{"ip":"80.94.95.29","total_events":162,"verdict":{"verdict":"probing","label":"Low-level probing","detail":null,"confidence":"low","network_type":null,"why":["162 event(s), fewer than 10 distinct ports, no exploit payloads.","Not in any known-scanner range.","Sent 22,639 bytes despite few ports and no known exploit path: focused interaction with one service, worth a look."],"engagement":{"level":"payload","label":"Sustained payload","detail":"22,639 bytes sent","bytes_sent":22639,"session_seconds":0,"persistent":false}},"first_seen":"2026-08-21T16:18:05","last_seen":"2026-09-09T22:33:39","events_24h":0,"events_7d":0,"geo":{"country_code":"RO","country_name":"Romania","region":"","city":"","lat":45.9968,"lon":24.997,"asn":204428,"org":"SS-Net"},"source_domain":null,"known_scanners":[],"scanner_tag":null,"cve_matches":[],"malware":[],"top_ports":[{"port":443,"proto":"tcp","label":"HTTPS","count":74},{"port":445,"proto":"tcp","label":"SMB","count":44},{"port":444,"proto":"tcp","label":"","count":44}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i131000_f57a46bbacb6_e5728521abd4"],"tls_client_hello":"","tls_ja3":["2196848d251b217de8b2c037e356c11d"],"http_akin":[]},"fingerprint_peers":{"t13i131000_f57a46bbacb6_e5728521abd4":61},"akin_families":{},"user_agents":["Go-http-client/1.1"],"timeline":[{"date":"2026-08-21","count":24},{"date":"2026-09-03","count":9},{"date":"2026-09-04","count":19},{"date":"2026-09-08","count":65},{"date":"2026-09-09","count":45}],"recent_events":[{"timestamp":"2026-09-09T22:33:39","port":444,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:444\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/rdweb/pages/fr-fr/login.aspx","summary":"","payload_hex":"474554202f72647765622f70616765732f66722d66722f6c6f67696e2e6173707820485454502f312e310d0a486f73743a20<HONEYPOT>3a3434340d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"","session":"7459602c-2c47-4298-8367-e3ec48314b10","seq":1,"duration_ms":100,"bytes_in":146,"bytes_out":76},{"timestamp":"2026-09-09T22:33:39","port":444,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:444\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/rdweb/pages/de-de/login.aspx","summary":"","payload_hex":"474554202f72647765622f70616765732f64652d64652f6c6f67696e2e6173707820485454502f312e310d0a486f73743a20<HONEYPOT>3a3434340d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"","session":"609af0af-8ede-4b5b-bbe0-4ec169e1cfce","seq":1,"duration_ms":100,"bytes_in":146,"bytes_out":76},{"timestamp":"2026-09-09T22:33:39","port":444,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:444\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/rdweb/pages/it-it/login.aspx","summary":"","payload_hex":"474554202f72647765622f70616765732f69742d69742f6c6f67696e2e6173707820485454502f312e310d0a486f73743a20<HONEYPOT>3a3434340d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"","session":"240c5e68-b91c-4110-a279-15d55bc45967","seq":1,"duration_ms":100,"bytes_in":146,"bytes_out":76},{"timestamp":"2026-09-09T22:33:39","port":444,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:444\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/rdweb/pages/nl-nl/login.aspx","summary":"","payload_hex":"474554202f72647765622f70616765732f6e6c2d6e6c2f6c6f67696e2e6173707820485454502f312e310d0a486f73743a20<HONEYPOT>3a3434340d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"","session":"357e4e10-efca-4d78-93b1-16eafd488592","seq":1,"duration_ms":100,"bytes_in":146,"bytes_out":76},{"timestamp":"2026-09-09T22:33:39","port":444,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:444\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/rdweb/pages/zh-cn/login.aspx","summary":"","payload_hex":"474554202f72647765622f70616765732f7a682d636e2f6c6f67696e2e6173707820485454502f312e310d0a486f73743a20<HONEYPOT>3a3434340d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"","session":"af04dc5f-4d27-408c-93e0-5ca268f16d10","seq":1,"duration_ms":100,"bytes_in":146,"bytes_out":76},{"timestamp":"2026-09-09T22:33:39","port":444,