{"ip":"77.91.71.90","total_events":171,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"61+ ports swept","confidence":"medium","network_type":null,"why":["No exploit payloads observed.","Swept 61 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"19,269 bytes sent","bytes_sent":19269,"session_seconds":0,"persistent":false}},"first_seen":"2026-07-21T13:59:34","last_seen":"2026-09-23T15:08:36","events_24h":29,"events_7d":29,"geo":{"country_code":"RU","country_name":"Russia","region":"","city":"","lat":55.7386,"lon":37.6068,"asn":211486,"org":"Alferov Aleksey Aleksandrovich"},"source_domain":null,"known_scanners":[],"scanner_tag":null,"cve_matches":[],"malware":[],"top_ports":[{"port":5001,"proto":"tcp","label":"","count":20},{"port":5000,"proto":"tcp","label":"Web-alt","count":9},{"port":4434,"proto":"tcp","label":"","count":6},{"port":35443,"proto":"tcp","label":"","count":6},{"port":444,"proto":"tcp","label":"","count":5},{"port":8089,"proto":"tcp","label":"Splunk","count":5},{"port":4443,"proto":"tcp","label":"","count":5},{"port":14443,"proto":"tcp","label":"","count":5},{"port":1443,"proto":"tcp","label":"","count":4},{"port":7443,"proto":"tcp","label":"","count":4},{"port":4432,"proto":"tcp","label":"","count":4},{"port":446,"proto":"tcp","label":"","count":3},{"port":8085,"proto":"tcp","label":"","count":3},{"port":4437,"proto":"tcp","label":"","count":3},{"port":443,"proto":"tcp","label":"HTTPS","count":3}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i140900_cbb2034c60b8_e7c285222651","t13i130900_f57a46bbacb6_e7c285222651"],"tls_client_hello":"16030100e8010000e40303d8288d8e511eb923fe8d32f8eff29440e8ef887ab96fd440fc1205382cf5685920b4179583046458ba1f23d3eac465c2196415c703e53bd310c21fc4457f1b0ebb001cc02bc02fc02cc030cca9cca8c009c013c00ac014c0121301130213030100007f000500050100000000000a000a0008001d001700180019000b00020100000d001a0018080404030807080508060401050106010503060302010203ff010001000017000000120000002b0009080304030303020301003300260024001d00202107f3fac5e1b9237547c1cd9a1248d7ccf2b9b893a83c18e9ad5ea6c27d5950","tls_ja3":["6639916abfac56b9257ca216677085bc","ea4a9ae049cfc614efbb3c244abb3fc7"],"http_akin":["a11cun040_0000004b_a4cdfabf","a11cun030_0000004a_c91eaf54"]},"fingerprint_peers":{"t13i140900_cbb2034c60b8_e7c285222651":658,"t13i130900_f57a46bbacb6_e7c285222651":4415,"a11cun030_0000004a_c91eaf54":71,"a11cun040_0000004b_a4cdfabf":2},"akin_families":{"a11cun040_0000004b_a4cdfabf":{"head":"a11cun030_0000004a_c91eaf54","shapes":2,"ips":71},"a11cun030_0000004a_c91eaf54":{"head":"a11cun030_0000004a_c91eaf54","shapes":2,"ips":71}},"user_agents":["Go-http-client/1.1","Mozilla/5.0 SynologyDetect/1.0"],"timeline":[{"date":"2026-07-21","count":10},{"date":"2026-08-17","count":105},{"date":"2026-08-18","count":17},{"date":"2026-09-15","count":6},{"date":"2026-09-16","count":4},{"date":"2026-09-23","count":29}],"recent_events":[{"timestamp":"2026-09-23T15:08:36","port":5001,"proto":"tcp","app_proto":"tls","app_protocol":"targusdataspeed","host":"<HONEYPOT>","headers":"{\"accept\":\"application/json\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:5001\",\"user-agent\":\"Mozilla/5.0 