{"ip":"80.209.134.1","total_events":17,"verdict":{"verdict":"probing","label":"Low-level probing","detail":null,"confidence":"low","network_type":"nsp","why":["17 event(s), fewer than 10 distinct ports, no exploit payloads.","Not in any known-scanner range."],"engagement":{"level":"request","label":"Request traffic","detail":"732 bytes sent","bytes_sent":732,"session_seconds":0,"persistent":false}},"first_seen":"2026-09-29T22:15:03","last_seen":"2026-09-29T22:15:23","events_24h":17,"events_7d":17,"geo":{"country_code":"GB","country_name":"United Kingdom","region":"England","city":"Tottenham","lat":51.5834,"lon":-0.0755,"asn":51561,"org":"ICUK Computing Services Limited"},"source_domain":"default-80-209-134-1.interdsl.co.uk","known_scanners":[],"scanner_tag":{"key":"peeringdb:as51561","label":"ICUK Computing Services Ltd","category":"isp","url":"https://www.peeringdb.com/asn/51561"},"cve_matches":[],"malware":[],"top_ports":[{"port":80,"proto":"tcp","label":"HTTP","count":8},{"port":4899,"proto":"tcp","label":"","count":7},{"port":445,"proto":"tcp","label":"SMB","count":1},{"port":21,"proto":"tcp","label":"FTP","count":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t12i750600_7f299a1aa72b_4446390ac224"],"tls_client_hello":"1603010200010001fc03038e52012b99930de5fd7543d45d78259c3fa68d7f24410b1869f445f65b32b431000096c030c02cc028c024c014c00ac022c02100a3009f006b006a0039003800880087c032c02ec02ac026c00fc005009d003d00350084008dc012c008c01cc01b00160013c00dc003000a008bc02fc02bc027c023c013c009c01fc01e00a2009e0067004000330032009a009900450044c031c02dc029c025c00ec004009c003c002f00960041008cc011c007c00cc00200050004008a00ff0100013d000b000403000102000a00340032000e000d0019000b000c00180009000a00160017000800060007001400150004000500120013000100020003000f0010001100230000000d0020001e060106020603050105020503040104020403030103020303020102020203000f000101001500cc000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000","tls_ja3":["c547b50b6845f397789bb4d89f8c0692"],"http_akin":["b11cun050_0004001b_a980c670","b10lun000_00000000_334359b9"]},"fingerprint_peers":{"t12i750600_7f299a1aa72b_4446390ac224":1,"b11cun050_0004001b_a980c670":1,"b10lun000_00000000_334359b9":2219},"akin_families":{"b10lun000_00000000_334359b9":{"head":"b10lun000_00000000_334359b9","shapes":2,"ips":2218}},"user_agents":["Mozilla/5.0"],"timeline":[{"date":"2026-09-29","count":17}],"recent_events":[{"timestamp":"2026-09-29T22:15:23","port":445,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0000\u0000��SMBr\u0000\u0000\u0000\u0000\u0018S�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000����\u0000\u0000\u0000\u0000\u0000x\u0000\u0002PC NETWORK PROGRAM 1.0\u0000\u0002LANMAN1.0\u0000\u0002Windows for Workgroups 3.1a\u0000\u0002LM1.2X002\u0000\u0002LANMAN2.1\u0000\u0002NT LM 0.12\u0000\u0002SMB 2.002\u0000\u0002SMB 2.???\u0000","payload_hex":"0000009bff534d4272000000001853c8000000000000000000000000fffffffe00000000007800025043204e4554574f524b2050524f4752414d20312e3000024c414e4d414e312e30000257696e646f777320666f7220576f726b67726f75707320332e316100024c4d312e325830303200024c414e4d414e322e3100024e54204c4d20302e31320002534d4220322e3030320002534d4220322e3f3f3f00","method":"","user_agent":"","ja3":"","session":"5e055289-6b27-49d6-94c9-85a7403f594c","seq":1,"duration_ms":100,"bytes_in":159,"bytes_out":12,"enriched":{"digest":"62b6be8bec717ee4","strings":["SMBr","PC NETWORK PROGRAM 1.0","LANMAN1.0","Windows for Workgroups 3.1a","LM1.2X002","LANMAN2.1","NT LM 0.12","SMB 2.002","SMB 2.???"]