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:444\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/rdweb/pages/ja-jp/login.aspx","summary":"","payload_hex":"474554202f72647765622f70616765732f6a612d6a702f6c6f67696e2e6173707820485454502f312e310d0a486f73743a20<HONEYPOT>3a3434340d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"","session":"edf43d32-2c4d-4b67-95cb-cd393e5caa06","seq":1,"duration_ms":100,"bytes_in":146,"bytes_out":76},{"timestamp":"2026-09-09T22:33:38","port":444,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:444\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/rdweb/pages/zh-cn/login.aspx","summary":"","payload_hex":"474554202f72647765622f70616765732f7a682d636e2f6c6f67696e2e6173707820485454502f312e310d0a486f73743a20<HONEYPOT>3a3434340d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"2196848d251b217de8b2c037e356c11d","session":"3ea8dc97-919d-4f16-848d-c53d69e6a08c","seq":1,"duration_ms":100,"bytes_in":146,"bytes_out":76},{"timestamp":"2026-09-09T22:33:38","port":444,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:444\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/rdweb/pages/ja-jp/login.aspx","summary":"","payload_hex":"474554202f72647765622f70616765732f6a612d6a702f6c6f67696e2e6173707820485454502f312e310d0a486f73743a20<HONEYPOT>3a3434340d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"2196848d251b217de8b2c037e356c11d","session":"db1421e6-81c8-470a-9186-e248a92c269b","seq":1,"duration_ms":100,"bytes_in":146,"bytes_out":76},{"timestamp":"2026-09-09T22:33:38","port":444,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:444\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/rdweb/pages/en-us/login.aspx","summary":"","payload_hex":"474554202f72647765622f70616765732f656e2d75732f6c6f67696e2e6173707820485454502f312e310d0a486f73743a20<HONEYPOT>3a3434340d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"","session":"681c81bf-62d7-4551-b854-5a66cc802a45","seq":1,"duration_ms":100,"bytes_in":146,"bytes_out":76},{"timestamp":"2026-09-09T22:33:38","port":444,"proto":"tcp","app_proto":"","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:444\",\"user-agent\":\"Go-http-client/1.1\"}","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/rdweb/pages/pt-br/login.aspx","summary":"","payload_hex":"474554202f72647765622f70616765732f70742d62722f6c6f67696e2e6173707820485454502f312e310d0a486f73743a20<HONEYPOT>3a3434340d0a557365722d4167656e743a20476f2d687474702d636c69656e742f312e310d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Go-http-client/1.1","ja3":"","session":"666e1b8b-4909-441d-898c-33f0ec9c9b11","seq":1,"duration_ms":100,"bytes_in":146,"bytes_out":76}],"http_methods":[{"method":"GET","count":162}],"distinct_ports_total":3,"top_paths":[{"path":"/rdweb/pages/nl-nl/login.aspx","count":13,"ports":3},{"path":"/rdweb/pages/zh-cn/login.aspx","count":13,"ports":3},{"path":"/rdweb/pages/en-us/login.aspx","count":13,"ports":3},{"path":"/rdweb/pages/pt-br/login.aspx","count":13,"ports":3},{"path":"/rdweb/pages/de-de/login.aspx","count":13,"ports":3},{"path":"/rdweb/pages/it-it/login.aspx","count":13,"ports":3},{"path":"/rdweb/pages/ja-jp/login.aspx","count":13,"ports":3},{"path":"/rdweb/pages/fr-fr/login.aspx","count":13,"ports":3},{"path":"/rdweb/pages/es-es/login.aspx","count":13,"ports":3},{"path":"/","count":10,"ports":3},{"path":"/+CSCOE+/logon.html","count":8,"ports":3},{"path":"/+C49E+/logon.html","count":6,"ports":3},{"path":"/remote/login","count":6,"ports":3},{"path":"/admin/","count":3,"ports":1},{"path":"/sslvpnLogin","count":1,"ports":1}],"distinct_paths_total":26,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept-Encoding","Connection","Host","User-Agent"],"representative":[{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Connection","value":"close","notable":false},{"name":"Host","value":"<HONEYPOT>:444","notable":false},{"name":"User-Agent","value":"Go-http-client/1.1","notable":false}],"distinct_sets":1,"events_with_headers":10},"tags":[],"data_as_of":"2026-09-24T12:55:07.814401+00:00"}