{"ip":"77.239.124.111","data_as_of":"2026-10-27T00:30:33+00:00","observed":true,"total_events":11,"verdict":{"verdict":"probing","label":"Low-level probing","detail":null,"confidence":"low","network_type":null,"why":["20 event(s), fewer than 10 distinct ports, no exploit payloads.","Not in any known-scanner range.","Sent 4,456 bytes to few ports with no known exploit path, which is focused interaction with one service.","Counts include 9 interactive session(s) as well as first-packet events."],"engagement":{"level":"payload","label":"Sustained payload","detail":"4,456 bytes sent","bytes_sent":4456,"session_seconds":10,"persistent":false},"basis":"combined"},"first_seen":"2026-10-19T04:26:19","last_seen":"2026-10-26T17:35:54","events_24h":4,"events_7d":11,"interactive_sessions":9,"interactive_sessions_24h":1,"interactive_sessions_7d":8,"interactive_protocols":[{"protocol":"http","sessions":5},{"protocol":"adb","sessions":2}],"geo":{"country_code":"US","country_name":"United States","region":"","city":"","lat":37.751,"lon":-97.822,"asn":198364,"org":"Banatsync Srl"},"source_domain":null,"known_scanners":[],"scanner_tag":null,"cve_matches":[],"malware":[],"udp":null,"interaction":{"window_days":90,"sessions":9,"first_seen":"2026-10-19T04:26:19","last_seen":"2026-10-26T01:24:54","verdicts":[{"verdict":"scan","sessions":6},{"verdict":"unknown","sessions":3}],"personas":[{"persona":"nginx@1.24.0, wordpress@6.5.2, leaks@2, miner@bfgminer 5.5.0, elasticsearch@6.8.23, winrm@Windows Server 2016, fortigate@7.0.5, docker@25.0.3","sessions":4},{"persona":"adb@Android 9 TV box","sessions":2},{"persona":"nginx@1.24.0, wordpress@6.5.2, leaks@2, miner@bfgminer 5.5.0, elasticsearch@6.8.23, winrm@Windows Server 2016, dlink-dir645@1.01, fortigate@7.0.5","sessions":1}],"services":[{"protocol":"http","port":7681,"sessions":4},{"protocol":"adb","port":5555,"sessions":2},{"protocol":"tcp","port":7681,"sessions":2},{"protocol":"http","port":8080,"sessions":1}],"logins":[],"commands":[],"downloads":[],"files":[{"sha256":"5dbad7dd0b9b122dcd9956884390f4aac4738caba8ff53498a7ab6718b176c30","name":"shell-1","size":11,"mime_type":"text/plain","kind":"adb-command","times":1,"first_seen":"2026-10-26T01:24:52","last_seen":"2026-10-26T01:24:52","virustotal":null}],"attack":[{"technique_id":"T1595","technique_name":"Active Scanning","tactic_id":"TA0043","tactic_name":"Reconnaissance","sessions":6}]},"top_ports":[{"port":7681,"proto":"tcp","label":"","count":6,"sessions":6},{"port":5555,"proto":"tcp","label":"","count":4,"sessions":2},{"port":5585,"proto":"tcp","label":"","count":1,"sessions":0},{"port":8080,"proto":"tcp","label":"HTTP-alt","count":0,"sessions":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i131000_f57a46bbacb6_ab7e3b40a677"],"tls_client_hello":"16030105c6010005c20303abfd74a113acf15b6cfdf34aa3807a55157f1cbfd5223c69d6852e0602dbc02220344b59c0fe322062879a861631d4b7aa91fe26132acba83f562909718b3213f4001ac02bc02fc02cc030cca9cca8c009c013c00ac0141301130213030100055f000b00020100ff010001000017000000120000000500050100000000000a0010000e11ec11eb11ed001d001700180019000d0016001408040403080708050806040105010601050306030032001a0018080404030807080508060401050106010503060302010203002b00050403040303003304ea04e811ec04c0568b09bd512ca334655da76def9421e03b3ce9e89282c9227799393598728e727f367a3e0f720951578141593162944b3365078498300e620c2df9926f884cd7d88d4f5759d01b1c8fe14b9a3c851c956baa0043e361702849639d7342d6571b7c1b3120d99a14d8c41674cc315c875baa0d4443307535aee7c2710c55320030393c8a951f62a51ef99a557429d4cace92d18c17895f4291bcdec80b45e3866385bfe45c0f51d5402de6a118e80a502797a5170b8a34424bf5c84c055d594a9cd6d3c33050a3cd352509961f5e8c0d9d10cc91679a58f6ce037a2e1b7b813a51025144b9e2a34adc0678b00607537676d1620eabac7299c1286844663a579fb23c3553f4267fb33f2db018a2f3b52f258c31