SynologyDetect/1.0\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/webapi/entry.cgi?api=SYNO.API.Info&method=query&query=SYNO.API.Auth&version=1","summary":"","payload_hex":"474554202f7765626170692f656e7472792e6367693f6170693d53594e4f2e4150492e496e666f266d6574686f643d71756572792671756572793d53594e4f2e4150492e417574682676657273696f6e3d3120485454502f312e310d0a486f73743a20<HONEYPOT>3a353030310d0a557365722d4167656e743a204d6f7a696c6c612f352e302053796e6f6c6f67794465746563742f312e300d0a4163636570743a206170706c69636174696f6e2f6a736f6e0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 SynologyDetect/1.0","ja3":"ea4a9ae049cfc614efbb3c244abb3fc7","session":"ddae6722-354d-4cb0-a428-373a0ecb5c29","seq":1,"duration_ms":100,"bytes_in":209,"bytes_out":76},{"timestamp":"2026-09-23T15:08:36","port":5001,"proto":"tcp","app_proto":"tls","app_protocol":"targusdataspeed","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"host\":\"<HONEYPOT>:5001\",\"user-agent\":\"Mozilla/5.0 SynologyDetect/1.0\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a353030310d0a557365722d4167656e743a204d6f7a696c6c612f352e302053796e6f6c6f67794465746563742f312e300d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 SynologyDetect/1.0","ja3":"ea4a9ae049cfc614efbb3c244abb3fc7","session":"a518f50e-b866-4142-a5c5-b2c467d05806","seq":1,"duration_ms":100,"bytes_in":106,"bytes_out":76},{"timestamp":"2026-09-23T15:08:35","port":5001,"proto":"tcp","app_proto":"tls","app_protocol":"targusdataspeed","host":"<HONEYPOT>","headers":"{\"accept\":\"application/json\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:5001\",\"user-agent\":\"Mozilla/5.0 SynologyDetect/1.0\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/webapi/query.cgi?api=SYNO.API.Info&method=query&query=SYNO.API.Auth&version=1","summary":"","payload_hex":"474554202f7765626170692f71756572792e6367693f6170693d53594e4f2e4150492e496e666f266d6574686f643d71756572792671756572793d53594e4f2e4150492e417574682676657273696f6e3d3120485454502f312e310d0a486f73743a20<HONEYPOT>3a353030310d0a557365722d4167656e743a204d6f7a696c6c612f352e302053796e6f6c6f67794465746563742f312e300d0a4163636570743a206170706c69636174696f6e2f6a736f6e0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 SynologyDetect/1.0","ja3":"ea4a9ae049cfc614efbb3c244abb3fc7","session":"596fff4c-0c42-4bce-ace4-a4e2f451501f","seq":1,"duration_ms":100,"bytes_in":209,"bytes_out":76},{"timestamp":"2026-09-23T15:07:20","port":5001,"proto":"tcp","app_proto":"tls","app_protocol":"targusdataspeed","host":"185.228.81.201","headers":"{\"accept\":\"application/json\",\"connection\":\"close\",\"host\":\"185.228.81.201:5001\",\"user-agent\":\"Mozilla/5.0 SynologyDetect/1.0\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/webapi/query.cgi?api=SYNO.API.Info&method=query&query=SYNO.API.Auth&version=1","summary":"","payload_hex":"474554202f7765626170692f71756572792e6367693f6170693d53594e4f2e4150492e496e666f266d6574686f643d71756572792671756572793d53594e4f2e4150492e417574682676657273696f6e3d3120485454502f312e310d0a486f73743a203138352e3232382e38312e3230313a353030310d0a557365722d4167656e743a204d6f7a696c6c612f352e302053796e6f6c6f67794465746563742f312e300d0a4163636570743a206170706c69636174696f6e2f6a736f6e0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 