{"ip":"72.5.43.15","total_events":16,"verdict":{"verdict":"probing","label":"Low-level probing","detail":null,"confidence":"low","network_type":null,"why":["16 event(s), fewer than 10 distinct ports, no exploit payloads.","Not in any known-scanner range."],"engagement":{"level":"request","label":"Request traffic","detail":"2,976 bytes sent","bytes_sent":2976,"session_seconds":0,"persistent":false}},"first_seen":"2026-09-19T08:46:11","last_seen":"2026-09-19T10:08:04","events_24h":0,"events_7d":0,"geo":{"country_code":"RO","country_name":"Romania","region":"Bucharest","city":"","lat":44.4291,"lon":26.1006,"asn":399629,"org":"BL Networks"},"source_domain":null,"known_scanners":[],"scanner_tag":null,"cve_matches":[],"malware":[],"top_ports":[{"port":8080,"proto":"tcp","label":"HTTP-alt","count":4},{"port":8888,"proto":"tcp","label":"HTTP-alt","count":2},{"port":8443,"proto":"tcp","label":"HTTPS-alt","count":2},{"port":31337,"proto":"tcp","label":"","count":2},{"port":11601,"proto":"tcp","label":"","count":2},{"port":1337,"proto":"tcp","label":"","count":2},{"port":443,"proto":"tcp","label":"HTTPS","count":2}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i311000_e8f1e7e78f70_d41ae481755e"],"tls_client_hello":"","tls_ja3":["c12b4ccd5320bbb380ca1a9df90f771d"],"http_akin":["b11cun063_40040001_ffe60107_x9f62a4acfdb1"]},"fingerprint_peers":{"t13i311000_e8f1e7e78f70_d41ae481755e":775,"b11cun063_40040001_ffe60107_x9f62a4acfdb1":6},"akin_families":{},"user_agents":[],"timeline":[{"date":"2026-09-19","count":16}],"recent_events":[{"timestamp":"2026-09-19T10:08:04","port":8080,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"Upgrade\",\"host\":\"<HONEYPOT>\",\"sec-websocket-key\":\"9IItX0PNVUXoDvtl9Ir/Pw==\",\"sec-websocket-protocol\":\"chisel-v3\",\"sec-websocket-version\":\"13\",\"upgrade\":\"websocket\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557067726164653a20776562736f636b65740d0a436f6e6e656374696f6e3a20557067726164650d0a5365632d576562536f636b65742d4b65793a20394949745830504e5655586f4476746c3949722f50773d3d0d0a5365632d576562536f636b65742d56657273696f6e3a2031330d0a5365632d576562536f636b65742d50726f746f636f6c3a2063686973656c2d76330d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"e82b3840-7339-45fc-9b16-47cf92a3c2b8","seq":1,"duration_ms":100,"bytes_in":186,"bytes_out":75},{"timestamp":"2026-09-19T10:08:04","port":8080,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"Upgrade\",\"host\":\"<HONEYPOT>\",\"sec-websocket-key\":\"UuJF+V77H52YCeGHWeLmzQ==\",\"sec-websocket-protocol\":\"chisel-v3\",\"sec-websocket-version\":\"13\",\"upgrade\":\"websocket\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557067726164653a20776562736f636b65740d0a436f6e6e656374696f6e3a20557067726164650d0a5365632d576562536f636b65742d4b65793a2055754a462b563737483532594365474857654c6d7a513d3d0d0a5365632d576562536f636b65742d56657273696f6e3a2031330d0a5365632d576562536f636b65742d50726f746f636f6c3a2063686973656c2d76330d0a0d0a","method":"GET","user_agent":"","ja3":"c12b4ccd5320bbb380ca1a9df90f771d","session":"df307097-7c6d-4a94-a522-3b9093b14326","seq":1,"duration_ms":100,"bytes_in":186,"bytes_out":75},{"timestamp":"2026-09-19T09:51:48","port":8080,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"Upgrade\",\"host\":\"<HONEYPOT>\",\"sec-websocket-key\":\"CMVJRWp7mDG/mhw7klzvUg==\",\"sec-websocket-protocol\":\"chisel-v3\",\"sec-websocket-version\":\"13\",\"upgrade\":\"websocket\