{"ip":"80.94.95.217","total_events":97,"verdict":{"verdict":"probing","label":"Low-level probing","detail":null,"confidence":"low","network_type":null,"why":["97 event(s), fewer than 10 distinct ports, no exploit payloads.","Not in any known-scanner range.","Sent 23,355 bytes despite few ports and no known exploit path: focused interaction with one service, worth a look."],"engagement":{"level":"payload","label":"Sustained payload","detail":"23,355 bytes sent","bytes_sent":23355,"session_seconds":1,"persistent":false}},"first_seen":"2026-07-06T23:48:13","last_seen":"2026-07-22T17:59:16","events_24h":0,"events_7d":0,"geo":{"country_code":"RO","country_name":"Romania","region":"","city":"","lat":45.9968,"lon":24.997,"asn":204428,"org":"SS-Net"},"source_domain":null,"known_scanners":[],"scanner_tag":null,"cve_matches":[],"malware":[],"top_ports":[{"port":443,"proto":"tcp","label":"HTTPS","count":77},{"port":8443,"proto":"tcp","label":"HTTPS-alt","count":8},{"port":80,"proto":"tcp","label":"HTTP","count":7},{"port":8080,"proto":"tcp","label":"HTTP-alt","count":4},{"port":22,"proto":"tcp","label":"SSH","count":1}],"fingerprints":{"ssh_hassh":["16443846184eafde36765c9bab2f4397"],"tls_ja4":["t13i1311h2_f57a46bbacb6_ab7e3b40a677","t13i191000_9dc949149365_e5728521abd4","t13i1911h2_9dc949149365_e5728521abd4","t13i131000_f57a46bbacb6_ab7e3b40a677"],"tls_ja3":["725543c78edf669194c11dc7a039b56e","60828da5b42313d165aae2938e651b72","cadc9fa1fb68c3ba6ecca8c1cc913cd5","96458b3de39df5d47bc5c4a9f10f8f26"],"ja4h":["ge11nn0400_88d30a62b7ad","ge11nn0800_82bc102cd348","ge11nn0400_9c3956fad5da","po11nn0700_6dcaae4e2e8c"]},"fingerprint_peers":{"t13i191000_9dc949149365_e5728521abd4":140,"t13i1311h2_f57a46bbacb6_ab7e3b40a677":2656,"t13i1911h2_9dc949149365_e5728521abd4":4,"t13i131000_f57a46bbacb6_ab7e3b40a677":5709,"ge11nn0800_82bc102cd348":1,"po11nn0700_6dcaae4e2e8c":1,"ge11nn0400_9c3956fad5da":1485,"ge11nn0400_88d30a62b7ad":4695,"16443846184eafde36765c9bab2f4397":95},"user_agents":["Go-http-client/1.1","nextjs-scanner/1.0 (+authorized-asset-inventory)","Mozilla/5.0 NextJSDetector/2.0","Mozilla/5.0 NextScanner/4.0","Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36"],"timeline":[{"date":"2026-07-06","count":6},{"date":"2026-07-07","count":9},{"date":"2026-07-10","count":1},{"date":"2026-07-12","count":6},{"date":"2026-07-13","count":18},{"date":"2026-07-14","count":8},{"date":"2026-07-15","count":4},{"date":"2026-07-16","count":6},{"date":"2026-07-17","count":3},{"date":"2026-07-19","count":3},{"date":"2026-07-20","count":9},{"date":"2026-07-21","count":12},{"date":"2026-07-22","count":12}],"recent_events":[{"timestamp":"2026-07-22T17:59:16","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\",\"connection\":\"close\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 NextScanner/4.0\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/_next/image?url=%2Ffavicon.ico&w=64&q=75","summary":"","payload_hex":"474554202f5f6e6578742f696d6167653f75726c3d25324666617669636f6e2e69636f26773d363426713d373520485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e30204e6578745363616e6e65722f342e300d0a4163636570743a20746578742f68746d6c2c6170706c69636174696f6e2f7868746d6c2b786d6c2c6170706c69636174696f6e2f786d6c3b713d302e392c2a2f2a3b713d302e380d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 NextScanner/4.0","ja3":"cadc9fa1fb68c3ba6ecca8c1cc913cd5","session":"09571187-8d8b-4275-b7ad-2395111a1e6f","seq":1,"duration_ms":100,"bytes_in":211,"bytes_out":77},{"timestamp":"2026-07-22T17:59:15","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"text/x-component,*/*;q=0.8\",\"connection\":\"close\",\"host\":\"<HONEYPOT>\",\"next-router-prefetch\":\"1\",\"purpose\":\"prefetch\",\"rsc\":\"1\",\"user-agent\":\"Mozilla/5.0 