{"ip":"71.6.232.27","total_events":135,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"11+ ports swept","confidence":"medium","network_type":null,"why":["No exploit payloads observed.","Swept 11 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"14,341 bytes sent","bytes_sent":14341,"session_seconds":0,"persistent":false}},"first_seen":"2026-02-18T17:43:51","last_seen":"2026-09-14T21:45:39","events_24h":0,"events_7d":0,"geo":{"country_code":"US","country_name":"United States","region":"","city":"","lat":37.751,"lon":-97.822,"asn":10439,"org":"CariNet, Inc."},"source_domain":null,"known_scanners":[],"scanner_tag":null,"cve_matches":[],"malware":[],"udp":{"source_verified":false,"window_days":90,"events":2,"protocols":[{"protocol":"dns","events":2}],"ports":[{"port":53,"events":2}],"dns_questions":[{"name":"a.gtld-servers.net","type":"A","events":2}],"quic_clients":[],"first_seen":"2026-10-05T16:29:33","last_seen":"2026-10-05T16:49:50","recent":[{"timestamp":"2026-10-05T16:49:50","port":53,"src_port":56126,"proto":"udp","app_proto":"dns","app_protocol":"dns","summary":"DNS query A a.gtld-servers.net","payload_hex":"05390100000100000000000001610c67746c642d73657276657273036e65740000010001","sni":"","session":"9954a077-1b73-4246-8179-605b53620ede","bytes_in":36,"source_verified":false,"dns":{"kind":"query","name":"a.gtld-servers.net","type":"A","class":"IN"}},{"timestamp":"2026-10-05T16:29:33","port":53,"src_port":42395,"proto":"udp","app_proto":"dns","app_protocol":"dns","summary":"DNS query A a.gtld-servers.net","payload_hex":"05390100000100000000000001610c67746c642d73657276657273036e65740000010001","sni":"","session":"d8c00f1f-3292-4119-b99c-b41a2cfba44a","bytes_in":36,"source_verified":false,"dns":{"kind":"query","name":"a.gtld-servers.net","type":"A","class":"IN"}}]},"top_ports":[{"port":25,"proto":"tcp","label":"SMTP","count":22},{"port":443,"proto":"tcp","label":"HTTPS","count":19},{"port":80,"proto":"tcp","label":"HTTP","count":17},{"port":3000,"proto":"tcp","label":"Web-alt","count":13},{"port":8080,"proto":"tcp","label":"HTTP-alt","count":12},{"port":27017,"proto":"tcp","label":"MongoDB","count":10},{"port":8443,"proto":"tcp","label":"HTTPS-alt","count":10},{"port":587,"proto":"tcp","label":"SMTP","count":10},{"port":5432,"proto":"tcp","label":"Postgres","count":8},{"port":22,"proto":"tcp","label":"SSH","count":7},{"port":6379,"proto":"tcp","label":"Redis","count":7}],"fingerprints":{"ssh_hassh":["5445c358120b523b688fb5f70acd1122"],"tls_ja4":["t12i130500_2d7513195f68_e51b7354d87f"],"tls_client_hello":"","tls_ja3":["cba7f34191ef2379c1325641f6c6c4f4"],"http_akin":["b11cun040_00040016_aa48e2c8"]},"fingerprint_peers":{"5445c358120b523b688fb5f70acd1122":6,"b11cun040_00040016_aa48e2c8":6048,"t12i130500_2d7513195f68_e51b7354d87f":1080},"akin_families":{},"user_agents":["Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36"],"timeline":[{"date":"2026-07-08","count":3},{"date":"2026-07-13","count":4},{"date":"2026-07-22","count":4},{"date":"2026-07-23","count":3},{"date":"2026-07-27","count":4},{"date":"2026-08-05","count":3},{"date":"2026-08-10","count":4},{"date":"2026-08-17","count":4},{"date":"2026-08-31","count":6},{"date":"2026-09-01","count":2},{"date":"2026-09-02","count":4},{"date":"2026-09-08","count":3},{"date":"2026-09-14","count":2}],"recent_events":[{"timestamp":"2026-09-14T21:45:39","port":8080,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:8080\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a383038300d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3133342e302e302e30205361666172692f3533372e33360d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36","ja3":"","session":"d032ea38-19b9-4da2-a8dc-69e78563f502","seq":1,"duration_ms":100,"bytes_in":204,"bytes_out":76},{"timestamp":"2026-09-14T19:41:08","port":22,"proto":"tcp","app_proto":"","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"SSH-2.0-OpenSSH_6.6.1\r\n\u0000\u0000\u0005�\u0013\u0014\u0006qU�\u0006\u0018~:�T/|�UB9\u0000\u0000\u0001acurve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1\u0000\u0000\u0002[ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa,ssh-dss,ssh-ed25519,ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa,ssh-dss,ssh-ed25519\u0000\u0000\u0000�aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,arcfour256,arcfour128,aