL Networks"},"source_domain":null,"known_scanners":[],"scanner_tag":null,"cve_matches":[],"malware":[],"top_ports":[{"port":80,"proto":"tcp","label":"HTTP","count":4},{"port":8080,"proto":"tcp","label":"HTTP-alt","count":4}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i311000_e8f1e7e78f70_d41ae481755e"],"tls_client_hello":"1603010200010001fc0303ae250b0b01f735224c10399b8427fcfedc0ad81267246b235e5ac08d479ff542201568f8e724844a3fbb3943523a618d1a8f10d88d79c2f9e98e6a97cf5d5b7d21003e130213031301c02cc030009fcca9cca8ccaac02bc02f009ec024c028006bc023c0270067c00ac0140039c009c0130033009d009c003d003c0035002f00ff01000175000b000403000102000a00160014001d0017001e0019001801000101010201030104002300000016000000170000000d002a0028040305030603080708080809080a080b080408050806040105010601030303010302040205020602002b00050403040303002d00020101003300260024001d0020a74d602af9e3f8431898a0dba97139d6d5741495dbbe16c62c63bbd1ca87e521001500dc00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000","tls_ja3":["c12b4ccd5320bbb380ca1a9df90f771d"],"http_akin":["b11cun020_00040001_78f1f19c","b11cun063_40040001_ffe60107_x9f62a4acfdb1"]},"fingerprint_peers":{"t13i311000_e8f1e7e78f70_d41ae481755e":775,"b11cun020_00040001_78f1f19c":44,"b11cun063_40040001_ffe60107_x9f62a4acfdb1":6},"akin_families":{},"user_agents":[],"timeline":[{"date":"2026-09-22","count":8}],"recent_events":[{"timestamp":"2026-09-22T07:33:55","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"host\":\"<HONEYPOT>\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/api/metrics/run","summary":"","payload_hex":"474554202f6170692f6d6574726963732f72756e20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"9c2ed508-59eb-4115-93f9-249c1d86964a","seq":1,"duration_ms":100,"bytes_in":72,"bytes_out":78},{"timestamp":"2026-09-22T07:33:55","port":80,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"Upgrade\",\"host\":\"<HONEYPOT>\",\"sec-websocket-key\":\"g3AnbMHui/BZ/dTU7AcLRQ==\",\"sec-websocket-protocol\":\"chisel-v3\",\"sec-websocket-version\":\"13\",\"upgrade\":\"websocket\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557067726164653a20776562736f636b65740d0a436f6e6e656374696f6e3a20557067726164650d0a5365632d576562536f636b65742d4b65793a206733416e624d4875692f425a2f6454553741634c52513d3d0d0a5365632d576562536f636b65742d56657273696f6e3a2031330d0a5365632d576562536f636b65742d50726f746f636f6c3a2063686973656c2d76330d0a0d0a","method":"GET","user_agent":"","ja3":"c12b4ccd5320bbb380ca1a9df90f771d","session":"b61432f8-7c30-4c6f-a91e-28f2e1322f0a","seq":1,"duration_ms":100,"bytes_in":186,"bytes_out":78},{"timestamp":"2026-09-22T07:33:54","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"host\":\"<HONEYPOT>\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/7f13c0a9d8644f3ca0a563b6b56e49d7","summary":"","payload_hex":"474554202f376631336330613964383634346633636130613536336236623536653439643720485454502f312e310d0a486f73743a20<HONEYPOT>0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"dee9566f-94c5-4e91-a640-012534b68a2f","seq":1,"duration_ms":101,"bytes_in":89,"bytes_out":78},{"timestamp":"2026-09-22T07:33:54","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"Upgrade\",\"host\":\"<HONEYPOT>\",\"sec-websocket-key\":\"X0ynez9WrtniU46Lhur/6Q==\",\"sec-websocket-protocol\":\"chisel-v3\",\"sec-websocket-version\":\"13\",\"upgrade\":\"websocket\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557067726164653a20776562736f636b65740d0a436f6e6e656374696f6e3a20557067726164650d0a5365632d576562536f636b65742d4b65793a205830796e657a395772746e695534364c6875722f36513d3d0d0a5365632d576562536f636b65742d56657273696f6e3a2031330d0a5365