e9ba3c360527b73b8e664049339b63dcb63b2ac6bda41e8d626f1ba98ca280579a1303be2b49284ac2bc283d33bb3a76416a1f77708569c34f5058e892cfd2ba1004eb194c2b7a1e0a7aa8196dd357b449369a79001a9b8314a8c8902dc454bacaa74aea4078dc8f6305b31030b06cb66d2eb6217ca68120e4a9bdfaa15512c71df7839025c9ab9235a9897f4a777f969acb301a7ca2aacc7fa372a7321f9412aaeaa1c98606790d7512712c60f7910bd08009c5da39e0737cf0ab828a947b44c68f9e593186665060a8b6437a993822a07ad5ab79babf0d97497f394c6e37087c02a96516745011cc3ce5192060228f20655ab85333a7b65c1598ab2cc9db2b3e07108af3050373e512ac69be2c845ffcb333c692930ec62022f30368f62d7e898912444b2e064e731cca6b733629c712d2bc4d2cb4cbcb7813c2b22e292066e67912d30c795349978a1318a09a695f4a8ce1858548785492b05bb5da644e993771eac3a1f1c6cdc05afd542b0ec801bc566af28748409c84b25065455875008d13093b7faca6584f264f9cfaae8145c8b825132e8c414c1a8bbffcb7e2177b7ed69f141739148a536d93c5574a3acf06c025c1cf0d8142b4145186d83df59a8ace017b684840e6ebb0d1da1370861c4945913759bb1ca442d5f3040b6a40f15695902b1e640343af2a82884bbf47ab954f480eeb64b7e9a9218f78cc637271b169c0d5d277ac10cb8ce2121f4b70fba97ee101049fb1b48fa5cccc5484ee37b65b5141b3d005cee94a05001786b9b226906c770b8cd0f7143bf12e6f8092b7994bcc5c6eac086d5a2a962098c2032919dfd5a8ea6442b8970402d769f832ccb7bb00fdaab3b08cbe262838a4655b6805b97db6c154e8b05c623f2a658b212b20c593ae58fb56258315bfe50d51cb790e40745c1862f7d52782b81a36b8c77515b540d864cddb29e4c61393ca9a179a77c17773265171332ba6f98ca8da1179ec5736b78279d4829f87b469de28167ea653c91983a2b1c140d109262c5a5f43a6cf466545f63de2ec7fb1076bf807b317a191a9aa6b3d343af99956e41a9c40da4fbf766c87743ca990675533b52e6ac812c2038c4087cc1506cb632f7792b45ce06f06c636185ba37a5bb6b8da44cdd38a43f609e11b2a6c8259a810439ebb58243a5d6c7551d4e8a04c78c839f834ade6076b04146ceb9677236ac0e1574b110e130c34a945719957999f657f686d2b975ff434f475d98ddb5c15daab40dccc56bdd8e4bf81dc8e088bdaee151f065ea6d8f4367c8ad2d4ebcc6d0186a3514f36412060ee07569a0cd32e7c64001d00201f065ea6d8f4367c8ad2d4ebcc6d0186a3514f36412060ee07569a0c","tls_ja3":["725543c78edf669194c11dc7a039b56e"],"http_akin":["b11cun103_50340011_f5d02f95_x9f62a4acfdb1"],"interactive":{"ssh_hassh":[],"tls_ja4":["t13i131000_f57a46bbacb6_ab7e3b40a677"],"tls_ja3":["725543c78edf669194c11dc7a039b56e"]}},"fingerprint_peers":{"t13i131000_f57a46bbacb6_ab7e3b40a677":3147,"b11cun103_50340011_f5d02f95_x9f62a4acfdb1":21},"akin_families":{},"user_agents":["Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36","Go-http-client/1.1"],"timeline":[{"date":"2026-10-19","count":0,"sessions":1},{"date":"2026-10-20","count":4,"sessions":3},{"date":"2026-10-21","count":2,"sessions":3},{"date":"2026-10-25","count":1,"sessions":0},{"date":"2026-10-26","count":4,"sessions":2}],"recent_events":[{"timestamp":"2026-10-26T17:35:54","port":5555,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CNXN\u0000\u0000\u0000\u0001\u0000\u0010\u0000\u0000\u0007\u0000\u0000\u00002\u0002\u0000\u0000����host::\u0000","payload_hex":"434e584e00000001001000000700000032020000bcb1a7b1686f73743a3a00","method":"","user_agent":"","ja3":"","session":"0f5ee1b4-a8a2-45f8-aac6-c78c6f6c1998","seq":1,"duration_ms":100,"bytes_in":31,"bytes_out":14,"enriched":{"digest":"6c0944affd4f5212","strings":["CNXN","host::"]}},{"timestamp":"2026-10-26T04:41:53","port":5555,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CNXN\u0000\u0000\u0000\u0001\u0000\u0010\u0000\u0000\u0007\u0000\u0000\u00002\u0002\u0000\u0000����host::\u0000","payload_hex":"434e584e00000001001000000700000032020000bcb1a7b1686f73743a3a00","method":"","user_agent":"","ja3":"","session":"d4894ad1-2483-4741-94ee-a05645c246cd","seq":1,"duration_ms":100,"bytes_in":31,"bytes_out":14,"enriched":{"digest":"6c0944affd4f5212","strings":["CNXN","host::"]}},{"timestamp":"2026-10-26T04:32:57","port":5555,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CNXN\u0000\u0000\u