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-gcm@openssh.com,aes128-cbc,3des-cbc,arcfour\u0000\u0000\u0000�aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,arcfour256,arcfour128,aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-gcm@openssh.com,aes128-cbc,3des-cbc,arcfour\u0000\u0000\u0000$hmac-sha2-256,hmac-sha1,hmac-sha1-96\u0000\u0000\u0000$hmac-sha2-256,hmac-sha1,hmac-sha1-96\u0000\u0000\u0000\u0004none\u0000\u0000\u0000\u0004none\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000�~��tN�ܸp��'�\t(�X�","payload_hex":"5353482d322e302d4f70656e5353485f362e362e310d0a000005cc13140671558306187e3ad0542f7ceb55423900000161637572766532353531392d736861323536406c69627373682e6f72672c656364682d736861322d6e697374703235362c656364682d736861322d6e697374703338342c656364682d736861322d6e697374703532312c6469666669652d68656c6c6d616e2d67726f757031342d736861312c6469666669652d68656c6c6d616e2d67726f7570312d736861312c637572766532353531392d736861323536406c69627373682e6f72672c656364682d736861322d6e697374703235362c656364682d736861322d6e697374703338342c656364682d736861322d6e697374703532312c6469666669652d68656c6c6d616e2d67726f75702d65786368616e67652d7368613235362c6469666669652d68656c6c6d616e2d67726f75702d65786368616e67652d736861312c6469666669652d68656c6c6d616e2d67726f757031342d736861312c6469666669652d68656c6c6d616e2d67726f7570312d736861310000025b7373682d7273612d636572742d763031406f70656e7373682e636f6d2c7373682d6473732d636572742d763031406f70656e7373682e636f6d2c65636473612d736861322d6e697374703235362d636572742d763031406f70656e7373682e636f6d2c65636473612d736861322d6e697374703338342d636572742d763031406f70656e7373682e636f6d2c65636473612d736861322d6e697374703532312d636572742d763031406f70656e7373682e636f6d2c7373682d656432353531392d636572742d763031406f70656e7373682e636f6d2c65636473612d736861322d6e697374703235362c65636473612d736861322d6e697374703338342c65636473612d736861322d6e697374703532312c7373682d7273612c7373682d6473732c7373682d656432353531392c7373682d7273612d636572742d763031406f70656e7373682e636f6d2c7373682d6473732d636572742d763031406f70656e7373682e636f6d2c65636473612d736861322d6e697374703235362d636572742d763031406f70656e7373682e636f6d2c65636473612d736861322d6e697374703338342d636572742d763031406f70656e7373682e636f6d2c65636473612d736861322d6e697374703532312d636572742d763031406f70656e7373682e636f6d2c7373682d656432353531392d636572742d763031406f70656e7373682e636f6d2c65636473612d736861322d6e697374703235362c65636473612d736861322d6e697374703338342c65636473612d736861322d6e697374703532312c7373682d7273612c7373682d6473732c7373682d65643235353139000000b76165733132382d6374722c6165733139322d6374722c6165733235362d6374722c6165733132382d67636d406f70656e7373682e636f6d2c617263666f75723235362c617263666f75723132382c6165733132382d6374722c6165733139322d6374722c6165733235362d6374722c617263666f75723235362c617263666f75723132382c6165733132382d67636d406f70656e7373682e636f6d2c6165733132382d6362632c336465732d6362632c617263666f7572000000b76165733132382d6374722c6165733139322d6374722c6165733235362d6374722c6165733132382d67636d406f70656e7373682e636f6d2c617263666f75723235362c617263666f75723132382c6165733132382d6374722c6165733139322d6374722c6165733235362d6374722c617263666f75723235362c617263666f75723132382c6165733132382d67636d406f70656e7373682e636f6d2c6165733132382d6362632c336465732d6362632c617263666f757200000024686d61632d736861322d3235362c686d61632d736861312c686d61632d736861312d393600000024686d61632d736861322d3235362c686d61632d736861312c686d61632d736861312d3936000000046e6f6e65000000046e6f6e6500000000000000000000000000ed7eedc0744ee0dcb870e09627ab0928a258bf","method":"","user_agent":"","ja3":"","session":"7498d117-a719-4cc0-8aeb-8b9d34ec9383","seq":1,"duration_ms":148,"bytes_in":1511,"bytes_out":11,"enriched":{"digest":"0aa780a1a01bc2de","label":"SSH","strings":["SSH-2.0-OpenSSH_6.6.1","acurve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-ni…","[ssh-rsa-cert-v01@openssh.com,ssh-dss-cert-v01@openssh.com,ecdsa-sha2-nistp256-c…","aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,arcfour256,arcfour128,ae…","$hmac-sha2-256,hmac-sha1,hmac-sha1-96","none"],"iocs":{"domains":["libssh.org","openssh.com"]}}},{"timestamp":"2026-09-08T04:25:44","port":3000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:3000\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a333030300d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