{"ip":"80.94.95.146","total_events":132,"verdict":{"verdict":"probing","label":"Low-level probing","detail":null,"confidence":"low","network_type":null,"why":["132 event(s), fewer than 10 distinct ports, no exploit payloads.","Not in any known-scanner range.","Sent 22,066 bytes despite few ports and no known exploit path: focused interaction with one service, worth a look."],"engagement":{"level":"payload","label":"Sustained payload","detail":"22,066 bytes sent","bytes_sent":22066,"session_seconds":0,"persistent":false}},"first_seen":"2026-08-19T07:06:23","last_seen":"2026-08-26T23:40:31","events_24h":0,"events_7d":0,"geo":{"country_code":"RO","country_name":"Romania","region":"","city":"","lat":45.9968,"lon":24.997,"asn":204428,"org":"SS-Net"},"source_domain":null,"known_scanners":[],"scanner_tag":null,"cve_matches":[],"malware":[],"top_ports":[{"port":443,"proto":"tcp","label":"HTTPS","count":95},{"port":8443,"proto":"tcp","label":"HTTPS-alt","count":13},{"port":2443,"proto":"tcp","label":"","count":13},{"port":1443,"proto":"tcp","label":"","count":11}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i131000_f57a46bbacb6_e5728521abd4","t13i1311h2_f57a46bbacb6_e5728521abd4"],"tls_client_hello":"","tls_ja3":["8c5b2f378e481f94b4f82c131798f4d4","2196848d251b217de8b2c037e356c11d"],"http_akin":[]},"fingerprint_peers":{"t13i131000_f57a46bbacb6_e5728521abd4":61,"t13i1311h2_f57a46bbacb6_e5728521abd4":0},"akin_families":{},"user_agents":["Go-http-client/1.1"],"timeline":[{"date":"2026-08-19","count":18},{"date":"2026-08-22","count":48},{"date":"2026-08-24","count":44},{"date":"2026-08-25","count":4},{"date":"2026-08-26","count":18}],"recent_events":[{"timestamp":"2026-08-26T23:40:31","port":443,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:443\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/users/sign_in","summary":"","payload_hex":"474554202f75736572732f7369676e5f696e20485454502f312e310d0a486f73743a20<HONEYPOT>3a3434330d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"","session":"a444ec5f-8ab0-4321-87cb-a0c7cb9b6510","seq":1,"duration_ms":100,"bytes_in":131,"bytes_out":77},{"timestamp":"2026-08-26T23:40:30","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/users/sign_in","summary":"","payload_hex":"474554202f75736572732f7369676e5f696e20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"2196848d251b217de8b2c037e356c11d","session":"5be924e4-e95e-42da-8119-03b19b048983","seq":1,"duration_ms":100,"bytes_in":127,"bytes_out":77},{"timestamp":"2026-08-26T22:38:11","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/remote/login","summary":"","payload_hex":"474554202f72656d6f74652f6c6f67696e20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"2196848d251b217de8b2c037e356c11d","session":"171bdd14-48b2-4a12-b177-f223f4057d9f","seq":1,"duration_ms":100,"bytes_in":126,"bytes_out":77},{"timestamp":"2026-08-26T22:38:11","port":443,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:443\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/remote/login","summary":"","payload_hex":"474554202f72656d6f74652f6c6f67696e20485454502f312e310d0a486f73743a20<HONEYPOT>3a3434330d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"","session":"18c7e9ce-c624-4a0c-ad3d-e05d9f21f5de","seq":1,"duration_ms":100,"bytes_in":130,"bytes_out":77},{"timestamp":"2026-08-26T14:00:29","port":443,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:443\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a3434330d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"","session":"2b6c9430-56d5-414e-8c18-03615d000d3d","seq":1,"duration_ms":100,"bytes_in":118,"bytes_out":77},{"timestamp":"2026-08-26T14:00:28","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"2196848d251b217de8b2c037e356c