0000\u0001\u0000\u0010\u0000\u0000\u0007\u0000\u0000\u00002\u0002\u0000\u0000����host::\u0000","payload_hex":"434e584e00000001001000000700000032020000bcb1a7b1686f73743a3a00","method":"","user_agent":"","ja3":"","session":"6a12f72b-f9f8-414c-8c72-89266a3e2b8d","seq":1,"duration_ms":103,"bytes_in":31,"bytes_out":14,"enriched":{"digest":"6c0944affd4f5212","strings":["CNXN","host::"]}},{"timestamp":"2026-10-26T04:24:05","port":5555,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CNXN\u0000\u0000\u0000\u0001\u0000\u0010\u0000\u0000\u0007\u0000\u0000\u00002\u0002\u0000\u0000����host::\u0000","payload_hex":"434e584e00000001001000000700000032020000bcb1a7b1686f73743a3a00","method":"","user_agent":"","ja3":"","session":"3d21a2aa-ada9-4189-952c-ed698144448f","seq":1,"duration_ms":100,"bytes_in":31,"bytes_out":14,"enriched":{"digest":"6c0944affd4f5212","strings":["CNXN","host::"]}},{"timestamp":"2026-10-26T01:24:52","port":5555,"proto":"tcp","app_proto":"adb","app_protocol":"adb","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"OPEN\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0011\u0000\u0000\u0000/\u0006\u0000\u0000����shell:echo hello\n","payload_hex":"4f50454e0100000000000000110000002f060000b0afbab17368656c6c3a6563686f2068656c6c6f0a","method":"","user_agent":"","ja3":"","session":"192e8611-d56a-4ab0-bb11-f7e155e2ac10-3","seq":3,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"cab4872ca3850703","strings":["OPEN","shell:echo hello"]},"interactive":true},{"timestamp":"2026-10-26T01:24:52","port":5555,"proto":"tcp","app_proto":"adb","app_protocol":"adb","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CNXN\u0000\u0000\u0000\u0001\u0000\u0010\u0000\u0000\u0007\u0000\u0000\u00002\u0002\u0000\u0000����host::\u0000","payload_hex":"434e584e00000001001000000700000032020000bcb1a7b1686f73743a3a00","method":"","user_agent":"","ja3":"","session":"192e8611-d56a-4ab0-bb11-f7e155e2ac10-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"6c0944affd4f5212","strings":["CNXN","host::"]},"interactive":true},{"timestamp":"2026-10-25T21:42:44","port":5585,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CNXN\u0000\u0000\u0000\u0001\u0000\u0010\u0000\u0000\u0007\u0000\u0000\u00002\u0002\u0000\u0000����host::\u0000","payload_hex":"434e584e00000001001000000700000032020000bcb1a7b1686f73743a3a00","method":"","user_agent":"","ja3":"","session":"f30d2037-d6b4-42e6-9429-0d020934b0da","seq":1,"duration_ms":104,"bytes_in":31,"bytes_out":14,"enriched":{"digest":"6c0944affd4f5212","strings":["CNXN","host::"]}},{"timestamp":"2026-10-21T20:50:12","port":7681,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"cache-control\":\"no-cache\",\"connection\":\"Upgrade\",\"host\":\"<HONEYPOT>:7681\",\"origin\":\"https://<HONEYPOT>:7681\",\"pragma\":\"no-cache\",\"sec-websocket-key\":\"UokunjxUbXjjQdKwPo6RKg==\",\"sec-websocket-protocol\":\"tty\",\"sec-websocket-version\":\"13\",\"upgrade\":\"websocket\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/ws","summary":"","payload_hex":"474554202f777320485454502f312e310d0a486f73743a20<HONEYPOT>3a373638310d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3133352e302e302e30205361666172692f3533372e33360d0a43616368652d436f6e74726f6c3a206e6f2d63616368650d0a436f6e6e656374696f6e3a20557067726164650d0a4f726967696e3a2068747470733a2f2f<HONEYPOT>3a373638310d0a507261676d613a206e6f2d63616368650d0a5365632d576562536f636b65742d4b65793a20556f6b756e6a785562586a6a51644b77506f36524b673d3d0d0a5365632d576562536f636b65742d50726f746f636f6c3a207474790d0a5365632d576562536f636b65742d56657273696f6e3a2031330d0a557067726164653a20776562736f636b65740d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36","ja3":"725543c78edf669194c11dc7a039b56e","session":"adc927e3-cd91-4d69-b478-c2b081e7adf1","seq":1,"duration_ms":