{"ip":"77.91.71.24","total_events":223,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"139+ ports swept","confidence":"medium","network_type":null,"why":["No exploit payloads observed.","Swept 139 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"22,926 bytes sent","bytes_sent":22926,"session_seconds":0,"persistent":false}},"first_seen":"2026-07-21T13:54:59","last_seen":"2026-09-16T13:19:09","events_24h":0,"events_7d":44,"geo":{"country_code":"RU","country_name":"Russia","region":"","city":"","lat":55.7386,"lon":37.6068,"asn":211486,"org":"Alferov Aleksey Aleksandrovich"},"source_domain":null,"known_scanners":[],"scanner_tag":null,"cve_matches":[],"malware":[],"top_ports":[{"port":10001,"proto":"tcp","label":"","count":5},{"port":11443,"proto":"tcp","label":"","count":5},{"port":24437,"proto":"tcp","label":"","count":4},{"port":9444,"proto":"tcp","label":"","count":4},{"port":8880,"proto":"tcp","label":"","count":4},{"port":1082,"proto":"tcp","label":"","count":4},{"port":47443,"proto":"tcp","label":"","count":4},{"port":8480,"proto":"tcp","label":"","count":3},{"port":1080,"proto":"tcp","label":"SOCKS","count":3},{"port":8090,"proto":"tcp","label":"","count":3},{"port":448,"proto":"tcp","label":"","count":3},{"port":8095,"proto":"tcp","label":"","count":3},{"port":4444,"proto":"tcp","label":"","count":3},{"port":10440,"proto":"tcp","label":"","count":3},{"port":24431,"proto":"tcp","label":"","count":3}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i130900_f57a46bbacb6_e7c285222651"],"tls_ja3":["6639916abfac56b9257ca216677085bc"],"ja4h":["ge11nn0400_9c3956fad5da","ge11nn0300_0db47b7d240d"]},"fingerprint_peers":{"t13i130900_f57a46bbacb6_e7c285222651":4525,"ge11nn0400_9c3956fad5da":1528,"ge11nn0300_0db47b7d240d":4891},"user_agents":["Go-http-client/1.1"],"timeline":[{"date":"2026-07-21","count":21},{"date":"2026-08-17","count":119},{"date":"2026-08-18","count":39},{"date":"2026-09-15","count":26},{"date":"2026-09-16","count":18}],"recent_events":[{"timestamp":"2026-09-16T13:19:09","port":4432,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:4432\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a343433320d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"6639916abfac56b9257ca216677085bc","session":"c49eb173-c2fb-449d-98b1-3123f70bcacc","seq":1,"duration_ms":100,"bytes_in":117,"bytes_out":76},{"timestamp":"2026-09-16T13:17:23","port":445,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:445\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a3434350d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"6639916abfac56b9257ca216677085bc","session":"d4272cfa-e08c-434f-8519-bd71a2febde6","seq":1,"duration_ms":100,"bytes_in":117,"bytes_out":76},{"timestamp":"2026-09-16T13:17:05","port":4432,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:4432\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a343433320d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"6639916abfac56b9257ca216677085bc","session":"dd59c578-a184-4d66-adec-6e93a951bf9c","seq":1,"duration_ms":100,"bytes_in":117,"bytes_out":76},{"timestamp":"2026-09-16T13:14:47","port":4435,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:4435\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a343433350d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"6639916abfac56b9257ca216677085bc","session":"a2346b43-09a4-424d-b06c-e87cdc810adb","seq":1,"duration_ms":100,"bytes_in":117,"bytes_out":76},{"timestamp":"2026-09-16T13:10:39","port":4431,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:4431\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a343433310d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"6639916abfac56b9257ca216677085bc","session":"a70feebc-15e9-4c68-b1a6-ee1af81fc610","seq":1,"duration_ms":100,"bytes_in":117,"bytes_out":76},{"timestamp":"2026-09-16T13:10:26","port":60443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:60443\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a36303434330d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"6639916abfac56b9257ca216677085bc","session":"035fce54-449a-4c67-9764-a9d3f44a93b3","seq":1,"duration_ms":100,"bytes_in":118,"bytes_out":76},{"timestamp":"2026-09-16T13:08:32","port":4436,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:4436\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a343433360d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"6639916abfac56b9257ca216677085bc","session":"da838e7a-a6f3-4393-bb3d-cc167d0256ba","seq":1,"duration_ms":103,"bytes_in":118,"bytes_out":76},{"timestamp":"2026-09-16T13:06:12","port":4434,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:4434\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a343433340d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"6639916abfac56b9257ca216677085bc","session":"6c52fcb3-93ea-413d-9393-b2b99e8351a8","seq":1,"duration_ms":100,"bytes_in":117,"bytes_out":76},{"timestamp":"2026-09-16T13:05:12","port":445,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:445\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a3434350d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"6639916abfac56b9257ca216677085bc","session":"f7268f39-666f-4d49-b30c-189e75bb298b","seq":1,"duration_ms":100,"bytes_in":116,"bytes_out":76},{"timestamp":"2026-09-16T13:04:17","port":4439,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:4439\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a343433390d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"6639916abfac56b9257ca216677085bc","session":"538a63f5-32d5-4b53-bba5-2113c6ca0f05","seq":1,"duration_ms":100,"bytes_in":117,"bytes_out":76}],"http_methods":[{"method":"GET","count":223}],"distinct_ports_total":139,"top_paths":[{"path":"/","count":223,"ports":139}],"distinct_paths_total":1,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept-Encoding","Connection","Host","User-Agent"],"representative":[{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Connection","value":"close","notable":false},{"name":"Host","value":"<HONEYPOT>:4432","notable":false},{"name":"User-Agent","value":"Go-http-client/1.1","notable":false}],"distinct_sets":1,"events_with_headers":10},"tags":[],"data_as_of":"2026-09-21T10:40:47.928658+00:00"}