}},{"timestamp":"2026-09-29T22:15:22","port":21,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\r\n\r\n","payload_hex":"0d0a0d0a","method":"","user_agent":"","ja3":"","session":"ba3b1dbf-35cd-4637-a460-7327c759afcd","seq":1,"duration_ms":101,"bytes_in":4,"bytes_out":34},{"timestamp":"2026-09-29T22:15:17","port":80,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"","headers":"","body":"","sni":"","tls_cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","tls_version":"TLSv1.2","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e300d0a0d0a","method":"GET","user_agent":"","ja3":"c547b50b6845f397789bb4d89f8c0692","session":"8d4b14a0-2bce-42cd-83a6-8a610cb3d031","seq":1,"duration_ms":198,"bytes_in":18,"bytes_out":77},{"timestamp":"2026-09-29T22:15:11","port":80,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\r\n\r\n","payload_hex":"0d0a0d0a","method":"","user_agent":"","ja3":"","session":"4c18578d-f0b4-4429-ae41-4e3719bb1902","seq":1,"duration_ms":100,"bytes_in":4,"bytes_out":12},{"timestamp":"2026-09-29T22:15:10","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"4f5054494f4e53202f20485454502f312e300d0a0d0a","method":"OPTIONS","user_agent":"","ja3":"","session":"4d2bd9bf-f1cb-4506-93d8-e3cb13dc4a23","seq":1,"duration_ms":100,"bytes_in":22,"bytes_out":77},{"timestamp":"2026-09-29T22:15:10","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"OPTIONS / RTSP/1.0\r\n\r\n","payload_hex":"4f5054494f4e53202f20525453502f312e300d0a0d0a","method":"","user_agent":"","ja3":"","session":"83ff6244-de28-4443-9a53-0cbc6101f3d7","seq":1,"duration_ms":100,"bytes_in":22,"bytes_out":77,"enriched":{"digest":"b6bc3f9a3eb2980d","label":"HTTP","strings":["OPTIONS / RTSP/1.0"]}},{"timestamp":"2026-09-29T22:15:10","port":80,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"l\u0000\u000b\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000","payload_hex":"6c000b000000000000000000","method":"","user_agent":"","ja3":"","session":"a84285f5-e459-4171-8164-fe312f5eee13","seq":1,"duration_ms":100,"bytes_in":12,"bytes_out":12},{"timestamp":"2026-09-29T22:15:09","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/nice%20ports%2C/Tri%6Eity.txt%2ebak","summary":"","payload_hex":"474554202f6e696365253230706f7274732532432f5472692536456974792e74787425326562616b20485454502f312e300d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"06da1f03-dda3-44ac-b044-eca7ab2ea75c","seq":1,"duration_ms":101,"bytes_in":53,"bytes_out":77},{"timestamp":"2026-09-29T22:15:09","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e300d0a0d0a","method":"GET","user_agent":"","ja3":"","session":"add397ef-69ab-489c-b149-3f116d216839","seq":1,"duration_ms":100,"bytes_in":18,"bytes_out":77},{"timestamp":"2026-09-29T22:15:08","port":80,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>-host.colocrossing.com","headers":"{\"accept-encoding\":\"gzip, deflate\",\"accept-language\":\"en-US,*\",\"connection\":\"Keep-Alive\",\"host\":\"<HONEYPOT>-host.colocrossing.com\",\"user-agent\":\"Mozilla/5.0\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a203139322d332d3131382d3134362d686f73742e636f6c6f63726f7373696e672e636f6d0d0a436f6e6e656374696f6e3a204b6565702d416c6976650d0a4163636570742d456e636f64696e673a20677a69702c206465666c6174650d0a4163636570742d4c616e67756167653a20656e2d55532c2a0d0a557365722d4167656e743a204d6f7a696c6c612f352e300d0a0d0a","method":"GET","user_agent":"Mozilla/5.0","ja3":"","session":"1bb68a71-2c28-4607-bbf5-451ef5b2bc91","seq":1,"duration_ms":100,"bytes_in":168,"bytes_out":77}],"http_methods":[{"method":"GET","count":6},{"method":"OPTIONS","count":1}],"distinct_ports_total":4,"top_paths":[{"path":"/","count":6,"ports":2},{"path":"/nice%20ports%2C/Tri%6Eity.txt%2ebak","count":1,"ports":1}],"distinct_paths_total":2,"top_snis":[],"top_hosts":[{"value":"<HONEYPOT>-host.colocrossing.com","count":1}],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept-Encoding","Accept-Language","Connection","Host","User-Agent"],"representative":[{"name":"Accept-Encoding","value":"gzip, deflate","notable":false},{"name":"Accept-Language","value":"en-US,*","notable":false},{"name":"Connection","value":"Keep-Alive","notable":false},{"name":"Host","value":"<HONEYPOT>-host.colocrossing.com","notable":false},{"name":"User-Agent","value":"Mozilla/5.0","notable":false}],"distinct_sets":1,"events_with_headers":1},"tags":[],"data_as_of":"2026-09-30T13:32:10.146712+00:00"}