632d576562536f636b65742d50726f746f636f6c3a2063686973656c2d76330d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"a5cf5d30-2dd1-4b3f-a9a1-3dbee9f3e721","seq":1,"duration_ms":101,"bytes_in":186,"bytes_out":78},{"timestamp":"2026-09-22T07:22:03","port":8080,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"Upgrade\",\"host\":\"<HONEYPOT>\",\"sec-websocket-key\":\"MNCKq3cVEypeoR6IT5+oJg==\",\"sec-websocket-protocol\":\"chisel-v3\",\"sec-websocket-version\":\"13\",\"upgrade\":\"websocket\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557067726164653a20776562736f636b65740d0a436f6e6e656374696f6e3a20557067726164650d0a5365632d576562536f636b65742d4b65793a204d4e434b71336356457970656f52364954352b6f4a673d3d0d0a5365632d576562536f636b65742d56657273696f6e3a2031330d0a5365632d576562536f636b65742d50726f746f636f6c3a2063686973656c2d76330d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"efb6aba2-1f3c-42c7-bfb4-293bc45c9c13","seq":1,"duration_ms":101,"bytes_in":186,"bytes_out":78},{"timestamp":"2026-09-22T07:22:03","port":8080,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"host\":\"<HONEYPOT>\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/api/metrics/run","summary":"","payload_hex":"474554202f6170692f6d6574726963732f72756e20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"77e618d1-56fb-4a05-aca7-553bc9730bcd","seq":1,"duration_ms":100,"bytes_in":72,"bytes_out":78},{"timestamp":"2026-09-22T07:22:03","port":8080,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"host\":\"<HONEYPOT>\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/7f13c0a9d8644f3ca0a563b6b56e49d7","summary":"","payload_hex":"474554202f376631336330613964383634346633636130613536336236623536653439643720485454502f312e310d0a486f73743a20<HONEYPOT>0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"0899c080-490f-4684-92a9-d2f8205ed1d3","seq":1,"duration_ms":101,"bytes_in":89,"bytes_out":78},{"timestamp":"2026-09-22T07:22:03","port":8080,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"Upgrade\",\"host\":\"<HONEYPOT>\",\"sec-websocket-key\":\"HJTd6Tve3pOBk+lGHkDPww==\",\"sec-websocket-protocol\":\"chisel-v3\",\"sec-websocket-version\":\"13\",\"upgrade\":\"websocket\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557067726164653a20776562736f636b65740d0a436f6e6e656374696f6e3a20557067726164650d0a5365632d576562536f636b65742d4b65793a20484a54643654766533704f426b2b6c47486b445077773d3d0d0a5365632d576562536f636b65742d56657273696f6e3a2031330d0a5365632d576562536f636b65742d50726f746f636f6c3a2063686973656c2d76330d0a0d0a","method":"GET","user_agent":"","ja3":"c12b4ccd5320bbb380ca1a9df90f771d","session":"59b34265-7941-46ec-9021-0e6dd1093380","seq":1,"duration_ms":100,"bytes_in":186,"bytes_out":78}],"http_methods":[{"method":"GET","count":8}],"distinct_ports_total":2,"top_paths":[{"path":"/","count":4,"ports":2},{"path":"/api/metrics/run","count":2,"ports":2},{"path":"/7f13c0a9d8644f3ca0a563b6b56e49d7","count":2,"ports":2}],"distinct_paths_total":3,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Connection","Host","Sec-Websocket-Key","Sec-Websocket-Protocol","Sec-Websocket-Version","Upgrade"],"representative":[{"name":"Connection","value":"Upgrade","notable":false},{"name":"Host","value":"<HONEYPOT>","notable":false},{"name":"Sec-Websocket-Key","value":"g3AnbMHui/BZ/dTU7AcLRQ==","notable":false},{"name":"Sec-Websocket-Protocol","value":"chisel-v3","notable":false},{"name":"Sec-Websocket-Version","value":"13","notable":false},{"name":"Upgrade","value":"websocket","notable":false}],"distinct_sets":2,"events_with_headers":8},"tags":[],"data_as_of":"2026-10-01T22:14:17.939147+00:00"}