SynologyDetect/1.0","ja3":"ea4a9ae049cfc614efbb3c244abb3fc7","session":"f50fd8a4-d7b9-4e1c-9ca3-9eff7c4f6568","seq":1,"duration_ms":100,"bytes_in":211,"bytes_out":76},{"timestamp":"2026-09-23T15:07:20","port":5001,"proto":"tcp","app_proto":"tls","app_protocol":"targusdataspeed","host":"185.228.81.201","headers":"{\"accept\":\"application/json\",\"connection\":\"close\",\"host\":\"185.228.81.201:5001\",\"user-agent\":\"Mozilla/5.0 SynologyDetect/1.0\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/webapi/entry.cgi?api=SYNO.API.Info&method=query&query=SYNO.API.Auth&version=1","summary":"","payload_hex":"474554202f7765626170692f656e7472792e6367693f6170693d53594e4f2e4150492e496e666f266d6574686f643d71756572792671756572793d53594e4f2e4150492e417574682676657273696f6e3d3120485454502f312e310d0a486f73743a203138352e3232382e38312e3230313a353030310d0a557365722d4167656e743a204d6f7a696c6c612f352e302053796e6f6c6f67794465746563742f312e300d0a4163636570743a206170706c69636174696f6e2f6a736f6e0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 SynologyDetect/1.0","ja3":"ea4a9ae049cfc614efbb3c244abb3fc7","session":"21495046-26c4-41bd-98fd-39b172bbee87","seq":1,"duration_ms":100,"bytes_in":211,"bytes_out":76},{"timestamp":"2026-09-23T15:07:20","port":5001,"proto":"tcp","app_proto":"tls","app_protocol":"targusdataspeed","host":"185.228.81.201","headers":"{\"connection\":\"close\",\"host\":\"185.228.81.201:5001\",\"user-agent\":\"Mozilla/5.0 SynologyDetect/1.0\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a203138352e3232382e38312e3230313a353030310d0a557365722d4167656e743a204d6f7a696c6c612f352e302053796e6f6c6f67794465746563742f312e300d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 SynologyDetect/1.0","ja3":"ea4a9ae049cfc614efbb3c244abb3fc7","session":"c9ce6a5e-caf4-41a2-9710-5a9e62481879","seq":1,"duration_ms":100,"bytes_in":108,"bytes_out":76},{"timestamp":"2026-09-23T14:55:47","port":5001,"proto":"tcp","app_proto":"tls","app_protocol":"targusdataspeed","host":"192.3.118.146","headers":"{\"accept\":\"application/json\",\"connection\":\"close\",\"host\":\"192.3.118.146:5001\",\"user-agent\":\"Mozilla/5.0 SynologyDetect/1.0\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/webapi/query.cgi?api=SYNO.API.Info&method=query&query=SYNO.API.Auth&version=1","summary":"","payload_hex":"474554202f7765626170692f71756572792e6367693f6170693d53594e4f2e4150492e496e666f266d6574686f643d71756572792671756572793d53594e4f2e4150492e417574682676657273696f6e3d3120485454502f312e310d0a486f73743a203139322e332e3131382e3134363a353030310d0a557365722d4167656e743a204d6f7a696c6c612f352e302053796e6f6c6f67794465746563742f312e300d0a4163636570743a206170706c69636174696f6e2f6a736f6e0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 SynologyDetect/1.0","ja3":"ea4a9ae049cfc614efbb3c244abb3fc7","session":"2e3a5bef-fc6e-4787-98e3-10756f293acf","seq":1,"duration_ms":100,"bytes_in":210,"bytes_out":76},{"timestamp":"2026-09-23T14:55:47","port":5001,"proto":"tcp","app_proto":"tls","app_protocol":"targusdataspeed","host":"192.3.118.146","headers":"{\"accept\":\"application/json\",\"connection\":\"close\",\"host\":\"192.3.118.146:5001\",\"user-agent\":\"Mozilla/5.0 