{"ip":"77.91.71.91","total_events":156,"verdict":{"verdict":"scanning","label":"Unrecognized scanner","detail":"67+ ports swept","confidence":"medium","network_type":null,"why":["No exploit payloads observed.","Swept 67 distinct ports (threshold for a sweep is 10).","Not in any known-scanner range."],"engagement":{"level":"payload","label":"Sustained payload","detail":"16,447 bytes sent","bytes_sent":16447,"session_seconds":0,"persistent":false}},"first_seen":"2026-07-21T13:57:47","last_seen":"2026-09-24T16:19:13","events_24h":0,"events_7d":9,"geo":{"country_code":"RU","country_name":"Russia","region":"","city":"","lat":55.7386,"lon":37.6068,"asn":211486,"org":"Alferov Aleksey Aleksandrovich"},"source_domain":null,"known_scanners":[],"scanner_tag":null,"cve_matches":[],"malware":[],"top_ports":[{"port":444,"proto":"tcp","label":"","count":6},{"port":5000,"proto":"tcp","label":"Web-alt","count":6},{"port":5443,"proto":"tcp","label":"","count":5},{"port":443,"proto":"tcp","label":"HTTPS","count":5},{"port":8443,"proto":"tcp","label":"HTTPS-alt","count":4},{"port":2443,"proto":"tcp","label":"","count":4},{"port":16443,"proto":"tcp","label":"","count":4},{"port":80,"proto":"tcp","label":"HTTP","count":4},{"port":4435,"proto":"tcp","label":"","count":4},{"port":9443,"proto":"tcp","label":"","count":4},{"port":27443,"proto":"tcp","label":"","count":4},{"port":8888,"proto":"tcp","label":"HTTP-alt","count":4},{"port":4432,"proto":"tcp","label":"","count":4},{"port":448,"proto":"tcp","label":"","count":3},{"port":8087,"proto":"tcp","label":"","count":3}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i140900_cbb2034c60b8_e7c285222651","t13i130900_f57a46bbacb6_e7c285222651"],"tls_client_hello":"16030100e8010000e40303fd95cdffef9201836a827e2de0bbc591c5071b4e26cb53e8d2e621c31472bc9e206d3535ad51f08fb4aa6cadab53403823b5cef4218262376075d0f2c75630ee39001cc02bc02fc02cc030cca9cca8c009c013c00ac014c0121301130213030100007f000500050100000000000a000a0008001d001700180019000b00020100000d001a0018080404030807080508060401050106010503060302010203ff010001000017000000120000002b0009080304030303020301003300260024001d00202fe0f5310c04257cc7953fe20242c20eefa73def895c507dcc2f22abaf58c04a","tls_ja3":["6639916abfac56b9257ca216677085bc","ea4a9ae049cfc614efbb3c244abb3fc7"],"http_akin":["a11cun040_0000004b_a4cdfabf","a11cun030_0000004a_c91eaf54"]},"fingerprint_peers":{"t13i140900_cbb2034c60b8_e7c285222651":697,"t13i130900_f57a46bbacb6_e7c285222651":3848,"a11cun040_0000004b_a4cdfabf":18,"a11cun030_0000004a_c91eaf54":225},"akin_families":{"a11cun040_0000004b_a4cdfabf":{"head":"a11cun030_0000004a_c91eaf54","shapes":2,"ips":225},"a11cun030_0000004a_c91eaf54":{"head":"a11cun030_0000004a_c91eaf54","shapes":2,"ips":225}},"user_agents":["Go-http-client/1.1","Mozilla/5.0 SynologyDetect/1.0"],"timeline":[{"date":"2026-07-21","count":10},{"date":"2026-08-17","count":106},{"date":"2026-08-18","count":12},{"date":"2026-09-15","count":9},{"date":"2026-09-16","count":10},{"date":"2026-09-24","count":9}],"recent_events":[{"timestamp":"2026-09-24T16:19:13","port":5000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"application/json\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:5000\",\"user-agent\":\"Mozilla/5.0 SynologyDetect/1.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/webapi/query.cgi?api=SYNO.API.Info&method=query&query=SYNO.API.Auth&version=1","summary":"","payload_hex":"474554202f7765626170692f71756572792e6367693f6170693d53594e4f2e4150492e496e666f266d6574686f643d71756572792671756572793d53594e4f2e4150492e417574682676657273696f6e3d3120485454502f312e310d0a486f73743a20<HONEYPOT>3a353030300d0a557365722d4167656e743a204d6f7a696c6c612f352e302053796e6f6c6f67794465746563742f312e300d0a4163636570743a206170706c69636174696f6e2f6a736f6e0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 SynologyDetect/1.0","ja3":"","session":"b03f6270-3075-417c-bdde-e8e5dcb9294a","seq":1,"duration_ms":100,"bytes_in":210,"bytes_out":76},{"timestamp":"2026-09-24T16:19:13","port":5000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"application/json\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:5000\",\"user-agent\":\"Mozilla/5.0 SynologyDetect/1.