11d","session":"85fac6fc-cee9-4107-9e64-800f386af036","seq":1,"duration_ms":100,"bytes_in":114,"bytes_out":77},{"timestamp":"2026-08-26T00:10:35","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/admin/","summary":"","payload_hex":"474554202f61646d696e2f20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"2196848d251b217de8b2c037e356c11d","session":"9788eb85-93f4-45ea-946c-5cf908ec0a50","seq":1,"duration_ms":100,"bytes_in":120,"bytes_out":77},{"timestamp":"2026-08-26T00:10:35","port":443,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:443\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/admin/","summary":"","payload_hex":"474554202f61646d696e2f20485454502f312e310d0a486f73743a20<HONEYPOT>3a3434330d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"","session":"f38dbe2b-0825-4727-b39a-2f0b7ed8843d","seq":1,"duration_ms":100,"bytes_in":124,"bytes_out":77},{"timestamp":"2026-08-26T00:10:34","port":443,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:443\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a3434330d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"","session":"68f95e21-82f4-4b4b-9de5-4c13a9916833","seq":1,"duration_ms":100,"bytes_in":118,"bytes_out":77},{"timestamp":"2026-08-26T00:10:34","port":443,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:443\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/users/sign_in","summary":"","payload_hex":"474554202f75736572732f7369676e5f696e20485454502f312e310d0a486f73743a20<HONEYPOT>3a3434330d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"","session":"bb32e8a1-dd38-46ba-9cfe-2d46f75a2f8d","seq":1,"duration_ms":100,"bytes_in":131,"bytes_out":77}],"http_methods":[{"method":"GET","count":117},{"method":"POST","count":15}],"distinct_ports_total":4,"top_paths":[{"path":"/+CSCOE+/logon.html","count":21,"ports":1},{"path":"/+webvpn+/index.html","count":15,"ports":1},{"path":"/","count":10,"ports":1},{"path":"/rdweb/pages/es-es/login.aspx","count":8,"ports":4},{"path":"/rdweb/pages/fr-fr/login.aspx","count":8,"ports":4},{"path":"/rdweb/pages/it-it/login.aspx","count":8,"ports":4},{"path":"/rdweb/pages/de-de/login.aspx","count":8,"ports":4},{"path":"/rdweb/pages/pt-br/login.aspx","count":8,"ports":4},{"path":"/rdweb/pages/en-us/login.aspx","count":7,"ports":4},{"path":"/rdweb/pages/nl-nl/login.aspx","count":7,"ports":4},{"path":"/remote/login","count":6,"ports":1},{"path":"/users/sign_in","count":6,"ports":1},{"path":"/rdweb/pages/ja-jp/login.aspx","count":6,"ports":3},{"path":"/rdweb/pages/zh-cn/login.aspx","count":6,"ports":3},{"path":"/admin/","count":4,"ports":1}],"distinct_paths_total":17,"top_snis":[],"top_hosts":[],"top_alpns":[{"value":"h2, http/1.1","count":30}],"banners":[],"credentials":[{"username":"administrator","password":"P%40ssw0rd","count":1},{"username":"admin","password":"Pa%24%24w0rd","count":1},{"username":"administrator","password":"Welkom01%21","count":1},{"username":"admin","password":"Welkom123","count":1},{"username":"admin","password":"Welkom123%21","count":1},{"username":"administrator","password":"Pa%24%24w0rd","count":1},{"username":"administrator","password":"Welkom01","count":1},{"username":"admin","password":"P%40ssw0rd","count":1},{"username":"admin","password":"xxxxxxxxxxxx","count":1},{"username":"admin","password":"Welkom01%21","count":1}],"header_profile":{"signature":["Accept-Encoding","Connection","Host","User-Agent"],"representative":[{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Connection","value":"close","notable":false},{"name":"Host","value":"<HONEYPOT>:443","notable":false},{"name":"User-Agent","value":"Go-http-client/1.1","notable":false}],"distinct_sets":1,"events_with_headers":10},"tags":[],"data_as_of":"2026-09-24T13:53:41.832793+00:00"}