3133342e302e302e30205361666172692f3533372e33360d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36","ja3":"","session":"77f4bdfb-2c1d-4135-a3f1-8d894cdabf59","seq":1,"duration_ms":100,"bytes_in":204,"bytes_out":76},{"timestamp":"2026-09-08T03:55:52","port":3000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:3000\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a333030300d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3133342e302e302e30205361666172692f3533372e33360d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36","ja3":"","session":"4703455c-ac28-4284-8139-220b6799bb29","seq":1,"duration_ms":101,"bytes_in":204,"bytes_out":76},{"timestamp":"2026-09-08T00:48:34","port":3000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:3000\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a333030300d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3133342e302e302e30205361666172692f3533372e33360d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36","ja3":"","session":"428cfac3-4c19-4e94-9e0d-81826fa9497d","seq":1,"duration_ms":100,"bytes_in":205,"bytes_out":76},{"timestamp":"2026-09-02T01:27:51","port":25,"proto":"tcp","app_proto":"","app_protocol":"smtp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"EHLO zx17.quadmetrics.com\r\nQUIT\r\n","payload_hex":"45484c4f207a7831372e717561646d6574726963732e636f6d0d0a515549540d0a","method":"","user_agent":"","ja3":"","session":"a0803b2e-d0b9-417f-a1a9-c8deee6b805e","seq":1,"duration_ms":47,"bytes_in":33,"bytes_out":40,"enriched":{"digest":"2569bf3ab57e0678","label":"SMTP","strings":["EHLO zx17.quadmetrics.com","QUIT"],"iocs":{"domains":["zx17.quadmetrics.com"]}}},{"timestamp":"2026-09-02T00:25:07","port":25,"proto":"tcp","app_proto":"","app_protocol":"smtp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"EHLO zx17.quadmetrics.com\r\nQUIT\r\n","payload_hex":"45484c4f207a7831372e717561646d6574726963732e636f6d0d0a515549540d0a","method":"","user_agent":"","ja3":"","session":"f8f9bb4d-c295-4e50-8e03-6cd0b1210e5d","seq":1,"duration_ms":47,"bytes_in":33,"bytes_out":40,"enriched":{"digest":"2569bf3ab57e0678","label":"SMTP","strings":["EHLO zx17.quadmetrics.com","QUIT"],"iocs":{"domains":["zx17.quadmetrics.com"]}}},{"timestamp":"2026-09-02T00:05:08","port":25,"proto":"tcp","app_proto":"","app_protocol":"smtp","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"EHLO zx17.quadmetrics.com\r\n","payload_hex":"45484c4f207a7831372e717561646d6574726963732e636f6d0d0a","method":"","user_agent":"","ja3":"","session":"50a15ab7-cf9c-4698-8015-48a74678ef7c","seq":1,"duration_ms":100,"bytes_in":27,"bytes_out":40,"enriched":{"digest":"f170216d8922985f","label":"SMTP","strings":["EHLO zx17.quadmetrics.com"],"iocs":{"domains":["zx17.quadmetrics.com"]}}},{"timestamp":"2026-09-02T00:05:08","port":25,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"QUIT\r\n","payload_hex":"515549540d0a","method":"","user_agent":"","ja3":"","session":"50a15ab7-cf9c-4698-8015-48a74678ef7c","seq":2,"duration_ms":150,"bytes_in":33,"bytes_out":54,"enriched":{"digest":"559ce5fcec51fbf7","strings":["QUIT"]}},{"timestamp":"2026-09-01T03:54:27","port":3000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"*/*\",\"accept-encoding\":\"gzip\",\"host\":\"<HONEYPOT>:3000\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a333030300d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3133342e302e302e30205361666172692f3533372e33360d0a4163636570743a202a2f2a0d0a4163636570742d456e636f64696e673a20677a69700d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36","ja3":"","session":"57c14648-2942-476e-9e3a-5c315a449dca","seq":1,"duration_ms":101,"bytes_in":204,"bytes_out":76}],"http_methods":[{"method":"GET","count":58}],"distinct_ports_total":11,"top_paths":[{"path":"/","count":58,"ports":5}],"distinct_paths_total":1,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[{"value":"SSH-2.0-OpenSSH_6.6.1","count":7}],"credentials":[],"header_profile":{"signature":["Accept","Accept-Encoding","Host","User-Agent"],"representative":[{"name":"Accept","value":"*/*","notable":false},{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Host","value":"<HONEYPOT>:8080","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36","notable":false}],"distinct_sets":1,"events_with_headers":5},"tags":[],"data_as_of":"2026-10-05T18:50:43.295405+00:00"}