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/webapi/entry.cgi?api=SYNO.API.Info&method=query&query=SYNO.API.Auth&version=1","summary":"","payload_hex":"474554202f7765626170692f656e7472792e6367693f6170693d53594e4f2e4150492e496e666f266d6574686f643d71756572792671756572793d53594e4f2e4150492e417574682676657273696f6e3d3120485454502f312e310d0a486f73743a20<HONEYPOT>3a353030300d0a557365722d4167656e743a204d6f7a696c6c612f352e302053796e6f6c6f67794465746563742f312e300d0a4163636570743a206170706c69636174696f6e2f6a736f6e0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 SynologyDetect/1.0","ja3":"","session":"42912b74-b257-4c39-8d04-aabd8aad7e69","seq":1,"duration_ms":100,"bytes_in":210,"bytes_out":76},{"timestamp":"2026-09-24T16:19:13","port":5000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"host\":\"<HONEYPOT>:5000\",\"user-agent\":\"Mozilla/5.0 SynologyDetect/1.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a353030300d0a557365722d4167656e743a204d6f7a696c6c612f352e302053796e6f6c6f67794465746563742f312e300d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 SynologyDetect/1.0","ja3":"","session":"2628a23a-8473-4b8c-a51e-5cdd0d9eae5d","seq":1,"duration_ms":100,"bytes_in":107,"bytes_out":76},{"timestamp":"2026-09-24T16:08:02","port":5000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"application/json\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:5000\",\"user-agent\":\"Mozilla/5.0 SynologyDetect/1.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/webapi/query.cgi?api=SYNO.API.Info&method=query&query=SYNO.API.Auth&version=1","summary":"","payload_hex":"474554202f7765626170692f71756572792e6367693f6170693d53594e4f2e4150492e496e666f266d6574686f643d71756572792671756572793d53594e4f2e4150492e417574682676657273696f6e3d3120485454502f312e310d0a486f73743a20<HONEYPOT>3a353030300d0a557365722d4167656e743a204d6f7a696c6c612f352e302053796e6f6c6f67794465746563742f312e300d0a4163636570743a206170706c69636174696f6e2f6a736f6e0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 SynologyDetect/1.0","ja3":"","session":"dea1b1ea-9964-4f2b-adc5-5e4b503e0abd","seq":1,"duration_ms":100,"bytes_in":209,"bytes_out":76},{"timestamp":"2026-09-24T16:08:02","port":5000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"application/json\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:5000\",\"user-agent\":\"Mozilla/5.0 SynologyDetect/1.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/webapi/entry.cgi?api=SYNO.API.Info&method=query&query=SYNO.API.Auth&version=1","summary":"","payload_hex":"474554202f7765626170692f656e7472792e6367693f6170693d53594e4f2e4150492e496e666f266d6574686f643d71756572792671756572793d53594e4f2e4150492e417574682676657273696f6e3d3120485454502f312e310d0a486f73743a20<HONEYPOT>3a353030300d0a557365722d4167656e743a204d6f7a696c6c612f352e302053796e6f6c6f67794465746563742f312e300d0a4163636570743a206170706c69636174696f6e2f6a736f6e0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 SynologyDetect/1.0","ja3":"","session":"9f314c0e-4005-439a-a089-56a7ff889cee","seq":1,"duration_ms":100,"bytes_in":209,"bytes_out":76},{"timestamp":"2026-09-24T16:08:02","port":5000,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"host\":\"<HONEYPOT>:5000\",\"user-agent\":\"Mozilla/5.0 SynologyDetect/1.