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557067726164653a20776562736f636b65740d0a436f6e6e656374696f6e3a20557067726164650d0a5365632d576562536f636b65742d4b65793a20434d564a525770376d44472f6d6877376b6c7a7655673d3d0d0a5365632d576562536f636b65742d56657273696f6e3a2031330d0a5365632d576562536f636b65742d50726f746f636f6c3a2063686973656c2d76330d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"e4fa8ad8-4b8e-43ec-9845-87485738fa4a","seq":1,"duration_ms":100,"bytes_in":186,"bytes_out":75},{"timestamp":"2026-09-19T09:51:48","port":8080,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"Upgrade\",\"host\":\"<HONEYPOT>\",\"sec-websocket-key\":\"Jwg63Nr3hySF2mMOP5AFtg==\",\"sec-websocket-protocol\":\"chisel-v3\",\"sec-websocket-version\":\"13\",\"upgrade\":\"websocket\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557067726164653a20776562736f636b65740d0a436f6e6e656374696f6e3a20557067726164650d0a5365632d576562536f636b65742d4b65793a204a776736334e723368795346326d4d4f5035414674673d3d0d0a5365632d576562536f636b65742d56657273696f6e3a2031330d0a5365632d576562536f636b65742d50726f746f636f6c3a2063686973656c2d76330d0a0d0a","method":"GET","user_agent":"","ja3":"c12b4ccd5320bbb380ca1a9df90f771d","session":"fb576838-eb8e-4cb7-b561-082a4acb07bf","seq":1,"duration_ms":101,"bytes_in":186,"bytes_out":75},{"timestamp":"2026-09-19T09:48:50","port":8443,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"Upgrade\",\"host\":\"<HONEYPOT>\",\"sec-websocket-key\":\"4p5/xGRg7fwcOAPLHrzXDQ==\",\"sec-websocket-protocol\":\"chisel-v3\",\"sec-websocket-version\":\"13\",\"upgrade\":\"websocket\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557067726164653a20776562736f636b65740d0a436f6e6e656374696f6e3a20557067726164650d0a5365632d576562536f636b65742d4b65793a203470352f78475267376677634f41504c48727a5844513d3d0d0a5365632d576562536f636b65742d56657273696f6e3a2031330d0a5365632d576562536f636b65742d50726f746f636f6c3a2063686973656c2d76330d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"01db646b-8238-48bd-8f91-087974ad77d2","seq":1,"duration_ms":100,"bytes_in":186,"bytes_out":75},{"timestamp":"2026-09-19T09:48:50","port":8443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"Upgrade\",\"host\":\"<HONEYPOT>\",\"sec-websocket-key\":\"VuUm2oSrN69SDYmGXNVQBw==\",\"sec-websocket-protocol\":\"chisel-v3\",\"sec-websocket-version\":\"13\",\"upgrade\":\"websocket\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557067726164653a20776562736f636b65740d0a436f6e6e656374696f6e3a20557067726164650d0a5365632d576562536f636b65742d4b65793a205675556d326f53724e36395344596d47584e565142773d3d0d0a5365632d576562536f636b65742d56657273696f6e3a2031330d0a5365632d576562536f636b65742d50726f746f636f6c3a2063686973656c2d76330d0a0d0a","method":"GET","user_agent":"","ja3":"c12b4ccd5320bbb380ca1a9df90f771d","session":"22a7065d-49b0-4597-9431-23776333533e","seq":1,"duration_ms":100,"bytes_in":186,"bytes_out":75},{"timestamp":"2026-09-19T09:47:45","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"Upgrade\",\"host\":\"<HONEYPOT>\",\"sec-websocket-key\":\"36WMxR7/sE2sWD26mO7w6w==\",\"sec-websocket-protocol\":\"chisel-v3\",\"sec-websocket-version\":\"13\",\"upgrade\":\"websocket\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557067726164653a20776562736f636b65740d0a436f6e6e656374696f6e3a20557067726164650d0a5365632d576562536f636b65742d4b65793a203336574d7852372f73453273574432366d4f377736773d3d0d0a5365632d576562536f636b65742d56657273696f6