{"ip":"77.239.124.123","total_events":6,"verdict":{"verdict":"probing","label":"Low-level probing","detail":null,"confidence":"low","network_type":null,"why":["6 event(s), fewer than 10 distinct ports, no exploit payloads.","Not in any known-scanner range."],"engagement":{"level":"request","label":"Request traffic","detail":"2,341 bytes sent","bytes_sent":2341,"session_seconds":0,"persistent":false}},"first_seen":"2026-09-03T00:54:30","last_seen":"2026-09-06T20:42:59","events_24h":0,"events_7d":2,"geo":{"country_code":"US","country_name":"United States","region":"","city":"","lat":37.751,"lon":-97.822,"asn":198364,"org":"Banatsync Srl"},"source_domain":null,"known_scanners":[],"scanner_tag":null,"cve_matches":[],"malware":[],"top_ports":[{"port":7681,"proto":"tcp","label":"","count":6}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i140900_cbb2034c60b8_e7c285222651"],"tls_ja3":["ea4a9ae049cfc614efbb3c244abb3fc7"],"ja4h":["ge11nn1000_80d3711bdbd8"]},"fingerprint_peers":{"t13i140900_cbb2034c60b8_e7c285222651":682,"ge11nn1000_80d3711bdbd8":21},"user_agents":["Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36"],"timeline":[{"date":"2026-09-03","count":4},{"date":"2026-09-06","count":2}],"recent_events":[{"timestamp":"2026-09-06T20:42:59","port":7681,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"cache-control\":\"no-cache\",\"connection\":\"Upgrade\",\"host\":\"<HONEYPOT>:7681\",\"origin\":\"https://<HONEYPOT>:7681\",\"pragma\":\"no-cache\",\"sec-websocket-key\":\"vU9quOEIAGxhF/5T9lu+gA==\",\"sec-websocket-protocol\":\"tty\",\"sec-websocket-version\":\"13\",\"upgrade\":\"websocket\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/ws","summary":"","payload_hex":"474554202f777320485454502f312e310d0a486f73743a20<HONEYPOT>3a373638310d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3133352e302e302e30205361666172692f3533372e33360d0a43616368652d436f6e74726f6c3a206e6f2d63616368650d0a436f6e6e656374696f6e3a20557067726164650d0a4f726967696e3a2068747470733a2f2f<HONEYPOT>3a373638310d0a507261676d613a206e6f2d63616368650d0a5365632d576562536f636b65742d4b65793a2076553971754f454941477868462f3554396c752b67413d3d0d0a5365632d576562536f636b65742d50726f746f636f6c3a207474790d0a5365632d576562536f636b65742d56657273696f6e3a2031330d0a557067726164653a20776562736f636b65740d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36","ja3":"ea4a9ae049cfc614efbb3c244abb3fc7","session":"43c565df-830a-44b4-84de-a7a99f5aa0f7","seq":1,"duration_ms":101,"bytes_in":390,"bytes_out":79},{"timestamp":"2026-09-06T20:42:59","port":7681,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"cache-control\":\"no-cache\",\"connection\":\"Upgrade\",\"host\":\"<HONEYPOT>:7681\",\"origin\":\"http://<HONEYPOT>:7681\",\"pragma\":\"no-cache\",\"sec-websocket-key\":\"H+B2Ipx3ztdgMCdoZVoOPg==\",\"sec-websocket-protocol\":\"tty\",\"sec-websocket-version\":\"13\",\"upgrade\":\"websocket\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/ws","summary":"","payload_hex":"474554202f777320485454502f312e310d0a486f73743a20<HONEYPOT>3a373638310d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3133352e302e302e30205361666172692f3533372e33360d0a43616368652d436f6e74726f6c3a206e6f2d63616368650d0a436f6e6e656374696f6e3a20557067726164650d0a4f726967696e3a20687474703a2f2f<HONEYPOT>3a373638310d0a507261676d613a206e6f2d63616368650d0a5365