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a353030300d0a557365722d4167656e743a204d6f7a696c6c612f352e302053796e6f6c6f67794465746563742f312e300d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 SynologyDetect/1.0","ja3":"","session":"e85ead58-2d48-4a2f-95b7-43d9257895a3","seq":1,"duration_ms":100,"bytes_in":106,"bytes_out":76},{"timestamp":"2026-09-24T13:34:12","port":5001,"proto":"tcp","app_proto":"tls","app_protocol":"targusdataspeed","host":"<HONEYPOT>","headers":"{\"accept\":\"application/json\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:5001\",\"user-agent\":\"Mozilla/5.0 SynologyDetect/1.0\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/webapi/query.cgi?api=SYNO.API.Info&method=query&query=SYNO.API.Auth&version=1","summary":"","payload_hex":"474554202f7765626170692f71756572792e6367693f6170693d53594e4f2e4150492e496e666f266d6574686f643d71756572792671756572793d53594e4f2e4150492e417574682676657273696f6e3d3120485454502f312e310d0a486f73743a20<HONEYPOT>3a353030310d0a557365722d4167656e743a204d6f7a696c6c612f352e302053796e6f6c6f67794465746563742f312e300d0a4163636570743a206170706c69636174696f6e2f6a736f6e0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 SynologyDetect/1.0","ja3":"ea4a9ae049cfc614efbb3c244abb3fc7","session":"895a4eec-0826-479c-b386-fbaead3a5347","seq":1,"duration_ms":100,"bytes_in":210,"bytes_out":76},{"timestamp":"2026-09-24T13:34:12","port":5001,"proto":"tcp","app_proto":"tls","app_protocol":"targusdataspeed","host":"<HONEYPOT>","headers":"{\"accept\":\"application/json\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:5001\",\"user-agent\":\"Mozilla/5.0 SynologyDetect/1.0\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/webapi/entry.cgi?api=SYNO.API.Info&method=query&query=SYNO.API.Auth&version=1","summary":"","payload_hex":"474554202f7765626170692f656e7472792e6367693f6170693d53594e4f2e4150492e496e666f266d6574686f643d71756572792671756572793d53594e4f2e4150492e417574682676657273696f6e3d3120485454502f312e310d0a486f73743a20<HONEYPOT>3a353030310d0a557365722d4167656e743a204d6f7a696c6c612f352e302053796e6f6c6f67794465746563742f312e300d0a4163636570743a206170706c69636174696f6e2f6a736f6e0d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 SynologyDetect/1.0","ja3":"ea4a9ae049cfc614efbb3c244abb3fc7","session":"02f20e6a-9b4f-4202-a3d2-cac97658a4b6","seq":1,"duration_ms":100,"bytes_in":210,"bytes_out":76},{"timestamp":"2026-09-24T13:34:12","port":5001,"proto":"tcp","app_proto":"tls","app_protocol":"targusdataspeed","host":"<HONEYPOT>","headers":"{\"connection\":\"close\",\"host\":\"<HONEYPOT>:5001\",\"user-agent\":\"Mozilla/5.0 SynologyDetect/1.0\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a353030310d0a557365722d4167656e743a204d6f7a696c6c612f352e302053796e6f6c6f67794465746563742f312e300d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 SynologyDetect/1.0","ja3":"ea4a9ae049cfc614efbb3c244abb3fc7","session":"7267a827-2b68-456d-b282-5ac6c087349f","seq":1,"duration_ms":101,"bytes_in":107,"bytes_out":76},{"timestamp":"2026-09-16T13:16:11","port":5443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:5443\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a353434330d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"6639916abfac56b9257ca216677085bc","session":"08f4ee76-cc7b-4945-b62e-549202e16a26","seq":1,"duration_ms":100,"bytes_in":117,"bytes_out":76}],"http_methods":[{"method":"GET","count":156}],"distinct_ports_total":67,"top_paths":[{"path":"/","count":150,"ports":67},{"path":"/webapi/query.cgi?api=SYNO.API.Info&method=query&query=SYNO.API.Auth&version=1","count":3,"ports":2},{"path":"/webapi/entry.cgi?api=SYNO.API.Info&method=query&query=SYNO.API.Auth&version=1","count":3,"ports":2}],"distinct_paths_total":3,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept","Connection","Host","User-Agent"],"representative":[{"name":"Accept","value":"application/json","notable":false},{"name":"Connection","value":"close","notable":false},{"name":"Host","value":"<HONEYPOT>:5000","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 SynologyDetect/1.0","notable":false}],"distinct_sets":3,"events_with_headers":10},"tags":[],"data_as_of":"2026-09-29T08:36:14.378828+00:00"}