NextScanner/4.0\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e30204e6578745363616e6e65722f342e300d0a4163636570743a20746578742f782d636f6d706f6e656e742c2a2f2a3b713d302e380d0a4e6578742d526f757465722d50726566657463683a20310d0a507572706f73653a2070726566657463680d0a5273633a20310d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 NextScanner/4.0","ja3":"cadc9fa1fb68c3ba6ecca8c1cc913cd5","session":"bea0928c-e6c0-46ba-9c7c-9f4a6a3f5672","seq":1,"duration_ms":100,"bytes_in":186,"bytes_out":77},{"timestamp":"2026-07-22T17:59:15","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\",\"connection\":\"close\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 NextScanner/4.0\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e30204e6578745363616e6e65722f342e300d0a4163636570743a20746578742f68746d6c2c6170706c69636174696f6e2f7868746d6c2b786d6c2c6170706c69636174696f6e2f786d6c3b713d302e392c2a2f2a3b713d302e380d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 NextScanner/4.0","ja3":"cadc9fa1fb68c3ba6ecca8c1cc913cd5","session":"75c1bda7-d901-40b2-93d5-6a576d7ce53c","seq":1,"duration_ms":100,"bytes_in":171,"bytes_out":77},{"timestamp":"2026-07-22T10:27:01","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\",\"connection\":\"close\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 NextScanner/4.0\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/_next/image?url=%2Ffavicon.ico&w=64&q=75","summary":"","payload_hex":"474554202f5f6e6578742f696d6167653f75726c3d25324666617669636f6e2e69636f26773d363426713d373520485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e30204e6578745363616e6e65722f342e300d0a4163636570743a20746578742f68746d6c2c6170706c69636174696f6e2f7868746d6c2b786d6c2c6170706c69636174696f6e2f786d6c3b713d302e392c2a2f2a3b713d302e380d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 NextScanner/4.0","ja3":"cadc9fa1fb68c3ba6ecca8c1cc913cd5","session":"ebd202f8-88cd-4192-a362-f6008d398153","seq":1,"duration_ms":101,"bytes_in":211,"bytes_out":77},{"timestamp":"2026-07-22T10:27:00","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"text/x-component,*/*;q=0.8\",\"connection\":\"close\",\"host\":\"<HONEYPOT>\",\"next-router-prefetch\":\"1\",\"purpose\":\"prefetch\",\"rsc\":\"1\",\"user-agent\":\"Mozilla/5.0 NextScanner/4.0\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e30204e6578745363616e6e65722f342e300d0a4163636570743a20746578742f782d636f6d706f6e656e742c2a2f2a3b713d302e380d0a4e6578742d526f757465722d50726566657463683a20310d0a507572706f73653a2070726566657463680d0a5273633a20310d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 NextScanner/4.0","ja3":"cadc9fa1fb68c3ba6ecca8c1cc913cd5","session":"86be85d6-1f46-4f02-b8ef-d55e844c9db1","seq":1,"duration_ms":100,"bytes_in":186,"bytes_out":77},{"timestamp":"2026-07-22T10:27:00","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\",\"connection\":\"close\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 NextScanner/4.0\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e30204e6578745363616e6e65722f342e300d0a4163636570743a20746578742f68746d6c2c6170706c69636174696f6e2f7868746d6c2b786d6c2c6170706c69636174696f6e2f786d6c3b713d302e392c2a2f2a3b713d302e380d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 NextScanner/4.0","ja3":"cadc9fa1fb68c3ba6ecca8c1cc913cd5","session":"6a999efa-3312-4d1f-8b22-fb05a5a7ec60","seq":1,"duration_ms":100,"bytes_in":171,"bytes_out":77},{"timestamp":"2026-07-22T05:20:14","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\",\"connection\":\"close\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 NextScanner/4.0\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/_next/image?url=%2Ffavicon.ico&w=64&q=75","summary":"","payload_hex":"474554202f5f6e6578742f696d6167653f75726c3d25324666617669636f6e2e69636f26773d363426713d373520485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e30204e6578745363616e6e65722f342e300d0a4163636570743a20746578742f68746d6c2c6170706c69636174696f6e2f7868746d6c2b786d6c2c6170706c69636174696f6e2f786d6c3b713d302e392c2a2f2a3b713d302e380d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 