SynologyDetect/1.0\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/webapi/entry.cgi?api=SYNO.API.Info&method=query&query=SYNO.API.Auth&version=1","summary":"","payload_hex":"474554202f7765626170692f656e7472792e6367693f6170693d53594e4f2e4150492e496e666f266d6574686f643d71756572792671756572793d53594e4f2e4150492e417574682676657273696f6e3d3120485454502f312e310d0a486f73743a203139322e332e3131382e3134363a353030310d0a557365722d4167656e743a204d6f7a696c6c612f352e302053796e6f6c6f67794465746563742f312e300d0a4163636570743a206170706c69636174696f6e2f6a736f6e0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 SynologyDetect/1.0","ja3":"ea4a9ae049cfc614efbb3c244abb3fc7","session":"49224a37-6a2e-452b-8235-2568b02b4080","seq":1,"duration_ms":100,"bytes_in":210,"bytes_out":76},{"timestamp":"2026-09-23T14:55:47","port":5001,"proto":"tcp","app_proto":"tls","app_protocol":"targusdataspeed","host":"192.3.118.146","headers":"{\"connection\":\"close\",\"host\":\"192.3.118.146:5001\",\"user-agent\":\"Mozilla/5.0 SynologyDetect/1.0\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a203139322e332e3131382e3134363a353030310d0a557365722d4167656e743a204d6f7a696c6c612f352e302053796e6f6c6f67794465746563742f312e300d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 SynologyDetect/1.0","ja3":"ea4a9ae049cfc614efbb3c244abb3fc7","session":"a32d860c-5f60-4d05-bcc3-7a68a7a194d5","seq":1,"duration_ms":100,"bytes_in":107,"bytes_out":76},{"timestamp":"2026-09-23T14:50:00","port":5001,"proto":"tcp","app_proto":"tls","app_protocol":"targusdataspeed","host":"<HONEYPOT>","headers":"{\"accept\":\"application/json\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:5001\",\"user-agent\":\"Mozilla/5.0 SynologyDetect/1.0\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/webapi/entry.cgi?api=SYNO.API.Info&method=query&query=SYNO.API.Auth&version=1","summary":"","payload_hex":"474554202f7765626170692f656e7472792e6367693f6170693d53594e4f2e4150492e496e666f266d6574686f643d71756572792671756572793d53594e4f2e4150492e417574682676657273696f6e3d3120485454502f312e310d0a486f73743a20<HONEYPOT>3a353030310d0a557365722d4167656e743a204d6f7a696c6c612f352e302053796e6f6c6f67794465746563742f312e300d0a4163636570743a206170706c69636174696f6e2f6a736f6e0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 SynologyDetect/1.0","ja3":"ea4a9ae049cfc614efbb3c244abb3fc7","session":"dafac29b-2ba6-449c-9316-7f545a4d80fc","seq":1,"duration_ms":100,"bytes_in":210,"bytes_out":76}],"http_methods":[{"method":"GET","count":171}],"distinct_ports_total":61,"top_paths":[{"path":"/","count":152,"ports":61},{"path":"/webapi/query.cgi?api=SYNO.API.Info&method=query&query=SYNO.API.Auth&version=1","count":10,"ports":2},{"path":"/webapi/entry.cgi?api=SYNO.API.Info&method=query&query=SYNO.API.Auth&version=1","count":9,"ports":2}],"distinct_paths_total":3,"top_snis":[],"top_hosts":[{"value":"185.228.81.201","count":6},{"value":"192.3.118.146","count":6}],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","Connection","Host","User-Agent"],"representative":[{"name":"Accept","value":"application/json","notable":false},{"name":"Connection","value":"close","notable":false},{"name":"Host","value":"<HONEYPOT>:5001","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 SynologyDetect/1.0","notable":false}],"distinct_sets":2,"events_with_headers":10},"tags":[],"data_as_of":"2026-09-23T16:54:05.959900+00:00"}