632d576562536f636b65742d4b65793a20482b4232497078337a7464674d43646f5a566f4f50673d3d0d0a5365632d576562536f636b65742d50726f746f636f6c3a207474790d0a5365632d576562536f636b65742d56657273696f6e3a2031330d0a557067726164653a20776562736f636b65740d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36","ja3":"","session":"57d0f134-0741-43da-9479-fe6ad6aac22b","seq":1,"duration_ms":101,"bytes_in":389,"bytes_out":79},{"timestamp":"2026-09-03T05:19:19","port":7681,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"cache-control\":\"no-cache\",\"connection\":\"Upgrade\",\"host\":\"<HONEYPOT>:7681\",\"origin\":\"https://<HONEYPOT>:7681\",\"pragma\":\"no-cache\",\"sec-websocket-key\":\"rLz6O4YTmRbKgvpIXuP7ZQ==\",\"sec-websocket-protocol\":\"tty\",\"sec-websocket-version\":\"13\",\"upgrade\":\"websocket\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/ws","summary":"","payload_hex":"474554202f777320485454502f312e310d0a486f73743a20<HONEYPOT>3a373638310d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3133352e302e302e30205361666172692f3533372e33360d0a43616368652d436f6e74726f6c3a206e6f2d63616368650d0a436f6e6e656374696f6e3a20557067726164650d0a4f726967696e3a2068747470733a2f2f<HONEYPOT>3a373638310d0a507261676d613a206e6f2d63616368650d0a5365632d576562536f636b65742d4b65793a20724c7a364f3459546d52624b67767049587550375a513d3d0d0a5365632d576562536f636b65742d50726f746f636f6c3a207474790d0a5365632d576562536f636b65742d56657273696f6e3a2031330d0a557067726164653a20776562736f636b65740d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36","ja3":"ea4a9ae049cfc614efbb3c244abb3fc7","session":"fb997bc2-9e99-443a-acd2-93a667ea0f2b","seq":1,"duration_ms":100,"bytes_in":392,"bytes_out":79},{"timestamp":"2026-09-03T05:19:18","port":7681,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"cache-control\":\"no-cache\",\"connection\":\"Upgrade\",\"host\":\"<HONEYPOT>:7681\",\"origin\":\"http://<HONEYPOT>:7681\",\"pragma\":\"no-cache\",\"sec-websocket-key\":\"xJA9e0bNSk8syabo1U2bfw==\",\"sec-websocket-protocol\":\"tty\",\"sec-websocket-version\":\"13\",\"upgrade\":\"websocket\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/ws","summary":"","payload_hex":"474554202f777320485454502f312e310d0a486f73743a20<HONEYPOT>3a373638310d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3133352e302e302e30205361666172692f3533372e33360d0a43616368652d436f6e74726f6c3a206e6f2d63616368650d0a436f6e6e656374696f6e3a20557067726164650d0a4f726967696e3a20687474703a2f2f<HONEYPOT>3a373638310d0a507261676d613a206e6f2d63616368650d0a5365632d576562536f636b65742d4b65793a20784a41396530624e536b38737961626f3155326266773d3d0d0a5365632d576562536f636b65742d50726f746f636f6c3a207474790d0a5365632d576562536f636b65742d56657273696f6e3a2031330d0a557067726164653a20776562736f636b65740d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36","ja3":"","session":"b703b5dc-9572-415c-b72c-4bf083b3eafc","seq":1,"duration_ms":100,"bytes_in":391,"bytes_out":79},{"timestamp":"2026-09-03T00:54:30","port":7681,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"cache-control\":\"no-cache\",\"connection\":\"Upgrade\",\"host\":\"<HONEYPOT>:7681\",\"origin\":\"https://<HONEYPOT>:7681\",\"pragma\":\"no-cache\",\"sec-websocket-key\":\"O6Vfrjx3Nech3edMuCkQww==\",\"sec-websocket-protocol\":\"tty\",\"sec-websocket-version\":\"13\",\"upgrade\":\"websocket\