NextScanner/4.0","ja3":"cadc9fa1fb68c3ba6ecca8c1cc913cd5","session":"0c092aee-a28f-45b9-b3dc-b8bc55db9325","seq":1,"duration_ms":102,"bytes_in":211,"bytes_out":77},{"timestamp":"2026-07-22T05:20:12","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"text/x-component,*/*;q=0.8\",\"connection\":\"close\",\"host\":\"<HONEYPOT>\",\"next-router-prefetch\":\"1\",\"purpose\":\"prefetch\",\"rsc\":\"1\",\"user-agent\":\"Mozilla/5.0 NextScanner/4.0\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e30204e6578745363616e6e65722f342e300d0a4163636570743a20746578742f782d636f6d706f6e656e742c2a2f2a3b713d302e380d0a4e6578742d526f757465722d50726566657463683a20310d0a507572706f73653a2070726566657463680d0a5273633a20310d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 NextScanner/4.0","ja3":"cadc9fa1fb68c3ba6ecca8c1cc913cd5","session":"9528cd85-e40e-4234-b8fc-e870b674b312","seq":1,"duration_ms":101,"bytes_in":186,"bytes_out":77},{"timestamp":"2026-07-22T05:20:11","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\",\"connection\":\"close\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 NextScanner/4.0\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e30204e6578745363616e6e65722f342e300d0a4163636570743a20746578742f68746d6c2c6170706c69636174696f6e2f7868746d6c2b786d6c2c6170706c69636174696f6e2f786d6c3b713d302e392c2a2f2a3b713d302e380d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 NextScanner/4.0","ja3":"cadc9fa1fb68c3ba6ecca8c1cc913cd5","session":"cdebf3da-79ab-4272-9a9e-5e98f63f3f16","seq":1,"duration_ms":101,"bytes_in":171,"bytes_out":77},{"timestamp":"2026-07-22T03:23:50","port":443,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept\":\"text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\",\"connection\":\"close\",\"host\":\"<HONEYPOT>\",\"user-agent\":\"Mozilla/5.0 NextScanner/4.0\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":["h2","http/1.1"],"url_path":"/_next/image?url=%2Ffavicon.ico&w=64&q=75","summary":"","payload_hex":"474554202f5f6e6578742f696d6167653f75726c3d25324666617669636f6e2e69636f26773d363426713d373520485454502f312e310d0a486f73743a20<HONEYPOT>0d0a557365722d4167656e743a204d6f7a696c6c612f352e30204e6578745363616e6e65722f342e300d0a4163636570743a20746578742f68746d6c2c6170706c69636174696f6e2f7868746d6c2b786d6c2c6170706c69636174696f6e2f786d6c3b713d302e392c2a2f2a3b713d302e380d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 NextScanner/4.0","ja3":"cadc9fa1fb68c3ba6ecca8c1cc913cd5","session":"dde18675-fd29-4312-b625-d1f9b43e55ce","seq":1,"duration_ms":100,"bytes_in":212,"bytes_out":77}],"http_methods":[{"method":"GET","count":94},{"method":"POST","count":2}],"distinct_ports_total":5,"top_paths":[{"path":"/","count":64,"ports":4},{"path":"/_next/image?url=%2Ffavicon.ico&w=64&q=75","count":20,"ports":2},{"path":"/_next/static/","count":6,"ports":3},{"path":"/_next/static/chunks/","count":6,"ports":3}],"distinct_paths_total":4,"top_snis":[],"top_hosts":[],"top_alpns":[{"value":"h2, http/1.1","count":54}],"banners":[{"value":"SSH-2.0-Go","count":1}],"credentials":[],"header_profile":{"signature":["Accept","Connection","Host","Next-Router-Prefetch","Purpose","Rsc","User-Agent"],"representative":[{"name":"Accept","value":"text/x-component,*/*;q=0.8","notable":false},{"name":"Connection","value":"close","notable":false},{"name":"Host","value":"<HONEYPOT>","notable":false},{"name":"Next-Router-Prefetch","value":"1","notable":false},{"name":"Purpose","value":"prefetch","notable":false},{"name":"Rsc","value":"1","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 NextScanner/4.0","notable":false}],"distinct_sets":2,"events_with_headers":10},"tags":[],"data_as_of":"2026-07-30T17:49:26.356141+00:00"}