100,"bytes_in":392,"bytes_out":79},{"timestamp":"2026-10-21T20:50:12","port":7681,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"cache-control\":\"no-cache\",\"connection\":\"Upgrade\",\"host\":\"<HONEYPOT>:7681\",\"origin\":\"http://<HONEYPOT>:7681\",\"pragma\":\"no-cache\",\"sec-websocket-key\":\"eYX8Uxtp9wmbtnfGeGX2Yg==\",\"sec-websocket-protocol\":\"tty\",\"sec-websocket-version\":\"13\",\"upgrade\":\"websocket\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/ws","summary":"","payload_hex":"474554202f777320485454502f312e310d0a486f73743a20<HONEYPOT>3a373638310d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3133352e302e302e30205361666172692f3533372e33360d0a43616368652d436f6e74726f6c3a206e6f2d63616368650d0a436f6e6e656374696f6e3a20557067726164650d0a4f726967696e3a20687474703a2f2f<HONEYPOT>3a373638310d0a507261676d613a206e6f2d63616368650d0a5365632d576562536f636b65742d4b65793a20655958385578747039776d62746e66476547583259673d3d0d0a5365632d576562536f636b65742d50726f746f636f6c3a207474790d0a5365632d576562536f636b65742d56657273696f6e3a2031330d0a557067726164653a20776562736f636b65740d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36","ja3":"","session":"1f6ff5cc-b133-4bd3-a470-2c4b6b310b55","seq":1,"duration_ms":100,"bytes_in":391,"bytes_out":79},{"timestamp":"2026-10-21T18:41:11","port":7681,"proto":"tcp","app_proto":"http","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"cache-control\":\"no-cache\",\"connection\":\"Upgrade\",\"host\":\"<HONEYPOT>:7681\",\"origin\":\"https://<HONEYPOT>:7681\",\"pragma\":\"no-cache\",\"sec-websocket-key\":\"+Ui/jIJIvapoK/u+ONnJ2A==\",\"sec-websocket-protocol\":\"tty\",\"sec-websocket-version\":\"13\",\"upgrade\":\"websocket\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"1.3","alpn":[],"url_path":"/ws","summary":"","payload_hex":"474554202f777320485454502f312e310d0a486f73743a203c484f4e4559504f543e3a373638310d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3133352e302e302e30205361666172692f3533372e33360d0a43616368652d436f6e74726f6c3a206e6f2d63616368650d0a436f6e6e656374696f6e3a20557067726164650d0a4f726967696e3a2068747470733a2f2f3c484f4e4559504f543e3a373638310d0a507261676d613a206e6f2d63616368650d0a5365632d576562536f636b65742d4b65793a202b55692f6a494a497661706f4b2f752b4f4e6e4a32413d3d0d0a5365632d576562536f636b65742d50726f746f636f6c3a207474790d0a5365632d576562536f636b65742d56657273696f6e3a2031330d0a557067726164653a20776562736f636b65740d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36","ja3":"725543c78edf669194c11dc7a039b56e","session":"d20144e7-8e0b-4999-adc1-c2c2254772a6-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true}],"http_methods":[{"method":"GET","count":13}],"distinct_ports_total":4,"top_paths":[{"path":"/ws","count":10,"ports":1},{"path":"/","count":1,"ports":1},{"path":"/api/version","count":1,"ports":1},{"path":"/api/config","count":1,"ports":1}],"distinct_paths_total":4,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Cache-Control","Connection","Host","Origin","Pragma","Sec-Websocket-Key","Sec-Websocket-Protocol","Sec-Websocket-Version","Upgrade","User-Agent"],"representative":[{"name":"Cache-Control","value":"no-cache","notable":false},{"name":"Connection","value":"Upgrade","notable":false},{"name":"Host","value":"<HONEYPOT>:7681","notable":false},{"name":"Origin","value":"https://<HONEYPOT>:7681","notable":true},{"name":"Pragma","value":"no-cache","notable":false},{"name":"Sec-Websocket-Key","value":"UokunjxUbXjjQdKwPo6RKg==","notable":false},{"name":"Sec-Websocket-Protocol","value":"tty","notable":false},{"name":"Sec-Websocket-Version","value":"13","notable":false},{"name":"Upgrade","value":"websocket","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36","notable":false}],"distinct_sets":1,"events_with_headers":3},"tags":[]}