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/ws","summary":"","payload_hex":"474554202f777320485454502f312e310d0a486f73743a20<HONEYPOT>3a373638310d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3133352e302e302e30205361666172692f3533372e33360d0a43616368652d436f6e74726f6c3a206e6f2d63616368650d0a436f6e6e656374696f6e3a20557067726164650d0a4f726967696e3a2068747470733a2f2f<HONEYPOT>3a373638310d0a507261676d613a206e6f2d63616368650d0a5365632d576562536f636b65742d4b65793a204f365666726a78334e6563683365644d75436b5177773d3d0d0a5365632d576562536f636b65742d50726f746f636f6c3a207474790d0a5365632d576562536f636b65742d56657273696f6e3a2031330d0a557067726164653a20776562736f636b65740d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36","ja3":"ea4a9ae049cfc614efbb3c244abb3fc7","session":"72627bda-1b7c-48b3-88af-25ede0433e2f","seq":1,"duration_ms":100,"bytes_in":390,"bytes_out":79},{"timestamp":"2026-09-03T00:54:30","port":7681,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"cache-control\":\"no-cache\",\"connection\":\"Upgrade\",\"host\":\"<HONEYPOT>:7681\",\"origin\":\"http://<HONEYPOT>:7681\",\"pragma\":\"no-cache\",\"sec-websocket-key\":\"80wFNJkwjq2grgasBPp0bQ==\",\"sec-websocket-protocol\":\"tty\",\"sec-websocket-version\":\"13\",\"upgrade\":\"websocket\",\"user-agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/ws","summary":"","payload_hex":"474554202f777320485454502f312e310d0a486f73743a20<HONEYPOT>3a373638310d0a557365722d4167656e743a204d6f7a696c6c612f352e30202857696e646f7773204e542031302e303b2057696e36343b2078363429204170706c655765624b69742f3533372e333620284b48544d4c2c206c696b65204765636b6f29204368726f6d652f3133352e302e302e30205361666172692f3533372e33360d0a43616368652d436f6e74726f6c3a206e6f2d63616368650d0a436f6e6e656374696f6e3a20557067726164650d0a4f726967696e3a20687474703a2f2f<HONEYPOT>3a373638310d0a507261676d613a206e6f2d63616368650d0a5365632d576562536f636b65742d4b65793a20383077464e4a6b776a713267726761734250703062513d3d0d0a5365632d576562536f636b65742d50726f746f636f6c3a207474790d0a5365632d576562536f636b65742d56657273696f6e3a2031330d0a557067726164653a20776562736f636b65740d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36","ja3":"","session":"d044e32d-d631-411c-a6e9-6301e801a012","seq":1,"duration_ms":100,"bytes_in":389,"bytes_out":79}],"http_methods":[{"method":"GET","count":6}],"distinct_ports_total":1,"top_paths":[{"path":"/ws","count":6,"ports":1}],"distinct_paths_total":1,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Cache-Control","Connection","Host","Origin","Pragma","Sec-Websocket-Key","Sec-Websocket-Protocol","Sec-Websocket-Version","Upgrade","User-Agent"],"representative":[{"name":"Cache-Control","value":"no-cache","notable":false},{"name":"Connection","value":"Upgrade","notable":false},{"name":"Host","value":"<HONEYPOT>:7681","notable":false},{"name":"Origin","value":"https://<HONEYPOT>:7681","notable":true},{"name":"Pragma","value":"no-cache","notable":false},{"name":"Sec-Websocket-Key","value":"vU9quOEIAGxhF/5T9lu+gA==","notable":false},{"name":"Sec-Websocket-Protocol","value":"tty","notable":false},{"name":"Sec-Websocket-Version","value":"13","notable":false},{"name":"Upgrade","value":"websocket","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36","notable":false}],"distinct_sets":1,"events_with_headers":6},"tags":[],"data_as_of":"2026-09-11T09:52:17.588194+00:00"}