e3a2031330d0a5365632d576562536f636b65742d50726f746f636f6c3a2063686973656c2d76330d0a0d0a","method":"GET","user_agent":"","ja3":"c12b4ccd5320bbb380ca1a9df90f771d","session":"2fd58703-da45-485d-8fbc-5bc14929a0b4","seq":1,"duration_ms":101,"bytes_in":186,"bytes_out":75},{"timestamp":"2026-09-19T09:47:44","port":443,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"Upgrade\",\"host\":\"<HONEYPOT>\",\"sec-websocket-key\":\"lgH+lT0b0ne7nVzRWY0jbw==\",\"sec-websocket-protocol\":\"chisel-v3\",\"sec-websocket-version\":\"13\",\"upgrade\":\"websocket\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557067726164653a20776562736f636b65740d0a436f6e6e656374696f6e3a20557067726164650d0a5365632d576562536f636b65742d4b65793a206c67482b6c543062306e65376e567a525759306a62773d3d0d0a5365632d576562536f636b65742d56657273696f6e3a2031330d0a5365632d576562536f636b65742d50726f746f636f6c3a2063686973656c2d76330d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"40fec645-3375-4e61-b5b1-c61ceb558530","seq":1,"duration_ms":100,"bytes_in":186,"bytes_out":75},{"timestamp":"2026-09-19T09:47:40","port":31337,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"Upgrade\",\"host\":\"<HONEYPOT>\",\"sec-websocket-key\":\"DdjPrV4mLqb9961RzBo5fg==\",\"sec-websocket-protocol\":\"chisel-v3\",\"sec-websocket-version\":\"13\",\"upgrade\":\"websocket\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557067726164653a20776562736f636b65740d0a436f6e6e656374696f6e3a20557067726164650d0a5365632d576562536f636b65742d4b65793a2044646a507256346d4c716239393631527a426f3566673d3d0d0a5365632d576562536f636b65742d56657273696f6e3a2031330d0a5365632d576562536f636b65742d50726f746f636f6c3a2063686973656c2d76330d0a0d0a","method":"GET","user_agent":"","ja3":"c12b4ccd5320bbb380ca1a9df90f771d","session":"853e8b96-9d45-4ee0-b2e6-8470de8aff00","seq":1,"duration_ms":100,"bytes_in":186,"bytes_out":75},{"timestamp":"2026-09-19T09:47:39","port":31337,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"Upgrade\",\"host\":\"<HONEYPOT>\",\"sec-websocket-key\":\"hry0zhjGEnfDn8574ELN7Q==\",\"sec-websocket-protocol\":\"chisel-v3\",\"sec-websocket-version\":\"13\",\"upgrade\":\"websocket\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557067726164653a20776562736f636b65740d0a436f6e6e656374696f6e3a20557067726164650d0a5365632d576562536f636b65742d4b65793a20687279307a686a47456e66446e38353734454c4e37513d3d0d0a5365632d576562536f636b65742d56657273696f6e3a2031330d0a5365632d576562536f636b65742d50726f746f636f6c3a2063686973656c2d76330d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"c6821de4-ceeb-4d40-8de5-acb17d5549b8","seq":1,"duration_ms":101,"bytes_in":186,"bytes_out":75}],"http_methods":[{"method":"GET","count":16}],"distinct_ports_total":7,"top_paths":[{"path":"/","count":16,"ports":7}],"distinct_paths_total":1,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Connection","Host","Sec-Websocket-Key","Sec-Websocket-Protocol","Sec-Websocket-Version","Upgrade"],"representative":[{"name":"Connection","value":"Upgrade","notable":false},{"name":"Host","value":"<HONEYPOT>","notable":false},{"name":"Sec-Websocket-Key","value":"9IItX0PNVUXoDvtl9Ir/Pw==","notable":false},{"name":"Sec-Websocket-Protocol","value":"chisel-v3","notable":false},{"name":"Sec-Websocket-Version","value":"13","notable":false},{"name":"Upgrade","value":"websocket","notable":false}],"distinct_sets":1,"events_with_headers":10},"tags":[],"data_as_of":"2026-10-01T22:33:50.084028+00:00"}